Red Hat OpenShift Pipelines release notes

With this update, pipelines-<version> is the default channel to install the Red Hat OpenShift Pipelines Operator. For example, the default channel to install the Pipelines Operator version 1.7 is pipelines-1.7. Cluster administrators can also use the latest channel to install the most recent stable version of the Operator.

When you run a command in a user namespace, your container runs as root (user id 0) but has user privileges on the host. With this update, to run pods in the user namespace, you must pass the annotations that CRI-O expects.

With this update, the when expressions in a Task object are scoped to guard the tasks by default. To continue guarding the Task object and its dependent tasks, set the scope-when-expressions-to-task flag to true.

With this update, you can use variable substitution in the subPath field of a workspace within a task.

With this update, you can reference parameters and results by using a bracket notation with single or double quotes. Prior to this update, you could only use the dot notation. For example, the following are now equivalent:

With this update, you can include the onError parameter of a step in the task definition without enabling the enable-api-fields flag.

With this update, the feature-flag-triggers config map has a new field labels-exclusion-pattern. You can set the value of this field to a regular expression (regex) pattern. The controller filters out labels that match the regex pattern from propagating from the event listener to the resources created for the event listener.

With this update, the TriggerGroups field is added to the EventListener specification. Using this field, you can specify a set of interceptors to run before selecting and running a group of triggers. To enable this feature, set the enable-api-fields flag in the feature-flags-triggers config map to alpha.

With this update, Trigger resources support custom runs defined by a TriggerTemplate template.

With this update, Triggers support emitting Kubernetes events from an EventListener pod.

With this update, count metrics are available for the following objects: ClusterInteceptor, EventListener, TriggerTemplate, ClusterTriggerBinding, and TriggerBinding.

This update adds the ServicePort specification to Kubernetes resource. You can use this specification to modify which port exposes the event listener service. The default port is 8080.

With this update, you can use the targetURI field in the EventListener specification to send cloud events during trigger processing. To enable this feature, set the enable-api-fields flag in the feature-flags-triggers config map to alpha.

With this update, the tekton-triggers-eventlistener-roles object now has a patch verb, in addition to the create verb that already exists.

With this update, the securityContext.runAsUser parameter is removed from event listener deployment.

With this update, the tkn [pipeline | pipelinerun] export command exports a pipeline or pipeline run as a YAML file. For example:

With this update, the --grace option is added to the tkn pipelinerun cancel. Use the --grace option to terminate a pipeline run gracefully instead of forcing the termination. To enable this feature, set the enable-api-fields flag in the feature-flags config map to alpha.

This update adds the Operator and Chains versions to the output of the tkn version command.

With this update, the tkn pipelinerun describe command displays all canceled task runs, when you cancel a pipeline run. Before this fix, only one task run was displayed.

With this update, you can skip supplying the asking specifications for optional workspace when you run the tkn [t | p | ct] start command skips with the --skip-optional-workspace flag. You can also skip it when running in interactive mode.

With this update, you can use the tkn chains command to manage Tekton Chains. You can also use the --chains-namespace option to specify the namespace where you want to install Tekton Chains.

With this update, you can use the Red Hat OpenShift Pipelines Operator to install and deploy Tekton Hub and Tekton Chains.

With this update, you can find and use Pipelines as Code (PAC) as an add-on option.

With this update, you can now disable the installation of community cluster tasks by setting the communityClusterTasks parameter to false. For example:

...
spec:
  profile: all
  targetNamespace: openshift-pipelines
  addon:
    params:
    - name: clusterTasks
      value: "true"
    - name: pipelineTemplates
      value: "true"
    - name: communityClusterTasks
      value: "false"
...

With this update, you can disable the integration of Tekton Hub with the Developer perspective by setting the enable-devconsole-integration flag in the TektonConfig custom resource to false. For example:

...
hub:
  params:
    - name: enable-devconsole-integration
      value: "true"
...

With this update, the operator-config.yaml config map enables the output of the tkn version command to display of the Operator version.

With this update, the version of the argocd-task-sync-and-wait tasks is modified to v0.2.

