Red Hat OpenShift Pipelines release notes

Breaking change: This update removes the disable-working-directory-overwrite and disable-home-env-overwrite fields from the TektonConfig custom resource (CR). As a result, the TektonConfig CR no longer automatically sets the $HOME environment variable and workingDir parameter. You can still set the $HOME environment variable and workingDir parameter by using the env and workingDir fields in the Task custom resource definition (CRD).

The Conditions custom resource definition (CRD) type is deprecated and planned to be removed in a future release. Instead, use the recommended When expression.

Breaking change: The Triggers resource validates the templates and generates an error if you do not specify the EventListener and TriggerBinding values.

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

You cannot use the nodejs:14-ubi8-minimal image stream because doing so generates the following errors:

STEP 7: RUN /usr/libexec/s2i/assemble
/bin/sh: /usr/libexec/s2i/assemble: No such file or directory
subprocess exited with status 127
subprocess exited with status 127
error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127
time="2021-11-04T13:05:26Z" level=error msg="exit status 127"

Implicit parameter mapping incorrectly passes parameters from the top-level Pipeline or PipelineRun definitions to the taskRef tasks. Mapping should only occur from a top-level resource to tasks with in-line taskSpec specifications. This issue only affects users who have set the enable-api-fields feature flag to alpha.

With this update, if metadata such as labels and annotations are present in both Pipeline and PipelineRun object definitions, the values in the PipelineRun type takes precedence. You can observe similar behavior for Task and TaskRun objects.

With this update, if the timeouts.tasks field or the timeouts.finally field is set to 0, then the timeouts.pipeline is also set to 0.

With this update, the -x set flag is removed from scripts that do not use a shebang. The fix reduces potential data leak from script execution.

With this update, any backslash character present in the usernames in Git credentials is escaped with an additional backslash in the .gitconfig file.

With this update, the finalizer property of the EventListener object is not necessary for cleaning up logging and config maps.

With this update, the default HTTP client associated with the event listener server is removed, and a custom HTTP client added. As a result, the timeouts have improved.

With this update, the Triggers cluster role now works with owner references.

With this update, the race condition in the event listener does not happen when multiple interceptors return extensions.

With this update, the tkn pr delete command does not delete the pipeline runs with the ignore-running flag.

With this update, the Operator pods do not continue restarting when you modify any add-on parameters.

With this update, the tkn serve CLI pod is scheduled on infra nodes, if not configured in the subscription and config custom resources.

With this update, cluster tasks with specified versions are not deleted during upgrade.

With this update, you can configure a pipeline or task start command to return a YAML or JSON-formatted string by using the --output <string>, where <string> is yaml or json. Otherwise, without the --output option, the start command returns a human-friendly message that is hard for other programs to parse. Returning a YAML or JSON-formatted string is useful for continuous integration (CI) environments. For example, after a resource is created, you can use yq or jq to parse the YAML or JSON-formatted message about the resource and wait until that resource is terminated without using the showlog option.

With this update, you can authenticate to a registry using the auth.json authentication file of Podman. For example, you can use tkn bundle push to push to a remote registry using Podman instead of Docker CLI.

With this update, if you use the tkn [taskrun | pipelinerun] delete --all command, you can preserve runs that are younger than a specified number of minutes by using the new --keep-since <minutes> option. For example, to keep runs that are less than five minutes old, you enter tkn [taskrun | pipelinerun] delete -all --keep-since 5.

With this update, when you delete task runs or pipeline runs, you can use the --parent-resource and --keep-since options together. For example, the tkn pipelinerun delete --pipeline pipelinename --keep-since 5 command preserves pipeline runs whose parent resource is named pipelinename and whose age is five minutes or less. The tkn tr delete -t <taskname> --keep-since 5 and tkn tr delete --clustertask <taskname> --keep-since 5 commands work similarly for task runs.

This update adds support for the triggers resources to work with v1beta1 resources.

This update adds an ignore-running option to the tkn pipelinerun delete and tkn taskrun delete commands.

