github tektoncd/operator v0.81.0
Tekton Operator release v0.81.0 "Release v0.81.0"
on GitHub

latest release: tekton-operator-0.81.0
5 hours ago

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac

Obtain the attestation: 

REKOR_UUID=108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file: 

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.0/release.yaml
REKOR_UUID=108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.81.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

  • ✨ feat(chains): expose storage.oci.encoding-format in CRD (#3871)

expose storage.oci.encoding-format config key in TektonChain and TektonConfig CRDs — allows configuring OCI 1.1 Referrers API storage via the operator

  • ✨ feat(common): support rollout strategy in options (#3813)

options now applies deployments[].spec.strategy and
statefulSets[].spec.updateStrategy to the generated workloads instead of
ignoring them. This makes it possible to set, for example,
rollingUpdate.maxSurge: 0 on a component whose replicas are pinned
one-per-node by anti-affinity, where the default surge-based rollout cannot
schedule the extra pod.

  • ✨ feat(pruner): add NetworkPolicy for controller and webhook (#3795)

TektonPruner gains a spec.networkPolicy field so its controller and webhook default-deny and allow policies can be reconciled, overridden, or disabled per component. The field is propagated from TektonConfig.

  • ✨ feat(tektonpipeline): add NetworkPolicy for pipeline core components (#3758)

TektonPipeline now ships default NetworkPolicy resources for pipeline-controller, pipeline-webhook, pipeline-events-controller, and pipeline-resolvers pods, restricting network access to
only DNS, API server, Prometheus metrics, and webhook traffic. Resolvers additionally allow HTTP/HTTPS and SSH egress for git, bundle, hub, and http resolver types.

  • ✨ feat: add NetworkPolicy support for operator and proxy-webhook (#3714)

Tekton Operator now ships default NetworkPolicy resources restricting network access for its own controller and proxy-webhook pods to only DNS, Kubernetes API server, Prometheus metrics, and webhook traffic. TektonPipeline also gains a spec.networkPolicy field (mirroring TektonTrigger) so its proxy-webhook's default-deny and allow policies can be reconciled, overridden, or disabled per component.

  • ✨ feat(results): expose Tekton Results Watcher config via TektonConfig (#3709)

TektonConfig and TektonResult now support spec.result.watcher to configure Tekton Results Watcher behavior (for example completed_run_grace_period, check_owner, store_deadline, and disable_storing_incomplete_runs) without manually editing the tekton-results-watcher Deployment.

  • ✨ Add networkpolicies RBAC to operator bundle CSVs (#3764)

Fixes

  • 🐛 [cherry-pick: release-v0.81.x] fix(release): bump pinned ko/koparse images for go 1.26.5 (#3886)

Fix patch release pipeline failures caused by Go 1.26.5 requirement
mismatch in pinned ko/koparse images.

  • 🐛 fix(rbac): add bind/escalate verbs for k8s install (#3739)

Fix missing RBAC permissions in the Kubernetes Helm chart and install
manifests that prevented the operator from installing Pipelines-as-Code
on Kubernetes.

  • 🐛 fix(common): apply proxy settings to StatefulSets too (#3710)

Fix StatefulSet pods (used when statefulset-ordinals is enabled) not
inheriting cluster-wide proxy environment variables.

  • 🐛 fix(release): resolve in-toto attestation UUID in wait-for-chains (#3859)
  • 🐛 fix(common): propagate config to StatefulSets too (#3846)
  • 🐛 fix(deps): bump sigstore-go with knative.dev/pkg semconv alignment (#3785)

Misc

  • 🔨 add NetworkPolicy for MultiCluster Components (#3839)

Add NetworkPolicy support for TektonScheduler, TektonMulticlusterProxyAAE, and SyncerService components, giving each a default-deny policy plus targeted allow rules for required traffic.

  • 🔨 feat(tektonresult): add NetworkPolicy support for Results (#3808)

Add NetworkPolicy support for Tekton Results. Default policies for Results API, watcher, retention-policy-agent, and postgres are reconciled from TektonConfig.spec.networkPolicy (enabled by default; set disabled: true to remove them).

  • 🔨 feat(manualapprovalgate): add NetworkPolicy support (#3801)

ManualApprovalGate now creates default NetworkPolicies that restrict ingress/egress for its controller and webhook pods. These are enabled by default. To opt out, set spec.networkPolicy.disabled: true on the ManualApprovalGate CR.

  • 🔨 feat(pruner): add NetworkPolicy for controller and webhook (#3795)

TektonPruner gains a spec.networkPolicy field so its controller and webhook default-deny and allow policies can be reconciled, overridden, or disabled per component. The field is propagated from TektonConfig.

  • 🔨 feat(tektonconfig): add NetworkPolicy for console plugin (#3765)

The OpenShift Pipelines console plugin now ships default NetworkPolicy resources restricting ingress to only the OpenShift Console on port 8443. The plugin is a static file server with no
egress required.

  • 🔨 chore(deps): bump the github-actions group with 5 updates (#3852)
  • 🔨 chore(deps): bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 (#3844)
  • 🔨 chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 (#3826)
  • 🔨 chore(deps): bump the github-actions group with 5 updates (#3820)
  • 🔨 chore(deps): bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (#3818)
  • 🔨 chore(deps): bump k8s.io/api from 0.35.6 to 0.35.7 (#3816)
  • 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.14.0 to 1.14.1 (#3815)
  • 🔨 chore(deps): bump k8s.io/apiextensions-apiserver from 0.35.6 to 0.35.7 (#3814)
  • 🔨 chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#3804)
  • 🔨 chore(deps): bump the github-actions group across 1 directory with 5 updates (#3794)
  • 🔨 Ignore otel major/minor updates in dependabot (#3792)
  • 🔨 chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 (#3767)
  • 🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#3766)
  • 🔨 chore(deps): bump github.com/openshift-pipelines/pipelines-as-code from 0.48.0 to 0.49.0 (#3712)
  • 🔨 chore(deps): bump the github-actions group with 4 updates (#3708)
  • 🔨 chore(deps): bump github.com/tektoncd/pruner from 0.4.0 to 0.4.1 (#3706)
  • 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.14.0 (#3705)
  • 🔨 chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#3702)
  • 🔨 chore(deps): bump the github-actions group with 3 updates (#3667)
  • 🔨 chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 (#3645)
  • 🔨 chore(deps): bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#3644)
  • 🔨 chore(deps): bump the github-actions group with 6 updates (#3634)
  • 🔨 chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.20.3 (#3593)
  • 🔨 chore(deps): bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#3583)
  • 🔨 ci(dependabot): remove unsupported cooldown fields from github-actions (#3530)
  • 🔨 chore(deps): bump chainguard-dev/actions from 1.6.22 to 1.6.23 (#3527)
  • 🔨 chore(deps): bump k8s.io/code-generator from 0.35.5 to 0.35.6 (#3525)
  • 🔨 chore(deps): bump k8s.io/api from 0.35.5 to 0.35.6 (#3524)
  • 🔨 chore(deps): bump k8s.io/apiextensions-apiserver from 0.35.5 to 0.35.6 (#3523)
  • 🔨 Regenerate dependabot.yml configuration (#3517)

Docs

Thanks

Thanks to these contributors who contributed to v0.81.0!

Extra shout-out for awesome release notes:

Check out latest releases or
releases around tektoncd/operator v0.81.0

Don't miss a new operator release

NewReleases is sending notifications on new releases.

Get notifications