Red Hat OpenShift Pipelines release notes

With this update, you can use a parameter of a task or pipeline or a result of a previous task to specify the name of a resource to bind to a workspace, for example, name: $(params.name)-configmap.

With this update, OpenShift Pipelines supports using your existing entitlements for Red Hat Enterprise Linux in build processes within your pipelines. The built-in buildah cluster task can now use these entitlements.

With this update, if a pipeline run or task run uses the pipeline service account, you can use CSI volume types in the pipeline or task.

With this update, you can use a StepAction custom resource (CR) to define a reusable scripted action that you can invoke from any number of tasks. To use this feature, you must set the pipeline.options.configMaps.feature-flags.data.enable-step-actions spec in the TektonConfig CR to true.

With this update, object parameters and array results are enabled by default. You do not need to set any flags to use them.

With this update, you can use the HTTP resolver to fetch a pipeline or task from an HTTP URL, as shown in the following examples:

apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: remote-task-reference
spec:
  taskRef:
    resolver: http
    params:
    - name: url
      value: https://raw.githubusercontent.com/tektoncd-catalog/git-clone/main/task/git-clone/git-clone.yaml

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: http-demo
spec:
  pipelineRef:
    resolver: http
    params:
    - name: url
      value: https://raw.githubusercontent.com/tektoncd/catalog/main/pipeline/build-push-gke-deploy/0.1/build-push-gke-deploy.yaml

With this update, you can use an enum declaration to limit the values that you can supply for a parameter of a pipeline or task, as shown in the following example. To use this feature, you must set the pipeline.options.configMaps.feature-flags.data.enable-param-enum spec in the TektonConfig CR to true.

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: pipeline-param-enum
spec:
  params:
  - name: message
    enum: ["v1", "v2"]
    default: "v1"
# ...

With this update, when using the Git resolver with the authenticated source control management (SCM) API, you can override the default token, SCM type, and server URL that you configured. See the following example:

apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  name: git-api-demo-tr
spec:
  taskRef:
    resolver: git
    params:
    - name: org
      value: tektoncd
    - name: repo
      value: catalog
    - name: revision
      value: main
    - name: pathInRepo
      value: task/git-clone/0.6/git-clone.yaml
    # create the my-secret-token secret in the namespace where the
    # pipelinerun is created. The secret must  contain a GitHub personal access
    # token in the token key of the secret.
    - name: token
      value: my-secret-token
    - name: tokenKey
      value: token
    - name: scmType
      value: github
    - name: serverURL
      value: https://ghe.mycompany.com

With this update, you can define default resource requirements for containers and init-containers in pods that OpenShift Pipelines creates when executing task runs. Use the pipeline.options.configMaps.config-defaults.default-container-resource-requirements spec in the TektonConfig CR to set these requirements. You can set the default values for all containers and also for particular containers by name or by prefix, such as sidecar-*.

With this update, OpenShift Pipelines supports horizontal pod autoscaling for the Operator proxy webhook. If the pod that runs the Operator proxy webhook reaches 85% CPU utilization, the autoscaler creates another replica of the pod. If you want to use more than one replica for the Operator proxy webhook at startup, you must configure this number in the options.horizontalPodAutoscalers spec of the TektonConfig CR.

With this update, the internal leader election for several components of OpenShift Pipelines was improved. The Operator controller, Operator webhook, proxy webhook, Pipelines as Code watcher, Pipelines as Code webhook, and the Tekton Chains controller now use separate leader election ConfigMaps. The leader election affects which replica of a component processes a request.

Before this update, when you scaled up the number of replicas of the OpenShift Pipelines controller, manual intervention was required to enable the use of the new replicas; namely, you needed to delete leases in the leader election. With this update, when you scale up the number of replicas of the OpenShift Pipelines controller, the leader election includes the new replicas automatically, so the new replicas can process information.

With this update, you can optionally set the following flags in the spec.pipeline spec of the TektonConfig CR:

With this update, when specifying CEL expressions for the Triggers interceptor, you can use the first and last functions to access values in a JSON array.

With this update, when specifying CEL expressions for the Triggers interceptor, you can use the translate function that facilitates the utilization of regular expressions to replace characters with specified strings, as in the following example:

".translate("[^a-z0-9]+", "ABC")

This is $an Invalid5String

ABChisABCisABCanABCnvalid5ABCtring

With this update, you can enable the web console plugin for OpenShift Pipelines. If you enable the plugin, you can view pipeline and task execution statistics in the Pipelines overview page and in the page of a pipeline. You must install Tekton Results to view this information.

With this update, if you are using OpenShift Container Platform 4.15 and you enabled the console plugin, you can view archive information about past pipeline runs and task runs. Tekton Results provides this information.

With this update, the PipelineRun details page, accessible from both the Developer or Administrator perspective of the web console, introduces a Vulnerabilities row. This new row offers a visual representation of identified vulnerabilities, categorized by severity (critical, high, medium, and low). To enable this feature, update your tasks and associated pipelines to the specified format. Additionally, once enabled, you can also access the information about identified vulnerabilities through the Vulnerabilities column in the pipeline run list view page.

With this update, the PipelineRun details page, accessible from both the Developer or Administrator perspective of the web console, provides an option to download or view Software Bill of Materials (SBOMs) for enhanced transparency and control. To enable this feature, update your tasks and associated pipelines to the specified format.

With this update, the tkn version command displays the version of the Tekton Hub component if this component is installed.

With this update, you can use the tkn customrun list command to list custom runs.

With this update, when using the tkn task start command, you can specify a URL for an OCI image in the -i or --image argument. The command pulls the image and runs the specified task from this image.

With this update, the opc version command displays the version of the Tekton Results CLI component, which is a part of the opc utility.

With this update, when using Pipelines as Code, you can specify the pipelinesascode.tekton.dev/pipeline annotation on a pipeline run to fetch the pipeline from a Tekton Hub instance. The value of this annotation must refer to a single pipeline on Tekton Hub.

With this update, you can deploy an additional Pipelines as Code controller with different configuration settings and different secrets. You can use multiple Pipelines as Code controllers to interact with multiple GitHub instances.

With this update, Pipelines as Code includes metrics publication for the GitLab and BitBucket providers. You can access the metrics using the /metrics path on the Pipelines as Code controller and watcher service, port 9090.

With this update, when specifying the conditions for executing a pipeline run using a CEL expression with pipelinesascode.tekton.dev/on-cel-expression , you can check for existence of files in the Git repository:

With this update, Tekton Chains supports the v1 value of the API version.

With this update, you can set the artifacts.pipelinerun.enable-deep-inspection parameter in the TektonConfig CR. When this parameter is true, Tekton Chains records the results of the child task runs of a pipeline run. When this parameter is false, Tekton Chains records the results of the pipeline run but not of its child task runs.

With this update, you can set the builddefinition.buildtype parameter in the TektonConfig CR to set the build type for in-toto attestation. When this parameter is https://tekton.dev/chains/v2/slsa, Tekton Chains records in-toto attestations in strict conformance with the SLSA v1.0 specification. When this parameter is https://tekton.dev/chains/v2/slsa-tekton, Tekton Chains records in-toto attestations with additional information such as the labels and annotations in each task run and pipeline run, and also adds each task in a pipeline run under resolvedDependencies.

Before this update, when Tekton Chains was configured to use gcs storage, Tekton Chains did not record pipeline run information. With this update, Tekton Chains records pipeline run information with this storage.

With this update, performance metrics are available for Tekton Chains. To access the metrics, expose the tekton-chains-metrics service and then use the /metrics path on this service, port 9090. These metrics are also available in the OpenShift Container Platform Monitoring stack.

With this update, Tekton Chains uses the new v2alpha3 record format version when recording pipeline runs and task runs that use the v1 version value.

With this update, Tekton Chains uses the v1 version of pipeline run and task run formats internally.

With this update, if Tekton Results is installed, Tekton Results records the summary and record data for pipeline runs started using Pipelines as Code.

With this update, Tekton Results provides up to 100 megabytes of logging information for a pipeline or task.

With this update, any authenticated user can view the tekton-results-api-service route in the openshift-pipelines namespace to interact with Tekton Results using a REST API.

With this update, the Tekton Results API includes a new endpoint for fetching summary and aggregation for a list of records.

With this update, the GetLog endpoint of the Tekton Results API returns raw bytes with the text/plain content type.

With this update, you can optionally specify a custom CA certificate in the options.configMaps.tekton-results-api-config.data.config.DB_SSLROOTCERT spec in the TektonResult CR. In this case, Tekton Results requires an SSL connection to the database server and uses this certificate for the connection. If you want to use this setting, when configuring Tekton Results you must also use alternate specs for several other configuration parameters, as listed in the following table. Both the regular and the alternate parameter specs are in the TektonResult CR.

Before this update, when using multiple Pipelines as Code controllers configured with different GitHub apps, the Pipelines as Code watcher component crashed with a nilerror message. With this update, Pipelines as Code functions normally with multiple controllers configured with different GitHub apps.

Before this update, when you started a pipeline run using Pipelines as Code, Tekton Results did not store information about this pipeline run. Because of this issue, the web console plugin did not include the pipeline run in the execution statistics display. With this update, Tekton Results stores information about Pipelines as Code pipeline runs and these pipeline runs are included in the execution statistics display.