This update adds a create subcommand to the tkn task and tkn clustertask commands.

With this update, when you use the tkn pipelinerun delete --all command, you can use the new --label <string> option to filter the pipeline runs by label. Optionally, you can use the --label option with = and == as equality operators, or != as an inequality operator. For example, the tkn pipelinerun delete --all --label asdf and tkn pipelinerun delete --all --label==asdf commands both delete all the pipeline runs that have the asdf label.

With this update, you can fetch the version of installed Tekton components from the config map or, if the config map is not present, from the deployment controller.

With this update, triggers support the feature-flags and config-defaults config map to configure feature flags and to set default values respectively.

This update adds a new metric, eventlistener_event_count, that you can use to count events received by the EventListener resource.

This update adds v1beta1 Go API types. With this update, triggers now support the v1beta1 API version.

In the current release, auto-prunning of resources is enabled by default. In addition, you can configure auto-prunning of task run and pipeline run for each namespace separately, by using the following new annotations:

Administrators can disable the creation of the pipeline service account for the entire cluster, and prevent privilege escalation by misusing the associated SCC, which is very similar to anyuid.

You can now configure feature flags and components by using the TektonConfig custom resource (CR) and the CRs for individual components, such as TektonPipeline and TektonTriggers. This level of granularity helps customize and test alpha features such as the Tekton OCI bundle for individual components.

You can now configure optional Timeouts field for the PipelineRun resource. For example, you can configure timeouts separately for a pipeline run, each task run, and the finally tasks.

The pods generated by the TaskRun resource now sets the activeDeadlineSeconds field of the pods. This enables OpenShift to consider them as terminating, and allows you to use specifically scoped ResourceQuota object for the pods.

You can use configmaps to eliminate metrics tags or labels type on a task run, pipeline run, task, and pipeline. In addition, you can configure different types of metrics for measuring duration, such as a histogram, gauge, or last value.

You can define requests and limits on a pod coherently, as Tekton now fully supports the LimitRange object by considering the Min, Max, Default, and DefaultRequest fields.

The following alpha features are introduced:

The current release enables you to configure node selection by specifying the nodeSelector and tolerations values in the TektonConfig custom resource (CR). The Operator adds these values to all the deployments that it creates.

In CLI 0.21.0, support for all v1alpha1 resources for clustertask, task, taskrun, pipeline, and pipelinerun commands are deprecated. These resources are now deprecated and will be removed in a future release.

In Tekton Triggers v0.16.0, the redundant status label is removed from the metrics for the EventListener resource.

With the current release, the v1alpha1 features are now deprecated and will be removed in a future release. With this update, you can begin using the v1beta1 Go API types instead. Triggers now supports the v1beta1 API version.

With the current release, the EventListener resource sends a response before the triggers finish processing.

The current release removes the podTemplate field from the EventListener resource.

The current release removes the deprecated replicas field from the specification for the EventListener resource.

In Red Hat OpenShift Pipelines 1.6, the values of HOME="/tekton/home" and workingDir="/workspace" are removed from the specification of the Step objects.

apiVersion: operator.tekton.dev/v1alpha1
  kind: TektonConfig
  metadata:
    name: config
  spec:
    pipeline:
      disable-working-directory-overwrite: false
      disable-home-env-overwrite: false
  ...

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

Before you install tasks based on the Tekton Catalog on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) using tkn hub, verify if the task can be executed on these platforms. To check if ppc64le and s390x are listed in the "Platforms" section of the task information, you can run the following command: tkn hub info task <name>

You cannot use the nodejs:14-ubi8-minimal image stream because doing so generates the following errors:

STEP 7: RUN /usr/libexec/s2i/assemble
/bin/sh: /usr/libexec/s2i/assemble: No such file or directory
subprocess exited with status 127
subprocess exited with status 127
error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127
time="2021-11-04T13:05:26Z" level=error msg="exit status 127"

The tkn hub command is now supported on IBM Power Systems, IBM Z, and LinuxONE.

