Chapter 6. Red Hat OpenShift Pipelines release notes
Red Hat OpenShift Pipelines is a cloud-native CI/CD experience based on the Tekton project which provides:
- Standard Kubernetes-native pipeline definitions (CRDs).
- Serverless pipelines with no CI server management overhead.
- Extensibility to build images using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko.
- Portability across any Kubernetes distribution.
- Powerful CLI for interacting with pipelines.
- Integrated user experience with the Developer perspective of the OpenShift Container Platform web console.
For an overview of Red Hat OpenShift Pipelines, see Understanding OpenShift Pipelines.
6.1. Getting support
If you experience difficulty with a procedure described in this documentation, visit the Red Hat Customer Portal to learn more about Red Hat Technology Preview features support scope.
For questions and feedback, you can send an email to the product team at pipelines-interest@redhat.com.
6.2. Release notes for Red Hat OpenShift Pipelines Technology Preview 1.2
6.2.1. New features
Red Hat OpenShift Pipelines Technology Preview (TP) 1.2 is now available on OpenShift Container Platform 4.6. Red Hat OpenShift Pipelines TP 1.2 is updated to support:
- Tekton Pipelines 0.16.3
-
Tekton
tkn
CLI 0.13.1 - Tekton Triggers 0.8.1
- ClusterTasks based on Tekton Catalog 0.16
- IBM Power Systems on OpenShift Container Platform 4.6
- IBM Z and LinuxONE on OpenShift Container Platform 4.6
In addition to the fixes and stability improvements, here is a highlight of what’s new in OpenShift Pipelines 1.2.
6.2.1.1. Pipelines
This release of Red Hat OpenShift Pipelines adds support for a disconnected installation.
NoteInstallations in restricted environments are currently not supported on IBM Power Systems, IBM Z, and LinuxONE.
-
You can now use the
when
field, instead ofconditions
, to run a task only when certain criteria are met. The key components ofWhenExpressions
areInput
,Operator
, andValues
. If all theWhenExpressions
evaluate toTrue
, then the task is run. If any of theWhenExpressions
evaluate toFalse
, the task is skipped. - Step statuses are now updated if a task run is canceled or times out.
-
Support for Git Large File Storage (LFS) is now available to build the base image used by
git-init
. -
You can now use the
taskSpec
field to specify metadata, such as labels and annotations, when a task is embedded in a pipeline. -
Cloud events are now supported by pipeline runs. Retries with
backoff
are now enabled for cloud events sent by the cloud event pipeline resource. -
You can now set a default
Workspace
configuration for any workspace that aTask
resource declares, but that aTaskRun
resource does not explicitly provide. -
Support is available for namespace variable interpolation for the
PipelineRun
namespace andTaskRun
namespace. -
Validation for
TaskRun
objects is now added to check that not more than one persistent volume claim workspace is used when aTaskRun
resource is associated with an Affinity Assistant. If more than one persistent volume claim workspace is used, the task run fails with aTaskRunValidationFailed
condition. Note that by default, the Affinity Assistant is disabled in Red Hat OpenShift Pipelines, so you will need to enable the assistant to use it.
6.2.1.2. Pipelines CLI
The
tkn task describe
,tkn taskrun describe
,tkn clustertask describe
,tkn pipeline describe
, andtkn pipelinerun describe
commands now:-
Automatically select the
Task
,TaskRun
,ClusterTask
,Pipeline
andPipelineRun
resource, respectively, if only one of them is present. -
Display the results of the
Task
,TaskRun
,ClusterTask
,Pipeline
andPipelineRun
resource in their outputs, respectively. -
Display workspaces declared in the
Task
,TaskRun
,ClusterTask
,Pipeline
andPipelineRun
resource in their outputs, respectively.
-
Automatically select the
-
You can now use the
--prefix-name
option with thetkn clustertask start
command to specify a prefix for the name of a task run. -
Interactive mode support has now been provided to the
tkn clustertask start
command. -
You can now specify
PodTemplate
properties supported by pipelines using local or remote file definitions forTaskRun
andPipelineRun
objects. -
You can now use the
--use-params-defaults
option with thetkn clustertask start
command to use the default values set in theClusterTask
configuration and create the task run. -
The
--use-param-defaults
flag for thetkn pipeline start
command now prompts the interactive mode if the default values have not been specified for some of the parameters.
