Red Hat OpenShift Pipelines is a cloud-native CI/CD experience based on the Tekton project which provides:

  • Standard Kubernetes-native pipeline definitions (CRDs).

  • Serverless pipelines with no CI server management overhead.

  • Extensibility to build images using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko.

  • Portability across any Kubernetes distribution.

  • Powerful CLI for interacting with pipelines.

  • Integrated user experience with the Developer perspective of the OpenShift Container Platform web console.

For an overview of Red Hat OpenShift Pipelines, see Understanding OpenShift Pipelines.

Pipelines support

If you experience difficulty with a procedure described in this documentation, visit the Red Hat Customer Portal to learn more about Red Hat Technology Preview features support scope.

For questions and feedback, you can send an email to the product team at

Release notes for Red Hat OpenShift Pipelines Technology Preview 1.3

New features

Red Hat OpenShift Pipelines Technology Preview (TP) 1.3 is now available on OpenShift Container Platform 4.7. Red Hat OpenShift Pipelines TP 1.3 is updated to support:

  • Tekton Pipelines 0.19.0

  • Tekton tkn CLI 0.15.0

  • Tekton Triggers 0.10.2

  • ClusterTasks based on Tekton Catalog 0.19.0

  • IBM Power Systems on OpenShift Container Platform 4.7

  • IBM Z and LinuxONE on OpenShift Container Platform 4.7

In addition to the fixes and stability improvements, the following sections highlight what is new in Red Hat OpenShift Pipelines 1.3.


  • Tasks that build images, such as S2I and Buildah tasks, now emit a URL of the image built that includes the image SHA.

  • Conditions in pipeline tasks that reference custom tasks are disallowed because the Conditions custom resource definition (CRD) has been deprecated.

  • Variable expansion is now added in the Task CRD for the following fields: spec.steps[].imagePullPolicy and spec.sidecar[].imagePullPolicy.

  • You can disable the built-in credential mechanism in Tekton by setting the disable-creds-init feature-flag to true.

  • Resolved When expressions are now listed in the Skipped Tasks and the Task Runs sections in the Status field of the PipelineRun configuration.

  • The git init command can now clone recursive submodules.

  • A Task CR author can now specify a timeout for a step in the Task spec.

  • You can now base the entry point image on distroless/static:nonroot and give it a mode to copy itself to the destination, without relying on the cp command being present in the base image.

  • You can now use the configuration flag require-git-ssh-secret-known-hosts to disallow omitting known hosts in the Git SSH secret. When the flag value is set to true, you must include the known_host field in the Git SSH secret. The default value for the flag is false.

  • The concept of optional workspaces is now introduced. A task or pipeline might declare a workspace optional and conditionally change their behavior based on its presence. A task run or pipeline run might also omit that workspace, thereby modifying the task or pipeline behavior. The default task run workspaces are not added in place of an omitted optional workspace.

  • Credentials initialization in Tekton now detects an SSH credential that is used with a non-SSH URL, and vice versa in Git pipeline resources, and logs a warning in the step containers.

  • The task run controller emits a warning event if the affinity specified by the pod template is overwritten by the affinity assistant.

  • The task run reconciler now records metrics for cloud events that are emitted once a task run is completed. This includes retries.

Pipelines CLI

  • Support for --no-headers flag is now added to the following commands: tkn condition list,tkn triggerbinding list,tkn eventlistener list,tkn clustertask list, tkn clustertriggerbinding list.

  • When used together, the --last or --use options override the --prefix-name and --timeout options.

  • The tkn eventlistener logs command is now added to view the EventListener logs.

  • The tekton hub commands are now integrated into the tkn CLI.

  • The --nocolour option is now changed to --no-color.

  • The --all-namespaces flag is added to the following commands: tkn triggertemplate list, tkn condition list, tkn triggerbinding list, tkn eventlistener list.


  • You can now specify your resource information in the EventListener template.

