LoginSign Up
← Back to all sparks
T

Tekton Pipelines

INFRA · APIS
Velocity5.0

Kubernetes-native building blocks for CI/CD pipelines

tekton.dev ↗

Tekton turns set-security-context on by default, and tells you to check your Steps

ci-cdkubernetessecurity-defaultsobservabilitylts-branchessupply-chain
◆Current state
v1.16.0 flips set-security-context to true by default, applying to Tekton-injected TaskRun containers and Affinity Assistants; user-defined Steps and Sidecars must now supply their own restricted-compatible security contexts, with the flag available to switch back if generated contexts do not suit the images or the cluster. The other substance is observability — tracing spans added for task parameter and workspace substitution, and the root span fixed to cover the full reconciliation cycle rather than ending at initialisation.
◆Where it's heading
After a period where the effort was concentrated on backporting one resolver defect across every supported branch, this release moves to defaults and instrumentation. Both changes shift work onto the operator: a security default that requires action from anyone running custom Steps, and spans that only matter to teams already collecting traces. The pattern of maintaining many concurrent lines continues, with v1.3.x moved to end of life in this cycle, and the notes remain boilerplate-heavy — attestation instructions still occupy more space than the changes.
◆Prediction
Expect follow-up releases to handle fallout from the security-context default, since a flag that requires action is the kind that generates compatibility reports. The end-of-life move on v1.3.x suggests further branch pruning is likelier than new capability.

◆Recent moves

  1. 16d ago

    set-security-context defaults to true; substitution gets tracing spans

    The set-security-context flag now defaults to true for Tekton-injected containers and Affinity Assistants, an action-required change for anyone whose Steps and Sidecars do not supply restricted-compatible contexts. Tracing spans for parameter and workspace substitution and a corrected root-span lifecycle make up the rest; a hardening default flip rather than new capability.

    View source ↗
  2. 20d ago

    Resolver leader-election and stuck-PipelineRun fixes reach v1.6

    The resolver fixes reaching the oldest maintained line, part of the backport campaign that dominated the previous window.

    View source ↗
  3. 20d ago

    Tekton Pipeline release v1.15.1 "Toyger Orisa" LTS

    A patch on the v1.15 LTS line carrying the same resolver corrections already covered by the release that introduced it.

    View source ↗
  4. 20d ago

    Tekton Pipeline release v1.9.7 "Devon Rex Dreadnought"

    Another branch in the simultaneous backport of the resolver defects, semantically identical to its siblings on other lines.

    View source ↗
  5. 1mo ago

    Tekton Pipeline release v1.15.0 "Toyger Orisa" LTS

    ⚡ SPARK

    The LTS designation that governs which branch platform teams standardise on, and the reference point the subsequent backports and this release's defaults work are measured against.

    View source ↗
  6. 1mo ago

    Tekton Pipeline release v1.6.6 "Sphynx Sentinels"

    An earlier patch on the v1.6 line, preceding the resolver backport that landed there later.

    View source ↗