Before this update, when you started many pipeline runs using Pipelines as Code at the same time and these pipelines runs included a max-keep-run annotation, the Pipelines as Code watcher component failed to process some of the pending pipeline runs and they remained in a pending state. With this update, Pipelines as Code pipeline runs are processed correctly.

Before this update, when you started many pipeline runs using Pipelines as Code at the same time and these pipelines runs included a max-keep-run annotation, the Pipelines as Code watcher was unable to reconcile the pipeline runs because of a race condition between deletion of existing pipeline runs and processing new pipeline runs. Because of this issue, some pipeline runs could not be processed. With this update, the Pipelines as Code watcher processes pipeline runs.

Before this update, when you used the tkn pr logs -f command to view the logs for a running pipeline, the command line utility stopped responding, even if the pipeline run completed successfully. With this update, the tkn pr logs -f command properly displays the log information and exits.

Before this update, a large number of error messages referencing tekton-pipelines-webhook.ConversionWebhook could be logged. With this update, unneeded conversion webhook configuration for the ClusterTask and StepAction Custom Resource Definitions (CRDs) was removed, and such error messages are no longer logged.

Before this update, some configuration settings using the options sections in the TektonConfig custom resource (CR) did not work, because a race condition would occur if the same setting was configured in both the options section and another field in the TektonConfig CR. With this update, the settings work.

Before this update, the OpenShift Pipelines console plugin pod did not move to the node specified using the nodeSelector, tolerations, and priorityClassName settings. With this update, the OpenShift Pipelines plugin pod moves to the correct node.

Before this update, some error messages were logged in the operator controller logs without the proper context information. With this update, error messages contain the required information.

Before this update, if the pipelines-scc-rolebinding rolebinding was missing or deleted in any namespace, the OpenShift Pipelines operator controller would fail to create default resources in new namespaces correctly. With this update, the controller functions correctly.

Before this update, if you configured the Horizontal Pod Autoscaler (HPA) using the options section in the TektonConfig CR, any existing HPA was updated correctly but a new HPA was not created when required. With this update, Horizontal Pod Autoscaler configuration using the options section works correctly.

Before this update, if a user or an OpenShift Pipelines controller used the OpenShift Pipelines API to modify a pipeline run that was in the process of being started by Pipelines as Code, Pipelines as Code could stop and the log contained "panic" messages. With this update, the pipeline being started by Pipelines as Code can be modified concurrently.

Before this update, in Pipelines as Code, a concurrency limit setting of 0 was not interpreted as disabling the concurrency limit. With this update, a concurrency limit setting of 0 disables the concurrency limit.

Before this update, when you used the web console and clicked a pipeline in the overview page, the pipeline details page did not contain information about tasks in the pipeline. With this update, when you click a pipeline in the overview page, the pipeline details page contains the required information.

Before this update, when you configured Tekton Chains to disable storing OCI artifacts by setting an empty artifacts.oci.storage value in the TektonConfig CR, the configuration did not work and Tekton Chains attempted to store the artifacts and logged a failure in the chains.tekton.dev/signed annotation. With this update, when you set an empty artifacts.oci.storage value in the TektonConfig CR, Tekton Chains does not attempt to store OCI artifacts.

Before this update, the Source-to-Image (S2I) cluster tasks used a base S2I container image that was in Technology Preview. With this update, the S2I cluster tasks used a base S2I container image that is released and fully supported.

With this update, optionally, you can enable a setting so that, when a task run is cancelled, OpenShift Pipelines stops the pod for the task run but does not delete the pod. To enable this setting, in the TektonConfig custom resource (CR) set the pipeline.options.configMaps.feature-flags.data.keep-pod-on-cancel spec to true and the pipeline.enable-api-fields spec to alpha.

Before this update, you had to enable alpha features in order to set compute resource limits on the task level. With this update, you can use the computeResources spec for a TaskRun CR to set the resource limits for a task.

With this update, when specifying a task and using the displayName parameter, you can use parameters that include the values of parameters, results, or context variables in the display name, for example, $(params.application), $(tasks.scan.results.report), $(context.pipeline.name).

With this update, when specifying a remote pipeline or task using the hub resolver, in the version parameter you can use inequation constraints such as >=0.2.0,< 1.0.0.

With this update, when specifying a task you can use a Common Expression Language (CEL) expression in the when expression. To use this feature, you must set the pipeline.options.configMaps.feature-flags.data.enable-cel-in-whenexpression spec to true in the TektonConfig CR.

With this update, when specifying a pipeline in a PipelineRun CR spec, you can reference the results produced by an inline task in a subsequent inline task.

  apiVersion: tekton.dev/v1
  kind: Task
  metadata:
    name: uid-task
  spec:
    results:
      - name: uid
    steps:
      - name: uid
        image: alpine
        command: ["/bin/sh", "-c"]
        args:
          - echo "1001" | tee $(results.uid.path)
  ---
  apiVersion: tekton.dev/v1
  kind: PipelineRun
  metadata:
    name: uid-pipeline-run
  spec:
    pipelineSpec:
      tasks:
      - name: add-uid
        taskRef:
          name: uid-task
      - name: show-uid
        taskSpec:
          steps:
            - name: show-uid
              image: alpine
              command: ["/bin/sh", "-c"]
              args:
                - echo $(tasks.add-uid.results.uid)

With this update, when configuring the cluster resolver, you can set the value of the blocked-namespaces parameter to *. With this setting, only the namespaces listed in the allowed-namespaces parameter are allowed and all other namespaces are blocked.

With this update, the disable-affinity-assistant feature flag has been deprecated and might be removed in a future release. Instead, in the TektonConfig CR, you can set the pipeline.options.configMaps.feature-flags.data.coschedule spec to one of the following values:

Before this update, the core interceptor always created TLS secrets when starting. With this update, the core interceptor creates TLS secrets if a TLS secret is not present on the cluster or when a certificate in the existing secret has expired.

With this update, when you use the tkn bundle push command, the bundle is created with the creation time set to 1970-01-01T00:00:00Z (Unix epoch time). This change ensures that bundle images created from the same source are always identical. You can use the --ctime parameter to set the creation time in the RFC3339 format. You can also use the SOURCE_DATE_EPOCH environment variable to set the creation time.

With this update, in Pipelines as Code, when using a CEL expression for advanced event matching (pipelinesascode.tekton.dev/on-cel-expression), you can use the header and body fields to access the full payload that is passed by the Git repository provider body. You can use this feature to filter events by any information that the Git repository sends.

With this update, when a Pipelines as Code pipeline run is triggered by a push event, you can use /test, /test branch:<branchname>, /retest, /retest branch:<branchname>, /cancel, and /cancel branch:<branchname> commands on the corresponding commit comment to re-run or cancel the pipeline run.

With this update, when using Pipelines as Code, you can use remote tasks on remote pipelines. Therefore, you can reuse a complete remote pipeline across multiple repositories. You can override tasks from the remote pipeline by adding a task with the same name.

With this update, when using Pipelines as Code, you can view improved information about CI pipeline runs in the Git repository provider. This information includes the namespace and the associated pipeline run.

Before this update, a task run sometimes failed with a cannot stop the sidecar error message. With this update, the race condition between controllers that caused this failure is fixed.

Before this update, to enable keeping pods when a task run is cancelled, along with setting the pipeline.options.configMaps.feature-flags.data.keep-pod-on-cancel spec to true in the TektonConfig CR, you also need to set the pipeline.enable-api-fields spec to alpha in the TektonConfig CR. With this update, setting the pipeline.options.configMaps.feature-flags.data.keep-pod-on-cancel spec to true in the TektonConfig CR enables keeping pods when a task run is cancelled, and no additional setting is necessary.

Before this update, if you defined a sidecar for a task, OpenShift Pipelines did not validate the container image in the definition when creating the Task and TaskRun custom resources (CRs). At run time, a sidecar with an invalid container image caused the task run to fail. With this update, OpenShift Pipelines validates the container image in the sidecar definition when creating the Task and TaskRun CRs.

Before this update, the OpenShift Pipelines controller sometimes crashed when the task was evaluating parameters. With this update, the controller no longer crashes.

Before this update, if the final task in a pipeline run failed or was skipped, OpenShift Pipelines sometimes reported a validation error for the pipeline run. With this update, OpenShift Pipelines reports the status of the pipeline run correctly.

With this update, the web console includes a new gauge metric for pipeline runs and task runs. This metric indicates whether the underlying pods are being throttled by OpenShift Container Platform either because of resource quota policies defined in the namespace or because of resource constraints on the underlying node.

With this update, the new set-security-context feature flag is set to true by default, in order to enable task runs and pipeline runs to run in namespaces with restricted pod security admission policies.

With this update, the enable-api-fields flag is set to beta by default. You can use all features that are marked as beta in the code without further changes.

With this update, the results.tekton.dev/* and chains.tekton.dev/* reserved annotations are not passed from the pipeline run to the task runs that it creates.

Before this update, CSI volumes and projected volumes were not enabled by default. With this update, you can use CSI volumes and projected volumes in your pipelines without changing any configuration fields.

With this update, the isolated workspaces feature is enabled by default. You can use this feature to share a workspace with specified steps and sidecars without sharing it with the entire task run.

With this update, you can configure the default security context constraint (SCC) for the pods that OpenShift Pipelines creates for pipeline runs and task runs. You can set the SCC separately for different namespaces and also configure the maximum (least restrictive) SCC that can be set for any namespace.