  • It is now mandatory for EventListener service accounts to have the list and watch verbs, in addition to the get verb for all the triggers resources. This enables you to use Listers to fetch data from EventListeners, Triggers, TriggerBindings, TriggerTemplates, and ClusterTriggerBindings resources. You can use this feature to create a Sink object rather than specifying multiple informers, and directly make calls to the API server.

  • A new Interceptor interface is added to support immutable input event bodies. Interceptors can now add data or fields to a new extensions field, and cannot modify the input bodies making them immutable. The CEL interceptor uses this new Interceptor interface.

  • A namespaceSelector field is added to the EventListener resource. Use it to specify the namespaces from where the EventListener resource can fetch the Trigger object for processing events. To use the namespaceSelector field, the service account for the EventListener must have a cluster role.

  • The triggers EventListener resource now supports end-to-end secure connection to the eventlistener pod.

  • The escaping parameters behavior in the TriggerTemplates resource by replacing " with \" is now removed.

  • A new resources field, supporting Kubernetes resources, is introduced as part of the EventListener spec.

  • A new functionality for the CEL interceptor, with support for upper and lower-casing of ASCII strings, is added.

  • You can embed TriggerBinding resources by using the name and value fields in a trigger, or an event listener.

  • The PodSecurityPolicy configuration is updated to run in restricted environments. It ensures that containers must run as non-root. In addition, the role-based access control for using the pod security policy is moved from cluster-scoped to namespace-scoped. This ensures that the triggers cannot use other pod security policies that are unrelated to a namespace.

  • Support for embedded trigger templates is now added. You can either use the name field to refer to an embedded template or embed the template inside the spec field.

Deprecated features

  • Pipeline templates that use PipelineResources CRDs are now deprecated and will be removed in a future release.

  • The field is deprecated in favor of the template.ref field and will be removed in a future release.

  • The -c shorthand for the --check command has been removed. In addition, global tkn flags are added to the version command.

Known issues

  • CEL overlays add fields to a new top-level extensions function, instead of modifying the incoming event body. TriggerBinding resources can access values within this new extensions function using the $(extensions.<key>) syntax. Update your binding to use $(extensions.<key>) instead of $(body.<overlay-key>) .

  • The escaping parameters behavior by replacing " with \" is now removed. If you need to retain the old escaping parameters behavior add the true" annotation to your TriggerTemplate specification.

  • You can embed TriggerBinding resources by using the name and value fields inside a trigger or an event listener. However, you cannot specify both name and ref fields for a single binding. Use the ref field to refer to a TriggerBinding resource and the name field for embedded bindings.

  • An interceptor cannot attempt to reference a Secret outside the namespace of an EventListener. You must include secrets in the namespace of the EventListener.

  • In Triggers 0.9.0 and later, if a body or header based TriggerBinding parameter is missing or malformed in an event payload, the default values are used instead of displaying an error.

  • Tasks and Pipelines created with WhenExpressions using Tekton Pipelines 0.16.x must be reapplied to fix their JSON annotations.

  • When a pipeline accepts an optional workspace and gives it to a PipelineTask, the PipelineRun stalls if the workspace is not provided.

  • To use the Buildah cluster task in a disconnected environment, ensure that the Dockerfile uses an internal image stream as the base image, and then use it in the same manner as any S2I cluster task.

Fixed issues

  • Extensions added by a CEL Interceptor are passed on to webhook interceptors by adding the Extensions field within the event body.

  • The activity timeout for log readers is now configurable using the LogOptions field. However, the default behavior of timeout in 10 seconds is retained.

  • The log command ignores the --follow flag when a task run or pipeline run is complete, and reads available logs instead of live logs.

  • References to the following Tekton resources: EventListener, TriggerBinding, ClusterTriggerBinding, Condition, and TriggerTemplate are now standardized and made consistent across all user-facing messages in tkn commands.

  • Previously, if you started a canceled task run or pipeline run with the --use-taskrun <canceled-task-run-name>, --use-pipelinerun <canceled-pipeline-run-name> or --last flags, the new run would be canceled. This bug is now fixed.

  • The tkn pr desc command is now enhanced to ensure that it does not fail in case of pipeline runs with conditions.

