Chapter 1. Red Hat OpenShift Pipelines release notes

With this update, when incorporating a step from another custom resource (CR) using a stepRef: section, you can use parameters in the same way that you use parameters in taskRef: and pipelineRef: sections.

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: test-task
spec:
  steps:
  - name: fetch-repository
    stepRef:
      resolver: git
      params:
      - name: url
        value: https://github.com/tektoncd/catalog.git
      - name: revision
        value: main
      - name: pathInRepo
        value: stepaction/git-clone/0.1/git-clone
    params:
    - name: url
      value: $(params.repo-url)
    - name: revision
      value: $(params.tag-name)
    - name: output-path
      value: $(workspaces.output.path)

With this update, when specifying the use of a workspace in a pipeline run or task run, you can use parameters and other variables in the specification in the secret, configMap, and projected.sources sections.

apiVersion: tekton.dev/v1
kind: Task
metadata:
  generateName: something-
spec:
  params:
  - name: myWorkspaceSecret
  steps:
  - image: registry.redhat.io/ubi/ubi8-minimal:latest
    script: |
      echo “Hello World”
  workspaces:
  - name: myworkspace
    secret:
      secretName: $(params.myWorkspaceSecret)

By default, when OpenShift Pipelines fails to pull the container image that is required for the execution of a task, the task fails. With this release, you can configure an image pull backoff timeout. If you configure this timeout, when OpenShift Pipelines fails to pull the container image that is required for the execution of a task, it continues to attempt to pull the image for the specified time period. The task fails if OpenShift Pipelines is unable to pull the image within the specified period.

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    options:
      configMaps:
          config-defaults:
              data:
                   default-imagepullbackoff-timeout: "5m"

With this update, the YAML manifest of every step in a completed TaskRun CR includes a new terminationReason field. This field contains the reason the step execution ended. OpenShift Pipelines uses the following values for the terminationReason field:

With this update, several tasks are added to the openshift-pipelines namespace in the resolverTasks add-on. You can incorporate these tasks in your pipelines using the cluster resolver. Most of these tasks were previously available as cluster tasks (ClusterTask resources). You can access the following tasks by using the cluster resolver:

With this update, you can use the TriggerTemplate CR to specify templates for any types of resources. When the trigger is invoked, OpenShift Pipelines creates the resources that you define in the TriggerTemplate CR for the trigger. In the following example, a ConfigMap resource is created when the trigger is invoked:

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: create-configmap-template
spec:
  params:
    - name: action
  resourcetemplates:
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        generateName: sample-
      data:
        field: "Action is : $(tt.params.action)"

With this update, you can define the ServiceType in an EventListener CR as NodePort and define the port number for the event listener, as shown in the following example:

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: simple-eventlistener
spec:
  serviceAccountName:  simple-tekton-robot
  triggers:
    - name: simple-trigger
      bindings:
      - ref: simple-binding
      template:
        ref: simple-template
  resources:
    kubernetesResource:
      serviceType: NodePort
      servicePort: 38080

With this update, if you use a serviceType value of LoadBalancer in an EventListener CR, you can optionally specify a load balancer class in the serviceLoadBalancerClass field. If your cluster provides multiple load balancer controllers, you can use the load balancer class to select one of these controllers. For more information about setting a load balancer class, see the Kubernetes documentation.

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: listener-loadbalancerclass
spec:
  serviceAccountName: tekton-triggers-example-sa
  triggers:
    - name: example-trig
      bindings:
        - ref: pipeline-binding
        - ref: message-binding
      template:
        ref: pipeline-template
  resources:
    kubernetesResource:
      serviceType: LoadBalancer
      serviceLoadBalancerClass: private

You must set the following parameters in the ApprovalTask specification:

The manual approval gate supports approval from multiple users:

With this update, when providing a /test or /retest command for Pipelines as Code in a Git request comment, you can now set any standard or custom parameters for the pipeline run.

/test pipelinerun1 revision=main param1="value1" param2="value \"value2\" with quotes"

This command runs the pipelinerun1 pipeline run on the main branch instead of the pull request branch.

/test checker target_branch=backport-branch

This command runs the checker pipeline run on a backport (cherry-pick) of the pull request to the backport-branch branch.

