From d25fef8174e7f3806e6eb33f5741c8573827a2a4 Mon Sep 17 00:00:00 2001 From: Rohit Parmar Date: Thu, 13 Aug 2026 12:02:57 +0530 Subject: [PATCH 1/5] [RHDEVDOCS-7794] Fix DITA structural issues for AEM migration readiness --- modules/op-about-multicluster-support.adoc | 7 +- ...icating-pipelines-repos-using-secrets.adoc | 2 +- ...figuring-cosign-for-sbom-verification.adoc | 84 +++++++++++++++++++ ...t-ssh-authentication-using-workspaces.adoc | 3 +- .../op-configuring-gitops-command-prefix.adoc | 2 +- ...p-creating-pipeline-runs-multicluster.adoc | 13 +-- modules/op-downloading-an-sbom.adoc | 33 ++++++++ ...ulticluster-kueue-resources-reference.adoc | 32 ++++--- modules/op-multicluster-limitations.adoc | 29 +++---- modules/op-reading-the-sbom.adoc | 54 ++++++++++++ modules/op-resolver-bundle.adoc | 12 +-- modules/op-resolver-cluster.adoc | 12 +-- modules/op-resolver-git-anon.adoc | 12 +-- modules/op-resolver-git-scm.adoc | 12 +-- modules/op-resolver-http.adoc | 12 +-- modules/op-resolver-hub.adoc | 16 ++-- modules/op-results-opc-pipelinerunlist.adoc | 4 +- .../op-specifying-manual-approval-task.adoc | 12 +-- ...p-troubleshooting-task-params-changed.adoc | 2 +- modules/op-verify-clustertask-migration.adoc | 3 +- modules/op-viewing-an-sbom.adoc | 25 ++++++ ...ftware-supply-chain-security-elements.adoc | 8 +- 22 files changed, 293 insertions(+), 96 deletions(-) create mode 100644 modules/op-configuring-cosign-for-sbom-verification.adoc create mode 100644 modules/op-downloading-an-sbom.adoc create mode 100644 modules/op-reading-the-sbom.adoc create mode 100644 modules/op-viewing-an-sbom.adoc diff --git a/modules/op-about-multicluster-support.adoc b/modules/op-about-multicluster-support.adoc index 01684f9995b..8ae2d37198f 100644 --- a/modules/op-about-multicluster-support.adoc +++ b/modules/op-about-multicluster-support.adoc @@ -11,15 +11,14 @@ Multicluster support enables you to distribute pipeline workloads across multipl When you run many tasks concurrently on a single cluster, performance can degrade due to resource contention on critical components such as the Kubernetes API server and etcd. A multicluster approach addresses these challenges by distributing workloads across multiple clusters, which helps alleviate resource bottlenecks, reduce the impact of failures, and improve overall scalability. -.Key benefits - +Key benefits:: ++ * *Horizontal scalability*: Distribute pipeline workloads across multiple clusters to handle increased capacity demands without overloading a single cluster. * *Improved performance*: Reduce resource contention on the Kubernetes API server and etcd by spreading workloads across clusters. * *Reduced failure impact*: Minimize the effect of cluster failures by isolating workloads across different clusters. * *Resource optimization*: Use Kueue to schedule pipeline runs based on resource availability across your cluster infrastructure. -.How it works - +How it works:: In a multicluster setup: . You create pipeline runs on the hub cluster which initially enter a pending state. diff --git a/modules/op-authenticating-pipelines-repos-using-secrets.adoc b/modules/op-authenticating-pipelines-repos-using-secrets.adoc index 32458b66837..828b9c34760 100644 --- a/modules/op-authenticating-pipelines-repos-using-secrets.adoc +++ b/modules/op-authenticating-pipelines-repos-using-secrets.adoc @@ -50,5 +50,5 @@ params: - name: url value: https://bitbucket.org//.git ---- - ++ At runtime, the `git-clone` task uses credentials from the `bitbucket-auth` secret when accessing HTTPS Git URLs matching `https://bitbucket.org`. \ No newline at end of file diff --git a/modules/op-configuring-cosign-for-sbom-verification.adoc b/modules/op-configuring-cosign-for-sbom-verification.adoc new file mode 100644 index 00000000000..d543b9e168e --- /dev/null +++ b/modules/op-configuring-cosign-for-sbom-verification.adoc @@ -0,0 +1,84 @@ +// This module is included in the following assemblies: +// * secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc + +:_mod-docs-content-type: PROCEDURE +[id="op-configuring-cosign-for-sbom-verification_{context}"] += Setting up {pipelines-shortname} to download or view software bills of materials + +[role="_abstract"] +The `PipelineRun` details page provides an option to download or view Software Bill of Materials (SBOMs), enhancing transparency and control within your supply chain. SBOMs lists all the software libraries that a component uses. Those libraries can enable specific functionality or help development. + +You can use a software bill of materials (SBOM) to better understand the composition of your software, identify vulnerabilities, and assess the potential impact of any security issues that might arise. + +.Options to download or view SBOMs +image::sbom.png[Options to download or view SBOMs] + +.Prerequisites + +* You have link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[logged in to the web console]. + +* You have the appropriate link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[roles and permissions] in a project to create applications and other workloads in {product-title}. + +.Procedure + +. In the *Developer* or *Administrator* perspective, switch to the relevant project where you want a visual representation of SBOMs. + +. Add a task in the following format to view or download the SBOM information: ++ +.Example SBOM task +[source,yaml] +---- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: sbom-task + annotations: + task.output.location: results + task.results.format: application/text + task.results.key: LINK_TO_SBOM + task.results.type: external-link +spec: + results: + - description: Contains the SBOM link + name: LINK_TO_SBOM + steps: + - name: print-sbom-results + image: quay.io/image + script: | + #!/bin/sh + syft version + syft quay.io//quarkus-demo:v2 --output cyclonedx-json=sbom-image.json + echo 'BEGIN SBOM' + cat sbom-image.json + echo 'END SBOM' + echo 'quay.io/user/workloads//node-express/node-express:build-8e536-1692702836' | tee $(results.LINK_TO_SBOM.path) +---- +`name`:: The name of your task. +`task.output.location`:: The location for storing the task outputs. +`task.results.key`:: The SBOM task result name. Do not change the name of the SBOM result task. +`task.results.type`:: (Optional) Set to open the SBOM in a new tab. +`- description: Contains the SBOM link`:: The description of the result. +`image`:: The image that generates the SBOM. +`script`:: The script that generates the SBOM image. +``:: The SBOM image along with the path name. + +. Update the Pipeline to reference the newly created SBOM task. ++ +[source,yaml] +---- +... +spec: + tasks: + - name: sbom-task + taskRef: + name: sbom-task + results: + - name: IMAGE_URL + description: url + value: +---- +`name`:: The same name as created in Step 2. +`- name: IMAGE_URL`:: The name of the result. +``:: The OCI image repository URL that has the `.sbom` images. + +. Rerun the affected OpenShift Pipeline. diff --git a/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc b/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc index 11c9d53fb94..11852290f11 100644 --- a/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc +++ b/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc @@ -55,7 +55,8 @@ $ tkn task start ``:: Replace `` with the name of the workspace that you configured and `` with the name of the secret that you created. + -- -.Example task for cloning a Git repository by using an SSH key for authentication +The following is an example task for cloning a Git repository by using an SSH key for authentication: + [source,yaml,subs="attributes+"] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-configuring-gitops-command-prefix.adoc b/modules/op-configuring-gitops-command-prefix.adoc index 1b04f8839b7..ef71479d9b9 100644 --- a/modules/op-configuring-gitops-command-prefix.adoc +++ b/modules/op-configuring-gitops-command-prefix.adoc @@ -65,7 +65,7 @@ For example, if the custom prefix is set to `pac`, use the following command to ---- /pac test ---- - ++ [NOTE] ==== The prefix setting does not affect custom GitOps commands. diff --git a/modules/op-creating-pipeline-runs-multicluster.adoc b/modules/op-creating-pipeline-runs-multicluster.adoc index bcf7b89ce2b..7f6f9fc03ee 100644 --- a/modules/op-creating-pipeline-runs-multicluster.adoc +++ b/modules/op-creating-pipeline-runs-multicluster.adoc @@ -93,10 +93,9 @@ The pipeline run initially shows a `Pending` status. When MultiKueue schedules i In the web console, multicluster pipeline runs are indicated with a multicluster icon next to the pipeline run name in both the list view and details page. ==== -.Using HTTP resolver to fetch pipeline definitions - +Using HTTP resolver to fetch pipeline definitions:: You can use the HTTP resolver to fetch pipeline definitions from a remote location. The following example shows how to create a pipeline run that uses the HTTP resolver: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -114,11 +113,12 @@ spec: - name: url value: https://raw.githubusercontent.com/example/repo/main/pipeline.yaml ---- - ++ Replace the `url` parameter value with the URL to your pipeline definition. -.Using {pac} with multicluster - +Using {pac} with multicluster:: ++ +-- {pac} is compatible with multicluster configurations. When you configure a repository for {pac} on the hub cluster, ensure that pipeline runs created by {pac} include the `managedBy: kueue.x-k8s.io/multikueue` field in the specification. The following example shows a {pac} pipeline run configuration that works in a multicluster environment: @@ -167,3 +167,4 @@ Secret synchronization for PAC is handled automatically by the syncer-service, w ** Remote resolvers such as Git or HTTP resolvers to fetch pipeline definitions from external sources * Only the pipeline run and its associated ConfigMaps and Secrets are synchronized to spoke clusters. Other resources are not synchronized. ==== +-- diff --git a/modules/op-downloading-an-sbom.adoc b/modules/op-downloading-an-sbom.adoc new file mode 100644 index 00000000000..ab5bbc80ae3 --- /dev/null +++ b/modules/op-downloading-an-sbom.adoc @@ -0,0 +1,33 @@ +// This module is included in the following assemblies: +// * secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc + +:_mod-docs-content-type: PROCEDURE +[id="op-downloading-an-sbom_{context}"] += Downloading an SBOM in the CLI + +[role="_abstract"] +You can download a software bill of materials (SBOM) for a pipeline run by using the Cosign CLI tool. + +.Prerequisites + +* You have installed the Cosign CLI tool. For information about installing the Cosign tool, see the link:https://docs.sigstore.dev/cosign/system_config/installation/[Sigstore documentation for Cosign]. + +* You have set up {pipelines-shortname} to download or view SBOMs. + +.Procedure + +. Open terminal, log in to *Developer* or *Administrator* perspective, and then switch to the relevant project. + +. From the OpenShift web console, copy the `download sbom` command and run it on your terminal. ++ +[source,terminal] +---- +$ cosign download sbom quay.io//user-workload@sha256 +---- + +.. (Optional) To view the full SBOM in a searchable format, run the following command to redirect the output: ++ +[source,terminal] +---- +$ cosign download sbom quay.io//user-workload@sha256 > sbom.txt +---- diff --git a/modules/op-multicluster-kueue-resources-reference.adoc b/modules/op-multicluster-kueue-resources-reference.adoc index d91e49144a4..e02cfe36c38 100644 --- a/modules/op-multicluster-kueue-resources-reference.adoc +++ b/modules/op-multicluster-kueue-resources-reference.adoc @@ -7,12 +7,13 @@ = Kueue resources for multicluster configuration [role="_abstract"] -Kueue resources define quotas, queues, and multicluster configuration for managing pipeline runs across clusters. The following tables describe the key Kueue resources used in a multicluster {pipelines-shortname} setup. +Kueue resources define quotas, queues, and multicluster configuration for managing pipeline runs across clusters. -.ResourceFlavor +The following tables describe the key Kueue resources used in a multicluster {pipelines-shortname} setup. +ResourceFlavor:: A ResourceFlavor represents a variation of available resources. In multicluster configurations, it typically defines a default set of resources. - ++ [cols="1,2",options="header"] |=== |Field @@ -22,10 +23,9 @@ A ResourceFlavor represents a variation of available resources. In multicluster |The name of the resource flavor. |=== -.ClusterQueue - +ClusterQueue:: A ClusterQueue defines resource quotas and admission checks for workloads across namespaces. - ++ [cols="1,2",options="header"] |=== |Field @@ -62,10 +62,9 @@ A ClusterQueue defines resource quotas and admission checks for workloads across |A list of admission checks that workloads must pass before admission. For multicluster, this typically references a MultiKueue admission check. |=== -.LocalQueue - +LocalQueue:: A LocalQueue provides a namespace-scoped interface to a ClusterQueue. - ++ [cols="1,2",options="header"] |=== |Field @@ -81,10 +80,9 @@ A LocalQueue provides a namespace-scoped interface to a ClusterQueue. |The name of the ClusterQueue that this LocalQueue references. |=== -.AdmissionCheck - +AdmissionCheck:: An AdmissionCheck defines a condition that workloads must satisfy before being admitted. - ++ [cols="1,2",options="header"] |=== |Field @@ -106,10 +104,9 @@ An AdmissionCheck defines a condition that workloads must satisfy before being a |The name of the MultiKueueConfig resource. |=== -.MultiKueueConfig - +MultiKueueConfig:: A MultiKueueConfig defines the configuration for multicluster workload distribution. - ++ [cols="1,2",options="header"] |=== |Field @@ -122,10 +119,9 @@ A MultiKueueConfig defines the configuration for multicluster workload distribut |A list of MultiKueueCluster names that workloads can be scheduled to. |=== -.MultiKueueCluster - +MultiKueueCluster:: A MultiKueueCluster defines a spoke cluster configuration. - ++ [cols="1,2",options="header"] |=== |Field diff --git a/modules/op-multicluster-limitations.adoc b/modules/op-multicluster-limitations.adoc index 3c15874585d..87fdf200640 100644 --- a/modules/op-multicluster-limitations.adoc +++ b/modules/op-multicluster-limitations.adoc @@ -14,8 +14,7 @@ When working with pipeline runs in a multicluster environment, be aware of the f Some or all of these limitations might be removed in future releases as the multicluster support continues to evolve. ==== -.Web console limitations - +Web console limitations:: The following actions are not fully supported in the web console for multicluster pipeline runs: Stop action:: @@ -24,8 +23,7 @@ The Stop action does not work for pipeline runs executing on spoke clusters. Thi Cancel action:: The Cancel action might be disabled or unavailable in the web console for multicluster pipeline runs. This action immediately cancels the pipeline run and all active tasks. The availability of this action depends on whether the hub cluster detects active tasks, which might not be accurately reflected for pipeline runs executing on spoke clusters. -.Workaround - +Workaround:: To stop or cancel a multicluster pipeline run, you must cancel it directly on the spoke cluster where it is executing: . Log in to the spoke cluster where the pipeline run is executing. @@ -40,7 +38,7 @@ The cancellation status is synchronized back to the hub cluster. [NOTE] ==== -Both the Stop and Cancel actions are designed to execute finally tasks as part of cleanup. Cancelling from the spoke cluster allows finally tasks to execute properly. +Both the Stop and Cancel actions are designed to execute finally tasks as part of cleanup. Canceling from the spoke cluster allows finally tasks to execute properly. ==== Logs and status display:: @@ -49,30 +47,29 @@ When viewing logs or status for pipeline runs executing on spoke clusters, you m Pending admission state:: Pipeline runs created on the hub cluster show a "waiting to be admitted to a spoke cluster" status before MultiKueue schedules them to a spoke cluster. This is normal behavior while the system determines the best spoke cluster based on resource availability. -.API version requirement - +API version requirement:: Multicluster pipeline runs must use the `tekton.dev/v1` API version. The `tekton.dev/v1beta1` API version is not supported. -.Reference limitations - +Reference limitations:: You cannot use `pipelineRef` or `taskRef` to reference existing pipelines or tasks stored in the cluster using the cluster resolver. Instead, you must use one of the following approaches: * Embedded pipeline specifications * Remote resolvers such as Git, HTTP, or Bundle resolvers -.Additional limitations - -PipelineRun name length:: +Additional limitations:: ++ +-- +PipelineRun name length::: The name of a pipeline run must not exceed 45 characters. This limit exists because MultiKueue generates workload names by adding additional characters to the pipeline run name. -Namespace requirements:: +Namespace requirements::: Namespaces must be pre-created on spoke clusters before pipeline runs can be scheduled to them. If a namespace does not exist on a spoke cluster, MultiKueue cannot schedule pipeline runs to that cluster. -LocalQueue requirements:: +LocalQueue requirements::: Each spoke cluster must have a matching LocalQueue resource in the same namespace where pipeline runs are created. The LocalQueue name must match the name referenced in the pipeline run's `kueue.x-k8s.io/queue-name` label. +-- -.tkn CLI limitations - +tkn CLI limitations:: The `tkn` CLI tool has limited functionality in multicluster environments: * On the hub cluster, the following commands do not work: diff --git a/modules/op-reading-the-sbom.adoc b/modules/op-reading-the-sbom.adoc new file mode 100644 index 00000000000..b9631a28500 --- /dev/null +++ b/modules/op-reading-the-sbom.adoc @@ -0,0 +1,54 @@ +// This module is included in the following assemblies: +// * secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc + +:_mod-docs-content-type: REFERENCE +[id="op-reading-the-sbom_{context}"] += Reading the SBOM + +[role="_abstract"] +In the SBOM, you can see four characteristics of each library that a project uses. This information helps you verify that individual libraries are safely-sourced, updated, and compliant. + +The following characteristics are listed for each library: + +* Its author or publisher + +* Its name + +* Its version + +* Its licenses + +The following example shows a sample excerpt from an SBOM: + +[source,json] +---- +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220", + "version": 1, + "metadata": { + ... + }, + "components": [ + { + "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8", + "type": "library", + "author": "Armin Ronacher ", + "name": "Flask", + "version": "2.1.0", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*", + "purl": "pkg:pypi/Flask@2.1.0", + "properties": [ + { + "name": "syft:package:foundBy", + "value": "python-package-cataloger" + ... +---- diff --git a/modules/op-resolver-bundle.adoc b/modules/op-resolver-bundle.adoc index 8d11a2d1af2..1717a3237af 100644 --- a/modules/op-resolver-bundle.adoc +++ b/modules/op-resolver-bundle.adoc @@ -74,9 +74,9 @@ spec: - name: username value: "pipelines" ---- - ++ The following example pipeline references a remote task from a Tekton bundle: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -99,9 +99,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a remote task from a Tekton bundle: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -122,9 +122,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from a Tekton bundle: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-resolver-cluster.adoc b/modules/op-resolver-cluster.adoc index 223177b67d1..99c9cf5024e 100644 --- a/modules/op-resolver-cluster.adoc +++ b/modules/op-resolver-cluster.adoc @@ -69,9 +69,9 @@ spec: - name: sample-pipeline-parameter value: test ---- - ++ The following example pipeline references a task from the same cluster: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -94,9 +94,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a task from the same cluster: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -117,9 +117,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from the same cluster: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-resolver-git-anon.adoc b/modules/op-resolver-git-anon.adoc index 5f6636eaed1..0d1815652a7 100644 --- a/modules/op-resolver-git-anon.adoc +++ b/modules/op-resolver-git-anon.adoc @@ -77,9 +77,9 @@ spec: - name: sample-pipeline-parameter value: test ---- - ++ The following example pipeline references a remote task from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -102,9 +102,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a remote task from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -125,9 +125,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-resolver-git-scm.adoc b/modules/op-resolver-git-scm.adoc index 102e2d69115..f53aecc4eea 100644 --- a/modules/op-resolver-git-scm.adoc +++ b/modules/op-resolver-git-scm.adoc @@ -89,9 +89,9 @@ spec: - name: sample-pipeline-parameter value: test ---- - ++ The following example pipeline references a remote task from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -116,9 +116,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a remote task from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -141,9 +141,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from a Git repository: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-resolver-http.adoc b/modules/op-resolver-http.adoc index 940633abc5b..98d387026a6 100644 --- a/modules/op-resolver-http.adoc +++ b/modules/op-resolver-http.adoc @@ -54,9 +54,9 @@ spec: - name: username value: "pipelines" ---- - ++ The following example pipeline defines a task that references a remote task from an HTTPS URL: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -75,9 +75,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a remote task from an HTTPS URL: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -94,9 +94,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from an HTTPS URL: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-resolver-hub.adoc b/modules/op-resolver-hub.adoc index c406f686209..2e619b14abc 100644 --- a/modules/op-resolver-hub.adoc +++ b/modules/op-resolver-hub.adoc @@ -90,9 +90,9 @@ spec: - name: sample-pipeline-parameter value: test ---- - ++ The following example pipeline references a remote task from a catalog: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -119,9 +119,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task run references a remote task from a catalog: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -146,9 +146,9 @@ spec: - name: sample-task-parameter value: test ---- - ++ The following example task includes a step that references a `StepAction` definition from a catalog: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -175,9 +175,9 @@ spec: - name: sample-stepaction-parameter value: test ---- - ++ The following example task run references a remote task from a private hub instance by using the `url` parameter: - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-results-opc-pipelinerunlist.adoc b/modules/op-results-opc-pipelinerunlist.adoc index 72824a59e9b..713e076fb52 100644 --- a/modules/op-results-opc-pipelinerunlist.adoc +++ b/modules/op-results-opc-pipelinerunlist.adoc @@ -28,7 +28,7 @@ $ opc results pipelinerun list -n Optionally, specify the `--limit` command line option, for example, `--limit=10`. With this setting, the `opc` command displays the specified number of lines containing pipeline run names and then exits. If you add the `--single-page=false` command line option, the command displays the specified number of lines and then prompts you to continue or quit. + Optionally, specify the `--labels` command line option, for example, `--labels="app.kubernetes.io/name=test-app, app.kubernetes.io/component=database`. With this setting, the list includes only the pipeline runs that have the specified labels or annotations. - ++ .Example output of the `opc results pipelinerun list` command [source,terminal] ---- @@ -39,7 +39,7 @@ openshift-pipelines-main-release-tests-jdc24 e34daea2-66fb-4c7d-9d4b-d9d82a07b openshift-pipelines-main-release-tests-6zj7f 9b3e5d68-70ab-4c23-8872-e7ad7121e60b 1 week ago 5s Failed(CouldntGetPipeline) openshift-pipelines-main-release-tests-kkk9t 2fd28c48-388b-4e6a-9ec3-2bcd9dedebc3 1 week ago 5s Failed(CouldntGetPipeline) ---- - ++ ** To view pipeline runs related to specified named pipelines, enter the following command: + [source,terminal] diff --git a/modules/op-specifying-manual-approval-task.adoc b/modules/op-specifying-manual-approval-task.adoc index d465da2cfa8..8df0bf97347 100644 --- a/modules/op-specifying-manual-approval-task.adoc +++ b/modules/op-specifying-manual-approval-task.adoc @@ -123,9 +123,9 @@ The following table describes the parameters for a manual approval task. |=== + You can define approval tasks for different workflows depending on your requirements. The following are a few examples of approval configurations. - ++ The following is an example for multi user approval. - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -161,9 +161,9 @@ spec: name: deploy-task runAfter: [approval-gate] ---- - ++ The following is an example for a group-based user approval. - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 @@ -198,9 +198,9 @@ spec: name: deploy-task runAfter: [approval-gate] ---- - ++ The following is an example for mixed user and group approvals. - ++ [source,yaml] ---- apiVersion: tekton.dev/v1 diff --git a/modules/op-troubleshooting-task-params-changed.adoc b/modules/op-troubleshooting-task-params-changed.adoc index 097f2654074..e5b8ee6902d 100644 --- a/modules/op-troubleshooting-task-params-changed.adoc +++ b/modules/op-troubleshooting-task-params-changed.adoc @@ -20,7 +20,7 @@ $ oc get task buildah -n openshift-pipelines -o yaml . Check the task reference documentation for the correct parameter names and types. For more information, see the Additional Resources section. . Update your pipeline to use the correct parameter names. - ++ [NOTE] ==== Parameters such as `BUILDER_IMAGE`, `gitInitImage`, and `KN_IMAGE` are no longer supported in {pipelines-shortname} installation tasks. If you need to use a custom image, create a copy of the task and modify it. diff --git a/modules/op-verify-clustertask-migration.adoc b/modules/op-verify-clustertask-migration.adoc index 86fb591c126..6543aaa265f 100644 --- a/modules/op-verify-clustertask-migration.adoc +++ b/modules/op-verify-clustertask-migration.adoc @@ -75,7 +75,8 @@ $ tkn pipelinerun describe -- + -- -.Example output +Example output: + [source,terminal] ---- Name: my-pipeline-run-xxxxx diff --git a/modules/op-viewing-an-sbom.adoc b/modules/op-viewing-an-sbom.adoc new file mode 100644 index 00000000000..7d0ca811b2a --- /dev/null +++ b/modules/op-viewing-an-sbom.adoc @@ -0,0 +1,25 @@ +// This module is included in the following assemblies: +// * secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc + +:_mod-docs-content-type: PROCEDURE +[id="op-viewing-an-sbom_{context}"] += Viewing an SBOM in the web UI + +[role="_abstract"] +You can view a software bill of materials (SBOM) for a pipeline run directly in the {product-title} web console. + +.Prerequisites + +* You have set up {pipelines-shortname} to download or view SBOMs. + +.Procedure + +. Navigate to the Activity -> `PipelineRuns` tab. + +. For the project whose SBOM you want to view, select its most recent pipeline run. + +. On the `PipelineRun` details page, select *View SBOM*. + +.. You can use your web browser to immediately search the SBOM for terms that indicate vulnerabilities in your software supply chain. For example, try searching for `log4j`. + +.. You can select *Download* to download the SBOM, or *Expand* to view it full-screen. diff --git a/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc b/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc index 76533d59c7a..30d45005da5 100644 --- a/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc +++ b/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc @@ -25,7 +25,13 @@ The `PipelineRun` displays the signed badge next to its name only if you have co include::modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc[leveloffset=+1] -include::modules/op-setting-up-openshift-pipelines-to-download-or-view-sboms.adoc[leveloffset=+1] +include::modules/op-configuring-cosign-for-sbom-verification.adoc[leveloffset=+1] + +include::modules/op-viewing-an-sbom.adoc[leveloffset=+1] + +include::modules/op-downloading-an-sbom.adoc[leveloffset=+1] + +include::modules/op-reading-the-sbom.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources From 75de9aa089c77eba3904987fba5216268cdcd0a3 Mon Sep 17 00:00:00 2001 From: Rohit Parmar Date: Thu, 13 Aug 2026 14:53:41 +0530 Subject: [PATCH 2/5] [RHDEVDOCS-7795] Fix DITA metadata issues for AEM migration readiness --- modules/op-about-must-gather.adoc | 1 + modules/op-collecting-pipelines-debugging-data.adoc | 5 +++-- modules/op-configuring-hub-cluster-multicluster.adoc | 1 + modules/op-configuring-spoke-clusters-multicluster.adoc | 1 + modules/op-creating-pipeline-runs-multicluster.adoc | 1 + modules/op-troubleshooting-access-denied.adoc | 5 ++++- modules/op-troubleshooting-general-debugging.adoc | 1 + modules/op-troubleshooting-resolution-failed.adoc | 5 ++++- modules/op-troubleshooting-resolver-not-enabled.adoc | 5 ++++- modules/op-troubleshooting-task-params-changed.adoc | 5 ++++- modules/op-verifying-multicluster-setup.adoc | 1 + ...ng-tekton-workloads-from-eviction-during-node-drains.adoc | 2 +- 12 files changed, 26 insertions(+), 7 deletions(-) diff --git a/modules/op-about-must-gather.adoc b/modules/op-about-must-gather.adoc index 70c2b793939..f45683406fb 100644 --- a/modules/op-about-must-gather.adoc +++ b/modules/op-about-must-gather.adoc @@ -2,6 +2,7 @@ [id="op-about-must-gather_{context}"] = About the must-gather tool +[role="_abstract"] The `oc adm must-gather` tool collects diagnostic information about your cluster, such as resource definitions, configurations, and logs for project-level and cluster-level resources. When you run the command, the tool performs the following actions: diff --git a/modules/op-collecting-pipelines-debugging-data.adoc b/modules/op-collecting-pipelines-debugging-data.adoc index 3d66aaeefb8..0d35bb30911 100644 --- a/modules/op-collecting-pipelines-debugging-data.adoc +++ b/modules/op-collecting-pipelines-debugging-data.adoc @@ -1,8 +1,9 @@ :_mod-docs-content-type: PROCEDURE [id="op-collecting-pipelines-debugging-data_{context}"] -= Collecting OpenShift Pipelines debugging data += Collecting {pipelines-shortname} debugging data -You can use the `oc adm must-gather` CLI command to collect detailed diagnostic data and logs for OpenShift Pipelines components on your cluster. +[role="_abstract"] +You can use the `oc adm must-gather` CLI command to collect detailed diagnostic data and logs for {pipelines-shortname} components on your cluster. .Prerequisites diff --git a/modules/op-configuring-hub-cluster-multicluster.adoc b/modules/op-configuring-hub-cluster-multicluster.adoc index c66b39e4b03..0bc94c68a81 100644 --- a/modules/op-configuring-hub-cluster-multicluster.adoc +++ b/modules/op-configuring-hub-cluster-multicluster.adoc @@ -6,6 +6,7 @@ [id="op-configuring-hub-cluster-multicluster_{context}"] = Configuring the hub cluster for multicluster +[role="_abstract"] You can configure an {product-title} cluster as a hub cluster to manage and schedule pipeline runs across multiple spoke clusters. .Prerequisites diff --git a/modules/op-configuring-spoke-clusters-multicluster.adoc b/modules/op-configuring-spoke-clusters-multicluster.adoc index 5f1076badbc..8a4057d8c8a 100644 --- a/modules/op-configuring-spoke-clusters-multicluster.adoc +++ b/modules/op-configuring-spoke-clusters-multicluster.adoc @@ -6,6 +6,7 @@ [id="op-configuring-spoke-clusters-multicluster_{context}"] = Configuring spoke clusters for multicluster +[role="_abstract"] You can configure {product-title} clusters as spoke clusters to execute pipeline runs scheduled from a hub cluster. .Prerequisites diff --git a/modules/op-creating-pipeline-runs-multicluster.adoc b/modules/op-creating-pipeline-runs-multicluster.adoc index 7f6f9fc03ee..97038124958 100644 --- a/modules/op-creating-pipeline-runs-multicluster.adoc +++ b/modules/op-creating-pipeline-runs-multicluster.adoc @@ -6,6 +6,7 @@ [id="op-creating-pipeline-runs-multicluster_{context}"] = Creating pipeline runs in a multicluster environment +[role="_abstract"] After you configure multicluster support, you can create pipeline runs on the hub cluster that are automatically scheduled and executed on spoke clusters. .Prerequisites diff --git a/modules/op-troubleshooting-access-denied.adoc b/modules/op-troubleshooting-access-denied.adoc index 0cf581293b0..13521a78f44 100644 --- a/modules/op-troubleshooting-access-denied.adoc +++ b/modules/op-troubleshooting-access-denied.adoc @@ -6,7 +6,10 @@ [id="troubleshooting-access-denied_{context}"] = Resolve namespace access blocked errors -If you receive an error that access to the specified namespace is blocked, the cluster resolver might not have permission to access that namespace. This can occur when the cluster resolver configuration restricts access to certain namespaces, or when RBAC policies prevent the service account from accessing the namespace. +[role="_abstract"] +If you receive an error that access to the specified namespace is blocked, the cluster resolver might not have permission to access that namespace. + +This can occur when the cluster resolver configuration restricts access to certain namespaces, or when RBAC policies prevent the service account from accessing the namespace. .Procedure diff --git a/modules/op-troubleshooting-general-debugging.adoc b/modules/op-troubleshooting-general-debugging.adoc index 50acb021226..cc85a918a96 100644 --- a/modules/op-troubleshooting-general-debugging.adoc +++ b/modules/op-troubleshooting-general-debugging.adoc @@ -6,6 +6,7 @@ [id="troubleshooting-general-debugging_{context}"] = General debugging tips for cluster resolver migration +[role="_abstract"] If you encounter other issues during migration, use the following troubleshooting steps. .Procedure diff --git a/modules/op-troubleshooting-resolution-failed.adoc b/modules/op-troubleshooting-resolution-failed.adoc index 523c9e67fee..321a26ea0b7 100644 --- a/modules/op-troubleshooting-resolution-failed.adoc +++ b/modules/op-troubleshooting-resolution-failed.adoc @@ -6,7 +6,10 @@ [id="troubleshooting-resolution-failed_{context}"] = Resolve task resolution