CI/CD

• .gitconfig File
• Basic Authentication
• SSH Key Authentication
• Trusted Certificate Authorities

• Create a secret object with secret data.
• Update the pod service account to allow the reference to the secret.
• Create a pod, which consumes the secret as an environment variable or as a file using a secret volume.

Procedure

• Use the create command to create a secret object from a JSON or YAML file:

  $ oc create -f <filename>

  For example, you can create a secret from your local .docker/config.json file:

  $ oc create secret generic dockerhub \
      --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
      --type=kubernetes.io/dockerconfigjson

  This command generates a JSON specification of the secret named dockerhub and creates the object.

  YAML Opaque Secret Object Definition

  apiVersion: v1
  kind: Secret
  metadata:
    name: mysecret
  type: Opaque 1
  data:
    username: dXNlci1uYW1l
    password: cGFzc3dvcmQ=

  1

  Specifies an opaque secret.

  Docker Configuration JSON File Secret Object Definition

  apiVersion: v1
  kind: Secret
  metadata:
    name: aregistrykey
    namespace: myapps
  type: kubernetes.io/dockerconfigjson 1
  data:
    .dockerconfigjson:bm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg== 2

  1

  Specifies that the secret is using a docker configuration JSON file.

  2

  The output of a base64-encoded the docker configuration JSON file

Procedure

• Set the fieldPath environment variable source to the JsonPath of the field from which you are interested in obtaining the value:

  env:
    - name: FIELDREF_ENV
      valueFrom:
        fieldRef:
          fieldPath: metadata.name

Procedure

• To use a secret as an environment variable, set the valueFrom syntax:

  apiVersion: build.openshift.io/v1
  kind: BuildConfig
  metadata:
    name: secret-example-bc
  spec:
    strategy:
      sourceStrategy:
        env:
        - name: MYVAL
          valueFrom:
            secretKeyRef:
              key: myval
              name: mysecret

Procedure

• Set the imageOptimizationPolicy to SkipLayers:

  strategy:
    dockerStrategy:
      imageOptimizationPolicy: SkipLayers

Procedure

• To create an incremental build, create a with the following modification to the strategy definition:

  strategy:
    sourceStrategy:
      from:
        kind: "ImageStreamTag"
        name: "incremental-image:latest" 1
      incremental: true 2

  1

  Specify an image that supports incremental builds. Consult the documentation of the builder image to determine if it supports this behavior.

  2

  This flag controls whether an incremental build is attempted. If the builder image does not support incremental builds, the build will still succeed, but you will get a log message stating the incremental build was not successful because of a missing save-artifacts script.

• Provide an assemble, run, or save-artifacts script in the .s2i/bin directory of your application source repository.

• Provide a URL of a directory containing the scripts as part of the strategy definition. For example:

  strategy:
    sourceStrategy:
      from:
        kind: "ImageStreamTag"
        name: "builder-image:latest"
      scripts: "http://somehost.com/scripts_directory" 1

  1

  This path will have run, assemble, and save-artifacts appended to it. If any or all scripts are found they will be used in place of the same named scripts provided in the image.

Procedure

• Set the customStrategy.from section:

  strategy:
    customStrategy:
      from:
        kind: "DockerImage"
        name: "openshift/sti-image-builder"

Procedure

• To mount each secret at a specific location, edit the secretSource and mountPath fields of the strategy YAML file:

  strategy:
    customStrategy:
      secrets:
        - secretSource: 1
            name: "secret1"
          mountPath: "/tmp/secret1" 2
        - secretSource:
            name: "secret2"
          mountPath: "/tmp/secret2"

  1

  secretSource is a reference to a secret in the same namespace as the build.

  2

  mountPath is the path inside the custom builder where the secret should be mounted.

• Dynamic job and run creation in Jenkins.
• Dynamic creation of agent pod templates from image streams, image stream tags, or config maps.
• Injection of environment variables.
• Pipeline visualization in the OpenShift Container Platform web console.
• Integration with the Jenkins Git plugin, which passes commit information from OpenShift Container Platform builds to the Jenkins Git plugin.
• Synchronization of secrets into Jenkins credential entries.

• An inline jenkinsfile field within your build configuration.
• A jenkinsfilePath field within your build configuration that references the location of the jenkinsfile to use relative to the source contextDir.

• A file located within your source code repository.
• Embedded as part of your build configuration using the jenkinsfile field.

• A file named jenkinsfile at the root of your repository.
• A file named jenkinsfile at the root of the source contextDir of your repository.
• A file name specified via the jenkinsfilePath field of the JenkinsPipelineStrategy section of your BuildConfig, which is relative to the source contextDir if supplied, otherwise it defaults to the root of the repository.

• Embed the Jenkins file in the build configuration.
• Include in the build configuration a reference to the Git repository that contains the Jenkins file.

Procedure

• To define environment variables to be used during build, edit the YAML file:

  jenkinsPipelineStrategy:
  ...
    env:
      - name: "FOO"
        value: "BAR"

Procedure

• To manually re-run a build, enter the following command:

  $ oc start-build --from-build=<build_name>

Procedure

• To manually stream a build’s logs in stdout, enter the following command:

  $ oc start-build <buildconfig_name> --follow

Procedure

• To specify a desired environment variable, enter the following command:

  $ oc start-build <buildconfig_name> --env=<key>=<value>

Procedure

• Start a build from a source using the following command to send the contents of a local Git repository as an archive from the tag v2:

  $ oc start-build hello-world --from-repo=../hello-world --commit=v2

Procedure

• To manually cancel multiple builds, enter the following command:

  $ oc cancel-build <build1_name> <build2_name> <build3_name>

Procedure

• To cancel all builds, enter the following command:

  $ oc cancel-build bc/<buildconfig_name>

Procedure

• To cancel all in a given state, enter the following command:

  $ oc cancel-build bc/<buildconfig_name>

Procedure

• To stream the logs of the latest build for a BuildConfig, enter the following command:

  $ oc logs -f bc/<buildconfig_name>

Procedure

• To stream the logs for a given version build for a BuildConfig, enter the following command:

  $ oc logs --version=<number> bc/<buildconfig_name>

Procedure

• To enable more verbose output, pass the BUILD_LOGLEVEL environment variable as part of the sourceStrategy or dockerStrategy in a BuildConfig:

  sourceStrategy:
  ...
    env:
      - name: "BUILD_LOGLEVEL"
        value: "2" 1

  1

  Adjust this value to the desired log level.

