fix privileged steps in kubernetes

pipeline/backend/kubernetes/pod.go

@@ -445,7 +445,19 @@ func containerSecurityContext(sc *SecurityContext, stepPrivileged bool) *v1.Secu
 		return nil
 	}
 
+	privileged := false
+
+	// if security context privileged is set explicitly
 	if sc != nil && sc.Privileged != nil && *sc.Privileged {
+		privileged = true
+	}
+
+	// if security context privileged is not set explicitly, but step is privileged
+	if (sc == nil || sc.Privileged == nil) && stepPrivileged {
+		privileged = true
+	}
+
+	if privileged {
 		securityContext := &v1.SecurityContext{
 			Privileged: newBool(true),
 		}

pipeline/backend/kubernetes/pod_test.go

@@ -406,15 +406,21 @@ func TestPodPrivilege(t *testing.T) {
 	}
 	pod, err = createTestPod(true, false, secCtx)
 	assert.NoError(t, err)
-	assert.Equal(t, true, *pod.Spec.Containers[0].SecurityContext.Privileged)
+	assert.True(t, *pod.Spec.Containers[0].SecurityContext.Privileged)
+
+	// step is privileged and no security context is provided
+	secCtx = SecurityContext{}
+	pod, err = createTestPod(true, false, secCtx)
+	assert.NoError(t, err)
+	assert.True(t, *pod.Spec.Containers[0].SecurityContext.Privileged)
 
 	// global runAsNonRoot is true and override is requested value by security context
 	secCtx = SecurityContext{
 		RunAsNonRoot: newBool(false),
 	}
 	pod, err = createTestPod(false, true, secCtx)
 	assert.NoError(t, err)
-	assert.Equal(t, true, *pod.Spec.SecurityContext.RunAsNonRoot)
+	assert.True(t, *pod.Spec.SecurityContext.RunAsNonRoot)
 }
 
 func TestScratchPod(t *testing.T) {

pipeline/frontend/yaml/compiler/compiler_test.go

@@ -342,3 +342,40 @@ func TestSecretMatch(t *testing.T) {
 		})
 	}
 }
+
+func TestCompilerCompilePrivileged(t *testing.T) {
+	compiler := New(
+		WithEscalated("test/image"),
+	)
+
+	fronConf := &yaml_types.Workflow{
+		SkipClone: true,
+		Steps: yaml_types.ContainerList{
+			ContainerList: []*yaml_types.Container{
+				{
+					Name:      "privileged-plugin",
+					Image:     "test/image",
+					DependsOn: []string{}, // no dependencies =>  enable dag mode & all steps are executed in parallel
+				},
+				{
+					Name:     "no-plugin",
+					Image:    "test/image",
+					Commands: []string{"echo 'i am not a plugin anymore'"},
+				},
+				{
+					Name:  "not-privileged-image",
+					Image: "some/other-image",
+				},
+			},
+		},
+	}
+
+	backConf, err := compiler.Compile(fronConf)
+	assert.NoError(t, err)
+
+	assert.Len(t, backConf.Stages, 1)
+	assert.Len(t, backConf.Stages[0].Steps, 3)
+	assert.True(t, backConf.Stages[0].Steps[0].Privileged)
+	assert.False(t, backConf.Stages[0].Steps[1].Privileged)
+	assert.False(t, backConf.Stages[0].Steps[2].Privileged)
+}