CI/CD

• .gitconfig File
• Basic Authentication
• SSH Key Authentication
• Trusted Certificate Authorities

• Create a secret object with secret data.
• Update the pod service account to allow the reference to the secret.
• Create a pod, which consumes the secret as an environment variable or as a file using a secret volume.

Procedure

• Use the create command to create a secret object from a JSON or YAML file:

  $ oc create -f <filename>

  For example, you can create a secret from your local .docker/config.json file:

  $ oc create secret generic dockerhub \
      --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
      --type=kubernetes.io/dockerconfigjson

  This command generates a JSON specification of the secret named dockerhub and creates the object.

  YAML Opaque Secret Object Definition

  apiVersion: v1
  kind: Secret
  metadata:
    name: mysecret
  type: Opaque 1
  data:
    username: <username>
    password: <password>

  1

  Specifies an opaque secret.

  Docker Configuration JSON File Secret Object Definition

  apiVersion: v1
  kind: Secret
  metadata:
    name: aregistrykey
    namespace: myapps
  type: kubernetes.io/dockerconfigjson 1
  data:
    .dockerconfigjson:bm5ubm5ubm5ubm5ubm5ubm5ubm5ubmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cgYXV0aCBrZXlzCg== 2

  1

  Specifies that the secret is using a docker configuration JSON file.

  2

  The output of a base64-encoded the docker configuration JSON file

Procedure

• Set the fieldPath environment variable source to the JsonPath of the field from which you are interested in obtaining the value:

  env:
    - name: FIELDREF_ENV
      valueFrom:
        fieldRef:
          fieldPath: metadata.name

Procedure

• To use a secret as an environment variable, set the valueFrom syntax:

  apiVersion: build.openshift.io/v1
  kind: BuildConfig
  metadata:
    name: secret-example-bc
  spec:
    strategy:
      sourceStrategy:
        env:
        - name: MYVAL
          valueFrom:
            secretKeyRef:
              key: myval
              name: mysecret

Procedure

• Set the imageOptimizationPolicy to SkipLayers:

  strategy:
    dockerStrategy:
      imageOptimizationPolicy: SkipLayers

Prerequisites

• You have added an input secret, config map, or both to a BuildConfig object.

Procedure

• In the dockerStrategy definition of the BuildConfig object, add any build volumes to the volumes array. For example:

  spec:
    dockerStrategy:
      volumes:
        - name: secret-mvn 1
          mounts:
          - destinationPath: /opt/app-root/src/.ssh 2
          source:
            type: Secret 3
            secret:
              secretName: my-secret 4
        - name: settings-mvn 5
          mounts:
          - destinationPath: /opt/app-root/src/.m2  6
          source:
            type: ConfigMap 7
            configMap:
              name: my-config 8
        - name: my-csi-volume 9
          mounts:
          - destinationPath: /opt/app-root/src/some_path  10
          source:
            type: CSI 11
            csi:
              driver: csi.sharedresource.openshift.io 12
              readOnly: true 13
              volumeAttributes: 14
                attribute: value

  1 5 9

  Required. A unique name.

  2 6 10

  Required. The absolute path of the mount point. It must not contain .. or : and doesn’t collide with the destination path generated by the builder. The /opt/app-root/src is the default home directory for many Red Hat S2I-enabled images.

  3 7 11

  Required. The type of source, ConfigMap, Secret, or CSI.

  4 8

  Required. The name of the source.

  12

  Required. The driver that provides the ephemeral CSI volume.

  13

  Optional. If true, this instructs the driver to provide a read-only volume.

  14

  Optional. The volume attributes of the ephemeral CSI volume. Consult the CSI driver’s documentation for supported attribute keys and values.

Procedure

• To create an incremental build, create a with the following modification to the strategy definition:

  strategy:
    sourceStrategy:
      from:
        kind: "ImageStreamTag"
        name: "incremental-image:latest" 1
      incremental: true 2

  1

  Specify an image that supports incremental builds. Consult the documentation of the builder image to determine if it supports this behavior.

  2

  This flag controls whether an incremental build is attempted. If the builder image does not support incremental builds, the build will still succeed, but you will get a log message stating the incremental build was not successful because of a missing save-artifacts script.

• Provide an assemble, run, or save-artifacts script in the .s2i/bin directory of your application source repository.

• Provide a URL of a directory containing the scripts as part of the strategy definition. For example:

  strategy:
    sourceStrategy:
      from:
        kind: "ImageStreamTag"
        name: "builder-image:latest"
      scripts: "http://somehost.com/scripts_directory" 1

  1

  This path will have run, assemble, and save-artifacts appended to it. If any or all scripts are found they will be used in place of the same named scripts provided in the image.

Prerequisites

• You have added an input secret, config map, or both to a BuildConfig object.

Procedure

• In the sourceStrategy definition of the BuildConfig object, add any build volumes to the volumes array. For example:

  spec:
    sourceStrategy:
      volumes:
        - name: secret-mvn 1
          mounts:
          - destinationPath: /opt/app-root/src/.ssh 2
          source:
            type: Secret 3
            secret:
              secretName: my-secret 4
        - name: settings-mvn 5
          mounts:
          - destinationPath: /opt/app-root/src/.m2 6
          source:
            type: ConfigMap 7
            configMap:
              name: my-config 8
        - name: my-csi-volume 9
          mounts:
          - destinationPath: /opt/app-root/src/some_path  10
          source:
            type: CSI 11
            csi:
              driver: csi.sharedresource.openshift.io 12
              readOnly: true 13
              volumeAttributes: 14
                attribute: value

Procedure

• Set the customStrategy.from section:

  strategy:
    customStrategy:
      from:
        kind: "DockerImage"
        name: "openshift/sti-image-builder"

Procedure

• To mount each secret at a specific location, edit the secretSource and mountPath fields of the strategy YAML file:

  strategy:
    customStrategy:
      secrets:
        - secretSource: 1
            name: "secret1"
          mountPath: "/tmp/secret1" 2
        - secretSource:
            name: "secret2"
          mountPath: "/tmp/secret2"

  1

  secretSource is a reference to a secret in the same namespace as the build.

  2

  mountPath is the path inside the custom builder where the secret should be mounted.