failed or resource not found errors -If a pipeline run fails with a "resolution failed" or "resource not found" error, the cluster resolver cannot find the specified task. This can occur when the task does not exist in the specified namespace, the task name is misspelled in the pipeline definition, or the namespace name is incorrect. +[role="_abstract"] +If a pipeline run fails with a "resolution failed" or "resource not found" error, the cluster resolver cannot find the specified task. + +This can occur when the task does not exist in the specified namespace, the task name is misspelled in the pipeline definition, or the namespace name is incorrect. .Procedure diff --git a/modules/op-troubleshooting-resolver-not-enabled.adoc b/modules/op-troubleshooting-resolver-not-enabled.adoc index 33147be496e..4f5868c734b 100644 --- a/modules/op-troubleshooting-resolver-not-enabled.adoc +++ b/modules/op-troubleshooting-resolver-not-enabled.adoc @@ -6,7 +6,10 @@ [id="troubleshooting-resolver-not-enabled_{context}"] = Resolve cluster resolver not enabled errors -If the cluster resolver is not working, it might not be enabled in your {pipelines-title} installation. This can occur when the cluster resolver feature flag is not enabled, or when the resolver configuration is missing or incorrect. +[role="_abstract"] +If the cluster resolver is not working, it might not be enabled in your {pipelines-title} installation. + +This can occur when the cluster resolver feature flag is not enabled, or when the resolver configuration is missing or incorrect. .Procedure diff --git a/modules/op-troubleshooting-task-params-changed.adoc b/modules/op-troubleshooting-task-params-changed.adoc index e5b8ee6902d..f8c931ae5b0 100644 --- a/modules/op-troubleshooting-task-params-changed.adoc +++ b/modules/op-troubleshooting-task-params-changed.adoc @@ -6,7 +6,10 @@ [id="troubleshooting-task-params-changed_{context}"] = Resolve task parameter changed errors -Tasks in the {pipelines-shortname} namespace might have different parameters than their deprecated `ClusterTask` versions. Review the current task definitions and update your pipelines to use the correct parameter names. +[role="_abstract"] +Tasks in the {pipelines-shortname} namespace might have different parameters than their deprecated `ClusterTask` versions. + +Review the current task definitions and update your pipelines to use the correct parameter names. .Procedure diff --git a/modules/op-verifying-multicluster-setup.adoc b/modules/op-verifying-multicluster-setup.adoc index 8ea6072ebf7..98e4d7b7b4a 100644 --- a/modules/op-verifying-multicluster-setup.adoc +++ b/modules/op-verifying-multicluster-setup.adoc @@ -6,6 +6,7 @@ [id="op-verifying-multicluster-setup_{context}"] = Verifying multicluster setup +[role="_abstract"] You can verify that your multicluster configuration is working correctly by checking the status of Kueue resources on the hub cluster. .Prerequisites diff --git a/resource/protecting-tekton-workloads-from-eviction-during-node-drains.adoc b/resource/protecting-tekton-workloads-from-eviction-during-node-drains.adoc index cde6f378d55..71bdb9cf99a 100644 --- a/resource/protecting-tekton-workloads-from-eviction-during-node-drains.adoc +++ b/resource/protecting-tekton-workloads-from-eviction-during-node-drains.adoc @@ -1,4 +1,4 @@ -:_content-type: ASSEMBLY +:_mod-docs-content-type: ASSEMBLY include::_attributes/common-attributes.adoc[] [id="protecting-tekton-workloads-from-eviction-during-node-drains"] = Protecting Tekton workload pods from eviction during node drains From aa13fd28ab4a3e9e525e5c782137b00e6df61e52 Mon Sep 17 00:00:00 2001 From: Rohit Parmar Date: Fri, 14 Aug 2026 19:27:14 +0530 Subject: [PATCH 3/5] [RHDEVDOCS-7796] Fix DITA content compliance issues for AEM migration readiness and feedback from peer review incorporated. --- about/understanding-openshift-pipelines.adoc | 17 ---------- ...ting-applications-with-cicd-pipelines.adoc | 32 ++++--------------- create/using-manual-approval.adoc | 5 --- create/using-rh-entitlements-pipelines.adoc | 2 +- .../working-with-pipelines-web-console.adoc | 9 ------ ...g-tekton-hub-with-openshift-pipelines.adoc | 6 ++-- modules/op-about-pipelinerun.adoc | 7 +++- modules/op-about-podtemplate.adoc | 5 +++ modules/op-about-stepactions.adoc | 5 +++ ...ches-compute-resource-quota-pipelines.adoc | 17 ++++++++++ modules/op-approving-task-web-console.adoc | 5 +++ modules/op-chains-signing-secrets-cosign.adoc | 2 +- ...figuring-basic-authentication-for-git.adoc | 9 ++++-- ...figuring-cosign-for-sbom-verification.adoc | 10 ++++-- .../op-configuring-default-maximum-scc.adoc | 5 +++ ...onfiguring-ssh-authentication-for-git.adoc | 7 +++- modules/op-console-statistics.adoc | 7 +++- ...ting-pipelines-using-pipeline-builder.adoc | 2 +- ...lication-in-administrator-perspective.adoc | 2 +- ...izing-pipelines-as-code-configuration.adoc | 7 +++- modules/op-default-pruner-configuration.adoc | 7 +++- ...diagnosing-a-pipeline-with-opc-assist.adoc | 7 +++- modules/op-downloading-an-sbom.adoc | 7 +++- ...or-triggers-for-user-defined-projects.adoc | 5 +++ .../op-installing-pipelines-as-code-cli.adoc | 2 +- ...lines-as-code-on-an-openshift-cluster.adoc | 2 +- ...ling-tekton-hub-with-login-and-rating.adoc | 15 ++++++--- modules/op-installing-tkn-on-windows.adoc | 7 +++- modules/op-lightspeed-utility-commands.adoc | 7 +++- ...n-pipelines-in-restricted-environment.adoc | 7 ++++ ...modifiable-fields-with-default-values.adoc | 2 +- ...ne-run-status-using-pipelines-as-code.adoc | 9 ++++++ modules/op-odc-pipelines-abstract.adoc | 5 +++ .../op-pac-configuring-github-app-cli.adoc | 2 +- ...p-pac-configuring-github-app-manually.adoc | 2 +- ...p-pipelines-as-code-command-reference.adoc | 7 +++- ...ipelines-as-code-resolver-annotations.adoc | 7 ++-- ...-pod-eviction-during-node-maintenance.adoc | 9 ++++-- .../op-querying-results-records-about.adoc | 7 +++- modules/op-release-notes-1-20-0.adoc | 10 +++--- modules/op-resolver-hub-about.adoc | 14 +++++--- modules/op-results-reference-records.adoc | 5 +++ modules/op-running-a-pipeline.adoc | 5 +++ ...n-with-custom-scc-and-service-account.adoc | 7 +++- ...lines-to-view-project-vulnerabilities.adoc | 11 ++++--- ...s-resource-quota-using-priority-class.adoc | 2 +- ...arameters-tekton-chains-configuration.adoc | 16 +++++++--- ...ipelines-compatibility-support-matrix.adoc | 7 +++- ...g-pipelines-as-code-with-a-github-app.adoc | 2 +- ...ipelines-as-code-with-bitbucket-cloud.adoc | 4 +-- ...pelines-as-code-with-bitbucket-server.adoc | 4 +-- ...pipelines-as-code-with-github-webhook.adoc | 4 +-- ...p-using-pipelines-as-code-with-gitlab.adoc | 4 +-- .../op-using-secrets-as-a-nonroot-user.adoc | 7 +++- ...-ssh-authentication-in-git-type-tasks.adoc | 7 +++- pac/managing-pipeline-runs-pac.adoc | 9 ------ ...for-openshift-pipelines-observability.adoc | 6 ---- release_notes/op-release-notes-1-20.adoc | 5 +-- ...esource-quota-for-openshift-pipelines.adoc | 14 -------- ...configuring-security-context-for-pods.adoc | 7 ++-- ...shift-pipelines-supply-chain-security.adoc | 4 --- 61 files changed, 266 insertions(+), 165 deletions(-) diff --git a/about/understanding-openshift-pipelines.adoc b/about/understanding-openshift-pipelines.adoc index 90cc2e73374..2d62d99d4fe 100644 --- a/about/understanding-openshift-pipelines.adoc +++ b/about/understanding-openshift-pipelines.adoc @@ -30,29 +30,12 @@ include::modules/op-about-pipelines.adoc[leveloffset=+2] //About pipeline run include::modules/op-about-pipelinerun.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources - -* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] - -//Pod templates include::modules/op-about-podtemplate.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources -* link:https://docs.openshift.com/container-platform/4.17/nodes/pods/nodes-pods-using.html[Using pods] - -//About workspace include::modules/op-about-workspace.adoc[leveloffset=+2] -//About stepactions include::modules/op-about-stepactions.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources - -* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions using resolvers] -//About triggers include::modules/op-about-triggers.adoc[leveloffset=+2] [role="_additional-resources"] diff --git a/create/creating-applications-with-cicd-pipelines.adoc b/create/creating-applications-with-cicd-pipelines.adoc index 3c66ed1d56c..5c3187de4c1 100644 --- a/create/creating-applications-with-cicd-pipelines.adoc +++ b/create/creating-applications-with-cicd-pipelines.adoc @@ -42,21 +42,8 @@ include::modules/op-assembling-a-pipeline.adoc[leveloffset=+1] include::modules/op-mirroring-images-to-run-pipelines-in-restricted-environment.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources - -* link:https://docs.openshift.com/container-platform/latest/openshift_images/configuring-samples-operator.html#samples-operator-restricted-network-install[Configuring Samples Operator for a restricted cluster] - -* link:https://docs.openshift.com/container-platform/4.17/disconnected/mirroring/index.html[About disconnected installation mirroring] - include::modules/op-running-a-pipeline.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources - -* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] - - include::modules/op-adding-triggers.adoc[leveloffset=+1] include::modules/op-configuring-eventlisteners-to-serve-multiple-namespaces.adoc[leveloffset=+1] @@ -67,11 +54,6 @@ include::modules/op-triggering-a-pipelinerun.adoc[leveloffset=+1] include::modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources - -* link:https://docs.openshift.com/container-platform/latest/observability/monitoring/enabling-monitoring-for-user-defined-projects.html[Enabling monitoring for user-defined projects] - include::modules/op-configuring-pull-request-capabilities-in-GitHub-interceptor.adoc[leveloffset=+1] include::modules/op-filtering-pull-requests-using-GitHub-interceptor.adoc[leveloffset=+2] @@ -81,10 +63,10 @@ include::modules/op-validating-pull-requests-using-GitHub-interceptors.adoc[leve [role="_additional-resources"] == Additional resources -* To include {pac} along with the application source code in the same repository, see xref:../pac/about-pipelines-as-code.adoc#about-pipelines-as-code[About {pac}]. -* For more details on pipelines in the *Developer* perspective, see the xref:../create/working-with-pipelines-web-console.adoc#working-with-pipelines-web-console[Working with {pipelines-shortname} in the web console] section. -* To learn more about Security Context Constraints (SCCs), see the link:https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html[Managing Security Context Constraints] section. -* For more examples of reusable tasks, see the link:https://github.com/openshift/pipelines-catalog[OpenShift Catalog] repository. Additionally, you can also see the Tekton Catalog in the Tekton project. -* To install and deploy a custom instance of {tekton-hub} for reusable tasks and pipelines, see xref:../hub/using-tekton-hub-with-openshift-pipelines.adoc#using-tekton-hub-with-openshift-pipelines[Using {tekton-hub} with {pipelines-title}]. -* For more details on re-encrypt TLS termination, see link:https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html#re-encryption-termination[Re-encryption Termination]. -* For more details on secured routes, see the link:https://docs.openshift.com/container-platform/latest/networking/routes/secured-routes.html[Secured routes] section. +* xref:../pac/about-pipelines-as-code.adoc#about-pipelines-as-code[About {pac}] +* xref:../create/working-with-pipelines-web-console.adoc#working-with-pipelines-web-console[Working with {pipelines-shortname} in the web console] +* link:https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html[Managing Security Context Constraints] +* link:https://github.com/openshift/pipelines-catalog[OpenShift Catalog] +* xref:../hub/using-tekton-hub-with-openshift-pipelines.adoc#using-tekton-hub-with-openshift-pipelines[Using {tekton-hub} with {pipelines-title}] +* link:https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html#re-encryption-termination[Re-encryption Termination] +* link:https://docs.openshift.com/container-platform/latest/networking/routes/secured-routes.html[Secured routes] diff --git a/create/using-manual-approval.adoc b/create/using-manual-approval.adoc index e9c2c5325c0..d9588e938b3 100644 --- a/create/using-manual-approval.adoc +++ b/create/using-manual-approval.adoc @@ -20,11 +20,6 @@ include::modules/op-approving-manual-approval-task-about.adoc[leveloffset=+1] include::modules/op-approving-task-web-console.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources - -* xref:../create/working-with-pipelines-web-console.adoc#op-enabling-plugin_working-with-pipelines-web-console[Enabling the {pipelines-shortname} console plugin] - include::modules/op-approving-task-command-line.adoc[leveloffset=+2] include::modules/op-behavior-of-approvaltask-with-groups-and-users.adoc[leveloffset=+1] diff --git a/create/using-rh-entitlements-pipelines.adoc b/create/using-rh-entitlements-pipelines.adoc index 747737fe479..be195350fe7 100644 --- a/create/using-rh-entitlements-pipelines.adoc +++ b/create/using-rh-entitlements-pipelines.adoc @@ -64,5 +64,5 @@ include::modules/op-entitlements-shared-csi-driver.adoc[leveloffset=+1] * link:https://access.redhat.com/articles/simple-content-access[Simple content access] * link:https://docs.openshift.com/container-platform/4.14/support/remote_health_monitoring/using-insights-operator.html[Using Insights Operator] * link:https://docs.openshift.com/container-platform/latest/support/remote_health_monitoring/insights-operator-simple-access.html[Importing simple content access entitlements with Insights Operator] -* https://docs.openshift.com/container-platform/4.14/storage/container_storage_interface/ephemeral-storage-shared-resource-csi-driver-operator.html[Shared Resource CSI Driver Operator] +* link:https://docs.openshift.com/container-platform/4.14/storage/container_storage_interface/ephemeral-storage-shared-resource-csi-driver-operator.html[Shared Resource CSI Driver Operator] * xref:../install_config/customizing-configurations-in-the-tektonconfig-cr.adoc#op-changing-default-service-account_customizing-configurations-in-the-tektonconfig-cr[Changing the default service account for {pipelines-shortname}] diff --git a/create/working-with-pipelines-web-console.adoc b/create/working-with-pipelines-web-console.adoc index 8d6048235de..a63b1ed6bd1 100644 --- a/create/working-with-pipelines-web-console.adoc +++ b/create/working-with-pipelines-web-console.adoc @@ -32,18 +32,9 @@ include::modules/op-editing-pipelines.adoc[leveloffset=+2] include::modules/op-deleting-pipelines.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources - -* xref:../hub/using-tekton-hub-with-openshift-pipelines.adoc#using-tekton-hub-with-openshift-pipelines[Using {tekton-hub} with {pipelines-shortname}] - -// Admin console include::modules/op-creating-pipeline-templates-admin-console.adoc[leveloffset=+1] include::modules/op-console-statistics.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources -* xref:../records/using-tekton-results-for-openshift-pipelines-observability.adoc#using-tekton-results-for-openshift-pipelines-observability[Using {tekton-results} for {pipelines-shortname} observability] include::modules/op-enabling-plugin.adoc[leveloffset=+2] include::modules/op-webstat-general.adoc[leveloffset=+2] diff --git a/hub/using-tekton-hub-with-openshift-pipelines.adoc b/hub/using-tekton-hub-with-openshift-pipelines.adoc index cc99fd994ea..49677ad16c1 100644 --- a/hub/using-tekton-hub-with-openshift-pipelines.adoc +++ b/hub/using-tekton-hub-with-openshift-pipelines.adoc @@ -6,12 +6,12 @@ include::_attributes/common-attributes.adoc[] toc::[] -:FeatureName: {tekton-hub} -include::snippets/technology-preview.adoc[] - [role="_abstract"] {tekton-hub} helps you discover, search, and share reusable tasks and pipelines for your CI/CD workflows. A public instance of {tekton-hub} is available at link:https://hub.tekton.dev/[hub.tekton.dev]. Cluster administrators can also install and deploy a custom instance of {tekton-hub} by modifying the configurations in the `TektonHub` custom resource (CR). +:FeatureName: {tekton-hub} +include::snippets/technology-preview.adoc[] + include::modules/op-installing-and-deploying-tekton-hub-on-an-openshift-cluster.adoc[leveloffset=+1] include::modules/op-installing-tekton-hub-without-login-and-rating.adoc[leveloffset=+2] diff --git a/modules/op-about-pipelinerun.adoc b/modules/op-about-pipelinerun.adoc index 1eb7c704045..7008c7eab18 100644 --- a/modules/op-about-pipelinerun.adoc +++ b/modules/op-about-pipelinerun.adoc @@ -52,4 +52,9 @@ spec: `spec.params`:: The list of parameters required to run the pipeline. -`spec.workspaces`:: Workspace used by the pipeline run. \ No newline at end of file +`spec.workspaces`:: Workspace used by the pipeline run. + +[role="_additional-resources"] +.Additional resources + +* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] \ No newline at end of file diff --git a/modules/op-about-podtemplate.adoc b/modules/op-about-podtemplate.adoc index 86567ced551..cc2a49ecd83 100644 --- a/modules/op-about-podtemplate.adoc +++ b/modules/op-about-podtemplate.adoc @@ -55,3 +55,8 @@ spec: runAsNonRoot: true runAsUser: 1001 ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.openshift.com/container-platform/4.17/nodes/pods/nodes-pods-using.html[Using pods] diff --git a/modules/op-about-stepactions.adoc b/modules/op-about-stepactions.adoc index 4f78ce55df2..55d40b29429 100644 --- a/modules/op-about-stepactions.adoc +++ b/modules/op-about-stepactions.adoc @@ -81,3 +81,8 @@ spec: - name: display_result script: 'echo $(step.apply.results.output)' ---- + +[role="_additional-resources"] +.Additional resources + +* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions using resolvers] diff --git a/modules/op-alternative-approaches-compute-resource-quota-pipelines.adoc b/modules/op-alternative-approaches-compute-resource-quota-pipelines.adoc index 3367e92e4db..7954150ba61 100644 --- a/modules/op-alternative-approaches-compute-resource-quota-pipelines.adoc +++ b/modules/op-alternative-approaches-compute-resource-quota-pipelines.adoc @@ -35,6 +35,20 @@ spec: * Ideally, set the compute resource quota for a pipeline to match the total resources consumed by the pods running at the same time in a pipeline run. However, pods running tasks consume compute resources based on the use case. For example, a Maven build task might need different compute resources for different applications. As a result, you cannot set the compute resource quotas ahead of time for tasks in a generic pipeline. For greater control over compute resource usage, use customized pipelines for different applications. +If your use case is not addressed by these approaches, you can implement a workaround by using a resource quota for a priority class. + +[NOTE] +==== +When using {pipelines-title} in a namespace configured with a `ResourceQuota` object, the pods resulting from task runs and pipeline runs might fail with an error, such as: `failed quota: must specify cpu, memory`. + +To avoid this error, do any one of the following: + +* (Recommended) Specify a limit range for the namespace. +* Explicitly define requests and limits for all containers. + +For more information, see "ResourceQuota error with task runs and pipeline runs" and "Resolution for ResourceQuota errors". +==== + [role="_additional-resources"] .Additional resources @@ -43,3 +57,6 @@ spec: * xref:../resource/reducing-pipelines-resource-consumption.adoc#reducing-pipelines-resource-consumption[Reduce pipeline resource consumption] * link:https://docs.openshift.com/container-platform/latest/applications/quotas/quotas-setting-per-project.html[Resource quotas per project] + +* link:https://issues.redhat.com/browse/SRVKP-1801[ResourceQuota error with task runs and pipeline runs (Red Hat Issue Tracker)] +* link:https://access.redhat.com/solutions/2841971[Resolution for ResourceQuota errors (Red Hat Knowledgebase)] diff --git a/modules/op-approving-task-web-console.adoc b/modules/op-approving-task-web-console.adoc index 7959f7e67cd..9d30dcd6e49 100644 --- a/modules/op-approving-task-web-console.adoc +++ b/modules/op-approving-task-web-console.adoc @@ -27,3 +27,8 @@ If a manual approval task lists you as an approver and a pipeline run reaches th ** To reject the task, select *Reject*. . Enter a message in the *Reason* field. . Click *Submit*. + +[role="_additional-resources"] +.Additional resources + +* xref:../create/working-with-pipelines-web-console.adoc#op-enabling-plugin_working-with-pipelines-web-console[Enabling the {pipelines-shortname} console plugin] diff --git a/modules/op-chains-signing-secrets-cosign.adoc b/modules/op-chains-signing-secrets-cosign.adoc index ba4c53ffdf8..a5c4b58226b 100644 --- a/modules/op-chains-signing-secrets-cosign.adoc +++ b/modules/op-chains-signing-secrets-cosign.adoc @@ -11,7 +11,7 @@ Manually generate cosign signing keys by using the `cosign` tool when you need c .Prerequisites -* You installed the Cosign tool. For information about installing the Cosign tool, see the link:https://docs.sigstore.dev/cosign/system_config/installation/[Sigstore documentation for Cosign]. +* You installed the Cosign tool. .Procedure diff --git a/modules/op-configuring-basic-authentication-for-git.adoc b/modules/op-configuring-basic-authentication-for-git.adoc index ed47a7e194d..ee067ac8824 100644 --- a/modules/op-configuring-basic-authentication-for-git.adoc +++ b/modules/op-configuring-basic-authentication-for-git.adoc @@ -17,12 +17,12 @@ To configure Basic HTTP authentication for a pipeline, create a Basic HTTP authe [NOTE] ==== -GitHub deprecated authentication using a plain password. Instead, use a link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[personal access token]. +GitHub deprecated authentication using a plain password. Instead, use a personal access token. ==== .Procedure -. Create the YAML manifest for the secret in the `secret.yaml` file. In this manifest, specify the username and password or link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[GitHub personal access token] to access the target Git repository. +. Create the YAML manifest for the secret in the `secret.yaml` file. In this manifest, specify the username and password or GitHub personal access token to access the target Git repository. + [source,yaml,subs="attributes+"] ---- @@ -104,3 +104,8 @@ spec: ---- $ oc apply --filename secret.yaml,serviceaccount.yaml,run.yaml ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[Creating a personal access token on GitHub] diff --git a/modules/op-configuring-cosign-for-sbom-verification.adoc b/modules/op-configuring-cosign-for-sbom-verification.adoc index d543b9e168e..ae5785fe3c1 100644 --- a/modules/op-configuring-cosign-for-sbom-verification.adoc +++ b/modules/op-configuring-cosign-for-sbom-verification.adoc @@ -15,9 +15,9 @@ image::sbom.png[Options to download or view SBOMs] .Prerequisites -* You have link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[logged in to the web console]. +* You have logged in to the web console. -* You have the appropriate link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[roles and permissions] in a project to create applications and other workloads in {product-title}. +* You have the appropriate roles and permissions in a project to create applications and other workloads in {product-title}. .Procedure @@ -82,3 +82,9 @@ spec: ``:: The OCI image repository URL that has the `.sbom` images. . Rerun the affected OpenShift Pipeline. + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[Accessing the web console] +* link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[Default roles and permissions] diff --git a/modules/op-configuring-default-maximum-scc.adoc b/modules/op-configuring-default-maximum-scc.adoc index 732ca369cea..6a580e2133c 100644 --- a/modules/op-configuring-default-maximum-scc.adoc +++ b/modules/op-configuring-default-maximum-scc.adoc @@ -36,3 +36,8 @@ spec: + `default`:: `spec.platforms.openshift.scc.default` specifies the default SCC that {pipelines-shortname} attaches to the service account (SA) used for workloads, which is, by default, the `pipeline` SA. {pipelines-shortname} uses this SCC for all pipeline run and task run pods. `maxAllowed`:: `spec.platforms.openshift.scc.maxAllowed` specifies the least restrictive SCC that you can configure for pipeline run and task run pods in any namespace. This setting does not apply when you configure a custom SA and SCC in a particular pipeline run or task run. + +[role="_additional-resources"] +.Additional resources + +* xref:../install_config/customizing-configurations-in-the-tektonconfig-cr.adoc#op-changing-default-service-account_customizing-configurations-in-the-tektonconfig-cr[Changing the default service account for {pipelines-shortname}] diff --git a/modules/op-configuring-ssh-authentication-for-git.adoc b/modules/op-configuring-ssh-authentication-for-git.adoc index ca078aef11c..5560f013d41 100644 --- a/modules/op-configuring-ssh-authentication-for-git.adoc +++ b/modules/op-configuring-ssh-authentication-for-git.adoc @@ -12,7 +12,7 @@ To configure SSH-based authentication for a pipeline, create an authentication s .Procedure -. Generate an link:https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent[SSH private key], or copy an existing private key, which is usually available in the `~/.ssh/id_rsa` file. +. Generate an SSH private key, or copy an existing private key, which is usually available in the `~/.ssh/id_rsa` file. . Create the YAML manifest for the secret in the `secret.yaml` file. In this manifest, set the value of `ssh-privatekey` to the content of the SSH private key file, and set the value of `known_hosts` to the content of the known hosts file. + @@ -103,3 +103,8 @@ spec: ---- $ oc apply --filename secret.yaml,serviceaccount.yaml,run.yaml ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent[Generating a new SSH key and adding it to the ssh-agent] diff --git a/modules/op-console-statistics.adoc b/modules/op-console-statistics.adoc index 49b61a50ea0..f347ebf583d 100644 --- a/modules/op-console-statistics.adoc +++ b/modules/op-console-statistics.adoc @@ -10,7 +10,12 @@ You can view statistics related to execution of pipelines in the web console. To view the statistic information, you must complete the following steps: -* Install {tekton-results}. See _Using Tekton Results for {pipelines-shortname} observability_ in the _Additional resources_ section. +* Install {tekton-results}. See _Using Tekton Results for {pipelines-shortname} observability_. * Enable the {pipelines-shortname} console plugin. You can view statistic information for all pipelines together and for each individual pipeline. + +[role="_additional-resources"] +.Additional resources + +* xref:../records/using-tekton-results-for-openshift-pipelines-observability.adoc#using-tekton-results-for-openshift-pipelines-observability[Using {tekton-results} for {pipelines-shortname} observability] diff --git a/modules/op-constructing-pipelines-using-pipeline-builder.adoc b/modules/op-constructing-pipelines-using-pipeline-builder.adoc index bcdcecb073b..361e21408d9 100644 --- a/modules/op-constructing-pipelines-using-pipeline-builder.adoc +++ b/modules/op-constructing-pipelines-using-pipeline-builder.adoc @@ -18,7 +18,7 @@ In the *Developer* perspective of the console, you can use the *+Add* -> *Pipeli [IMPORTANT] ==== -In the developer perspective, you can create a customized pipeline using your own set of curated tasks. To search, install, and upgrade your tasks directly from the developer console, your cluster administrator needs to install and deploy a local {tekton-hub} instance and link that hub to the {product-title} cluster. For more details, see _Using {tekton-hub} with {pipelines-shortname}_ in the _Additional resources_ section. +In the developer perspective, you can create a customized pipeline using your own set of curated tasks. To search, install, and upgrade your tasks directly from the developer console, your cluster administrator needs to install and deploy a local {tekton-hub} instance and link that hub to the {product-title} cluster. For more details, see _Using {tekton-hub} with {pipelines-shortname}_. If you do not deploy any local {tekton-hub} instance, by default, you can only access namespace tasks and public {tekton-hub} tasks. ==== diff --git a/modules/op-creating-a-github-application-in-administrator-perspective.adoc b/modules/op-creating-a-github-application-in-administrator-perspective.adoc index c673e9c7dd8..cc739a4a385 100644 --- a/modules/op-creating-a-github-application-in-administrator-perspective.adoc +++ b/modules/op-creating-a-github-application-in-administrator-perspective.adoc @@ -36,5 +36,5 @@ To view details such as name, link, and secret associated with the GitHub applic [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps[About creating GitHub Apps on GitHub] (GitHub) +* link:https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps[About creating GitHub Apps on GitHub (GitHub)] diff --git a/modules/op-customizing-pipelines-as-code-configuration.adoc b/modules/op-customizing-pipelines-as-code-configuration.adoc index 2e7107835bb..6d97966bec6 100644 --- a/modules/op-customizing-pipelines-as-code-configuration.adoc +++ b/modules/op-customizing-pipelines-as-code-configuration.adoc @@ -20,7 +20,7 @@ To customize {pac}, cluster administrators can configure the following parameter | `remote-tasks` | When enabled, allows remote tasks from pipeline run annotations. | `enabled` -| `hub-url` | The base URL for the link:https://artifacthub.io[{artifact-hub}]. | `https://artifacthub.io` +| `hub-url` | The base URL for the {artifact-hub}. | `https://artifacthub.io` | `hub-catalog-name` | The {tekton-hub} catalog name. | `tekton` @@ -57,3 +57,8 @@ To customize {pac}, cluster administrators can configure the following parameter | `enable-cancel-in-progress-on-push` | Cancels in-progress pipeline runs when a user pushes a new commit. {pac} cancels the old run only after the new one starts. The `cancel-in-progress` annotation on individual runs overrides this setting. | `false` |=== + +[role="_additional-resources"] +.Additional resources + +* link:https://artifacthub.io[{artifact-hub}] diff --git a/modules/op-default-pruner-configuration.adoc b/modules/op-default-pruner-configuration.adoc index 52d7b993dfd..9e9d8ca8180 100644 --- a/modules/op-default-pruner-configuration.adoc +++ b/modules/op-default-pruner-configuration.adoc @@ -36,7 +36,7 @@ spec: | Parameter | Description |`schedule` -|The cron schedule for running the pruner process. The default schedule runs the process at 08:00 every day. For more information about the cron schedule syntax, see link:https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#cron-schedule-syntax[Cron schedule syntax] in the Kubernetes documentation. +|The cron schedule for running the pruner process. The default schedule runs the process at 08:00 every day. For more information about the cron schedule syntax, see Cron schedule syntax in the Kubernetes documentation. |`resources` |The resource types to which the pruner applies. The available resource types are `taskrun` and `pipelinerun` @@ -63,3 +63,8 @@ For example, if you set `keep` to `100`, then the pruner keeps 100 most recent p ==== The `keep` and `keep-since` parameters are mutually exclusive. Use only one of them in your configuration. ==== + +[role="_additional-resources"] +.Additional resources + +* link:https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#cron-schedule-syntax[Cron schedule syntax (Kubernetes documentation)] diff --git a/modules/op-diagnosing-a-pipeline-with-opc-assist.adoc b/modules/op-diagnosing-a-pipeline-with-opc-assist.adoc index 6649bcbf729..e32a6ee04da 100644 --- a/modules/op-diagnosing-a-pipeline-with-opc-assist.adoc +++ b/modules/op-diagnosing-a-pipeline-with-opc-assist.adoc @@ -12,7 +12,7 @@ If a `PipelineRun` execution fails, you can use the `opc assist` CLI command to [IMPORTANT] ==== -To use the `opc assist` CLI command, you must install and configure link:https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/latest/html/install/ols-installing-lightspeed[{ols-official}] on your cluster. +To use the `opc assist` CLI command, you must install and configure {ols-official} on your cluster. ==== :FeatureName: Running {pipelines-title} with the `opc` CLI tool @@ -51,3 +51,8 @@ $ opc assist taskrun diagnose -n where: ``:: Specifies the name of the failed `TaskRun` object. ``:: Specifies the name of the project (namespace) where you executed the pipeline. + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/latest/html/install/ols-installing-lightspeed[Installing {ols-official}] diff --git a/modules/op-downloading-an-sbom.adoc b/modules/op-downloading-an-sbom.adoc index ab5bbc80ae3..8b92c0e854d 100644 --- a/modules/op-downloading-an-sbom.adoc +++ b/modules/op-downloading-an-sbom.adoc @@ -10,7 +10,7 @@ You can download a software bill of materials (SBOM) for a pipeline run by using .Prerequisites -* You have installed the Cosign CLI tool. For information about installing the Cosign tool, see the link:https://docs.sigstore.dev/cosign/system_config/installation/[Sigstore documentation for Cosign]. +* You have installed the Cosign CLI tool. * You have set up {pipelines-shortname} to download or view SBOMs. @@ -31,3 +31,8 @@ $ cosign download sbom quay.io//user-workload@sha256 ---- $ cosign download sbom quay.io//user-workload@sha256 > sbom.txt ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.sigstore.dev/cosign/system_config/installation/[Sigstore documentation for Cosign] diff --git a/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc b/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc index ec2b47a4468..9723fdb3e62 100644 --- a/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc +++ b/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc @@ -56,3 +56,8 @@ $ git commit -m "empty-commit" --allow-empty && git push origin main ---- . On the {OCP} web console, navigate to **Administrator** -> **Observe** -> **Metrics**. . To view a metric, search by its name. For example, to view the details of the `eventlistener_http_resources` metric for the `github-listener` event listener, search using the `eventlistener_http_resources` keyword. + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.openshift.com/container-platform/latest/observability/monitoring/enabling-monitoring-for-user-defined-projects.html[Enabling monitoring for user-defined projects] diff --git a/modules/op-installing-pipelines-as-code-cli.adoc b/modules/op-installing-pipelines-as-code-cli.adoc index af3d9fd70d4..bd8534cf6ed 100644 --- a/modules/op-installing-pipelines-as-code-cli.adoc +++ b/modules/op-installing-pipelines-as-code-cli.adoc @@ -1,7 +1,7 @@ // This module is included in the following assemblies: // * pac/install-config-pipelines-as-code.adoc -:_mod-docs-content-type: CONCEPT +:_mod-docs-content-type: REFERENCE [id="installing-pipelines-as-code-cli_{context}"] = Installing {pac} CLI diff --git a/modules/op-installing-pipelines-as-code-on-an-openshift-cluster.adoc b/modules/op-installing-pipelines-as-code-on-an-openshift-cluster.adoc index 67625f9f5d0..e4189e228c0 100644 --- a/modules/op-installing-pipelines-as-code-on-an-openshift-cluster.adoc +++ b/modules/op-installing-pipelines-as-code-on-an-openshift-cluster.adoc @@ -6,7 +6,7 @@ = Installing {pac} on an {OCP} [role="_abstract"] -When you install the {pipelines-title} Operator, the system installs {pac} in the `openshift-pipelines` namespace. For more details, see _Installing {pipelines-shortname}_ in the _Additional resources_ section. +When you install the {pipelines-title} Operator, the system installs {pac} in the `openshift-pipelines` namespace. For more details, see _Installing {pipelines-shortname}_. .Procedure diff --git a/modules/op-installing-tekton-hub-with-login-and-rating.adoc b/modules/op-installing-tekton-hub-with-login-and-rating.adoc index 249787a2c19..b1c2754309d 100644 --- a/modules/op-installing-tekton-hub-with-login-and-rating.adoc +++ b/modules/op-installing-tekton-hub-with-login-and-rating.adoc @@ -15,11 +15,11 @@ You can install {tekton-hub} on your cluster with custom configuration that supp . Create an OAuth application with your Git repository hosting provider, and note the Client ID and Client Secret. The supported providers are GitHub, GitLab, and Bitbucket. -** For a link:https://docs.github.com/en/developers/apps/creating-an-oauth-app[GitHub OAuth application], set the Homepage URL and the Authorization callback URL as ``. +** For a GitHub OAuth application, set the Homepage URL and the Authorization callback URL as ``. -** For a link:https://docs.gitlab.com/ee/integration/oauth_provider.html#user-owned-applications[GitLab OAuth application], set the `REDIRECT_URI` as `/auth/gitlab/callback`. +** For a GitLab OAuth application, set the `REDIRECT_URI` as `/auth/gitlab/callback`. -** For a link:https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud[Bitbucket OAuth application], set the `Callback URL` as ``. +** For a Bitbucket OAuth application, set the `Callback URL` as ``. . Edit the `/config/02-api/20-api-secret.yaml` file to include the {tekton-hub} API secrets. For example: + @@ -141,4 +141,11 @@ $ oc get tektonhub.operator.tekton.dev ---- NAME VERSION READY REASON APIURL UIURL hub v1.9.0 True https://api.route.url/ https://ui.route.url/ ----- \ No newline at end of file +---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.github.com/en/developers/apps/creating-an-oauth-app[Creating a GitHub OAuth application] +* link:https://docs.gitlab.com/ee/integration/oauth_provider.html#user-owned-applications[Creating a GitLab OAuth application] +* link:https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud[Using OAuth on Bitbucket Cloud] diff --git a/modules/op-installing-tkn-on-windows.adoc b/modules/op-installing-tkn-on-windows.adoc index 5414166bd8f..820884bf98e 100644 --- a/modules/op-installing-tkn-on-windows.adoc +++ b/modules/op-installing-tkn-on-windows.adoc @@ -11,7 +11,7 @@ For Windows, you can download the CLI as a `zip` archive. .Procedure -. Download the link:https://mirror.openshift.com/pub/cgw/pipelines/{pipelines-version-number}.