Prerequisites

• You have configured multiple image change triggers. These triggers have triggered one or more builds.

• lastTriggeredImageID: This field, which is not shown in the example, is deprecated in OpenShift Container Platform 4.8 and will be ignored in a future release. It contains the resolved image reference for the ImageStreamTag when the last build was triggered from this BuildConfig.
• paused: You can use this field, which is not shown in the example, to temporarily disable this particular image change trigger.
• from: You use this field to reference the ImageStreamTag that drives this image change trigger. Its type is the core Kubernetes type, OwnerReference.

Procedure

• Shell script:

  postCommit:
    script: "bundle exec rake test --verbose"

  The script value is a shell script to be run with /bin/sh -ic. Use this when a shell script is appropriate to execute the build hook. For example, for running unit tests as above. To control the image entry point, or if the image does not have /bin/sh, use command and/or args.

  Note

  The additional -i flag was introduced to improve the experience working with CentOS and RHEL images, and may be removed in a future release.

• Command as the image entry point:

  postCommit:
    command: ["/bin/bash", "-c", "bundle exec rake test --verbose"]

  In this form, command is the command to run, which overrides the image entry point in the exec form, as documented in the Dockerfile reference. This is needed if the image does not have /bin/sh, or if you do not want to use a shell. In all other cases, using script might be more convenient.

• Command with arguments:

  postCommit:
    command: ["bundle", "exec", "rake", "test"]
    args: ["--verbose"]

  This form is equivalent to appending the arguments to command.

Prerequisites

• You must provide or create a yum-compatible repository configuration file that downloads content from your Satellite instance.

  Sample repository configuration

  [test-<name>]
  name=test-<number>
  baseurl = https://satellite.../content/dist/rhel/server/7/7Server/x86_64/os
  enabled=1
  gpgcheck=0
  sslverify=0
  sslclientkey = /etc/pki/entitlement/...-key.pem
  sslclientcert = /etc/pki/entitlement/....pem

Prerequisites

• The entitlement keys and Satellite repository configurations must be added as build inputs.

• Pipeline: Automates the entire process of building, testing, and deploying applications, using the Groovy syntax.
• Node: A machine capable of either orchestrating or executing a scripted pipeline.
• Stage: A conceptually distinct subset of tasks performed in a pipeline. Plugins or user interfaces often use this block to display status or progress of tasks.
• Step: A single task that specifies the exact action to be taken, either by using a command or a script.

• Pipeline: A set of tasks in a series, in parallel, or both.
• Task: A sequence of steps as commands, binaries, or scripts.
• PipelineRun: Execution of a pipeline with one or more tasks.

• TaskRun: Execution of a task with one or more steps.

  Note

  You can initiate a PipelineRun or a TaskRun with a set of inputs such as parameters and workspaces, and the execution results in a set of outputs and artifacts.

• Workspace: In Tekton, workspaces are conceptual blocks that serve the following purposes:

  • Storage of inputs, outputs, and build artifacts.
  • Common space to share data among tasks.
  • Mount points for credentials held in secrets, configurations held in config maps, and common tools shared by an organization.
  Note

  In Jenkins, there is no direct equivalent of Tekton workspaces. You can think of the control node as a workspace, as it stores the cloned code repository, build history, and artifacts. In situations where a job is assigned to a different node, the cloned code and the generated artifacts are stored in that node, but the build history is maintained by the control node.

• TP: Technology Preview
• GA: General Availability

• Pipeline run and task runs will be automatically pruned by a cron job in the target namespace. The cron job uses the IMAGE_JOB_PRUNER_TKN environment variable to get the value of tkn image. With this enhancement, the following fields are introduced to the TektonConfig custom resource:

  ...
  pruner:
    resources:
      - pipelinerun
      - taskrun
    schedule: "*/5 * * * *" # cron schedule
    keep: 2 # delete all keeping n
  ...

• In OpenShift Container Platform, you can customize the installation of the Tekton Add-ons component by modifying the values of the new parameters clusterTasks and pipelinesTemplates in the TektonConfig custom resource:

  apiVersion: operator.tekton.dev/v1alpha1
  kind: TektonConfig
  metadata:
    name: config
  spec:
    profile: all
    targetNamespace: openshift-pipelines
    addon:
      params:
      - name: clusterTasks
        value: "true"
      - name: pipelineTemplates
        value: "true"
  ...

  The customization is allowed if you create the add-on using TektonConfig, or directly by using Tekton Add-ons. However, if the parameters are not passed, the controller adds parameters with default values.

  Note
  • If add-on is created using the TektonConfig custom resource, and you change the parameter values later in the Addon custom resource, then the values in the TektonConfig custom resource overwrites the changes.
  • You can set the value of the pipelinesTemplates parameter to true only when the value of the clusterTasks parameter is true.

• The enableMetrics parameter is added to the TektonConfig custom resource. You can use it to disable the service monitor, which is part of Tekton Pipelines for OpenShift Container Platform.

  apiVersion: operator.tekton.dev/v1alpha1
  kind: TektonConfig
  metadata:
    name: config
  spec:
    profile: all
    targetNamespace: openshift-pipelines
    pipeline:
      params:
      - name: enableMetrics
        value: "true"
  ...

• Eventlistener OpenCensus metrics, which captures metrics at process level, is added.
• Triggers now has label selector; you can configure triggers for an event listener using labels.

• The ClusterInterceptor custom resource definition for registering interceptors is added, which allows you to register new Interceptor types that you can plug in. In addition, the following relevant changes are made:

  • In the trigger specifications, you can configure interceptors using a new API that includes a ref field to refer to a cluster interceptor. In addition, you can use the params field to add parameters that pass on to the interceptors for processing.
  • The bundled interceptors CEL, GitHub, GitLab, and BitBucket, have been migrated. They are implemented using the new ClusterInterceptor custom resource definition.
  • Core interceptors are migrated to the new format, and any new triggers created using the old syntax automatically switch to the new ref or params based syntax.
• To disable prefixing the name of the task or step while displaying logs, use the --prefix option for log commands.
• To display the version of a specific component, use the new --component flag in the tkn version command.
• The tkn hub check-upgrade command is added, and other commands are revised to be based on the pipeline version. In addition, catalog names are displayed in the search command output.
• Support for optional workspaces are added to the start command.
• If the plugins are not present in the plugins directory, they are searched in the current path.