• Dynamic job and run creation in Jenkins.
• Dynamic creation of agent pod templates from image streams, image stream tags, or config maps.
• Injection of environment variables.
• Pipeline visualization in the OpenShift Container Platform web console.
• Integration with the Jenkins Git plugin, which passes commit information from OpenShift Container Platform builds to the Jenkins Git plugin.
• Synchronization of secrets into Jenkins credential entries.

• An inline jenkinsfile field within your build configuration.
• A jenkinsfilePath field within your build configuration that references the location of the jenkinsfile to use relative to the source contextDir.

• A file located within your source code repository.
• Embedded as part of your build configuration using the jenkinsfile field.

• A file named jenkinsfile at the root of your repository.
• A file named jenkinsfile at the root of the source contextDir of your repository.
• A file name specified via the jenkinsfilePath field of the JenkinsPipelineStrategy section of your BuildConfig, which is relative to the source contextDir if supplied, otherwise it defaults to the root of the repository.

• Embed the Jenkins file in the build configuration.
• Include in the build configuration a reference to the Git repository that contains the Jenkins file.

Procedure

• To define environment variables to be used during build, edit the YAML file:

  jenkinsPipelineStrategy:
  ...
    env:
      - name: "FOO"
        value: "BAR"

Procedure

• To manually re-run a build, enter the following command:

  $ oc start-build --from-build=<build_name>

Procedure

• To manually stream a build’s logs in stdout, enter the following command:

  $ oc start-build <buildconfig_name> --follow

Procedure

• To specify a desired environment variable, enter the following command:

  $ oc start-build <buildconfig_name> --env=<key>=<value>

Procedure

• Start a build from a source using the following command to send the contents of a local Git repository as an archive from the tag v2:

  $ oc start-build hello-world --from-repo=../hello-world --commit=v2

Procedure

• To manually cancel multiple builds, enter the following command:

  $ oc cancel-build <build1_name> <build2_name> <build3_name>

Procedure

• To cancel all builds, enter the following command:

  $ oc cancel-build bc/<buildconfig_name>

Procedure

• To cancel all in a given state, enter the following command:

  $ oc cancel-build bc/<buildconfig_name>

Procedure

• To stream the logs of the latest build for a BuildConfig, enter the following command:

  $ oc logs -f bc/<buildconfig_name>

Procedure

• To stream the logs for a given version build for a BuildConfig, enter the following command:

  $ oc logs --version=<number> bc/<buildconfig_name>

Procedure

• To enable more verbose output, pass the BUILD_LOGLEVEL environment variable as part of the sourceStrategy or dockerStrategy in a BuildConfig:

  sourceStrategy:
  ...
    env:
      - name: "BUILD_LOGLEVEL"
        value: "2" 1

  1

  Adjust this value to the desired log level.

Prerequisites

• You have configured multiple image change triggers. These triggers have triggered one or more builds.

• lastTriggeredImageID: This field, which is not shown in the example, is deprecated in OpenShift Container Platform 4.8 and will be ignored in a future release. It contains the resolved image reference for the ImageStreamTag when the last build was triggered from this BuildConfig.
• paused: You can use this field, which is not shown in the example, to temporarily disable this particular image change trigger.
• from: You use this field to reference the ImageStreamTag that drives this image change trigger. Its type is the core Kubernetes type, OwnerReference.

Procedure

• Shell script:

  postCommit:
    script: "bundle exec rake test --verbose"

  The script value is a shell script to be run with /bin/sh -ic. Use this when a shell script is appropriate to execute the build hook. For example, for running unit tests as above. To control the image entry point, or if the image does not have /bin/sh, use command and/or args.

  Note

  The additional -i flag was introduced to improve the experience working with CentOS and RHEL images, and may be removed in a future release.

• Command as the image entry point:

  postCommit:
    command: ["/bin/bash", "-c", "bundle exec rake test --verbose"]

  In this form, command is the command to run, which overrides the image entry point in the exec form, as documented in the Dockerfile reference. This is needed if the image does not have /bin/sh, or if you do not want to use a shell. In all other cases, using script might be more convenient.

• Command with arguments:

  postCommit:
    command: ["bundle", "exec", "rake", "test"]
    args: ["--verbose"]

  This form is equivalent to appending the arguments to command.

Prerequisites

• You must provide or create a yum-compatible repository configuration file that downloads content from your Satellite instance.

  Sample repository configuration

  [test-<name>]
  name=test-<number>
  baseurl = https://satellite.../content/dist/rhel/server/7/7Server/x86_64/os
  enabled=1
  gpgcheck=0
  sslverify=0
  sslclientkey = /etc/pki/entitlement/...-key.pem
  sslclientcert = /etc/pki/entitlement/....pem

Prerequisites

• You have added the entitlement keys and Satellite repository configurations as build volumes.

• Pipeline: Automates the entire process of building, testing, and deploying applications, using the Groovy syntax.
• Node: A machine capable of either orchestrating or executing a scripted pipeline.
• Stage: A conceptually distinct subset of tasks performed in a pipeline. Plugins or user interfaces often use this block to display status or progress of tasks.
• Step: A single task that specifies the exact action to be taken, either by using a command or a script.

• Pipeline: A set of tasks in a series, in parallel, or both.
• Task: A sequence of steps as commands, binaries, or scripts.
• PipelineRun: Execution of a pipeline with one or more tasks.

• TaskRun: Execution of a task with one or more steps.

  Note

  You can initiate a PipelineRun or a TaskRun with a set of inputs such as parameters and workspaces, and the execution results in a set of outputs and artifacts.

• Workspace: In Tekton, workspaces are conceptual blocks that serve the following purposes:

  • Storage of inputs, outputs, and build artifacts.
  • Common space to share data among tasks.
  • Mount points for credentials held in secrets, configurations held in config maps, and common tools shared by an organization.
  Note

  In Jenkins, there is no direct equivalent of Tekton workspaces. You can think of the control node as a workspace, as it stores the cloned code repository, build history, and artifacts. In situations where a job is assigned to a different node, the cloned code and the generated artifacts are stored in that node, but the build history is maintained by the control node.

• With this update, the prior version of the tkn command is not compatible with Red Hat OpenShift Pipelines 1.10.
• This update removes support for Cluster and CloudEvent pipeline resources from Tekton CLI. You cannot create pipeline resources by using the tkn pipelineresource create command. Also, pipeline resources are no longer supported in the start command of a task, cluster task, or pipeline.
• This update removes tekton as a provenance format from Tekton Chains.