6.2.1.3. Triggers
-
The Common Expression Language (CEL) function named
parseYAML
has been added to parse a YAML string into a map of strings. - Error messages for parsing CEL expressions have been improved to make them more granular while evaluating expressions and when parsing the hook body for creating the evaluation environment.
- Support is now available for marshaling boolean values and maps if they are used as the values of expressions in a CEL overlay mechanism.
The following fields have been added to the
EventListener
object:-
The
replicas
field enables the event listener to run more than one pod by specifying the number of replicas in the YAML file. -
The
NodeSelector
field enables theEventListener
object to schedule the event listener pod to a specific node.
-
The
-
Webhook interceptors can now parse the
EventListener-Request-URL
header to extract parameters from the original request URL being handled by the event listener. - Annotations from the event listener can now be propagated to the deployment, services, and other pods. Note that custom annotations on services or deployment are overwritten, and hence, must be added to the event listener annotations so that they are propagated.
-
Proper validation for replicas in the
EventListener
specification is now available for cases when a user specifies thespec.replicas
values asnegative
orzero
. -
You can now specify the
TriggerCRD
object inside theEventListener
spec as a reference using theTriggerRef
field to create theTriggerCRD
object separately and then bind it inside theEventListener
spec. -
Validation and defaults for the
TriggerCRD
object are now available.
6.2.2. Deprecated features
-
$(params)
are now removed and replaced by$(tt.params)
to avoid confusion between theresourcetemplate
andtriggertemplate
parameters. -
The
ServiceAccount
reference of the optionalEventListenerTrigger
-based authentication level has changed from an object reference to aServiceAccountName
string. This ensures that theServiceAccount
reference is in the same namespace as theEventListenerTrigger
object. -
The
Conditions
custom resource definition (CRD) is now deprecated; use theWhenExpressions
CRD instead. -
The
PipelineRun.Spec.ServiceAccountNames
object is being deprecated and replaced by thePipelineRun.Spec.TaskRunSpec[].ServiceAccountName
object.
6.2.3. Known issues
- This release of Red Hat OpenShift Pipelines adds support for a disconnected installation. However, some images used by the cluster tasks must be mirrored for them to work in disconnected clusters.
-
Pipelines in the
openshift
namespace are not deleted after you uninstall the Red Hat OpenShift Pipelines Operator. Use theoc delete pipelines -n openshift --all
command to delete the pipelines. Uninstalling the Red Hat OpenShift Pipelines Operator does not remove the event listeners.
As a workaround, to remove the
EventListener
andPod
CRDs:Edit the
EventListener
object with theforegroundDeletion
finalizers:$ oc patch el/<eventlistener_name> -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge
For example:
$ oc patch el/github-listener-interceptor -p '{"metadata":{"finalizers":["foregroundDeletion"]}}' --type=merge
Delete the
EventListener
CRD:$ oc patch crd/eventlisteners.triggers.tekton.dev -p '{"metadata":{"finalizers":[]}}' --type=merge
When you run a multi-arch container image task without command specification on an IBM Power Systems (ppc64le) or IBM Z (s390x) cluster, the
TaskRun
resource fails with the following error:Error executing command: fork/exec /bin/bash: exec format error
As a workaround, use an architecture specific container image or specify the sha256 digest to point to the correct architecture. To get the sha256 digest enter:
$ skopeo inspect --raw <image_name>| jq '.manifests[] | select(.platform.architecture == "<architecture>") | .digest'
6.2.4. Fixed issues
- A simple syntax validation to check the CEL filter, overlays in the Webhook validator, and the expressions in the interceptor has now been added.
- Triggers no longer overwrite annotations set on the underlying deployment and service objects.
-
Previously, an event listener would stop accepting events. This fix adds an idle timeout of 120 seconds for the
EventListener
sink to resolve this issue. -
Previously, canceling a pipeline run with a
Failed(Canceled)
state gave a success message. This has been fixed to display an error instead. -
The
tkn eventlistener list
command now provides the status of the listed event listeners, thus enabling you to easily identify the available ones. -
Consistent error messages are now displayed for the
triggers list
andtriggers describe
commands when triggers are not installed or when a resource cannot be found. -
Previously, a large number of idle connections would build up during cloud event delivery. The
DisableKeepAlives: true
parameter was added to thecloudeventclient
config to fix this issue. Thus, a new connection is set up for every cloud event. -
Previously, the
creds-init
code would write empty files to the disk even if credentials of a given type were not provided. This fix modifies thecreds-init
code to write files for only those credentials that have actually been mounted from correctly annotated secrets.