{osp-version-patch}/tkn-windows-amd64.zip[CLI tool]. +. Download the CLI tool. // Binaries also need to be updated in the following modules: // op-installing-tkn-on-linux.adoc @@ -32,3 +32,8 @@ endif::openshift-rosa,openshift-dedicated[] ---- C:\> path ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://mirror.openshift.com/pub/cgw/pipelines/{pipelines-version-number}.{osp-version-patch}/tkn-windows-amd64.zip[Download the {pipelines-title} CLI tool for Windows] diff --git a/modules/op-lightspeed-utility-commands.adoc b/modules/op-lightspeed-utility-commands.adoc index def00f638ef..48d942f9beb 100644 --- a/modules/op-lightspeed-utility-commands.adoc +++ b/modules/op-lightspeed-utility-commands.adoc @@ -8,7 +8,7 @@ [role="_abstract"] Use the {pipelines-shortname} Client (opc) to access generative AI-powered diagnostics. These commands use {ols-official} to analyze pipeline failures and give actionable troubleshooting guidance. -For installation and configuration of {ols}, see the link:https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/latest[{ols-official} documentation]. +For installation and configuration of {ols}, see the {ols-official} documentation. :FeatureName: Running {pipelines-title} with the `opc` CLI tool include::snippets/technology-preview.adoc[] @@ -35,3 +35,8 @@ where: ``:: Specifies the name of the failed `PipelineRun` or `TaskRun` object. ``:: Specifies the name of the namespace containing the `PipelineRun` or `TaskRun` object. + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.redhat.com/en/documentation/red_hat_openshift_lightspeed/latest[{ols-official} documentation] diff --git a/modules/op-mirroring-images-to-run-pipelines-in-restricted-environment.adoc b/modules/op-mirroring-images-to-run-pipelines-in-restricted-environment.adoc index 5dc3f0b7c7f..6b85f11a20c 100644 --- a/modules/op-mirroring-images-to-run-pipelines-in-restricted-environment.adoc +++ b/modules/op-mirroring-images-to-run-pipelines-in-restricted-environment.adoc @@ -204,3 +204,10 @@ latest [...] ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.openshift.com/container-platform/latest/openshift_images/configuring-samples-operator.html#samples-operator-restricted-network-install[Configuring Samples Operator for a restricted cluster] + +* link:https://docs.openshift.com/container-platform/4.17/disconnected/mirroring/index.html[About disconnected installation mirroring] diff --git a/modules/op-modifiable-fields-with-default-values.adoc b/modules/op-modifiable-fields-with-default-values.adoc index a16e2c92189..2c282d46797 100644 --- a/modules/op-modifiable-fields-with-default-values.adoc +++ b/modules/op-modifiable-fields-with-default-values.adoc @@ -23,7 +23,7 @@ For clusters that use injected sidecars, setting this field to `false` can lead * `require-git-ssh-secret-known-hosts` (default: `false`): Setting this field to `true` requires that any Git SSH secret must include the `known_hosts` field. -** For more information about configuring Git SSH secrets, see _Configuring SSH authentication for Git_ in the _Additional resources_ section. +** For more information about configuring Git SSH secrets, see _Configuring SSH authentication for Git_. * `enable-tekton-oci-bundles` (default: `false`): Set this field to `true` to enable the use of an experimental alpha feature named Tekton OCI bundle. diff --git a/modules/op-monitoring-pipeline-run-status-using-pipelines-as-code.adoc b/modules/op-monitoring-pipeline-run-status-using-pipelines-as-code.adoc index debc188d053..6414f8d7e93 100644 --- a/modules/op-monitoring-pipeline-run-status-using-pipelines-as-code.adoc +++ b/modules/op-monitoring-pipeline-run-status-using-pipelines-as-code.adoc @@ -73,3 +73,12 @@ Using the `tkn pac describe` command, you can extract the status of the runs ass *Notifications* {pac} does not manage notifications. If you need to have notifications, use the `finally` feature of pipelines. + +[role="_additional-resources"] +.Additional resources + +* link:https://github.com/chmouel/tekton-slack-task-status[An example task to send Slack messages on success or failure] + +* link:https://github.com/openshift-pipelines/pipelines-as-code/blob/7b41cc3f769af40a84b7ead41c6f037637e95070/.tekton/push.yaml[An example of a pipeline run with `finally` tasks triggered on push events] + +* link:https://github.com/openshift-pipelines/pipelines-as-code/blob/main/test/testdata/pipelinerun_git_clone_private.yaml[An example of the `git-clone` task used for cloning private repositories] diff --git a/modules/op-odc-pipelines-abstract.adoc b/modules/op-odc-pipelines-abstract.adoc index 3b009b7f5b0..5cacfbe8a1a 100644 --- a/modules/op-odc-pipelines-abstract.adoc +++ b/modules/op-odc-pipelines-abstract.adoc @@ -13,3 +13,8 @@ In the *Developer* perspective, you can access the following options for creatin * Use the *+Add* -> *From Git* option to create pipelines using pipeline templates and resources while creating an application. After you create the pipelines for your application, you can view and visually interact with the deployed pipelines in the *Pipelines* view. You can also use the *Topology* view to interact with the pipelines created using the *From Git* option. You must apply custom labels to pipelines created using the *Pipeline builder* to see them in the *Topology* view. + +[role="_additional-resources"] +.Additional resources + +* xref:../hub/using-tekton-hub-with-openshift-pipelines.adoc#using-tekton-hub-with-openshift-pipelines[Using {tekton-hub} with {pipelines-shortname}] diff --git a/modules/op-pac-configuring-github-app-cli.adoc b/modules/op-pac-configuring-github-app-cli.adoc index 4c177e11e5a..b76001e46cf 100644 --- a/modules/op-pac-configuring-github-app-cli.adoc +++ b/modules/op-pac-configuring-github-app-cli.adoc @@ -42,5 +42,5 @@ $ tkn pac bootstrap github-app --github-api-url https://github.com/enterprises/e [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub] (GitHub) +* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub (GitHub)] diff --git a/modules/op-pac-configuring-github-app-manually.adoc b/modules/op-pac-configuring-github-app-manually.adoc index 3b64c7bcabb..8d8748f44c9 100644 --- a/modules/op-pac-configuring-github-app-manually.adoc +++ b/modules/op-pac-configuring-github-app-manually.adoc @@ -102,4 +102,4 @@ $ oc -n openshift-pipelines create secret generic pipelines-as-code-secret \ [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub] (GitHub) +* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub (GitHub)] diff --git a/modules/op-pipelines-as-code-command-reference.adoc b/modules/op-pipelines-as-code-command-reference.adoc index c1a08412e06..76fd30c8a8a 100644 --- a/modules/op-pipelines-as-code-command-reference.adoc +++ b/modules/op-pipelines-as-code-command-reference.adoc @@ -87,7 +87,7 @@ When executed from the directory containing the source code, it automatically de In addition, it uses basic language detection capability and adds extra tasks depending on the language. -For example, if it detects a `setup.py` file at the repository root, the link:https://hub.tekton.dev/tekton/task/pylint[pylint task] is automatically added to the generated pipeline run. +For example, if it detects a `setup.py` file at the repository root, the pylint task is automatically added to the generated pipeline run. |=== @@ -234,3 +234,8 @@ The `tkn pac cel` command maintains a persistent history and creates the `cel-hi * *Linux or macOS:* `~/.cache/tkn-pac/cel-history` * *Windows:* `%USERPROFILE%\.cache\tkn-pac\cel-history` + +[role="_additional-resources"] +.Additional resources + +* link:https://hub.tekton.dev/tekton/task/pylint[pylint task on {tekton-hub}] diff --git a/modules/op-pipelines-as-code-resolver-annotations.adoc b/modules/op-pipelines-as-code-resolver-annotations.adoc index 4914a48aaf4..75e85de842c 100644 --- a/modules/op-pipelines-as-code-resolver-annotations.adoc +++ b/modules/op-pipelines-as-code-resolver-annotations.adoc @@ -12,10 +12,7 @@ If you reference a remote task in a pipeline run, or a pipeline in a `PipelineRu [NOTE] ==== -Red Hat deprecated the public instance of {tekton-hub} (`hub.tekton.dev`) and will remove it in a future release. Use link:https://artifacthub.io[{artifact-hub}] as an alternative for Tekton `Pipeline` and `Task` resources: - -* link:https://artifacthub.io/packages/search?repo=tekton-catalog-tasks[Tekton Catalog Tasks] -* link:https://artifacthub.io/packages/search?repo=tekton-catalog-pipelines[Tekton Catalog Pipelines] +Red Hat deprecated the public instance of {tekton-hub} (`hub.tekton.dev`) and will remove it in a future release. Use {artifact-hub} as an alternative for Tekton `Pipeline` and `Task` resources, including Tekton Catalog Tasks and Tekton Catalog Pipelines. {artifact-hub} is open source and supports self-hosting, providing greater flexibility for managing your Tekton `Pipeline` and `Task` resources. ==== @@ -23,5 +20,7 @@ Red Hat deprecated the public instance of {tekton-hub} (`hub.tekton.dev`) and wi [role="_additional-resources"] .Additional resources +* link:https://artifacthub.io[{artifact-hub}] * link:https://artifacthub.io/packages/search?repo=tekton-catalog-tasks[Tekton Catalog Tasks on Artifact Hub] +* link:https://artifacthub.io/packages/search?repo=tekton-catalog-pipelines[Tekton Catalog Pipelines on Artifact Hub] diff --git a/modules/op-preventing-taskrun-pod-eviction-during-node-maintenance.adoc b/modules/op-preventing-taskrun-pod-eviction-during-node-maintenance.adoc index 94482806cc6..9153d0e443b 100644 --- a/modules/op-preventing-taskrun-pod-eviction-during-node-maintenance.adoc +++ b/modules/op-preventing-taskrun-pod-eviction-during-node-maintenance.adoc @@ -11,7 +11,7 @@ You can prevent eviction of running Tekton `TaskRun` pods during node maintenanc .Prerequisites * You have access to an {OCP} cluster. -* You have installed the xref:../install_config/installing-pipelines.adoc#installing-pipelines[{pipelines-shortname} Operator] in your cluster. +* You have installed the {pipelines-shortname} Operator in your cluster. * You have identified the tasks or pipelines that require protection from eviction. .Procedure @@ -78,4 +78,9 @@ $ oc get pdb tekton-protect -n ci $ oc adm drain --ignore-daemonsets ---- + -If you configured the PDB correctly, the drain operation pauses while the protected pod is running. \ No newline at end of file +If you configured the PDB correctly, the drain operation pauses while the protected pod is running. + +[role="_additional-resources"] +.Additional resources + +* xref:../install_config/installing-pipelines.adoc#installing-pipelines[Installing the {pipelines-shortname} Operator] diff --git a/modules/op-querying-results-records-about.adoc b/modules/op-querying-results-records-about.adoc index e3e2c028006..c435cf81190 100644 --- a/modules/op-querying-results-records-about.adoc +++ b/modules/op-querying-results-records-about.adoc @@ -6,8 +6,13 @@ = Querying {tekton-results} for results and records [role="_abstract"] -You can use the `opc` command line utility to query {tekton-results} for results and records. To install the `opc` command line utility, install the package for the `tkn` command line utility. For instructions about installing this package, see xref:../tkn_cli/installing-tkn.adoc#installing-tkn[Installing tkn]. +You can use the `opc` command line utility to query {tekton-results} for results and records. To install the `opc` command line utility, install the package for the `tkn` command line utility. You can use the names of records and results to retrieve the data in them. You can search for results and records by using Common Expression Language (CEL) queries. These searches display the universally unique identifiers (UUIDs) of the results or records. You can use the provided examples to create queries for common search types. You can also use reference information to create other queries. + +[role="_additional-resources"] +.Additional resources + +* xref:../tkn_cli/installing-tkn.adoc#installing-tkn[Installing tkn] diff --git a/modules/op-release-notes-1-20-0.adoc b/modules/op-release-notes-1-20-0.adoc index 7a96129582a..e5c6b9b9951 100644 --- a/modules/op-release-notes-1-20-0.adoc +++ b/modules/op-release-notes-1-20-0.adoc @@ -20,7 +20,7 @@ Pod anti-affinity rule added to controller replicas:: * {pipelines-shortname} adds and applies the `preferredDuringSchedulingIgnoredDuringExecution` pod anti-affinity rule to controller replicas, except for the {tekton-chains} controllers. In High Availability (HA) setups, this rule distributes replicas across different nodes instead of scheduling them on the same node, improving resiliency, load balancing, and availability. No additional configuration is required. New buildah-ns task for improved container build security:: -* {pipelines-shortname} adds the `buildah-ns` task. It improves container build security with user namespace isolation and remains compatible with the existing `buildah` task. For more information, see "Additional resources". +* {pipelines-shortname} adds the `buildah-ns` task. It improves container build security with user namespace isolation and remains compatible with the existing `buildah` task. `readOnlyRootFilesystem` enabled for default deployments:: * Containers in the {pipelines-shortname}, {tekton-results}, {tekton-chains}, and Manual Approval Gate deployments have `readOnlyRootFilesystem` setting enabled by default, improving security and compliance. @@ -42,7 +42,7 @@ include::snippets/technology-preview.adoc[] .Operator Independent control of RBAC and CA bundle config map creation:: -* With this update, you can independently control whether the {pipelines-shortname} Operator creates role-based access control (RBAC) resources and Trusted Certificate Authority (CA) bundle config maps in your cluster. This enhancement gives you more flexibility to fit your environment and helps avoid resource duplication. By default, both options are enabled to keep the existing behavior. For more information, see "Additional resources". +* With this update, you can independently control whether the {pipelines-shortname} Operator creates role-based access control (RBAC) resources and Trusted Certificate Authority (CA) bundle config maps in your cluster. This enhancement gives you more flexibility to fit your environment and helps avoid resource duplication. By default, both options are enabled to keep the existing behavior. .Pruner @@ -114,7 +114,7 @@ Detailed logging for GitHub API calls:: * {pac} supports detailed logging for GitHub API calls, providing insights into API interactions, durations, and rate-limiting. By setting the controller log level to 'debug', you can troubleshoot complex issues more efficiently. This enhancement refactors code to instrument GitHub calls and affects all types of GitHub API calls within the provider. For more information, see link:https://pipelinesascode.com/docs/install/logging/#debugging-api-interactions[Debugging API interactions]. New autoconfigure-repo-repository-template option:: -* {pac} adds the `auto-configure-repo-repository-template` setting, a new option in `auto-configure-new-github-repo` feature setting to combine repository creation within a single namespace, streamlining management for those with many repositories. For more information, see "Additional resources". +* {pac} adds the `auto-configure-repo-repository-template` setting, a new option in `auto-configure-new-github-repo` feature setting to combine repository creation within a single namespace, streamlining management for those with many repositories. Support for relative task references in remote Pipeline definitions:: * You can use relative paths to reference tasks from within a remote `Pipeline` definition. The {pac} resolver automatically builds the full URL for the task based on the location of the remote `PipelineSpec` definition. This enhancement improves pipeline organization and portability, particularly when working with tagged releases or branches. For more information, see link:https://pipelinesascode.com/docs/guide/resolver/#overriding-tasks-from-a-remote-pipeline-on-a-pipelinerun[Overriding tasks from a remote pipeline on a `PipelineRun`]. @@ -123,13 +123,13 @@ Support for relative task references in remote Pipeline definitions:: include::snippets/technology-preview.adoc[] New dynamic pull_request_number variable for push events:: -* Pull requests that trigger a push event automatically populate a new {pac} dynamic `pull_request_number` variable, allowing for a clear reference to the specific pull request associated with the push event and improving traceability. For more information, see "Additional resources". +* Pull requests that trigger a push event automatically populate a new {pac} dynamic `pull_request_number` variable, allowing for a clear reference to the specific pull request associated with the push event and improving traceability. [id="pipelines-breaking-changes-1-20-0_{context}"] == Breaking changes -* The public instance of {tekton-hub} (`hub.tekton.dev`) is deprecated and will be removed in a future release. For more information, see "Additional resources". +* The public instance of {tekton-hub} (`hub.tekton.dev`) is deprecated and will be removed in a future release. * Git resolver no longer sets `TEKTON_HUB_API` to the public hub. You must set the environment variable when pointing to a self-hosted hub. For more information, see link:https://tekton.dev/docs/operator/tektonconfig/#resolvers[Resolvers]. diff --git a/modules/op-resolver-hub-about.adoc b/modules/op-resolver-hub-about.adoc index ce57114a37f..de845a617e9 100644 --- a/modules/op-resolver-hub-about.adoc +++ b/modules/op-resolver-hub-about.adoc @@ -6,14 +6,18 @@ = Specifying a remote pipeline, task, or step action from a Tekton catalog [role="_abstract"] -You can use the hub resolver to specify a remote pipeline, task, or `StepAction` definition from a public Tekton catalog of link:https://artifacthub.io/[{artifact-hub}] or from an instance of {tekton-hub}. +You can use the hub resolver to specify a remote pipeline, task, or `StepAction` definition from a public Tekton catalog of {artifact-hub} or from an instance of {tekton-hub}. [NOTE] ==== -The public instance of {tekton-hub} (`hub.tekton.dev`) is deprecated and Red Hat will remove it in a future release. Use link:https://artifacthub.io[{artifact-hub}] as an alternative for Tekton `Pipeline` and `Task` resources: - -* link:https://artifacthub.io/packages/search?repo=tekton-catalog-tasks[Tekton Catalog Tasks] -* link:https://artifacthub.io/packages/search?repo=tekton-catalog-pipelines[Tekton Catalog Pipelines] +The public instance of {tekton-hub} (`hub.tekton.dev`) is deprecated and Red Hat will remove it in a future release. Use {artifact-hub} as an alternative for Tekton `Pipeline` and `Task` resources. {artifact-hub} is open source and supports self-hosting, providing greater flexibility for managing your Tekton `Pipeline` and `Task` resources. ==== + +[role="_additional-resources"] +.Additional resources + +* link:https://artifacthub.io/[{artifact-hub}] +* link:https://artifacthub.io/packages/search?repo=tekton-catalog-tasks[Tekton Catalog Tasks] +* link:https://artifacthub.io/packages/search?repo=tekton-catalog-pipelines[Tekton Catalog Pipelines] diff --git a/modules/op-results-reference-records.adoc b/modules/op-results-reference-records.adoc index 3e51af1f38a..fdef2bb5f0d 100644 --- a/modules/op-results-reference-records.adoc +++ b/modules/op-results-reference-records.adoc @@ -29,3 +29,8 @@ You can use the following fields in Common Expression Language (CEL) queries for |=== Because the `data` field has the entire YAML data for the task run or pipeline run, you can use all elements of this data in your CEL query. For example, `data.status.completionTime` has the completion time of the task run or pipeline run. + +[role="_additional-resources"] +.Additional resources + +* link:https://cel.dev/[Common Expression Language (CEL)] diff --git a/modules/op-running-a-pipeline.adoc b/modules/op-running-a-pipeline.adoc index aba85f34b82..9bb34750436 100644 --- a/modules/op-running-a-pipeline.adoc +++ b/modules/op-running-a-pipeline.adoc @@ -86,3 +86,8 @@ Note the output of the earlier command. You can access the application by using ---- $ tkn pipeline start build-and-deploy --last ---- + +[role="_additional-resources"] +.Additional resources + +* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] diff --git a/modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc b/modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc index f2350cf2a04..9bf88b29c0b 100644 --- a/modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc +++ b/modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc @@ -10,7 +10,7 @@ When using the `pipelines-scc` SCC associated with the default `pipelines` servi [NOTE] ==== -For more information about pod timeouts, see link:https://bugzilla.redhat.com/show_bug.cgi?id=1995779[BZ#1995779]. +For more information about pod timeouts, see BZ#1995779. ==== To avoid pod timeouts, you can create a custom SCC with the `fsGroup.type` parameter set to `RunAsAny`, and associate it with a custom service account. @@ -126,3 +126,8 @@ spec: taskRunTemplate: serviceAccountName: 'fsgroup-runasany' ---- + +[role="_additional-resources"] +.Additional resources + +* link:https://bugzilla.redhat.com/show_bug.cgi?id=1995779[BZ#1995779 - Pod timeouts with pipelines-scc SCC] diff --git a/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc b/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc index e9c52a2a258..da1ca4d7d2d 100644 --- a/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc +++ b/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc @@ -23,9 +23,9 @@ Visual representation of identified vulnerabilities is available starting from t .Prerequisites -* You have link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[logged in to the web console]. +* You have logged in to the web console. -* You have the appropriate link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[roles and permissions] in a project to create applications and other workloads in {product-title}. +* You have the appropriate roles and permissions in a project to create applications and other workloads in {product-title}. * You have an existing vulnerability scan task. @@ -51,7 +51,7 @@ jq -rce \ + [NOTE] ==== -You might need to adjust the link:https://jqlang.github.io/jq/download/[jq] command for different JSON structures. +You might need to adjust the jq command for different JSON structures. ==== .. (Optional) If you do not have a vulnerability scan task, create one in the following format: @@ -142,6 +142,9 @@ spec: [role="_additional-resources"] .Additional resources -* link:https://developers.redhat.com/products/trusted-application-pipeline/overview[Review Red{nbsp}Hat Trusted Application Pipeline (RHTAP) for a customizable end-to-end solution for building applications] +* link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[Accessing the web console] +* link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[Default roles and permissions] +* link:https://jqlang.github.io/jq/download/[Downloading jq] +* link:https://developers.redhat.com/products/trusted-application-pipeline/overview[Review Red{nbsp}Hat Trusted Application Pipeline (RHTAP) for a customizable end-to-end solution for building applications] * link:https://docs.redhat.com/en/documentation/red_hat_trusted_application_pipeline/1.0/html/getting_started_with_red_hat_trusted_application_pipeline/index[Getting Started with Red{nbsp}Hat Trusted Application Pipeline] \ No newline at end of file diff --git a/modules/op-specifying-pipelines-resource-quota-using-priority-class.adoc b/modules/op-specifying-pipelines-resource-quota-using-priority-class.adoc index 8813be2bec5..40ccb5c376d 100644 --- a/modules/op-specifying-pipelines-resource-quota-using-priority-class.adoc +++ b/modules/op-specifying-pipelines-resource-quota-using-priority-class.adoc @@ -202,7 +202,7 @@ The pipeline run might fail with an error: `failed quota: must spec To avoid this error, set a limit range for the namespace, where the defaults from the `LimitRange` object apply to pods created during the build process. -For more information about setting limit ranges, see _Restrict resource consumption with limit ranges_ in the _Additional resources_ section. +For more information about setting limit ranges, see _Restrict resource consumption with limit ranges_. ==== + [NOTE] diff --git a/modules/op-supported-parameters-tekton-chains-configuration.adoc b/modules/op-supported-parameters-tekton-chains-configuration.adoc index a4c52a0a124..12f2e4db705 100644 --- a/modules/op-supported-parameters-tekton-chains-configuration.adoc +++ b/modules/op-supported-parameters-tekton-chains-configuration.adoc @@ -109,7 +109,7 @@ Cluster administrators can use various supported parameter keys and values to co | `signers.kms.kmsref` | The URI reference to a KMS service to use in `kms` signers. -| Supported schemes: `gcpkms://`, `awskms://`, `azurekms://`, `hashivault://`. See link:https://docs.sigstore.dev/cosign/key_management/overview/#providers[Providers] in the Sigstore documentation for more details. +| Supported schemes: `gcpkms://`, `awskms://`, `azurekms://`, `hashivault://`. See Providers in the Sigstore documentation for more details. | |=== @@ -128,7 +128,7 @@ Cluster administrators can use various supported parameter keys and values to co | `storage.oci.repository` | The OCI repository for storing OCI signatures and attestation. -| If you configure one of the artifact storage backends to `oci` and do not define this key, {tekton-chains} stores the attestation alongside the stored OCI artifact itself. If you define this key, the attestation is not stored alongside the OCI artifact and is instead stored in the designated location. See the link:https://github.com/sigstore/cosign#specifying-registry[cosign documentation] for additional information. +| If you configure one of the artifact storage backends to `oci` and do not define this key, {tekton-chains} stores the attestation alongside the stored OCI artifact itself. If you define this key, the attestation is not stored alongside the OCI artifact and is instead stored in the designated location. See the cosign documentation for additional information. | | `builder.id` @@ -146,7 +146,7 @@ Cluster administrators can use various supported parameter keys and values to co * Supported parameters for docstore storage + -If you enable the `docdb` storage method for any artifacts, configure docstore storage options. For more information about the go-cloud docstore URI format, see the link:https://gocloud.dev/howto/docstore/[docstore package documentation]. {pipelines-title} supports the following docstore services: +If you enable the `docdb` storage method for any artifacts, configure docstore storage options. For more information about the go-cloud docstore URI format, see the docstore package documentation. {pipelines-title} supports the following docstore services: + -- ** `firestore` @@ -179,7 +179,7 @@ If you enable the `docdb` storage method for any artifacts, configure docstore s * Supported parameters for Grafeas storage + -If you enable the `grafeas` storage method for any artifacts, configure Grafeas storage options. For more information about Grafeas notes and occurrences, see link:https://github.com/grafeas/grafeas/blob/master/docs/grafeas_concepts.md[Grafeas concepts]. +If you enable the `grafeas` storage method for any artifacts, configure Grafeas storage options. For more information about Grafeas notes and occurrences, see Grafeas concepts. To create occurrences, {pipelines-title} must first create notes that link occurrences. {pipelines-title} creates two types of occurrences: `ATTESTATION` Occurrence and `BUILD` Occurrence. @@ -326,3 +326,11 @@ Give this file as a secret and configure mounting this file for the {tekton-chai | | |=== + +[role="_additional-resources"] +.Additional resources + +* link:https://docs.sigstore.dev/cosign/key_management/overview/#providers[Providers (Sigstore documentation)] +* link:https://github.com/sigstore/cosign#specifying-registry[Cosign documentation for specifying registry] +* link:https://gocloud.dev/howto/docstore/[Docstore package documentation] +* link:https://github.com/grafeas/grafeas/blob/master/docs/grafeas_concepts.md[Grafeas concepts] diff --git a/modules/op-tkn-pipelines-compatibility-support-matrix.adoc b/modules/op-tkn-pipelines-compatibility-support-matrix.adoc index c2aa51693d3..363a9263d4c 100644 --- a/modules/op-tkn-pipelines-compatibility-support-matrix.adoc +++ b/modules/op-tkn-pipelines-compatibility-support-matrix.adoc @@ -6,7 +6,7 @@ = Compatibility and support matrix [role="_abstract"] -Some features in this release are currently in link:https://access.redhat.com/support/offerings/techpreview[Technology Preview]. These experimental features are not intended for production use. +Some features in this release are currently in Technology Preview. These experimental features are not intended for production use. In the table, the following statuses mark each feature: @@ -35,3 +35,8 @@ The OpenShift console plugin for {pipelines-shortname} follows the same version ==== For questions and feedback, you can send an email to the product team at pipelines-interest@redhat.com. + +[role="_additional-resources"] +.Additional resources + +* link:https://access.redhat.com/support/offerings/techpreview[Technology Preview] diff --git a/modules/op-using-pipelines-as-code-with-a-github-app.adoc b/modules/op-using-pipelines-as-code-with-a-github-app.adoc index f88c4250335..0584fb56921 100644 --- a/modules/op-using-pipelines-as-code-with-a-github-app.adoc +++ b/modules/op-using-pipelines-as-code-with-a-github-app.adoc @@ -20,4 +20,4 @@ By default, {pac} can communicate with one GitHub app. If you configured additio [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub] (GitHub) +* link:https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps[About GitHub Apps on GitHub (GitHub)] diff --git a/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc b/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc index d3fd3bca4d7..7e8ebd11421 100644 --- a/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc +++ b/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc @@ -240,6 +240,6 @@ workspace-repo-run-abc123 True Succeeded 5m 2m [role="_additional-resources"] .Additional resources -* link:https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/[Creating app password on Bitbucket Cloud] (Bitbucket Cloud) -* link:https://developer.atlassian.com/cloud/bitbucket/bitbucket-api-changes-gdpr/#introducing-atlassian-account-id-and-nicknames[Introducing Atlassian Account ID and Nicknames] (Atlassian Developer) +* link:https://support.atlassian.com/bitbucket-cloud/docs/app-passwords/[Creating app password on Bitbucket Cloud (Bitbucket Cloud)] +* link:https://developer.atlassian.com/cloud/bitbucket/bitbucket-api-changes-gdpr/#introducing-atlassian-account-id-and-nicknames[Introducing Atlassian Account ID and Nicknames (Atlassian