• The tkn start [task | clustertask | pipeline] command starts interactively and ask for the params value, even when you specify the default parameters are specified. To stop the interactive prompts, pass the --use-param-defaults flag at the time of invoking the command. For example:

  $ tkn pipeline start build-and-deploy \
      -w name=shared-workspace,volumeClaimTemplateFile=https://raw.githubusercontent.com/openshift/pipelines-tutorial/pipelines-1.5/01_pipeline/03_persistent_volume_claim.yaml \
      -p deployment-name=pipelines-vote-api \
      -p git-url=https://github.com/openshift/pipelines-vote-api.git \
      -p IMAGE=image-registry.openshift-image-registry.svc:5000/pipelines-tutorial/pipelines-vote-api \
      --use-param-defaults

• The version field is added in the tkn task describe command.
• The option to automatically select resources such as TriggerTemplate, or TriggerBinding, or ClusterTriggerBinding, or Eventlistener, is added in the describe command, if only one is present.
• In the tkn pr describe command, a section for skipped tasks is added.
• Support for the tkn clustertask logs is added.
• The YAML merge and variable from config.yaml is removed. In addition, the release.yaml file can now be more easily consumed by tools such as kustomize and ytt.
• The support for resource names to contain the dot character (".") is added.
• The hostAliases array in the PodTemplate specification is added to the pod-level override of hostname resolution. It is achieved by modifying the /etc/hosts file.
• A variable $(tasks.status) is introduced to access the aggregate execution status of tasks.
• An entry-point binary build for Windows is added.

• In the when expressions, support for fields written is PascalCase is removed. The when expressions only support fields written in lowercase.

  Note

  If you had applied a pipeline with when expressions in Tekton Pipelines v0.16 (Operator v1.2.x), you have to reapply it.

• When you upgrade the Red Hat OpenShift Pipelines Operator to v1.5, the openshift-client and the openshift-client-v-1-5-0 cluster tasks have the SCRIPT parameter. However, the ARGS parameter and the git resource are removed from the specification of the openshift-client cluster task. This is a breaking change, and only those cluster tasks that do not have a specific version in the name field of the ClusterTask resource upgrade seamlessly.

  To prevent the pipeline runs from breaking, use the SCRIPT parameter after the upgrade because it moves the values previously specified in the ARGS parameter into the SCRIPT parameter of the cluster task. For example:

  ...
  - name: deploy
    params:
    - name: SCRIPT
      value: oc rollout status <deployment-name>
    runAfter:
      - build
    taskRef:
      kind: ClusterTask
      name: openshift-client
  ...

• When you upgrade from Red Hat OpenShift Pipelines Operator v1.4 to v1.5, the profile names in which the TektonConfig custom resource is installed now change.

  Table 4.2. Profiles for TektonConfig custom resource

  Profiles in Pipelines 1.5	Corresponding profile in Pipelines 1.4	Installed Tekton components
  All (default profile)	All (default profile)	Pipelines, Triggers, Add-ons
  Basic	Default	Pipelines, Triggers
  Lite	Basic	Pipelines

  Note

  If you used profile: all in the config instance of the TektonConfig custom resource, no change is necessary in the resource specification.

  However, if the installed Operator is either in the Default or the Basic profile before the upgrade, you must edit the config instance of the TektonConfig custom resource after the upgrade. For example, if the configuration was profile: basic before the upgrade, ensure that it is profile: lite after upgrading to Pipelines 1.5.

• The disable-home-env-overwrite and disable-working-dir-overwrite fields are now deprecated and will be removed in a future release. For this release, the default value of these flags is set to true for backward compatibility.

  Note

  In the next release (Red Hat OpenShift Pipelines 1.6), the HOME environment variable will not be automatically set to /tekton/home, and the default working directory will not be set to /workspace for task runs. These defaults collide with any value set by image Dockerfile of the step.

• The ServiceType and podTemplate fields are removed from the EventListener spec.
• The controller service account no longer requests cluster-wide permission to list and watch namespaces.

• The status of the EventListener resource has a new condition called Ready.

  Note

  In the future, the other status conditions for the EventListener resource will be deprecated in favor of the Ready status condition.

• The eventListener and namespace fields in the EventListener response are deprecated. Use the eventListenerUID field instead.

• The replicas field is deprecated from the EventListener spec. Instead, the spec.replicas field is moved to spec.resources.kubernetesResource.replicas in the KubernetesResource spec.

  Note

  The replicas field will be removed in a future release.

• The old method of configuring the core interceptors is deprecated. However, it continues to work until it is removed in a future release. Instead, interceptors in a Trigger resource are now configured using a new ref and params based syntax. The resulting default webhook automatically switch the usages of the old syntax to the new syntax for new triggers.
• Use rbac.authorization.k8s.io/v1 instead of the deprecated rbac.authorization.k8s.io/v1beta1 for the ClusterRoleBinding resource.
• In cluster roles, the cluster-wide write access to resources such as serviceaccounts, secrets, configmaps, and limitranges are removed. In addition, cluster-wide access to resources such as deployments, statefulsets, and deployment/finalizers are removed.
• The image custom resource definition in the caching.internal.knative.dev group is not used by Tekton anymore, and is excluded in this release.

• The git-cli cluster task is built off the alpine/git base image, which expects /root as the user’s home directory. However, this is not explicitly set in the git-cli cluster task.

  In Tekton, the default home directory is overwritten with /tekton/home for every step of a task, unless otherwise specified. This overwriting of the $HOME environment variable of the base image causes the git-cli cluster task to fail.

  This issue is expected to be fixed in the upcoming releases. For Red Hat OpenShift Pipelines 1.5 and earlier versions, you can use any one of the following workarounds to avoid the failure of the git-cli cluster task:

  • Set the $HOME environment variable in the steps, so that it is not overwritten.

    1. [OPTIONAL] If you installed Red Hat OpenShift Pipelines using the Operator, then clone the git-cli cluster task into a separate task. This approach ensures that the Operator does not overwrite the changes made to the cluster task.
    2. Execute the oc edit clustertasks git-cli command.

    3. Add the expected HOME environment variable to the YAML of the step:

       ...
       steps:
         - name: git
           env:
           - name: HOME
             value: /root
           image: $(params.BASE_IMAGE)
           workingDir: $(workspaces.source.path)
       ...

       Warning

       For Red Hat OpenShift Pipelines installed by the Operator, if you do not clone the git-cli cluster task into a separate task before changing the HOME environment variable, then the changes are overwritten during Operator reconciliation.

