Red Hat OpenShift Pipelines release notes

With this update, you cannot use the openshift-operators namespace as the target namespace for installing OpenShift Pipelines. If you used the openshift-operators namespace as the target namespace, change the target namespace before upgrading to Red Hat OpenShift Pipelines Operator version 1.12. Otherwise, after the upgrade, you will not be able to change any configuration settings in the TektonConfig CR except the targetNamespace setting.

With this update, the new spec.pipeline.performance.replicas parameter controls the number of replicas that is created for every pod for a pipeline run or task run. If you previously set the replica counts in your deployment manually, after upgrading to OpenShift Pipelines version 1.12 you must use this parameter to control the replica counts.

With this update, the following parameters are no longer supported in the TektonResult CR:

With this update, the tkn pac bootstrap command supports the --github-hostname flag. The --github-api-url flag is deprecated.

If limit ranges are configured for a namespace, but pod ephemeral storage is not configured in the limit ranges, pods can go into an error stage with the message Pod ephemeral local storage usage exceeds the total limit of containers 0.

If you want to make changes to the configuration in the TektonResult CR, you must delete the existing TektonResult CR and then create a new one. If you change an existing TektonResult CR, the changes are not applied to the existing deployment of Tekton Results. For example, if you change the connection from an internal database server to an external one or vice versa, the API remains connected to the old database.

Before this update, Pipelines as Code ran pipeline runs based only on branch base names, and could incorrectly trigger pipeline runs with the same base name but different branch name. With this update, Pipelines as Code checks both the base name and the exact branch name of a pipeline run.

Before this update, an incoming webhook event could trigger multiple pipeline runs configured for other events. With this update, an incoming webhook event triggers only a pipeline run configured for the webhook event.

With this update, the pac-gitauth secrets are now explicitly deleted when cleaning up a pipeline run, in case the ownerRef on the pipeline run gets removed.

Before this update, when a task in a pipeline run failed with a reason message, the entire pipeline run failed with a PipelineValidationFailed reason. With this update, the pipeline run fails with the same reason message as the task that failed.

Before this update, the disable-ha flag value was not correctly passed to the Pipelines controller, and the high availability (HA) functionality was never enabled. With this update, you can enable the HA functionality by setting the value of the disable-ha flag in the TektonConfig CR to false.

Before this update, the skopeo-copy cluster task would fail when attempting to copy images mentioned in config map data. With this update, the skopeo-copy cluster task completes properly.

With this update, a pipeline run automatically generated by the tkn pac generate –language=java command has correct annotations and parameter names.

Before this update, only a user with the administrative permissions could successfully run the tkn pac create repository command. With this update, any authorized user can run the tkn pac create repository command.

Before this update, the /test <run-name> and /retest <run-name> user comments, which specified a particular pipeline, did not trigger pipeline runs as expected. With this update, these comments trigger pipeline runs successfully.

Before this update, if there were multiple pipeline runs in the .tekton folder with the generateName field and not the Name field, the pipeline runs failed. This update fixes the issue.

Before this update, in Pipelines as Code when using GitLab, a pipeline run was triggered by any event in a merge request, including adding labels and setting status. With this update, the pipeline run is triggered only when there is an open, reopen, or push event. A comment containing the status of the checks is now posted on the merge request.

Before this update, while a pipeline run was waiting for approval, the status of the check could be displayed as skipped in the checks section of GitHub and Gitea pull requests. With this update, the correct pending approval status is displayed.

Before this update, the bundles resolver sometimes set the type to Task when attempting to retrieve a pipeline, leading to errors in retrieval. With this update, the resolver uses the correct type to retrieve a pipeline.

This update fixes an error in processing the Common Expression Language (CEL) NOT operator when querying Tekton Results.

This update fixed a 404 error response that was produced in the Tekton Results API when a LIST operation for records was requested and the specified result was -.

Before this update, in an EventListener object, the status.address.url field was always set to the default port. With this update, the status.address.url field is set to match the port specified in the spec.resources.kubernetesresource.serviceport parameter.

Before this update, if the GitHub API provided a paginated response, Pipelines as Code used only the first page of the response. With this update, all paginated responses are processed fully.

Before this update, the Tekton Chains controller crashed when the host address of KMS Hashicorp Vault was configured incorrectly or when Tekton Chains was unable to connect to the KMS Hashicorp Vault. With this update, Tekton Chains logs the connection error and does not crash.

This update replaces the resource-verification-mode feature flag with a new trusted-resources-verification-no-match-policy flag in the pipeline specification.

With this update, you cannot edit the Tekton Chains CR. Instead, edit the TektonConfig CR to configure Tekton Chains.

This update removes support for the PipelineResource commands and references from Tekton CLI:

This update removes support for the full embedded status from Tekton CLI.

The taskref.bundle and pipelineref.bundle bundles are deprecated and will be removed in a future release.

In Red Hat OpenShift Pipelines 1.11, support for the PipelineResource CR has been removed, use the Task CR instead.

In Red Hat OpenShift Pipelines 1.11, support for the v1alpha1.Run objects has been removed. You must upgrade the objects from v1alpha1.Run to v1beta1.CustomRun before upgrading to this release.

In Red Hat OpenShift Pipelines 1.11, the custom-task-version feature flag has been removed.

In Red Hat OpenShift Pipelines 1.11, the pipelinerun.status.taskRuns and pipelinerun.status.runs fields have been removed along with the embedded-status feature flag. Use the pipelinerun.status.childReferences field instead.

Setting the prune-per-resource boolean field does not delete PipelineRun or TaskRun resources if they were not part of any pipeline or task.

Tekton CLI does not show logs of the PipelineRun resources that are created by using resolvers.

When you filter your pipeline results based on the order_by=created_time+desc&page_size=1 query, you get zero records without any nextPageToken value in the output.

When you set the value of the loglevel.pipelinesascode field to debug, no debugging logs are generated in the Pipelines as Code controller pod. As a workaround, restart the Pipelines as Code controller pod.

Before this update, Pipelines as Code failed to create a PipelineRun resource while detecting the generateName field in the PipelineRun CR. With this update, Pipelines as Code supports providing the generateName field in the PipelineRun CR.

Before this update, when you created a PipelineRun resource from the web console, all annotations would be copied from the pipeline, causing issues for the running nodes. This update now resolves the issue.

This update fixes the tkn pr delete command for the keep flag. Now, if the value of the keep flag is equal to the number of the associated task runs or pipeline runs, then the command returns the exit code 0 along with a message.

Before this update, the Tekton Operator did not expose the performance configuration fields for any customizations. With this update, as a cluster administrator, you can customize the following performance configuration fields in the TektonConfig CR based on your needs:

This update fixes the remote bundle resolver to perform a case-insensitive comparison of the kind field with the dev.tekton.image.kind annotation value in the bundle.

Before this update, pods for remote resolvers were terminated because of insufficient memory when you would clone a large Git repository. This update fixes the issue and increases the memory limit for deploying remote resolvers.

With this update, task and pipeline resources of v1 type are supported in remote resolution.

This update reverts the removal of embedded TaskRun status from the API. The embedded TaskRun status is now available as a deprecated feature to support compatibility with older versions of the client-server.

Before this update, all annotations were merged into PipelineRun and TaskRun resources even if they were not required for the execution. With this update, when you merge annotations into PipelineRun and TaskRun resources, the last-applied-configuration annotation is skipped.

This update fixes a regression issue and prevents the validation of a skipped task result in pipeline results. For example, if the pipeline result references a skipped PipelineTask resource, then the pipeline result is not emitted and the PipelineRun execution does not fail due to a missing result.

This update uses the pod status message to determine the cause of a pod termination.

Before this update, the default resolver was not set for the execution of the finally tasks. This update sets the default resolver for the finally tasks.

With this update, Red Hat OpenShift Pipelines avoids occasional failures of the TaskRun or PipelineRun execution when you use remote resolution.

Before this update, a long pipeline run would be stuck in the running state on the cluster, even after the timeout. This update fixes the issue.

This update fixes the tkn pr delete command for correctly using the keep flag. With this update, if the value of the keep flag equals the number of associated task runs or pipeline runs, the tkn pr delete command returns exit code 0 along with a message.