With this update, a new options: heading is available under each component in the TektonConfig spec. You can use parameters under this headings to control settings for different components. In particular, you can use parameters under the platforms.openshift.pipelinesAsCode.options.configMaps.pac-config-logging.data spec to set logging levels for components of Pipelines as Code.

With this update, you can use the new spec.pipeline.performance.replicas parameter to set the number of replicas that are created for the OpenShift Pipelines controller pod. If you previously set the replica counts in your deployment manually, you must now use this setting to control the replica counts.

With this update, the Operator ensures that the stored API version remains the same throughout your deployment of OpenShift Pipelines. The stored API version in OpenShift Pipelines 1.12 is v1.

With this update, you can use a secret to configure S3 bucket storage to store Tekton Results logging information. When configuring S3 bucket storage, you must provide the secret with the S3 storage credentials by using the new secret_name spec in the TektonResult custom resource (CR).

With this update, you can configure Tekton Results to store data in an external PostgreSQL server.

With this update, you can use Google Cloud Storage (GCS) to store Tekton Results logging information. You can provide the secret with the GCS storage credentials and then provide the secret name, secret key, and bucket name in properties under the TektonResult spec. You can also use Workload Identity Federation for authentication.

With this update, any service account authenticated with OpenShift Pipelines can access the TektonResult CR.

With this update, Tekton Results includes cluster role aggregation for service accounts with admin, edit, and view roles. Cluster role binding is no longer required for these service accounts to access results and records using the Tekton Results API.

With this update, you can configure pruning for each PipelineRun or TaskRun resource by setting a prune-per-resource boolean field in the TektonConfig CR. You can also configure pruning for each PipelineRun or TaskRun resource in a namespace by adding the operator.tekton.dev/prune.prune-per-resource=true annotation to that namespace.

With this update, if there are any changes in the OpenShift Container Platform cluster-wide proxy, Operator Lifecycle Manager (OLM) recreates the Red Hat OpenShift Pipelines Operator.

With this update, you can disable the pruner feature by setting the value of the config.pruner.disabled field to true in the TektonConfig CR.

With this update, you can configure readiness and liveness probes on Trigger CRs. You can also set the value of the failure threshold for the probes; the default value is 3.

With this update, OpenShift Pipelines triggers add Type and Subject values when creating a response to a Cloud Events request.

With this update, the tkn pipeline logs command displays the logs of a pipeline or task that is referenced using a resolver.

With this update, when entering the tkn bundle push command, you can use the --annotate flag to provide additional annotations.

With this update, a Pipelines as Code pipeline run can include remote tasks fetched from multiple Artifact Hub or Tekton Hub instances and from different catalogs in the same hub instance.

With this update, you can use parameters under the platforms.openshift.pipelinesAsCode.options.configMaps.pac-config-logging.data spec in the TektonConfig CR to set logging levels for Pipelines as Code components.

With this update, you can set policies that allow certain actions only to members of a team and reject the actions when other users request them. Currently, the pull_request and ok_to_test actions support setting such policies.

With this update, you can pass arbitrary parameters in the incoming webhook as a JSON payload. OpenShift Pipelines passes these parameters to the pipeline run. To provide an additional security layer, you must explicitly define the permitted parameters in the Repository CR.

With this update, matching a large set of pipeline runs with a large number of remote annotations in Pipelines as Code is optimized. Pipelines as Code fetches the remote tasks only for the pipeline run that has matched.

With this update, you can use the source_url variable in a pipeline run template to retrieve information about the forked repository from where the event, such as a pull or push request, is triggered.

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
# ...
spec:
  params:
    - name: source_url
      value: "{{ source_url }}"
  pipelineSpec:
    params:
      - name: source_url
# ...

With this update, if an authorized user provides an ok-to-test comment to trigger a pipeline run on the pull request from an unauthorized user and then the author makes further changes to the branch, Pipelines as Code triggers the pipelines. To disable triggering the pipeline until an authorized user provides a new ok-to-test comment, set the pipelinesAsCode.settings.remember-ok-to-test spec in the TektonConfig CR to false.

With this update, on the GitHub status check page, the table that shows the status of all tasks includes the display name of every task.

With this update, you can configure the tags push event in a pipeline run on GitLab.

With this update, you can use the target_url and source_url fields in Pipelines as Code Common Expression Language (CEL) expression filtering annotations to filter the request for a specific target or source.

With this update, when you configure fetching a remote GitHub URL using a token, you can include a branch name that contains a slash. You must encode the slash within the branch name as %2F to ensure proper parsing by Pipelines as Code, as in the following example URL: https://github.com/organization/repository/blob/feature%2Fmainbranch/path/file. In this example URL, the branch name is feature/mainbranch and the name of the file to fetch is /path/file.

With this update, you can use --v1beta1 flag in the tkn pac resolve command. Use this flag if the pipeline run is generated with the v1beta1 API version schema.

Before this update, if you configured Pipelines as Code with the custom console driver to output to a custom console, the Pipelines as Code controller crashed in certain cases. After you pushed changes to a pull request, the CI status check for this pull request could remain as waiting for status to be reported and the associated pipeline run did not complete. With this update, the Pipelines as Code controller operates normally. After you push changes to a pull request, the associated pipeline run completes normally and the CI status check for the pull request is updated.

Before this update, when using Pipelines as Code, if you created an access policy on the Repository custom resource (CR) that did not include a particular user and then added the user to the OWNER file in the Git repository, the user would have no rights for the Pipelines as Code CI process. For example, if the user created a pull request into the Git repository. the CI process would not run on this pull request automatically. With this update, a user who is not included in the access policy on the Repository CR but is included in the OWNER file is allowed to run the CI process for the repository.

With this update, the HTTP/2.0 protocol is not supported for webhooks. All webhook calls to Red Hat OpenShift Pipelines must use the HTTP/1.1 protocol.

Before this update, the generated Git secret for the latest pipeline run was deleted when the max-keep-runs parameter was exceeded. With this update, the Git secret is no longer deleted on the latest pipeline run.

With this update, the S2I cluster task uses a General Availability container image.

With this update, you can use Red Hat OpenShift Pipelines on the OpenShift Container Platform cluster that runs on ARM hardware. You have support for the ClusterTask resources where images are available and the Tekton CLI tool on ARM hardware.

This update adds support for results, object parameters, array results, and indexing into an array when you set the enable-api-fields feature flag to beta value in the TektonConfig CR.

With this update, propagated parameters are now part of a stable feature. This feature enables interpolating parameters in embedded specifications to reduce verbosity in Tekton resources.

With this update, propagated workspaces are now part of a stable feature. You can enable the propagated workspaces feature by setting the enable-api-fields feature flag to alpha or beta value.

With this update, the TaskRun object fetches and displays the init container failure message to users when a pod fails to run.

With this update, you can replace parameters, results, and the context of a pipeline task while configuring a matrix as per the following guidelines:

With this update, the TaskRun resource validation process also validates the matrix.include parameters. The validation checks whether all parameters have values and match the specified type, and object parameters have all the keys required.

This update adds a new default-resolver-type field in the default-configs config map. You can set the value of this field to configure a default resolver.

With this update, you can define and use a PipelineRun context variable in the pipelineRun.workspaces.subPath configuration.

With this update, the ClusterResolver, BundleResolver, HubResolver, and GitResolver features are now available by default.

With this update, Tekton Triggers support the Affinity and TopologySpreadConstraints values in the EventListener specification. You can use these values to configure Kubernetes and custom resources for an EventListener object.

This update adds a Slack interceptor that allows you to extract fields by using a slash command in Slack. The extracted fields are sent in the form data section of an HTTP request.

With this update, you can configure pruning for each PipelineRun or TaskRun resource by setting a prune-per-resource boolean field in the TektonConfig CR. You can also configure pruning for each PipelineRun or TaskRun resource in a namespace by adding the operator.tekton.dev/prune.prune-per-resource=true annotation to that namespace.

With this update, if there are any changes in the OpenShift Container Platform cluster-wide proxy, Operator Lifecycle Manager (OLM) recreates the Red Hat OpenShift Pipelines Operator.

With this update, you can disable the pruner feature by setting the value of the config.pruner.disabled field to true in the TektonConfig CR.

With this update, Tekton Chains is now generally available for use.

With this update, you can use the skopeo tool with Tekton Chains to generate keys, which are used in the cosign signing scheme.

When you upgrade to the Red Hat OpenShift Pipelines Operator 1.11, the previous Tekton Chains configuration will be overwritten and you must set it again in the TektonConfig CR.

This update adds a new resource/<catalog_name>/<kind>/<resource_name>/raw endpoint and a new resourceURLPath field in the resource API response. This update helps you to obtain the latest raw YAML file of the resource.

This update adds Tekton Results to the Tekton Operator as an optional component.

With this update, Pipelines as Code allows you to expand a custom parameter within your PipelineRun resource by using the params field. You can specify a value for the custom parameter inside the template of the Repository CR. The specified value replaces the custom parameter in your pipeline run. Also, you can define a custom parameter and use its expansion only when specified conditions are compatible with a Common Expression Language (CEL) filter.

With this update, you can either rerun a specific pipeline or all pipelines by clicking the Re-run all checks button in the Checks tab of the GitHub interface.