  • Disable overwriting the HOME environment variable in the feature-flags config map.

    1. Execute the oc edit -n openshift-pipelines configmap feature-flags command.

    2. Set the value of the disable-home-env-overwrite flag to true.

       Warning
       • If you installed Red Hat OpenShift Pipelines using the Operator, then the changes are overwritten during Operator reconciliation.
       • Modifying the default value of the disable-home-env-overwrite flag can break other tasks and cluster tasks, as it changes the default behavior for all tasks.

  • Use a different service account for the git-cli cluster task, as the overwriting of the HOME environment variable happens when the default service account for pipelines is used.

    1. Create a new service account.
    2. Link your Git secret to the service account you just created.
    3. Use the service account while executing a task or a pipeline.
• On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task and the tkn hub command are unsupported.
• When you run Maven and Jib-Maven cluster tasks on IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters, set the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

• The when expressions in dag tasks are not allowed to specify the context variable accessing the execution status ($(tasks.<pipelineTask>.status)) of any other task.
• Use Owner UIDs instead of Owner names, as it helps avoid race conditions created by deleting a volumeClaimTemplate PVC, in situations where a PipelineRun resource is quickly deleted and then recreated.
• A new Dockerfile is added for pullrequest-init for build-base image triggered by non-root users.
• When a pipeline or task is executed with the -f option and the param in its definition does not have a type defined, a validation error is generated instead of the pipeline or task run failing silently.
• For the tkn start [task | pipeline | clustertask] commands, the description of the --workspace flag is now consistent.
• While parsing the parameters, if an empty array is encountered, the corresponding interactive help is displayed as an empty string now.

• TP: Technology Preview
• GA: General Availability

• The custom tasks have the following enhancements:

  • Pipeline results can now refer to results produced by custom tasks.
  • Custom tasks can now use workspaces, service accounts, and pod templates to build more complex custom tasks.

• The finally task has the following enhancements:

  • The when expressions are supported in finally tasks, which provides efficient guarded execution and improved reusability of tasks.

  • A finally task can be configured to consume the results of any task within the same pipeline.

    Note

    Support for when expressions and finally tasks are unavailable in the OpenShift Container Platform 4.7 web console.

• Support for multiple secrets of the type dockercfg or dockerconfigjson is added for authentication at runtime.
• Functionality to support sparse-checkout with the git-clone task is added. This enables you to clone only a subset of the repository as your local copy, and helps you to restrict the size of the cloned repositories.
• You can create pipeline runs in a pending state without actually starting them. In clusters that are under heavy load, this allows Operators to have control over the start time of the pipeline runs.
• Ensure that you set the SYSTEM_NAMESPACE environment variable manually for the controller; this was previously set by default.
• A non-root user is now added to the build-base image of pipelines so that git-init can clone repositories as a non-root user.
• Support to validate dependencies between resolved resources before a pipeline run starts is added. All result variables in the pipeline must be valid, and optional workspaces from a pipeline can only be passed to tasks expecting it for the pipeline to start running.
• The controller and webhook runs as a non-root group, and their superfluous capabilities have been removed to make them more secure.
• You can use the tkn pr logs command to see the log streams for retried task runs.
• You can use the --clustertask option in the tkn tr delete command to delete all the task runs associated with a particular cluster task.
• Support for using Knative service with the EventListener resource is added by introducing a new customResource field.
• An error message is displayed when an event payload does not use the JSON format.
• The source control interceptors such as GitLab, BitBucket, and GitHub, now use the new InterceptorRequest or InterceptorResponse type interface.
• A new CEL function marshalJSON is implemented so that you can encode a JSON object or an array to a string.
• An HTTP handler for serving the CEL and the source control core interceptors is added. It packages four core interceptors into a single HTTP server that is deployed in the tekton-pipelines namespace. The EventListener object forwards events over the HTTP server to the interceptor. Each interceptor is available at a different path. For example, the CEL interceptor is available on the /cel path.

• The pipelines-scc Security Context Constraint (SCC) is used with the default pipeline service account for pipelines. This new service account is similar to anyuid, but with a minor difference as defined in the YAML for SCC of OpenShift Container Platform 4.7:

  fsGroup:
    type: MustRunAs

• The build-gcs sub-type in the pipeline resource storage, and the gcs-fetcher image, are not supported.
• In the taskRun field of cluster tasks, the label tekton.dev/task is removed.
• For webhooks, the value v1beta1 corresponding to the field admissionReviewVersions is removed.
• The creds-init helper image for building and deploying is removed.

• In the triggers spec and binding, the deprecated field template.name is removed in favor of template.ref. You should update all eventListener definitions to use the ref field.

  Note

  Upgrade from Pipelines 1.3.x and earlier versions to Pipelines 1.4.0 breaks event listeners because of the unavailability of the template.name field. For such cases, use Pipelines 1.4.1 to avail the restored template.name field.

• For EventListener custom resources/objects, the fields PodTemplate and ServiceType are deprecated in favor of Resource.
• The deprecated spec style embedded bindings is removed.
• The spec field is removed from the triggerSpecBinding.
• The event ID representation is changed from a five-character random string to a UUID.

• In the Developer perspective, the pipeline metrics and triggers features are available only on OpenShift Container Platform 4.7.6 or later versions.
• On IBM Power Systems, IBM Z, and LinuxONE, the tkn hub command is not supported.
• When you run Maven and Jib Maven cluster tasks on an IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters, set the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

• Triggers throw error resulting from bad handling of the JSON format, if you have the following configuration in the trigger binding:

  params:
    - name: github_json
      value: $(body)

  To resolve the issue:

  • If you are using triggers v0.11.0 and above, use the marshalJSON CEL function, which takes a JSON object or array and returns the JSON encoding of that object or array as a string.

  • If you are using older triggers version, add the following annotation in the trigger template:

    annotations:
      triggers.tekton.dev/old-escape-quotes: "true"

• When upgrading from Pipelines 1.3.x to 1.4.x, you must recreate the routes.