• In Red Hat OpenShift Pipelines 1.10, the ClusterTask commands are now deprecated and are planned to be removed in a future release. The tkn task create command is also deprecated with this update.
• In Red Hat OpenShift Pipelines 1.10, the flags -i and -o that were used with the tkn task start command are now deprecated because the v1 API does not support pipeline resources.
• In Red Hat OpenShift Pipelines 1.10, the flag -r that was used with the tkn pipeline start command is deprecated because the v1 API does not support pipeline resources.
• The Red Hat OpenShift Pipelines 1.10 update sets the openshiftDefaultEmbeddedStatus parameter to both with full and minimal embedded status. The flag to change the default embedded status is also deprecated and will be removed. In addition, the pipeline default embedded status will be changed to minimal in a future release.

• This update includes the following backward incompatible changes:

  • Removal of the PipelineResources cluster
  • Removal of the PipelineResources cloud event

• If the pipelines metrics feature does not work after a cluster upgrade, run the following command as a workaround:

  $ oc get tektoninstallersets.operator.tekton.dev | awk '/pipeline-main-static/ {print $1}' | xargs oc delete tektoninstallersets

• With this update, usage of external databases, such as the Crunchy PostgreSQL is not supported on IBM Power, IBM Z, and {linuxoneProductName}. Instead, use the default Tekton Hub database.

• Before this update, the opc pac command generated a runtime error instead of showing any help. This update fixes the opc pac command to show the help message.
• Before this update, running the tkn pac create repo command needed the webhook details for creating a repository. With this update, the tkn-pac create repo command does not configure a webhook when your GitHub application is installed.
• Before this update, Pipelines as Code would not report a pipeline run creation error when Tekton Pipelines had issues creating the PipelineRun resource. For example, a non-existing task in a pipeline run would show no status. With this update, Pipelines as Code shows the proper error message coming from Tekton Pipelines along with the task that is missing.
• This update fixes UI page redirection after a successful authentication. Now, you are redirected to the same page where you had attempted to log in to Tekton Hub.
• This update fixes the list command with these flags, --all-namespaces and --output=yaml, for a cluster task, an individual task, and a pipeline.
• This update removes the forward slash in the end of the repo.spec.url URL so that it matches the URL coming from GitHub.
• Before this update, the marshalJSON function would not marshal a list of objects. With this update, the marshalJSON function marshals the list of objects.
• With this update, Pipelines as Code lets you bypass GitHub enterprise questions in the CLI bootstrap GitHub application.
• This update fixes the GitHub collaborator check when your repository has more than 100 users.
• With this update, the sign and verify commands for a task or pipeline now work without a kubernetes configuration file.
• With this update, Tekton Operator cleans leftover pruner cron jobs if pruner has been skipped on a namespace.
• Before this update, the API ConfigMap object would not be updated with a user configured value for a catalog refresh interval. This update fixes the CATALOG_REFRESH_INTERVAL API in the Tekon Hub CR.

• This update fixes reconciling of PipelineRunStatus when changing the EmbeddedStatus feature flag. This update resets the following parameters:

  • The status.runs and status.taskruns parameters to nil with minimal EmbeddedStatus
  • The status.childReferences parameter to nil with full EmbeddedStatus
• This update adds a conversion configuration to the ResolutionRequest CRD. This update properly configures conversion from the v1alpha1.ResolutionRequest request to the v1beta1.ResolutionRequest request.
• This update checks for duplicate workspaces associated with a pipeline task.
• This update fixes the default value for enabling resolvers in the code.
• This update fixes TaskRef and PipelineRef names conversion by using a resolver.

• With this update, the Conditions custom resource definition (CRD) type has been removed. As an alternative, use the WhenExpressions instead.
• With this update, support for tekton.dev/v1alpha1 API pipeline resources, such as Pipeline, PipelineRun, Task, Clustertask, and TaskRun has been removed.
• With this update, the tkn-pac setup command has been removed. Instead, use the tkn-pac webhook add command to re-add a webhook to an existing Git repository. And use the tkn-pac webhook update-token command to update the personal provider access token for an existing Secret object in the Git repository.
• With this update, a namespace that runs a pipeline with default settings does not apply the pod-security.kubernetes.io/enforce:privileged label to a workload.

• In the Red Hat OpenShift Pipelines 1.9.0 release, ClusterTasks are deprecated and planned to be removed in a future release. As an alternative, you can use Cluster Resolver.
• In the Red Hat OpenShift Pipelines 1.9.0 release, the use of the triggers and the namespaceSelector fields in a single EventListener specification is deprecated and planned to be removed in a future release. You can use these fields in different EventListener specifications successfully.
• In the Red Hat OpenShift Pipelines 1.9.0 release, the tkn pipelinerun describe command does not display timeouts for the PipelineRun resource.
• In the Red Hat OpenShift Pipelines 1.9.0 release, the PipelineResource` custom resource (CR) is deprecated. The PipelineResource CR was a Tech Preview feature and part of the tekton.dev/v1alpha1 API.
• In the Red Hat OpenShift Pipelines 1.9.0 release, custom image parameters from cluster tasks are deprecated. As an alternative, you can copy a cluster task and use your custom image in it.

• The chains-secret and chains-config config maps are removed after you uninstall the Red Hat OpenShift Pipelines Operator. As they contain user data, they should be preserved and not deleted.

• When running the tkn pac set of commands on Windows, you may receive the following error message: Command finished with error: not supported by Windows.

  Workaround: Set the NO_COLOR environment variable to true.

• Running the tkn pac resolve -f <filename> | oc create -f command may not provide expected results, if the tkn pac resolve command uses a templated parameter value to function.

  Workaround: To mitigate this issue, save the output of tkn pac resolve in a temporary file by running the tkn pac resolve -f <filename> -o tempfile.yaml command and then run the oc create -f tempfile.yaml command. For example, tkn pac resolve -f <filename> -o /tmp/pull-request-resolved.yaml && oc create -f /tmp/pull-request-resolved.yaml.