This update adds a new tkn pac info command to the Pipelines as Code CLI. As an administrator, you can use the tkn pac info command to obtain the following details about the Pipelines as Code installation:

This update enables error detection for all PipelineRun resources by default. Pipelines as Code detects if a PipelineRun resource execution has failed and shows a snippet of the last few lines of the error. For a GitHub application, Pipelines as Code detects error messages in the container logs and exposes them as annotations on a pull request.

With this update, you can fetch tasks from a private Tekton Hub instance attached to a private Git repository. To enable this update, Pipelines as Code uses the internal raw URL of the private Tekton Hub instance instead of using the GitHub raw URL.

Before this update, Pipelines as Code provided logs that would not include the namespace detail. With this update, Pipelines as Code adds the namespace information to the pipeline logs so that you can filter them based on a namespace and debug easily.

With this update, you can define the provenance source from where the PipelineRun resource definition is to be fetched. By default, Pipelines as Code fetches the PipelineRun resource definition from the branch where the event has been triggered. Now, you can configure the value of the pipelinerun_provenance setting to default_branch so that the PipelineRun resource definition is fetched from the default branch of the repository as configured on GitHub.

With this update, you can extend the scope of the GitHub token at the following levels:

With this update, Pipelines as Code triggers a CI pipeline for a pull request created by a user who is not an owner, collaborator, or public member or is not listed in the owner file but has permission to push changes to the repository.

With this update, the custom console setting allows you to use custom parameters from a Repository CR.

With this update, Pipelines as Code changes all PipelineRun labels to PipelineRun annotations. You can use a PipelineRun annotation to mark a Tekton resource, instead of using a PipelineRun label.

With this update, you can use the pac-config-logging config map for watcher and webhook resources, but not for the Pipelines as Code controller.

Before this update, a task run could fail with a mount path error message, when a running or pending pod was preempted. With this update, a task run does not fail when the cluster causes a pod to be deleted and re-created.

Before this update, a shell script in a task had to be run as root. With this update, the shell script image has the non-root user ID set so that you can run a task that includes a shell script, such as the git-clone task, as a non-root user within the pod.

Before this update, in Red Hat OpenShift Pipelines 1.11.0, when a pipeline run is defined using Pipelines as Code, the definition in the Git repository references the tekton.dev/v1beta1 API version and includes a spec.pipelineRef.bundle entry, the kind parameter for the bundle reference was wrongly set to Task. The issue did not exist in earlier versions of Red Hat OpenShift Pipelines. With this update, the kind parameter is set correctly.

Before this update, the disable-ha flag was not correctly passed to the tekton-pipelines controller, so the High Availability (HA) feature of Red Hat OpenShift Pipelines could not be enabled. With this update, the disable-ha flag is correctly passed and you can enable the HA feature as required.

Before this update, you could not set the URL for Tekton Hub and Artifact Hub for the hub resolver, so you could use only the preset addresses of Tekton Hub and Artifact Hub. With this update, you can configure the URL for Tekton Hub and Artifact Hub for the hub resolver, for example, to use a custom Tekton Hub instance that you installed.

With this update, the SHA digest of the git-init image corresponds to version 1.10.5, which is the current released version of the image.

Before this update, the tekton-pipelines-controller component used a config map named config-leader-election. This name is the default value for knative controllers, so the configuration process for OpenShift Pipelines could affect other controllers and vice versa. With this update, the component uses a unique config name, so the configuration process for OpenShift Pipelines does not affect other controllers and is not affected by other controllers.

Before this update, when a user without write access to a GitHub repository opened a pull request, Pipelines as Code CI/CD actions would show as skipped in GitHub. With this update, Pipelines as Code CI/CD actions are shown as Pending approval in GitHub.

Before this update, Pipelines as Code ran CI/CD actions for every pull request into a branch that matched a configured branch name. With this update, Pipelines as Code runs CI/CD actions only when the source branch of the pull request matches the exact configured branch name.

Before this update, metrics for the Pipelines as Code controller were not visible in the OpenShift Container Platform developer console. With this update, metrics for the Pipelines as Code controller are displayed in the developer console.

Before this update, in Red Hat OpenShift Pipelines 1.11.0, the Operator always installed Tekton Chains and you could not disable installation of the Tekton Chains component. With this update, you can set the value of the disabled parameter to true in the TektonConfig CR to disable installation okindf Tekton Chains.

Before this update, if you configured Tekton Chains on an older version of OpenShift Pipelines using the TektonChain CR and then upgraded to OpenShift Pipelines version 1.11.0, the configuration information was overwritten. With this update, if you upgrade from an older version of OpenShift Pipelines and Tekton Chains was configured in the same namespace where the TektonConfig is installed (openshift-pipelines), Tekton Chains configuration information is preserved.

Before this update, the tkn pac resolve -f command did not detect the existing secret for authentication with the Git repository. With this update, this command successfully detects the secret.

With this update, you can use --v1beta1 flag in the tkn pac resolve command. Use this flag if you want to generate the pipeline run with the v1beta1 API version schema.

Before this update, the tkn pr logs command failed to display the logs for a pipeline run if this pipeline run referenced a resolver. With this update, the command displays the logs.

With this update, the SHA digest of the git-init image corresponds to version 1.12.1, which is the current released version of the image

With this update, the HTTP/2.0 protocol is not supported for webhooks. All webhook calls to Red Hat OpenShift Pipelines must use the HTTP/1.1 protocol.

Before this update, if the final task of a pipeline has failed or was skipped, OpenShift Pipelines reported validation errors. With this update, a pipeline can succeed even if its final task fails or is skipped.

With this update, you can specify environment variables in a PipelineRun or TaskRun pod template to override or append the variables that are configured in a task or step. Also, you can specify environment variables in a default pod template to use those variables globally for all PipelineRuns and TaskRuns. This update also adds a new default configuration named forbidden-envs to filter environment variables while propagating from pod templates.

With this update, custom tasks in pipelines are enabled by default.

This update supports the v1beta1.CustomRun API version for custom tasks.

This update adds support for the PipelineRun reconciler to create a custom run. For example, custom TaskRuns created from PipelineRuns can now use the v1beta1.CustomRun API version instead of v1alpha1.Run, if the custom-task-version feature flag is set to v1beta1, instead of the default value v1alpha1.

This update adds a new retries field to the v1beta1.TaskRun and v1.TaskRun specifications.

With this update, triggers support the creation of Pipelines, Tasks, PipelineRuns, and TaskRuns objects of the v1 API version along with CustomRun objects of the v1beta1 API version.

With this update, GitHub Interceptor blocks a pull request trigger from being executed unless invoked by an owner or with a configurable comment by an owner.

With this update, GitHub Interceptor has the ability to add a comma delimited list of all files that have changed for the push and pull request events. The list of changed files is added to the changed_files property of the event payload in the top-level extensions field.

This update changes the MinVersion of TLS to tls.VersionTLS12 so that triggers run on OpenShift Container Platform when the Federal Information Processing Standards (FIPS) mode is enabled.

This update adds support to pass a Container Storage Interface (CSI) file as a workspace at the time of starting a Task, ClusterTask or Pipeline.

This update adds v1 API support to all CLI commands associated with task, pipeline, pipeline run, and task run resources. Tekton CLI works with both v1beta1 and v1 APIs for these resources.

This update adds support for an object type parameter in the start and describe commands.

This update adds a default-forbidden-env parameter in optional pipeline properties. The parameter includes forbidden environment variables that should not be propagated if provided through pod templates.

This update adds support for custom logos in Tekton Hub UI. To add a custom logo, set the value of the customLogo parameter to base64 encoded URI of logo in the Tekton Hub CR.

This update increments the version number of the git-clone task to 0.9.

This update adds annotations and labels to the PipelineRun and TaskRun attestations.

This update adds a new format named slsa/v1, which generates the same provenance as the one generated when requesting in the in-toto format.

With this update, Sigstore features are moved out from the experimental features.

With this update, the predicate.materials function includes image URI and digest information from all steps and sidecars for a TaskRun object.

This update supports installing, upgrading, or downgrading Tekton resources of the v1 API version on the cluster.

This update supports adding a custom logo in place of the Tekton Hub logo in UI.

This update extends the tkn hub install command functionality by adding a --type artifact flag, which fetches resources from the Artifact Hub and installs them on your cluster.

This update adds support tier, catalog, and org information as labels to the resources being installed from Artifact Hub to your cluster.

This update enhances incoming webhook support. For a GitHub application installed on the OpenShift Container Platform cluster, you do not need to provide the git_provider specification for an incoming webhook. Instead, Pipelines as Code detects the secret and use it for the incoming webhook.

With this update, you can use the same token to fetch remote tasks from the same host on GitHub with a non-default branch.

With this update, Pipelines as Code supports Tekton v1 templates. You can have v1 and v1beta1 templates, which Pipelines as Code reads for PR generation. The PR is created as v1 on cluster.

Before this update, OpenShift console UI would use a hardcoded pipeline run template as a fallback template when a runtime template was not found in the OpenShift namespace. This update in the pipelines-as-code config map provides a new default pipeline run template named, pipelines-as-code-template-default for the console to use.

With this update, Pipelines as Code supports Tekton Pipelines 0.44.0 minimal status.

With this update, Pipelines as Code supports Tekton v1 API, which means Pipelines as Code is now compatible with Tekton v0.44 and later.