Tekton Results uses an UpdateLog operation to store logging information in the database. With this update, you can use the TektonResult CR to specify a timeout value for this operation. If the operation does not complete within the specified time period, Tekton Results ends the operation.

apiVersion: operator.tekton.dev/v1
kind: TektonResult
metadata:
  name: result
spec:
     options:
        deployments:
           tekton-results-watcher:
              spec:
                  template:
                     spec:
                        containers:
                        - name: watcher
                          args:
                          - "--updateLogTimeout=60s"

With this update, when configuring Tekton Results, you can optionally specify the following database configuration settings in the options.configMaps.tekton-results-api-config.data.config section of the TektonResult CR:

With this update, you can use the HTTP resolver to fetch a pipeline or task from an HTTP URL, as shown in the following examples:

apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: remote-task-reference
spec:
  taskRef:
    resolver: http
    params:
    - name: url
      value: https://raw.githubusercontent.com/tektoncd-catalog/git-clone/main/task/git-clone/git-clone.yaml

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: http-demo
spec:
  pipelineRef:
    resolver: http
    params:
    - name: url
      value: https://raw.githubusercontent.com/tektoncd/catalog/main/pipeline/build-push-gke-deploy/0.1/build-push-gke-deploy.yaml

With this update, you can use an enum declaration to limit the values that you can supply for a parameter of a pipeline or task, as shown in the following example. To use this feature, you must set the pipeline.options.configMaps.feature-flags.data.enable-param-enum spec in the TektonConfig CR to true.

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: pipeline-param-enum
spec:
  params:
  - name: message
    enum: ["v1", "v2"]
    default: "v1"
# ...

With this update, when using the Git resolver with the authenticated source control management (SCM) API, you can override the default token, SCM type, and server URL that you configured. See the following example:

apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  name: git-api-demo-tr
spec:
  taskRef:
    resolver: git
    params:
    - name: org
      value: tektoncd
    - name: repo
      value: catalog
    - name: revision
      value: main
    - name: pathInRepo
      value: task/git-clone/0.6/git-clone.yaml
    # create the my-secret-token secret in the namespace where the
    # pipelinerun is created. The secret must  contain a GitHub personal access
    # token in the token key of the secret.
    - name: token
      value: my-secret-token
    - name: tokenKey
      value: token
    - name: scmType
      value: github
    - name: serverURL
      value: https://ghe.mycompany.com

With this update, you can optionally set the following flags in the spec.pipeline spec of the TektonConfig CR:

With this update, when specifying CEL expressions for the Triggers interceptor, you can use the translate function that facilitates the utilization of regular expressions to replace characters with specified strings, as in the following example:

".translate("[^a-z0-9]+", "ABC")

This is $an Invalid5String

ABChisABCisABCanABCnvalid5ABCtring

With this update, you can enable the web console plugin for OpenShift Pipelines. If you enable the plugin, you can view pipeline and task execution statistics in the Pipelines overview page and in the page of a pipeline. You must install Tekton Results to view this information.

With this update, when specifying the conditions for executing a pipeline run using a CEL expression with pipelinesascode.tekton.dev/on-cel-expression , you can check for existence of files in the Git repository:

With this update, you can optionally specify a custom CA certificate in the options.configMaps.tekton-results-api-config.data.config.DB_SSLROOTCERT spec in the TektonResult CR. In this case, Tekton Results requires an SSL connection to the database server and uses this certificate for the connection. If you want to use this setting, when configuring Tekton Results you must also use alternate specs for several other configuration parameters, as listed in the following table. Both the regular and the alternate parameter specs are in the TektonResult CR.

For the configuration parameters not listed in this table, use the regular specs as described in the documentation.

With this update, when specifying a pipeline in a PipelineRun CR spec, you can reference the results produced by an inline task in a subsequent inline task.

  apiVersion: tekton.dev/v1
  kind: Task
  metadata:
    name: uid-task
  spec:
    results:
      - name: uid
    steps:
      - name: uid
        image: alpine
        command: ["/bin/sh", "-c"]
        args:
          - echo "1001" | tee $(results.uid.path)
  ---
  apiVersion: tekton.dev/v1
  kind: PipelineRun
  metadata:
    name: uid-pipeline-run
  spec:
    pipelineSpec:
      tasks:
      - name: add-uid
        taskRef:
          name: uid-task
      - name: show-uid
        taskSpec:
          steps:
            - name: show-uid
              image: alpine
              command: ["/bin/sh", "-c"]
              args:
                - echo $(tasks.add-uid.results.uid)

With this update, the disable-affinity-assistant feature flag has been deprecated and might be removed in a future release. Instead, in the TektonConfig CR, you can set the pipeline.options.configMaps.feature-flags.data.coschedule spec to one of the following values:

With this update, in Pipelines as Code, when using a CEL expression for advanced event matching (pipelinesascode.tekton.dev/on-cel-expression), you can use the header and body fields to access the full payload that is passed by the Git repository provider body. You can use this feature to filter events by any information that the Git repository sends.