• Previously, the tekton.dev/task label was removed from the task runs of cluster tasks, and the tekton.dev/clusterTask label was introduced. The problems resulting from that change is resolved by fixing the clustertask describe and delete commands. In addition, the lastrun function for tasks is modified, to fix the issue of the tekton.dev/task label being applied to the task runs of both tasks and cluster tasks in older versions of pipelines.
• When doing an interactive tkn pipeline start pipelinename, a PipelineResource is created interactively. The tkn p start command prints the resource status if the resource status is not nil.
• Previously, the tekton.dev/task=name label was removed from the task runs created from cluster tasks. This fix modifies the tkn clustertask start command with the --last flag to check for the tekton.dev/task=name label in the created task runs.
• When a task uses an inline task specification, the corresponding task run now gets embedded in the pipeline when you run the tkn pipeline describe command, and the task name is returned as embedded.
• The tkn version command is fixed to display the version of the installed Tekton CLI tool, without a configured kubeConfiguration namespace or access to a cluster.
• If an argument is unexpected or more than one arguments are used, the tkn completion command gives an error.
• Previously, pipeline runs with the finally tasks nested in a pipeline specification would lose those finally tasks, when converted to the v1alpha1 version and restored back to the v1beta1 version. This error occurring during conversion is fixed to avoid potential data loss. Pipeline runs with the finally tasks nested in a pipeline specification is now serialized and stored on the alpha version, only to be deserialized later.
• Previously, there was an error in the pod generation when a service account had the secrets field as {}. The task runs failed with CouldntGetTask because the GET request with an empty secret name returned an error, indicating that the resource name may not be empty. This issue is fixed by avoiding an empty secret name in the kubeclient GET request.
• Pipelines with the v1beta1 API versions can now be requested along with the v1alpha1 version, without losing the finally tasks. Applying the returned v1alpha1 version will store the resource as v1beta1, with the finally section restored to its original state.
• Previously, an unset selfLink field in the controller caused an error in the Kubernetes v1.20 clusters. As a temporary fix, the CloudEvent source field is set to a value that matches the current source URI, without the value of the auto-populated selfLink field.
• Previously, a secret name with dots such as gcr.io led to a task run creation failure. This happened because of the secret name being used internally as part of a volume mount name. The volume mount name conforms to the RFC1123 DNS label and disallows dots as part of the name. This issue is fixed by replacing the dot with a dash that results in a readable name.
• Context variables are now validated in the finally tasks.
• Previously, when the task run reconciler was passed a task run that did not have a previous status update containing the name of the pod it created, the task run reconciler listed the pods associated with the task run. The task run reconciler used the labels of the task run, which were propagated to the pod, to find the pod. Changing these labels while the task run was running, caused the code to not find the existing pod. As a result, duplicate pods were created. This issue is fixed by changing the task run reconciler to only use the tekton.dev/taskRun Tekton-controlled label when finding the pod.
• Previously, when a pipeline accepted an optional workspace and passed it to a pipeline task, the pipeline run reconciler stopped with an error if the workspace was not provided, even if a missing workspace binding is a valid state for an optional workspace. This issue is fixed by ensuring that the pipeline run reconciler does not fail to create a task run, even if an optional workspace is not provided.
• The sorted order of step statuses matches the order of step containers.
• Previously, the task run status was set to unknown when a pod encountered the CreateContainerConfigError reason, which meant that the task and the pipeline ran until the pod timed out. This issue is fixed by setting the task run status to false, so that the task is set as failed when the pod encounters the CreateContainerConfigError reason.
• Previously, pipeline results were resolved on the first reconciliation, after a pipeline run was completed. This could fail the resolution resulting in the Succeeded condition of the pipeline run being overwritten. As a result, the final status information was lost, potentially confusing any services watching the pipeline run conditions. This issue is fixed by moving the resolution of pipeline results to the end of a reconciliation, when the pipeline run is put into a Succeeded or True condition.
• Execution status variable is now validated. This avoids validating task results while validating context variables to access execution status.
• Previously, a pipeline result that contained an invalid variable would be added to the pipeline run with the literal expression of the variable intact. Therefore, it was difficult to assess whether the results were populated correctly. This issue is fixed by filtering out the pipeline run results that reference failed task runs. Now, a pipeline result that contains an invalid variable will not be emitted by the pipeline run at all.
• The tkn eventlistener describe command is fixed to avoid crashing without a template. It also displays the details about trigger references.
• Upgrades from Pipelines 1.3.x and earlier versions to Pipelines 1.4.0 breaks event listeners because of the unavailability of template.name. In Pipelines 1.4.1, the template.name has been restored to avoid breaking event listeners in triggers.
• In Pipelines 1.4.1, the ConsoleQuickStart custom resource has been updated to align with OpenShift Container Platform 4.7 capabilities and behavior.

• Tekton Pipelines 0.19.0
• Tekton tkn CLI 0.15.0
• Tekton Triggers 0.10.2
• cluster tasks based on Tekton Catalog 0.19.0
• IBM Power Systems on OpenShift Container Platform 4.7
• IBM Z and LinuxONE on OpenShift Container Platform 4.7

• Pipeline templates that use PipelineResources CRDs are now deprecated and will be removed in a future release.
• The template.name field is deprecated in favor of the template.ref field and will be removed in a future release.
• The -c shorthand for the --check command has been removed. In addition, global tkn flags are added to the version command.

• CEL overlays add fields to a new top-level extensions function, instead of modifying the incoming event body. TriggerBinding resources can access values within this new extensions function using the $(extensions.<key>) syntax. Update your binding to use the $(extensions.<key>) syntax instead of the $(body.<overlay-key>) syntax.
• The escaping parameters behavior by replacing " with \" is now removed. If you need to retain the old escaping parameters behavior add the tekton.dev/old-escape-quotes: true" annotation to your TriggerTemplate specification.
• You can embed TriggerBinding resources by using the name and value fields inside a trigger or an event listener. However, you cannot specify both name and ref fields for a single binding. Use the ref field to refer to a TriggerBinding resource and the name field for embedded bindings.
• An interceptor cannot attempt to reference a secret outside the namespace of an EventListener resource. You must include secrets in the namespace of the `EventListener`resource.
• In Triggers 0.9.0 and later, if a body or header based TriggerBinding parameter is missing or malformed in an event payload, the default values are used instead of displaying an error.
• Tasks and pipelines created with WhenExpression objects using Tekton Pipelines 0.16.x must be reapplied to fix their JSON annotations.
• When a pipeline accepts an optional workspace and gives it to a task, the pipeline run stalls if the workspace is not provided.
• To use the Buildah cluster task in a disconnected environment, ensure that the Dockerfile uses an internal image stream as the base image, and then use it in the same manner as any S2I cluster task.