Linux (x86_64, amd64)

Linux on IBM zSystems and IBM® LinuxONE (s390x)

Linux on IBM Power (ppc64le)

Linux on ARM (aarch64, arm64)

Windows

macOS

macOS on ARM

If you use the Bundles resolver to define a pipeline run and then use the tkn pac resolve --v1beta1 command for this pipeline run, the command generates incorrect YAML output. The kind parameter for the bundle is set to Task in the YAML output. As a workaround, you can set the correct value in the YAML data manually. Alternatively, you can use the opc pac resolve --v1beta1 command or use the version of the tkn tool included with OpenShift Pipelines version 1.12.0 or later.

With this update, the prior version of the tkn command is not compatible with Red Hat OpenShift Pipelines 1.10.

This update removes support for Cluster and CloudEvent pipeline resources from Tekton CLI. You cannot create pipeline resources by using the tkn pipelineresource create command. Also, pipeline resources are no longer supported in the start command of a task, cluster task, or pipeline.

This update removes tekton as a provenance format from Tekton Chains.

In Red Hat OpenShift Pipelines 1.10, the ClusterTask commands are now deprecated and are planned to be removed in a future release. The tkn task create command is also deprecated with this update.

In Red Hat OpenShift Pipelines 1.10, the flags -i and -o that were used with the tkn task start command are now deprecated because the v1 API does not support pipeline resources.

In Red Hat OpenShift Pipelines 1.10, the flag -r that was used with the tkn pipeline start command is deprecated because the v1 API does not support pipeline resources.

The Red Hat OpenShift Pipelines 1.10 update sets the openshiftDefaultEmbeddedStatus parameter to both with full and minimal embedded status. The flag to change the default embedded status is also deprecated and will be removed. In addition, the pipeline default embedded status will be changed to minimal in a future release.

This update includes the following backward incompatible changes:

If the pipelines metrics feature does not work after a cluster upgrade, run the following command as a workaround:

$ oc get tektoninstallersets.operator.tekton.dev | awk '/pipeline-main-static/ {print $1}' | xargs oc delete tektoninstallersets

With this update, usage of external databases, such as the Crunchy PostgreSQL is not supported on IBM Power, IBM zSystems, and IBM® LinuxONE. Instead, use the default Tekton Hub database.

Before this update, the opc pac command generated a runtime error instead of showing any help. This update fixes the opc pac command to show the help message.

Before this update, running the tkn pac create repo command needed the webhook details for creating a repository. With this update, the tkn-pac create repo command does not configure a webhook when your GitHub application is installed.

Before this update, Pipelines as Code would not report a pipeline run creation error when Tekton Pipelines had issues creating the PipelineRun resource. For example, a non-existing task in a pipeline run would show no status. With this update, Pipelines as Code shows the proper error message coming from Tekton Pipelines along with the task that is missing.

This update fixes UI page redirection after a successful authentication. Now, you are redirected to the same page where you had attempted to log in to Tekton Hub.

This update fixes the list command with these flags, --all-namespaces and --output=yaml, for a cluster task, an individual task, and a pipeline.

This update removes the forward slash in the end of the repo.spec.url URL so that it matches the URL coming from GitHub.

Before this update, the marshalJSON function would not marshal a list of objects. With this update, the marshalJSON function marshals the list of objects.

With this update, Pipelines as Code lets you bypass GitHub enterprise questions in the CLI bootstrap GitHub application.

This update fixes the GitHub collaborator check when your repository has more than 100 users.

With this update, the sign and verify commands for a task or pipeline now work without a kubernetes configuration file.

With this update, Tekton Operator cleans leftover pruner cron jobs if pruner has been skipped on a namespace.

Before this update, the API configmap object would not be updated with a user configured value for a catalog refresh interval. This update fixes the CATALOG_REFRESH_INTERVAL API in the Tekon Hub CR.

This update fixes reconciling of PipelineRunStatus when changing the EmbeddedStatus feature flag. This update resets the following parameters:

This update adds a conversion configuration to the ResolutionRequest CRD. This update properly configures conversion from the v1alpha1.ResolutionRequest request to the v1beta1.ResolutionRequest request.

This update checks for duplicate workspaces associated with a pipeline task.

This update fixes the default value for enabling resolvers in the code.

This update fixes TaskRef and PipelineRef names conversion by using a resolver.

Linux (x86_64, amd64)

Linux on IBM zSystems and IBM® LinuxONE (s390x)

Linux on IBM Power (ppc64le)

Linux on ARM (aarch64, arm64)

Windows

macOS

macOS on ARM

With this update, the Conditions custom resource definition (CRD) type has been removed. As an alternative, use the WhenExpressions instead.

With this update, support for tekton.dev/v1alpha1 API pipeline resources, such as Pipeline, PipelineRun, Task, Clustertask, and TaskRun has been removed.

With this update, the tkn-pac setup command has been removed. Instead, use the tkn-pac webhook add command to re-add a webhook to an existing Git repository. And use the tkn-pac webhook update-token command to update the personal provider access token for an existing Secret object in the Git repository.

With this update, a namespace that runs a pipeline with default settings does not apply the pod-security.kubernetes.io/enforce:privileged label to a workload.

In the Red Hat OpenShift Pipelines 1.9.0 release, ClusterTasks are deprecated and planned to be removed in a future release. As an alternative, you can use Cluster Resolver.

In the Red Hat OpenShift Pipelines 1.9.0 release, the use of the triggers and the namespaceSelector fields in a single EventListener specification is deprecated and planned to be removed in a future release. You can use these fields in different EventListener specifications successfully.

In the Red Hat OpenShift Pipelines 1.9.0 release, the tkn pipelinerun describe command does not display timeouts for the PipelineRun resource.

In the Red Hat OpenShift Pipelines 1.9.0 release, the PipelineResource` custom resource (CR) is deprecated. The PipelineResource CR was a Tech Preview feature and part of the tekton.dev/v1alpha1 API.

In the Red Hat OpenShift Pipelines 1.9.0 release, custom image parameters from cluster tasks are deprecated. As an alternative, you can copy a cluster task and use your custom image in it.

The chains-secret and chains-config config maps are removed after you uninstall the Red Hat OpenShift Pipelines Operator. As they contain user data, they should be preserved and not deleted.

When running the tkn pac set of commands on Windows, you may receive the following error message: Command finished with error: not supported by Windows.

Running the tkn pac resolve -f <filename> | oc create -f command may not provide expected results, if the tkn pac resolve command uses a templated parameter value to function.

Before this update, after replacing an empty array, the original array returned an empty string rendering the paramaters inside it invalid. With this update, this issue is resolved and the original array returns as empty.

Before this update, if duplicate secrets were present in a service account for a pipelines run, it resulted in failure in task pod creation. With this update, this issue is resolved and the task pod is created successfully even if duplicate secrets are present in a service account.

Before this update, by looking at the TaskRun’s spec.StatusMessage field, users could not distinguish whether the TaskRun had been cancelled by the user or by a PipelineRun that was part of it. With this update, this issue is resolved and users can distinguish the status of the TaskRun by looking at the TaskRun’s spec.StatusMessage field.

Before this update, webhook validation was removed on deletion of old versions of invalid objects. With this update, this issue is resolved.

Before this update, if you set the timeouts.pipeline parameter to 0, you could not set the timeouts.tasks parameter or the timeouts.finally parameters. This update resolves the issue. Now, when you set the timeouts.pipeline parameter value, you can set the value of either the`timeouts.tasks` parameter or the timeouts.finally parameter. For example:

yaml
kind: PipelineRun
spec:
  timeouts:
    pipeline: "0"  # No timeout
    tasks: "0h3m0s"

Before this update, a race condition could occur if another tool updated labels or annotations on a PipelineRun or TaskRun. With this update, this issue is resolved and you can merge labels or annotations.

Before this update, log keys did not have the same keys as in pipelines controllers. With this update, this issue has been resolved and the log keys have been updated to match the log stream of pipeline controllers. The keys in logs have been changed from "ts" to "timestamp", from "level" to "severity", and from "message" to "msg".

Before this update, if a PipelineRun was deleted with an unknown status, an error message was not generated. With this update, this issue is resolved and an error message is generated.

Before this update, to access bundle commands like list and push, it was required to use the kubeconfig file . With this update, this issue has been resolved and the kubeconfig file is not required to access bundle commands.

Before this update, if the parent PipelineRun was running while deleting TaskRuns, then TaskRuns would be deleted. With this update, this issue is resolved and TaskRuns are not getting deleted if the parent PipelineRun is running.

Before this update, if the user attempted to build a bundle with more objects than the pipeline controller permitted, the Tekton CLI did not display an error message. With this update, this issue is resolved and the Tekton CLI displays an error message if the user attempts to build a bundle with more objects than the limit permitted in the pipeline controller.