Developer)] diff --git a/modules/op-using-pipelines-as-code-with-bitbucket-server.adoc b/modules/op-using-pipelines-as-code-with-bitbucket-server.adoc index a5a38086d63..095941ce4ee 100644 --- a/modules/op-using-pipelines-as-code-with-bitbucket-server.adoc +++ b/modules/op-using-pipelines-as-code-with-bitbucket-server.adoc @@ -140,5 +140,5 @@ my-repo-run-xyz456 True Succeeded 4m 1m .Additional resources * link:https://pipelinesascode.com/docs/guides/repository-crd/[Using the Repository custom resource] -* link:https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html[Creating personal tokens on Bitbucket Data Center] (Bitbucket Data Center) -* link:https://confluence.atlassian.com/bitbucketserver/manage-webhooks-938025878.html[Managing webhooks on Bitbucket Data Center] (Bitbucket Data Center) +* link:https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html[Creating personal tokens on Bitbucket Data Center (Bitbucket Data Center)] +* link:https://confluence.atlassian.com/bitbucketserver/manage-webhooks-938025878.html[Managing webhooks on Bitbucket Data Center (Bitbucket Data Center)] diff --git a/modules/op-using-pipelines-as-code-with-github-webhook.adoc b/modules/op-using-pipelines-as-code-with-github-webhook.adoc index a61ffdcfcf3..693a33c3aad 100644 --- a/modules/op-using-pipelines-as-code-with-github-webhook.adoc +++ b/modules/op-using-pipelines-as-code-with-github-webhook.adoc @@ -228,5 +228,5 @@ Verify the webhook configuration in your GitHub repository. [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[Creating a personal access token] (GitHub) -* link:https://docs.github.com/en/developers/webhooks-and-events/webhooks/about-webhooks[About webhooks] (GitHub) \ No newline at end of file +* link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[Creating a personal access token (GitHub)] +* link:https://docs.github.com/en/developers/webhooks-and-events/webhooks/about-webhooks[About webhooks (GitHub)] diff --git a/modules/op-using-pipelines-as-code-with-gitlab.adoc b/modules/op-using-pipelines-as-code-with-gitlab.adoc index 178bb95cc23..97a7a1c7547 100644 --- a/modules/op-using-pipelines-as-code-with-gitlab.adoc +++ b/modules/op-using-pipelines-as-code-with-gitlab.adoc @@ -196,7 +196,7 @@ $ oc -n $target_namespace patch secret gitlab-webhook-config -p "{\"data\": {\"p [role="_additional-resources"] .Additional resources -* link:https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html[Personal access tokens] (GitLab) -* link:https://docs.gitlab.com/ee/user/project/integrations/webhooks.html[Webhooks] (GitLab) +* link:https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html[Personal access tokens (GitLab)] +* link:https://docs.gitlab.com/ee/user/project/integrations/webhooks.html[Webhooks (GitLab)] diff --git a/modules/op-using-secrets-as-a-nonroot-user.adoc b/modules/op-using-secrets-as-a-nonroot-user.adoc index e3e977edafd..1256fddccc4 100644 --- a/modules/op-using-secrets-as-a-nonroot-user.adoc +++ b/modules/op-using-secrets-as-a-nonroot-user.adoc @@ -17,4 +17,9 @@ In such scenarios, consider the following aspects of starting task runs and pipe * SSH authentication for Git requires the user to have a valid home directory configured in the `/etc/passwd` directory. Specifying a UID that has no valid home directory results in authentication failure. * SSH authentication ignores the `$HOME` environment variable. So you must or symlink the appropriate secret files from the `$HOME` directory defined by {pipelines-shortname} (`/tekton/home`), to the non-root user's valid home directory. -In addition, to configure SSH authentication in a non-root security context, see the `git-clone-and-check` step in the link:https://github.com/openshift-pipelines/pipelines-examples/blob/main/v1/taskruns/authenticating-git-commands.yaml[example for authenticating git commands]. +In addition, to configure SSH authentication in a non-root security context, see the `git-clone-and-check` step in the example for authenticating git commands. + +[role="_additional-resources"] +.Additional resources + +* link:https://github.com/openshift-pipelines/pipelines-examples/blob/main/v1/taskruns/authenticating-git-commands.yaml[Example for authenticating git commands] diff --git a/modules/op-using-ssh-authentication-in-git-type-tasks.adoc b/modules/op-using-ssh-authentication-in-git-type-tasks.adoc index 50dbddd89df..a2dd2e5d0b0 100644 --- a/modules/op-using-ssh-authentication-in-git-type-tasks.adoc +++ b/modules/op-using-ssh-authentication-in-git-type-tasks.adoc @@ -29,4 +29,9 @@ spec: However, explicit symlinks are not necessary when you use a pipeline resource of the `git` type or the `git-clone` task available in the Tekton catalog. -As an example of using SSH authentication in `git` type tasks, see link:https://github.com/openshift-pipelines/pipelines-examples/blob/main/v1/taskruns/authenticating-git-commands.yaml[authenticating-git-commands.yaml]. +As an example of using SSH authentication in `git` type tasks, see authenticating-git-commands.yaml. + +[role="_additional-resources"] +.Additional resources + +* link:https://github.com/openshift-pipelines/pipelines-examples/blob/main/v1/taskruns/authenticating-git-commands.yaml[authenticating-git-commands.yaml] diff --git a/pac/managing-pipeline-runs-pac.adoc b/pac/managing-pipeline-runs-pac.adoc index 7ff4cde8430..3c325727be5 100644 --- a/pac/managing-pipeline-runs-pac.adoc +++ b/pac/managing-pipeline-runs-pac.adoc @@ -21,15 +21,6 @@ include::modules/op-restarting-or-canceling-pipeline-run-using-pipelines-as-code include::modules/op-monitoring-pipeline-run-status-using-pipelines-as-code.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources - -* link:https://github.com/chmouel/tekton-slack-task-status[An example task to send Slack messages on success or failure] - -* link:https://github.com/openshift-pipelines/pipelines-as-code/blob/7b41cc3f769af40a84b7ead41c6f037637e95070/.tekton/push.yaml[An example of a pipeline run with `finally` tasks triggered on push events] - -* link:https://github.com/openshift-pipelines/pipelines-as-code/blob/main/test/testdata/pipelinerun_git_clone_private.yaml[An example of the `git-clone` task used for cloning private repositories] - include::modules/op-cleaning-up-pipeline-run-using-pipelines-as-code.adoc[leveloffset=+1] include::modules/op-using-incoming-webhook-with-pipelines-as-code.adoc[leveloffset=+1] diff --git a/records/using-tekton-results-for-openshift-pipelines-observability.adoc b/records/using-tekton-results-for-openshift-pipelines-observability.adoc index a4b9142faf6..d73148b6a71 100644 --- a/records/using-tekton-results-for-openshift-pipelines-observability.adoc +++ b/records/using-tekton-results-for-openshift-pipelines-observability.adoc @@ -36,12 +36,6 @@ include::modules/op-results-reference-results.adoc[leveloffset=+2] include::modules/op-results-reference-records.adoc[leveloffset=+2] -[role="_additional-resources"] -.Additional resources - -* link:https://cel.dev/[Common Expression Language (CEL)] - -//Querying results and logs by the names of pipeline runs and task runs include::modules/op-querying-pipelinerun-taskrun-about.adoc[leveloffset=+1] include::modules/op-results-opc-config.adoc[leveloffset=+2] diff --git a/release_notes/op-release-notes-1-20.adoc b/release_notes/op-release-notes-1-20.adoc index d1abab850ea..fcc1fbddf5d 100644 --- a/release_notes/op-release-notes-1-20.adoc +++ b/release_notes/op-release-notes-1-20.adoc @@ -24,7 +24,7 @@ Release notes contain information about new and deprecated features, breaking ch * Powerful CLI for interacting with pipelines. * Integrated user experience with the {OCP} web console, up to {OCP} version 4.19. -For an overview of {pipelines-title}, see xref:../about/understanding-openshift-pipelines.adoc#understanding-openshift-pipelines[Understanding {pipelines-shortname}]. +For an overview of {pipelines-title}, see "Understanding {pipelines-shortname}". // Compatibility and support matrix 1.20 include::modules/op-tkn-pipelines-compatibility-support-matrix.adoc[leveloffset=+1] @@ -36,12 +36,13 @@ include::modules/op-release-notes-1-20-0.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources * xref:../secure/using-buildah-ns-tekton-task.adoc#op-differences-between-buildah-buildah-ns-tasks_using-buildah-ns-tekton-task[Differences between `buildah` and `buildah-ns` tasks] -//* xref:../install_config/customizing-configurations-in-the-tektonconfig-cr.adoc#op-configuration-rbac-trusted-ca-flags_customizing-configurations-in-the-tektonconfig-cr[Configuration of RBAC and Trusted CA flags]. * xref:../install_config/customizing-configurations-in-the-tektonconfig-cr.adoc#event-pruner-configuration_customizing-configurations-in-the-tektonconfig-cr[Enabling the event-based pruner] * xref:../pac/install-config-pipelines-as-code.adoc#customizing-pipelines-as-code-configuration_install-config-pipelines-as-code[Customizing {pac} configuration] +* xref:../about/understanding-openshift-pipelines.adoc#understanding-openshift-pipelines[Understanding {pipelines-shortname}] + * xref:../pac/creating-pipeline-runs-pac.adoc#op-parameters-pipeline-run-using-pipelines-as-code_creating-pipeline-runs-pac[Commit and URL Information] * xref:../create/remote-pipelines-tasks-resolvers.adoc#resolver-hub_remote-pipelines-tasks-resolvers[{tekton-hub} deprecation note under Specifying from a Tekton catalog] diff --git a/resource/setting-compute-resource-quota-for-openshift-pipelines.adoc b/resource/setting-compute-resource-quota-for-openshift-pipelines.adoc index d7652962308..343a17b570c 100644 --- a/resource/setting-compute-resource-quota-for-openshift-pipelines.adoc +++ b/resource/setting-compute-resource-quota-for-openshift-pipelines.adoc @@ -13,20 +13,6 @@ However, you might want to limit the amount of compute resources consumed by pod include::modules/op-alternative-approaches-compute-resource-quota-pipelines.adoc[leveloffset=+1] -[NOTE] -==== -When using {pipelines-title} in a namespace configured with a `ResourceQuota` object, the pods resulting from task runs and pipeline runs might fail with an error, such as: `failed quota: must specify cpu, memory`. - -To avoid this error, do any one of the following: - -* (Recommended) Specify a limit range for the namespace. -* Explicitly define requests and limits for all containers. - -For more information, see the link:https://issues.redhat.com/browse/SRVKP-1801[issue] and the link:https://access.redhat.com/solutions/2841971[resolution]. -==== - -If your use case is not addressed by these approaches, you can implement a workaround by using a resource quota for a priority class. - include::modules/op-specifying-pipelines-resource-quota-using-priority-class.adoc[leveloffset=+1] [role="_additional-resources"] diff --git a/secure/configuring-security-context-for-pods.adoc b/secure/configuring-security-context-for-pods.adoc index 6217b706362..afcd388fd20 100644 --- a/secure/configuring-security-context-for-pods.adoc +++ b/secure/configuring-security-context-for-pods.adoc @@ -33,15 +33,11 @@ You can configure the security context for pods that {pipelines-shortname} creat [NOTE] ==== -The simplest way to run `buildah` that ensures all images can build is to run it as root in a pod with the `privileged` SCC. For instructions about running `buildah` with more restrictive security settings, see xref:../secure/unprivileged-building-of-container-images-using-buildah.adoc#unprivileged-building-of-container-images-using-buildah[Building of container images using Buildah as a non-root user]. +The simplest way to run `buildah` that ensures all images can build is to run it as root in a pod with the `privileged` SCC. For instructions about running `buildah` with more restrictive security settings, see "Building of container images using Buildah as a non-root user". ==== include::modules/op-configuring-default-maximum-scc.adoc[leveloffset=+1] -[role="_additional-resources"] -.Additional resources -* xref:../install_config/customizing-configurations-in-the-tektonconfig-cr.adoc#op-changing-default-service-account_customizing-configurations-in-the-tektonconfig-cr[Changing the default service account for {pipelines-shortname}] - include::modules/op-configuring-scc-namespace.adoc[leveloffset=+1] include::modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc[leveloffset=+1] @@ -51,3 +47,4 @@ include::modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-servic == Additional resources * link:https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html[Managing security context constraints] +* xref:../secure/unprivileged-building-of-container-images-using-buildah.adoc#unprivileged-building-of-container-images-using-buildah[Building of container images using Buildah as a non-root user] diff --git a/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc b/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc index ddc9f4a5692..9fd3d2d62cd 100644 --- a/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc +++ b/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc @@ -31,8 +31,6 @@ include::modules/op-creating-mounting-kms-authentication-token-secret.adoc[level include::modules/op-enabling-tekton-chains-to-operate-only-in-selected-namespaces.adoc[leveloffset=+2] -:leveloffset: 0 - include::modules/op-signing-secrets-in-tekton-chains.adoc[leveloffset=+1] include::modules/op-chains-generating-cosign-secret.adoc[leveloffset=+2] @@ -43,8 +41,6 @@ include::modules/op-chains-signing-secrets-skopeo.adoc[leveloffset=+2] include::modules/op-chains-resolving-existing-secret.adoc[leveloffset=+2] -:leveloffset: 0 - include::modules/op-authenticating-to-an-oci-registry.adoc[leveloffset=+1] include::modules/op-creating-and-verifying-task-run-signatures-without-any-additional-authentication.adoc[leveloffset=+1] From 87fc08bd8009ca87b80c2ceae74ef39df26b7086 Mon Sep 17 00:00:00 2001 From: Rohit Parmar Date: Tue, 18 Aug 2026 11:49:08 +0530 Subject: [PATCH 4/5] [RHDEVDOCS-7797] Fix Vale style and spelling issues for AEM migration readiness Fix terminology, style, and spelling warnings across OpenShift Pipelines documentation. Update Vale vocabulary files to suppress false positives. Delete orphaned monolithic SBOM module replaced by split modules in RHDEVDOCS-7794. --- .gitignore | 1 + .vale.ini | 1 + .vale/styles/Vocab/OpenShiftDocs/accept.txt | 33 ++-- .vale/styles/Vocab/RedHat/accept.txt | 18 +- .../vocabularies/OpenShiftDocs/accept.txt | 33 ++-- about/understanding-openshift-pipelines.adoc | 4 +- ...ting-applications-with-cicd-pipelines.adoc | 3 +- ...-from-clustertask-to-cluster-resolver.adoc | 2 +- create/using-rh-entitlements-pipelines.adoc | 8 +- ...configurations-in-the-tektonconfig-cr.adoc | 2 +- install_config/uninstalling-pipelines.adoc | 4 +- modules/op-about-must-gather.adoc | 2 +- modules/op-about-pipelinerun.adoc | 4 - modules/op-about-stepactions.adoc | 3 - ...bout-troubleshooting-cluster-resolver.adoc | 2 +- modules/op-about-whenexpression.adoc | 4 +- modules/op-adding-triggers.adoc | 4 +- modules/op-approving-task-command-line.adoc | 2 +- modules/op-assembling-a-pipeline.adoc | 2 +- modules/op-assess-migration-impact.adoc | 2 +- modules/op-chains-signing-secrets-skopeo.adoc | 4 +- ...figuring-basic-authentication-for-git.adoc | 2 +- ...figuring-cosign-for-sbom-verification.adoc | 2 +- ...t-ssh-authentication-using-workspaces.adoc | 2 +- ...-configuring-hub-cluster-multicluster.adoc | 8 +- ...nfiguring-spoke-clusters-multicluster.adoc | 14 +- ...onfiguring-ssh-authentication-for-git.adoc | 2 +- ...ting-pipelines-using-pipeline-builder.adoc | 14 +- ...lication-in-administrator-perspective.adoc | 2 +- ...without-any-additional-authentication.adoc | 2 +- modules/op-creating-global-repository-cr.adoc | 2 +- ...p-creating-pipeline-runs-multicluster.adoc | 2 +- ...leting-the-pipelines-custom-resources.adoc | 4 +- modules/op-disabling-inline-spec.adoc | 6 +- modules/op-enabling-manual-approval-gate.adoc | 2 +- ...or-triggers-for-user-defined-projects.adoc | 2 +- .../op-entitlements-shared-csi-driver.adoc | 6 +- ...lines-using-the-developer-perspective.adoc | 4 +- ...ines-as-code-with-custom-certificates.adoc | 2 +- modules/op-lightspeed-utility-commands.adoc | 6 +- ...-pipeline-run-using-pipelines-as-code.adoc | 2 +- modules/op-migrating-to-artifact-hub.adoc | 2 +- modules/op-multicluster-architecture.adoc | 4 +- modules/op-multicluster-limitations.adoc | 6 +- modules/op-odc-pipelines-abstract.adoc | 2 +- modules/op-providing-secure-connection.adoc | 2 +- modules/op-query-results-name.adoc | 2 +- modules/op-release-notes-1-0.adoc | 2 +- modules/op-release-notes-1-12.adoc | 2 +- modules/op-release-notes-1-14.adoc | 8 +- modules/op-release-notes-1-19.adoc | 2 +- modules/op-release-notes-1-20-0.adoc | 4 +- modules/op-release-notes-1-21-0.adoc | 58 +++--- modules/op-release-notes-1-22-0.adoc | 53 ++--- modules/op-release-notes-1-23-0.adoc | 59 +++--- modules/op-release-notes-1-6.adoc | 2 +- modules/op-release-notes-1-7.adoc | 4 +- modules/op-release-notes-1-9.adoc | 2 +- modules/op-resolver-cluster-tasks-ref.adoc | 6 +- modules/op-resolver-git-config-scm.adoc | 2 +- modules/op-resolver-stepactions-ref.adoc | 2 +- modules/op-results-search-records.adoc | 2 +- modules/op-results-search-results.adoc | 2 +- modules/op-running-a-pipeline.adoc | 3 - modules/op-sample-eventlistener-resource.adoc | 2 +- ...t-pipelines-to-download-or-view-sboms.adoc | 182 ------------------ ...lines-to-view-project-vulnerabilities.adoc | 4 +- ...tarting-pipelines-from-pipelines-view.adoc | 4 +- ...ipelines-as-code-with-bitbucket-cloud.adoc | 4 +- ...pipelines-as-code-with-github-webhook.adoc | 4 +- ...p-using-pipelines-as-code-with-gitlab.adoc | 4 +- ...ne-annotations-with-pipelines-as-code.adoc | 2 +- ...sk-annotations-with-pipelines-as-code.adoc | 2 +- modules/op-verifying-multicluster-setup.adoc | 4 +- modules/op-verifying-pipeline-run-pac.adoc | 2 +- modules/op-viewing-an-sbom.adoc | 2 +- pac/about-pipelines-as-code.adoc | 2 +- pac/creating-pipeline-runs-pac.adoc | 2 +- release_notes/op-release-notes-1-21.adoc | 2 +- release_notes/op-release-notes-1-22.adoc | 5 +- release_notes/op-release-notes-1-23.adoc | 5 +- .../configuring-multicluster-support.adoc | 4 +- ...ftware-supply-chain-security-elements.adoc | 7 +- ...shift-pipelines-supply-chain-security.adoc | 4 +- 84 files changed, 268 insertions(+), 434 deletions(-) delete mode 100644 modules/op-setting-up-openshift-pipelines-to-download-or-view-sboms.adoc diff --git a/.gitignore b/.gitignore index 8050e35fa71..1bb8dcc8f2d 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ commercial_package .vale/styles/AsciiDocDITA .vale/styles/OpenShiftAsciiDoc .vale/styles/RedHat +.vale-cqa.ini diff --git a/.vale.ini b/.vale.ini index 820cb47dfcb..53f6e5acafd 100644 --- a/.vale.ini +++ b/.vale.ini @@ -3,6 +3,7 @@ StylesPath = .vale/styles MinAlertLevel = suggestion Packages = RedHat, AsciiDoc, OpenShiftAsciiDoc, https://github.com/jhradilek/asciidoctor-dita-vale/releases/latest/download/AsciiDocDITA.zip +Vocab = OpenShiftDocs # Ignore files in dirs starting with `.` to avoid raising errors for `.vale/fixtures/*/testinvalid.adoc` files [[!.]*.adoc] diff --git a/.vale/styles/Vocab/OpenShiftDocs/accept.txt b/.vale/styles/Vocab/OpenShiftDocs/accept.txt index 2490f054fee..7d8fdd84bea 100644 --- a/.vale/styles/Vocab/OpenShiftDocs/accept.txt +++ b/.vale/styles/Vocab/OpenShiftDocs/accept.txt @@ -8,57 +8,64 @@ args Assisted Installer Atlassian backoff -buildah +[Bb]uildah Buildpacks Control Plane Machine Set Operator -Cron -cron +[Cc]ron custom resource custom resources +defaultRetention destinationCACertificate -docstore +Docdb +[Dd]ocstore dotnet enablement finalizer finalizers +Forgejo Fulcio +Git's Gitea -gosmee +[Gg]osmee Grafeas jq -Kaniko +[Kk]aniko keyless kubeconfig +maxRetention MetalLB multiline nonproduction -opc +[Oo][Pp][Cc] +[Pp][Aa][Cc] Operator Operators param -pipelinerun +[Pp]ipeline[Rr]un +pipelinerun_status Postgres prepopulated +prepopulates +pull_request_number proxying pylint refetching Rekor -repo -Repo +[Rr]epo resource_type resync retryable reusability Roxctl -sbom +[Ss][Bb][Oo][Mm] SCCs semver Sigstore -skopeo +[Ss]kopeo subprocesses substring sudo -taskrun +[Tt]ask[Rr]un tkn unencrypted unschedulable diff --git a/.vale/styles/Vocab/RedHat/accept.txt b/.vale/styles/Vocab/RedHat/accept.txt index 73cb54b80dd..29f6d55e0b1 100644 --- a/.vale/styles/Vocab/RedHat/accept.txt +++ b/.vale/styles/Vocab/RedHat/accept.txt @@ -7,29 +7,33 @@ backoff Buildpacks [Cc]ron defaultRetention -docstore +Docdb +[Dd]ocstore dotnet enablement finalizer finalizers +Forgejo Fulcio +Git's Gitea [Gg]itlab gosmee Grafeas jq -Kaniko +[Kk]aniko keyless maxRetention nonproduction -opc +[Oo][Pp][Cc] +[Pp][Aa][Cc] param -pipelinerun +[Pp]ipeline[Rr]un pipelinerun_status prepopulated prepopulates -proxying pull_request_number +proxying pylint refetching Rekor @@ -40,14 +44,14 @@ resync retryable reusability Roxctl -sbom +[Ss][Bb][Oo][Mm] SCCs semver Sigstore skopeo subprocesses sudo -taskrun +[Tt]ask[Rr]un tkn unencrypted unschedulable diff --git a/.vale/styles/config/vocabularies/OpenShiftDocs/accept.txt b/.vale/styles/config/vocabularies/OpenShiftDocs/accept.txt index 2490f054fee..7d8fdd84bea 100644 --- a/.vale/styles/config/vocabularies/OpenShiftDocs/accept.txt +++ b/.vale/styles/config/vocabularies/OpenShiftDocs/accept.txt @@ -8,57 +8,64 @@ args Assisted Installer Atlassian backoff -buildah +[Bb]uildah Buildpacks Control Plane Machine Set Operator -Cron -cron +[Cc]ron custom resource custom resources +defaultRetention destinationCACertificate -docstore +Docdb +[Dd]ocstore dotnet enablement finalizer finalizers +Forgejo Fulcio +Git's Gitea -gosmee +[Gg]osmee Grafeas jq -Kaniko +[Kk]aniko keyless kubeconfig +maxRetention MetalLB multiline nonproduction -opc +[Oo][Pp][Cc] +[Pp][Aa][Cc] Operator Operators param -pipelinerun +[Pp]ipeline[Rr]un +pipelinerun_status Postgres prepopulated +prepopulates +pull_request_number proxying pylint refetching Rekor -repo -Repo +[Rr]epo resource_type resync retryable reusability Roxctl -sbom +[Ss][Bb][Oo][Mm] SCCs semver Sigstore -skopeo +[Ss]kopeo subprocesses substring sudo -taskrun +[Tt]ask[Rr]un tkn unencrypted unschedulable diff --git a/about/understanding-openshift-pipelines.adoc b/about/understanding-openshift-pipelines.adoc index 2d62d99d4fe..5b37d4a77a0 100644 --- a/about/understanding-openshift-pipelines.adoc +++ b/about/understanding-openshift-pipelines.adoc @@ -42,6 +42,8 @@ include::modules/op-about-triggers.adoc[leveloffset=+2] == Additional resources * xref:../install_config/installing-pipelines.adoc#installing-pipelines[Installing {pipelines-shortname}] -* xref:../create/creating-applications-with-cicd-pipelines.adoc#creating-applications-with-cicd-pipelines[Creating CI/CD solutions for applications using {pipelines-shortname}] +* xref:../create/creating-applications-with-cicd-pipelines.adoc#creating-applications-with-cicd-pipelines[Creating CI/CD solutions for applications by using {pipelines-shortname}] +* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories by using secrets] +* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions by using resolvers] * link:https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html#re-encryption-termination[Re-encryption Termination] * link:https://docs.openshift.com/container-platform/latest/networking/routes/secured-routes.html[Secured routes] diff --git a/create/creating-applications-with-cicd-pipelines.adoc b/create/creating-applications-with-cicd-pipelines.adoc index 5c3187de4c1..05d4e6f4e57 100644 --- a/create/creating-applications-with-cicd-pipelines.adoc +++ b/create/creating-applications-with-cicd-pipelines.adoc @@ -30,7 +30,7 @@ The following `pipelines-tutorial` example demonstrates the preceding tasks. The * You have access to an {OCP} cluster. * You have installed xref:../install_config/installing-pipelines.adoc#installing-pipelines[{pipelines-shortname}] using the {pipelines-title} Operator listed in the OpenShift OperatorHub. After you install it, it is applicable to the entire cluster. * You have installed xref:../tkn_cli/installing-tkn.adoc#installing-tkn[{pipelines-shortname} CLI]. -* You have forked the front-end link:https://github.com/openshift/pipelines-vote-ui/tree/{pipelines-ver}[`pipelines-vote-ui`] and back-end link:https://github.com/openshift/pipelines-vote-api/tree/{pipelines-ver}[`pipelines-vote-api`] Git repositories using your GitHub ID, and have administrator access to these repositories. +* You have forked the front-end link:https://github.com/openshift/pipelines-vote-ui/tree/{pipelines-ver}[`pipelines-vote-ui`] and back-end link:https://github.com/openshift/pipelines-vote-api/tree/{pipelines-ver}[`pipelines-vote-api`] Git repositories by using your GitHub ID, and have administrator access to these repositories. * Optional: You have cloned the link:https://github.com/openshift/pipelines-tutorial/tree/{pipelines-ver}[`pipelines-tutorial`] Git repository. @@ -65,6 +65,7 @@ include::modules/op-validating-pull-requests-using-GitHub-interceptors.adoc[leve * xref:../pac/about-pipelines-as-code.adoc#about-pipelines-as-code[About {pac}] * xref:../create/working-with-pipelines-web-console.adoc#working-with-pipelines-web-console[Working with {pipelines-shortname} in the web console] +* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories by using secrets] * link:https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html[Managing Security Context Constraints] * link:https://github.com/openshift/pipelines-catalog[OpenShift Catalog] * xref:../hub/using-tekton-hub-with-openshift-pipelines.adoc#using-tekton-hub-with-openshift-pipelines[Using {tekton-hub} with {pipelines-title}] diff --git a/create/migrate-from-clustertask-to-cluster-resolver.adoc b/create/migrate-from-clustertask-to-cluster-resolver.adoc index 8789f67a898..82e709f1722 100644 --- a/create/migrate-from-clustertask-to-cluster-resolver.adoc +++ b/create/migrate-from-clustertask-to-cluster-resolver.adoc @@ -40,7 +40,7 @@ include::modules/op-troubleshooting-general-debugging.adoc[leveloffset=+1] [role="_additional-resources"] == Additional resources -* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions using resolvers] +* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions by using resolvers] * xref:../create/remote-pipelines-tasks-resolvers.adoc#resolver-cluster_remote-pipelines-tasks-resolvers[Specifying a pipeline, task, or step action from the same cluster] * xref:../create/remote-pipelines-tasks-resolvers.adoc#resolver-cluster-tasks-ref_remote-pipelines-tasks-resolvers[Tasks provided in the {pipelines-shortname} namespace] * link:https://tekton.dev/docs/pipelines/cluster-resolver/[Tekton Cluster Resolver documentation] diff --git a/create/using-rh-entitlements-pipelines.adoc b/create/using-rh-entitlements-pipelines.adoc index be195350fe7..8fcadd3a11b 100644 --- a/create/using-rh-entitlements-pipelines.adoc +++ b/create/using-rh-entitlements-pipelines.adoc @@ -9,7 +9,7 @@ toc::[] [role="_abstract"] If you have {op-system-base-full} entitlements, you can use these entitlements to build container images in your pipelines. -The Insight Operator automatically manages your entitlements after you import them into this Operator from Simple Common Access (SCA). This operator provides a secret named `etc-pki-entitlement` in the `openshift-config-managed` namespace. +The Insight Operator automatically manages your entitlements after you import them into this Operator from Simple Common Access (SCA). This Operator provides a secret named `etc-pki-entitlement` in the `openshift-config-managed` namespace. You can use Red Hat entitlements in your pipelines in one of the following two ways: @@ -19,15 +19,15 @@ You can use Red Hat entitlements in your pipelines in one of the following two w == Prerequisites -* You logged on to your {OCP} cluster using the `oc` command line tool. +* You logged on to your {OCP} cluster by using the `oc` command line tool. -* You enabled the Insights Operator feature on your {OCP} cluster. If you want to use the Shared Resources CSI Driver operator to share the secret between namespaces, you must also enable the Shared Resources CSI driver. For information about enabling features, including the Insights Operator and Shared Resources CSI Driver, see link:https://docs.openshift.com/container-platform/latest/nodes/clusters/nodes-cluster-enabling-features.html[Enabling features using feature gates]. +* You enabled the Insights Operator feature on your {OCP} cluster. If you want to use the Shared Resources CSI Driver Operator to share the secret between namespaces, you must also enable the Shared Resources CSI Driver. For information about enabling features, including the Insights Operator and Shared Resources CSI Driver, see link:https://docs.openshift.com/container-platform/latest/nodes/clusters/nodes-cluster-enabling-features.html[Enabling features by using feature gates]. + + [NOTE] ==== -After you enable the Insights Operator, you must wait for some time to ensure that the cluster updates all the nodes with this operator. You can monitor the status of all nodes by entering the following command: +After you enable the Insights Operator, you must wait for some time to ensure that the cluster updates all the nodes with this Operator. You can monitor the status of all nodes by entering the following command: [source,terminal] ---- diff --git a/install_config/customizing-configurations-in-the-tektonconfig-cr.adoc b/install_config/customizing-configurations-in-the-tektonconfig-cr.adoc index 4a84f9c134d..286ec2ef77b 100644 --- a/install_config/customizing-configurations-in-the-tektonconfig-cr.adoc +++ b/install_config/customizing-configurations-in-the-tektonconfig-cr.adoc @@ -75,6 +75,6 @@ include::modules/op-additional-options-webhooks.