With this update, when using Pipelines as Code, you can use remote tasks on remote pipelines. Therefore, you can reuse a complete remote pipeline across multiple repositories. You can override tasks from the remote pipeline by adding a task with the same name.

With this update, you can use the source_url variable in a pipeline run template to retrieve information about the forked repository from where the event, such as a pull or push request, is triggered.

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
# ...
spec:
  params:
    - name: source_url
      value: "{{ source_url }}"
  pipelineSpec:
    params:
      - name: source_url
# ...

With this update, you can replace parameters, results, and the context of a pipeline task while configuring a matrix as per the following guidelines:

This update adds a new tkn pac info command to the Pipelines as Code CLI. As an administrator, you can use the tkn pac info command to obtain the following details about the Pipelines as Code installation:

With this update, you can extend the scope of the GitHub token at the following levels:

With this update, custom tasks in pipelines are enabled by default.

This update adds support for the PipelineRun reconciler to create a custom run. For example, custom TaskRuns created from PipelineRuns can now use the v1beta1.CustomRun API version instead of v1alpha1.Run, if the custom-task-version feature flag is set to v1beta1, instead of the default value v1alpha1.

With this update, GitHub Interceptor blocks a pull request trigger from being executed unless invoked by an owner or with a configurable comment by an owner.

This update supports validation and rotation of certificates for the ClusterInterceptor server. 

This update introduces a new CLI tool called opc. It is anticipated that an upcoming release will replace the tkn CLI tool with opc.

With this update, Pipelines as Code is installed by default. You can disable Pipelines as Code by using the -p flag:

$ oc patch tektonconfig config --type="merge" -p '{"spec": {"platforms": {"openshift":{"pipelinesAsCode": {"enable": false}}}}}'

With this update, you can configure pipeline resolvers in the TektonConfig CRD. You can enable or disable these pipeline resolvers:  enable-bundles-resolver, enable-cluster-resolver, enable-git-resolver, and enable-hub-resolver.

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    enable-bundles-resolver: true
    enable-cluster-resolver: true
    enable-git-resolver: true
    enable-hub-resolver: true
...

You can also provide resolver specific configurations in TektonConfig. For example, you can define the following fields in the map[string]string format to set configurations for individual resolvers:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    bundles-resolver-config:
      default-service-account: pipelines
    cluster-resolver-config:
      default-namespace: test
    git-resolver-config:
      server-url: localhost.com
    hub-resolver-config:
      default-tekton-hub-catalog: tekton
...

With this update, as an administrator, you can use an external database, such as Crunchy PostgreSQL with Tekton Hub, instead of using the default Tekton Hub database. This update helps you to perform the following actions:

This update removes the dependency of config.yaml from external Git repositories and moves the complete configuration data into the API ConfigMap. This update helps an administrator to perform the following actions:

This update supports advanced event matching on file path for push and pull requests to GitHub and GitLab. For example, you can use the Common Expression Language (CEL) to run a pipeline only if a path has changed for any markdown file in the docs directory.

  ...
  annotations:
     pipelinesascode.tekton.dev/on-cel-expression: |
      event == "pull_request" && "docs/*.md".pathChanged()

This update provides the following enhancements for the tkn-pac plugin:

This update adds the following new commands:

Before this update, the GitHub apps token scoping was not defined and tokens would be used on every repository installation. With this update, you can scope the GitHub apps token to the target repository using the following parameters:

This update adds minimal TaskRun and Run statuses within PipelineRun statuses.

To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

With this update, the graceful termination of pipeline runs feature is promoted from an alpha feature to a stable feature. As a result, the previously deprecated PipelineRunCancelled status remains deprecated and is planned to be removed in a future release.

Because this feature is available by default, you no longer need to set the pipeline.enable-api-fields field to alpha in the TektonConfig custom resource definition.

With this update, you can specify the workspace for a pipeline task by using the name of the workspace. This change makes it easier to specify a shared workspace for a pair of Pipeline and PipelineTask resources. You can also continue to map workspaces explicitly.