6.3. Release notes for Red Hat OpenShift Pipelines Technology Preview 1.1
6.3.1. New features
Red Hat OpenShift Pipelines Technology Preview (TP) 1.1 is now available on OpenShift Container Platform 4.6. Red Hat OpenShift Pipelines TP 1.1 is updated to support:
- Tekton Pipelines 0.14.3
-
Tekton
tkn
CLI 0.11.0 - Tekton Triggers 0.6.1
- ClusterTasks based on Tekton Catalog 0.14
In addition to the fixes and stability improvements, here is a highlight of what’s new in OpenShift Pipelines 1.1.
6.3.1.1. Pipelines
- Workspaces can now be used instead of PipelineResources. It is recommended that you use Workspaces in OpenShift Pipelines, as PipelineResources are difficult to debug, limited in scope, and make Tasks less reusable. For more details on Workspaces, see Understanding OpenShift Pipelines.
Workspace support for VolumeClaimTemplates has been added:
- The VolumeClaimTemplate for a PipelineRun and TaskRun can now be added as a volume source for Workspaces. The tekton-controller then creates a PersistentVolumeClaim (PVC) using the template that is seen as a PVC for all TaskRuns in the Pipeline. Thus you do not need to define the PVC configuration every time it binds a workspace that spans multiple tasks.
- Support to find the name of the PersistentVolumeClaim when a VolumeClaimTemplate is used as a volume source is now available using variable substitution.
Support for improving audits:
-
The
PipelineRun.Status
field now contains the status of every TaskRun in the Pipeline and the Pipeline specification used to instantiate a PipelineRun to monitor the progress of the PipelineRun. -
Pipeline results have been added to the pipeline specification and
PipelineRun
status. -
The
TaskRun.Status
field now contains the exact Task specification used to instantiate theTaskRun
.
-
The
- Support to apply the default parameter to Conditions.
-
A TaskRun created by referencing a ClusterTask now adds the
tekton.dev/clusterTask
label instead of thetekton.dev/task
label. -
The
kubeconfigwriter
now adds theClientKeyData
and theClientCertificateData
configurations in the Resource structure to enable replacement of the pipeline resource type cluster with the kubeconfig-creator Task. -
The names of the
feature-flags
and theconfig-defaults
ConfigMaps are now customizable. - Support for HostNetwork in the PodTemplate used by TaskRun is now available.
- An Affinity Assistant is now available to support node affinity in TaskRuns that share workspace volume. By default, this is disabled on OpenShift Pipelines.
-
The PodTemplate has been updated to specify
imagePullSecrets
to identify secrets that the container runtime should use to authorize container image pulls when starting a pod. - Support for emitting warning events from the TaskRun controller if the controller fails to update the TaskRun.
- Standard or recommended k8s labels have been added to all resources to identify resources belonging to an application or component.
- The Entrypoint process is now notified for signals and these signals are then propagated using a dedicated PID Group of the Entrypoint process.
-
The PodTemplate can now be set on a Task level at runtime using
TaskRunSpecs
. Support for emitting Kubernetes events:
-
The controller now emits events for additional TaskRun lifecycle events -
taskrun started
andtaskrun running
. - The PipelineRun controller now emits an event every time a Pipeline starts.
-
The controller now emits events for additional TaskRun lifecycle events -
- In addition to the default Kubernetes events, support for CloudEvents for TaskRuns is now available. The controller can be configured to send any TaskRun events, such as create, started, and failed, as cloud events.
-
Support for using the
$context.<task|taskRun|pipeline|pipelineRun>.name
variable to reference the appropriate name when in PipelineRuns and TaskRuns. - Validation for PipelineRun parameters is now available to ensure that all the parameters required by the Pipeline are provided by the PipelineRun. This also allows PipelineRuns to provide extra parameters in addition to the required parameters.