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources -* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] +* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories by using secrets] * xref:../create/working-with-pipelines-web-console.adoc#using-custom-pipeline-template-for-git-import_working-with-pipelines-web-console[Creating pipeline templates in the Administrator perspective] * link:https://docs.openshift.com/container-platform/latest/applications/pruning-objects.html[Pruning objects to reclaim resources] diff --git a/install_config/uninstalling-pipelines.adoc b/install_config/uninstalling-pipelines.adoc index 3fb9a341c23..199085b5ea2 100644 --- a/install_config/uninstalling-pipelines.adoc +++ b/install_config/uninstalling-pipelines.adoc @@ -9,14 +9,14 @@ toc::[] [role="_abstract"] Cluster administrators can uninstall the {pipelines-title} Operator by performing the following steps: -. Delete the Custom Resources (CRs) for the optional components, `TektonHub` and `TektonResult`, if these CRs exist, and then delete the `TektonConfig` CR. +. Delete the custom resources (CRs) for the optional components, `TektonHub` and `TektonResult`, if these CRs exist, and then delete the `TektonConfig` CR. + [CAUTION] ==== If you uninstall the Operator without removing the CRs of optional components, you cannot remove the components later. ==== . Uninstall the {pipelines-title} Operator. -. Delete the Custom Resource Definitions (CRDs) of the `operator.tekton.dev` group. +. Delete the custom resource definitions (CRDs) of the `operator.tekton.dev` group. Uninstalling only the Operator will not remove the {pipelines-title} components created by default when you install the Operator. diff --git a/modules/op-about-must-gather.adoc b/modules/op-about-must-gather.adoc index f45683406fb..8dfc75315b6 100644 --- a/modules/op-about-must-gather.adoc +++ b/modules/op-about-must-gather.adoc @@ -12,4 +12,4 @@ When you run the command, the tool performs the following actions: * Executes scripts inside the pods to gather logs, custom resource definitions (CRDs), and system states from the relevant nodes and control plane components. * Streams the collected data back to your local machine and saves it into a newly created directory starting with `./must-gather.local`. -By default, the tool collects data across core cluster components. When troubleshooting issues specific to {pipelines-title}, you specify the {pipelines-shortname} `must-gather` image to capture components like the operator subscription, Tekton configurations, task runs, pipeline runs, and pod logs in the operator namespaces. +By default, the tool collects data across core cluster components. When troubleshooting issues specific to {pipelines-title}, you specify the {pipelines-shortname} `must-gather` image to capture components such as the Operator subscription, Tekton configurations, task runs, pipeline runs, and pod logs in the Operator namespaces. diff --git a/modules/op-about-pipelinerun.adoc b/modules/op-about-pipelinerun.adoc index 7008c7eab18..0b6c9542fc8 100644 --- a/modules/op-about-pipelinerun.adoc +++ b/modules/op-about-pipelinerun.adoc @@ -54,7 +54,3 @@ spec: `spec.workspaces`:: Workspace used by the pipeline run. -[role="_additional-resources"] -.Additional resources - -* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] \ No newline at end of file diff --git a/modules/op-about-stepactions.adoc b/modules/op-about-stepactions.adoc index 55d40b29429..f1335216b09 100644 --- a/modules/op-about-stepactions.adoc +++ b/modules/op-about-stepactions.adoc @@ -82,7 +82,4 @@ spec: script: 'echo $(step.apply.results.output)' ---- -[role="_additional-resources"] -.Additional resources -* xref:../create/remote-pipelines-tasks-resolvers.adoc#remote-pipelines-tasks-resolvers[Specifying remote pipelines, tasks, and step actions using resolvers] diff --git a/modules/op-about-troubleshooting-cluster-resolver.adoc b/modules/op-about-troubleshooting-cluster-resolver.adoc index 016934e0b3c..06a0e6c2e3b 100644 --- a/modules/op-about-troubleshooting-cluster-resolver.adoc +++ b/modules/op-about-troubleshooting-cluster-resolver.adoc @@ -19,6 +19,6 @@ Common issues that can occur during migration include: * *Task parameters have changed*: Tasks migrated from `ClusterTask` to namespace-scoped tasks might have different parameter names or requirements. Some deprecated parameters from the `ClusterTask` versions are no longer supported. -* *General debugging*: Other issues that require examining pipeline run events, resolver logs, service account permissions, or operator versions. +* *General debugging*: Other issues that require examining pipeline run events, resolver logs, service account permissions, or Operator versions. Each issue has specific diagnostic steps and solutions to restore functionality after migration. diff --git a/modules/op-about-whenexpression.adoc b/modules/op-about-whenexpression.adoc index 0b6f97ad367..68db40699b9 100644 --- a/modules/op-about-whenexpression.adoc +++ b/modules/op-about-whenexpression.adoc @@ -13,7 +13,7 @@ When expressions guard task execution by setting criteria for running tasks with The key components of a when expression are as follows: * `input`: Specifies static inputs or variables such as a parameter, task result, and execution status. You must enter a valid input. If you do not enter a valid input, its value defaults to an empty string. -* `operator`: Specifies the relationship of an input to a set of `values`. Enter `in` or `notin` as your operator values. +* `operator`: Specifies the relationship of an input to a set of `values`. Enter `in` or `notin` as the value for this field. * `values`: Specifies an array of string values. Enter a non-empty array of static values or variables such as parameters, results, and a bound state of a workspace. The declared when expressions evaluate before the task runs. If the when expression evaluates to `True`, the task runs. If the when expression evaluates to `False`, the task skips. @@ -157,7 +157,7 @@ spec: The *Pipeline Run details* page of the {OCP} web console shows the status of the tasks and when expressions as follows: -* The task meets all criteria: Tasks and the when expression symbol, which appears as a diamond shape, appear in a **success** state. +* The task meets all criteria: Tasks and the when expression symbol, which is displayed as a diamond shape, are displayed in a **success** state. * The task does not meet one of the criteria: The Task skips. Skipped tasks and the when expression symbol appear in a **skipped** state. diff --git a/modules/op-adding-triggers.adoc b/modules/op-adding-triggers.adoc index a03af945778..fcf43f77cdc 100644 --- a/modules/op-adding-triggers.adoc +++ b/modules/op-adding-triggers.adoc @@ -169,7 +169,7 @@ spec: . Create the `EventListener` resource by performing the following steps: + -* To create an `EventListener` resource using a secure HTTPS connection: +* To create an `EventListener` resource by using a secure HTTPS connection: + .. Add a label to enable the secure HTTPS connection to the `Eventlistener` resource: + @@ -228,7 +228,7 @@ spec: + See `oc create route reencrypt --help` for more options. + -* To create an `EventListener` resource using an insecure HTTP connection: +* To create an `EventListener` resource by using an insecure HTTP connection: + .. Create the `EventListener` resource. .. Expose the `EventListener` service as an {OCP} route to make it publicly accessible: diff --git a/modules/op-approving-task-command-line.adoc b/modules/op-approving-task-command-line.adoc index f02ab3fd0d7..3fa3b3fc168 100644 --- a/modules/op-approving-task-command-line.adoc +++ b/modules/op-approving-task-command-line.adoc @@ -11,7 +11,7 @@ You can approve or reject a manual approval task by using the `opc` command-line .Prerequisites * You downloaded and installed the `opc` command-line utility. This utility is available in the same package as the `tkn` command-line utility. -* You have logged in to the cluster using the `oc` command-line utility. +* You have logged in to the cluster by using the `oc` command-line utility. .Procedure diff --git a/modules/op-assembling-a-pipeline.adoc b/modules/op-assembling-a-pipeline.adoc index ddfc35628ea..85df262a334 100644 --- a/modules/op-assembling-a-pipeline.adoc +++ b/modules/op-assembling-a-pipeline.adoc @@ -15,7 +15,7 @@ Create a pipeline that takes the source code of the application from GitHub, and The pipeline performs the following tasks for the back-end application `pipelines-vote-api` and front-end application `pipelines-vote-ui`: * Clones the source code of the application from the Git repository by referring to the `git-url` and `git-revision` parameters. -* Builds the container image using the `buildah` task provided in the `openshift-pipelines` namespace. +* Builds the container image by using the `buildah` task provided in the `openshift-pipelines` namespace. * Pushes the image to the {product-registry} by referring to the `image` parameter. * Deploys the new image on {OCP} by using the `apply-manifests` and `update-deployment` tasks. diff --git a/modules/op-assess-migration-impact.adoc b/modules/op-assess-migration-impact.adoc index 57b6188aad0..f7405d43db8 100644 --- a/modules/op-assess-migration-impact.adoc +++ b/modules/op-assess-migration-impact.adoc @@ -6,7 +6,7 @@ = Assess migration impact [role="_abstract"] -You must migrate to {artifact-hub} to ensure uninterrupted catalog resolution. +You must migrate to {artifact-hub} for uninterrupted catalog resolution. You must migrate if: diff --git a/modules/op-chains-signing-secrets-skopeo.adoc b/modules/op-chains-signing-secrets-skopeo.adoc index 5cd52d33232..cc6332913af 100644 --- a/modules/op-chains-signing-secrets-skopeo.adoc +++ b/modules/op-chains-signing-secrets-skopeo.adoc @@ -15,7 +15,7 @@ Generate signing keys by using the `skopeo` tool when you already have Skopeo in .Procedure -. Generate a public/private key pair by running the following command: +. Generate a public and private key pair by running the following command: + [source,terminal] ---- @@ -40,7 +40,7 @@ $ base64 -w 0 .pub > b64.pub $ base64 -w 0 .private > b64.private ---- -. Encode the passphrase using the `base64` tool by running the following command: +. Encode the passphrase with the `base64` tool by running the following command: + [source,terminal] ---- diff --git a/modules/op-configuring-basic-authentication-for-git.adoc b/modules/op-configuring-basic-authentication-for-git.adoc index ee067ac8824..f213fb81152 100644 --- a/modules/op-configuring-basic-authentication-for-git.adoc +++ b/modules/op-configuring-basic-authentication-for-git.adoc @@ -17,7 +17,7 @@ To configure Basic HTTP authentication for a pipeline, create a Basic HTTP authe [NOTE] ==== -GitHub deprecated authentication using a plain password. Instead, use a personal access token. +GitHub deprecated authentication by using a plain password. Instead, use a personal access token. ==== .Procedure diff --git a/modules/op-configuring-cosign-for-sbom-verification.adoc b/modules/op-configuring-cosign-for-sbom-verification.adoc index ae5785fe3c1..ba3a3743d97 100644 --- a/modules/op-configuring-cosign-for-sbom-verification.adoc +++ b/modules/op-configuring-cosign-for-sbom-verification.adoc @@ -81,7 +81,7 @@ spec: `- name: IMAGE_URL`:: The name of the result. ``:: The OCI image repository URL that has the `.sbom` images. -. Rerun the affected OpenShift Pipeline. +. Rerun the affected {pipelines-shortname}. [role="_additional-resources"] .Additional resources diff --git a/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc b/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc index 11852290f11..4c5d514d2d1 100644 --- a/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc +++ b/modules/op-configuring-git-ssh-authentication-using-workspaces.adoc @@ -41,7 +41,7 @@ spec: A .ssh directory with private key, known_hosts, config, etc. ---- -. In the steps of the task, access the directory using the path in the `$(workspaces..path)` environment variable, for example, `$(workspaces.ssh-directory.path)` +. In the steps of the task, access the directory by using the path in the `$(workspaces..path)` environment variable, for example, `$(workspaces.ssh-directory.path)` . When running the task, specify the secret for the named workspace by including the `--workspace` argument in the `tkn task start` command: + diff --git a/modules/op-configuring-hub-cluster-multicluster.adoc b/modules/op-configuring-hub-cluster-multicluster.adoc index 0bc94c68a81..fc29fdce9e5 100644 --- a/modules/op-configuring-hub-cluster-multicluster.adoc +++ b/modules/op-configuring-hub-cluster-multicluster.adoc @@ -12,13 +12,13 @@ You can configure an {product-title} cluster as a hub cluster to manage and sche .Prerequisites * You have installed the {pipelines-shortname} Operator on the hub cluster. -* You have access to the hub cluster using an account with `cluster-admin` permissions. +* You have access to the hub cluster by using an account with `cluster-admin` permissions. * You have installed the `oc` CLI. * You have access to the kubeconfig files for each spoke cluster you want to connect. .Procedure -. Install the Red Hat Build of Kueue (RHBoK) operator on the hub cluster: +. Install the Red Hat Build of Kueue (RHBoK) Operator on the hub cluster: + .. If the cert-manager is not already installed, install it from OperatorHub. Alternatively, you can install it using the following script: + @@ -27,9 +27,9 @@ You can configure an {product-title} cluster as a hub cluster to manage and sche $ curl -sL https://raw.githubusercontent.com/openshift/kueue-operator/refs/heads/main/hack/deploy-cert-manager.sh | bash ---- + -.. Install the Red Hat Build of Kueue operator version 1.3 or later from OperatorHub. +.. Install the Red Hat Build of Kueue Operator version 1.3 or later from OperatorHub. + -.. Create a Kueue custom resource to configure the operator by running the following command: +.. Create a Kueue custom resource to configure the Operator by running the following command: + [source,terminal] ---- diff --git a/modules/op-configuring-spoke-clusters-multicluster.adoc b/modules/op-configuring-spoke-clusters-multicluster.adoc index 8a4057d8c8a..eeb85fde1b8 100644 --- a/modules/op-configuring-spoke-clusters-multicluster.adoc +++ b/modules/op-configuring-spoke-clusters-multicluster.adoc @@ -7,18 +7,18 @@ = Configuring spoke clusters for multicluster [role="_abstract"] -You can configure {product-title} clusters as spoke clusters to execute pipeline runs scheduled from a hub cluster. +You can configure {product-title} clusters as spoke clusters to run pipeline runs scheduled from a hub cluster. .Prerequisites * You have installed the {pipelines-shortname} Operator on each spoke cluster. -* You have access to each spoke cluster using an account with `cluster-admin` permissions. +* You have access to each spoke cluster by using an account with `cluster-admin` permissions. * You have installed the `oc` CLI. * You have configured the hub cluster for multicluster support. .Procedure -. Install the Red Hat Build of Kueue (RHBoK) operator on each spoke cluster: +. Install the Red Hat Build of Kueue (RHBoK) Operator on each spoke cluster: + .. If the cert-manager is not already installed, install it from OperatorHub. Alternatively, you can install it using the following script: + @@ -27,9 +27,9 @@ You can configure {product-title} clusters as spoke clusters to execute pipeline $ curl -sL https://raw.githubusercontent.com/openshift/kueue-operator/refs/heads/main/hack/deploy-cert-manager.sh | bash ---- + -.. Install the Red Hat Build of Kueue operator version 1.3 or later from OperatorHub. +.. Install the Red Hat Build of Kueue Operator version 1.3 or later from OperatorHub. + -.. Create a Kueue custom resource to configure the operator by running the following command: +.. Create a Kueue custom resource to configure the Operator by running the following command: + [source,terminal] ---- @@ -62,7 +62,7 @@ EOF . On each spoke cluster, create a service account and RBAC resources for MultiKueue by running the following command: + -This service account and its associated roles allow the hub cluster to execute pipeline runs on this spoke cluster. The permissions include creating and managing pipeline runs, task runs, pods, secrets, and Kueue workloads. You will generate a kubeconfig for this service account in a later step. +This service account and its associated roles allow the hub cluster to run pipeline runs on this spoke cluster. The permissions include creating and managing pipeline runs, task runs, pods, secrets, and Kueue workloads. You will generate a kubeconfig for this service account in a later step. + [source,terminal] ---- @@ -313,4 +313,4 @@ Save this `spoke-cluster.kubeconfig` file and provide it to the hub cluster admi .Verification -* Verify that the spoke cluster can receive and execute pipeline runs from the hub cluster. See "Verifying multicluster setup". +* Verify that the spoke cluster can receive and run pipeline runs from the hub cluster. See "Verifying multicluster setup". diff --git a/modules/op-configuring-ssh-authentication-for-git.adoc b/modules/op-configuring-ssh-authentication-for-git.adoc index 5560f013d41..45a14a6f6d6 100644 --- a/modules/op-configuring-ssh-authentication-for-git.adoc +++ b/modules/op-configuring-ssh-authentication-for-git.adoc @@ -107,4 +107,4 @@ $ oc apply --filename secret.yaml,serviceaccount.yaml,run.yaml [role="_additional-resources"] .Additional resources -* link:https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent[Generating a new SSH key and adding it to the ssh-agent] +* link:https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent[Generating a new SSH key and adding it to the SSH agent] diff --git a/modules/op-constructing-pipelines-using-pipeline-builder.adoc b/modules/op-constructing-pipelines-using-pipeline-builder.adoc index 361e21408d9..291a8c420e5 100644 --- a/modules/op-constructing-pipelines-using-pipeline-builder.adoc +++ b/modules/op-constructing-pipelines-using-pipeline-builder.adoc @@ -9,7 +9,7 @@ In the *Developer* perspective of the console, you can use the *+Add* -> *Pipeline* -> *Pipeline builder* option to: * Configure pipelines using either the *Pipeline builder* or the *YAML view*. -* Construct a pipeline flow using existing tasks. When you install the {pipelines-shortname} Operator, it adds reusable pipeline tasks to your cluster that you can use with the cluster resolver. +* Construct a pipeline flow by using existing tasks. When you install the {pipelines-shortname} Operator, it adds reusable pipeline tasks to your cluster that you can use with the cluster resolver. * Specify the type of resources required for the pipeline run, and if required, add additional parameters to the pipeline. * Reference these pipeline resources in each of the tasks in the pipeline as input and output resources. * If required, reference any additional parameters added to the pipeline in the task. The Pipeline Builder prepopulates the task parameters based on the task specifications. @@ -18,14 +18,14 @@ In the *Developer* perspective of the console, you can use the *+Add* -> *Pipeli [IMPORTANT] ==== -In the developer perspective, you can create a customized pipeline using your own set of curated tasks. To search, install, and upgrade your tasks directly from the developer console, your cluster administrator needs to install and deploy a local {tekton-hub} instance and link that hub to the {product-title} cluster. For more details, see _Using {tekton-hub} with {pipelines-shortname}_. +In the developer perspective, you can create a customized pipeline by using your own set of curated tasks. To search, install, and upgrade your tasks directly from the developer console, your cluster administrator needs to install and deploy a local {tekton-hub} instance and link that hub to the {product-title} cluster. For more details, see _Using {tekton-hub} with {pipelines-shortname}_. If you do not deploy any local {tekton-hub} instance, by default, you can only access namespace tasks and public {tekton-hub} tasks. ==== .Procedure . In the *+Add* view of the *Developer* perspective, click the *Pipeline* tile to see the *Pipeline builder* page. -. Configure the pipeline using either the *Pipeline builder* view or the *YAML view*. +. Configure the pipeline by using either the *Pipeline builder* view or the *YAML view*. + [NOTE] ==== @@ -40,7 +40,7 @@ image::op-pipeline-yaml.png[YAML view of the Pipeline builder] .. In the *Name* field, enter a unique name for the pipeline. .. In the *Tasks* section: ... Click *Add task*. -... Search for a task using the quick search field and select the required task from the displayed list. +... Search for a task by using the quick search field and select the required task from the displayed list. ... Click *Add* or *Install and add*. In this example, use the *s2i-Node.js* task. + [NOTE] @@ -50,7 +50,7 @@ The search list has all the {tekton-hub} tasks and tasks available in the cluste *** To add sequential tasks to the pipeline: **** Click the plus icon to the right or left of the task -> click *Add task*. -**** Search for a task using the quick search field and select the required task from the displayed list. +**** Search for a task by using the quick search field and select the required task from the displayed list. **** Click *Add* or *Install and add*. + .Pipeline builder @@ -58,7 +58,7 @@ image::op-pipeline-builder.png[Pipeline builder view] *** To add a final task: **** Click the *Add finally task* -> Click *Add task*. -**** Search for a task using the quick search field and select the required task from the displayed list. +**** Search for a task by using the quick search field and select the required task from the displayed list. **** Click *Add* or *Install and add*. .. In the *Resources* section, click *Add Resources* to specify the name and type of resources for the pipeline run. These resources are then used by the tasks in the pipeline as inputs and outputs. For this example: @@ -67,7 +67,7 @@ image::op-pipeline-builder.png[Pipeline builder view] + [NOTE] ==== -An error icon appears next to the task if a resource is missing. +An error icon is displayed next to the task if a resource is missing. ==== .. Optional: The *Parameters* for a task are pre-populated based on the specifications of the task. If required, use the *Add Parameters* link in the *Parameters* section to add additional parameters. diff --git a/modules/op-creating-a-github-application-in-administrator-perspective.adoc b/modules/op-creating-a-github-application-in-administrator-perspective.adoc index cc739a4a385..54cd1055f25 100644 --- a/modules/op-creating-a-github-application-in-administrator-perspective.adoc +++ b/modules/op-creating-a-github-application-in-administrator-perspective.adoc @@ -17,7 +17,7 @@ If you created additional {pac} controllers to support additional GitHub apps, y You have installed the {pipelines-title} `{pipelines-ver}` operator from the Operator Hub. .Procedure -. In the administrator perspective, navigate to *Pipelines* using the navigation pane. +. In the administrator perspective, navigate to *Pipelines* by using the navigation pane. . Click *Setup GitHub App* on the *Pipelines* page. . Enter your GitHub App name. For example, `pipelines-ci-clustername-testui`. . Click *Setup*. diff --git a/modules/op-creating-and-verifying-task-run-signatures-without-any-additional-authentication.adoc b/modules/op-creating-and-verifying-task-run-signatures-without-any-additional-authentication.adoc index eae8fec2ec7..b069acbed0c 100644 --- a/modules/op-creating-and-verifying-task-run-signatures-without-any-additional-authentication.adoc +++ b/modules/op-creating-and-verifying-task-run-signatures-without-any-additional-authentication.adoc @@ -89,7 +89,7 @@ $ tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev $ export TASKRUN_UID=$(tkn tr describe --last -o jsonpath='{.metadata.uid}') ---- -. To verify the signature using the public key that you created, enter the following command: +. To verify the signature by using the public key that you created, enter the following command: + [source,terminal] ---- diff --git a/modules/op-creating-global-repository-cr.adoc b/modules/op-creating-global-repository-cr.adoc index bb17119ba46..530236b1ffa 100644 --- a/modules/op-creating-global-repository-cr.adoc +++ b/modules/op-creating-global-repository-cr.adoc @@ -14,7 +14,7 @@ include::snippets/technology-preview.adoc[] .Prerequisites * You have administrator access to the `openshift-pipelines` namespace. -* You logged on to the OpenShift cluster using the `oc` command line utility. +* You logged on to the OpenShift cluster by using the `oc` command line utility. .Procedure diff --git a/modules/op-creating-pipeline-runs-multicluster.adoc b/modules/op-creating-pipeline-runs-multicluster.adoc index 97038124958..13e2e77d3a6 100644 --- a/modules/op-creating-pipeline-runs-multicluster.adoc +++ b/modules/op-creating-pipeline-runs-multicluster.adoc @@ -13,7 +13,7 @@ After you configure multicluster support, you can create pipeline runs on the hu * You have configured the hub cluster for multicluster support. * You have configured at least one spoke cluster for multicluster support. -* You have access to the hub cluster using an account with permissions to create pipeline runs. +* You have access to the hub cluster by using an account with permissions to create pipeline runs. * You have created a namespace with a LocalQueue resource. .Procedure diff --git a/modules/op-deleting-the-pipelines-custom-resources.adoc b/modules/op-deleting-the-pipelines-custom-resources.adoc index dfcfeb74e0e..e98fb13fa91 100644 --- a/modules/op-deleting-the-pipelines-custom-resources.adoc +++ b/modules/op-deleting-the-pipelines-custom-resources.adoc @@ -11,13 +11,13 @@ You can remove the {pipelines-shortname} custom resources (CRs) to clean up the .Procedure . In the *Administrator* perspective of the web console, navigate to *Administration* -> *`CustomResourceDefinitions`*. -. Type `TektonHub` in the *Filter by name* field to search for the `TektonHub` Custom Resource Definition (CRD). +. Type `TektonHub` in the *Filter by name* field to search for the `TektonHub` custom resource definition (CRD). . Click the name of the `TektonHub` CRD to display the details page for the CRD. . Click the `Instances` tab. -. If an instance appears, click the *Options* menu {kebab} for the displayed instance. +. If an instance is displayed, click the *Options* menu {kebab} for the displayed instance. . Select *Delete `TektonHub`*. diff --git a/modules/op-disabling-inline-spec.adoc b/modules/op-disabling-inline-spec.adoc index cd980ed57bd..6ccf12d62df 100644 --- a/modules/op-disabling-inline-spec.adoc +++ b/modules/op-disabling-inline-spec.adoc @@ -77,12 +77,12 @@ You can set the `disable-inline-spec` parameter to any single value or to a comm | Value | Description |`pipeline` -|You cannot use a `taskSpec:` spec to define a task inside a `Pipeline` CR. Instead, you must use a `taskRef:` spec to incorporate a task from a `Task` CR or to specify a task using a resolver. +|You cannot use a `taskSpec:` spec to define a task inside a `Pipeline` CR. Instead, you must use a `taskRef:` spec to incorporate a task from a `Task` CR or to specify a task by using a resolver. |`pipelinerun` -|You cannot use a `pipelineSpec:` spec to define a pipeline inside a `PipelineRun` CR. Instead, you must use a `pipelineRef:` spec to incorporate a pipeline from a `Pipeline` CR or to specify a pipeline using a resolver. +|You cannot use a `pipelineSpec:` spec to define a pipeline inside a `PipelineRun` CR. Instead, you must use a `pipelineRef:` spec to incorporate a pipeline from a `Pipeline` CR or to specify a pipeline by using a resolver. |`taskrun` -|You cannot use a `taskSpec:` spec to define a task inside a `TaskRun` CR. Instead, you must use a `taskRef:` spec to incorporate a task from a `Task` CR or to specify a task using a resolver. +|You cannot use a `taskSpec:` spec to define a task inside a `TaskRun` CR. Instead, you must use a `taskRef:` spec to incorporate a task from a `Task` CR or to specify a task by using a resolver. |=== diff --git a/modules/op-enabling-manual-approval-gate.adoc b/modules/op-enabling-manual-approval-gate.adoc index cd175c258b7..787aec776e1 100644 --- a/modules/op-enabling-manual-approval-gate.adoc +++ b/modules/op-enabling-manual-approval-gate.adoc @@ -11,7 +11,7 @@ To use manual approval tasks, you must first enable the manual approval gate con .Prerequisites * You installed the {pipelines-title} Operator in your cluster. -* You have logged in to the cluster using the `oc` command-line utility. +* You have logged in to the cluster by using the `oc` command-line utility. * You have administrator permissions for the `openshift-pipelines` namespace. .Procedure diff --git a/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc b/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc index 9723fdb3e62..8a1897c6704 100644 --- a/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc +++ b/modules/op-enabling-monitoring-of-event-listeners-for-triggers-for-user-defined-projects.adoc @@ -55,7 +55,7 @@ spec: $ git commit -m "empty-commit" --allow-empty && git push origin main ---- . On the {OCP} web console, navigate to **Administrator** -> **Observe** -> **Metrics**. -. To view a metric, search by its name. For example, to view the details of the `eventlistener_http_resources` metric for the `github-listener` event listener, search using the `eventlistener_http_resources` keyword. +. To view a metric, search by its name. For example, to view the details of the `eventlistener_http_resources` metric for the `github-listener` event listener, search by using the `eventlistener_http_resources` keyword. [role="_additional-resources"] .Additional resources diff --git a/modules/op-entitlements-shared-csi-driver.adoc b/modules/op-entitlements-shared-csi-driver.adoc index 6d52ade40a2..40eebdda9df 100644 --- a/modules/op-entitlements-shared-csi-driver.adoc +++ b/modules/op-entitlements-shared-csi-driver.adoc @@ -3,15 +3,15 @@ // *openshift_pipelines/configuring-security-context-for-pods.adoc :_mod-docs-content-type: PROCEDURE [id="op-entitlements-shared-csi-driver_{context}"] -= Using Red Hat entitlements by sharing the secret using the Shared Resources CSI driver operator += Using Red Hat entitlements by sharing the secret using the Shared Resources CSI Driver Operator [role="_abstract"] You can set up sharing of the `etc-pki-entitlement` secret from the `openshift-config-managed` namespace to other namespaces by using the Shared Resources Container Storage Interface (CSI) Driver Operator. You can then configure your pipeline to use this secret for the Buildah task. .Prerequisites -* You have logged in to your {OCP} cluster using the `oc` command line utility as a user with cluster administrator permissions. -* You have enabled the Shared Resources CSI Driver operator on your {OCP} cluster. +* You have logged in to your {OCP} cluster by using the `oc` command line utility as a user with cluster administrator permissions. +* You have enabled the Shared Resources CSI Driver Operator on your {OCP} cluster. .Procedure diff --git a/modules/op-interacting-with-pipelines-using-the-developer-perspective.adoc b/modules/op-interacting-with-pipelines-using-the-developer-perspective.adoc index 7997baa40f9..376fbcb5dbb 100644 --- a/modules/op-interacting-with-pipelines-using-the-developer-perspective.adoc +++ b/modules/op-interacting-with-pipelines-using-the-developer-perspective.adoc @@ -23,8 +23,8 @@ By default, the *Details* tab displays a visual representation of all the `seria + To view the task details, click the listed *Tasks* and *Finally* tasks. In addition, you can do the following: + -* Use the zoom in, zoom out, fit to screen, and reset view features using the standard icons displayed in the lower left corner of the *Pipeline details* visualization. -* Change the zoom factor of the pipeline visualization using the mouse wheel. +* Use the zoom in, zoom out, fit to screen, and reset view features by using the standard icons displayed in the lower left corner of the *Pipeline details* visualization. +* Change the zoom factor of the pipeline visualization by using the mouse wheel. * Hover over the tasks and see the task details. + .Pipeline details diff --git a/modules/op-interfacing-pipelines-as-code-with-custom-certificates.adoc b/modules/op-interfacing-pipelines-as-code-with-custom-certificates.adoc index 0e48f7e443e..93d4f70d7d8 100644 --- a/modules/op-interfacing-pipelines-as-code-with-custom-certificates.adoc +++ b/modules/op-interfacing-pipelines-as-code-with-custom-certificates.adoc @@ -10,5 +10,5 @@ To configure {pac} with a Git repository that uses a privately signed or custom .Procedure -* If you have installed {pac} using the {pipelines-title} Operator, you can add your custom certificate to the cluster using the `Proxy` object. The Operator exposes the certificate in all {pipelines-title} components and workloads, including {pac}. +* If you have installed {pac} by using the {pipelines-title} Operator, you can add your custom certificate to the cluster by using the `Proxy` object. The Operator exposes the certificate in all {pipelines-title} components and workloads, including {pac}. diff --git a/modules/op-lightspeed-utility-commands.adoc b/modules/op-lightspeed-utility-commands.adoc index 48d942f9beb..aa601815437 100644 --- a/modules/op-lightspeed-utility-commands.adoc +++ b/modules/op-lightspeed-utility-commands.adoc @@ -6,7 +6,7 @@ = {ols} utility commands [role="_abstract"] -Use the {pipelines-shortname} Client (opc) to access generative AI-powered diagnostics. These commands use {ols-official} to analyze pipeline failures and give actionable troubleshooting guidance. +Use the {pipelines-shortname} Client (opc) to access generative diagnostics powered by artificial intelligence. These commands use {ols-official} to analyze pipeline failures and give actionable troubleshooting guidance. For installation and configuration of {ols}, see the {ols-official} documentation. @@ -20,8 +20,8 @@ assist:: | Command | Description -| `opc assist pipelinerun diagnose` | Analyze a failed `PipelineRun` execution using {ols} to identify the root cause and display suggested remediation steps. -| `opc assist taskrun diagnose` | Analyze a failed `TaskRun` execution using {ols} to identify the root cause and display suggested remediation steps. +| `opc assist pipelinerun diagnose` | Analyze a failed `PipelineRun` execution by using {ols} to identify the root cause and display suggested remediation steps. +| `opc assist taskrun diagnose` | Analyze a failed `TaskRun` execution by using {ols} to identify the root cause and display suggested remediation steps. |=== diff --git a/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc b/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc index 90f7312a560..1e58273c5e1 100644 --- a/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc +++ b/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc @@ -180,7 +180,7 @@ metadata: [NOTE] ==== -If you use the `header` or `body` field for event matching, you might be unable to trigger the pipeline run using Git commands such as `retest`. If you use a Git command, the payload body is the comment that has this command, and not the original payload. +If you use the `header` or `body` field for event matching, you might be unable to trigger the pipeline run by using Git commands such as `retest`. If you use a Git command, the payload body is the comment that has this command, and not the original payload. If you want to trigger the pipeline run again when using the `body` field for event matching, you can close and reopen the pull request or merge request, or add a new SHA commit. To add a new SHA commit, use the following command: diff --git a/modules/op-migrating-to-artifact-hub.adoc b/modules/op-migrating-to-artifact-hub.adoc index 2dc5edabaf8..4e2a541a557 100644 --- a/modules/op-migrating-to-artifact-hub.adoc +++ b/modules/op-migrating-to-artifact-hub.adoc @@ -25,7 +25,7 @@ You can update existing Tekton resources to use {artifact-hub} instead of the de * For Pipelines: change `catalog: Tekton` to `catalog: tekton-catalog-pipelines` * For `StepActions`: change `catalog: Tekton` to `catalog: tekton-catalog-stepactions` -. Update version values to full semantic versioning (semver). +. Update version values to full semantic versioning (semver). + For example, change a version such as `0.8` to `0.8.0`. diff --git a/modules/op-multicluster-architecture.adoc b/modules/op-multicluster-architecture.adoc index 5c1d17af17c..4165be5d0a9 100644 --- a/modules/op-multicluster-architecture.adoc +++ b/modules/op-multicluster-architecture.adoc @@ -20,7 +20,7 @@ The hub cluster serves as the central control plane for managing pipeline runs. * Runs the syncer-service to synchronize secrets from the hub to spoke clusters * Manages pipeline run definitions and statuses * Schedules pipeline runs to spoke clusters based on resource availability -* Does not execute pipeline workloads +* Does not run pipeline workloads * Provides a unified interface for monitoring all pipeline runs The hub cluster requires the TektonConfig custom resource to have the scheduler enabled with multicluster role set to `Hub` (`spec.scheduler.multi-cluster-role: Hub`). @@ -30,7 +30,7 @@ On the hub cluster, you create pipeline runs that initially remain in a pending [id="spoke-clusters_{context}"] == Spoke clusters -Spoke clusters execute the actual pipeline workloads. Each spoke cluster has the following characteristics: +Spoke clusters run the actual pipeline workloads. Each spoke cluster has the following characteristics: * Contains a full {pipelines-shortname} installation * Runs Kueue with MultiKueue disabled diff --git a/modules/op-multicluster-limitations.adoc b/modules/op-multicluster-limitations.adoc index 87fdf200640..fc60a5fa2f5 100644 --- a/modules/op-multicluster-limitations.adoc +++ b/modules/op-multicluster-limitations.adoc @@ -38,7 +38,7 @@ The cancellation status is synchronized back to the hub cluster. [NOTE] ==== -Both the Stop and Cancel actions are designed to execute finally tasks as part of cleanup. Canceling from the spoke cluster allows finally tasks to execute properly. +Both the Stop and Cancel actions are designed to run finally tasks as part of cleanup. Canceling from the spoke cluster allows finally tasks to run properly. ==== Logs and status display:: @@ -51,7 +51,7 @@ API version requirement:: Multicluster pipeline runs must use the `tekton.dev/v1` API version. The `tekton.dev/v1beta1` API version is not supported. Reference limitations:: -You cannot use `pipelineRef` or `taskRef` to reference existing pipelines or tasks stored in the cluster using the cluster resolver. Instead, you must use one of the following approaches: +You cannot use `pipelineRef` or `taskRef` to reference existing pipelines or tasks stored in the cluster by using the cluster resolver. Instead, you must use one of the following approaches: * Embedded pipeline specifications * Remote resolvers such as Git, HTTP, or Bundle resolvers @@ -73,7 +73,7 @@ tkn CLI limitations:: The `tkn` CLI tool has limited functionality in multicluster environments: * On the hub cluster, the following commands do not work: -** `tkn taskrun list` - Returns no results because task runs execute on spoke clusters +** `tkn taskrun list` - Returns no results because task runs run on spoke clusters ** `tkn pipelinerun describe` - Fails with "failed to find get taskruns of the pipelineruns" ** `tkn pipelinerun logs` - Fails