Before this update, the terminal was not available after the user ran a tkn command, and the pipeline run was done, even if retries were specified. Specifying a timeout in the task run or pipeline run had no effect. This update fixes the issue so that the terminal is available after running the command.

Before this update, running tkn pipelinerun delete --all would delete all resources. This update prevents the resources in the running state from getting deleted.

Before this update, using the tkn version --component=<component> command did not return the component version. This update fixes the issue so that this command returns the component version.

Before this update, when you used the tkn pr logs command, it displayed the pipelines output logs in the wrong task order. This update resolves the issue so that logs of completed PipelineRuns are listed in the appropriate TaskRun execution order.

Before this update, editing the specification of a running pipeline might prevent the pipeline run from stopping when it was complete. This update fixes the issue by fetching the definition only once and then using the specification stored in the status for verification. This change reduces the probability of a race condition when a PipelineRun or a TaskRun refers to a Pipeline or Task that changes while it is running.

When expression values can now have array parameter references, such as: values: [$(params.arrayParam[*])].

Pipeline run and task runs will be automatically pruned by a cron job in the target namespace. The cron job uses the IMAGE_JOB_PRUNER_TKN environment variable to get the value of tkn image. With this enhancement, the following fields are introduced to the TektonConfig custom resource:

...
pruner:
  resources:
    - pipelinerun
    - taskrun
  schedule: "*/5 * * * *" # cron schedule
  keep: 2 # delete all keeping n
...

In OpenShift Container Platform, you can customize the installation of the Tekton Add-ons component by modifying the values of the new parameters clusterTasks and pipelinesTemplates in the TektonConfig custom resource:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: all
  targetNamespace: openshift-pipelines
  addon:
    params:
    - name: clusterTasks
      value: "true"
    - name: pipelineTemplates
      value: "true"
...

The enableMetrics parameter is added to the TektonConfig custom resource. You can use it to disable the service monitor, which is part of Tekton Pipelines for OpenShift Container Platform.

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: all
  targetNamespace: openshift-pipelines
  pipeline:
    params:
    - name: enableMetrics
      value: "true"
...

Eventlistener OpenCensus metrics, which captures metrics at process level, is added.

Triggers now has label selector; you can configure triggers for an event listener using labels.

The ClusterInterceptor custom resource definition for registering interceptors is added, which allows you to register new Interceptor types that you can plug in. In addition, the following relevant changes are made:

To disable prefixing the name of the task or step while displaying logs, use the --prefix option for log commands.

To display the version of a specific component, use the new --component flag in the tkn version command.

The tkn hub check-upgrade command is added, and other commands are revised to be based on the pipeline version. In addition, catalog names are displayed in the search command output.

Support for optional workspaces are added to the start command.

If the plugins are not present in the plugins directory, they are searched in the current path.

The tkn start [task | clustertask | pipeline] command starts interactively and ask for the params value, even when you specify the default parameters are specified. To stop the interactive prompts, pass the --use-param-defaults flag at the time of invoking the command. For example:

$ tkn pipeline start build-and-deploy \
    -w name=shared-workspace,volumeClaimTemplateFile=https://raw.githubusercontent.com/openshift/pipelines-tutorial/pipelines-1.7/01_pipeline/03_persistent_volume_claim.yaml \
    -p deployment-name=pipelines-vote-api \
    -p git-url=https://github.com/openshift/pipelines-vote-api.git \
    -p IMAGE=image-registry.openshift-image-registry.svc:5000/pipelines-tutorial/pipelines-vote-api \
    --use-param-defaults

The version field is added in the tkn task describe command.

The option to automatically select resources such as TriggerTemplate, or TriggerBinding, or ClusterTriggerBinding, or Eventlistener, is added in the describe command, if only one is present.

In the tkn pr describe command, a section for skipped tasks is added.

Support for the tkn clustertask logs is added.

The YAML merge and variable from config.yaml is removed. In addition, the release.yaml file can now be more easily consumed by tools such as kustomize and ytt.