• Before this update, after replacing an empty array, the original array returned an empty string rendering the paramaters inside it invalid. With this update, this issue is resolved and the original array returns as empty.
• Before this update, if duplicate secrets were present in a service account for a pipelines run, it resulted in failure in task pod creation. With this update, this issue is resolved and the task pod is created successfully even if duplicate secrets are present in a service account.
• Before this update, by looking at the TaskRun’s spec.StatusMessage field, users could not distinguish whether the TaskRun had been cancelled by the user or by a PipelineRun that was part of it. With this update, this issue is resolved and users can distinguish the status of the TaskRun by looking at the TaskRun’s spec.StatusMessage field.
• Before this update, webhook validation was removed on deletion of old versions of invalid objects. With this update, this issue is resolved.

• Before this update, if you set the timeouts.pipeline parameter to 0, you could not set the timeouts.tasks parameter or the timeouts.finally parameters. This update resolves the issue. Now, when you set the timeouts.pipeline parameter value, you can set the value of either the`timeouts.tasks` parameter or the timeouts.finally parameter. For example:

  yaml
  kind: PipelineRun
  spec:
    timeouts:
      pipeline: "0"  # No timeout
      tasks: "0h3m0s"

• Before this update, a race condition could occur if another tool updated labels or annotations on a PipelineRun or TaskRun. With this update, this issue is resolved and you can merge labels or annotations.

• Before this update, log keys did not have the same keys as in pipelines controllers. With this update, this issue has been resolved and the log keys have been updated to match the log stream of pipeline controllers. The keys in logs have been changed from "ts" to "timestamp", from "level" to "severity", and from "message" to "msg".

• Before this update, if a PipelineRun was deleted with an unknown status, an error message was not generated. With this update, this issue is resolved and an error message is generated.
• Before this update, to access bundle commands like list and push, it was required to use the kubeconfig file . With this update, this issue has been resolved and the kubeconfig file is not required to access bundle commands.
• Before this update, if the parent PipelineRun was running while deleting TaskRuns, then TaskRuns would be deleted. With this update, this issue is resolved and TaskRuns are not getting deleted if the parent PipelineRun is running.
• Before this update, if the user attempted to build a bundle with more objects than the pipeline controller permitted, the Tekton CLI did not display an error message. With this update, this issue is resolved and the Tekton CLI displays an error message if the user attempts to build a bundle with more objects than the limit permitted in the pipeline controller.

• Before this update, if namespaces were removed from the cluster, then the operator did not remove namespaces from the ClusterInterceptor ClusterRoleBinding subjects. With this update, this issue has been resolved, and the operator removes the namespaces from the ClusterInterceptor ClusterRoleBinding subjects.
• Before this update, the default installation of the Red Hat OpenShift Pipelines Operator resulted in the pipelines-scc-rolebinding security context constraint (SCC) role binding resource remaining in the cluster. With this update, the default installation of the Red Hat OpenShift Pipelines Operator results in the pipelines-scc-rolebinding security context constraint (SCC) role binding resource resource being removed from the cluster.

• Before this update, Pipelines as Code did not get updated values from the Pipelines as Code ConfigMap object. With this update, this issue is fixed and the Pipelines as Code ConfigMap object looks for any new changes.
• Before this update, Pipelines as Code controller did not wait for the tekton.dev/pipeline label to be updated and added the checkrun id label, which would cause race conditions. With this update, the Pipelines as Code controller waits for the tekton.dev/pipeline label to be updated and then adds the checkrun id label, which helps to avoid race conditions.
• Before this update, the tkn-pac create repo command did not override a PipelineRun if it already existed in the git repository. With this update, tkn-pac create command is fixed to override a PipelineRun if it exists in the git repository and this resolves the issue successfully.
• Before this update, the tkn pac describe command did not display reasons for every message. With this update, this issue is fixed and the tkn pac describe command displays reasons for every message.
• Before this update, a pull request failed if the user in the annotation provided values by using a regex form, for example, refs/head/rel-*. The pull request failed because it was missing refs/heads in its base branch. With this update, the prefix is added and checked that it matches. This resolves the issue and the pull request is successful.

• Before this update, the tkn pac repo list command did not run on Microsoft Windows. This update fixes the issue, and now you can run the tkn pac repo list command on Microsoft Windows.
• Before this update, Pipelines as Code watcher did not receive all the configuration change events. With this update, the Pipelines as Code watcher is updated, and now the Pipelines as Code watcher does not miss the configuration change events.
• Before this update, the pods created by Pipelines as Code, such as TaskRuns or PipelineRuns could not access custom certificates exposed by the user in the cluster. This update fixes the issue, and you can now access custom certificates from the TaskRuns or PipelineRuns pods in the cluster.
• Before this update, on a cluster enabled with FIPS, the tekton-triggers-core-interceptors core interceptor used in the Trigger resource did not function after the Pipelines Operator was upgraded to version 1.9. This update resolves the issue. Now, OpenShift uses MInTLS 1.2 for all its components. As a result, the tekton-triggers-core-interceptors core interceptor updates to TLS version 1.2and its functionality runs accurately.

• Before this update, when using a pipeline run with an internal OpenShift image registry, the URL to the image had to be hardcoded in the pipeline run definition. For example:

  ...
    - name: IMAGE_NAME
      value: 'image-registry.openshift-image-registry.svc:5000/<test_namespace>/<test_pipelinerun>'
  ...

  When using a pipeline run in the context of Pipelines as Code, such hardcoded values prevented the pipeline run definitions from being used in different clusters and namespaces.

  With this update, you can use the dynamic template variables instead of hardcoding the values for namespaces and pipeline run names to generalize pipeline run definitions. For example:

  ...
    - name: IMAGE_NAME
      value: 'image-registry.openshift-image-registry.svc:5000/{{ target_namespace }}/$(context.pipelineRun.name)'
  ...

• Before this update, Pipelines as Code used the same GitHub token to fetch a remote task available in the same host only on the default GitHub branch. This update resolves the issue. Now Pipelines as Code uses the same GitHub token to fetch a remote task from any GitHub branch.

• The value for CATALOG_REFRESH_INTERVAL, a field in the Hub API ConfigMap object used in the Tekton Hub CR, is not getting updated with a custom value provided by the user.

  Workaround: None. You can track the issue SRVKP-2854.

• With this update, an OLM misconfiguration issue has been introduced, which prevents the upgrade of the OpenShift Container Platform. This issue will be fixed in a future release.

• Before this update, an OLM misconfiguration issue had been introduced in the previous version of the release, which prevented the upgrade of OpenShift Container Platform. With this update, this misconfiguration issue has been fixed.

