Chapter 1. Red Hat OpenShift Pipelines release notes

Manual Approval Gate

Manual Approval Gate controller role binding update

Before this update, the Manual Approval Gate controller role binding included the system:authenticated group. As a result, any authenticated user or service account in the cluster could approve, reject, list, or describe approval tasks across namespaces without requiring specific RBAC permissions. With this update, the system:authenticated group is removed from the controller role binding. As a result, users and service accounts require explicit role bindings to manage approval tasks. To grant users approval task access, create a RoleBinding to the manual-approval-gate-approver ClusterRole in the relevant namespace. This ClusterRole is shipped with Manual Approval Gate and provides the minimum required permissions.

SRVKP-12172

Manual Approval Gate

Approval task spec fields are no longer mutable during updates

Before this update, the Manual Approval Gate webhook did not enforce immutability on task parameters during updates. As a consequence, an approver could modify spec.numberOfApprovalsRequired or spec.description while submitting an approval, bypassing multi-approver requirements. With this update, the webhook enforces immutability on these fields for existing approval tasks.

SRVKP-12509

Approvers can no longer inject pre-approved entries into the approver list

Before this update, the Manual Approval Gate webhook did not validate new entries in spec.approvers during task updates. As a consequence, an approver could inject additional approver entries with a pre-approved status during their own approval action. With this update, the webhook rejects attempts to add, remove, or modify approver entries in spec.approvers on existing approval tasks.

SRVKP-12510

Tekton Chains

OCI 1.1 Referrers API and Sigstore Protobuf Bundle support for Tekton Chains

With this update, Tekton Chains OCI storage adds support for both the OCI 1.1 Referrers API and the Sigstore protobuf bundle (v0.3) serialization format:

• OCI 1.1 Referrers API: Allows storing signatures and attestations as registry-native referrers instead of .sig and .att image tags, eliminating tag pollution in OCI registries.
• Sigstore Protobuf bundle support: Set storage.oci.encoding-format: sigstore-bundle in the chains-config ConfigMap to store signatures and attestations as Sigstore protobuf bundles (v0.3) with artifactType: application/vnd.dev.sigstore.bundle.v0.3+json, discoverable via oras discover or cosign download.
• Backward compatibility: The default value dsse preserves existing tag-based behavior.
• Transparency log integration: Transparency log entries (Rekor) are embedded in the bundle when transparency.enabled is set to "true".
• Verification: Image verification using cosign verify and cosign verify-attestation is supported for both dsse and sigstore-bundle modes.
• Re-signing behavior: Re-signing in sigstore-bundle mode accumulates referrers per signing invocation due to non-deterministic ECDSA signatures; exact crash-recovery retries are deduplicated.

• Configuration validation: Invalid values for storage.oci.encoding-format are rejected by the controller at config-load time, retaining the last valid configuration.

  SRVKP-10475

Server-Side Apply for Tekton Results finalizer management

The Tekton Results controller now manages finalizers on PipelineRun and TaskRun resources using Server-Side Apply (SSA) instead of Merge patch. This reduces retries and Kubernetes API requests during reconciliation while seamlessly handling in-flight resources during upgrades.

SRVKP-8541

Time-based query support for the Splunk logging plugin

The Tekton Results Splunk logging plugin now supports time-based queries that limit search windows using start and end timestamps, optimizing Splunk queries and reducing infrastructure load.

SRVKP-14266

Custom JSON field extraction and line formatting for Loki logging plugin

Tekton Results introduces LOGGING_PLUGIN_JSON_MAP to define custom JSON field extraction mappings, and LOGGING_PLUGIN_LINE_FORMAT to define custom log line output formatting for the Loki logging plugin.

SRVKP-14266

Support service accounts for Bitbucket Data Center scoped tokens

Before this update, configuring a Bitbucket Data Center provider with HTTP scoped tokens required specifying a user in the Repository custom resource configuration. With this update, the user field requirement is removed when using project or repository scoped tokens, allowing direct use of the scoped token context for authentication. As a result, service accounts using scoped tokens can authenticate without a dedicated user account.

SRVKP-14264

Direct OpenTelemetry SDK tracing setup

Before this update, Pipelines as Code used Knative’s config-observability ConfigMap for tracing configuration. With this update, tracing is set up directly using the OpenTelemetry SDK, enabling parentbased_* samplers via the OTEL_TRACES_SAMPLER environment variable. As a result, the entire trace chain is kept or dropped together, providing more consistent distributed tracing behavior.