Before this update, if namespaces were removed from the cluster, then the operator did not remove namespaces from the ClusterInterceptor ClusterRoleBinding subjects. With this update, this issue has been resolved, and the operator removes the namespaces from the ClusterInterceptor ClusterRoleBinding subjects.

Before this update, the default installation of the Red Hat OpenShift Pipelines Operator resulted in the pipelines-scc-rolebinding security context constraint (SCC) role binding resource remaining in the cluster. With this update, the default installation of the Red Hat OpenShift Pipelines Operator results in the pipelines-scc-rolebinding security context constraint (SCC) role binding resource resource being removed from the cluster.

Before this update, Pipelines as Code did not get updated values from the Pipelines as Code configmap object. With this update, this issue is fixed and the Pipelines as Code configmap object looks for any new changes.

Before this update, Pipelines as Code controller did not wait for the tekton.dev/pipeline label to be updated and added the checkrun id label, which would cause race conditions. With this update, the Pipelines as Code controller waits for the tekton.dev/pipeline label to be updated and then adds the checkrun id label, which helps to avoid race conditions.

Before this update, the tkn-pac create repo command did not override a PipelineRun if it already existed in the git repository. With this update, tkn-pac create command is fixed to override a PipelineRun if it exists in the git repository and this resolves the issue successfully.

Before this update, the tkn pac describe command did not display reasons for every message. With this update, this issue is fixed and the tkn pac describe command displays reasons for every message.

Before this update, a pull request failed if the user in the annotation provided values by using a regex form, for example, refs/head/rel-*. The pull request failed because it was missing refs/heads in its base branch. With this update, the prefix is added and checked that it matches. This resolves the issue and the pull request is successful.

Before this update, the tkn pac repo list command did not run on Microsoft Windows. This update fixes the issue, and now you can run the tkn pac repo list command on Microsoft Windows.

Before this update, Pipelines as Code watcher did not receive all the configuration change events. With this update, the Pipelines as Code watcher is updated, and now the Pipelines as Code watcher does not miss the configuration change events.

Before this update, the pods created by Pipelines as Code, such as TaskRuns or PipelineRuns could not access custom certificates exposed by the user in the cluster. This update fixes the issue, and you can now access custom certificates from the TaskRuns or PipelineRuns pods in the cluster.

Before this update, on a cluster enabled with FIPS, the tekton-triggers-core-interceptors core interceptor used in the Trigger resource did not function after the Pipelines Operator was upgraded to version 1.9. This update resolves the issue. Now, OpenShift uses MInTLS 1.2 for all its components. As a result, the tekton-triggers-core-interceptors core interceptor updates to TLS version 1.2and its functionality runs accurately.

Before this update, when using a pipeline run with an internal OpenShift image registry, the URL to the image had to be hardcoded in the pipeline run definition. For example:

...
  - name: IMAGE_NAME
    value: 'image-registry.openshift-image-registry.svc:5000/<test_namespace>/<test_pipelinerun>'
...

...
  - name: IMAGE_NAME
    value: 'image-registry.openshift-image-registry.svc:5000/{{ target_namespace }}/$(context.pipelineRun.name)'
...

Before this update, Pipelines as Code used the same GitHub token to fetch a remote task available in the same host only on the default GitHub branch. This update resolves the issue. Now Pipelines as Code uses the same GitHub token to fetch a remote task from any GitHub branch.

The value for CATALOG_REFRESH_INTERVAL, a field in the Hub API configmap object used in the Tekton Hub CR, is not getting updated with a custom value provided by the user.

With this update, an OLM misconfiguration issue has been introduced, which prevents the upgrade of the OpenShift Container Platform. This issue will be fixed in a future release.

Before this update, an OLM misconfiguration issue had been introduced in the previous version of the release, which prevented the upgrade of OpenShift Container Platform. With this update, this misconfiguration issue has been fixed.

This update fixes the performance issues for huge pipelines. Now, the CPU usage is reduced by 61% and the memory usage is reduced by 44%.

Before this update, a pipeline run would fail if a task did not run because of its when expression. This update fixes the issue by preventing the validation of a skipped task result in pipeline results. Now, the pipeline result is not emitted and the pipeline run does not fail because of a missing result.

This update fixes the pipelineref.bundle conversion to the bundle resolver for the v1beta1 API. Now, the conversion feature sets the value of the kind field to Pipeline after conversion.

Before this update, an issue in the OpenShift Pipelines Operator prevented the user from setting the value of the spec.pipeline.enable-api-fields field to beta. This update fixes the issue. Now, you can set the value to beta along with alpha and stable in the TektonConfig custom resource.

Before this update, when Pipelines as Code could not create a secret due to a cluster error, it would show the temporary token on the GitHub check run, which is public. This update fixes the issue. Now, the token is no longer displayed on the GitHub checks interface when the creation of the secret fails.

There is currently a known issue with the stop option for pipeline runs in the OpenShift Container Platform web console. The stop option in the Actions drop-down list is not working as expected and does not cancel the pipeline run.

There is currently a known issue with upgrading to OpenShift Pipelines version 1.9.x due to a failing custom resource definition conversion.

This update changes the default metrics level of TaskRun and PipelineRun resources to the following values:

apiVersion: v1
kind: configmap
metadata:
  name: config-observability
  namespace: tekton-pipelines
  labels:
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipelines
data:
  _example: |
  ...
    metrics.taskrun.level: "task"
    metrics.taskrun.duration-type: "histogram"
    metrics.pipelinerun.level: "pipeline"
    metrics.pipelinerun.duration-type: "histogram"

With this update, if an annotation or label is present in both Pipeline and PipelineRun resources, the value in the Run type takes precedence. The same is true if an annotation or label is present in Task and TaskRun resources.

In Red Hat OpenShift Pipelines 1.8, the previously deprecated PipelineRun.Spec.ServiceAccountNames field has been removed. Use the PipelineRun.Spec.TaskRunSpecs field instead.

In Red Hat OpenShift Pipelines 1.8, the previously deprecated TaskRun.Status.ResourceResults.ResourceRef field has been removed. Use the TaskRun.Status.ResourceResults.ResourceName field instead.

In Red Hat OpenShift Pipelines 1.8, the previously deprecated Conditions resource type has been removed. Remove the Conditions resource from Pipeline resource definitions that include it. Use when expressions in PipelineRun definitions instead.

For Tekton Chains, the tekton-provenance format has been removed in this release. Use the in-toto format by setting "artifacts.taskrun.format": "in-toto" in the TektonChain custom resource instead.

Red Hat OpenShift Pipelines 1.7.x shipped with Pipelines as Code 0.5.x. The current update ships with Pipelines as Code 0.10.x. This change creates a new route in the openshift-pipelines namespace for the new controller. You must update this route in GitHub Apps or webhooks that use Pipelines as Code. To fetch the route, use the following command:

$ oc get route -n openshift-pipelines pipelines-as-code-controller \
  --template='https://{{ .spec.host }}'

With this update, Pipelines as Code renames the default secret keys for the Repository custom resource definition (CRD). In your CRD, replace token with provider.token, and replace secret with webhook.secret.

With this update, Pipelines as Code replaces a special template variable with one that supports multiple pipeline runs for private repositories. In your pipeline runs, replace secret: pac-git-basic-auth-{{repo_owner}}-{{repo_name}} with secret: {{ git_auth_secret }}.

With this update, Pipelines as Code updates the following commands in the tkn-pac CLI tool:

Starting with OpenShift Container Platform 4.11, the preview and stable channels for installing and upgrading the Red Hat OpenShift Pipelines Operator are removed. To install and upgrade the Operator, use the appropriate pipelines-<version> channel, or the latest channel for the most recent stable version. For example, to install the OpenShift Pipelines Operator version 1.8.x, use the pipelines-1.8 channel.

Support for the tekton.dev/v1alpha1 API version, which was deprecated in Red Hat OpenShift Pipelines GA 1.6, is planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.

In Red Hat OpenShift Pipelines 1.8, the PipelineResource custom resource (CR) is available but no longer supported. The PipelineResource CR was a Tech Preview feature and part of the tekton.dev/v1alpha1 API, which had been deprecated and planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.

In Red Hat OpenShift Pipelines 1.8, the Condition custom resource (CR) is removed. The Condition CR was part of the tekton.dev/v1alpha1 API, which has been deprecated and is planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.