• This update fixes the performance issues for huge pipelines. Now, the CPU usage is reduced by 61% and the memory usage is reduced by 44%.
• Before this update, a pipeline run would fail if a task did not run because of its when expression. This update fixes the issue by preventing the validation of a skipped task result in pipeline results. Now, the pipeline result is not emitted and the pipeline run does not fail because of a missing result.
• This update fixes the pipelineref.bundle conversion to the bundle resolver for the v1beta1 API. Now, the conversion feature sets the value of the kind field to Pipeline after conversion.
• Before this update, an issue in the Pipelines Operator prevented the user from setting the value of the spec.pipeline.enable-api-fields field to beta. This update fixes the issue. Now, you can set the value to beta along with alpha and stable in the TektonConfig custom resource.
• Before this update, when Pipelines as Code could not create a secret due to a cluster error, it would show the temporary token on the GitHub check run, which is public. This update fixes the issue. Now, the token is no longer displayed on the GitHub checks interface when the creation of the secret fails.

• There is currently a known issue with the stop option for pipeline runs in the OpenShift Container Platform web console. The stop option in the Actions drop-down list is not working as expected and does not cancel the pipeline run.

• There is currently a known issue with upgrading to Pipelines version 1.9.x due to a failing custom resource definition conversion.

  Workaround: Before upgrading to Pipelines version 1.9.x, perform the step mentioned in the solution on the Red Hat Customer Portal.

• This update changes the default metrics level of TaskRun and PipelineRun resources to the following values:

  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: config-observability
    namespace: tekton-pipelines
    labels:
      app.kubernetes.io/instance: default
      app.kubernetes.io/part-of: tekton-pipelines
  data:
    _example: |
    ...
      metrics.taskrun.level: "task"
      metrics.taskrun.duration-type: "histogram"
      metrics.pipelinerun.level: "pipeline"
      metrics.pipelinerun.duration-type: "histogram"

• With this update, if an annotation or label is present in both Pipeline and PipelineRun resources, the value in the Run type takes precedence. The same is true if an annotation or label is present in Task and TaskRun resources.
• In Red Hat OpenShift Pipelines 1.8, the previously deprecated PipelineRun.Spec.ServiceAccountNames field has been removed. Use the PipelineRun.Spec.TaskRunSpecs field instead.
• In Red Hat OpenShift Pipelines 1.8, the previously deprecated TaskRun.Status.ResourceResults.ResourceRef field has been removed. Use the TaskRun.Status.ResourceResults.ResourceName field instead.
• In Red Hat OpenShift Pipelines 1.8, the previously deprecated Conditions resource type has been removed. Remove the Conditions resource from Pipeline resource definitions that include it. Use when expressions in PipelineRun definitions instead.

• For Tekton Chains, the tekton-provenance format has been removed in this release. Use the in-toto format by setting "artifacts.taskrun.format": "in-toto" in the TektonChain custom resource instead.

• Red Hat OpenShift Pipelines 1.7.x shipped with Pipelines as Code 0.5.x. The current update ships with Pipelines as Code 0.10.x. This change creates a new route in the openshift-pipelines namespace for the new controller. You must update this route in GitHub Apps or webhooks that use Pipelines as Code. To fetch the route, use the following command:

  $ oc get route -n openshift-pipelines pipelines-as-code-controller \
    --template='https://{{ .spec.host }}'

• With this update, Pipelines as Code renames the default secret keys for the Repository custom resource definition (CRD). In your CRD, replace token with provider.token, and replace secret with webhook.secret.
• With this update, Pipelines as Code replaces a special template variable with one that supports multiple pipeline runs for private repositories. In your pipeline runs, replace secret: pac-git-basic-auth-{{repo_owner}}-{{repo_name}} with secret: {{ git_auth_secret }}.

• With this update, Pipelines as Code updates the following commands in the tkn-pac CLI tool:

  • Replace tkn pac repository create with tkn pac create repository.
  • Replace tkn pac repository delete with tkn pac delete repository.
  • Replace tkn pac repository list with tkn pac list.

• Starting with OpenShift Container Platform 4.11, the preview and stable channels for installing and upgrading the Red Hat OpenShift Pipelines Operator are removed. To install and upgrade the Operator, use the appropriate pipelines-<version> channel, or the latest channel for the most recent stable version. For example, to install the Pipelines Operator version 1.8.x, use the pipelines-1.8 channel.

  Note

  In OpenShift Container Platform 4.10 and earlier versions, you can use the preview and stable channels for installing and upgrading the Operator.

• Support for the tekton.dev/v1alpha1 API version, which was deprecated in Red Hat OpenShift Pipelines GA 1.6, is planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.

  This change affects the pipeline component, which includes the TaskRun, PipelineRun, Task, Pipeline, and similar tekton.dev/v1alpha1 resources. As an alternative, update existing resources to use apiVersion: tekton.dev/v1beta1 as described in Migrating From Tekton v1alpha1 to Tekton v1beta1.

  Bug fixes and support for the tekton.dev/v1alpha1 API version are provided only through the end of the current GA 1.8 lifecycle.

  Important

  For the Tekton Operator, the operator.tekton.dev/v1alpha1 API version is not deprecated. You do not need to make changes to this value.

• In Red Hat OpenShift Pipelines 1.8, the PipelineResource custom resource (CR) is available but no longer supported. The PipelineResource CR was a Tech Preview feature and part of the tekton.dev/v1alpha1 API, which had been deprecated and planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.
• In Red Hat OpenShift Pipelines 1.8, the Condition custom resource (CR) is removed. The Condition CR was part of the tekton.dev/v1alpha1 API, which has been deprecated and is planned to be removed in the upcoming Red Hat OpenShift Pipelines GA 1.9 release.
• In Red Hat OpenShift Pipelines 1.8, the gcr.io image for gsutil has been removed. This removal might break clusters with Pipeline resources that depend on this image. Bug fixes and support are provided only through the end of the Red Hat OpenShift Pipelines 1.7 lifecycle.

• In Red Hat OpenShift Pipelines 1.8, the PipelineRun.Status.TaskRuns and PipelineRun.Status.Runs fields are deprecated and are planned to be removed in a future release. See TEP-0100: Embedded TaskRuns and Runs Status in PipelineRuns.