The support for resource names to contain the dot character (".") is added.

The hostAliases array in the PodTemplate specification is added to the pod-level override of hostname resolution. It is achieved by modifying the /etc/hosts file.

A variable $(tasks.status) is introduced to access the aggregate execution status of tasks.

An entry-point binary build for Windows is added.

In the when expressions, support for fields written is PascalCase is removed. The when expressions only support fields written in lowercase.

When you upgrade the Red Hat OpenShift Pipelines Operator to v1.5, the openshift-client and the openshift-client-v-1-5-0 cluster tasks have the SCRIPT parameter. However, the ARGS parameter and the git resource are removed from the specification of the openshift-client cluster task. This is a breaking change, and only those cluster tasks that do not have a specific version in the name field of the ClusterTask resource upgrade seamlessly.

...
- name: deploy
  params:
  - name: SCRIPT
    value: oc rollout status <deployment-name>
  runAfter:
    - build
  taskRef:
    kind: ClusterTask
    name: openshift-client
...

When you upgrade from Red Hat OpenShift Pipelines Operator v1.4 to v1.5, the profile names in which the TektonConfig custom resource is installed now change.

The disable-home-env-overwrite and disable-working-dir-overwrite fields are now deprecated and will be removed in a future release. For this release, the default value of these flags is set to true for backward compatibility.

The ServiceType and podTemplate fields are removed from the EventListener spec.

The controller service account no longer requests cluster-wide permission to list and watch namespaces.

The status of the EventListener resource has a new condition called Ready.

The eventListener and namespace fields in the EventListener response are deprecated. Use the eventListenerUID field instead.

The replicas field is deprecated from the EventListener spec. Instead, the spec.replicas field is moved to spec.resources.kubernetesResource.replicas in the KubernetesResource spec.

The old method of configuring the core interceptors is deprecated. However, it continues to work until it is removed in a future release. Instead, interceptors in a Trigger resource are now configured using a new ref and params based syntax. The resulting default webhook automatically switch the usages of the old syntax to the new syntax for new triggers.

Use rbac.authorization.k8s.io/v1 instead of the deprecated rbac.authorization.k8s.io/v1beta1 for the ClusterRoleBinding resource.

In cluster roles, the cluster-wide write access to resources such as serviceaccounts, secrets, configmaps, and limitranges are removed. In addition, cluster-wide access to resources such as deployments, statefulsets, and deployment/finalizers are removed.

The image custom resource definition in the caching.internal.knative.dev group is not used by Tekton anymore, and is excluded in this release.

The git-cli cluster task is built off the alpine/git base image, which expects /root as the user’s home directory. However, this is not explicitly set in the git-cli cluster task.

On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task and the tkn hub command are unsupported.

When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

The when expressions in dag tasks are not allowed to specify the context variable accessing the execution status ($(tasks.<pipelineTask>.status)) of any other task.

Use Owner UIDs instead of Owner names, as it helps avoid race conditions created by deleting a volumeClaimTemplate PVC, in situations where a PipelineRun resource is quickly deleted and then recreated.

A new Dockerfile is added for pullrequest-init for build-base image triggered by non-root users.

When a pipeline or task is executed with the -f option and the param in its definition does not have a type defined, a validation error is generated instead of the pipeline or task run failing silently.

For the tkn start [task | pipeline | clustertask] commands, the description of the --workspace flag is now consistent.

While parsing the parameters, if an empty array is encountered, the corresponding interactive help is displayed as an empty string now.

The custom tasks have the following enhancements:

The finally task has the following enhancements:

Support for multiple secrets of the type dockercfg or dockerconfigjson is added for authentication at runtime.

Functionality to support sparse-checkout with the git-clone task is added. This enables you to clone only a subset of the repository as your local copy, and helps you to restrict the size of the cloned repositories.

You can create pipeline runs in a pending state without actually starting them. In clusters that are under heavy load, this allows Operators to have control over the start time of the pipeline runs.