  • When you delete a task run using tkn tr delete with the --task option, and a cluster task exists with the same name, the task runs for the cluster task also gets deleted. As a workaround, filter the task runs by using the TaskRefKind field.

  • The tkn triggertemplate describe command would display only part of the apiVersion in the output. For example, only was displayed instead of This bug is now fixed.

  • The webhook, under certain conditions, would fail to acquire a lease and not function correctly. This bug is now fixed.

  • Pipelines with When expressions created in v0.16.3 can now be run in v0.17.1 and later. After an upgrade, you do not need to reapply pipeline definitions created in previous versions because both the uppercase and lowercase first letters for the annotations are now supported.

  • By default, the leader-election-ha is now enabled for high availability. When the controller flag disable-ha is set to true, it disables high availability support.

  • Issues with duplicate cloud events are now fixed. Cloud events are now sent only when a condition changes the state, reason, or message.

  • When a service account name is missing from a PipelineRun or TaskRun spec, the controller uses the service account name from the config-defaults config map. If the service account name is also missing in the config-defaults config map, the controller now sets it to default in the spec.

  • Validation for compatibility with the affinity assistant is now supported when the same persistent volume claim is used for multiple workspaces, but with different subpaths.

Release notes for Red Hat OpenShift Pipelines Technology Preview 1.2

New features

Red Hat OpenShift Pipelines Technology Preview (TP) 1.2 is now available on OpenShift Container Platform 4.6. Red Hat OpenShift Pipelines TP 1.2 is updated to support:

  • Tekton Pipelines 0.16.3

  • Tekton tkn CLI 0.13.1

  • Tekton Triggers 0.8.1

  • ClusterTasks based on Tekton Catalog 0.16

  • IBM Power Systems on OpenShift Container Platform 4.6

  • IBM Z and LinuxONE on OpenShift Container Platform 4.6

In addition to the fixes and stability improvements, the following sections highlight what is new in Red Hat OpenShift Pipelines 1.2.


  • This release of Red Hat OpenShift Pipelines adds support for a disconnected installation.

    Installations in restricted environments are currently not supported on IBM Power Systems, IBM Z, and LinuxONE.

  • You can now use the when field, instead of conditions, to run a task only when certain criteria are met. The key components of WhenExpressions are Input, Operator, and Values. If all the WhenExpressions evaluate to True, then the task is run. If any of the WhenExpressions evaluate to False, the task is skipped.

  • Step statuses are now updated if a task run is canceled or times out.

  • Support for Git Large File Storage (LFS) is now available to build the base image used by git-init.

  • You can now use the taskSpec field to specify metadata, such as labels and annotations, when a task is embedded in a pipeline.

  • Cloud events are now supported by pipeline runs. Retries with backoff are now enabled for cloud events sent by the cloud event pipeline resource.

  • You can now set a default Workspace configuration for any workspace that a Task resource declares, but that a TaskRun resource does not explicitly provide.

  • Support is available for namespace variable interpolation for the PipelineRun namespace and TaskRun namespace.

  • Validation for TaskRun objects is now added to check that not more than one persistent volume claim workspace is used when a TaskRun resource is associated with an Affinity Assistant. If more than one persistent volume claim workspace is used, the task run fails with a TaskRunValidationFailed condition. Note that by default, the Affinity Assistant is disabled in Red Hat OpenShift Pipelines, so you will need to enable the assistant to use it.

Pipelines CLI

  • The tkn task describe, tkn taskrun describe, tkn clustertask describe, tkn pipeline describe, and tkn pipelinerun describe commands now:

    • Automatically select the Task, TaskRun, ClusterTask, Pipeline and PipelineRun resource, respectively, if only one of them is present.

    • Display the results of the Task, TaskRun, ClusterTask, Pipeline and PipelineRun resource in their outputs, respectively.

    • Display workspaces declared in the Task, TaskRun, ClusterTask, Pipeline and PipelineRun resource in their outputs, respectively.

  • You can now use the --prefix-name option with the tkn clustertask start command to specify a prefix for the name of a task run.

  • Interactive mode support has now been provided to the tkn clustertask start command.