• Extensions added by a CEL Interceptor are passed on to webhook interceptors by adding the Extensions field within the event body.
• The activity timeout for log readers is now configurable using the LogOptions field. However, the default behavior of timeout in 10 seconds is retained.
• The log command ignores the --follow flag when a task run or pipeline run is complete, and reads available logs instead of live logs.
• References to the following Tekton resources: EventListener, TriggerBinding, ClusterTriggerBinding, Condition, and TriggerTemplate are now standardized and made consistent across all user-facing messages in tkn commands.
• Previously, if you started a canceled task run or pipeline run with the --use-taskrun <canceled-task-run-name>, --use-pipelinerun <canceled-pipeline-run-name> or --last flags, the new run would be canceled. This bug is now fixed.
• The tkn pr desc command is now enhanced to ensure that it does not fail in case of pipeline runs with conditions.
• When you delete a task run using the tkn tr delete command with the --task option, and a cluster task exists with the same name, the task runs for the cluster task also get deleted. As a workaround, filter the task runs by using the TaskRefKind field.
• The tkn triggertemplate describe command would display only part of the apiVersion value in the output. For example, only triggers.tekton.dev was displayed instead of triggers.tekton.dev/v1alpha1. This bug is now fixed.
• The webhook, under certain conditions, would fail to acquire a lease and not function correctly. This bug is now fixed.
• Pipelines with when expressions created in v0.16.3 can now be run in v0.17.1 and later. After an upgrade, you do not need to reapply pipeline definitions created in previous versions because both the uppercase and lowercase first letters for the annotations are now supported.
• By default, the leader-election-ha field is now enabled for high availability. When the disable-ha controller flag is set to true, it disables high availability support.
• Issues with duplicate cloud events are now fixed. Cloud events are now sent only when a condition changes the state, reason, or message.
• When a service account name is missing from a PipelineRun or TaskRun spec, the controller uses the service account name from the config-defaults config map. If the service account name is also missing in the config-defaults config map, the controller now sets it to default in the spec.
• Validation for compatibility with the affinity assistant is now supported when the same persistent volume claim is used for multiple workspaces, but with different subpaths.

• Tekton Pipelines 0.16.3
• Tekton tkn CLI 0.13.1
• Tekton Triggers 0.8.1
• cluster tasks based on Tekton Catalog 0.16
• IBM Power Systems on OpenShift Container Platform 4.6
• IBM Z and LinuxONE on OpenShift Container Platform 4.6

• $(params) parameters are now removed from the triggertemplate resource and replaced by $(tt.params) to avoid confusion between the resourcetemplate and triggertemplate resource parameters.
• The ServiceAccount reference of the optional EventListenerTrigger-based authentication level has changed from an object reference to a ServiceAccountName string. This ensures that the ServiceAccount reference is in the same namespace as the EventListenerTrigger object.
• The Conditions custom resource definition (CRD) is now deprecated; use the WhenExpressions CRD instead.
• The PipelineRun.Spec.ServiceAccountNames object is being deprecated and replaced by the PipelineRun.Spec.TaskRunSpec[].ServiceAccountName object.

• This release of Red Hat OpenShift Pipelines adds support for a disconnected installation. However, some images used by the cluster tasks must be mirrored for them to work in disconnected clusters.
• Pipelines in the openshift namespace are not deleted after you uninstall the Red Hat OpenShift Pipelines Operator. Use the oc delete pipelines -n openshift --all command to delete the pipelines.

• Uninstalling the Red Hat OpenShift Pipelines Operator does not remove the event listeners.

  As a workaround, to remove the EventListener and Pod CRDs:

  1. Edit the EventListener object with the foregroundDeletion finalizers:

     $ oc patch el/<eventlistener_name> -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge

     For example:

     $ oc patch el/github-listener-interceptor -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge

  2. Delete the EventListener CRD:

     $ oc patch crd/eventlisteners.triggers.tekton.dev -p '{"metadata":{"finalizers":[]}}' --type=merge

• When you run a multi-arch container image task without command specification on an IBM Power Systems (ppc64le) or IBM Z (s390x) cluster, the TaskRun resource fails with the following error:

  Error executing command: fork/exec /bin/bash: exec format error

  As a workaround, use an architecture specific container image or specify the sha256 digest to point to the correct architecture. To get the sha256 digest enter:

  $ skopeo inspect --raw <image_name>| jq '.manifests[] | select(.platform.architecture == "<architecture>") | .digest'

• A simple syntax validation to check the CEL filter, overlays in the Webhook validator, and the expressions in the interceptor has now been added.
• Triggers no longer overwrite annotations set on the underlying deployment and service objects.
• Previously, an event listener would stop accepting events. This fix adds an idle timeout of 120 seconds for the EventListener sink to resolve this issue.
• Previously, canceling a pipeline run with a Failed(Canceled) state gave a success message. This has been fixed to display an error instead.
• The tkn eventlistener list command now provides the status of the listed event listeners, thus enabling you to easily identify the available ones.
• Consistent error messages are now displayed for the triggers list and triggers describe commands when triggers are not installed or when a resource cannot be found.
• Previously, a large number of idle connections would build up during cloud event delivery. The DisableKeepAlives: true parameter was added to the cloudeventclient config to fix this issue. Thus, a new connection is set up for every cloud event.
• Previously, the creds-init code would write empty files to the disk even if credentials of a given type were not provided. This fix modifies the creds-init code to write files for only those credentials that have actually been mounted from correctly annotated secrets.

• Tekton Pipelines 0.14.3
• Tekton tkn CLI 0.11.0
• Tekton Triggers 0.6.1
• cluster tasks based on Tekton Catalog 0.14

• The --namespace or -n flags for all cluster-wide commands, including the clustertask and clustertriggerbinding commands, are deprecated. It will be removed in a future release.
• The name field in triggers.bindings within an event listener has been deprecated in favor of the ref field and will be removed in a future release.
• Variable interpolation in trigger templates using $(params) has been deprecated in favor of using $(tt.params) to reduce confusion with the pipeline variable interpolation syntax. The $(params.<paramName>) syntax will be removed in a future release.
• The tekton.dev/task label is deprecated on cluster tasks.
• The TaskRun.Status.ResourceResults.ResourceRef field is deprecated and will be removed.
• The tkn pipeline create, tkn task create, and tkn resource create -f subcommands have been removed.
• Namespace validation has been removed from tkn commands.
• The default timeout of 1h and the -t flag for the tkn ct start command have been removed.
• The s2i cluster task has been deprecated.