With this update, you can configure custom console dashboards in addition to configuring a console for OpenShift and Tekton dashboards for k8s.

With this update, Pipelines as Code detects the installation of a GitHub application initiated using the tkn pac create repo command and does not require a GitHub webhook if it was installed globally.

Before this update, if there was an error on a PipelineRun execution and not on the tasks attached to PipelineRun, Pipelines as Code would not report the failure properly. With this update, Pipelines as Code reports the error properly on the GitHub checks when a PipelineRun could not be created.

With this update, Pipelines as Code includes a target_namespace variable, which expands to the currently running namespace where the PipelineRun is executed.

With this update, Pipelines as Code lets you bypass GitHub enterprise questions in the CLI bootstrap GitHub application.

With this update, Pipelines as Code does not report errors when the repository CR was not found.

With this update, Pipelines as Code reports an error if multiple pipeline runs with the same name were found.

Before this update, if the source branch information coming from payload included refs/heads/ but the user-configured target branch only included the branch name, main, in a CEL expression, the push request would fail. With this update, Pipelines as Code passes the push request and triggers a pipeline if either the base branch or target branch has refs/heads/ in the payload.

Before this update, when a PipelineRun object could not be created, the error received from the Tekton controller was not reported to the user. With this update, Pipelines as Code reports the error messages to the GitHub interface so that users can troubleshoot the errors. Pipelines as Code also reports the errors that occurred during pipeline execution.

With this update, Pipelines as Code does not echo a secret to the GitHub checks interface when it failed to create the secret on the OpenShift Container Platform cluster because of an infrastructure issue.

This update removes the deprecated APIs that are no longer in use from Red Hat OpenShift Pipelines.

disable-ha

buckets

kube-api-qps

kube-api-burst

threads-per-controller

This update fixes the bundle resolver conversion issue for the PipelineRef field in a pipeline run. Now, the conversion feature sets the value of the kind field to Pipeline after conversion.

Before this update, the pipelinerun.timeouts field was reset to the timeouts.pipeline value, ignoring the timeouts.tasks and timeouts.finally values. This update fixes the issue and sets the correct default timeout value for a PipelineRun resource.

Before this update, the controller logs contained unnecessary data. This update fixes the issue.

Before this update, huge pipeline runs were not getting listed or deleted using the oc and tkn commands. This update mitigates this issue by compressing the huge annotations that were causing this problem. Remember that if the pipeline runs are still too huge after compression, then the same error still recurs.

Before this update, only the pod template specified in the pipelineRun.spec.taskRunSpecs[].podTemplate object would be considered for a pipeline run. With this update, the pod template specified in the pipelineRun.spec.podTemplate object is also considered and merged with the template specified in the pipelineRun.spec.taskRunSpecs[].podTemplate object.

If you enter the tkn task start or tkn clustertask start command, the tkn command line utility displays an error message. As a workaround, to start tasks or cluster tasks using the command line, use the version of the tkn utility shipped with OpenShift Pipelines 1.11 or a later version.

With this update, the S2I cluster task uses a General Availability container image.

With this update, the HTTP/2.0 protocol is not supported for webhooks. All webhook calls to Red Hat OpenShift Pipelines must use the HTTP/1.1 protocol.

With this update, you can specify pipeline parameters and results in arrays and object dictionary forms.

This update provides support for Container Storage Interface (CSI) and projected volumes for your workspace.

With this update, you can specify the stdoutConfig and stderrConfig parameters when defining pipeline steps. Defining these parameters helps to capture standard output and standard error, associated with steps, to local files.

With this update, you can add variables in the steps[].onError event handler, for example, $(params.CONTINUE).

With this update, you can use the output from the finally task in the PipelineResults definition. For example, $(finally.<pipelinetask-name>.result.<result-name>), where <pipelinetask-name> denotes the pipeline task name and <result-name> denotes the result name.

This update supports task-level resource requirements for a task run.

With this update, you do not need to recreate parameters that are shared, based on their names, between a pipeline and the defined tasks. This update is part of a developer preview feature.

This update adds support for remote resolution, such as built-in git, cluster, bundle, and hub resolvers.

This update adds the Interceptor CRD to define NamespacedInterceptor. You can use NamespacedInterceptor in the kind section of interceptors reference in triggers or in the EventListener specification.

This update enables CloudEvents.

With this update, you can configure the webhook port number when defining a trigger.

This update supports using trigger eventID as input to TriggerBinding.

This update supports validation and rotation of certificates for the ClusterInterceptor server. 

This update supports showing annotations in the describe command.

This update supports showing pipeline, tasks, and timeout in the pr describe command.

This update adds flags to provide pipeline, tasks, and timeout in the pipeline start command.

This update supports showing the presence of workspace, optional or mandatory, in the describe command of a task and pipeline.

This update adds the timestamps flag to show logs with a timestamp.

This update adds a new flag --ignore-running-pipelinerun, which ignores the deletion of TaskRun associated with PipelineRun.

This update adds support for experimental commands. This update also adds experimental subcommands, sign and verify to the tkn CLI tool.

This update makes the Z shell (Zsh) completion feature usable without generating any files.

This update introduces a new CLI tool called opc. It is anticipated that an upcoming release will replace the tkn CLI tool with opc.

With this update, Pipelines as Code is installed by default. You can disable Pipelines as Code by using the -p flag:

$ oc patch tektonconfig config --type="merge" -p '{"spec": {"platforms": {"openshift":{"pipelinesAsCode": {"enable": false}}}}}'

With this update, you can also modify Pipelines as Code configurations in the TektonConfig CRD.

With this update, if you disable the developer perspective, the Operator does not install developer console related custom resources.

This update includes ClusterTriggerBinding support for Bitbucket Server and Bitbucket Cloud and helps you to reuse a TriggerBinding across your entire cluster.

With this update, you can configure pipeline resolvers in the TektonConfig CRD. You can enable or disable these pipeline resolvers:  enable-bundles-resolver, enable-cluster-resolver, enable-git-resolver, and enable-hub-resolver.

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    enable-bundles-resolver: true
    enable-cluster-resolver: true
    enable-git-resolver: true
    enable-hub-resolver: true
...

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    bundles-resolver-config:
      default-service-account: pipelines
    cluster-resolver-config:
      default-namespace: test
    git-resolver-config:
      server-url: localhost.com
    hub-resolver-config:
      default-tekton-hub-catalog: tekton
...

Before this update, only Open Container Initiative (OCI) images were supported as outputs of TaskRun in the in-toto provenance agent. This update adds in-toto provenance metadata as outputs with these suffixes, ARTIFACT_URI and ARTIFACT_DIGEST.

Before this update, only TaskRun attestations were supported. This update adds support for PipelineRun attestations as well.

This update adds support for Tekton Chains to get the imgPullSecret parameter from the pod template. This update helps you to configure repository authentication based on each pipeline run or task run without modifying the service account.

With this update, as an administrator, you can use an external database, such as Crunchy PostgreSQL with Tekton Hub, instead of using the default Tekton Hub database. This update helps you to perform the following actions:

This update removes the dependency of config.yaml from external Git repositories and moves the complete configuration data into the API ConfigMap. This update helps an administrator to perform the following actions:

This update adds support for concurrency limit in the Repository CRD to define the maximum number of PipelineRuns running for a repository at a time. The PipelineRuns from a pull request or a push event are queued in alphabetical order.

This update adds a new command tkn pac logs for showing the logs of the latest pipeline run for a repository.

This update supports advanced event matching on file path for push and pull requests to GitHub and GitLab. For example, you can use the Common Expression Language (CEL) to run a pipeline only if a path has changed for any markdown file in the docs directory.

  ...
  annotations:
     pipelinesascode.tekton.dev/on-cel-expression: |
      event == "pull_request" && "docs/*.md".pathChanged()

With this update, you can reference a remote pipeline in the pipelineRef: object using annotations.

With this update, you can auto-configure new GitHub repositories with Pipelines as Code, which sets up a namespace and creates a Repository CRD for your GitHub repository.

With this update, Pipelines as Code generates metrics for PipelineRuns with provider information.

This update provides the following enhancements for the tkn-pac plugin:

With this update, you can view the errors for your pipeline run in the form of a version control system (VCS) comment or a small snippet in the GitHub checks.

With this update, Pipelines as Code optionally can detect errors inside the tasks if they are of a simple format and add those tasks as annotations in GitHub. This update is part of a developer preview feature.

This update adds the following new commands:

This update enhances functionality of the tkn-pac create repo command, which creates and configures webhooks for GitHub, GitLab, and BitbucketCloud along with creating repositories.

With this update, the tkn-pac describe command shows the latest fifty events in a sorted order.

This update adds the --last option to the tkn-pac logs command.

With this update, the tkn-pac resolve command prompts for a token on detecting a git_auth_secret in the file template.

With this update, Pipelines as Code hides secrets from log snippets to avoid exposing secrets in the GitHub interface.

With this update, the secrets automatically generated for git_auth_secret are an owner reference with PipelineRun. The secrets get cleaned with the PipelineRun, not after the pipeline run execution.

This update adds support to cancel a pipeline run with the /cancel comment.

Before this update, the GitHub apps token scoping was not defined and tokens would be used on every repository installation. With this update, you can scope the GitHub apps token to the target repository using the following parameters:

With this update, you can use Pipelines as Code with your own Git repositories that are hosted on GitLab.