  • You can now specify PodTemplate properties supported by pipelines using local or remote file definitions for TaskRun and PipelineRun objects.

  • You can now use the --use-params-defaults option with the tkn clustertask start command to use the default values set in the ClusterTask configuration and create the task run.

  • The --use-param-defaults flag for the tkn pipeline start command now prompts the interactive mode if the default values have not been specified for some of the parameters.


  • The Common Expression Language (CEL) function named parseYAML has been added to parse a YAML string into a map of strings.

  • Error messages for parsing CEL expressions have been improved to make them more granular while evaluating expressions and when parsing the hook body for creating the evaluation environment.

  • Support is now available for marshaling boolean values and maps if they are used as the values of expressions in a CEL overlay mechanism.

  • The following fields have been added to the EventListener object:

    • The replicas field enables the event listener to run more than one pod by specifying the number of replicas in the YAML file.

    • The NodeSelector field enables the EventListener object to schedule the event listener pod to a specific node.

  • Webhook interceptors can now parse the EventListener-Request-URL header to extract parameters from the original request URL being handled by the event listener.

  • Annotations from the event listener can now be propagated to the deployment, services, and other pods. Note that custom annotations on services or deployment are overwritten, and hence, must be added to the event listener annotations so that they are propagated.

  • Proper validation for replicas in the EventListener specification is now available for cases when a user specifies the spec.replicas values as negative or zero.

  • You can now specify the TriggerCRD object inside the EventListener spec as a reference using the TriggerRef field to create the TriggerCRD object separately and then bind it inside the EventListener spec.

  • Validation and defaults for the TriggerCRD object are now available.

Deprecated features

  • $(params) are now removed and replaced by $(tt.params) to avoid confusion between the resourcetemplate and triggertemplate parameters.

  • The ServiceAccount reference of the optional EventListenerTrigger-based authentication level has changed from an object reference to a ServiceAccountName string. This ensures that the ServiceAccount reference is in the same namespace as the EventListenerTrigger object.

  • The Conditions custom resource definition (CRD) is now deprecated; use the WhenExpressions CRD instead.

  • The PipelineRun.Spec.ServiceAccountNames object is being deprecated and replaced by the PipelineRun.Spec.TaskRunSpec[].ServiceAccountName object.

Known issues

  • This release of Red Hat OpenShift Pipelines adds support for a disconnected installation. However, some images used by the cluster tasks must be mirrored for them to work in disconnected clusters.

  • Pipelines in the openshift namespace are not deleted after you uninstall the Red Hat OpenShift Pipelines Operator. Use the oc delete pipelines -n openshift --all command to delete the pipelines.

  • Uninstalling the Red Hat OpenShift Pipelines Operator does not remove the event listeners.

    As a workaround, to remove the EventListener and Pod CRDs:

    1. Edit the EventListener object with the foregroundDeletion finalizers:

      $ oc patch el/<eventlistener_name> -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge

      For example:

      $ oc patch el/github-listener-interceptor -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge
    2. Delete the EventListener CRD:

      $ oc patch crd/ -p '{"metadata":{"finalizers":[]}}' --type=merge
  • When you run a multi-arch container image task without command specification on an IBM Power Systems (ppc64le) or IBM Z (s390x) cluster, the TaskRun resource fails with the following error:

    Error executing command: fork/exec /bin/bash: exec format error

    As a workaround, use an architecture specific container image or specify the sha256 digest to point to the correct architecture. To get the sha256 digest enter:

    $ skopeo inspect --raw <image_name>| jq '.manifests[] | select(.platform.architecture == "<architecture>") | .digest'

Fixed issues

  • A simple syntax validation to check the CEL filter, overlays in the Webhook validator, and the expressions in the interceptor has now been added.

  • Triggers no longer overwrite annotations set on the underlying deployment and service objects.

  • Previously, an event listener would stop accepting events. This fix adds an idle timeout of 120 seconds for the EventListener sink to resolve this issue.

  • Previously, canceling a pipeline run with a Failed(Canceled) state gave a success message. This has been fixed to display an error instead.