To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

This update supports an alpha feature in which you can use an array type for emitting results from a Task object. The result type is changed from string to ArrayOrString. For example, a task can specify a type to produce an array result:

kind: Task
apiVersion: tekton.dev/v1beta1
metadata:
  name: write-array
  annotations:
    description: |
      A simple task that writes array
spec:
  results:
    - name: array-results
      type: array
      description: The array results
...

Additionally, you can run a task script to populate the results with an array:

$ echo -n "[\"hello\",\"world\"]" | tee $(results.array-results.path)

To enable this feature, in the TektonConfig custom resource definition, in the pipeline section, you must set the enable-api-fields field to alpha.

This feature is in progress and is part of TEP-0076.

This update transitions the TriggerGroups field in the EventListener specification from an alpha feature to a stable feature. Using this field, you can specify a set of interceptors before selecting and running a group of triggers.

Because this feature is available by default, you no longer need to set the pipeline.enable-api-fields field to alpha in the TektonConfig custom resource definition.

With this update, as a cluster administrator, if you enable your local Tekton Hub instance, it periodically refreshes the database so that changes in the catalog appear in the Tekton Hub web console. You can adjust the period between refreshes.

Previously, to add the tasks and pipelines in the catalog to the database, you performed that task manually or set up a cron job to do it for you.

With this update, if you install a fresh instance of Tekton Hub by using the Operator, the Tekton Hub login is disabled by default. To enable the login and rating features, you must create the Hub API secret while installing Tekton Hub.

With this update, as an administrator, you can configure your local Tekton Hub instance to use a custom PostgreSQL 13 database rather than the default database. To do so, create a Secret resource named tekton-hub-db. For example:

apiVersion: v1
kind: Secret
metadata:
  name: tekton-hub-db
  labels:
    app: tekton-hub-db
type: Opaque
stringData:
  POSTGRES_HOST: <hostname>
  POSTGRES_DB: <database_name>
  POSTGRES_USER: <username>
  POSTGRES_PASSWORD: <password>
  POSTGRES_PORT: <listening_port_number>

With this update, Pipelines as Code supports GitLab integration with features such as the following:

With this update, you can perform advanced pipeline filtering with Common Expression Language (CEL). With CEL, you can match pipeline runs with different Git provider events by using annotations in the PipelineRun resource. For example:

  ...
  annotations:
     pipelinesascode.tekton.dev/on-cel-expression: |
      event == "pull_request" && target_branch == "main" && source_branch == "wip"

By default, the containers have restricted permissions for enhanced security. The restricted permissions apply to all controller pods in the Red Hat OpenShift Pipelines Operator, and to some cluster tasks. Due to restricted permissions, the git-clone cluster task fails under certain configurations.

Workaround: None. You can track the issue SRVKP-2634.

When installer sets are in a failed state, the status of the TektonConfig custom resource is incorrectly displayed as True instead of False.

$ oc get tektoninstallerset
NAME                                     READY   REASON
addon-clustertasks-nx5xz                 False   Error
addon-communityclustertasks-cfb2p        True
addon-consolecli-ftrb8                   True
addon-openshift-67dj2                    True
addon-pac-cf7pz                          True
addon-pipelines-fvllm                    True
addon-triggers-b2wtt                     True
addon-versioned-clustertasks-1-8-hqhnw   False   Error
pipeline-w75ww                           True
postpipeline-lrs22                       True
prepipeline-ldlhw                        True
rhosp-rbac-4dmgb                         True
trigger-hfg64                            True
validating-mutating-webhoook-28rf7       True

$ oc get tektonconfig config
NAME     VERSION   READY   REASON
config   1.8.1     True

With this update, pipelines-<version> is the default channel to install the Red Hat OpenShift Pipelines Operator. For example, the default channel to install the OpenShift Pipelines Operator version 1.7 is pipelines-1.7. Cluster administrators can also use the latest channel to install the most recent stable version of the Operator.

When you run a command in a user namespace, your container runs as root (user id 0) but has user privileges on the host. With this update, to run pods in the user namespace, you must pass the annotations that CRI-O expects.

Before this update, if certain conditions were not met, the when expression skipped a Task object and its dependent tasks. With this update, you can scope the when expression to guard the Task object only, not its dependent tasks. To enable this update, set the scope-when-expressions-to-task flag to true in the TektonConfig CRD.

With this update, you can reference parameters and results by using a bracket notation with single or double quotes. Prior to this update, you could only use the dot notation. For example, the following are now equivalent:

With this update, the tkn [pipeline | pipelinerun] export command exports a pipeline or pipeline run as a YAML file. For example:

This update adds the Operator and Chains versions to the output of the tkn version command.