Ensure that you set the SYSTEM_NAMESPACE environment variable manually for the controller; this was previously set by default.

A non-root user is now added to the build-base image of pipelines so that git-init can clone repositories as a non-root user.

Support to validate dependencies between resolved resources before a pipeline run starts is added. All result variables in the pipeline must be valid, and optional workspaces from a pipeline can only be passed to tasks expecting it for the pipeline to start running.

The controller and webhook runs as a non-root group, and their superfluous capabilities have been removed to make them more secure.

You can use the tkn pr logs command to see the log streams for retried task runs.

You can use the --clustertask option in the tkn tr delete command to delete all the task runs associated with a particular cluster task.

Support for using Knative service with the EventListener resource is added by introducing a new customResource field.

An error message is displayed when an event payload does not use the JSON format.

The source control interceptors such as GitLab, BitBucket, and GitHub, now use the new InterceptorRequest or InterceptorResponse type interface.

A new CEL function marshalJSON is implemented so that you can encode a JSON object or an array to a string.

An HTTP handler for serving the CEL and the source control core interceptors is added. It packages four core interceptors into a single HTTP server that is deployed in the tekton-pipelines namespace. The EventListener object forwards events over the HTTP server to the interceptor. Each interceptor is available at a different path. For example, the CEL interceptor is available on the /cel path.

The pipelines-scc Security Context Constraint (SCC) is used with the default pipeline service account for pipelines. This new service account is similar to anyuid, but with a minor difference as defined in the YAML for SCC of OpenShift Container Platform 4.7:

fsGroup:
  type: MustRunAs

The build-gcs sub-type in the pipeline resource storage, and the gcs-fetcher image, are not supported.

In the taskRun field of cluster tasks, the label tekton.dev/task is removed.

For webhooks, the value v1beta1 corresponding to the field admissionReviewVersions is removed.

The creds-init helper image for building and deploying is removed.

In the triggers spec and binding, the deprecated field template.name is removed in favor of template.ref. You should update all eventListener definitions to use the ref field.

For EventListener custom resources/objects, the fields PodTemplate and ServiceType are deprecated in favor of Resource.

The deprecated spec style embedded bindings is removed.

The spec field is removed from the triggerSpecBinding.

The event ID representation is changed from a five-character random string to a UUID.

In the Developer perspective, the pipeline metrics and triggers features are available only on OpenShift Container Platform 4.7.6 or later versions.

On IBM Power Systems, IBM Z, and LinuxONE, the tkn hub command is not supported.

When you run Maven and Jib Maven cluster tasks on an IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters, set the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

Triggers throw error resulting from bad handling of the JSON format, if you have the following configuration in the trigger binding:

params:
  - name: github_json
    value: $(body)

When upgrading from Pipelines 1.3.x to 1.4.x, you must recreate the routes.

Previously, the tekton.dev/task label was removed from the task runs of cluster tasks, and the tekton.dev/clusterTask label was introduced. The problems resulting from that change is resolved by fixing the clustertask describe and delete commands. In addition, the lastrun function for tasks is modified, to fix the issue of the tekton.dev/task label being applied to the task runs of both tasks and cluster tasks in older versions of pipelines.

When doing an interactive tkn pipeline start pipelinename, a PipelineResource is created interactively. The tkn p start command prints the resource status if the resource status is not nil.

Previously, the tekton.dev/task=name label was removed from the task runs created from cluster tasks. This fix modifies the tkn clustertask start command with the --last flag to check for the tekton.dev/task=name label in the created task runs.

When a task uses an inline task specification, the corresponding task run now gets embedded in the pipeline when you run the tkn pipeline describe command, and the task name is returned as embedded.

The tkn version command is fixed to display the version of the installed Tekton CLI tool, without a configured kubeConfiguration namespace or access to a cluster.

If an argument is unexpected or more than one arguments are used, the tkn completion command gives an error.