  • The tkn eventlistener list command now provides the status of the listed event listeners, thus enabling you to easily identify the available ones.

  • Consistent error messages are now displayed for the triggers list and triggers describe commands when triggers are not installed or when a resource cannot be found.

  • Previously, a large number of idle connections would build up during cloud event delivery. The DisableKeepAlives: true parameter was added to the cloudeventclient config to fix this issue. Thus, a new connection is set up for every cloud event.

  • Previously, the creds-init code would write empty files to the disk even if credentials of a given type were not provided. This fix modifies the creds-init code to write files for only those credentials that have actually been mounted from correctly annotated secrets.

Release notes for Red Hat OpenShift Pipelines Technology Preview 1.1

New features

Red Hat OpenShift Pipelines Technology Preview (TP) 1.1 is now available on OpenShift Container Platform 4.5. Red Hat OpenShift Pipelines TP 1.1 is updated to support:

  • Tekton Pipelines 0.14.3

  • Tekton tkn CLI 0.11.0

  • Tekton Triggers 0.6.1

  • ClusterTasks based on Tekton Catalog 0.14

In addition to the fixes and stability improvements, the following sections highlight what is new in Red Hat OpenShift Pipelines 1.1.


  • Workspaces can now be used instead of PipelineResources. It is recommended that you use Workspaces in OpenShift Pipelines, as PipelineResources are difficult to debug, limited in scope, and make Tasks less reusable. For more details on Workspaces, see Understanding OpenShift Pipelines.

  • Workspace support for VolumeClaimTemplates has been added:

    • The VolumeClaimTemplate for a PipelineRun and TaskRun can now be added as a volume source for Workspaces. The tekton-controller then creates a PersistentVolumeClaim (PVC) using the template that is seen as a PVC for all TaskRuns in the Pipeline. Thus you do not need to define the PVC configuration every time it binds a workspace that spans multiple tasks.

    • Support to find the name of the PersistentVolumeClaim when a VolumeClaimTemplate is used as a volume source is now available using variable substitution.

  • Support for improving audits:

    • The PipelineRun.Status field now contains the status of every TaskRun in the Pipeline and the Pipeline specification used to instantiate a PipelineRun to monitor the progress of the PipelineRun.

    • Pipeline results have been added to the pipeline specification and PipelineRun status.

    • The TaskRun.Status field now contains the exact Task specification used to instantiate the TaskRun.

  • Support to apply the default parameter to Conditions.

  • A TaskRun created by referencing a ClusterTask now adds the label instead of the label.

  • The kubeconfigwriter now adds the ClientKeyData and the ClientCertificateData configurations in the Resource structure to enable replacement of the pipeline resource type cluster with the kubeconfig-creator Task.

  • The names of the feature-flags and the config-defaults ConfigMaps are now customizable.

  • Support for HostNetwork in the PodTemplate used by TaskRun is now available.

  • An Affinity Assistant is now available to support node affinity in TaskRuns that share workspace volume. By default, this is disabled on OpenShift Pipelines.

  • The PodTemplate has been updated to specify imagePullSecrets to identify secrets that the container runtime should use to authorize container image pulls when starting a pod.

  • Support for emitting warning events from the TaskRun controller if the controller fails to update the TaskRun.

  • Standard or recommended k8s labels have been added to all resources to identify resources belonging to an application or component.

  • The Entrypoint process is now notified for signals and these signals are then propagated using a dedicated PID Group of the Entrypoint process.

  • The PodTemplate can now be set on a Task level at runtime using TaskRunSpecs.

  • Support for emitting Kubernetes events:

    • The controller now emits events for additional TaskRun lifecycle events - taskrun started and taskrun running.

    • The PipelineRun controller now emits an event every time a Pipeline starts.

  • In addition to the default Kubernetes events, support for CloudEvents for TaskRuns is now available. The controller can be configured to send any TaskRun events, such as create, started, and failed, as cloud events.

  • Support for using the $context.<task|taskRun|pipeline|pipelineRun>.name variable to reference the appropriate name when in PipelineRuns and TaskRuns.