-
You can now specify Tasks within a Pipeline that will always execute before the pipeline exits, either after finishing all tasks successfully or after a Task in the Pipeline failed, using the
finally
field in the Pipeline YAML file. -
The
git-clone
ClusterTask is now available.
6.3.1.2. Pipelines CLI
-
Support for embedded Trigger binding is now available to the
tkn evenlistener describe
command. - Support to recommend subcommands and make suggestions if an incorrect subcommand is used.
-
The
tkn task describe
command now auto selects the task if only one task is present in the Pipeline. -
You can now start a Task using default parameter values by specifying the
--use-param-defaults
flag in thetkn task start
command. -
You can now specify a volumeClaimTemplate for PipelineRuns or TaskRuns using the
--workspace
option with thetkn pipeline start
ortkn task start
commands. -
The
tkn pipelinerun logs
command now displays logs for the final tasks listed in thefinally
section. -
Interactive mode support has now been provided to the
tkn task start
command and thedescribe
subcommand for the following tkn resources:pipeline
,pipelinerun
,task
,taskrun
,clustertask
, andpipelineresource
. -
The
tkn version
command now displays the version of the Triggers installed in the cluster. -
The
tkn pipeline describe
command now displays parameter values and timeouts specified for Tasks used in the Pipeline. -
Support added for the
--last
option for thetkn pipelinerun describe
and thetkn taskrun describe
commands to describe the most recent PipelineRun or TaskRun, respectively. -
The
tkn pipeline describe
command now displays the conditions applicable to the Tasks in the Pipeline. -
You can now use the
--no-headers
and--all-namespaces
flags with thetkn resource list
command.
6.3.1.3. Triggers
The following Common Expression Language (CEL) functions are now available:
-
parseURL
to parse and extract portions of a URL -
parseJSON
to parse JSON value types embedded in a string in thepayload
field of thedeployment
webhook
-
- A new interceptor for webhooks from Bitbucket has been added.
-
EventListeners now display the
Address URL
and theAvailable status
as additional fields when listed with thekubectl get
command. -
TriggerTemplate params now use the
$(tt.params.<paramName>)
syntax instead of$(params.<paramName>)
to reduce the confusion between TriggerTemplate and ResourceTemplates params. -
You can now add
tolerations
in the EventListener CRD to ensure that EventListeners are deployed with the same configuration even if all nodes are tainted due to security or management issues. -
You can now add a Readiness Probe for EventListener Deployment at
URL/live
. - Support for embedding TriggerBinding specifications in EventListener Triggers.
-
Trigger resources are now annotated with the recommended
app.kubernetes.io
labels.
6.3.2. Deprecated features
The following items are deprecated in this release:
-
The
--namespace
or-n
flags for all cluster-wide commands, including theclustertask
andclustertriggerbinding
commands, are deprecated. It will be removed in a future release. -
The
name
field intriggers.bindings
within an EventListener has been deprecated in favor of theref
field and will be removed in a future release. -
Variable interpolation in TriggerTemplates using
$(params)
has been deprecated in favor of using$(tt.params)
to reduce confusion with the Pipeline variable interpolation syntax. The$(params.<paramName>)
syntax will be removed in a future release. -
The
tekton.dev/task
label is deprecated on ClusterTasks. -
The
TaskRun.Status.ResourceResults.ResourceRef
field is deprecated and will be removed. -
The
tkn pipeline create
,tkn task create
, andtkn resource create -f
subcommands have been removed. -
Namespace validation has been removed from
tkn
commands. -
The default timeout of
1h
and the-t
flag for thetkn ct start
command have been removed. -
The
s2i
ClusterTask has been deprecated.
6.3.3. Known issues
- Conditions do not support Workspaces.
-
The
--workspace
option and the interactive mode is not supported for thetkn clustertask start
command. -
Support of backward compatibility for
$(params.<paramName>)
forces you to use TriggerTemplates with pipeline specific params as the Triggers webhook is unable to differentiate Trigger params from pipelines params. -
Pipeline metrics report incorrect values when you run a promQL query for
tekton_taskrun_count
andtekton_taskrun_duration_seconds_count
. -
PipelineRuns and TaskRuns continue to be in the
Running
andRunning(Pending)
states respectively even when a non existing PVC name is given to a Workspace.