In Red Hat OpenShift Pipelines 1.8, the gcr.io image for gsutil has been removed. This removal might break clusters with Pipeline resources that depend on this image. Bug fixes and support are provided only through the end of the Red Hat OpenShift Pipelines 1.7 lifecycle.

In Red Hat OpenShift Pipelines 1.8, the PipelineRun.Status.TaskRuns and PipelineRun.Status.Runs fields are deprecated and are planned to be removed in a future release. See TEP-0100: Embedded TaskRuns and Runs Status in PipelineRuns.

In Red Hat OpenShift Pipelines 1.8, the pipelineRunCancelled state is deprecated and planned to be removed in a future release. Graceful termination of PipelineRun objects is now promoted from an alpha feature to a stable feature. (See TEP-0058: Graceful Pipeline Run Termination.) As an alternative, you can use the Cancelled state, which replaces the pipelineRunCancelled state.

In Red Hat OpenShift Pipelines 1.8, the timeout field in PipelineRun has been deprecated. Instead, use the PipelineRun.Timeouts field, which is now promoted from an alpha feature to a stable feature.

In Red Hat OpenShift Pipelines 1.8, init containers are omitted from the LimitRange object’s default request calculations.

The s2i-nodejs pipeline cannot use the nodejs:14-ubi8-minimal image stream to perform source-to-image (S2I) builds. Using that image stream produces an error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127 message.

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters.

On ARM, IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

Implicit parameter mapping incorrectly passes parameters from the top-level Pipeline or PipelineRun definitions to the taskRef tasks. Mapping should only occur from a top-level resource to tasks with in-line taskSpec specifications. This issue only affects clusters where this feature was enabled by setting the enable-api-fields field to alpha in the pipeline section of the TektonConfig custom resource definition.

Before this update, the metrics for pipeline runs in the Developer view of the web console were incomplete and outdated. With this update, the issue has been fixed so that the metrics are correct.

Before this update, if a pipeline had two parallel tasks that failed and one of them had retries=2, the final tasks never ran, and the pipeline timed out and failed to run. For example, the pipelines-operator-subscription task failed intermittently with the following error message: Unable to connect to the server: EOF. With this update, the issue has been fixed so that the final tasks always run.

Before this update, if a pipeline run stopped because a task run failed, other task runs might not complete their retries. As a result, no finally tasks were scheduled, which caused the pipeline to hang. This update resolves the issue. TaskRuns and Run objects can retry when a pipeline run has stopped, even by graceful stopping, so that pipeline runs can complete.

This update changes how resource requirements are calculated when one or more LimitRange objects are present in the namespace where a TaskRun object exists. The scheduler now considers step containers and excludes all other app containers, such as sidecar containers, when factoring requests from LimitRange objects.

Before this update, under specific conditions, the flag package might incorrectly parse a subcommand immediately following a double dash flag terminator, --. In that case, it ran the entrypoint subcommand rather than the actual command. This update fixes this flag-parsing issue so that the entrypoint runs the correct command.

Before this update, the controller might generate multiple panics if pulling an image failed, or its pull status was incomplete. This update fixes the issue by checking the step.ImageID value rather than the status.TaskSpec value.

Before this update, canceling a pipeline run that contained an unscheduled custom task produced a PipelineRunCouldntCancel error. This update fixes the issue. You can cancel a pipeline run that contains an unscheduled custom task without producing that error.

Before this update, if the <NAME> in $params["<NAME>"] or $params['<NAME>'] contained a dot character (.), any part of the name to the right of the dot was not extracted. For example, from $params["org.ipsum.lorem"], only org was extracted.

With this update, Trigger resources support custom interceptors and ensure that the port of the custom interceptor service is the same as the port in the ClusterInterceptor definition file.

Before this update, the tkn version command for Tekton Chains and Operator components did not work correctly. This update fixes the issue so that the command works correctly and returns version information for those components.

Before this update, if you ran a tkn pr delete --ignore-running command and a pipeline run did not have a status.condition value, the tkn CLI tool produced a null-pointer error (NPE). This update fixes the issue so that the CLI tool now generates an error and correctly ignores pipeline runs that are still running.

Before this update, if you used the tkn pr delete --keep <value> or tkn tr delete --keep <value> commands, and the number of pipeline runs or task runs was less than the value, the command did not return an error as expected. This update fixes the issue so that the command correctly returns an error under those conditions.

Before this update, if you used the tkn pr delete or tkn tr delete commands with the -p or -t flags together with the --ignore-running flag, the commands incorrectly deleted running or pending resources. This update fixes the issue so that these commands correctly ignore running or pending resources.

With this update, you can configure Tekton Chains by using the TektonChain custom resource. This feature enables your configuration to persist after upgrading, unlike the chains-config config map, which gets overwritten during upgrades.

With this update, ClusterTask resources no longer run as root by default, except for the buildah and s2i cluster tasks.

Before this update, tasks on Red Hat OpenShift Pipelines 1.7.1 failed when using init as a first argument followed by two or more arguments. With this update, the flags are parsed correctly, and the task runs are successful.

Before this update, installation of the Red Hat OpenShift Pipelines Operator on OpenShift Container Platform 4.9 and 4.10 failed due to an invalid role binding, with the following error message:

error updating rolebinding openshift-operators-prometheus-k8s-read-binding: RoleBinding.rbac.authorization.k8s.io
"openshift-operators-prometheus-k8s-read-binding" is invalid:
roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"openshift-operator-read"}: cannot change roleRef

Previously, upgrading the Red Hat OpenShift Pipelines Operator caused the pipeline service account to be recreated, which meant that the secrets linked to the service account were lost. This update fixes the issue. During upgrades, the Operator no longer recreates the pipeline service account. As a result, secrets attached to the pipeline service account persist after upgrades, and the resources (tasks and pipelines) continue to work correctly.

With this update, Pipelines as Code pods run on infrastructure nodes if infrastructure node settings are configured in the TektonConfig custom resource (CR).

Previously, with the resource pruner, each namespace Operator created a command that ran in a separate container. This design consumed too many resources in clusters with a high number of namespaces. For example, to run a single command, a cluster with 1000 namespaces produced 1000 containers in a pod.

In Tekton Chains, you must define a secret called signing-secrets to hold the key used for signing tasks and images. However, before this update, updating the Red Hat OpenShift Pipelines Operator reset or overwrote this secret, and the key was lost. This update fixes the issue. Now, if the secret is configured after installing Tekton Chains through the Operator, the secret persists, and it is not overwritten by upgrades.

Before this update, all S2I build tasks failed with an error similar to the following message:

Error: error writing "0 0 4294967295\n" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted
time="2022-03-04T09:47:57Z" level=error msg="error writing \"0 0 4294967295\\n\" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted"
time="2022-03-04T09:47:57Z" level=error msg="(unable to determine exit status)"

securityContext:
  capabilities:
    add: ["SETFCAP"]

Before this update, installing the Red Hat OpenShift Pipelines Operator took longer than expected. This update optimizes some settings to speed up the installation process.

With this update, Buildah and S2I cluster tasks have fewer steps than in previous versions. Some steps have been combined into a single step so that they work better with ResourceQuota and LimitRange objects and do not require more resources than necessary.

This update upgrades the Buildah, tkn CLI tool, and skopeo CLI tool versions in cluster tasks.

Before this update, the Operator failed when creating RBAC resources if any namespace was in a Terminating state. With this update, the Operator ignores namespaces in a Terminating state and creates the RBAC resources.

Before this update, pods for the prune cronjobs were not scheduled on infrastructure nodes, as expected. Instead, they were scheduled on worker nodes or not scheduled at all. With this update, these types of pods can now be scheduled on infrastructure nodes if configured in the TektonConfig custom resource (CR).

Breaking change: This update removes the disable-working-directory-overwrite and disable-home-env-overwrite fields from the TektonConfig custom resource (CR). As a result, the TektonConfig CR no longer automatically sets the $HOME environment variable and workingDir parameter. You can still set the $HOME environment variable and workingDir parameter by using the env and workingDir fields in the Task custom resource definition (CRD).

The Conditions custom resource definition (CRD) type is deprecated and planned to be removed in a future release. Instead, use the recommended When expression.

Breaking change: The Triggers resource validates the templates and generates an error if you do not specify the EventListener and TriggerBinding values.