• In Red Hat OpenShift Pipelines 1.8, the pipelineRunCancelled state is deprecated and planned to be removed in a future release. Graceful termination of PipelineRun objects is now promoted from an alpha feature to a stable feature. (See TEP-0058: Graceful Pipeline Run Termination.) As an alternative, you can use the Cancelled state, which replaces the pipelineRunCancelled state.

  You do not need to make changes to your Pipeline and Task resources. If you have tools that cancel pipeline runs, you must update tools in the next release. This change also affects tools such as the CLI, IDE extensions, and so on, so that they support the new PipelineRun statuses.

  Because this feature is available by default, you no longer need to set the pipeline.enable-api-fields field to alpha in the TektonConfig custom resource definition.

• In Red Hat OpenShift Pipelines 1.8, the timeout field in PipelineRun has been deprecated. Instead, use the PipelineRun.Timeouts field, which is now promoted from an alpha feature to a stable feature.

  Because this feature is available by default, you no longer need to set the pipeline.enable-api-fields field to alpha in the TektonConfig custom resource definition.

• In Red Hat OpenShift Pipelines 1.8, init containers are omitted from the LimitRange object’s default request calculations.

• The s2i-nodejs pipeline cannot use the nodejs:14-ubi8-minimal image stream to perform source-to-image (S2I) builds. Using that image stream produces an error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127 message.

  Workaround: Use nodejs:14-ubi8 rather than the nodejs:14-ubi8-minimal image stream.

• When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters.

  Workaround: Specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

  Tip

  Before you install tasks that are based on the Tekton Catalog on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) using tkn hub, verify if the task can be executed on these platforms. To check if ppc64le and s390x are listed in the "Platforms" section of the task information, you can run the following command: tkn hub info task <name>

• On ARM, IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

• Implicit parameter mapping incorrectly passes parameters from the top-level Pipeline or PipelineRun definitions to the taskRef tasks. Mapping should only occur from a top-level resource to tasks with in-line taskSpec specifications. This issue only affects clusters where this feature was enabled by setting the enable-api-fields field to alpha in the pipeline section of the TektonConfig custom resource definition.

• Before this update, the metrics for pipeline runs in the Developer view of the web console were incomplete and outdated. With this update, the issue has been fixed so that the metrics are correct.
• Before this update, if a pipeline had two parallel tasks that failed and one of them had retries=2, the final tasks never ran, and the pipeline timed out and failed to run. For example, the pipelines-operator-subscription task failed intermittently with the following error message: Unable to connect to the server: EOF. With this update, the issue has been fixed so that the final tasks always run.
• Before this update, if a pipeline run stopped because a task run failed, other task runs might not complete their retries. As a result, no finally tasks were scheduled, which caused the pipeline to hang. This update resolves the issue. TaskRuns and Run objects can retry when a pipeline run has stopped, even by graceful stopping, so that pipeline runs can complete.
• This update changes how resource requirements are calculated when one or more LimitRange objects are present in the namespace where a TaskRun object exists. The scheduler now considers step containers and excludes all other app containers, such as sidecar containers, when factoring requests from LimitRange objects.
• Before this update, under specific conditions, the flag package might incorrectly parse a subcommand immediately following a double dash flag terminator, --. In that case, it ran the entrypoint subcommand rather than the actual command. This update fixes this flag-parsing issue so that the entrypoint runs the correct command.
• Before this update, the controller might generate multiple panics if pulling an image failed, or its pull status was incomplete. This update fixes the issue by checking the step.ImageID value rather than the status.TaskSpec value.
• Before this update, canceling a pipeline run that contained an unscheduled custom task produced a PipelineRunCouldntCancel error. This update fixes the issue. You can cancel a pipeline run that contains an unscheduled custom task without producing that error.

• Before this update, if the <NAME> in $params["<NAME>"] or $params['<NAME>'] contained a dot character (.), any part of the name to the right of the dot was not extracted. For example, from $params["org.ipsum.lorem"], only org was extracted.

  This update fixes the issue so that $params fetches the complete value. For example, $params["org.ipsum.lorem"] and $params['org.ipsum.lorem'] are valid and the entire value of <NAME>, org.ipsum.lorem, is extracted.

  It also throws an error if <NAME> is not enclosed in single or double quotes. For example, $params.org.ipsum.lorem is not valid and generates a validation error.

• With this update, Trigger resources support custom interceptors and ensure that the port of the custom interceptor service is the same as the port in the ClusterInterceptor definition file.

• Before this update, the tkn version command for Tekton Chains and Operator components did not work correctly. This update fixes the issue so that the command works correctly and returns version information for those components.
• Before this update, if you ran a tkn pr delete --ignore-running command and a pipeline run did not have a status.condition value, the tkn CLI tool produced a null-pointer error (NPE). This update fixes the issue so that the CLI tool now generates an error and correctly ignores pipeline runs that are still running.
• Before this update, if you used the tkn pr delete --keep <value> or tkn tr delete --keep <value> commands, and the number of pipeline runs or task runs was less than the value, the command did not return an error as expected. This update fixes the issue so that the command correctly returns an error under those conditions.
• Before this update, if you used the tkn pr delete or tkn tr delete commands with the -p or -t flags together with the --ignore-running flag, the commands incorrectly deleted running or pending resources. This update fixes the issue so that these commands correctly ignore running or pending resources.

• With this update, you can configure Tekton Chains by using the TektonChain custom resource. This feature enables your configuration to persist after upgrading, unlike the chains-config config map, which gets overwritten during upgrades.
• With this update, ClusterTask resources no longer run as root by default, except for the buildah and s2i cluster tasks.
• Before this update, tasks on Red Hat OpenShift Pipelines 1.7.1 failed when using init as a first argument followed by two or more arguments. With this update, the flags are parsed correctly, and the task runs are successful.

• Before this update, installation of the Red Hat OpenShift Pipelines Operator on OpenShift Container Platform 4.9 and 4.10 failed due to an invalid role binding, with the following error message:

  error updating rolebinding openshift-operators-prometheus-k8s-read-binding: RoleBinding.rbac.authorization.k8s.io
  "openshift-operators-prometheus-k8s-read-binding" is invalid:
  roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"openshift-operator-read"}: cannot change roleRef

  This update fixes the issue so that the failure no longer occurs.