SRVKP-14264

Default NetworkPolicies for Manual Approval Gate

The ManualApprovalGate custom resource now creates default NetworkPolicies that restrict ingress and egress traffic for its controller and webhook workloads. These policies are enabled by default. To opt out, set spec.networkPolicy.disabled: true in the ManualApprovalGate custom resource.

MultiCluster: CEL-based routing policies in Tekton Kueue (Technology Preview)

Tekton Kueue supports CEL-based routing policies for PipelineRun placement. New CEL functions allow per-PipelineRun routing decisions based on runtime attributes such as labels, annotations, or event types, replacing the all-or-nothing multiKueueOverride boolean setting.

The following new CEL functions are available:

• managedBy(value): Sets spec.managedBy to route a PipelineRun resource to a custom controller.
• multiKueue(): Sets spec.managedBy for MultiKueue routing.
• multiKueue(queueName): Sets spec.managedBy and overrides the Kueue queue label.

You can use these functions in conditional CEL expressions to route PipelineRun resources to different clusters based on runtime attributes.

SRVKP-12732

NetworkPolicy support for OpenShift Pipelines Operator

Red Hat OpenShift Pipelines Operator now ships default NetworkPolicy resources restricting network access for its controller and proxy-webhook pods to only DNS, Kubernetes API server, Prometheus metrics, and webhook traffic. Additionally, the TektonPipeline custom resource gains a spec.networkPolicy field (mirroring TektonTrigger) so proxy-webhook network policies can be reconciled, overridden, or disabled per component.

SRVKP-12050

Support for CustomRuns in Tekton Results

Tekton Results now stores and records CustomRun (tekton.dev/v1beta1) resources alongside TaskRun and PipelineRun resources. CustomRun resources created by custom task controllers are automatically recorded in the Tekton Results database.

SRVKP-11436

Persistent date-range filter on PipelineRuns and TaskRuns list pages

The PipelineRuns list page and TaskRuns list page now feature a persistent date-range filter with standard time presets, querying both live cluster activity and archived data from Tekton Results. Filter selections are automatically saved to individual user profiles and persist across all sessions and devices.

SRVKP-12008

Persistent datasource filter on PipelineRuns and TaskRuns list pages

The datasource filter on the PipelineRuns and TaskRuns list pages is now persistent. The selected data source (Cluster or Archived) is automatically saved to the user profile and preserved across all sessions and devices.

SRVKP-12009

Default PVC configuration for Pipeline workspaces in UI

You can now configure a default PersistentVolumeClaim (PVC) for a Pipeline workspace. When a default workspace and PVC are configured, the Start Pipeline modal automatically pre-populates the workspace with the selected PVC, reducing manual configuration steps.

SRVKP-12527

Option to toggle optional task parameters in Pipeline Builder

A new Show required task params only toggle is available in the Pipeline Builder UI. When enabled, optional task parameters are hidden from the sidebar and the YAML editor switches to read-only mode to prevent parameter corruption while keeping the view uncluttered.

SRVKP-12530, SRVKP-12531

Compressed termination messages for Tekton Tasks

Termination messages are now compressed with zlib when enable-termination-message-compression is enabled, increasing effective result capacity from approximately 33 to approximately 187 results, a 5.7 times improvement. This compression has no effect when results-from is set to sidecar-logs.

SRVKP-7717

OpenTelemetry observability migration and metric updates

OpenShift Pipelines components (including Tekton Pipelines, Pipelines as Code, and Manual Approval Gate) have migrated observability infrastructure from OpenCensus to OpenTelemetry. Standard Knative/OTel metrics prefixes (kn_workqueue_*, http_client_*, go_*) replace legacy tekton_pipelines_controller_* infrastructure metrics.

SRVKP-8534, SRVKP-8544, SRVKP-11514

Centrally managed TLS profile support in Pipelines as Code controller

The Pipelines as Code controller now inherits TLS configuration settings directly from the OpenShift APIServer TLS Profile (config.openshift.io/v1), ensuring central TLS profile consistency and supporting Post-Quantum Cryptography (PQC) readiness.

SRVKP-9681

GitHub API rate limit event emission in Pipelines as Code

Pipelines as Code now emits Kubernetes events and log entries when GitHub API rate limits are exhausted. This surfaces rate limit exhaustion distinctly as a Repository event rather than reporting generic authentication failures.

SRVKP-10951

Forgejo and Gitea ListOrgTeams API caching

Pipelines as Code now caches ListOrgTeams API responses per organization during ACL checks, preventing redundant API calls when evaluating multiple allowed teams in Forgejo or Gitea provider integrations.