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

You cannot use the nodejs:14-ubi8-minimal image stream because doing so generates the following errors:

STEP 7: RUN /usr/libexec/s2i/assemble
/bin/sh: /usr/libexec/s2i/assemble: No such file or directory
subprocess exited with status 127
subprocess exited with status 127
error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127
time="2021-11-04T13:05:26Z" level=error msg="exit status 127"

Implicit parameter mapping incorrectly passes parameters from the top-level Pipeline or PipelineRun definitions to the taskRef tasks. Mapping should only occur from a top-level resource to tasks with in-line taskSpec specifications. This issue only affects clusters where this feature was enabled by setting the enable-api-fields field to alpha in the pipeline section of the TektonConfig custom resource definition.

With this update, if metadata such as labels and annotations are present in both Pipeline and PipelineRun object definitions, the values in the PipelineRun type takes precedence. You can observe similar behavior for Task and TaskRun objects.

With this update, if the timeouts.tasks field or the timeouts.finally field is set to 0, then the timeouts.pipeline is also set to 0.

With this update, the -x set flag is removed from scripts that do not use a shebang. The fix reduces potential data leak from script execution.

With this update, any backslash character present in the usernames in Git credentials is escaped with an additional backslash in the .gitconfig file.

With this update, the finalizer property of the EventListener object is not necessary for cleaning up logging and config maps.

With this update, the default HTTP client associated with the event listener server is removed, and a custom HTTP client added. As a result, the timeouts have improved.

With this update, the Triggers cluster role now works with owner references.

With this update, the race condition in the event listener does not happen when multiple interceptors return extensions.

With this update, the tkn pr delete command does not delete the pipeline runs with the ignore-running flag.

With this update, the Operator pods do not continue restarting when you modify any add-on parameters.

With this update, the tkn serve CLI pod is scheduled on infra nodes, if not configured in the subscription and config custom resources.

With this update, cluster tasks with specified versions are not deleted during upgrade.

With this update, you can configure a pipeline or task start command to return a YAML or JSON-formatted string by using the --output <string>, where <string> is yaml or json. Otherwise, without the --output option, the start command returns a human-friendly message that is hard for other programs to parse. Returning a YAML or JSON-formatted string is useful for continuous integration (CI) environments. For example, after a resource is created, you can use yq or jq to parse the YAML or JSON-formatted message about the resource and wait until that resource is terminated without using the showlog option.

With this update, you can authenticate to a registry using the auth.json authentication file of Podman. For example, you can use tkn bundle push to push to a remote registry using Podman instead of Docker CLI.

With this update, if you use the tkn [taskrun | pipelinerun] delete --all command, you can preserve runs that are younger than a specified number of minutes by using the new --keep-since <minutes> option. For example, to keep runs that are less than five minutes old, you enter tkn [taskrun | pipelinerun] delete -all --keep-since 5.

With this update, when you delete task runs or pipeline runs, you can use the --parent-resource and --keep-since options together. For example, the tkn pipelinerun delete --pipeline pipelinename --keep-since 5 command preserves pipeline runs whose parent resource is named pipelinename and whose age is five minutes or less. The tkn tr delete -t <taskname> --keep-since 5 and tkn tr delete --clustertask <taskname> --keep-since 5 commands work similarly for task runs.

This update adds support for the triggers resources to work with v1beta1 resources.

This update adds an ignore-running option to the tkn pipelinerun delete and tkn taskrun delete commands.

This update adds a create subcommand to the tkn task and tkn clustertask commands.

With this update, when you use the tkn pipelinerun delete --all command, you can use the new --label <string> option to filter the pipeline runs by label. Optionally, you can use the --label option with = and == as equality operators, or != as an inequality operator. For example, the tkn pipelinerun delete --all --label asdf and tkn pipelinerun delete --all --label==asdf commands both delete all the pipeline runs that have the asdf label.

With this update, you can fetch the version of installed Tekton components from the config map or, if the config map is not present, from the deployment controller.

With this update, triggers support the feature-flags and config-defaults config map to configure feature flags and to set default values respectively.

This update adds a new metric, eventlistener_event_count, that you can use to count events received by the EventListener resource.

This update adds v1beta1 Go API types. With this update, triggers now support the v1beta1 API version.

In the current release, auto-prunning of resources is enabled by default. In addition, you can configure auto-prunning of task run and pipeline run for each namespace separately, by using the following new annotations:

Administrators can disable the creation of the pipeline service account for the entire cluster, and prevent privilege escalation by misusing the associated SCC, which is very similar to anyuid.

You can now configure feature flags and components by using the TektonConfig custom resource (CR) and the CRs for individual components, such as TektonPipeline and TektonTriggers. This level of granularity helps customize and test alpha features such as the Tekton OCI bundle for individual components.

You can now configure optional Timeouts field for the PipelineRun resource. For example, you can configure timeouts separately for a pipeline run, each task run, and the finally tasks.

The pods generated by the TaskRun resource now sets the activeDeadlineSeconds field of the pods. This enables OpenShift to consider them as terminating, and allows you to use specifically scoped ResourceQuota object for the pods.

You can use configmaps to eliminate metrics tags or labels type on a task run, pipeline run, task, and pipeline. In addition, you can configure different types of metrics for measuring duration, such as a histogram, gauge, or last value.

You can define requests and limits on a pod coherently, as Tekton now fully supports the LimitRange object by considering the Min, Max, Default, and DefaultRequest fields.

The following alpha features are introduced:

The current release enables you to configure node selection by specifying the nodeSelector and tolerations values in the TektonConfig custom resource (CR). The Operator adds these values to all the deployments that it creates.

In CLI 0.21.0, support for all v1alpha1 resources for clustertask, task, taskrun, pipeline, and pipelinerun commands are deprecated. These resources are now deprecated and will be removed in a future release.

In Tekton Triggers v0.16.0, the redundant status label is removed from the metrics for the EventListener resource.

With the current release, the v1alpha1 features are now deprecated and will be removed in a future release. With this update, you can begin using the v1beta1 Go API types instead. Triggers now supports the v1beta1 API version.

With the current release, the EventListener resource sends a response before the triggers finish processing.

The current release removes the podTemplate field from the EventListener resource.

The current release removes the deprecated replicas field from the specification for the EventListener resource.

In Red Hat OpenShift Pipelines 1.6, the values of HOME="/tekton/home" and workingDir="/workspace" are removed from the specification of the Step objects.

apiVersion: operator.tekton.dev/v1alpha1
  kind: TektonConfig
  metadata:
    name: config
  spec:
    pipeline:
      disable-working-directory-overwrite: false
      disable-home-env-overwrite: false
  ...

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

Before you install tasks based on the Tekton Catalog on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) using tkn hub, verify if the task can be executed on these platforms. To check if ppc64le and s390x are listed in the "Platforms" section of the task information, you can run the following command: tkn hub info task <name>

You cannot use the nodejs:14-ubi8-minimal image stream because doing so generates the following errors:

STEP 7: RUN /usr/libexec/s2i/assemble
/bin/sh: /usr/libexec/s2i/assemble: No such file or directory
subprocess exited with status 127
subprocess exited with status 127
error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127
time="2021-11-04T13:05:26Z" level=error msg="exit status 127"

The tkn hub command is now supported on IBM Power Systems, IBM Z, and LinuxONE.

Before this update, the terminal was not available after the user ran a tkn command, and the pipeline run was done, even if retries were specified. Specifying a timeout in the task run or pipeline run had no effect. This update fixes the issue so that the terminal is available after running the command.

Before this update, running tkn pipelinerun delete --all would delete all resources. This update prevents the resources in the running state from getting deleted.

Before this update, using the tkn version --component=<component> command did not return the component version. This update fixes the issue so that this command returns the component version.

Before this update, when you used the tkn pr logs command, it displayed the pipelines output logs in the wrong task order. This update resolves the issue so that logs of completed PipelineRuns are listed in the appropriate TaskRun execution order.

Before this update, editing the specification of a running pipeline might prevent the pipeline run from stopping when it was complete. This update fixes the issue by fetching the definition only once and then using the specification stored in the status for verification. This change reduces the probability of a race condition when a PipelineRun or a TaskRun refers to a Pipeline or Task that changes while it is running.

When expression values can now have array parameter references, such as: values: [$(params.arrayParam[*])].

Pipeline run and task runs will be automatically pruned by a cron job in the target namespace. The cron job uses the IMAGE_JOB_PRUNER_TKN environment variable to get the value of tkn image. With this enhancement, the following fields are introduced to the TektonConfig custom resource:

...
pruner:
  resources:
    - pipelinerun
    - taskrun
  schedule: "*/5 * * * *" # cron schedule
  keep: 2 # delete all keeping n
...