• Previously, upgrading the Red Hat OpenShift Pipelines Operator caused the pipeline service account to be recreated, which meant that the secrets linked to the service account were lost. This update fixes the issue. During upgrades, the Operator no longer recreates the pipeline service account. As a result, secrets attached to the pipeline service account persist after upgrades, and the resources (tasks and pipelines) continue to work correctly.
• With this update, Pipelines as Code pods run on infrastructure nodes if infrastructure node settings are configured in the TektonConfig custom resource (CR).

• Previously, with the resource pruner, each namespace Operator created a command that ran in a separate container. This design consumed too many resources in clusters with a high number of namespaces. For example, to run a single command, a cluster with 1000 namespaces produced 1000 containers in a pod.

  This update fixes the issue. It passes the namespace-based configuration to the job so that all the commands run in one container in a loop.

• In Tekton Chains, you must define a secret called signing-secrets to hold the key used for signing tasks and images. However, before this update, updating the Red Hat OpenShift Pipelines Operator reset or overwrote this secret, and the key was lost. This update fixes the issue. Now, if the secret is configured after installing Tekton Chains through the Operator, the secret persists, and it is not overwritten by upgrades.

• Before this update, all S2I build tasks failed with an error similar to the following message:

  Error: error writing "0 0 4294967295\n" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted
  time="2022-03-04T09:47:57Z" level=error msg="error writing \"0 0 4294967295\\n\" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted"
  time="2022-03-04T09:47:57Z" level=error msg="(unable to determine exit status)"

  With this update, the pipelines-scc security context constraint (SCC) is compatible with the SETFCAP capability necessary for Buildah and S2I cluster tasks. As a result, the Buildah and S2I build tasks can run successfully.

  To successfully run the Buildah cluster task and S2I build tasks for applications written in various languages and frameworks, add the following snippet for appropriate steps objects such as build and push:

  securityContext:
    capabilities:
      add: ["SETFCAP"]

• Before this update, installing the Red Hat OpenShift Pipelines Operator took longer than expected. This update optimizes some settings to speed up the installation process.
• With this update, Buildah and S2I cluster tasks have fewer steps than in previous versions. Some steps have been combined into a single step so that they work better with ResourceQuota and LimitRange objects and do not require more resources than necessary.
• This update upgrades the Buildah, tkn CLI tool, and skopeo CLI tool versions in cluster tasks.
• Before this update, the Operator failed when creating RBAC resources if any namespace was in a Terminating state. With this update, the Operator ignores namespaces in a Terminating state and creates the RBAC resources.
• Before this update, pods for the prune cronjobs were not scheduled on infrastructure nodes, as expected. Instead, they were scheduled on worker nodes or not scheduled at all. With this update, these types of pods can now be scheduled on infrastructure nodes if configured in the TektonConfig custom resource (CR).

• Breaking change: This update removes the disable-working-directory-overwrite and disable-home-env-overwrite fields from the TektonConfig custom resource (CR). As a result, the TektonConfig CR no longer automatically sets the $HOME environment variable and workingDir parameter. You can still set the $HOME environment variable and workingDir parameter by using the env and workingDir fields in the Task custom resource definition (CRD).

• The Conditions custom resource definition (CRD) type is deprecated and planned to be removed in a future release. Instead, use the recommended When expression.

• Breaking change: The Triggers resource validates the templates and generates an error if you do not specify the EventListener and TriggerBinding values.

• When you run Maven and Jib-Maven cluster tasks, the default container image is supported only on Intel (x86) architecture. Therefore, tasks will fail on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) clusters. As a workaround, you can specify a custom image by setting the MAVEN_IMAGE parameter value to maven:3.6.3-adoptopenjdk-11.

  Tip

  Before you install tasks that are based on the Tekton Catalog on ARM, IBM Power Systems (ppc64le), IBM Z, and LinuxONE (s390x) using tkn hub, verify if the task can be executed on these platforms. To check if ppc64le and s390x are listed in the "Platforms" section of the task information, you can run the following command: tkn hub info task <name>

• On IBM Power Systems, IBM Z, and LinuxONE, the s2i-dotnet cluster task is unsupported.

• You cannot use the nodejs:14-ubi8-minimal image stream because doing so generates the following errors:

  STEP 7: RUN /usr/libexec/s2i/assemble
  /bin/sh: /usr/libexec/s2i/assemble: No such file or directory
  subprocess exited with status 127
  subprocess exited with status 127
  error building at STEP "RUN /usr/libexec/s2i/assemble": exit status 127
  time="2021-11-04T13:05:26Z" level=error msg="exit status 127"

• Implicit parameter mapping incorrectly passes parameters from the top-level Pipeline or PipelineRun definitions to the taskRef tasks. Mapping should only occur from a top-level resource to tasks with in-line taskSpec specifications. This issue only affects clusters where this feature was enabled by setting the enable-api-fields field to alpha in the pipeline section of the TektonConfig custom resource definition.

• With this update, if metadata such as labels and annotations are present in both Pipeline and PipelineRun object definitions, the values in the PipelineRun type takes precedence. You can observe similar behavior for Task and TaskRun objects.
• With this update, if the timeouts.tasks field or the timeouts.finally field is set to 0, then the timeouts.pipeline is also set to 0.
• With this update, the -x set flag is removed from scripts that do not use a shebang. The fix reduces potential data leak from script execution.
• With this update, any backslash character present in the usernames in Git credentials is escaped with an additional backslash in the .gitconfig file.

• With this update, the finalizer property of the EventListener object is not necessary for cleaning up logging and config maps.
• With this update, the default HTTP client associated with the event listener server is removed, and a custom HTTP client added. As a result, the timeouts have improved.
• With this update, the Triggers cluster role now works with owner references.
• With this update, the race condition in the event listener does not happen when multiple interceptors return extensions.

• With this update, the tkn pr delete command does not delete the pipeline runs with the ignore-running flag.

• With this update, the Operator pods do not continue restarting when you modify any add-on parameters.
• With this update, the tkn serve CLI pod is scheduled on infra nodes, if not configured in the subscription and config custom resources.
• With this update, cluster tasks with specified versions are not deleted during upgrade.