With this update to the TektonConfig CRD, the oc get tektonconfig command displays the OPerator version.

With this update, service monitor is added to the Triggers metrics.

You can sign task runs, task run results, and OCI registry images with cryptographic key types and services such as cosign.

You can use attestation formats such as in-toto.

You can securely store signatures and signed artifacts using OCI repository as a storage backend.

Pull request status. When iterating over a pull request, the status and control of the pull request is exercised on the platform hosting the Git repository.

GitHub checks the API to set the status of a pipeline run, including rechecks.

GitHub pull request and commit events.

Pull request actions in comments, such as /retest.

Git events filtering, and a separate pipeline for each event.

Automatic task resolution in Pipelines for local tasks, Tekton Hub, and remote URLs.

Use of GitHub blobs and objects API for retrieving configurations.

Access Control List (ACL) over a GitHub organization, or using a Prow-style OWNER file.

The tkn-pac plugin for the tkn CLI tool, which you can use to manage Pipelines as Code repositories and bootstrapping.

Support for GitHub Application, GitHub Webhook, Bitbucket Server, and Bitbucket Cloud.

Before this update, upgrading the Red Hat OpenShift Pipelines Operator deleted the data in the database associated with Tekton Hub and installed a new database. With this update, an Operator upgrade preserves the data.

Before this update, only cluster administrators could access pipeline metrics in the OpenShift Container Platform console. With this update, users with other cluster roles also can access the pipeline metrics.

Before this update, pipeline runs failed for pipelines containing tasks that emit large termination messages. The pipeline runs failed because the total size of termination messages of all containers in a pod cannot exceed 12 KB. With this update, the place-tools and step-init initialization containers that uses the same image are merged to reduce the number of containers running in each tasks’s pod. The solution reduces the chance of failed pipeline runs by minimizing the number of containers running in a task’s pod. However, it does not remove the limitation of the maximum allowed size of a termination message.

Before this update, attempts to access resource URLs directly from the Tekton Hub web console resulted in an Nginx 404 error. With this update, the Tekton Hub web console image is fixed to allow accessing resource URLs directly from the Tekton Hub web console.

Before this update, for each namespace the resource pruner job created a separate container to prune resources. With this update, the resource pruner job runs commands for all namespaces as a loop in one container.

The chains-config config map for Tekton Chains in the openshift-pipelines namespace is automatically reset to default after upgrading the Red Hat OpenShift Pipelines Operator. Currently, there is no workaround for this issue.

Before this update, tasks on Pipelines 1.7.1 failed on using init as the first argument, followed by two or more arguments. With this update, the flags are parsed correctly and the task runs are successful.

Before this update, installation of the Red Hat OpenShift Pipelines Operator on OpenShift Container Platform 4.9 and 4.10 failed due to invalid role binding, with the following error message:

error updating rolebinding openshift-operators-prometheus-k8s-read-binding: RoleBinding.rbac.authorization.k8s.io "openshift-operators-prometheus-k8s-read-binding" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"openshift-operator-read"}: cannot change roleRef

Before this update, upgrading the Operator triggered a reset of the signing-secrets secret key for Tekton Chains to its default value. With this update, the custom secret key persists after you upgrade the Operator.

Before this update, all S2I build tasks failed with an error similar to the following message:

Error: error writing "0 0 4294967295\n" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted
time="2022-03-04T09:47:57Z" level=error msg="error writing \"0 0 4294967295\\n\" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted"
time="2022-03-04T09:47:57Z" level=error msg="(unable to determine exit status)"

securityContext:
  capabilities:
    add: ["SETFCAP"]

Before this update, the Operator failed when creating RBAC resources if any namespace was in a Terminating state. With this update, the Operator ignores namespaces in a Terminating state and creates the RBAC resources.

Previously, upgrading the Red Hat OpenShift Pipelines Operator caused the pipeline service account to be recreated, which meant that the secrets linked to the service account were lost. This update fixes the issue. During upgrades, the Operator no longer recreates the pipeline service account. As a result, secrets attached to the pipeline service account persist after upgrades, and the resources (tasks and pipelines) continue to work correctly.