6.3.4. Fixed issues
-
Previously, the
tkn task delete <name> --trs
command would delete both the Task and ClusterTask if the name of the Task and ClusterTask were the same. With this fix, the command deletes only the TaskRuns that are created by the Task<name>
. -
Previously the
tkn pr delete -p <name> --keep 2
command would disregard the-p
flag when used with the--keep
flag and would delete all the PipelineRuns except the latest two. With this fix, the command deletes only the PipelineRuns that are created by the Pipeline<name>
, except for the latest two. -
The
tkn triggertemplate describe
output now displays ResourceTemplates in a table format instead of YAML format. -
Previously the
buildah
ClusterTask failed when a new user was added to a container. With this fix, the issue has been resolved.
6.4. Release notes for Red Hat OpenShift Pipelines Technology Preview 1.0
6.4.1. New features
Red Hat OpenShift Pipelines Technology Preview (TP) 1.0 is now available on OpenShift Container Platform 4.6. Red Hat OpenShift Pipelines TP 1.0 is updated to support:
- Tekton Pipelines 0.11.3
-
Tekton
tkn
CLI 0.9.0 - Tekton Triggers 0.4.0
- ClusterTasks based on Tekton Catalog 0.11
In addition to the fixes and stability improvements, here is a highlight of what’s new in OpenShift Pipelines 1.0.
6.4.1.1. Pipelines
- Support for v1beta1 API Version.
- Support for an improved LimitRange. Previously, LimitRange was specified exclusively for the TaskRun and the PipelineRun. Now there is no need to explicitly specify the LimitRange. The minimum LimitRange across the namespace is used.
- Support for sharing data between Tasks using TaskResults and TaskParams.
-
Pipelines can now be configured to not overwrite the
HOME
environment variable andworkingDir
of Steps. -
Similar to Task Steps,
sidecars
now support script mode. -
You can now specify a different scheduler name in TaskRun
podTemplate
. - Support for variable substitution using Star Array Notation.
- Tekton Controller can now be configured to monitor an individual namespace.
- A new description field is now added to the specification of Pipeline, Task, ClusterTask, Resource, and Condition.
- Addition of proxy parameters to Git PipelineResources.
6.4.1.2. Pipelines CLI
-
The
describe
subcommand is now added for the followingtkn
resources:eventlistener
,condition
,triggertemplate
,clustertask
, andtriggerbinding
. -
Support added for
v1beta1
to the following commands along with backward comptibility forv1alpha1
:clustertask
,task
,pipeline
,pipelinerun
, andtaskrun
. The following commands can now list output from all namespaces using the
--all-namespaces
flag option:-
tkn task list
-
tkn pipeline list
-
tkn taskrun list
tkn pipelinerun list
The output of these commands is also enhanced to display information without headers using the
--no-headers
flag option.
-
-
You can now start a Pipeline using default parameter values by specifying
--use-param-defaults
flag in thetkn pipelines start
command. -
Support for Workspace is now added to
tkn pipeline start
andtkn task start
commands. -
A new
clustertriggerbinding
command is now added with the following subcommands:describe
,delete
, andlist
. -
You can now directly start a pipeline run using a local or remote
yaml
file. -
The
describe
subcommand now displays an enhanced and detailed output. With the addition of new fields, such asdescription
,timeout
,param description
, andsidecar status
, the command output now provides more detailed information about a specifictkn
resource. -
The
tkn task log
command now displays logs directly if only one task is present in the namespace.
6.4.1.3. Triggers
-
Triggers can now create both
v1alpha1
andv1beta1
Pipeline resources. -
Support for new Common Expression Language (CEL) interceptor function -
compareSecret
. This function securely compares strings to secrets in CEL expressions. - Support for authentication and authorization at the EventListener Trigger level.
6.4.2. Deprecated features
The following items are deprecated in this release:
The environment variable
$HOME
, and variableworkingDir
in the Steps specification are deprecated and might be changed in a future release. Currently in a Step container,HOME
andworkingDir
are overwritten to/tekton/home
and/workspace
respectively.In a later release, these two fields will not be modified, and will be set to values defined in the container image and Task YAML. For this release, use flags
disable-home-env-overwrite
anddisable-working-directory-overwrite
to disable overwriting of theHOME
andworkingDir
variables.The following commands are deprecated and might be removed in the future release:
-
tkn pipeline create
-
tkn task create
-
-
The
-f
flag with thetkn resource create
command is now deprecated. It might be removed in the future release. -
The
-t
flag and the--timeout
flag (with seconds format) for thetkn clustertask create
command are now deprecated. Only duration timeout format is now supported, for example1h30s
. These deprecated flags might be removed in the future release.