SRVKP-11532

Reconciler shared state race condition

Before this update, the reconciler stored per-reconciliation state (globalRepo, secretNS) on the shared controller struct. As a consequence, concurrent reconciliations could overwrite each other’s namespace decisions, leading to incorrect secret lookups. With this update, per-reconciliation state is removed from the shared struct. As a result, concurrent reconciliations no longer interfere with each other.

SRVKP-14264

GitLab token rotation write access verification

Before this update, the GitLab token auto-rotation feature revoked the old token before updating the Kubernetes Secret. As a consequence, if the Secret update failed due to a permission error, the old token was already revoked, causing irrecoverable credential loss. With this update, a server-side dry-run Secret update is performed before revoking the old token. As a result, permission errors are detected early, preventing credential loss during token rotation.

SRVKP-14264

GitLab branch creation push events

Before this update, GitLab Push Hook payloads with an empty commits array (sent when a new branch is created at an existing commit) were rejected. As a consequence, PipelineRun resources were not triggered for new branch creation events. With this update, these payloads are accepted and PipelineRun resources are triggered using the after SHA. As a result, branch creation events on GitLab correctly trigger pipeline runs.

SRVKP-14264

GitLab source lookups pinned to event SHA

Before this update, GitLab source provenance used a mutable branch reference for looking up .tekton PipelineRun definitions and repository-local Task or Pipeline references. As a consequence, the definitions could change between the event and the lookup if new commits were pushed. With this update, the immutable event SHA is used for all source lookups. As a result, PipelineRun definitions and task references are pinned to the exact revision that triggered the event.

SRVKP-14264

Nil content handling in Gitea file retrieval

Before this update, the Forgejo SDK could return nil content for a missing file instead of an error in GetFileInsideRepo. As a consequence, the controller crashed with a SIGSEGV, leading to CrashLoopBackOff. With this update, a nil check guards against the nil content case. As a result, the controller handles missing files gracefully without crashing.

SRVKP-14264

Bitbucket Cloud token CLI updates

Before this update, updating a Bitbucket Cloud token via the tkn pac CLI did not prompt for the Atlassian account email. As a consequence, the stored username became stale after token rotation, causing 401 authentication errors. With this update, the CLI prompts for and saves the Atlassian account email during token update. As a result, authentication continues to work correctly after token rotation.

SRVKP-14264

Controller HTTP listener graceful shutdown

Before this update, the controller’s HTTP listener did not monitor context cancellation. As a consequence, the controller hung on SIGTERM until it was force-killed with SIGKILL. With this update, the listener monitors context cancellation and shuts down cleanly. As a result, the controller terminates gracefully on SIGTERM without requiring a force kill.

SRVKP-14264

Provider logger consistency

Before this update, some provider code used run.Clients.Log instead of the provider logger (v.Logger). As a consequence, log messages were missing standard context variables (provider, repository, event-id). With this update, all provider code uses v.Logger for logging. As a result, log messages from all providers include consistent context information for debugging.

SRVKP-14264

Webhook deployment Prometheus metrics port

Before this update, the webhook deployment was missing the containerPort and Service port definitions for Prometheus metrics on port 9090. As a consequence, Prometheus could not scrape metrics from the webhook, unlike the controller and watcher which had the port configured. With this update, the missing port definitions are added. As a result, Prometheus can scrape metrics from the webhook deployment.

SRVKP-14264

Kubernetes event timestamp population

Before this update, Kubernetes events emitted by Pipelines as Code were missing FirstTimestamp, LastTimestamp, Count, and ReportingController fields. As a consequence, kubectl displayed <unknown> in the LAST SEEN column. With this update, these fields are properly populated. As a result, event timestamps display correctly in kubectl output.

SRVKP-14264

Tekton Hub commands in tkn CLI

Tekton Hub integration in the tkn CLI is now deprecated in favor of Artifact Hub. Commands such as check-upgrade, downgrade, get, info, reinstall, search, and upgrade currently target Tekton Hub and displays a deprecation warning. To use Artifact Hub, pass --type artifact to tkn hub install.

SRVKP-11950, SRVKP-10462

Tekton Hub integration in Pipelines as Code

Tekton Hub integration has been removed from Pipelines as Code. All Tekton Hub-specific resolver code, configuration fields, and documentation have been removed, leaving Artifact Hub as the supported hub integration.

SRVKP-12188