In OpenShift Container Platform, you can customize the installation of the Tekton Add-ons component by modifying the values of the new parameters clusterTasks and pipelinesTemplates in the TektonConfig custom resource:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: all
  targetNamespace: openshift-pipelines
  addon:
    params:
    - name: clusterTasks
      value: "true"
    - name: pipelineTemplates
      value: "true"
...

The enableMetrics parameter is added to the TektonConfig custom resource. You can use it to disable the service monitor, which is part of Tekton Pipelines for OpenShift Container Platform.

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: all
  targetNamespace: openshift-pipelines
  pipeline:
    params:
    - name: enableMetrics
      value: "true"
...

Eventlistener OpenCensus metrics, which captures metrics at process level, is added.

Triggers now has label selector; you can configure triggers for an event listener using labels.

The ClusterInterceptor custom resource definition for registering interceptors is added, which allows you to register new Interceptor types that you can plug in. In addition, the following relevant changes are made:

To disable prefixing the name of the task or step while displaying logs, use the --prefix option for log commands.

To display the version of a specific component, use the new --component flag in the tkn version command.

The tkn hub check-upgrade command is added, and other commands are revised to be based on the pipeline version. In addition, catalog names are displayed in the search command output.

Support for optional workspaces are added to the start command.

If the plugins are not present in the plugins directory, they are searched in the current path.

The tkn start [task | clustertask | pipeline] command starts interactively and ask for the params value, even when you specify the default parameters are specified. To stop the interactive prompts, pass the --use-param-defaults flag at the time of invoking the command. For example:

$ tkn pipeline start build-and-deploy \
    -w name=shared-workspace,volumeClaimTemplateFile=https://raw.githubusercontent.com/openshift/pipelines-tutorial/pipelines-1.12/01_pipeline/03_persistent_volume_claim.yaml \
    -p deployment-name=pipelines-vote-api \
    -p git-url=https://github.com/openshift/pipelines-vote-api.git \
    -p IMAGE=image-registry.openshift-image-registry.svc:5000/pipelines-tutorial/pipelines-vote-api \
    --use-param-defaults

The version field is added in the tkn task describe command.

The option to automatically select resources such as TriggerTemplate, or TriggerBinding, or ClusterTriggerBinding, or Eventlistener, is added in the describe command, if only one is present.

In the tkn pr describe command, a section for skipped tasks is added.

Support for the tkn clustertask logs is added.

The YAML merge and variable from config.yaml is removed. In addition, the release.yaml file can now be more easily consumed by tools such as kustomize and ytt.

The support for resource names to contain the dot character (".") is added.

The hostAliases array in the PodTemplate specification is added to the pod-level override of hostname resolution. It is achieved by modifying the /etc/hosts file.

A variable $(tasks.status) is introduced to access the aggregate execution status of tasks.

An entry-point binary build for Windows is added.

In the when expressions, support for fields written is PascalCase is removed. The when expressions only support fields written in lowercase.

When you upgrade the Red Hat OpenShift Pipelines Operator to v1.5, the openshift-client and the openshift-client-v-1-5-0 cluster tasks have the SCRIPT parameter. However, the ARGS parameter and the git resource are removed from the specification of the openshift-client cluster task. This is a breaking change, and only those cluster tasks that do not have a specific version in the name field of the ClusterTask resource upgrade seamlessly.

...
- name: deploy
  params:
  - name: SCRIPT
    value: oc rollout status <deployment-name>
  runAfter:
    - build
  taskRef:
    kind: ClusterTask
    name: openshift-client
...

When you upgrade from Red Hat OpenShift Pipelines Operator v1.4 to v1.5, the profile names in which the TektonConfig custom resource is installed now change.

The disable-home-env-overwrite and disable-working-dir-overwrite fields are now deprecated and will be removed in a future release. For this release, the default value of these flags is set to true for backward compatibility.

The ServiceType and podTemplate fields are removed from the EventListener spec.

The controller service account no longer requests cluster-wide permission to list and watch namespaces.

The status of the EventListener resource has a new condition called Ready.

The eventListener and namespace fields in the EventListener response are deprecated. Use the eventListenerUID field instead.

The replicas field is deprecated from the EventListener spec. Instead, the spec.replicas field is moved to spec.resources.kubernetesResource.replicas in the KubernetesResource spec.

The old method of configuring the core interceptors is deprecated. However, it continues to work until it is removed in a future release. Instead, interceptors in a Trigger resource are now configured using a new ref and params based syntax. The resulting default webhook automatically switch the usages of the old syntax to the new syntax for new triggers.

Use rbac.authorization.k8s.io/v1 instead of the deprecated rbac.authorization.k8s.io/v1beta1 for the ClusterRoleBinding resource.

In cluster roles, the cluster-wide write access to resources such as serviceaccounts, secrets, configmaps, and limitranges are removed. In addition, cluster-wide access to resources such as deployments, statefulsets, and deployment/finalizers are removed.

The image custom resource definition in the caching.internal.knative.dev group is not used by Tekton anymore, and is excluded in this release.

The git-cli cluster task is built off the alpine/git base image, which expects /root as the user’s home directory. However, this is not explicitly set in the git-cli cluster task.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task and the tkn hub command are unsupported.

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

The when expressions in dag tasks are not allowed to specify the context variable accessing the execution status ($(tasks.<pipelineTask>.status)) of any other task.

Use Owner UIDs instead of Owner names, as it helps avoid race conditions created by deleting a volumeClaimTemplate PVC, in situations where a PipelineRun resource is quickly deleted and then recreated.

A new Dockerfile is added for pullrequest-init for build-base image triggered by non-root users.

When a pipeline or task is executed with the -f option and the param in its definition does not have a type defined, a validation error is generated instead of the pipeline or task run failing silently.

For the tkn start [task | pipeline | clustertask] commands, the description of the --workspace flag is now consistent.

While parsing the parameters, if an empty array is encountered, the corresponding interactive help is displayed as an empty string now.

The custom tasks have the following enhancements:

The finally task has the following enhancements:

Support for multiple secrets of the type dockercfg or dockerconfigjson is added for authentication at runtime.

Functionality to support sparse-checkout with the git-clone task is added. This enables you to clone only a subset of the repository as your local copy, and helps you to restrict the size of the cloned repositories.

You can create pipeline runs in a pending state without actually starting them. In clusters that are under heavy load, this allows Operators to have control over the start time of the pipeline runs.

Ensure that you set the SYSTEM_NAMESPACE environment variable manually for the controller; this was previously set by default.

A non-root user is now added to the build-base image of pipelines so that git-init can clone repositories as a non-root user.

Support to validate dependencies between resolved resources before a pipeline run starts is added. All result variables in the pipeline must be valid, and optional workspaces from a pipeline can only be passed to tasks expecting it for the pipeline to start running.

The controller and webhook runs as a non-root group, and their superfluous capabilities have been removed to make them more secure.

You can use the tkn pr logs command to see the log streams for retried task runs.

You can use the --clustertask option in the tkn tr delete command to delete all the task runs associated with a particular cluster task.

Support for using Knative service with the EventListener resource is added by introducing a new customResource field.

An error message is displayed when an event payload does not use the JSON format.

The source control interceptors such as GitLab, BitBucket, and GitHub, now use the new InterceptorRequest or InterceptorResponse type interface.

A new CEL function marshalJSON is implemented so that you can encode a JSON object or an array to a string.

An HTTP handler for serving the CEL and the source control core interceptors is added. It packages four core interceptors into a single HTTP server that is deployed in the tekton-pipelines namespace. The EventListener object forwards events over the HTTP server to the interceptor. Each interceptor is available at a different path. For example, the CEL interceptor is available on the /cel path.

The pipelines-scc Security Context Constraint (SCC) is used with the default pipeline service account for pipelines. This new service account is similar to anyuid, but with a minor difference as defined in the YAML for SCC of OpenShift Container Platform 4.7:

fsGroup:
  type: MustRunAs

The build-gcs sub-type in the pipeline resource storage, and the gcs-fetcher image, are not supported.

In the taskRun field of cluster tasks, the label tekton.dev/task is removed.

For webhooks, the value v1beta1 corresponding to the field admissionReviewVersions is removed.

The creds-init helper image for building and deploying is removed.

In the triggers spec and binding, the deprecated field template.name is removed in favor of template.ref. You should update all eventListener definitions to use the ref field.

For EventListener custom resources/objects, the fields PodTemplate and ServiceType are deprecated in favor of Resource.

The deprecated spec style embedded bindings is removed.

The spec field is removed from the triggerSpecBinding.