With this update, you can access pipeline execution details in the form of kubernetes events in your namespace. These details help you to troubleshoot pipeline errors without needing access to admin namespaces.

This update supports authentication of URLs in the Pipelines as Code resolver with the Git provider.

With this update, you can set the name of the hub catalog by using a setting in the pipelines-as-code config map.

With this update, you can set the maximum and default limits for the max-keep-run parameter.

This update adds documents on how to inject custom Secure Sockets Layer (SSL) certificates in Pipelines as Code to let you connect to provider instance with custom certificates.

With this update, the PipelineRun resource definition has the log URL included as an annotation. For example, the tkn-pac describe command shows the log link when describing a PipelineRun.

With this update, tkn-pac logs show repository name, instead of PipelineRun name.

With this update, you can run Red Hat OpenShift Pipelines GA 1.8 and later on an OpenShift Container Platform cluster that is running on ARM hardware. This includes support for ClusterTask resources and the tkn CLI tool.

This update implements Step and Sidecar overrides for TaskRun resources.

This update adds minimal TaskRun and Run statuses within PipelineRun statuses.

With this update, the graceful termination of pipeline runs feature is promoted from an alpha feature to a stable feature. As a result, the previously deprecated PipelineRunCancelled status remains deprecated and is planned to be removed in a future release.

With this update, you can specify the workspace for a pipeline task by using the name of the workspace. This change makes it easier to specify a shared workspace for a pair of Pipeline and PipelineTask resources. You can also continue to map workspaces explicitly.

With this update, parameters in embedded specifications are propagated without mutations.

With this update, you can specify the required metadata of a Task resource referenced by a PipelineRun resource by using annotations and labels. This way, Task metadata that depends on the execution context is available during the pipeline run.

This update adds support for object or dictionary types in params and results values. This change affects backward compatibility and sometimes breaks forward compatibility, such as using an earlier client with a later Red Hat OpenShift Pipelines version. This update changes the ArrayOrStruct structure, which affects projects that use the Go language API as a library.

This update adds a SkippingReason value to the SkippedTasks field of the PipelineRun status fields so that users know why a given PipelineTask was skipped.

This update supports an alpha feature in which you can use an array type for emitting results from a Task object. The result type is changed from string to ArrayOrString. For example, a task can specify a type to produce an array result:

kind: Task
apiVersion: tekton.dev/v1beta1
metadata:
  name: write-array
  annotations:
    description: |
      A simple task that writes array
spec:
  results:
    - name: array-results
      type: array
      description: The array results
...

$ echo -n "[\"hello\",\"world\"]" | tee $(results.array-results.path)

This update transitions the TriggerGroups field in the EventListener specification from an alpha feature to a stable feature. Using this field, you can specify a set of interceptors before selecting and running a group of triggers.

With this update, the Trigger resource supports end-to-end secure connections by running the ClusterInterceptor server using HTTPS.

With this update, you can use the tkn taskrun export command to export a live task run from a cluster to a YAML file, which you can use to import the task run to another cluster.

With this update, you can add the -o name flag to the tkn pipeline start command to print the name of the pipeline run right after it starts.

This update adds a list of available plugins to the output of the tkn --help command.

With this update, while deleting a pipeline run or task run, you can use both the --keep and --keep-since flags together.

With this update, you can use Cancelled as the value of the spec.status field rather than the deprecated PipelineRunCancelled value.

With this update, as an administrator, you can configure your local Tekton Hub instance to use a custom database rather than the default database.

With this update, as a cluster administrator, if you enable your local Tekton Hub instance, it periodically refreshes the database so that changes in the catalog appear in the Tekton Hub web console. You can adjust the period between refreshes.

With this update, you can install and run a Tekton Hub instance with minimal configuration. This way, you can start working with your teams to decide which additional customizations they might want.

This update adds GIT_SSL_CAINFO to the git-clone task so you can clone secured repositories.

With this update, you can log in to a vault by using OIDC rather than a static token. This change means that Spire can generate the OIDC credential so that only trusted workloads are allowed to log in to the vault. Additionally, you can pass the vault address as a configuration value rather than inject it as an environment variable.

The chains-config config map for Tekton Chains in the openshift-pipelines namespace is automatically reset to default after upgrading the Red Hat OpenShift Pipelines Operator because directly updating the config map is not supported when installed by using the Red Hat OpenShift Pipelines Operator. However, with this update, you can configure Tekton Chains by using the TektonChain custom resource. This feature enables your configuration to persist after upgrading, unlike the chains-config config map, which gets overwritten during upgrades.

With this update, if you install a fresh instance of Tekton Hub by using the Operator, the Tekton Hub login is disabled by default. To enable the login and rating features, you must create the Hub API secret while installing Tekton Hub.

With this update, as an administrator, you can configure your local Tekton Hub instance to use a custom PostgreSQL 13 database rather than the default database. To do so, create a Secret resource named tekton-hub-db. For example:

apiVersion: v1
kind: Secret
metadata:
  name: tekton-hub-db
  labels:
    app: tekton-hub-db
type: Opaque
stringData:
  POSTGRES_HOST: <hostname>
  POSTGRES_DB: <database_name>
  POSTGRES_USER: <username>
  POSTGRES_PASSWORD: <password>
  POSTGRES_PORT: <listening_port_number>

With this update, you no longer need to log in to the Tekton Hub web console to add resources from the catalog to the database. Now, these resources are automatically added when the Tekton Hub API starts running for the first time.

This update automatically refreshes the catalog every 30 minutes by calling the catalog refresh API job. This interval is user-configurable.

With this update, as a developer, you get a notification from the tkn-pac CLI tool if you try to add a duplicate repository to a Pipelines as Code run. When you enter tkn pac create repository, each repository must have a unique URL. This notification also helps prevent hijacking exploits.

With this update, as a developer, you can use the new tkn-pac setup cli command to add a Git repository to Pipelines as Code by using the webhook mechanism. This way, you can use Pipelines as Code even when using GitHub Apps is not feasible. This capability includes support for repositories on GitHub, GitLab, and BitBucket.

With this update, Pipelines as Code supports GitLab integration with features such as the following:

With this update, you can perform advanced pipeline filtering with Common Expression Language (CEL). With CEL, you can match pipeline runs with different Git provider events by using annotations in the PipelineRun resource. For example:

  ...
  annotations:
     pipelinesascode.tekton.dev/on-cel-expression: |
      event == "pull_request" && target_branch == "main" && source_branch == "wip"

Previously, as a developer, you could have only one pipeline run in your .tekton directory for each Git event, such as a pull request. With this update, you can have multiple pipeline runs in your .tekton directory. The web console displays the status and reports of the runs. The pipeline runs operate in parallel and report back to the Git provider interface.

With this update, you can test or retest a pipeline run by commenting /test or /retest on a pull request. You can also specify the pipeline run by name. For example, you can enter /test <pipelinerun_name> or /retest <pipelinerun-name>.

With this update, you can delete a repository custom resource and its associated secrets by using the new tkn-pac delete repository command.

By default, the containers have restricted permissions for enhanced security. The restricted permissions apply to all controller pods in the Red Hat OpenShift Pipelines Operator, and to some cluster tasks. Due to restricted permissions, the git-clone cluster task fails under certain configurations.

When installer sets are in a failed state, the status of the TektonConfig custom resource is incorrectly displayed as True instead of False.

$ oc get tektoninstallerset
NAME                                     READY   REASON
addon-clustertasks-nx5xz                 False   Error
addon-communityclustertasks-cfb2p        True
addon-consolecli-ftrb8                   True
addon-openshift-67dj2                    True
addon-pac-cf7pz                          True
addon-pipelines-fvllm                    True
addon-triggers-b2wtt                     True
addon-versioned-clustertasks-1-8-hqhnw   False   Error
pipeline-w75ww                           True
postpipeline-lrs22                       True
prepipeline-ldlhw                        True
rhosp-rbac-4dmgb                         True
trigger-hfg64                            True
validating-mutating-webhoook-28rf7       True

$ oc get tektonconfig config
NAME     VERSION   READY   REASON
config   1.8.1     True

Before this update, the pruner deleted task runs of running pipelines and displayed the following warning: some tasks were indicated completed without ancestors being done. With this update, the pruner retains the task runs that are part of running pipelines.

Before this update, pipeline-1.8 was the default channel for installing the Red Hat OpenShift Pipelines Operator 1.8.x. With this update, latest is the default channel.

Before this update, the Pipelines as Code controller pods did not have access to certificates exposed by the user. With this update, Pipelines as Code can now access routes and Git repositories guarded by a self-signed or a custom certificate.

Before this update, the task failed with RBAC errors after upgrading from Red Hat OpenShift Pipelines 1.7.2 to 1.8.0. With this update, the tasks run successfully without any RBAC errors.

Before this update, using the tkn CLI tool, you could not remove task runs and pipeline runs that contained a result object whose type was array. With this update, you can use the tkn CLI tool to remove task runs and pipeline runs that contain a result object whose type is array.

Before this update, if a pipeline specification contained a task with an ENV_VARS parameter of array type, the pipeline run failed with the following error: invalid input params for task func-buildpacks: param types don’t match the user-specified type: [ENV_VARS]. With this update, pipeline runs with such pipeline and task specifications do not fail.