With this update, you can use the tkn chains command to manage Tekton Chains. You can also use the --chains-namespace option to specify the namespace where you want to install Tekton Chains.

With this update, you can use the Red Hat OpenShift Pipelines Operator to install and deploy Tekton Hub and Tekton Chains.

With this update, you can find and use Pipelines as Code (PAC) as an add-on option.

With this update, you can now disable the installation of community cluster tasks by setting the communityClusterTasks parameter to false. For example:

...
spec:
  profile: all
  targetNamespace: openshift-pipelines
  addon:
    params:
    - name: clusterTasks
      value: "true"
    - name: pipelineTemplates
      value: "true"
    - name: communityClusterTasks
      value: "false"
...

With this update, you can disable the integration of Tekton Hub with the Developer perspective by setting the enable-devconsole-integration flag in the TektonConfig custom resource to false. For example:

...
hub:
  params:
    - name: enable-devconsole-integration
      value: "true"
...

Before this update, installation of the Red Hat OpenShift Pipelines Operator on OpenShift Container Platform 4.9 and 4.10 failed due to invalid role binding, with the following error message:

error updating rolebinding openshift-operators-prometheus-k8s-read-binding: RoleBinding.rbac.authorization.k8s.io "openshift-operators-prometheus-k8s-read-binding" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"openshift-operator-read"}: cannot change roleRef

With this update, the Red Hat OpenShift Pipelines Operator installs with distinct role binding namespaces to avoid conflict with installation of other Operators.

Before this update, upgrading the Operator triggered a reset of the signing-secrets secret key for Tekton Chains to its default value. With this update, the custom secret key persists after you upgrade the Operator.

Before this update, all S2I build tasks failed with an error similar to the following message:

Error: error writing "0 0 4294967295\n" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted
time="2022-03-04T09:47:57Z" level=error msg="error writing \"0 0 4294967295\\n\" to /proc/22/uid_map: write /proc/22/uid_map: operation not permitted"
time="2022-03-04T09:47:57Z" level=error msg="(unable to determine exit status)"

With this update, the pipelines-scc security context constraint (SCC) is compatible with the SETFCAP capability necessary for Buildah and S2I cluster tasks. As a result, the Buildah and S2I build tasks can run successfully.

To successfully run the Buildah cluster task and S2I build tasks for applications written in various languages and frameworks, add the following snippet for appropriate steps objects such as build and push:

securityContext:
  capabilities:
    add: ["SETFCAP"]

After upgrading to Red Hat OpenShift Pipelines 1.6.1 from an older version, OpenShift Pipelines might enter an inconsistent state where you are unable to perform any operations (create/delete/apply) on Tekton resources (tasks and pipelines). For example, while deleting a resource, you might encounter the following error:

Error from server (InternalError): Internal error occurred: failed calling webhook "validation.webhook.pipeline.tekton.dev": Post "https://tekton-pipelines-webhook.openshift-pipelines.svc:443/resource-validation?timeout=10s": service "tekton-pipelines-webhook" not found.

The SSL_CERT_DIR environment variable (/tekton-custom-certs) set by Red Hat OpenShift Pipelines will not override the following default system directories with certificate files:

The upstream version of Tekton Pipelines is revised to v0.28.3, which has the following fixes:

Before this update, the Red Hat OpenShift Pipelines Operator installed pod security policies from components such as Pipelines and Triggers. However, the pod security policies shipped as part of the components were deprecated in an earlier release. With this update, the Operator stops installing pod security policies from components. As a result, the following upgrade paths are affected:

After upgrading from Red Hat OpenShift Pipelines 1.5.2 to 1.6.4, accessing the event listener routes returns a 503 error.

Workaround: Modify the target port in the YAML file for the event listener’s route.

This release of Red Hat OpenShift Pipelines adds support for a disconnected installation.

The tkn task describe, tkn taskrun describe, tkn clustertask describe, tkn pipeline describe, and tkn pipelinerun describe commands now:

The following fields have been added to the EventListener object:

Workspace support for volume claim templates has been added:

Support for improving audits:

Support for emitting Kubernetes events:

The following Common Expression Language (CEL) functions are now available:

The following commands can now list output from all namespaces using the --all-namespaces flag option: tkn task list, tkn pipeline list, tkn taskrun list, tkn pipelinerun list

The output of these commands is also enhanced to display information without headers using the --no-headers flag option.