with "taskruns.tekton.dev not found" ** `tkn pipelinerun cancel` - Does not cancel the pipeline run diff --git a/modules/op-odc-pipelines-abstract.adoc b/modules/op-odc-pipelines-abstract.adoc index 5cacfbe8a1a..dcea8ecf398 100644 --- a/modules/op-odc-pipelines-abstract.adoc +++ b/modules/op-odc-pipelines-abstract.adoc @@ -10,7 +10,7 @@ In the *Developer* perspective, you can access the following options for creating pipelines from the *+Add* page: * Use the *+Add* -> *Pipelines* -> *Pipeline builder* option to create customized pipelines for your application. -* Use the *+Add* -> *From Git* option to create pipelines using pipeline templates and resources while creating an application. +* Use the *+Add* -> *From Git* option to create pipelines by using pipeline templates and resources while creating an application. After you create the pipelines for your application, you can view and visually interact with the deployed pipelines in the *Pipelines* view. You can also use the *Topology* view to interact with the pipelines created using the *From Git* option. You must apply custom labels to pipelines created using the *Pipeline builder* to see them in the *Topology* view. diff --git a/modules/op-providing-secure-connection.adoc b/modules/op-providing-secure-connection.adoc index c2393d03e63..dbaff0ca847 100644 --- a/modules/op-providing-secure-connection.adoc +++ b/modules/op-providing-secure-connection.adoc @@ -5,7 +5,7 @@ = Provide secure connection with OpenShift routes [role="_abstract"] -Provide secure connections with OpenShift routes using re-encrypted TLS termination to protect data in transit between external services and your cluster. +Provide secure connections with OpenShift routes by using re-encrypted TLS termination to protect data in transit between external services and your cluster. .Procedure diff --git a/modules/op-query-results-name.adoc b/modules/op-query-results-name.adoc index 2f9da6e936c..90382a7d166 100644 --- a/modules/op-query-results-name.adoc +++ b/modules/op-query-results-name.adoc @@ -82,7 +82,7 @@ $ opc results records get --addr ${RESULTS_API} \ xargs -0 python3 -c 'import sys, yaml, json; j=json.loads(sys.argv[1]); print(yaml.safe_dump(j))' ---- -. Optional: Retrieve the logging information for a task run from a record using the log record name. To get the log record name, replace `records` with `logs` in the record name. Enter the following command: +. Optional: Retrieve the logging information for a task run from a record by using the log record name. To get the log record name, replace `records` with `logs` in the record name. Enter the following command: + [source,terminal] ---- diff --git a/modules/op-release-notes-1-0.adoc b/modules/op-release-notes-1-0.adoc index 8b03da45f78..d856e5147f2 100644 --- a/modules/op-release-notes-1-0.adoc +++ b/modules/op-release-notes-1-0.adoc @@ -70,7 +70,7 @@ For this release, use the `disable-home-env-overwrite` and `disable-working-dire [id="known-issues-1-4-0_{context}"] == Known issues -* If you are upgrading from an older version of {pipelines-title}, you must delete your existing deployments before upgrading to {pipelines-title} version 1.0. To delete an existing deployment, you must first delete Custom Resources and then uninstall the {pipelines-title} Operator. For more details, see the uninstalling {pipelines-title} section. +* If you are upgrading from an older version of {pipelines-title}, you must delete your existing deployments before upgrading to {pipelines-title} version 1.0. To delete an existing deployment, you must first delete custom resources and then uninstall the {pipelines-title} Operator. For more details, see the uninstalling {pipelines-title} section. * Submitting the same `v1alpha1` tasks more than once results in an error. Use the `oc replace` command instead of `oc apply` when re-submitting a `v1alpha1` task. * The `buildah` cluster task does not work when a new user is added to a container. + diff --git a/modules/op-release-notes-1-12.adoc b/modules/op-release-notes-1-12.adoc index 20e48f3605f..8b8f9403a65 100644 --- a/modules/op-release-notes-1-12.adoc +++ b/modules/op-release-notes-1-12.adoc @@ -179,7 +179,7 @@ You must provide these parameters using secrets. After upgrading to {pipelines-s * Before this update, the bundles resolver sometimes set the type to `Task` when attempting to retrieve a pipeline, leading to errors in retrieval. With this update, the resolver uses the correct type to retrieve a pipeline. -* This update fixes an error in processing the Common Expression Language (CEL) NOT operator when querying {tekton-results}. +* This update fixes an error in processing the Common Expression Language (CEL) NOT expression when querying {tekton-results}. * This update fixed a `404` error response that was produced in the {tekton-results} API when a `LIST` operation for records was requested and the specified result was `-`. diff --git a/modules/op-release-notes-1-14.adoc b/modules/op-release-notes-1-14.adoc index 5a6cc97399a..61134d0efcf 100644 --- a/modules/op-release-notes-1-14.adoc +++ b/modules/op-release-notes-1-14.adoc @@ -21,7 +21,7 @@ In addition to fixes and stability improvements, the following sections highligh * With this update, if a pipeline run or task run uses the `pipeline` service account, you can use CSI volume types in the pipeline or task. -* With this update, you can use a `StepAction` custom resource (CR) to define a reusable scripted action that you can invoke from any number of tasks. To use this feature, you must set the `pipeline.options.configMaps.feature-flags.data.enable-step-actions` spec in the `TektonConfig` CR to `true`. +* With this update, you can use a `StepAction` custom resource (CR) to define a reusable scripted action that you can call from any number of tasks. To use this feature, you must set the `pipeline.options.configMaps.feature-flags.data.enable-step-actions` spec in the `TektonConfig` CR to `true`. * With this update, object parameters and array results are enabled by default. You do not need to set any flags to use them. @@ -335,15 +335,15 @@ With this update, {pipelines-title} General Availability (GA) 1.14.4 is availabl [id="fixed-issues-1-14-4_{context}"] === Fixed issues -* Before this update, a large number of error messages referencing `tekton-pipelines-webhook.ConversionWebhook` could be logged. With this update, unneeded conversion webhook configuration for the `ClusterTask` and `StepAction` Custom Resource Definitions (CRDs) was removed, and such error messages are no longer logged. +* Before this update, a large number of error messages referencing `tekton-pipelines-webhook.ConversionWebhook` could be logged. With this update, unneeded conversion webhook configuration for the `ClusterTask` and `StepAction` custom resource definitions (CRDs) was removed, and such error messages are no longer logged. * Before this update, some configuration settings using the `options` sections in the `TektonConfig` custom resource (CR) did not work, because a race condition would occur if the same setting was configured in both the `options` section and another field in the `TektonConfig` CR. With this update, the settings work. * Before this update, the {pipelines-shortname} console plugin pod did not move to the node specified using the `nodeSelector`, `tolerations`, and `priorityClassName` settings. With this update, the {pipelines-shortname} plugin pod moves to the correct node. -* Before this update, some error messages were logged in the operator controller logs without the proper context information. With this update, error messages contain the required information. +* Before this update, some error messages were logged in the Operator controller logs without the proper context information. With this update, error messages contain the required information. -* Before this update, if the `pipelines-scc-rolebinding` rolebinding was missing or deleted in any namespace, the {pipelines-shortname} operator controller would fail to create default resources in new namespaces correctly. With this update, the controller functions correctly. +* Before this update, if the `pipelines-scc-rolebinding` rolebinding was missing or deleted in any namespace, the {pipelines-shortname} Operator controller would fail to create default resources in new namespaces correctly. With this update, the controller functions correctly. * Before this update, if you configured the Horizontal Pod Autoscaler (HPA) using the `options` section in the `TektonConfig` CR, any existing HPA was updated correctly but a new HPA was not created when required. With this update, Horizontal Pod Autoscaler configuration using the `options` section works correctly. diff --git a/modules/op-release-notes-1-19.adoc b/modules/op-release-notes-1-19.adoc index 0798e4d9c1a..5f46966f85f 100644 --- a/modules/op-release-notes-1-19.adoc +++ b/modules/op-release-notes-1-19.adoc @@ -542,7 +542,7 @@ spec: * Before this update, the console plugin styling was outdated due to the upgrade to PatternFly 6 and the removal of deprecated `co-` classes. This caused alignment and spacing issues in the *Pipelines* section of the {OCP} web console. With this update, the console plugin styling is updated to use the appropriate PatternFly equivalent classes, ensuring consistent alignment and visual integration with the current {OCP} web console design standards -* Before this update, the {pipelines-shortname} console plugin failed due to a default {tekton-results} TLS secret creation issue in {pipelines-shortname} 1.18. This caused the console to be inaccessible, making pipeline details unviewable. With this release, the default {tekton-results} TLS secret creation is skipped in {pipelines-shortname} 1.18, resolving the issue. +* Before this update, the {pipelines-shortname} console plugin failed due to a default {tekton-results} TLS secret creation issue in {pipelines-shortname} 1.18. This caused the console to be inaccessible, making pipeline details not visible. With this release, the default {tekton-results} TLS secret creation is skipped in {pipelines-shortname} 1.18, resolving the issue. * Before this update, links for `PipelineRun` in the {OCP} web console incorrectly pointed to the deprecated `v1beta1` {pipelines-title} APIs instead of the current `v1` APIs. With this update, the links point to the appropriate `v1` APIs. diff --git a/modules/op-release-notes-1-20-0.adoc b/modules/op-release-notes-1-20-0.adoc index e5c6b9b9951..b7d47a197b8 100644 --- a/modules/op-release-notes-1-20-0.adoc +++ b/modules/op-release-notes-1-20-0.adoc @@ -29,7 +29,7 @@ Tasks display friendly names in the web console:: * Tasks in the {OCP} web console now use the `displayName` property instead of technical task names, improving readability and making tasks easier to search within the {pipelines-title} user interface. {pipelines-shortname} on {sno}:: -* Tech preview support for running {pipelines-shortname} on Single-Node OpenShift (SNO) is now available. This support is not intended for production deployments. {pipelines-shortname} on SNO has no additional limitations beyond the inherent constraints of a single-node cluster: limited scalability, no redundancy, and constrained concurrency. +* Tech preview support for running {pipelines-shortname} on {sno} is now available. This support is not intended for production deployments. {pipelines-shortname} on {sno} has no additional limitations beyond the inherent constraints of a single-node cluster: limited scalability, no redundancy, and constrained concurrency. For a cluster on libvirt API, the minimum hardware requirements are: ** 12 vCPUs @@ -243,7 +243,7 @@ data: With this update, the issue is fixed, allowing pipelines with default `BUILD_ARGS` parameter to be saved correctly. .{pac} -* Before this update, structured logs for {pac} lacked detailed source repository information from the initiating webhook request. With this update, logs for {pac} include complete source repository details, making it easier for operators to identify user-reported issues. +* Before this update, structured logs for {pac} lacked detailed source repository information from the initiating webhook request. With this update, logs for {pac} include complete source repository details, making it easier for cluster administrators to identify user-reported issues. * Before this update, invalid Common Expression Language (CEL) expressions in {pac} `PipelineRun` failed silently. With this update, {pac} posts error comments on pull requests, making troubleshooting easier. diff --git a/modules/op-release-notes-1-21-0.adoc b/modules/op-release-notes-1-21-0.adoc index 3a62257ce6d..0719fffaf9c 100644 --- a/modules/op-release-notes-1-21-0.adoc +++ b/modules/op-release-notes-1-21-0.adoc @@ -15,7 +15,7 @@ For more information about the supported versions of {OCP}, see link:https://acc In addition to fixes and stability improvements, the following sections highlight what is new in {pipelines-title} 1.21: -.Pipelines +*Pipelines* //https://issues.redhat.com/browse/SRVKP-7303 Read-only root filesystems enabled for {pipelines-shortname} containers:: @@ -71,7 +71,7 @@ spec: ** `max-size`: defines the maximum number of cached entries. The default value is `"1000"`. ** `ttl`: defines the time to live of the cache entry. The default value is `"5m"`. + -* *Per-resolver defaults*: You can set the default caching mode for specific resolvers using the `bundleresolver-config`, `git-resolver-config`, or `cluster-resolver-config` config maps: +* *Per-resolver defaults*: You can set the default caching mode for specific resolvers by using the `bundleresolver-config`, `git-resolver-config`, or `cluster-resolver-config` config maps: + [source,yaml] ---- @@ -200,7 +200,7 @@ spec: //+ //link:https://issues.redhat.com/browse/SRVKP-9135[SRVKP-9135] -.Operator +*Operator* //https://issues.redhat.com/browse/SRVKP-6166 A new parameter for controlling pipeline service account permissions:: @@ -233,7 +233,7 @@ With this update, the {tekton-results} component automatically creates an OpenSh //link:https://issues.redhat.com/browse/SRVKP-9140[SRVKP-9140] // and SRVKP-8057 -.User interface +*User interface* //https://issues.redhat.com/browse/SRVKP-8906 Group support for Approval Tasks:: @@ -250,7 +250,7 @@ With this update, the time-range filter earlier labeled "Last weeks" is updated //link:https://issues.redhat.com/browse/SRVKP-9428[SRVKP-9428] -.{pac} +*{pac}* //https://issues.redhat.com/browse/SRVKP-9056 Improved performance for GitLab project access control checks:: @@ -346,7 +346,7 @@ With this update, when no `secret` key is explicitly specified in the `Repositor -.{tekton-results} +*{tekton-results}* //https://issues.redhat.com/browse/SRVKP-8280 Fine-grained retention policies:: @@ -455,7 +455,7 @@ If you are using the default PostgreSQL deployment, ensure you have backed up yo //link:https://issues.redhat.com/browse/SRVKP-9336[SRVKP-9336] -.{tekton-cache} +*{tekton-cache}* //https://issues.redhat.com/browse/RHDEVDOCS-6985 {tekton-cache} is generally available:: @@ -470,7 +470,7 @@ Improved support for Docker credentials:: Before this update, `{tekton-cache}` required Docker secrets to include a `config.json` key. With this update, Docker secrets without a `config.json` key are supported. The `DOCKER_CONFIG` parameter can point to any location containing either a `config.json` file or a `.dockerconfigjson` file, improving flexibility for private registry authentication. -.{tekton-triggers} +*{tekton-triggers}* GitHub interceptor enforces SHA-256 signature validation:: Before this update, the GitHub interceptor supported both SHA-1 (`X-Hub-Signature`) and SHA-256 (`X-Hub-Signature-256`) signatures for webhook validation. With this update, the GitHub interceptor enforces a stricter security posture and only accepts SHA-256 signatures by using the `X-Hub-Signature-256` header, dropping support for SHA-1. As a result, standard GitHub webhooks remain unaffected, but any custom webhook implementations must update their Hash-based Message Authentication Code (HMAC) signature generation from SHA-1 to SHA-256 to avoid validation errors. @@ -478,14 +478,14 @@ Before this update, the GitHub interceptor supported both SHA-1 (`X-Hub-Signatur //link:https://issues.redhat.com/browse/SRVKP-9136[SRVKP-9136] -.{tekton-hub} +*{tekton-hub}* Default database migration to PostgreSQL version 15:: The PostgreSQL database version used by the {tekton-hub} is migrated from version 13 to version 15 to address the upcoming end of life (EOL) for PostgreSQL 13. This upgrade ensures continued stability and support for the {tekton-hub}. Additionally, the process implements an automated migration from version 13 to version 15 for existing deployments. //+ //link:https://issues.redhat.com/browse/SRVKP-9337[SRVKP-9337] -.{tekton-chains} +*{tekton-chains}* Flexible provenance and signing configuration:: With this update, you can select to disable image signing while still enabling provenance generation and attestation signing. This enhancement helps give more flexibility in managing security artifacts within your CI/CD pipelines. @@ -498,7 +498,7 @@ With this update, a new configuration option, `artifacts.oci.disable-signing`, i //link:https://issues.redhat.com/browse/SRVKP-8354[SRVKP-8354] -.CLI +*CLI* //https://issues.redhat.com/browse/SRVKP-7356 Support for rerunning resolver-based `PipelineRuns`:: @@ -509,13 +509,13 @@ New --resolvertype to support rerunning resolver-based `PipelineRuns`:: With this update, the `tkn p start --last` command introduces the `--resolvertype` flag. This flag enables users to specify the resolver type, such as `git`, `hub`, or `bundle`, when re-running a earlier resolver-based `PipelineRun`. Additionally, the help text for the command has been updated to use the correct pronoun. -.Pruner +*Pruner* //https://issues.redhat.com/browse/SRVKP-6989 Event-driven pruner is generally available:: With this update, the event-driven pruner `tektonpruner` is generally available (GA) and is fully supported as a pruning mechanism for {pipelines-shortname} with centralized and hierarchical configuration. + -While existing pruning mechanisms, such as the default job-based pruner, {pac} `keep-max-run`, and {tekton-results} based `retention`, continue to function, users currently relying on previous pruning approaches are encouraged to adopt the event-driven pruner `tektonpruner` to help ensure smoother performance, more predictable cleanup, and reduced operational overhead. +While existing pruning mechanisms, such as the default job-based pruner, {pac} `keep-max-run`, and {tekton-results} based `retention`, continue to function, users currently relying on previous pruning approaches are encouraged to adopt the event-driven pruner `tektonpruner` to help ensure smoother performance, more predictable cleanup, and reduced operational cost. + The following enhancements are present in this release: + @@ -541,7 +541,7 @@ labels: [id="pipelines-technology-preview-1-21-0"] == Technology Preview features -.{pac} +*{pac}* //https://issues.redhat.com/browse/SRVKP-8026 A new command for evaluating Common Expression Language (CEL) expressions (Technology Preview):: @@ -558,7 +558,7 @@ $ tkn pac cel -b -H + Key capabilities include: * Interactive mode: Provides a prompt in the terminal to type CEL expressions, with tab completion for variables and payload fields. -* Variable access using: +* Variable access by using: ** direct variables, such as `event` or `target_branch`, ** webhook payload fields, for example, `body.action`, ** HTTP headers, for example, `headers['X-GitHub-Event']`, @@ -568,7 +568,7 @@ Key capabilities include: //link:https://issues.redhat.com/browse/SRVKP-8026[SRVKP-8026] -.Manual Approval Gate +*Manual Approval Gate* //https://issues.redhat.com/browse/SRVKP-7187 Group support for Approval Task:: @@ -582,20 +582,20 @@ With this update, messages added by any member of a group when approving or reje [id="pipelines-breaking-changes-1-21-0"] == Breaking changes -.User interface +*User interface* Pipelines console navigation requires explicit plugin enablement:: With this update, the previous static console plugin is fully deprecated. After installing the {pipelines-title} Operator, you must explicitly enable the console plugin to access the *Pipelines* section in the {OCP} console. The earlier fallback behavior, which displayed a limited *Pipelines* entry when the plugin was disabled, is removed, and the *Pipelines* navigation menu is only visible when the console plugin is active. //+ //link:https://issues.redhat.com/browse/SRVKP-9456[SRVKP-9456] -.{pac} +*{pac}* //https://issues.redhat.com/browse/SRVKP-8663 pipelinerun_status field in Repository custom resource is deprecated:: With this update, the `pipelinerun_status` field of the `Repository` custom resource (CR) is deprecated and will be removed in a future release. Update any integrations or automation that reference this field to ensure compatibility with upcoming versions. -.{tekton-chains} +*{tekton-chains}* //https://issues.redhat.com/browse/SRVKP-9137 Cosign v2.6.0 update affects keyless signing:: @@ -605,7 +605,7 @@ With this update, {tekton-chains} uses Cosign version 2.6.0, which no longer acc [id="pipelines-known-issues-1-21-0"] == Known issues -.User interface +*User interface* Duplicate Pipelines navigation entry in the OpenShift Console:: During the migration from static to dynamic console plugins, the OpenShift Console might temporarily display two *Pipelines* entries in the navigation menu. This is a UI-only issue and does not affect pipeline execution or data. @@ -618,7 +618,7 @@ link:https://issues.redhat.com/browse/SRVKP-10006[SRVKP-10006] [id="pipelines-fixed-issues-1-21-0"] == Fixed issues -.Pipelines +*Pipelines* `PipelineRuns` fail clearly on invalid `apiVersion`:: Before this update, setting the `spec.tasks[].taskRef.apiVersion` field to an invalid value caused `PipelineRun` execution to fail silently. With this update, `PipelineRun` displays a clear error when `taskRef.apiVersion` is invalid. @@ -651,7 +651,7 @@ Before this update, `arm64` Kubernetes clusters experienced `TaskRun` failures d link:https://issues.redhat.com/browse/SRVKP-9135[SRVKP-9135] -.Operator +*Operator* Improved proxy webhook performance by replacing synchronous checks:: Before this update, the proxy webhook could timeout under high-concurrency workloads because it performed synchronous API calls to verify config map existence during pod admission. With this update, the webhook uses optional config map volumes that gracefully handle missing CA bundles without blocking pod creation. As a result, the defaulting webhook is less affected by etcd performance issues, the CA bundles `configmaps` are always mounted as Optional volumes, and the environment variable `SSL_CERT_DIR` is always set on `TaskRun` step-containers. @@ -693,7 +693,7 @@ Before this update, the {pipelines-shortname} Operator removed the `catalog-{IND + link:https://issues.redhat.com/browse/SRVKP-9472[SRVKP-9472] -.User interface +*User interface* Fixed `PipelineRun` canceling status in OpenShift Console after `TaskRuns` complete:: Before this update, the {OCP} Console showed `PipelineRuns` in a canceling state even after all associated `TaskRuns` completed, due to an internal UI inconsistency. With this update, the OpenShift Console `PipelineRun` status mechanism is corrected. As a result, `PipelineRun` status accurately reflects the state of completed `TaskRuns`. @@ -768,7 +768,7 @@ link:https://issues.redhat.com/browse/SRVKP-9436[SRVKP-9436] -.{pac} +*{pac}* GitOps commands in GitLab MR discussion replies are recognized:: Before this update, GitOps commands, such as `/ok-to-test`, posted as replies within GitLab merge request discussion threads were ignored; only commands in the top-level comment of a discussion were recognized. With this update, the GitLab provider honors commands posted in replies, improving command recognition and workflow reliability. @@ -853,7 +853,7 @@ Before this update, `PipelineRun` objects that failed validation in GitLab displ link:https://issues.redhat.com/browse/SRVKP-9044[SRVKP-9044] -.Tekton Ecosystem +*Tekton Ecosystem* Many image copy enabled in skopeo-copy task by using URL.txt:: Before this update, the `skopeo-copy` task failed to copy many images when source and destination image URLs were not provided, as it required non-empty image URLs and bypassed the `url.txt` file method. With this update, the `skopeo-copy` task parameters are optional, allowing the use of the `url.txt` file for many image copies regardless of source and destination URLs. As a result, the task supports copying many images by using `url.txt`. @@ -861,7 +861,7 @@ Before this update, the `skopeo-copy` task failed to copy many images when sourc link:https://issues.redhat.com/browse/SRVKP-6491[SRVKP-6491] -.{tekton-results} +*{tekton-results}* Description for `PipelineRun` deletion metric is correct:: Before this update, the metrics exposed by {tekton-results} had an inaccurate description for the metric tracking the duration of `PipelineRun` deletion. This caused confusion and reduced the reliability of metrics reporting. With this update, the description for the `prDeleteDuration` metric is corrected to accurately reflect the time between `PipelineRun` completion and final deletion. @@ -883,7 +883,7 @@ Before this update, the configuration behavior was inconsistent if the deprecate + link:https://issues.redhat.com/browse/SRVKP-9425[SRVKP-9425] -.{tekton-hub} +*{tekton-hub}* The system no longer downloads an outdated version of the git-clone task:: Before this update, the system downloaded an outdated version of the `git-clone` task (0.9.0) instead of the latest version (0.10). As a result, end users installed the older 0.9 version, causing inconsistencies and missing improvements available in 0.10. With this update, the `git-clone` task is updated to version 0.10. @@ -891,7 +891,7 @@ Before this update, the system downloaded an outdated version of the `git-clone` link:https://issues.redhat.com/browse/SRVKP-8568[SRVKP-8568] -.{tekton-chains} +*{tekton-chains}* Anti-affinity rule added to tekton-chains-controller spec:: Before this update, the `tekton-chains-controller` spec did not include an anti-affinity rule, causing pods to be unevenly distributed across nodes and potentially leading to resource contention. With this update, an anti-affinity rule is added to the `tekton-chains-controller` spec, improving pod scheduling and ensuring better resource distribution. @@ -908,7 +908,7 @@ Before this update, a build error caused failures in the End-to-End (E2E) testin + link:https://issues.redhat.com/browse/SRVKP-9137[SRVKP-9137] -.Pruner +*Pruner* Namespace-level pruner configuration updates takes effect immediately after upgrade:: Before this update, if event based pruner was enabled before an upgrade, the Operator reverted the pruner config values to default values after the upgrade. With this update, the values of pruner config are retained after an upgrade. diff --git a/modules/op-release-notes-1-22-0.adoc b/modules/op-release-notes-1-22-0.adoc index 024f9d4d444..1af02adc75c 100644 --- a/modules/op-release-notes-1-22-0.adoc +++ b/modules/op-release-notes-1-22-0.adoc @@ -5,6 +5,7 @@ [id="op-release-notes-1-22-0_{context}"] = Release notes for {pipelines-title} 1.22 +[role="_abstract"] With this update, {pipelines-title} General Availability (GA) 1.22 is available on {OCP} 4.14 and later supported versions. For more information about supported {OCP} versions, see link:https://access.redhat.com/support/policy/updates/openshift#dates[Life Cycle Dates]. @@ -14,7 +15,7 @@ For more information about supported {OCP} versions, see link:https://access.red In addition to fixes and stability improvements, these sections highlight what is new in {pipelines-title} 1.22: -.Pipelines +*Pipelines* //SRVKP-10637 hostUsers support in podTemplate for user namespace isolation:: @@ -23,7 +24,7 @@ With this update, {pipelines-shortname} supports the `hostUsers` setting in the link:https://issues.redhat.com/browse/SRVKP-9726[SRVKP-9726] The HTTP resolver supports content verification with a hash parameter:: -With this update, the HTTP resolver includes an optional `hash` parameter that accepts SHA-256 or SHA-512 hashes of the expected content. When you provide a hash, the resolver verifies content integrity after fetching by comparing the hash of the received content against the expected value. This enhancement helps improve security by ensuring that the content you fetch from HTTP sources matches your expectations, similar to the content verification available with the git resolver using commit hashes and the bundle resolver using digests. +With this update, the HTTP resolver includes an optional `hash` parameter that accepts SHA-256 or SHA-512 hashes of the expected content. When you provide a hash, the resolver verifies content integrity after fetching by comparing the hash of the received content against the expected value. This enhancement helps improve security by ensuring that the content you fetch from HTTP sources matches your expectations, similar to the content verification available with the git resolver by using commit hashes and the bundle resolver by using digests. + link:https://issues.redhat.com/browse/SRVKP-8511[SRVKP-8511] @@ -34,7 +35,7 @@ With this update, {pipelines-shortname} supports caching for bundle, git, and cl * `never` - disable caching * `auto` - cache only immutable references such as git SHAs and digest-based bundles + -The default mode is `auto`. You can configure cache behavior globally through resolver config maps or override it per task using the `cache` parameter. +The default mode is `auto`. You can configure cache behavior globally through resolver config maps or override it per task by using the `cache` parameter. + link:https://issues.redhat.com/browse/SRVKP-7037[SRVKP-7037] @@ -48,8 +49,8 @@ With this update, step objects support a `displayName` field, helping improve pi + link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] -Pipelines can execute embedded pipelines:: -With this update, pipelines can execute embedded pipelines directly using the `PipelineSpec` field under tasks, enabling pipelines-in-pipelines functionality. +Pipelines can run embedded pipelines:: +With this update, pipelines can run embedded pipelines directly by using the `PipelineSpec` field under tasks, enabling pipelines-in-pipelines functionality. + link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] @@ -64,12 +65,12 @@ With this update, when persistent volume claim (PVC) creation hits a quota limit link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] Per-task timeout overrides in PipelineRun:: -With this update, individual task timeouts can be overridden at the `PipelineRun` level using the `spec.taskRunSpecs[].timeout` field. +With this update, individual task timeouts can be overridden at the `PipelineRun` level by using the `spec.taskRunSpecs[].timeout` field. + link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] -.Operator +*Operator* ServiceMonitor configuration for Results and Pipelines components:: With this update, the {pipelines-shortname} Operator creates `ServiceMonitor` resources for the `{tekton-results}` and `tekton-pipelines-webhook` components. This enables the Prometheus Operator to automatically discover their metrics endpoints, simplifying integration with OpenShift monitoring and alerting. @@ -77,7 +78,7 @@ With this update, the {pipelines-shortname} Operator creates `ServiceMonitor` re link:https://issues.redhat.com/browse/SRVKP-7683[SRVKP-7683] -.