Before this update, cluster administrators could not provide a config.json file to the Buildah cluster task for accessing a container registry. With this update, cluster administrators can provide the Buildah cluster task with a config.json file by using the dockerconfig workspace.

Before this update, the git-clone task failed when cloning a repository using SSH keys. With this update, the role of the non-root user in the git-init task is removed, and the SSH program looks in the $HOME/.ssh/ directory for the correct keys.

With this update, pipelines-<version> is the default channel to install the Red Hat OpenShift Pipelines Operator. For example, the default channel to install the OpenShift Pipelines Operator version 1.7 is pipelines-1.7. Cluster administrators can also use the latest channel to install the most recent stable version of the Operator.

When you run a command in a user namespace, your container runs as root (user id 0) but has user privileges on the host. With this update, to run pods in the user namespace, you must pass the annotations that CRI-O expects.

Before this update, if certain conditions were not met, the when expression skipped a Task object and its dependent tasks. With this update, you can scope the when expression to guard the Task object only, not its dependent tasks. To enable this update, set the scope-when-expressions-to-task flag to true in the TektonConfig CRD.

With this update, you can use variable substitution in the subPath field of a workspace within a task.

With this update, you can reference parameters and results by using a bracket notation with single or double quotes. Prior to this update, you could only use the dot notation. For example, the following are now equivalent:

With this update, you can include the onError parameter of a step in the task definition without enabling the enable-api-fields flag.

With this update, the feature-flag-triggers config map has a new field labels-exclusion-pattern. You can set the value of this field to a regular expression (regex) pattern. The controller filters out labels that match the regex pattern from propagating from the event listener to the resources created for the event listener.

With this update, the TriggerGroups field is added to the EventListener specification. Using this field, you can specify a set of interceptors to run before selecting and running a group of triggers. To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

With this update, Trigger resources support custom runs defined by a TriggerTemplate template.

With this update, Triggers support emitting Kubernetes events from an EventListener pod.

With this update, count metrics are available for the following objects: ClusterInteceptor, EventListener, TriggerTemplate, ClusterTriggerBinding, and TriggerBinding.

This update adds the ServicePort specification to Kubernetes resource. You can use this specification to modify which port exposes the event listener service. The default port is 8080.

With this update, you can use the targetURI field in the EventListener specification to send cloud events during trigger processing. To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

With this update, the tekton-triggers-eventlistener-roles object now has a patch verb, in addition to the create verb that already exists.

With this update, the securityContext.runAsUser parameter is removed from event listener deployment.

With this update, the tkn [pipeline | pipelinerun] export command exports a pipeline or pipeline run as a YAML file. For example:

With this update, the --grace option is added to the tkn pipelinerun cancel. Use the --grace option to terminate a pipeline run gracefully instead of forcing the termination. To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

This update adds the Operator and Chains versions to the output of the tkn version command.

With this update, the tkn pipelinerun describe command displays all canceled task runs, when you cancel a pipeline run. Before this fix, only one task run was displayed.

With this update, you can skip supplying the asking specifications for optional workspace when you run the tkn [t | p | ct] start command skips with the --skip-optional-workspace flag. You can also skip it when running in interactive mode.

With this update, you can use the tkn chains command to manage Tekton Chains. You can also use the --chains-namespace option to specify the namespace where you want to install Tekton Chains.

With this update, you can use the Red Hat OpenShift Pipelines Operator to install and deploy Tekton Hub and Tekton Chains.

With this update, you can find and use Pipelines as Code (PAC) as an add-on option.

With this update, you can now disable the installation of community cluster tasks by setting the communityClusterTasks parameter to false. For example:

...
spec:
  profile: all
  targetNamespace: openshift-pipelines
  addon:
    params:
    - name: clusterTasks
      value: "true"
    - name: pipelineTemplates
      value: "true"
    - name: communityClusterTasks
      value: "false"
...

With this update, you can disable the integration of Tekton Hub with the Developer perspective by setting the enable-devconsole-integration flag in the TektonConfig custom resource to false. For example:

...
hub:
  params:
    - name: enable-devconsole-integration
      value: "true"
...

With this update, the operator-config.yaml config map enables the output of the tkn version command to display of the Operator version.

With this update, the version of the argocd-task-sync-and-wait tasks is modified to v0.2.

With this update to the TektonConfig CRD, the oc get tektonconfig command displays the OPerator version.

With this update, service monitor is added to the Triggers metrics.

You can sign task runs, task run results, and OCI registry images with cryptographic key types and services such as cosign.

You can use attestation formats such as in-toto.

You can securely store signatures and signed artifacts using OCI repository as a storage backend.

Pull request status. When iterating over a pull request, the status and control of the pull request is exercised on the platform hosting the Git repository.

GitHub checks the API to set the status of a pipeline run, including rechecks.

GitHub pull request and commit events.

Pull request actions in comments, such as /retest.

Git events filtering, and a separate pipeline for each event.

Automatic task resolution in OpenShift Pipelines for local tasks, Tekton Hub, and remote URLs.

Use of GitHub blobs and objects API for retrieving configurations.

Access Control List (ACL) over a GitHub organization, or using a Prow-style OWNER file.

The tkn pac plugin for the tkn CLI tool, which you can use to manage Pipelines as Code repositories and bootstrapping.

Support for GitHub Application, GitHub Webhook, Bitbucket Server, and Bitbucket Cloud.

Before this update, upgrading the Red Hat OpenShift Pipelines Operator deleted the data in the database associated with Tekton Hub and installed a new database. With this update, an Operator upgrade preserves the data.

Before this update, only cluster administrators could access pipeline metrics in the OpenShift Container Platform console. With this update, users with other cluster roles also can access the pipeline metrics.

Before this update, pipeline runs failed for pipelines containing tasks that emit large termination messages. The pipeline runs failed because the total size of termination messages of all containers in a pod cannot exceed 12 KB. With this update, the place-tools and step-init initialization containers that uses the same image are merged to reduce the number of containers running in each tasks’s pod. The solution reduces the chance of failed pipeline runs by minimizing the number of containers running in a task’s pod. However, it does not remove the limitation of the maximum allowed size of a termination message.

Before this update, attempts to access resource URLs directly from the Tekton Hub web console resulted in an Nginx 404 error. With this update, the Tekton Hub web console image is fixed to allow accessing resource URLs directly from the Tekton Hub web console.

Before this update, for each namespace the resource pruner job created a separate container to prune resources. With this update, the resource pruner job runs commands for all namespaces as a loop in one container.

The chains-config config map for Tekton Chains in the openshift-pipelines namespace is automatically reset to default after upgrading the Red Hat OpenShift Pipelines Operator. Currently, there is no workaround for this issue.

Before this update, tasks on OpenShift Pipelines 1.7.1 failed on using init as the first argument, followed by two or more arguments. With this update, the flags are parsed correctly and the task runs are successful.

Before this update, installation of the Red Hat OpenShift Pipelines Operator on OpenShift Container Platform 4.9 and 4.10 failed due to invalid role binding, with the following error message:

error updating rolebinding openshift-operators-prometheus-k8s-read-binding: RoleBinding.rbac.authorization.k8s.io "openshift-operators-prometheus-k8s-read-binding" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"openshift-operator-read"}: cannot change roleRef

Before this update, upgrading the Operator triggered a reset of the signing-secrets secret key for Tekton Chains to its default value. With this update, the custom secret key persists after you upgrade the Operator.

Before this update, all S2I build tasks failed with an error similar to the following message:

Error: error writing "0 0 4294967295\n" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted
time="2022-03-04T09:47:57Z" level=error msg="error writing \"0 0 4294967295\\n\" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted"
time="2022-03-04T09:47:57Z" level=error msg="(unable to determine exit status)"

securityContext:
  capabilities:
    add: ["SETFCAP"]

Before this update, the Operator failed when creating RBAC resources if any namespace was in a Terminating state. With this update, the Operator ignores namespaces in a Terminating state and creates the RBAC resources.

Previously, upgrading the Red Hat OpenShift Pipelines Operator caused the pipeline service account to be recreated, which meant that the secrets linked to the service account were lost. This update fixes the issue. During upgrades, the Operator no longer recreates the pipeline service account. As a result, secrets attached to the pipeline service account persist after upgrades, and the resources (tasks and pipelines) continue to work correctly.

After upgrading to Red Hat OpenShift Pipelines 1.6.1 from an older version, OpenShift Pipelines might enter an inconsistent state where you are unable to perform any operations (create/delete/apply) on Tekton resources (tasks and pipelines). For example, while deleting a resource, you might encounter the following error:

Error from server (InternalError): Internal error occurred: failed calling webhook "validation.webhook.pipeline.tekton.dev": Post "https://tekton-pipelines-webhook.openshift-pipelines.svc:443/resource-validation?timeout=10s": service "tekton-pipelines-webhook" not found.

The SSL_CERT_DIR environment variable (/tekton-custom-certs) set by Red Hat OpenShift Pipelines will not override the following default system directories with certificate files:

The Horizontal Pod Autoscaler can manage the replica count of deployments controlled by the Red Hat OpenShift Pipelines Operator. From this release onward, if the count is changed by an end user or an on-cluster agent, the Red Hat OpenShift Pipelines Operator will not reset the replica count of deployments managed by it. However, the replicas will be reset when you upgrade the Red Hat OpenShift Pipelines Operator.

The pod serving the tkn CLI will now be scheduled on nodes, based on the node selector and toleration limits specified in the TektonConfig custom resource.