The event ID representation is changed from a five-character random string to a UUID.

In the Developer perspective, the pipeline metrics and triggers features are available only on OpenShift Container Platform 4.7.6 or later versions.

On IBM Power Systems, IBM Z, and LinuxONE, the tkn hub command is not supported.

When you run Maven and Jib Maven cluster tasks on an IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters, set the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

Triggers throw error resulting from bad handling of the JSON format, if you have the following configuration in the trigger binding:

params:
  - name: github_json
    value: $(body)

When upgrading from OpenShift Pipelines 1.3.x to 1.4.x, you must recreate the routes.

Previously, the tekton.dev/task label was removed from the task runs of cluster tasks, and the tekton.dev/clusterTask label was introduced. The problems resulting from that change is resolved by fixing the clustertask describe and delete commands. In addition, the lastrun function for tasks is modified, to fix the issue of the tekton.dev/task label being applied to the task runs of both tasks and cluster tasks in older versions of pipelines.

When doing an interactive tkn pipeline start pipelinename, a PipelineResource is created interactively. The tkn p start command prints the resource status if the resource status is not nil.

Previously, the tekton.dev/task=name label was removed from the task runs created from cluster tasks. This fix modifies the tkn clustertask start command with the --last flag to check for the tekton.dev/task=name label in the created task runs.

When a task uses an inline task specification, the corresponding task run now gets embedded in the pipeline when you run the tkn pipeline describe command, and the task name is returned as embedded.

The tkn version command is fixed to display the version of the installed Tekton CLI tool, without a configured kubeConfiguration namespace or access to a cluster.

If an argument is unexpected or more than one arguments are used, the tkn completion command gives an error.

Previously, pipeline runs with the finally tasks nested in a pipeline specification would lose those finally tasks, when converted to the v1alpha1 version and restored back to the v1beta1 version. This error occurring during conversion is fixed to avoid potential data loss. Pipeline runs with the finally tasks nested in a pipeline specification is now serialized and stored on the alpha version, only to be deserialized later.

Previously, there was an error in the pod generation when a service account had the secrets field as {}. The task runs failed with CouldntGetTask because the GET request with an empty secret name returned an error, indicating that the resource name may not be empty. This issue is fixed by avoiding an empty secret name in the kubeclient GET request.

Pipelines with the v1beta1 API versions can now be requested along with the v1alpha1 version, without losing the finally tasks. Applying the returned v1alpha1 version will store the resource as v1beta1, with the finally section restored to its original state.

Previously, an unset selfLink field in the controller caused an error in the Kubernetes v1.20 clusters. As a temporary fix, the CloudEvent source field is set to a value that matches the current source URI, without the value of the auto-populated selfLink field.

Previously, a secret name with dots such as gcr.io led to a task run creation failure. This happened because of the secret name being used internally as part of a volume mount name. The volume mount name conforms to the RFC1123 DNS label and disallows dots as part of the name. This issue is fixed by replacing the dot with a dash that results in a readable name.

Context variables are now validated in the finally tasks.

Previously, when the task run reconciler was passed a task run that did not have a previous status update containing the name of the pod it created, the task run reconciler listed the pods associated with the task run. The task run reconciler used the labels of the task run, which were propagated to the pod, to find the pod. Changing these labels while the task run was running, caused the code to not find the existing pod. As a result, duplicate pods were created. This issue is fixed by changing the task run reconciler to only use the tekton.dev/taskRun Tekton-controlled label when finding the pod.

Previously, when a pipeline accepted an optional workspace and passed it to a pipeline task, the pipeline run reconciler stopped with an error if the workspace was not provided, even if a missing workspace binding is a valid state for an optional workspace. This issue is fixed by ensuring that the pipeline run reconciler does not fail to create a task run, even if an optional workspace is not provided.

The sorted order of step statuses matches the order of step containers.

Previously, the task run status was set to unknown when a pod encountered the CreateContainerConfigError reason, which meant that the task and the pipeline ran until the pod timed out. This issue is fixed by setting the task run status to false, so that the task is set as failed when the pod encounters the CreateContainerConfigError reason.

Previously, pipeline results were resolved on the first reconciliation, after a pipeline run was completed. This could fail the resolution resulting in the Succeeded condition of the pipeline run being overwritten. As a result, the final status information was lost, potentially confusing any services watching the pipeline run conditions. This issue is fixed by moving the resolution of pipeline results to the end of a reconciliation, when the pipeline run is put into a Succeeded or True condition.

Execution status variable is now validated. This avoids validating task results while validating context variables to access execution status.

Previously, a pipeline result that contained an invalid variable would be added to the pipeline run with the literal expression of the variable intact. Therefore, it was difficult to assess whether the results were populated correctly. This issue is fixed by filtering out the pipeline run results that reference failed task runs. Now, a pipeline result that contains an invalid variable will not be emitted by the pipeline run at all.

The tkn eventlistener describe command is fixed to avoid crashing without a template. It also displays the details about trigger references.

Upgrades from OpenShift Pipelines 1.3.x and earlier versions to OpenShift Pipelines 1.4.0 breaks event listeners because of the unavailability of template.name. In OpenShift Pipelines 1.4.1, the template.name has been restored to avoid breaking event listeners in triggers.

In OpenShift Pipelines 1.4.1, the ConsoleQuickStart custom resource has been updated to align with OpenShift Container Platform 4.7 capabilities and behavior.

Tekton Pipelines 0.19.0

Tekton tkn CLI 0.15.0

Tekton Triggers 0.10.2

cluster tasks based on Tekton Catalog 0.19.0

IBM Power Systems on OpenShift Container Platform 4.7

IBM Z and LinuxONE on OpenShift Container Platform 4.7

Pipeline templates that use PipelineResources CRDs are now deprecated and will be removed in a future release.

The template.name field is deprecated in favor of the template.ref field and will be removed in a future release.

The -c shorthand for the --check command has been removed. In addition, global tkn flags are added to the version command.

CEL overlays add fields to a new top-level extensions function, instead of modifying the incoming event body. TriggerBinding resources can access values within this new extensions function using the $(extensions.<key>) syntax. Update your binding to use the $(extensions.<key>) syntax instead of the $(body.<overlay-key>) syntax.

The escaping parameters behavior by replacing " with \" is now removed. If you need to retain the old escaping parameters behavior add the tekton.dev/old-escape-quotes: true" annotation to your TriggerTemplate specification.

You can embed TriggerBinding resources by using the name and value fields inside a trigger or an event listener. However, you cannot specify both name and ref fields for a single binding. Use the ref field to refer to a TriggerBinding resource and the name field for embedded bindings.

An interceptor cannot attempt to reference a secret outside the namespace of an EventListener resource. You must include secrets in the namespace of the `EventListener`resource.

In Triggers 0.9.0 and later, if a body or header based TriggerBinding parameter is missing or malformed in an event payload, the default values are used instead of displaying an error.

Tasks and pipelines created with WhenExpression objects using Tekton Pipelines 0.16.x must be reapplied to fix their JSON annotations.

When a pipeline accepts an optional workspace and gives it to a task, the pipeline run stalls if the workspace is not provided.

To use the Buildah cluster task in a disconnected environment, ensure that the Dockerfile uses an internal image stream as the base image, and then use it in the same manner as any S2I cluster task.

Extensions added by a CEL Interceptor are passed on to webhook interceptors by adding the Extensions field within the event body.

The activity timeout for log readers is now configurable using the LogOptions field. However, the default behavior of timeout in 10 seconds is retained.

The log command ignores the --follow flag when a task run or pipeline run is complete, and reads available logs instead of live logs.

References to the following Tekton resources: EventListener, TriggerBinding, ClusterTriggerBinding, Condition, and TriggerTemplate are now standardized and made consistent across all user-facing messages in tkn commands.

Previously, if you started a canceled task run or pipeline run with the --use-taskrun <canceled-task-run-name>, --use-pipelinerun <canceled-pipeline-run-name> or --last flags, the new run would be canceled. This bug is now fixed.

The tkn pr desc command is now enhanced to ensure that it does not fail in case of pipeline runs with conditions.

When you delete a task run using the tkn tr delete command with the --task option, and a cluster task exists with the same name, the task runs for the cluster task also get deleted. As a workaround, filter the task runs by using the TaskRefKind field.

The tkn triggertemplate describe command would display only part of the apiVersion value in the output. For example, only triggers.tekton.dev was displayed instead of triggers.tekton.dev/v1alpha1. This bug is now fixed.