Previously, pipeline runs with the finally tasks nested in a pipeline specification would lose those finally tasks, when converted to the v1alpha1 version and restored back to the v1beta1 version. This error occurring during conversion is fixed to avoid potential data loss. Pipeline runs with the finally tasks nested in a pipeline specification is now serialized and stored on the alpha version, only to be deserialized later.

Previously, there was an error in the pod generation when a service account had the secrets field as {}. The task runs failed with CouldntGetTask because the GET request with an empty secret name returned an error, indicating that the resource name may not be empty. This issue is fixed by avoiding an empty secret name in the kubeclient GET request.

Pipelines with the v1beta1 API versions can now be requested along with the v1alpha1 version, without losing the finally tasks. Applying the returned v1alpha1 version will store the resource as v1beta1, with the finally section restored to its original state.

Previously, an unset selfLink field in the controller caused an error in the Kubernetes v1.20 clusters. As a temporary fix, the CloudEvent source field is set to a value that matches the current source URI, without the value of the auto-populated selfLink field.

Previously, a secret name with dots such as gcr.io led to a task run creation failure. This happened because of the secret name being used internally as part of a volume mount name. The volume mount name conforms to the RFC1123 DNS label and disallows dots as part of the name. This issue is fixed by replacing the dot with a dash that results in a readable name.

Context variables are now validated in the finally tasks.

Previously, when the task run reconciler was passed a task run that did not have a previous status update containing the name of the pod it created, the task run reconciler listed the pods associated with the task run. The task run reconciler used the labels of the task run, which were propagated to the pod, to find the pod. Changing these labels while the task run was running, caused the code to not find the existing pod. As a result, duplicate pods were created. This issue is fixed by changing the task run reconciler to only use the tekton.dev/taskRun Tekton-controlled label when finding the pod.

Previously, when a pipeline accepted an optional workspace and passed it to a pipeline task, the pipeline run reconciler stopped with an error if the workspace was not provided, even if a missing workspace binding is a valid state for an optional workspace. This issue is fixed by ensuring that the pipeline run reconciler does not fail to create a task run, even if an optional workspace is not provided.

The sorted order of step statuses matches the order of step containers.

Previously, the task run status was set to unknown when a pod encountered the CreateContainerConfigError reason, which meant that the task and the pipeline ran until the pod timed out. This issue is fixed by setting the task run status to false, so that the task is set as failed when the pod encounters the CreateContainerConfigError reason.

Previously, pipeline results were resolved on the first reconciliation, after a pipeline run was completed. This could fail the resolution resulting in the Succeeded condition of the pipeline run being overwritten. As a result, the final status information was lost, potentially confusing any services watching the pipeline run conditions. This issue is fixed by moving the resolution of pipeline results to the end of a reconciliation, when the pipeline run is put into a Succeeded or True condition.

Execution status variable is now validated. This avoids validating task results while validating context variables to access execution status.

Previously, a pipeline result that contained an invalid variable would be added to the pipeline run with the literal expression of the variable intact. Therefore, it was difficult to assess whether the results were populated correctly. This issue is fixed by filtering out the pipeline run results that reference failed task runs. Now, a pipeline result that contains an invalid variable will not be emitted by the pipeline run at all.

The tkn eventlistener describe command is fixed to avoid crashing without a template. It also displays the details about trigger references.

Upgrades from Pipelines 1.3.x and earlier versions to Pipelines 1.4.0 breaks event listeners because of the unavailability of template.name. In Pipelines 1.4.1, the template.name has been restored to avoid breaking event listeners in triggers.

In Pipelines 1.4.1, the ConsoleQuickStart custom resource has been updated to align with OpenShift Container Platform 4.7 capabilities and behavior.

Tekton Pipelines 0.19.0

Tekton tkn CLI 0.15.0

Tekton Triggers 0.10.2

cluster tasks based on Tekton Catalog 0.19.0

IBM Power Systems on OpenShift Container Platform 4.7

IBM Z and LinuxONE on OpenShift Container Platform 4.7