  • Validation for PipelineRun parameters is now available to ensure that all the parameters required by the Pipeline are provided by the PipelineRun. This also allows PipelineRuns to provide extra parameters in addition to the required parameters.

  • You can now specify Tasks within a Pipeline that will always execute before the pipeline exits, either after finishing all tasks successfully or after a Task in the Pipeline failed, using the finally field in the Pipeline YAML file.

  • The git-clone ClusterTask is now available.

Pipelines CLI

  • Support for embedded Trigger binding is now available to the tkn evenlistener describe command.

  • Support to recommend subcommands and make suggestions if an incorrect subcommand is used.

  • The tkn task describe command now auto selects the task if only one task is present in the Pipeline.

  • You can now start a Task using default parameter values by specifying the --use-param-defaults flag in the tkn task start command.

  • You can now specify a volumeClaimTemplate for PipelineRuns or TaskRuns using the --workspace option with the tkn pipeline start or tkn task start commands.

  • The tkn pipelinerun logs command now displays logs for the final tasks listed in the finally section.

  • Interactive mode support has now been provided to the tkn task start command and the describe subcommand for the following tkn resources: pipeline, pipelinerun, task, taskrun, clustertask, and pipelineresource.

  • The tkn version command now displays the version of the Triggers installed in the cluster.

  • The tkn pipeline describe command now displays parameter values and timeouts specified for Tasks used in the Pipeline.

  • Support added for the --last option for the tkn pipelinerun describe and the tkn taskrun describe commands to describe the most recent PipelineRun or TaskRun, respectively.

  • The tkn pipeline describe command now displays the conditions applicable to the Tasks in the Pipeline.

  • You can now use the --no-headers and --all-namespaces flags with the tkn resource list command.


  • The following Common Expression Language (CEL) functions are now available:

    • parseURL to parse and extract portions of a URL

    • parseJSON to parse JSON value types embedded in a string in the payload field of the deployment webhook

  • A new interceptor for webhooks from Bitbucket has been added.

  • EventListeners now display the Address URL and the Available status as additional fields when listed with the kubectl get command.

  • TriggerTemplate params now use the $(tt.params.<paramName>) syntax instead of $(params.<paramName>) to reduce the confusion between TriggerTemplate and ResourceTemplates params.

  • You can now add tolerations in the EventListener CRD to ensure that EventListeners are deployed with the same configuration even if all nodes are tainted due to security or management issues.

  • You can now add a Readiness Probe for EventListener Deployment at URL/live.

  • Support for embedding TriggerBinding specifications in EventListener Triggers.

  • Trigger resources are now annotated with the recommended labels.

Deprecated features

The following items are deprecated in this release:

  • The --namespace or -n flags for all cluster-wide commands, including the clustertask and clustertriggerbinding commands, are deprecated. It will be removed in a future release.

  • The name field in triggers.bindings within an EventListener has been deprecated in favor of the ref field and will be removed in a future release.

  • Variable interpolation in TriggerTemplates using $(params) has been deprecated in favor of using $(tt.params) to reduce confusion with the Pipeline variable interpolation syntax. The $(params.<paramName>) syntax will be removed in a future release.

  • The label is deprecated on ClusterTasks.

  • The TaskRun.Status.ResourceResults.ResourceRef field is deprecated and will be removed.

  • The tkn pipeline create, tkn task create, and tkn resource create -f subcommands have been removed.

  • Namespace validation has been removed from tkn commands.

  • The default timeout of 1h and the -t flag for the tkn ct start command have been removed.

  • The s2i ClusterTask has been deprecated.

Known issues

  • Conditions do not support Workspaces.

  • The --workspace option and the interactive mode is not supported for the tkn clustertask start command.

  • Support of backward compatibility for $(params.<paramName>) forces you to use TriggerTemplates with pipeline specific params as the Triggers webhook is unable to differentiate Trigger params from pipelines params.

  • Pipeline metrics report incorrect values when you run a promQL query for tekton_taskrun_count and tekton_taskrun_duration_seconds_count.