The webhook, under certain conditions, would fail to acquire a lease and not function correctly. This bug is now fixed.

Pipelines with when expressions created in v0.16.3 can now be run in v0.17.1 and later. After an upgrade, you do not need to reapply pipeline definitions created in previous versions because both the uppercase and lowercase first letters for the annotations are now supported.

By default, the leader-election-ha field is now enabled for high availability. When the disable-ha controller flag is set to true, it disables high availability support.

Issues with duplicate cloud events are now fixed. Cloud events are now sent only when a condition changes the state, reason, or message.

When a service account name is missing from a PipelineRun or TaskRun spec, the controller uses the service account name from the config-defaults config map. If the service account name is also missing in the config-defaults config map, the controller now sets it to default in the spec.

Validation for compatibility with the affinity assistant is now supported when the same persistent volume claim is used for multiple workspaces, but with different subpaths.

Tekton Pipelines 0.16.3

Tekton tkn CLI 0.13.1

Tekton Triggers 0.8.1

cluster tasks based on Tekton Catalog 0.16

IBM Power Systems on OpenShift Container Platform 4.6

IBM Z and LinuxONE on OpenShift Container Platform 4.6

$(params) parameters are now removed from the triggertemplate resource and replaced by $(tt.params) to avoid confusion between the resourcetemplate and triggertemplate resource parameters.

The ServiceAccount reference of the optional EventListenerTrigger-based authentication level has changed from an object reference to a ServiceAccountName string. This ensures that the ServiceAccount reference is in the same namespace as the EventListenerTrigger object.

The Conditions custom resource definition (CRD) is now deprecated; use the WhenExpressions CRD instead.

The PipelineRun.Spec.ServiceAccountNames object is being deprecated and replaced by the PipelineRun.Spec.TaskRunSpec[].ServiceAccountName object.

This release of Red Hat OpenShift Pipelines adds support for a disconnected installation. However, some images used by the cluster tasks must be mirrored for them to work in disconnected clusters.

Pipelines in the openshift namespace are not deleted after you uninstall the Red Hat OpenShift Pipelines Operator. Use the oc delete pipelines -n openshift --all command to delete the pipelines.

Uninstalling the Red Hat OpenShift Pipelines Operator does not remove the event listeners.

When you run a multi-arch container image task without command specification on an IBM Power Systems (ppc64le) or IBM Z (s390x) cluster, the TaskRun resource fails with the following error:

Error executing command: fork/exec /bin/bash: exec format error

$ skopeo inspect --raw <image_name>| jq '.manifests[] | select(.platform.architecture == "<architecture>") | .digest'

A simple syntax validation to check the CEL filter, overlays in the Webhook validator, and the expressions in the interceptor has now been added.

Triggers no longer overwrite annotations set on the underlying deployment and service objects.

Previously, an event listener would stop accepting events. This fix adds an idle timeout of 120 seconds for the EventListener sink to resolve this issue.

Previously, canceling a pipeline run with a Failed(Canceled) state gave a success message. This has been fixed to display an error instead.

The tkn eventlistener list command now provides the status of the listed event listeners, thus enabling you to easily identify the available ones.

Consistent error messages are now displayed for the triggers list and triggers describe commands when triggers are not installed or when a resource cannot be found.

Previously, a large number of idle connections would build up during cloud event delivery. The DisableKeepAlives: true parameter was added to the cloudeventclient config to fix this issue. Thus, a new connection is set up for every cloud event.

Previously, the creds-init code would write empty files to the disk even if credentials of a given type were not provided. This fix modifies the creds-init code to write files for only those credentials that have actually been mounted from correctly annotated secrets.

Tekton Pipelines 0.14.3

Tekton tkn CLI 0.11.0

Tekton Triggers 0.6.1

cluster tasks based on Tekton Catalog 0.14

The --namespace or -n flags for all cluster-wide commands, including the clustertask and clustertriggerbinding commands, are deprecated. It will be removed in a future release.

The name field in triggers.bindings within an event listener has been deprecated in favor of the ref field and will be removed in a future release.

Variable interpolation in trigger templates using $(params) has been deprecated in favor of using $(tt.params) to reduce confusion with the pipeline variable interpolation syntax. The $(params.<paramName>) syntax will be removed in a future release.

The tekton.dev/task label is deprecated on cluster tasks.

The TaskRun.Status.ResourceResults.ResourceRef field is deprecated and will be removed.

The tkn pipeline create, tkn task create, and tkn resource create -f subcommands have been removed.

Namespace validation has been removed from tkn commands.

The default timeout of 1h and the -t flag for the tkn ct start command have been removed.

The s2i cluster task has been deprecated.

Conditions do not support workspaces.

The --workspace option and the interactive mode is not supported for the tkn clustertask start command.

Support of backward compatibility for $(params.<paramName>) syntax forces you to use trigger templates with pipeline specific params as the trigger s webhook is unable to differentiate trigger params from pipelines params.

Pipeline metrics report incorrect values when you run a promQL query for tekton_taskrun_count and tekton_taskrun_duration_seconds_count.

pipeline runs and task runs continue to be in the Running and Running(Pending) states respectively even when a non existing PVC name is given to a workspace.

Previously, the tkn task delete <name> --trs command would delete both the task and cluster task if the name of the task and cluster task were the same. With this fix, the command deletes only the task runs that are created by the task <name>.

Previously the tkn pr delete -p <name> --keep 2 command would disregard the -p flag when used with the --keep flag and would delete all the pipeline runs except the latest two. With this fix, the command deletes only the pipeline runs that are created by the pipeline <name>, except for the latest two.

The tkn triggertemplate describe output now displays resource templates in a table format instead of YAML format.

Previously the buildah cluster task failed when a new user was added to a container. With this fix, the issue has been resolved.

Tekton Pipelines 0.11.3

Tekton tkn CLI 0.9.0

Tekton Triggers 0.4.0

cluster tasks based on Tekton Catalog 0.11

The environment variable $HOME, and variable workingDir in the Steps specification are deprecated and might be changed in a future release. Currently in a Step container, the HOME and workingDir variables are overwritten to /tekton/home and /workspace variables, respectively.

The following commands are deprecated and might be removed in the future release: tkn pipeline create, tkn task create.

The -f flag with the tkn resource create command is now deprecated. It might be removed in the future release.

The -t flag and the --timeout flag (with seconds format) for the tkn clustertask create command are now deprecated. Only duration timeout format is now supported, for example 1h30s. These deprecated flags might be removed in the future release.

If you are upgrading from an older version of Red Hat OpenShift Pipelines, you must delete your existing deployments before upgrading to Red Hat OpenShift Pipelines version 1.0. To delete an existing deployment, you must first delete Custom Resources and then uninstall the Red Hat OpenShift Pipelines Operator. For more details, see the uninstalling Red Hat OpenShift Pipelines section.

Submitting the same v1alpha1 tasks more than once results in an error. Use the oc replace command instead of oc apply when re-submitting a v1alpha1 task.

The buildah cluster task does not work when a new user is added to a container.

useradd: /etc/passwd.8: lock file already used
useradd: cannot lock /etc/passwd; try again later.

Previously, the DeploymentConfig task triggered a new deployment build even when an image build was already in progress. This caused the deployment of the pipeline to fail. With this fix, the deploy task command is now replaced with the oc rollout status command which waits for the in-progress deployment to finish.

Support for APP_NAME parameter is now added in pipeline templates.

Previously, the pipeline template for Java S2I failed to look up the image in the registry. With this fix, the image is looked up using the existing image pipeline resources instead of the user provided IMAGE_NAME parameter.

All the OpenShift Pipelines images are now based on the Red Hat Universal Base Images (UBI).

Previously, when the pipeline was installed in a namespace other than tekton-pipelines, the tkn version command displayed the pipeline version as unknown. With this fix, the tkn version command now displays the correct pipeline version in any namespace.

The -c flag is no longer supported for the tkn version command.

Non-admin users can now list the cluster trigger bindings.

The event listener CompareSecret function is now fixed for the CEL Interceptor.

The list, describe, and start subcommands for tasks and cluster tasks now correctly display the output in case a task and cluster task have the same name.

Previously, the OpenShift Pipelines Operator modified the privileged security context constraints (SCCs), which caused an error during cluster upgrade. This error is now fixed.

In the tekton-pipelines namespace, the timeouts of all task runs and pipeline runs are now set to the value of default-timeout-minutes field using the config map.

Previously, the pipelines section in the web console was not displayed for non-admin users. This issue is now resolved.