• Conditions do not support workspaces.
• The --workspace option and the interactive mode is not supported for the tkn clustertask start command.
• Support of backward compatibility for $(params.<paramName>) syntax forces you to use trigger templates with pipeline specific params as the trigger s webhook is unable to differentiate trigger params from pipelines params.
• Pipeline metrics report incorrect values when you run a promQL query for tekton_taskrun_count and tekton_taskrun_duration_seconds_count.
• pipeline runs and task runs continue to be in the Running and Running(Pending) states respectively even when a non existing PVC name is given to a workspace.

• Previously, the tkn task delete <name> --trs command would delete both the task and cluster task if the name of the task and cluster task were the same. With this fix, the command deletes only the task runs that are created by the task <name>.
• Previously the tkn pr delete -p <name> --keep 2 command would disregard the -p flag when used with the --keep flag and would delete all the pipeline runs except the latest two. With this fix, the command deletes only the pipeline runs that are created by the pipeline <name>, except for the latest two.
• The tkn triggertemplate describe output now displays resource templates in a table format instead of YAML format.
• Previously the buildah cluster task failed when a new user was added to a container. With this fix, the issue has been resolved.

• Tekton Pipelines 0.11.3
• Tekton tkn CLI 0.9.0
• Tekton Triggers 0.4.0
• cluster tasks based on Tekton Catalog 0.11

• The environment variable $HOME, and variable workingDir in the Steps specification are deprecated and might be changed in a future release. Currently in a Step container, the HOME and workingDir variables are overwritten to /tekton/home and /workspace variables, respectively.

  In a later release, these two fields will not be modified, and will be set to values defined in the container image and the Task YAML. For this release, use the disable-home-env-overwrite and disable-working-directory-overwrite flags to disable overwriting of the HOME and workingDir variables.

• The following commands are deprecated and might be removed in the future release: tkn pipeline create, tkn task create.
• The -f flag with the tkn resource create command is now deprecated. It might be removed in the future release.
• The -t flag and the --timeout flag (with seconds format) for the tkn clustertask create command are now deprecated. Only duration timeout format is now supported, for example 1h30s. These deprecated flags might be removed in the future release.

• If you are upgrading from an older version of Red Hat OpenShift Pipelines, you must delete your existing deployments before upgrading to Red Hat OpenShift Pipelines version 1.0. To delete an existing deployment, you must first delete Custom Resources and then uninstall the Red Hat OpenShift Pipelines Operator. For more details, see the uninstalling Red Hat OpenShift Pipelines section.
• Submitting the same v1alpha1 tasks more than once results in an error. Use the oc replace command instead of oc apply when re-submitting a v1alpha1 task.

• The buildah cluster task does not work when a new user is added to a container.

  When the Operator is installed, the --storage-driver flag for the buildah cluster task is not specified, therefore the flag is set to its default value. In some cases, this causes the storage driver to be set incorrectly. When a new user is added, the incorrect storage-driver results in the failure of the buildah cluster task with the following error:

  useradd: /etc/passwd.8: lock file already used
  useradd: cannot lock /etc/passwd; try again later.

  As a workaround, manually set the --storage-driver flag value to overlay in the buildah-task.yaml file:

  1. Login to your cluster as a cluster-admin:

     $ oc login -u <login> -p <password> https://openshift.example.com:6443

  2. Use the oc edit command to edit buildah cluster task:

     $ oc edit clustertask buildah

     The current version of the buildah clustertask YAML file opens in the editor set by your EDITOR environment variable.

  3. Under the Steps field, locate the following command field:

      command: ['buildah', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--layers', '-f', '$(params.DOCKERFILE)', '-t', '$(resources.outputs.image.url)', '$(params.CONTEXT)']

  4. Replace the command field with the following:

      command: ['buildah', '--storage-driver=overlay', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--no-cache', '-f', '$(params.DOCKERFILE)', '-t', '$(params.IMAGE)', '$(params.CONTEXT)']

  5. Save the file and exit.

  Alternatively, you can also modify the buildah cluster task YAML file directly on the web console by navigating to Pipelines → Cluster Tasks → buildah. Select Edit Cluster Task from the Actions menu and replace the command field as shown in the previous procedure.

• Previously, the DeploymentConfig task triggered a new deployment build even when an image build was already in progress. This caused the deployment of the pipeline to fail. With this fix, the deploy task command is now replaced with the oc rollout status command which waits for the in-progress deployment to finish.
• Support for APP_NAME parameter is now added in pipeline templates.
• Previously, the pipeline template for Java S2I failed to look up the image in the registry. With this fix, the image is looked up using the existing image pipeline resources instead of the user provided IMAGE_NAME parameter.
• All the OpenShift Pipelines images are now based on the Red Hat Universal Base Images (UBI).
• Previously, when the pipeline was installed in a namespace other than tekton-pipelines, the tkn version command displayed the pipeline version as unknown. With this fix, the tkn version command now displays the correct pipeline version in any namespace.
• The -c flag is no longer supported for the tkn version command.
• Non-admin users can now list the cluster trigger bindings.
• The event listener CompareSecret function is now fixed for the CEL Interceptor.
• The list, describe, and start subcommands for tasks and cluster tasks now correctly display the output in case a task and cluster task have the same name.
• Previously, the OpenShift Pipelines Operator modified the privileged security context constraints (SCCs), which caused an error during cluster upgrade. This error is now fixed.
• In the tekton-pipelines namespace, the timeouts of all task runs and pipeline runs are now set to the value of default-timeout-minutes field using the config map.
• Previously, the pipelines section in the web console was not displayed for non-admin users. This issue is now resolved.

• input: Specifies static inputs or variables such as a parameter, task result, and execution status. You must enter a valid input. If you do not enter a valid input, its value defaults to an empty string.
• operator: Specifies the relationship of an input to a set of values. Enter in or notin as your operator values.
• values: Specifies an array of string values. Enter a non-empty array of static values or variables such as parameters, results, and a bound state of a workspace.

• The result of a previous task is as expected.
• A file in a Git repository has changed in the previous commits.
• An image exists in the registry.
• An optional workspace is available.

• All the criteria are met: Tasks and the when expression symbol, which is represented by a diamond shape are green.
• Any one of the criteria are not met: Task is skipped. Skipped tasks and the when expression symbol are grey.
• None of the criteria are met: Task is skipped. Skipped tasks and the when expression symbol are grey.
• Task run fails: Failed tasks and the when expression symbol are red.