  • PipelineRuns and TaskRuns continue to be in the Running and Running(Pending) states respectively even when a non existing PVC name is given to a Workspace.

Fixed issues

  • Previously, the tkn task delete <name> --trs command would delete both the Task and ClusterTask if the name of the Task and ClusterTask were the same. With this fix, the command deletes only the TaskRuns that are created by the Task <name>.

  • Previously the tkn pr delete -p <name> --keep 2 command would disregard the -p flag when used with the --keep flag and would delete all the PipelineRuns except the latest two. With this fix, the command deletes only the PipelineRuns that are created by the Pipeline <name>, except for the latest two.

  • The tkn triggertemplate describe output now displays ResourceTemplates in a table format instead of YAML format.

  • Previously the buildah ClusterTask failed when a new user was added to a container. With this fix, the issue has been resolved.

Release notes for Red Hat OpenShift Pipelines Technology Preview 1.0

New features

Red Hat OpenShift Pipelines Technology Preview (TP) 1.0 is now available on OpenShift Container Platform 4.4. Red Hat OpenShift Pipelines TP 1.0 is updated to support:

  • Tekton Pipelines 0.11.3

  • Tekton tkn CLI 0.9.0

  • Tekton Triggers 0.4.0

  • ClusterTasks based on Tekton Catalog 0.11

In addition to the fixes and stability improvements, the following sections highlight what is new in Red Hat OpenShift Pipelines 1.0.


  • Support for v1beta1 API Version.

  • Support for an improved LimitRange. Previously, LimitRange was specified exclusively for the TaskRun and the PipelineRun. Now there is no need to explicitly specify the LimitRange. The minimum LimitRange across the namespace is used.

  • Support for sharing data between Tasks using TaskResults and TaskParams.

  • Pipelines can now be configured to not overwrite the HOME environment variable and workingDir of Steps.

  • Similar to Task Steps, sidecars now support script mode.

  • You can now specify a different scheduler name in TaskRun podTemplate.

  • Support for variable substitution using Star Array Notation.

  • Tekton Controller can now be configured to monitor an individual namespace.

  • A new description field is now added to the specification of Pipeline, Task, ClusterTask, Resource, and Condition.

  • Addition of proxy parameters to Git PipelineResources.

Pipelines CLI

  • The describe subcommand is now added for the following tkn resources: eventlistener, condition, triggertemplate, clustertask, and triggerbinding.

  • Support added for v1beta1 to the following commands along with backward comptibility for v1alpha1: clustertask, task, pipeline, pipelinerun, and taskrun.

  • The following commands can now list output from all namespaces using the --all-namespaces flag option:

    • tkn task list

    • tkn pipeline list

    • tkn taskrun list

    • tkn pipelinerun list

      The output of these commands is also enhanced to display information without headers using the --no-headers flag option.

  • You can now start a Pipeline using default parameter values by specifying --use-param-defaults flag in the tkn pipelines start command.

  • Support for Workspace is now added to tkn pipeline start and tkn task start commands.

  • A new clustertriggerbinding command is now added with the following subcommands: describe, delete, and list.

  • You can now directly start a pipeline run using a local or remote yaml file.

  • The describe subcommand now displays an enhanced and detailed output. With the addition of new fields, such as description, timeout, param description, and sidecar status, the command output now provides more detailed information about a specific tkn resource.

  • The tkn task log command now displays logs directly if only one task is present in the namespace.


  • Triggers can now create both v1alpha1 and v1beta1 Pipeline resources.

  • Support for new Common Expression Language (CEL) interceptor function - compareSecret. This function securely compares strings to secrets in CEL expressions.

  • Support for authentication and authorization at the EventListener Trigger level.

Deprecated features

The following items are deprecated in this release:

  • The environment variable $HOME, and variable workingDir in the Steps specification are deprecated and might be changed in a future release. Currently in a Step container, HOME and workingDir are overwritten to /tekton/home and /workspace respectively.

    In a later release, these two fields will not be modified, and will be set to values defined in the container image and Task YAML. For this release, use flags disable-home-env-overwrite and disable-working-directory-overwrite to disable overwriting of the HOME and workingDir variables.