{pac} +*{pac}* Caching changed files to reduce VCS API load:: With this update, {pac} caches the list of changed files per event. This reduces redundant VCS API calls when evaluating `path.pathChanged()` or `on-path-change` annotations, helping minimize the risk of hitting API rate limits. @@ -103,7 +104,7 @@ This prevents unnecessary pipeline executions for minor or work-in-progress comm + [IMPORTANT] ==== -When using `[skip ci]` or `[ci skip]` commands in commit messages on GitLab, one additional pipeline entry appears for the same commit SHA in the GitLab UI. This is expected behavior on GitLab, which uses the skip commands to skip any GitLab CI regardless of whether a `.gitlab-ci.yml` file is defined. +When using `[skip ci]` or `[ci skip]` commands in commit messages on GitLab, one additional pipeline entry is displayed for the same commit SHA in the GitLab UI. This is expected behavior on GitLab, which uses the skip commands to skip any GitLab CI regardless of whether a `.gitlab-ci.yml` file is defined. link:https://issues.redhat.com/browse/SRVKP-11542[SRVKP-11542] ==== @@ -157,7 +158,7 @@ link:https://issues.redhat.com/browse/SRVKP-10609[SRVKP-10609] // SRVKP-8619 CEL expressions are supported in pipeline templates:: -With this update, {pac} supports the `cel:` prefix for evaluating Common Expression Language (CEL) expressions directly within pipeline templates. Previously, template variables were limited to simple data extraction from the request body, headers, or files. You can use the `cel:` prefix to perform inline logic, including ternary operators, presence checks, and complex string compositions. The `body`, `headers`, `files`, and `pac` namespaces are exposed to the CEL evaluation engine. +With this update, {pac} supports the `cel:` prefix for evaluating Common Expression Language (CEL) expressions directly within pipeline templates. Previously, template variables were limited to simple data extraction from the request body, headers, or files. You can use the `cel:` prefix to perform inline logic, including ternary expressions, presence checks, and complex string compositions. The `body`, `headers`, `files`, and `pac` namespaces are exposed to the CEL evaluation engine. + For example, the following expression conditionally selects a commit ID based on the presence of parent commits: + @@ -173,7 +174,7 @@ With this update, {pac} uses the GitHub GraphQL API to fetch multiple .tekton co + link:https://issues.redhat.com/browse/SRVKP-11470[SRVKP-11470] -.User interface +*User interface* //SRVKP-10644 ANSI color support in the OpenShift console log viewer:: @@ -187,7 +188,7 @@ link:https://issues.redhat.com/browse/SRVKP-10407[SRVKP-10407] Technology Preview features offer early access to new product innovations. These features are not fully supported, might be incomplete, and are not for production use. For more information, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope]. -.Multi-cluster +*Multi-cluster* Multi-cluster configuration in TektonConfig (Technology Preview):: With this update, the `TektonConfig` custom resource includes new multi-cluster configuration fields in the `scheduler` section. This enables configuration of multi-cluster setups for {pipelines-shortname}. You can set `multi-cluster-disabled` to enable or disable multi-cluster mode and specify the `multi-cluster-role` as either `Hub` or `Spoke`. @@ -213,7 +214,7 @@ With this update, when the {pipelines-shortname} Operator is configured with `mu + link:https://issues.redhat.com/browse/SRVKP-8983[SRVKP-8983] -Tekton Scheduler installation using the {pipelines-shortname} Operator (Technology Preview):: +Tekton Scheduler installation by using the {pipelines-shortname} Operator (Technology Preview):: With this update, the {pipelines-shortname} Operator supports installation and management of the Tekton Scheduler (Tekton-Kueue). A new `scheduler` section in the `TektonConfig` CR allows enabling the scheduler and specifying a default queue name. + The integration supports multi-cluster configurations with `multi-cluster-disabled` and `multi-cluster-role`. Administrators can manage pipeline resource allocation and queuing across single or multiple {ocp} clusters. @@ -231,7 +232,7 @@ link:https://issues.redhat.com/browse/SRVKP-10807[SRVKP-10807] [id="pipelines-breaking-changes-1-22-0"] == Breaking changes -.User interface +*User interface* Pipelines console navigation and plugin integration update:: With this update, the legacy static console plugin is fully deprecated. Previously, a limited *Pipelines* navigation entry appeared even when the console plugin was disabled. This behavior is no longer supported. + @@ -243,7 +244,7 @@ link:https://issues.redhat.com/browse/SRVKP-9456[SRVKP-9456] == Known issues buildah-ns task fails on {ocp} 4.20 and later:: -When you use the buildah-ns task on {ocp} 4.20 and later, the task fails with the error `reading ID mappings from "/proc/0/uid_map": open /proc/0/uid_map: no such file or directory`. This occurs because the CRI-O annotation-based user namespace mechanism using `io.kubernetes.cri-o.userns-mode: "auto"` was removed in {ocp} 4.20 due to upstream Kubernetes changes. As a consequence, the buildah-ns task cannot enable user namespaces using the annotation-based approach. +When you use the buildah-ns task on {ocp} 4.20 and later, the task fails with the error `reading ID mappings from "/proc/0/uid_map": open /proc/0/uid_map: no such file or directory`. This occurs because the CRI-O annotation-based user namespace mechanism by using `io.kubernetes.cri-o.userns-mode: "auto"` was removed in {ocp} 4.20 due to upstream Kubernetes changes. As a consequence, the buildah-ns task cannot enable user namespaces by using the annotation-based approach. + To work around this issue, use the standard `buildah` task and configure `hostUsers: false` in the `PodTemplate` field to enable user namespace support via the Kubernetes-native mechanism available on {ocp} 4.20 and later. + @@ -273,10 +274,10 @@ link:https://issues.redhat.com/browse/SRVKP-11362[SRVKP-11362] [id="pipelines-fixed-issues-1-22-0"] == Fixed issues -.Pipelines +*Pipelines* Affinity Assistant pods inherit correct service account:: -Before this update, when the affinity assistant was enabled to co-schedule tasks sharing workspace volumes, Affinity Assistant pods used the `default` service account instead of the service account configured in the PipelineRun. In security-restricted environments, the `default` service account lacked the necessary Security Context Constraints (SCC) permissions. As a consequence, tasks requiring workspace access would not start, causing the PipelineRun to block. With this update, Affinity Assistant pods inherit the service account from the PipelineRun's `taskRunTemplate` by default. As a result, Affinity Assistant pods have the correct permissions, and PipelineRuns using workspaces run successfully without requiring manual SCC configuration. +Before this update, when the affinity assistant was enabled to co-schedule tasks sharing workspace volumes, Affinity Assistant pods used the `default` service account instead of the service account configured in the PipelineRun. In security-restricted environments, the `default` service account lacked the necessary Security Context Constraints (SCC) permissions. As a consequence, tasks requiring workspace access would not start, causing the PipelineRun to block. With this update, Affinity Assistant pods inherit the service account from the PipelineRun's `taskRunTemplate` by default. As a result, Affinity Assistant pods have the correct permissions, and PipelineRuns that use workspaces run successfully without requiring manual SCC configuration. + link:https://issues.redhat.com/browse/SRVKP-7327[SRVKP-7327] @@ -315,7 +316,7 @@ Before this update, status steps displayed in incorrect order when using `StepAc + link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] -Task runs execute successfully on arm64 Kubernetes clusters:: +Task runs run successfully on arm64 Kubernetes clusters:: Before this update, arm64 Kubernetes clusters experienced task run failures due to platform variant mismatch in entrypoint lookup. As a consequence, tasks failed on arm64 clusters. With this update, the entrypoint correctly handles Linux platform variants. As a result, task runs succeed on arm64 clusters. + link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] @@ -326,20 +327,20 @@ Before this update, unordered arrays in pipeline run status caused massive inval link:https://issues.redhat.com/browse/SRVKP-11214[SRVKP-11214] -.Operator +*Operator* Webhooks are properly cleaned up when the Operator namespace is deleted:: -Before this update, the `proxy.operator.tekton.dev`, `validation.pipelinesascode.tekton.dev`, and `namespace.operator.tekton.dev` webhooks lacked owner references to the `openshift-pipelines` namespace. As a consequence, when you uninstalled the Pipelines Operator by deleting the namespace, these webhooks were not removed and remained on the cluster. With this update, owner references are added to all operator webhooks. As a result, all webhooks are properly cleaned up when you uninstall the Operator. +Before this update, the `proxy.operator.tekton.dev`, `validation.pipelinesascode.tekton.dev`, and `namespace.operator.tekton.dev` webhooks lacked owner references to the `openshift-pipelines` namespace. As a consequence, when you uninstalled the Pipelines Operator by deleting the namespace, these webhooks were not removed and remained on the cluster. With this update, owner references are added to all Operator webhooks. As a result, all webhooks are properly cleaned up when you uninstall the Operator. + link:https://issues.redhat.com/browse/SRVKP-8901[SRVKP-8901] Prometheus metrics collection works when the Operator is installed in a custom namespace:: -Before this update, the Operator `ServiceMonitor` resource had a hardcoded namespace reference to `openshift-operators` in its namespace selector. As a consequence, when you installed the Pipelines Operator in a different namespace, such as `openshift-pipelines`, Prometheus attempted to scrape metrics from the wrong namespace, causing permission errors and triggering the `PrometheusKubernetesListWatchFailures` alert. With this update, the hardcoded namespace reference is removed, and the `ServiceMonitor` automatically targets the namespace where the Operator is installed. As a result, Prometheus metrics collection works correctly regardless of the namespace where you install the Operator. +Before this update, the Operator `ServiceMonitor` resource had a hard-coded namespace reference to `openshift-operators` in its namespace selector. As a consequence, when you installed the Pipelines Operator in a different namespace, such as `openshift-pipelines`, Prometheus attempted to scrape metrics from the wrong namespace, causing permission errors and triggering the `PrometheusKubernetesListWatchFailures` alert. With this update, the hard-coded namespace reference is removed, and the `ServiceMonitor` automatically targets the namespace where the Operator is installed. As a result, Prometheus metrics collection works correctly regardless of the namespace where you install the Operator. + link:https://issues.redhat.com/browse/SRVKP-10509[SRVKP-10509] -.{pac} +*{pac}* //SRVKP-9118 Custom parameters are supported in CEL expressions correctly:: @@ -421,7 +422,7 @@ Before this update, running `tkn pac cel -p gitlab` with malformed payloads or h link:https://issues.redhat.com/browse/SRVKP-9396[SRVKP-9396] Commit-level re-evaluation of `/ok-to-test` approvals is enforced:: -Before this update, when the `remember-ok-to-test` parameter was set to `false`, a single `/ok-to-test` approval from an unauthorized user was incorrectly retained for subsequent commits in the same pull request. This behavior could allow unreviewed changes to execute in CI. With this update, permissions are re-evaluated for each new commit when `remember-ok-to-test=false`, and CI execution is blocked until a repository administrator provides approval. +Before this update, when the `remember-ok-to-test` parameter was set to `false`, a single `/ok-to-test` approval from an unauthorized user was incorrectly retained for subsequent commits in the same pull request. This behavior could allow unapproved changes to run in CI. With this update, permissions are re-evaluated for each new commit when `remember-ok-to-test=false`, and CI execution is blocked until a repository administrator provides approval. + link:https://issues.redhat.com/browse/SRVKP-9200[SRVKP-9200] @@ -448,7 +449,7 @@ Before this update, `PipelineRuns` deleted while in a `Running` or `Queued` stat link:https://issues.redhat.com/browse/SRVKP-8318[SRVKP-8318] -.User interface +*User interface* // SRVKP-10035 Pipeline run logs preserve whitespace and formatting in the console:: @@ -484,7 +485,7 @@ The `disable-affinity-assistant` field in the `TektonConfig` custom resource `sp + link:https://issues.redhat.com/browse/SRVKP-8267[SRVKP-8267] -Public Tekton Hub is removed as a default built-in catalog:: -The public Tekton Hub (hub.tekton.dev), which served as a default built-in catalog for pipeline resources, is removed and is no longer supported. You can use custom self-hosted Tekton Hub instances instead. +Public {tekton-hub} is removed as a default built-in catalog:: +The public {tekton-hub} (hub.tekton.dev), which served as a default built-in catalog for pipeline resources, is removed and is no longer supported. You can use custom self-hosted {tekton-hub} instances instead. + link:https://issues.redhat.com/browse/SRVKP-11213[SRVKP-11213] diff --git a/modules/op-release-notes-1-23-0.adoc b/modules/op-release-notes-1-23-0.adoc index ffb435675ad..7159e398aa6 100644 --- a/modules/op-release-notes-1-23-0.adoc +++ b/modules/op-release-notes-1-23-0.adoc @@ -15,23 +15,23 @@ For more information about supported {OCP} versions, see link:https://access.red In addition to fixes and stability improvements, these sections highlight what is new in {pipelines-shortname} 1.23: -.Operator +*Operator* //SRVKP-10928 Self-healing for CA bundle config maps in user namespaces:: -The {pipelines-shortname} Operator automatically detects and recreates missing CA bundle config maps (`config-trusted-cabundle` and `config-service-cabundle`) in user namespaces. Previously, if these config maps were deleted after initial reconciliation, the Operator would not recreate them because it only checked the namespace label. The Operator verifies that both config maps exist and triggers re-reconciliation if either is missing. +The {pipelines-shortname} Operator automatically detects and re-creates missing CA bundle config maps (`config-trusted-cabundle` and `config-service-cabundle`) in user namespaces. Previously, if these config maps were deleted after initial reconciliation, the Operator would not re-create them because it only checked the namespace label. The Operator verifies that both config maps exist and triggers re-reconciliation if either is missing. + link:https://issues.redhat.com/browse/SRVKP-10928[SRVKP-10928] //SRVKP-9462 Central TLS profile consistency for {pipelines-shortname} components:: -{pipelines-shortname} respects central TLS consistency on {OCP} by default. All TLS-enabled services inherit the cluster APIServer TLS security profile, including minimum TLS version and cipher suites, on the next reconcile after upgrade. This includes the Operator webhooks, Pipelines webhook, Triggers webhook and core interceptors, {pac} webhook, Manual Approval Gate webhook, and console plugin nginx server. Changes to the cluster TLS profile are automatically propagated to components without operator restarts, enabling Post-Quantum Cryptography (PQC) readiness. You can set the `enableCentralTLSConfig` setting to `false` in `TektonConfig` to opt out. +{pipelines-shortname} respects central TLS consistency on {OCP} by default. All TLS-enabled services inherit the cluster APIServer TLS security profile, including minimum TLS version and cipher suites, on the next reconcile after upgrade. This includes the Operator webhooks, Pipelines webhook, Triggers webhook and core interceptors, {pac} webhook, Manual Approval Gate webhook, and console plugin nginx server. Changes to the cluster TLS profile are automatically propagated to components without Operator restarts, enabling Post-Quantum Cryptography (PQC) readiness. You can set the `enableCentralTLSConfig` setting to `false` in `TektonConfig` to opt out. + link:https://issues.redhat.com/browse/SRVKP-9462[SRVKP-9462] //SRVKP-7899 Metrics migrated from OpenCensus to OpenTelemetry:: -Metrics across all {pipelines-shortname} components (Operator, Pipelines, Triggers, {tekton-chains}, {tekton-results}, and {pac}) are migrated from OpenCensus to OpenTelemetry. Infrastructure metrics such as workqueue, Kubernetes client, and Go runtime metrics are renamed from component-specific prefixes to standard Knative and OpenTelemetry namespaces. The configuration key changes from `metrics.backend-destination` to `metrics-protocol` in the following config maps: `tekton-config-observability` (Operator), `config-observability` (Pipelines), `config-observability-triggers` (Triggers), and `tekton-results-config-observability` ({tekton-results}). {pac} migrates from the `K_METRICS_CONFIG` environment variable to a ConfigMap-based configuration using `pipelines-as-code-config-observability`. {tekton-chains} signing metric names remain unchanged. +Metrics across all {pipelines-shortname} components (Operator, Pipelines, Triggers, {tekton-chains}, {tekton-results}, and {pac}) are migrated from OpenCensus to OpenTelemetry. Infrastructure metrics such as workqueue, Kubernetes client, and Go runtime metrics are renamed from component-specific prefixes to standard Knative and OpenTelemetry namespaces. The configuration key changes from `metrics.backend-destination` to `metrics-protocol` in the following config maps: `tekton-config-observability` (Operator), `config-observability` (Pipelines), `config-observability-triggers` (Triggers), and `tekton-results-config-observability` ({tekton-results}). {pac} migrates from the `K_METRICS_CONFIG` environment variable to a ConfigMap-based configuration by using `pipelines-as-code-config-observability`. {tekton-chains} signing metric names remain unchanged. + The following tables list the breaking metric changes. Core application metrics such as `tekton_pipelines_controller_pipelinerun_duration_seconds` and {tekton-chains} signing metrics remain unchanged. + @@ -169,11 +169,11 @@ If you customized observability settings, you must update the configuration key link:https://issues.redhat.com/browse/SRVKP-7899[SRVKP-7899] -.Pipelines +*Pipelines* //SRVKP-10955 Hub Resolver supports multiple Artifact Hub URLs:: -The Hub Resolver supports multiple Artifact Hub URLs at the cluster level with ordered fallback behavior. Previously, only a single URL could be configured cluster-wide. Multiple hub URLs can be configured at the cluster level, or a hub URL can be specified per resolution request using the `url` parameter. When no parameter is provided, the resolver falls back to cluster defaults. +The Hub Resolver supports multiple Artifact Hub URLs at the cluster level with ordered fallback behavior. Previously, only a single URL could be configured cluster-wide. Multiple hub URLs can be configured at the cluster level, or a hub URL can be specified per resolution request by using the `url` parameter. When no parameter is provided, the resolver falls back to cluster defaults. + link:https://issues.redhat.com/browse/SRVKP-10955[SRVKP-10955] @@ -202,7 +202,7 @@ CustomRun CloudEvents enabled by default:: CloudEvents for CustomRuns are sent by default when a sink is configured. Previously, the `send-cloudevents-for-runs` feature flag defaulted to false. The flag is deprecated and defaults to true. -.{pac} +*{pac}* //SRVKP-7197 Configurable prefix for GitOps commands prevents CI conflicts:: @@ -218,7 +218,7 @@ link:https://issues.redhat.com/browse/SRVKP-10579[SRVKP-10579] //SRVKP-10610 Remote task resolution for Gitea and Forgejo:: -{pac} supports resolving remote `taskRef` URLs when using Gitea or Forgejo as your Git provider. Previously, the provider silently ignored URL-based task references. You can reference tasks stored in any Gitea or Forgejo repository using standard web URLs, and {pac} fetches them using authenticated API calls. Supported URL formats include branch, tag, and commit SHA references. Both `/src/` and `/raw/` URL styles are accepted. +{pac} supports resolving remote `taskRef` URLs when using Gitea or Forgejo as your Git provider. Previously, the provider silently ignored URL-based task references. You can reference tasks stored in any Gitea or Forgejo repository by using standard web URLs, and {pac} fetches them by using authenticated API calls. Supported URL formats include branch, tag, and commit SHA references. Both `/src/` and `/raw/` URL styles are accepted. + link:https://issues.redhat.com/browse/SRVKP-10610[SRVKP-10610] @@ -273,7 +273,7 @@ Informative message when /retest has nothing to retest:: When issuing `/retest` with no failed PipelineRuns to retry, {pac} responds with an informative message. -.{tekton-chains} +*{tekton-chains}* //SRVKP-8542 Server-Side Apply helps improve finalizer management for resource cleanup:: @@ -286,14 +286,14 @@ Insecure OCI registry support:: {tekton-chains} supports connecting to insecure OCI registries. This allows signing and storing attestations in registries that do not have valid TLS certificates, such as development or testing environments. -.{tekton-results} +*{tekton-results}* //SRVKP-12423 Loki logging plugin configuration options:: Two new Loki-specific configuration options are available for the logging plugin: `LOGGING_PLUGIN_JSON_MAP` to define custom JSON field extraction mappings, and `LOGGING_PLUGIN_LINE_FORMAT` to define custom log line output formatting. This allows extraction of structured fields from Loki log entries, such as timestamps and pipeline run UIDs, and control over how log lines are displayed when queried through {tekton-results}. -.Tasks +*Tasks* //SRVKP-10806 Maven Task supports Java version selection:: @@ -301,23 +301,22 @@ The Maven Task includes a new `JAVA_VERSION` parameter to select the Java versio + link:https://issues.redhat.com/browse/SRVKP-10806[SRVKP-10806] - -.User interface +*User interface* [IMPORTANT] ==== -OpenShift Container Platform (OCP) 4.22 introduces breaking platform changes that affect the compatibility of the OpenShift Pipelines user interface (OSP UI). As a result, the latest OSP UI features are only available on OCP 4.22 and later. If you are running OCP 4.21 and earlier, review the supported upgrade paths and plan upgrades accordingly to take advantage of these UI improvements. +{OCP} 4.22 introduces breaking platform changes that affect the compatibility of the {pipelines-shortname} user interface (OSP UI). As a result, the latest OSP UI features are only available on {OCP} 4.22 and later. If you are running {OCP} 4.21 and earlier, review the supported upgrade paths and plan upgrades so to take advantage of these UI improvements. ==== [id="pipelines-fixed-issues-1-23-0_{context}"] == Fixed issues -.Operator +*Operator* //SRVKP-12425 Operator webhooks deleted before namespace cleanup on uninstall:: -Before this update, operator admission webhooks (`namespace.operator.tekton.dev` and `proxy.operator.tekton.dev`) could remain registered while their backend service was already removed during uninstall. As a consequence, `TektonConfig` finalization could fail, leaving the Subscription, ClusterServiceVersion, and operator deployment behind in the `openshift-operators` namespace. With this update, webhooks are explicitly removed at the start of finalization before namespace label cleanup runs. As a result, the {pipelines-shortname} Operator uninstalls cleanly through the {OCP} web console. +Before this update, Operator admission webhooks (`namespace.operator.tekton.dev` and `proxy.operator.tekton.dev`) could remain registered while their backend service was already removed during uninstall. As a consequence, `TektonConfig` finalization could fail, leaving the Subscription, ClusterServiceVersion, and Operator deployment behind in the `openshift-operators` namespace. With this update, webhooks are explicitly removed at the start of finalization before namespace label cleanup runs. As a result, the {pipelines-shortname} Operator uninstalls cleanly through the {OCP} web console. //SRVKP-12425 {tekton-results} API route uses passthrough TLS termination:: @@ -328,7 +327,7 @@ TektonInstallerSet deadlock resolved when resources have deletionTimestamp:: Before this update, a `TektonInstallerSet` could deadlock when attempting to reconcile resources that had a `deletionTimestamp` set. As a consequence, the reconciliation process could hang indefinitely. With this update, the reconciliation logic properly handles resources with `deletionTimestamp`. As a result, reconciliation completes successfully without deadlocking. -.Pipelines +*Pipelines* //SRVKP-9280 Git credential matching supports multiple repositories on the same host:: @@ -358,7 +357,7 @@ Before this update, VolumeMount paths were checked without full path normalizati //SRVKP-12422 VerificationPolicy pattern matching:: -Before this update, VerificationPolicy regular expressions could match substrings unexpectedly. As a consequence, policy checks could pass when only part of a value matched. With this update, resolver prefixes are stripped and matching is anchored. As a result, VerificationPolicy checks match the intended values. +Before this update, VerificationPolicy regular expressions could match partial values unexpectedly. As a consequence, policy checks could pass when only part of a value matched. With this update, resolver prefixes are stripped and matching is anchored. As a result, VerificationPolicy checks match the intended values. //SRVKP-12422 HTTP resolver response size limit:: @@ -366,7 +365,7 @@ Before this update, the HTTP resolver could read an unbounded response body. As //SRVKP-12422 Pipeline results from unsuccessful tasks:: -Before this update, pipeline level results could miss results produced by failed, cancelled, or timed out tasks. As a consequence, available results from unsuccessful tasks could remain unresolved. With this update, pipeline level results include available results from those tasks. As a result, pipeline run results are recorded more consistently. +Before this update, pipeline level results could miss results produced by failed, canceled, or timed out tasks. As a consequence, available results from unsuccessful tasks could remain unresolved. With this update, pipeline level results include available results from those tasks. As a result, pipeline run results are recorded more consistently. //SRVKP-12422 PipelineRun timeout propagation:: @@ -385,7 +384,7 @@ Init container OOM handling:: Before this update, a TaskRun could remain Running when an init container was OOMKilled with `enableKubernetesSidecar` enabled. As a consequence, users could see a TaskRun stuck in Running even though the Pod had failed. With this update, the TaskRun is marked Failed. As a result, the TaskRun status reflects the failed init container. -.{pac} +*{pac}* //SRVKP-12216 GitHub App credentials protected from header injection attacks:: @@ -400,7 +399,7 @@ link:https://issues.redhat.com/browse/SRVKP-12216[SRVKP-12216] //SRVKP-10575 source_url parameter correctly reflects fork repository details after retest in Gitea and Forgejo:: -Before this update, when retesting pull requests using comments in Gitea or Forgejo, the `source_url` parameter could lose fork repository details, resulting in an empty or incorrect `git-url` value in the `PipelineRun`. As a consequence, pipelines could not clone the source code from the fork repository. With this update, the `source_url` parameter is correctly populated to reflect the original fork repository when a retest is initiated. As a result, pipelines can reliably fetch source code from Gitea and Forgejo fork repositories. +Before this update, when retesting pull requests by using comments in Gitea or Forgejo, the `source_url` parameter could lose fork repository details, resulting in an empty or incorrect `git-url` value in the `PipelineRun`. As a consequence, pipelines could not clone the source code from the fork repository. With this update, the `source_url` parameter is correctly populated to reflect the original fork repository when a retest is initiated. As a result, pipelines can reliably fetch source code from Gitea and Forgejo fork repositories. + link:https://issues.redhat.com/browse/SRVKP-10575[SRVKP-10575] @@ -424,12 +423,12 @@ link:https://issues.redhat.com/browse/SRVKP-10943[SRVKP-10943] //SRVKP-11021 Relative task path resolution restored for repository-based references:: -Before this update, a regression introduced in {pipelines-shortname} 1.20.3 prevented {pac} from correctly resolving relative task references within a repository, such as `./task.yaml` or paths containing parent directory notation `..`. As a consequence, pipelines that modularized task definitions using relative paths in the `.tekton` directory failed to execute. With this update, the path normalization logic in the Git resolver is fixed to correctly handle relative path segments. As a result, pipelines can successfully reference and execute tasks using relative paths across all supported Git providers. +Before this update, a regression introduced in {pipelines-shortname} 1.20.3 prevented {pac} from correctly resolving relative task references within a repository, such as `./task.yaml` or paths containing parent directory notation `..`. As a consequence, pipelines that modularized task definitions by using relative paths in the `.tekton` directory failed to run. With this update, the path normalization logic in the Git resolver is fixed to correctly handle relative path segments. As a result, pipelines can successfully reference and run tasks by using relative paths across all supported Git providers. + link:https://issues.redhat.com/browse/SRVKP-11021[SRVKP-11021] //SRVKP-11464 -LLM analysis supports newer OpenAI models using correct token parameter:: +LLM analysis supports newer OpenAI models by using correct token parameter:: Before this update, {pac} LLM analysis used the legacy `max_tokens` parameter when making requests to the OpenAI API. Newer OpenAI models such as `gpt-5`, `o1`, and `o3` series reject this parameter and require `max_completion_tokens` instead. As a consequence, LLM analysis failed with HTTP 400 errors when using these newer models. With this update, {pac} detects the model type and sends the correct parameter. The configuration parameter for LLM analysis remains the same to maintain vendor neutrality. As a result, LLM analysis works correctly with both newer and older OpenAI-compatible models. + link:https://issues.redhat.com/browse/SRVKP-11464[SRVKP-11464] @@ -495,7 +494,7 @@ Controller follows principle of least privilege:: Before this update, the controller ServiceAccount had cluster-wide `secrets/delete` permission that was never used. As a consequence, the controller had broader permissions than necessary. With this update, the unused permission is removed. As a result, the controller follows the principle of least privilege. -.{tekton-chains} +*{tekton-chains}* //SRVKP-11363 Duplicate attestation and signature layers eliminated when same image reported multiple times:: @@ -519,7 +518,7 @@ Before this update, the Docdb storage backend had inefficient query logic for re [id="pipelines-deprecated-features-1-23-0_{context}"] == Deprecated features -.{pac} +*{pac}* //SRVKP-11931 The pipelinerun_status field in the Repository CR is deprecated:: @@ -528,17 +527,17 @@ The `pipelinerun_status` field in the `Repository` custom resource (CR), which t link:https://issues.redhat.com/browse/SRVKP-11931[SRVKP-11931] //SRVKP-12187 -Tekton Hub task resolution is deprecated:: -Tekton Hub catalog integration in {pac} is deprecated and will be removed in a future release. When you use Hub-based remote task or pipeline references, {pac} emits deprecation warnings in logs and documentation. Migrate to Artifact Hub or use remote URL-based or Git-based task references instead. For example, instead of referencing tasks through a Tekton Hub instance, fetch them directly from a Git repository URL or from Artifact Hub. Tekton Hub support will be removed in a future release of {pipelines-shortname}. +{tekton-hub} task resolution is deprecated:: +{tekton-hub} catalog integration in {pac} is deprecated and will be removed in a future release. When you use Hub-based remote task or pipeline references, {pac} emits deprecation warnings in logs and documentation. Migrate to Artifact Hub or use remote URL-based or Git-based task references instead. For example, instead of referencing tasks through a {tekton-hub} instance, fetch them directly from a Git repository URL or from Artifact Hub. {tekton-hub} support will be removed in a future release of {pipelines-shortname}. + link:https://issues.redhat.com/browse/SRVKP-12187[SRVKP-12187] -.CLI +*CLI* //SRVKP-11950 -Tekton Hub support in the tkn hub CLI is deprecated:: -Tekton Hub support in the `tkn hub` CLI is deprecated in favor of Artifact Hub. The following commands currently only work with Tekton Hub and might support Artifact Hub in a future release: +{tekton-hub} support in the tkn hub CLI is deprecated:: +{tekton-hub} support in the `tkn hub` CLI is deprecated in favor of Artifact Hub. The following commands currently only work with {tekton-hub} and might support Artifact Hub in a future release: + * `check-upgrade` * `downgrade` diff --git a/modules/op-release-notes-1-6.adoc b/modules/op-release-notes-1-6.adoc index cf7e3669c3f..1949b80fd32 100644 --- a/modules/op-release-notes-1-6.adoc +++ b/modules/op-release-notes-1-6.adoc @@ -37,7 +37,7 @@ In addition to the fixes and stability improvements, the following sections high * This update adds a `create` subcommand to the `tkn task` and `tkn clustertask` commands. // (link:https://github.com/tektoncd/cli/pull/1359[#1359]) -* With this update, when you use the `tkn pipelinerun delete --all` command, you can use the new `--label ` option to filter the pipeline runs by label. Optionally, you can use the `--label` option with `=` and `==` as equality operators, or `!=` as an inequality operator. For example, the `tkn pipelinerun delete --all --label asdf` and `tkn pipelinerun delete --all --label==asdf` commands both delete all the pipeline runs that have the `asdf` label. +* With this update, when you use the `tkn pipelinerun delete --all` command, you can use the new `--label ` option to filter the pipeline runs by label. Optionally, you can use the `--label` option with `=` and `==` for equality comparisons, or `!=` for inequality comparisons. For example, the `tkn pipelinerun delete --all --label asdf` and `tkn pipelinerun delete --all --label==asdf` commands both delete all the pipeline runs that have the `asdf` label. // (link:https://github.com/tektoncd/cli/pull/1402[#1402]) * With this update, you can fetch the version of installed Tekton components from the config map or, if the config map is not present, from the deployment controller. diff --git a/modules/op-release-notes-1-7.adoc b/modules/op-release-notes-1-7.adoc index 9a8774e449f..1bc678c4185 100644 --- a/modules/op-release-notes-1-7.adoc +++ b/modules/op-release-notes-1-7.adoc @@ -178,7 +178,7 @@ hub: * With this update, the version of the `argocd-task-sync-and-wait` tasks is modified to `v0.2`. // https://github.com/tektoncd/operator/pull/642 -* With this update to the `TektonConfig` CRD, the `oc get tektonconfig` command displays the OPerator version. +* With this update to the `TektonConfig` CRD, the `oc get tektonconfig` command displays the Operator version. // https://github.com/tektoncd/operator/pull/644 * With this update, service monitor is added to the Triggers metrics. @@ -204,7 +204,7 @@ Staring with {pipelines-title} 1.7, cluster administrators can also install and {tekton-chains} is a Technology Preview feature. ==== -{tekton-chains} is a Kubernetes Custom Resource Definition (CRD) controller. You can use it to manage the supply chain security of the tasks and pipelines created using {pipelines-title}. +{tekton-chains} is a Kubernetes custom resource definition (CRD) controller. You can use it to manage the supply chain security of the tasks and pipelines created using {pipelines-title}. By default, {tekton-chains} monitors the task runs in your {OCP} cluster. Chains takes snapshots of completed task runs, converts them to one or more standard payload formats, and signs and stores all artifacts. diff --git a/modules/op-release-notes-1-9.adoc b/modules/op-release-notes-1-9.adoc index ce40371a95b..2c3d8a8ae99 100644 --- a/modules/op-release-notes-1-9.adoc +++ b/modules/op-release-notes-1-9.adoc @@ -348,7 +348,7 @@ spec: // .Operator -* Before this update, if namespaces were removed from the cluster, then the operator did not remove namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects. With this update, this issue has been resolved, and the operator removes the namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects. +* Before this update, if namespaces were removed from the cluster, then the Operator did not remove namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects. With this update, this issue has been resolved, and the Operator removes the namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects. // Shubham Minglani * Before this update, the default installation of the {pipelines-title} Operator resulted in the `pipelines-scc-rolebinding security context constraint` (SCC) role binding resource remaining in the cluster. With this update, the default installation of the {pipelines-title} Operator results in the `pipelines-scc-rolebinding security context constraint` (SCC) role binding resource being removed from the cluster. diff --git a/modules/op-resolver-cluster-tasks-ref.adoc b/modules/op-resolver-cluster-tasks-ref.adoc index 909ca0a42a9..8d3429e8b85 100644 --- a/modules/op-resolver-cluster-tasks-ref.adoc +++ b/modules/op-resolver-cluster-tasks-ref.adoc @@ -154,9 +154,9 @@ you trust the remote repository. |`string` |`true` | Workspace | Description |`ssh-directory` |A `.ssh` directory with the private key, `known_hosts`, `config`, and other files as necessary. If you give this workspace, the task uses it for authentication to the Git repository. Bind this workspace to a `Secret` resource for secure storage of authentication information. |`basic-auth` |A workspace containing a `.gitconfig` and `.git-credentials` files. If you give this workspace, the task uses it for authentication to the Git repository. Use a `ssh-directory` workspace for authentication instead of `basic-auth` whenever possible. Bind this workspace to a `Secret` resource for secure storage of authentication information. -|`ssl-ca-directory` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories using HTTPS. +|`ssl-ca-directory` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories by using HTTPS. |`source` |A workspace that has the fetched Git repository. -|`input` |An optional workspace that has the files to add to the Git repository. You can access the workspace from your script using `$(workspaces.input.path)`, for example: +|`input` |An optional workspace that has the files to add to the Git repository. You can access the workspace from your script by using `$(workspaces.input.path)`, for example: `cp $(workspaces.input.path)/ .