• Store Task inputs and outputs
• Share data among Tasks
• Use it as a mount point for credentials held in Secrets
• Use it as a mount point for configurations held in ConfigMaps
• Use it as a mount point for common tools shared by an organization
• Create a cache of build artifacts that speed up jobs

• A read-only ConfigMaps or Secret
• An existing PersistentVolumeClaim shared with other Tasks
• A PersistentVolumeClaim from a provided VolumeClaimTemplate
• An emptyDir that is discarded when the TaskRun completes

• The TriggerBinding resource extracts the fields from an event payload and stores them as parameters.

  The following example shows a code snippet of the TriggerBinding resource, which extracts the Git repository information from the received event payload:

  apiVersion: triggers.tekton.dev/v1alpha1 1
  kind: TriggerBinding 2
  metadata:
    name: vote-app 3
  spec:
    params: 4
    - name: git-repo-url
      value: $(body.repository.url)
    - name: git-repo-name
      value: $(body.repository.name)
    - name: git-revision
      value: $(body.head_commit.id)

  1

  The API version of the TriggerBinding resource. In this example, v1alpha1.

  2

  Specifies the type of Kubernetes object. In this example, TriggerBinding.

  3

  Unique name to identify the TriggerBinding resource.

  4

  List of parameters which will be extracted from the received event payload and passed to the TriggerTemplate resource. In this example, the Git repository URL, name, and revision are extracted from the body of the event payload.

• The TriggerTemplate resource acts as a standard for the way resources must be created. It specifies the way parameterized data from the TriggerBinding resource should be used. A trigger template receives input from the trigger binding, and then performs a series of actions that results in creation of new pipeline resources, and initiation of a new pipeline run.

  The following example shows a code snippet of a TriggerTemplate resource, which creates a pipeline run using the Git repository information received from the TriggerBinding resource you just created:

  apiVersion: triggers.tekton.dev/v1alpha1 1
  kind: TriggerTemplate 2
  metadata:
    name: vote-app 3
  spec:
    params: 4
    - name: git-repo-url
      description: The git repository url
    - name: git-revision
      description: The git revision
      default: pipelines-1.5
    - name: git-repo-name
      description: The name of the deployment to be created / patched
  
    resourcetemplates: 5
    - apiVersion: tekton.dev/v1beta1
      kind: PipelineRun
      metadata:
        name: build-deploy-$(tt.params.git-repo-name)-$(uid)
      spec:
        serviceAccountName: pipeline
        pipelineRef:
          name: build-and-deploy
        params:
        - name: deployment-name
          value: $(tt.params.git-repo-name)
        - name: git-url
          value: $(tt.params.git-repo-url)
        - name: git-revision
          value: $(tt.params.git-revision)
        - name: IMAGE
          value: image-registry.openshift-image-registry.svc:5000/pipelines-tutorial/$(tt.params.git-repo-name)
        workspaces:
        - name: shared-workspace
          volumeClaimTemplate:
           spec:
            accessModes:
             - ReadWriteOnce
            resources:
              requests:
                storage: 500Mi

  1

  The API version of the TriggerTemplate resource. In this example, v1alpha1.

  2

  Specifies the type of Kubernetes object. In this example, TriggerTemplate.

  3

  Unique name to identify the TriggerTemplate resource.

  4

  Parameters supplied by the TriggerBinding resource.

  5

  List of templates that specify the way resources must be created using the parameters received through the TriggerBinding or EventListener resources.

• The Trigger resource combines the TriggerBinding and TriggerTemplate resources, and optionally, the interceptors event processor.

  Interceptors process all the events for a specific platform that runs before the TriggerBinding resource. You can use interceptors to filter the payload, verify events, define and test trigger conditions, and implement other useful processing. Interceptors use secret for event verification. After the event data passes through an interceptor, it then goes to the trigger before you pass the payload data to the trigger binding. You can also use an interceptor to modify the behavior of the associated trigger referenced in the EventListener specification.

  The following example shows a code snippet of a Trigger resource, named vote-trigger that connects the TriggerBinding and TriggerTemplate resources, and the interceptors event processor.

  apiVersion: triggers.tekton.dev/v1alpha1 1
  kind: Trigger 2
  metadata:
    name: vote-trigger 3
  spec:
    serviceAccountName: pipeline 4
    interceptors:
      - ref:
          name: "github" 5
        params: 6
          - name: "secretRef"
            value:
              secretName: github-secret
              secretKey: secretToken
          - name: "eventTypes"
            value: ["push"]
    bindings:
      - ref: vote-app 7
    template: 8
       ref: vote-app
  ---
  apiVersion: v1
  kind: Secret 9
  metadata:
    name: github-secret
  type: Opaque
  stringData:
    secretToken: "1234567"

  1

  The API version of the Trigger resource. In this example, v1alpha1.

  2

  Specifies the type of Kubernetes object. In this example, Trigger.

  3

  Unique name to identify the Trigger resource.

  4

  Service account name to be used.

  5

  Interceptor name to be referenced. In this example, github.

  6

  Desired parameters to be specified.

  7

  Name of the TriggerBinding resource to be connected to the TriggerTemplate resource.

  8

  Name of the TriggerTemplate resource to be connected to the TriggerBinding resource.

  9

  Secret to be used to verify events.

• The EventListener resource provides an endpoint, or an event sink, that listens for incoming HTTP-based events with a JSON payload. It extracts event parameters from each TriggerBinding resource, and then processes this data to create Kubernetes resources as specified by the corresponding TriggerTemplate resource. The EventListener resource also performs lightweight event processing or basic filtering on the payload using event interceptors, which identify the type of payload and optionally modify it. Currently, pipeline triggers support five types of interceptors: Webhook Interceptors, GitHub Interceptors, GitLab Interceptors, Bitbucket Interceptors, and Common Expression Language (CEL) Interceptors.

  The following example shows an EventListener resource, which references the Trigger resource named vote-trigger.

  apiVersion: triggers.tekton.dev/v1alpha1 1
  kind: EventListener 2
  metadata:
    name: vote-app 3
  spec:
    serviceAccountName: pipeline 4
    triggers:
      - triggerRef: vote-trigger 5

  1

  The API version of the EventListener resource. In this example, v1alpha1.

  2

  Specifies the type of Kubernetes object. In this example, EventListener.

  3

  Unique name to identify the EventListener resource.

  4

  Service account name to be used.

  5

  Name of the Trigger resource referenced by the EventListener resource.