  • The following commands are deprecated and might be removed in the future release:

    • tkn pipeline create

    • tkn task create

  • The -f flag with the tkn resource create command is now deprecated. It might be removed in the future release.

  • The -t flag and the --timeout flag (with seconds format) for the tkn clustertask create command are now deprecated. Only duration timeout format is now supported, for example 1h30s. These deprecated flags might be removed in the future release.

Known issues

  • If you are upgrading from an older version of Red Hat OpenShift Pipelines, you must delete your existing deployments before upgrading to Red Hat OpenShift Pipelines version 1.0. To delete an existing deployment, you must first delete Custom Resources and then uninstall the Red Hat OpenShift Pipelines Operator. For more details, see the uninstalling Red Hat OpenShift Pipelines section.

  • Submitting the same v1alpha1 Tasks more than once results in an error. Use oc replace instead of oc apply when re-submitting a v1alpha1 Task.

  • The buildah ClusterTask does not work when a new user is added to a container.

    When the Operator is installed, the --storage-driver flag for the buildah ClusterTask is not specified, therefore the flag is set to its default value. In some cases, this causes the storage driver to be set incorrectly. When a new user is added, the incorrect storage-driver results in the failure of the buildah ClusterTask with the following error:

    useradd: /etc/passwd.8: lock file already used
    useradd: cannot lock /etc/passwd; try again later.

    As a workaround, manually set the --storage-driver flag value to overlay in the buildah-task.yaml file:

    1. Login to your cluster as a cluster-admin:

      $ oc login -u <login> -p <password>
    2. Use the oc edit command to edit buildah ClusterTask:

      $ oc edit clustertask buildah

      The current version of the buildah clustertask YAML file opens in the editor set by your EDITOR environment variable.

    3. Under the steps field, locate the following command field:

       command: ['buildah', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--layers', '-f', '$(params.DOCKERFILE)', '-t', '$(resources.outputs.image.url)', '$(params.CONTEXT)']
    4. Replace the command field with the following:

       command: ['buildah', '--storage-driver=overlay', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--no-cache', '-f', '$(params.DOCKERFILE)', '-t', '$(params.IMAGE)', '$(params.CONTEXT)']
    5. Save the file and exit.

    Alternatively, you can also modify the buildah ClusterTask YAML file directly on the web console by navigating to PipelinesCluster Tasksbuildah. Select Edit Cluster Task from the Actions menu and replace the command field as shown in the previous procedure.

Fixed issues

  • Previously, the DeploymentConfig Task triggered a new deployment build even when an image build was already in progress. This caused the deployment of the Pipeline to fail. With this fix, the deploy task command is now replaced with the oc rollout status command which waits for the in-progress deployment to finish.

  • Support for APP_NAME parameter is now added in Pipeline templates.

  • Previously, the Pipeline template for Java S2I failed to look up the image in the registry. With this fix, the image is looked up using the existing image PipelineResources instead of the user provided IMAGE_NAME parameter.

  • All the OpenShift Pipelines images are now based on the Red Hat Universal Base Images (UBI).

  • Previously, when the Pipeline was installed in a namespace other than tekton-pipelines, the tkn version command displayed the Pipeline version as unknown. With this fix, the tkn version command now displays the correct Pipeline version in any namespace.

  • The -c flag is no longer supported for the tkn version command.

  • Non-admin users can now list the ClusterTriggerBindings.

  • The EventListener CompareSecret function is now fixed for the CEL Interceptor.

  • The list, describe, and start subcommands for task and clustertask now correctly display the output in case a Task and ClusterTask have the same name.

  • Previously, the OpenShift Pipelines Operator modified the privileged security context constraints (SCCs), which caused an error during cluster upgrade. This error is now fixed.

  • In the tekton-pipelines namespace, the timeouts of all TaskRuns and PipelineRuns are now set to the value of default-timeout-minutes field using the ConfigMap.

  • Previously, the Pipelines section in the web console was not displayed for non-admin users. This issue is now resolved.