• With this update, you can configure a pipeline or task start command to return a YAML or JSON-formatted string by using the --output <string>, where <string> is yaml or json. Otherwise, without the --output option, the start command returns a human-friendly message that is hard for other programs to parse. Returning a YAML or JSON-formatted string is useful for continuous integration (CI) environments. For example, after a resource is created, you can use yq or jq to parse the YAML or JSON-formatted message about the resource and wait until that resource is terminated without using the showlog option.
• With this update, you can authenticate to a registry using the auth.json authentication file of Podman. For example, you can use tkn bundle push to push to a remote registry using Podman instead of Docker CLI.
• With this update, if you use the tkn [taskrun | pipelinerun] delete --all command, you can preserve runs that are younger than a specified number of minutes by using the new --keep-since <minutes> option. For example, to keep runs that are less than five minutes old, you enter tkn [taskrun | pipelinerun] delete -all --keep-since 5.
• With this update, when you delete task runs or pipeline runs, you can use the --parent-resource and --keep-since options together. For example, the tkn pipelinerun delete --pipeline pipelinename --keep-since 5 command preserves pipeline runs whose parent resource is named pipelinename and whose age is five minutes or less. The tkn tr delete -t <taskname> --keep-since 5 and tkn tr delete --clustertask <taskname> --keep-since 5 commands work similarly for task runs.
• This update adds support for the triggers resources to work with v1beta1 resources.

• This update adds an ignore-running option to the tkn pipelinerun delete and tkn taskrun delete commands.
• This update adds a create subcommand to the tkn task and tkn clustertask commands.
• With this update, when you use the tkn pipelinerun delete --all command, you can use the new --label <string> option to filter the pipeline runs by label. Optionally, you can use the --label option with = and == as equality operators, or != as an inequality operator. For example, the tkn pipelinerun delete --all --label asdf and tkn pipelinerun delete --all --label==asdf commands both delete all the pipeline runs that have the asdf label.
• With this update, you can fetch the version of installed Tekton components from the config map or, if the config map is not present, from the deployment controller.

• With this update, triggers support the feature-flags and config-defaults config map to configure feature flags and to set default values respectively.
• This update adds a new metric, eventlistener_event_count, that you can use to count events received by the EventListener resource.

• This update adds v1beta1 Go API types. With this update, triggers now support the v1beta1 API version.

  With the current release, the v1alpha1 features are now deprecated and will be removed in a future release. Begin using the v1beta1 features instead.

• In the current release, auto-prunning of resources is enabled by default. In addition, you can configure auto-prunning of task run and pipeline run for each namespace separately, by using the following new annotations:

  • operator.tekton.dev/prune.schedule: If the value of this annotation is different from the value specified at the TektonConfig custom resource definition, a new cron job in that namespace is created.
  • operator.tekton.dev/prune.skip: When set to true, the namespace for which it is configured will not be prunned.
  • operator.tekton.dev/prune.resources: This annotation accepts a comma-separated list of resources. To prune a single resource such as a pipeline run, set this annotation to "pipelinerun". To prune multiple resources, such as task run and pipeline run, set this annotation to "taskrun, pipelinerun".
  • operator.tekton.dev/prune.keep: Use this annotation to retain a resource without prunning.

  • operator.tekton.dev/prune.keep-since: Use this annotation to retain resources based on their age. The value for this annotation must be equal to the age of the resource in minutes. For example, to retain resources which were created not more than five days ago, set keep-since to 7200.

    Note

    The keep and keep-since annotations are mutually exclusive. For any resource, you must configure only one of them.

  • operator.tekton.dev/prune.strategy: Set the value of this annotation to either keep or keep-since.
• Administrators can disable the creation of the pipeline service account for the entire cluster, and prevent privilege escalation by misusing the associated SCC, which is very similar to anyuid.
• You can now configure feature flags and components by using the TektonConfig custom resource (CR) and the CRs for individual components, such as TektonPipeline and TektonTriggers. This level of granularity helps customize and test alpha features such as the Tekton OCI bundle for individual components.
• You can now configure optional Timeouts field for the PipelineRun resource. For example, you can configure timeouts separately for a pipeline run, each task run, and the finally tasks.
• The pods generated by the TaskRun resource now sets the activeDeadlineSeconds field of the pods. This enables OpenShift to consider them as terminating, and allows you to use specifically scoped ResourceQuota object for the pods.
• You can use configmaps to eliminate metrics tags or labels type on a task run, pipeline run, task, and pipeline. In addition, you can configure different types of metrics for measuring duration, such as a histogram, gauge, or last value.
• You can define requests and limits on a pod coherently, as Tekton now fully supports the LimitRange object by considering the Min, Max, Default, and DefaultRequest fields.

• The following alpha features are introduced:

  • A pipeline run can now stop after running the finally tasks, rather than the previous behavior of stopping the execution of all task run directly. This update adds the following spec.status values:

    • StoppedRunFinally will stop the currently running tasks after they are completed, and then run the finally tasks.
    • CancelledRunFinally will immediately cancel the running tasks, and then run the finally tasks.

    • Cancelled will retain the previous behavior provided by the PipelineRunCancelled status.

      Note

      The Cancelled status replaces the deprecated PipelineRunCancelled status, which will be removed in the v1 version.

  • You can now use the oc debug command to put a task run into debug mode, which pauses the execution and allows you to inspect specific steps in a pod.
  • When you set the onError field of a step to continue, the exit code for the step is recorded and passed on to subsequent steps. However, the task run does not fail and the execution of the rest of the steps in the task continues. To retain the existing behavior, you can set the value of the onError field to stopAndFail.
  • Tasks can now accept more parameters than are actually used. When the alpha feature flag is enabled, the parameters can implicitly propagate to inlined specs. For example, an inlined task can access parameters of its parent pipeline run, without explicitly defining each parameter for the task.
  • If you enable the flag for the alpha features, the conditions under When expressions will only apply to the task with which it is directly associated, and not the dependents of the task. To apply the When expressions to the associated task and its dependents, you must associate the expression with each dependent task separately. Note that, going forward, this will be the default behavior of the When expressions in any new API versions of Tekton. The existing default behavior will be deprecated in favor of this update.

• The current release enables you to configure node selection by specifying the nodeSelector and tolerations values in the TektonConfig custom resource (CR). The Operator adds these values to all the deployments that it creates.

  • To configure node selection for the Operator’s controller and webhook deployment, you edit the config.nodeSelector and config.tolerations fields in the specification for the Subscription CR, after installing the Operator.
  • To deploy the rest of the control plane pods of OpenShift Pipelines on an infrastructure node, update the TektonConfig CR with the nodeSelector and tolerations fields. The modifications are then applied to all the pods created by Operator.