When you create a new project, the creation of the pipeline service account is delayed, and removal of existing cluster tasks and pipeline templates takes more than 10 minutes.

Before this update, multiple instances of Tekton installer sets were created for a pipeline after upgrading to Red Hat OpenShift Pipelines 1.6.1 from an older version. With this update, the Operator ensures that only one instance of each type of TektonInstallerSet exists after an upgrade.

Before this update, all the reconcilers in the Operator used the component version to decide resource recreation during an upgrade to Red Hat OpenShift Pipelines 1.6.1 from an older version. As a result, those resources were not recreated whose component versions did not change in the upgrade. With this update, the Operator uses the Operator version instead of the component version to decide resource recreation during an upgrade.

Before this update, the pipelines webhook service was missing in the cluster after an upgrade. This was due to an upgrade deadlock on the config maps. With this update, a mechanism is added to disable webhook validation if the config maps are absent in the cluster. As a result, the pipelines webhook service persists in the cluster after an upgrade.

Before this update, cron jobs for auto-pruning got recreated after any configuration change to the namespace. With this update, cron jobs for auto-pruning get recreated only if there is a relevant annotation change in the namespace.

The upstream version of Tekton Pipelines is revised to v0.28.3, which has the following fixes:

Before this update, the Red Hat OpenShift Pipelines Operator installed pod security policies from components such as Pipelines and Triggers. However, the pod security policies shipped as part of the components were deprecated in an earlier release. With this update, the Operator stops installing pod security policies from components. As a result, the following upgrade paths are affected:

Before this update, only cluster administrators could access pipeline metrics in the OpenShift Container Platform console. With this update, users with other cluster roles also can access the pipeline metrics.

Before this update, role-based access control (RBAC) issues with the OpenShift Pipelines Operator caused problems upgrading or installing components. This update improves the reliability and consistency of installing various Red Hat OpenShift Pipelines components.

Before this update, setting the clusterTasks and pipelineTemplates fields to false in the TektonConfig CR slowed the removal of cluster tasks and pipeline templates. This update improves the speed of lifecycle management of Tekton resources such as cluster tasks and pipeline templates.

After upgrading from Red Hat OpenShift Pipelines 1.5.2 to 1.6.4, accessing the event listener routes returns a 503 error.

Before this update, the Operator failed when creating RBAC resources if any namespace was in a Terminating state. With this update, the Operator ignores namespaces in a Terminating state and creates the RBAC resources.

Before this update, the task runs failed or restarted due to absence of annotation specifying the release version of the associated Tekton controller. With this update, the inclusion of the appropriate annotations are automated, and the tasks run without failure or restarts.

Tasks that build images, such as S2I and Buildah tasks, now emit a URL of the image built that includes the image SHA.

Conditions in pipeline tasks that reference custom tasks are disallowed because the Condition custom resource definition (CRD) has been deprecated.

Variable expansion is now added in the Task CRD for the following fields: spec.steps[].imagePullPolicy and spec.sidecar[].imagePullPolicy.

You can disable the built-in credential mechanism in Tekton by setting the disable-creds-init feature-flag to true.

Resolved when expressions are now listed in the Skipped Tasks and the Task Runs sections in the Status field of the PipelineRun configuration.

The git init command can now clone recursive submodules.

A Task CR author can now specify a timeout for a step in the Task spec.

You can now base the entry point image on the distroless/static:nonroot image and give it a mode to copy itself to the destination, without relying on the cp command being present in the base image.

You can now use the configuration flag require-git-ssh-secret-known-hosts to disallow omitting known hosts in the Git SSH secret. When the flag value is set to true, you must include the known_host field in the Git SSH secret. The default value for the flag is false.

The concept of optional workspaces is now introduced. A task or pipeline might declare a workspace optional and conditionally change their behavior based on its presence. A task run or pipeline run might also omit that workspace, thereby modifying the task or pipeline behavior. The default task run workspaces are not added in place of an omitted optional workspace.

Credentials initialization in Tekton now detects an SSH credential that is used with a non-SSH URL, and vice versa in Git pipeline resources, and logs a warning in the step containers.

The task run controller emits a warning event if the affinity specified by the pod template is overwritten by the affinity assistant.

The task run reconciler now records metrics for cloud events that are emitted once a task run is completed. This includes retries.

Support for --no-headers flag is now added to the following commands: tkn condition list,tkn triggerbinding list,tkn eventlistener list,tkn clustertask list, tkn clustertriggerbinding list.

When used together, the --last or --use options override the --prefix-name and --timeout options.

The tkn eventlistener logs command is now added to view the EventListener logs.

The tekton hub commands are now integrated into the tkn CLI.

The --nocolour option is now changed to --no-color.

The --all-namespaces flag is added to the following commands: tkn triggertemplate list, tkn condition list, tkn triggerbinding list, tkn eventlistener list.

You can now specify your resource information in the EventListener template.

It is now mandatory for EventListener service accounts to have the list and watch verbs, in addition to the get verb for all the triggers resources. This enables you to use Listers to fetch data from EventListener, Trigger, TriggerBinding, TriggerTemplate, and ClusterTriggerBinding resources. You can use this feature to create a Sink object rather than specifying multiple informers, and directly make calls to the API server.

A new Interceptor interface is added to support immutable input event bodies. Interceptors can now add data or fields to a new extensions field, and cannot modify the input bodies making them immutable. The CEL interceptor uses this new Interceptor interface.

A namespaceSelector field is added to the EventListener resource. Use it to specify the namespaces from where the EventListener resource can fetch the Trigger object for processing events. To use the namespaceSelector field, the service account for the EventListener resource must have a cluster role.

The triggers EventListener resource now supports end-to-end secure connection to the eventlistener pod.

The escaping parameters behavior in the TriggerTemplates resource by replacing " with \" is now removed.

A new resources field, supporting Kubernetes resources, is introduced as part of the EventListener spec.

A new functionality for the CEL interceptor, with support for upper and lower-casing of ASCII strings, is added.

You can embed TriggerBinding resources by using the name and value fields in a trigger, or an event listener.

The PodSecurityPolicy configuration is updated to run in restricted environments. It ensures that containers must run as non-root. In addition, the role-based access control for using the pod security policy is moved from cluster-scoped to namespace-scoped. This ensures that the triggers cannot use other pod security policies that are unrelated to a namespace.

Support for embedded trigger templates is now added. You can either use the name field to refer to an embedded template or embed the template inside the spec field.

This release of Red Hat OpenShift Pipelines adds support for a disconnected installation.

You can now use the when field, instead of conditions resource, to run a task only when certain criteria are met. The key components of WhenExpression resources are Input, Operator, and Values. If all the when expressions evaluate to True, then the task is run. If any of the when expressions evaluate to False, the task is skipped.

Step statuses are now updated if a task run is canceled or times out.

Support for Git Large File Storage (LFS) is now available to build the base image used by git-init.

You can now use the taskSpec field to specify metadata, such as labels and annotations, when a task is embedded in a pipeline.

Cloud events are now supported by pipeline runs. Retries with backoff are now enabled for cloud events sent by the cloud event pipeline resource.

You can now set a default Workspace configuration for any workspace that a Task resource declares, but that a TaskRun resource does not explicitly provide.

Support is available for namespace variable interpolation for the PipelineRun namespace and TaskRun namespace.

Validation for TaskRun objects is now added to check that not more than one persistent volume claim workspace is used when a TaskRun resource is associated with an Affinity Assistant. If more than one persistent volume claim workspace is used, the task run fails with a TaskRunValidationFailed condition. Note that by default, the Affinity Assistant is disabled in Red Hat OpenShift Pipelines, so you will need to enable the assistant to use it.

The tkn task describe, tkn taskrun describe, tkn clustertask describe, tkn pipeline describe, and tkn pipelinerun describe commands now:

You can now use the --prefix-name option with the tkn clustertask start command to specify a prefix for the name of a task run.

Interactive mode support has now been provided to the tkn clustertask start command.

You can now specify PodTemplate properties supported by pipelines using local or remote file definitions for TaskRun and PipelineRun objects.

You can now use the --use-params-defaults option with the tkn clustertask start command to use the default values set in the ClusterTask configuration and create the task run.

The --use-param-defaults flag for the tkn pipeline start command now prompts the interactive mode if the default values have not been specified for some of the parameters.

The Common Expression Language (CEL) function named parseYAML has been added to parse a YAML string into a map of strings.

Error messages for parsing CEL expressions have been improved to make them more granular while evaluating expressions and when parsing the hook body for creating the evaluation environment.

Support is now available for marshaling boolean values and maps if they are used as the values of expressions in a CEL overlay mechanism.

The following fields have been added to the EventListener object:

Webhook interceptors can now parse the EventListener-Request-URL header to extract parameters from the original request URL being handled by the event listener.

Annotations from the event listener can now be propagated to the deployment, services, and other pods. Note that custom annotations on services or deployment are overwritten, and hence, must be added to the event listener annotations so that they are propagated.

Proper validation for replicas in the EventListener specification is now available for cases when a user specifies the spec.replicas values as negative or zero.

You can now specify the TriggerCRD object inside the EventListener spec as a reference using the TriggerRef field to create the TriggerCRD object separately and then bind it inside the EventListener spec.

Validation and defaults for the TriggerCRD object are now available.