` @@ -238,7 +238,7 @@ spec: | Workspace | Description |`ssh-directory` |A `.ssh` directory with the private key, `known_hosts`, `config`, and other files as necessary. If you give this workspace, the task uses it for authentication to the Git repository. Bind this workspace to a `Secret` resource for secure storage of authentication information. |`basic-auth` |A workspace containing a `.gitconfig` and `.git-credentials` files. If you give this workspace, the task uses it for authentication to the Git repository. Use a `ssh-directory` workspace for authentication instead of `basic-auth` whenever possible. Bind this workspace to a `Secret` resource for secure storage of authentication information. -|`ssl-ca-directory` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories using HTTPS. +|`ssl-ca-directory` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories by using HTTPS. |`output` |A workspace that has the fetched git repository; the task places data on the root of the workspace or on the relative path defined by the `SUBDIRECTORY` parameter. |=== diff --git a/modules/op-resolver-git-config-scm.adoc b/modules/op-resolver-git-config-scm.adoc index 2e459b4ceb7..641f72f847d 100644 --- a/modules/op-resolver-git-config-scm.adoc +++ b/modules/op-resolver-git-config-scm.adoc @@ -12,7 +12,7 @@ For an authenticated Source Control Management (SCM) API, you must set the confi You can use Git repository providers that the `go-scm` library supports. Red Hat has not tested all `go-scm` implementations with the Git resolver, but Red Hat knows the following providers work: * `github.com` and GitHub Enterprise -* `gitlab.com` and self-hosted Gitlab +* `gitlab.com` and self-hosted GitLab * Gitea * Bitbucket Data Center * Bitbucket Cloud diff --git a/modules/op-resolver-stepactions-ref.adoc b/modules/op-resolver-stepactions-ref.adoc index b07ab1bd977..8bc4e107e10 100644 --- a/modules/op-resolver-stepactions-ref.adoc +++ b/modules/op-resolver-stepactions-ref.adoc @@ -51,7 +51,7 @@ spec: |`OUTPUT_PATH` | A directory for the fetched Git repository. The step action places cloned repository data in the root of the directory or in the relative path defined by the `SUBDIRECTORY` parameter. |`string` | |`SSH_DIRECTORY_PATH` |A `.ssh` directory with the private key, `known_hosts`, `config`, and other files as necessary. If you give this directory, the task uses it for authentication to the Git repository. Bind the workspace providing this directory to a `Secret` resource for secure storage of authentication information. |`string` | |`BASIC_AUTH_PATH` |A directory containing a `.gitconfig` and `.git-credentials` files. If you give this directory, the task uses it for authentication to the Git repository. Use a `SSH_DIRECTORY_PATH` directory for authentication instead of `BASIC_AUTH_PATH` whenever possible. Bind the workspace providing this directory to a `Secret` resource for secure storage of authentication information. |`string` | -|`SSL_CA_DIRECTORY_PATH` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories using HTTPS. |`string` | +|`SSL_CA_DIRECTORY_PATH` |A workspace containing CA certificates. If you give this workspace, Git uses these certificates to verify the peer when interacting with remote repositories by using HTTPS. |`string` | |`CRT_FILENAME` |Certificate authority (CA) bundle filename in the `ssl-ca-directory` workspace. |`string` |`ca-bundle.crt` |`HTTP_PROXY` |HTTP proxy server (non-TLS requests). |`string` | |`HTTPS_PROXY` |HTTPS proxy server (TLS requests). |`string` | diff --git a/modules/op-results-search-records.adoc b/modules/op-results-search-records.adoc index 46b39ba5234..ec2c3a56169 100644 --- a/modules/op-results-search-records.adoc +++ b/modules/op-results-search-records.adoc @@ -15,7 +15,7 @@ You can search for records by using Common Expression Language (CEL) queries. As .Procedure -* Search for records using a CEL query by entering the following command: +* Search for records by using a CEL query by entering the following command: + [source,terminal] ---- diff --git a/modules/op-results-search-results.adoc b/modules/op-results-search-results.adoc index a7ce047236f..6cad8dd5a26 100644 --- a/modules/op-results-search-results.adoc +++ b/modules/op-results-search-results.adoc @@ -15,7 +15,7 @@ You can search for results by using Common Expression Language (CEL) queries. Fo .Procedure -* Search for results using a CEL query by entering the following command: +* Search for results by using a CEL query by entering the following command: + [source,terminal] ---- diff --git a/modules/op-running-a-pipeline.adoc b/modules/op-running-a-pipeline.adoc index 9bb34750436..2d848ae62ef 100644 --- a/modules/op-running-a-pipeline.adoc +++ b/modules/op-running-a-pipeline.adoc @@ -87,7 +87,4 @@ Note the output of the earlier command. You can access the application by using $ tkn pipeline start build-and-deploy --last ---- -[role="_additional-resources"] -.Additional resources -* xref:../secure/authenticating-pipelines-repos-using-secrets.adoc#authenticating-pipelines-repos-using-secrets[Authenticating pipelines with repositories using secrets] diff --git a/modules/op-sample-eventlistener-resource.adoc b/modules/op-sample-eventlistener-resource.adoc index 87dc72bcc64..280725bc7f5 100644 --- a/modules/op-sample-eventlistener-resource.adoc +++ b/modules/op-sample-eventlistener-resource.adoc @@ -31,7 +31,7 @@ $ oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/ma $ oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/master/03_triggers/03_trigger.yaml ---- -. Create an `EventListener` resource using a secure HTTPS connection: +. Create an `EventListener` resource by using a secure HTTPS connection: .. Add a label to enable the secure HTTPS connection to the `EventListener` resource: + [source,terminal,subs="attributes+"] diff --git a/modules/op-setting-up-openshift-pipelines-to-download-or-view-sboms.adoc b/modules/op-setting-up-openshift-pipelines-to-download-or-view-sboms.adoc deleted file mode 100644 index 1308677ef25..00000000000 --- a/modules/op-setting-up-openshift-pipelines-to-download-or-view-sboms.adoc +++ /dev/null @@ -1,182 +0,0 @@ -// This module is included in the following assemblies: -// * secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc - -:_mod-docs-content-type: PROCEDURE -[id="op-setting-up-openshift-pipelines-to-download-or-view-sboms_{context}"] -= Setting up {pipelines-shortname} to download or view software bills of materials (SBOMs) - -[role="_abstract"] -The `PipelineRun` details page provides an option to download or view Software Bill of Materials (SBOMs), enhancing transparency and control within your supply chain. SBOMs lists all the software libraries that a component uses. Those libraries can enable specific functionality or help development. - -You can use a software bill of materials (SBOM) to better understand the composition of your software, identify vulnerabilities, and assess the potential impact of any security issues that might arise. - -.Options to download or view SBOMs -image::sbom.png[Options to download or view SBOMs] - -.Prerequisites - -* You have link:https://docs.openshift.com/container-platform/4.14/web_console/web-console.html#web-console[logged in to the web console]. - -* You have the appropriate link:https://docs.openshift.com/container-platform/4.14/authentication/using-rbac.html#default-roles_using-rbac[roles and permissions] in a project to create applications and other workloads in {product-title}. - -.Procedure - -. In the *Developer* or *Administrator* perspective, switch to the relevant project where you want a visual representation of SBOMs. - -. Add a task in the following format to view or download the SBOM information: -+ -.Example SBOM task -[source,yaml] ----- -apiVersion: tekton.dev/v1 -kind: Task -metadata: - name: sbom-task - annotations: - task.output.location: results - task.results.format: application/text - task.results.key: LINK_TO_SBOM - task.results.type: external-link -spec: - results: - - description: Contains the SBOM link - name: LINK_TO_SBOM - steps: - - name: print-sbom-results - image: quay.io/image - script: | - #!/bin/sh - syft version - syft quay.io//quarkus-demo:v2 --output cyclonedx-json=sbom-image.json - echo 'BEGIN SBOM' - cat sbom-image.json - echo 'END SBOM' - echo 'quay.io/user/workloads//node-express/node-express:build-8e536-1692702836' | tee $(results.LINK_TO_SBOM.path) ----- -`name`:: The name of your task. -`task.output.location`:: The location for storing the task outputs. -`task.results.key`:: The SBOM task result name. Do not change the name of the SBOM result task. -`task.results.type`:: (Optional) Set to open the SBOM in a new tab. -`- description: Contains the SBOM link`:: The description of the result. -`image`:: The image that generates the SBOM. -`script`:: The script that generates the SBOM image. -``:: The SBOM image along with the path name. - -. Update the Pipeline to reference the newly created SBOM task. - -+ -[source,yaml] ----- -... -spec: - tasks: - - name: sbom-task - taskRef: - name: sbom-task - results: - - name: IMAGE_URL - description: url - value: ----- -`name`:: The same name as created in Step 2. -`- name: IMAGE_URL`:: The name of the result. -``:: The OCI image repository URL that has the `.sbom` images. - -. Rerun the affected OpenShift Pipeline. - - -== Viewing an SBOM in the web UI - -.Prerequisites - -* You have set up {pipelines-shortname} to download or view SBOMs. - -.Procedure - -. Navigate to the Activity -> `PipelineRuns` tab. - -. For the project whose SBOM you want to view, select its most recent pipeline run. - -. On the `PipelineRun` details page, select *View SBOM*. - -.. You can use your web browser to immediately search the SBOM for terms that indicate vulnerabilities in your software supply chain. For example, try searching for `log4j`. - -.. You can select *Download* to download the SBOM, or *Expand* to view it full-screen. - -== Downloading an SBOM in the CLI - -.Prerequisites - -* You have installed the Cosign CLI tool. For information about installing the Cosign tool, see the link:https://docs.sigstore.dev/cosign/system_config/installation/[Sigstore documentation for Cosign]. - -* You have set up {pipelines-shortname} to download or view SBOMs. - -.Procedure - -. Open terminal, log in to *Developer* or *Administrator* perspective, and then switch to the relevant project. - -. From the OpenShift web console, copy the `download sbom` command and run it on your terminal. -+ -.Example cosign command -+ -[source,terminal] ----- -$ cosign download sbom quay.io//user-workload@sha256 ----- - -.. (Optional) To view the full SBOM in a searchable format, run the following command to redirect the output: -+ -.Example cosign command -+ -[source,terminal] ----- -$ cosign download sbom quay.io//user-workload@sha256 > sbom.txt ----- - -== Reading the SBOM - -In the SBOM, as the following sample excerpt shows, you can see four characteristics of each library that a project uses: - -* Its author or publisher - -* Its name - -* Its version - -* Its licenses - -This information helps you verify that individual libraries are safely-sourced, updated, and compliant. - -.Example SBOM -[source,terminal] ----- -{ - "bomFormat": "CycloneDX", - "specVersion": "1.4", - "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220", - "version": 1, - "metadata": { - ... - }, - "components": [ - { - "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8", - "type": "library", - "author": "Armin Ronacher ", - "name": "Flask", - "version": "2.1.0", - "licenses": [ - { - "license": { - "id": "BSD-3-Clause" - } - } - ], - "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*", - "purl": "pkg:pypi/Flask@2.1.0", - "properties": [ - { - "name": "syft:package:foundBy", - "value": "python-package-cataloger" - ... ----- diff --git a/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc b/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc index da1ca4d7d2d..cd198a4044d 100644 --- a/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc +++ b/modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc @@ -135,9 +135,9 @@ spec: .Verification -* Navigate to the `PipelineRun` details page and review the *Vulnerabilities* row for a visual representation of identified vulnerabilities. +* Go to the `PipelineRun` details page and review the *Vulnerabilities* row for a visual representation of identified vulnerabilities. -* Or, you can navigate to the `PipelineRun` list view page, and review the *Vulnerabilities* column. +* Or, you can go to the `PipelineRun` list view page, and review the *Vulnerabilities* column. [role="_additional-resources"] .Additional resources diff --git a/modules/op-starting-pipelines-from-pipelines-view.adoc b/modules/op-starting-pipelines-from-pipelines-view.adoc index bd1a2538616..96103582282 100644 --- a/modules/op-starting-pipelines-from-pipelines-view.adoc +++ b/modules/op-starting-pipelines-from-pipelines-view.adoc @@ -51,8 +51,8 @@ You can add many secrets based upon the number of resources in your pipeline. . Click *Start* to start the pipeline. . The *`PipelineRun` details* page displays the executing pipeline. After the pipeline starts, the system executes the tasks and steps within each task. You can: -* Use the zoom in, zoom out, fit to screen, and reset view features using the standard icons, which are in the lower left corner of the *`PipelineRun` details* page visualization. -* Change the zoom factor of the pipeline run visualization using the mouse wheel. At specific zoom factors, the background color of the tasks changes to indicate the error or warning status. +* Use the zoom in, zoom out, fit to screen, and reset view features by using the standard icons, which are in the lower left corner of the *`PipelineRun` details* page visualization. +* Change the zoom factor of the pipeline run visualization by using the mouse wheel. At specific zoom factors, the background color of the tasks changes to indicate the error or warning status. * Hover over the tasks to see the details, such as the time taken to run each step, task name, and task status. * Hover over the tasks badge to see the total number of tasks and tasks completed. * click a task to see the logs for each step in the task. diff --git a/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc b/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc index 7e8ebd11421..8ca58b44f34 100644 --- a/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc +++ b/modules/op-using-pipelines-as-code-with-bitbucket-cloud.adoc @@ -23,7 +23,7 @@ If your organization or project uses Bitbucket Cloud as the preferred platform, + [NOTE] ==== -* If you want to configure the webhook using the `tkn pac` CLI, add the `Webhooks`: `Read` and `Write` permission to the token. +* If you want to configure the webhook by using the `tkn pac` CLI, add the `Webhooks`: `Read` and `Write` permission to the token. * Once generated, save a copy of the password or token in an alternate location. ==== @@ -32,7 +32,7 @@ If your organization or project uses Bitbucket Cloud as the preferred platform, . Configure the webhook and create a `Repository` CR. -** To configure a webhook and create a `Repository` CR _automatically_ using the `tkn pac` CLI tool, use the following command: +** To configure a webhook and create a `Repository` CR _automatically_ by using the `tkn pac` CLI tool, use the following command: + [source,terminal] ---- diff --git a/modules/op-using-pipelines-as-code-with-github-webhook.adoc b/modules/op-using-pipelines-as-code-with-github-webhook.adoc index 693a33c3aad..834218a9487 100644 --- a/modules/op-using-pipelines-as-code-with-github-webhook.adoc +++ b/modules/op-using-pipelines-as-code-with-github-webhook.adoc @@ -50,14 +50,14 @@ $ git --amend -a --no-edit && git push --force-with-lease + [NOTE] ==== -If you want to configure the webhook using the `tkn pac` CLI, add the `admin:repo_hook` scope. +If you want to configure the webhook by using the `tkn pac` CLI, add the `admin:repo_hook` scope. ==== .Procedure . Configure the webhook and create a `Repository` custom resource (CR). -** To configure a webhook and create a `Repository` CR _automatically_ using the `tkn pac` CLI tool, use the following command: +** To configure a webhook and create a `Repository` CR _automatically_ by using the `tkn pac` CLI tool, use the following command: + [source,terminal] ---- diff --git a/modules/op-using-pipelines-as-code-with-gitlab.adoc b/modules/op-using-pipelines-as-code-with-gitlab.adoc index 97a7a1c7547..f9a90538265 100644 --- a/modules/op-using-pipelines-as-code-with-gitlab.adoc +++ b/modules/op-using-pipelines-as-code-with-gitlab.adoc @@ -16,7 +16,7 @@ If your organization or project uses GitLab as the preferred platform, you can u + [NOTE] ==== -* If you want to configure the webhook using the `tkn pac` CLI, add the `admin:repo_hook` scope to the token. +* If you want to configure the webhook by using the `tkn pac` CLI, add the `admin:repo_hook` scope to the token. * Using a token scoped for a specific project cannot give API access to a merge request (MR) sent from a forked repository. In such cases, {pac} displays the result of a pipeline as a comment on the MR. ==== @@ -25,7 +25,7 @@ If your organization or project uses GitLab as the preferred platform, you can u . Configure the webhook and create a `Repository` custom resource (CR). -** To configure a webhook and create a `Repository` CR _automatically_ using the `tkn pac` CLI tool, use the following command: +** To configure a webhook and create a `Repository` CR _automatically_ by using the `tkn pac` CLI tool, use the following command: + [source,terminal] ---- diff --git a/modules/op-using-remote-pipeline-annotations-with-pipelines-as-code.adoc b/modules/op-using-remote-pipeline-annotations-with-pipelines-as-code.adoc index 0e4df04ee9b..6d39af6522d 100644 --- a/modules/op-using-remote-pipeline-annotations-with-pipelines-as-code.adoc +++ b/modules/op-using-remote-pipeline-annotations-with-pipelines-as-code.adoc @@ -18,7 +18,7 @@ You can share a pipeline definition across many repositories by using the remote [NOTE] ==== -You can reference only one pipeline definition using the annotation. +You can reference only one pipeline definition by using the annotation. ==== [id="overriding-tasks-in-remote-pipeline_{context}"] diff --git a/modules/op-using-remote-task-annotations-with-pipelines-as-code.adoc b/modules/op-using-remote-task-annotations-with-pipelines-as-code.adoc index 32f7a8465e6..c1b5687017d 100644 --- a/modules/op-using-remote-task-annotations-with-pipelines-as-code.adoc +++ b/modules/op-using-remote-task-annotations-with-pipelines-as-code.adoc @@ -70,7 +70,7 @@ Include remote tasks in your pipeline runs by using {pac} resolver annotations t + [NOTE] ==== -* If you use GitHub and the remote task URL uses the same host as the `Repository` custom resource definition (CRD), {pac} uses the GitHub token and fetches the URL using the GitHub API. +* If you use GitHub and the remote task URL uses the same host as the `Repository` custom resource definition (CRD), {pac} uses the GitHub token and fetches the URL by using the GitHub API. + For example, if your repository URL is similar to `\https://github.com//` and the remote HTTP URL references a GitHub blob, {pac} fetches the task definition files from that private repository by using the GitHub App token. + diff --git a/modules/op-verifying-multicluster-setup.adoc b/modules/op-verifying-multicluster-setup.adoc index 98e4d7b7b4a..736cde6e2cb 100644 --- a/modules/op-verifying-multicluster-setup.adoc +++ b/modules/op-verifying-multicluster-setup.adoc @@ -13,7 +13,7 @@ You can verify that your multicluster configuration is working correctly by chec * You have configured the hub cluster for multicluster support. * You have configured at least one spoke cluster for multicluster support. -* You have access to the hub cluster using an account with permissions to view cluster resources. +* You have access to the hub cluster by using an account with permissions to view cluster resources. .Procedure @@ -92,7 +92,7 @@ EOF $ oc get pipelineruns -w ---- + -The pipeline run should transition from `Pending` to `Running` and then to `Succeeded`. +The pipeline run should change from `Pending` to `Running` and then to `Succeeded`. .Verification diff --git a/modules/op-verifying-pipeline-run-pac.adoc b/modules/op-verifying-pipeline-run-pac.adoc index ffe86f28c98..cc3cab0adba 100644 --- a/modules/op-verifying-pipeline-run-pac.adoc +++ b/modules/op-verifying-pipeline-run-pac.adoc @@ -12,7 +12,7 @@ You can verify that the {pac} resolver correctly processes the pipeline run defi .Prerequisites * You installed the `tkn` command line utility. -* You logged in to your {OCP} cluster using {oc-first}. +* You logged in to your {OCP} cluster by using {oc-first}. * You cloned your Git repository locally. .Procedure diff --git a/modules/op-viewing-an-sbom.adoc b/modules/op-viewing-an-sbom.adoc index 7d0ca811b2a..45537390474 100644 --- a/modules/op-viewing-an-sbom.adoc +++ b/modules/op-viewing-an-sbom.adoc @@ -14,7 +14,7 @@ You can view a software bill of materials (SBOM) for a pipeline run directly in .Procedure -. Navigate to the Activity -> `PipelineRuns` tab. +. Go to the Activity -> `PipelineRuns` tab. . For the project whose SBOM you want to view, select its most recent pipeline run. diff --git a/pac/about-pipelines-as-code.adoc b/pac/about-pipelines-as-code.adoc index 87e11c49f70..7bfd34d924e 100644 --- a/pac/about-pipelines-as-code.adoc +++ b/pac/about-pipelines-as-code.adoc @@ -21,7 +21,7 @@ With {pac}, cluster administrators and users with the required privileges can de * Pull request actions in comments, such as `/retest`. * Git events filtering and a separate pipeline for each event. * Automatic task resolution in {pipelines-shortname}, including local tasks, {tekton-hub}, and remote URLs. -* Retrieval of configurations using GitHub blobs and objects API. +* Retrieval of configurations by using GitHub blobs and objects API. * Access Control List (ACL) over a GitHub organization or using a Prow style `OWNERS` file. * The `tkn pac` CLI plugin for managing bootstrapping and {pac} repositories. * Support for GitHub App, GitHub Webhook, Bitbucket Data Center, and Bitbucket Cloud. diff --git a/pac/creating-pipeline-runs-pac.adoc b/pac/creating-pipeline-runs-pac.adoc index 9ce18861ff4..7f4ea67f832 100644 --- a/pac/creating-pipeline-runs-pac.adoc +++ b/pac/creating-pipeline-runs-pac.adoc @@ -7,7 +7,7 @@ include::_attributes/common-attributes.adoc[] toc::[] [role="_abstract"] -Automate pipeline execution triggered by Git events. Integrate {pac} with your repository provider and define your repository using the `Repository` custom resource (CR). +Automate pipeline execution triggered by Git events. Integrate {pac} with your repository provider and define your repository by using the `Repository` custom resource (CR). include::modules/op-creating-pipeline-run-pac.adoc[leveloffset=+1] diff --git a/release_notes/op-release-notes-1-21.adoc b/release_notes/op-release-notes-1-21.adoc index 07a60a9186e..a588c8150d5 100644 --- a/release_notes/op-release-notes-1-21.adoc +++ b/release_notes/op-release-notes-1-21.adoc @@ -19,7 +19,7 @@ Release notes contain information about new and deprecated features, breaking ch * Standard Kubernetes-native pipeline definitions (CRDs). * Serverless pipelines that run without the need to manage CI servers. -* Extensibility to build images using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. +* Extensibility to build images by using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. * Portability across any Kubernetes distribution. * Powerful CLI for interacting with pipelines. * Integrated user experience with the {OCP} web console, up to {OCP} version 4.20. diff --git a/release_notes/op-release-notes-1-22.adoc b/release_notes/op-release-notes-1-22.adoc index 5f74197f38c..7b66456dd89 100644 --- a/release_notes/op-release-notes-1-22.adoc +++ b/release_notes/op-release-notes-1-22.adoc @@ -12,13 +12,14 @@ toc::[] For additional information about the {pipelines-shortname} lifecycle and supported platforms, refer to the link:https://access.redhat.com/support/policy/updates/openshift_operators[OpenShift Operator Life Cycles] and link:https://access.redhat.com/support/policy/updates/openshift[Red{nbsp}Hat {OCP} Life Cycle Policy]. ==== +[role="_abstract"] Release notes contain information about new and deprecated features, breaking changes, and known issues. The following release notes apply for the most recent {pipelines-shortname} releases on {OCP}. {pipelines-title} is a cloud-native CI/CD experience based on the Tekton project which provides: * Standard Kubernetes-native pipeline definitions (CRDs). -* Serverless pipelines with no CI server management overhead. -* Extensibility to build images using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. +* Serverless pipelines with no CI server management required. +* Extensibility to build images by using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. * Portability across any Kubernetes distribution. * Powerful CLI for interacting with pipelines. * Integrated user experience with the {OCP} web console. diff --git a/release_notes/op-release-notes-1-23.adoc b/release_notes/op-release-notes-1-23.adoc index dc67b0692c9..ed487f903e3 100644 --- a/release_notes/op-release-notes-1-23.adoc +++ b/release_notes/op-release-notes-1-23.adoc @@ -12,13 +12,14 @@ toc::[] For additional information about the {pipelines-shortname} lifecycle and supported platforms, refer to the link:https://access.redhat.com/support/policy/updates/openshift_operators[OpenShift Operator Life Cycles] and link:https://access.redhat.com/support/policy/updates/openshift[Red{nbsp}Hat {OCP} Life Cycle Policy]. ==== +[role="_abstract"] Release notes contain information about new and deprecated features, breaking changes, and known issues. The following release notes apply for the most recent {pipelines-shortname} releases on {OCP}. {pipelines-title} is a cloud-native CI/CD experience based on the Tekton project, which provides: * Standard Kubernetes-native pipeline definitions (CRDs). -* Serverless pipelines with no CI server management overhead. -* Extensibility to build images using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. +* Serverless pipelines with no CI server management required. +* Extensibility to build images by using any Kubernetes tool, such as S2I, Buildah, JIB, and Kaniko. * Portability across any Kubernetes distribution. * Powerful CLI for interacting with pipelines. * Integrated user experience with the {OCP} web console. diff --git a/resource/configuring-multicluster-support.adoc b/resource/configuring-multicluster-support.adoc index 1b3efd20d21..3f93e5bf609 100644 --- a/resource/configuring-multicluster-support.adoc +++ b/resource/configuring-multicluster-support.adoc @@ -1,13 +1,13 @@ :_mod-docs-content-type: ASSEMBLY [id="configuring-multicluster-support"] -= Multicluster support for OpenShift Pipelines += Multicluster support for {pipelines-shortname} include::_attributes/common-attributes.adoc[] :context: configuring-multicluster-support toc::[] [role="_abstract"] -You can configure multicluster support in {pipelines-title} to distribute pipeline workloads across multiple {product-title} clusters for horizontal scalability. This approach uses a hub-and-spoke architecture, where a hub cluster manages pipeline runs and spoke clusters execute the workloads. +You can configure multicluster support in {pipelines-title} to distribute pipeline workloads across multiple {product-title} clusters for horizontal scalability. This approach uses a hub-and-spoke architecture, where a hub cluster manages pipeline runs and spoke clusters run the workloads. Multicluster support helps you overcome performance limitations that occur when running many tasks concurrently on a single cluster. By distributing workloads across clusters, you can reduce resource contention, improve performance, and increase the overall capacity of your pipeline infrastructure. diff --git a/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc b/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc index 30d45005da5..e41dad199dd 100644 --- a/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc +++ b/secure/setting-up-openshift-pipelines-to-view-software-supply-chain-security-elements.adoc @@ -17,10 +17,10 @@ Set up {pipelines-shortname} to view: Additionally, `PipelineRuns` that meet {tekton-chains} requirement displays signed badges next to their names. This badge indicates that the pipeline run execution results are cryptographically signed and stored securely, for example within an OCI image. -.The signed badge +*The signed badge* image::badge.png[The signed badge] -The `PipelineRun` displays the signed badge next to its name only if you have configured {tekton-chains}. For information about configuring {tekton-chains}, see link:https://docs.openshift.com/pipelines/1.13/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc[Using {tekton-chains} for {pipelines-shortname} supply chain security]. +The `PipelineRun` displays the signed badge next to its name only if you have configured {tekton-chains}. include::modules/op-setting-up-openshift-pipelines-to-view-project-vulnerabilities.adoc[leveloffset=+1] @@ -36,4 +36,5 @@ include::modules/op-reading-the-sbom.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources -* xref:../create/working-with-pipelines-web-console.adoc#additional-resources_working-with-pipelines-web-console[Working with {pipelines-title} in the web console] \ No newline at end of file +* link:https://docs.openshift.com/pipelines/1.13/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc[Using {tekton-chains} for {pipelines-shortname} supply chain security] +* xref:../create/working-with-pipelines-web-console.adoc#additional-resources_working-with-pipelines-web-console[Working with {pipelines-title} in the web console] diff --git a/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc b/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc index 9fd3d2d62cd..f611ed99210 100644 --- a/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc +++ b/secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc @@ -7,7 +7,7 @@ include::_attributes/common-attributes.adoc[] toc::[] [role="_abstract"] -{tekton-chains} is a Kubernetes Custom Resource Definition (CRD) controller. You can use it to manage the supply chain security of the tasks and pipelines created using {pipelines-title}. +{tekton-chains} is a Kubernetes custom resource definition (CRD) controller. You can use it to manage the supply chain security of the tasks and pipelines created by using {pipelines-title}. By default, {tekton-chains} observes all task run executions in your {OCP} cluster. When the task runs complete, {tekton-chains} takes a snapshot of the task runs. It then converts the snapshot to one or more standard payload formats, and finally signs and stores all artifacts. @@ -19,7 +19,7 @@ You can perform the following key tasks with {tekton-chains}: * You can use attestation formats such as `in-toto`. -* You can securely store signatures and signed artifacts using OCI repository as a storage backend. +* You can securely store signatures and signed artifacts by using OCI repository as a storage backend. include::modules/op-configuring-tekton-chains.adoc[leveloffset=+1] From 4ab3f819d627f28d0d682239773f84195630d96e Mon Sep 17 00:00:00 2001 From: Kamalini Mukherjee Date: Tue, 25 Aug 2026 14:56:08 +0530 Subject: [PATCH 5/5] [RHDEVDOCS-6787] Add CEL regex PR filtering example to PAC docs --- ...tching-pipeline-run-using-pipelines-as-code.adoc | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc b/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc index 1e58273c5e1..c37956bf888 100644 --- a/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc +++ b/modules/op-matching-pipeline-run-using-pipelines-as-code.adoc @@ -193,5 +193,18 @@ $ git commit --amend --no-edit && git push --force-with-lease [role="_additional-resources"] .Additional resources +.Example: Filtering pull requests by excluding non-code file changes +[source,yaml] +---- +metadata: + annotations: + pipelinesascode.tekton.dev/on-cel-expression: | + event == "pull_request" + && target_branch == "main" + && !files.all.all(x, x.matches('^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$')) +---- + +In this example, {pac} triggers the pipeline run only when a pull request targeting the `main` branch includes file modifications outside of documentation (`docs/`, `.md`) or repository metadata (`OWNERS`, `PROJECT`, `LICENSE`, `.gitignore`). + * link:https://cel.dev/[Common Expression Language (CEL)] * link:https://www.kubernetes.dev/docs/guide/owners/[Kubernetes OWNERS file specification]