6.4.3. Known issues
- If you are upgrading from an older version of Red Hat OpenShift Pipelines, you must delete your existing deployments before upgrading to Red Hat OpenShift Pipelines version 1.0. To delete an existing deployment, you must first delete Custom Resources and then uninstall the Red Hat OpenShift Pipelines Operator. For more details, see the uninstalling Red Hat OpenShift Pipelines section.
-
Submitting the same
v1alpha1
Tasks more than once results in an error. Useoc replace
instead ofoc apply
when re-submitting av1alpha1
Task. The
buildah
ClusterTask does not work when a new user is added to a container.When the Operator is installed, the
--storage-driver
flag for thebuildah
ClusterTask is not specified, therefore the flag is set to its default value. In some cases, this causes the storage driver to be set incorrectly. When a new user is added, the incorrect storage-driver results in the failure of thebuildah
ClusterTask with the following error:useradd: /etc/passwd.8: lock file already used useradd: cannot lock /etc/passwd; try again later.
As a workaround, manually set the
--storage-driver
flag value tooverlay
in thebuildah-task.yaml
file:Login to your cluster as a
cluster-admin
:$ oc login -u <login> -p <password> https://openshift.example.com:6443
Use the
oc edit
command to editbuildah
ClusterTask:$ oc edit clustertask buildah
The current version of the
buildah
clustertask YAML file opens in the editor set by yourEDITOR
environment variable.Under the
steps
field, locate the followingcommand
field:command: ['buildah', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--layers', '-f', '$(params.DOCKERFILE)', '-t', '$(resources.outputs.image.url)', '$(params.CONTEXT)']
Replace the
command
field with the following:command: ['buildah', '--storage-driver=overlay', 'bud', '--format=$(params.FORMAT)', '--tls-verify=$(params.TLSVERIFY)', '--no-cache', '-f', '$(params.DOCKERFILE)', '-t', '$(params.IMAGE)', '$(params.CONTEXT)']
- Save the file and exit.
Alternatively, you can also modify the
buildah
ClusterTask YAML file directly on the web console by navigating to PipelinesCluster Tasks buildah. Select Edit Cluster Task from the Actions menu and replace the command
field as shown in the previous procedure.
6.4.4. Fixed issues
-
Previously, the
DeploymentConfig
Task triggered a new deployment build even when an image build was already in progress. This caused the deployment of the Pipeline to fail. With this fix, thedeploy task
command is now replaced with theoc rollout status
command which waits for the in-progress deployment to finish. -
Support for
APP_NAME
parameter is now added in Pipeline templates. -
Previously, the Pipeline template for Java S2I failed to look up the image in the registry. With this fix, the image is looked up using the existing image PipelineResources instead of the user provided
IMAGE_NAME
parameter. - All the OpenShift Pipelines images are now based on the Red Hat Universal Base Images (UBI).
-
Previously, when the Pipeline was installed in a namespace other than
tekton-pipelines
, thetkn version
command displayed the Pipeline version asunknown
. With this fix, thetkn version
command now displays the correct Pipeline version in any namespace. -
The
-c
flag is no longer supported for thetkn version
command. - Non-admin users can now list the ClusterTriggerBindings.
- The EventListener CompareSecret function is now fixed for the CEL Interceptor.
-
The
list
,describe
, andstart
subcommands fortask
andclustertask
now correctly display the output in case a Task and ClusterTask have the same name. - Previously, the OpenShift Pipelines Operator modified the privileged security context constraints (SCCs), which caused an error during cluster upgrade. This error is now fixed.
-
In the
tekton-pipelines
namespace, the timeouts of all TaskRuns and PipelineRuns are now set to the value ofdefault-timeout-minutes
field using the ConfigMap. - Previously, the Pipelines section in the web console was not displayed for non-admin users. This issue is now resolved.