#Release Notes

#Compatibility and support matrix

The following table shows the compatibility and support matrix between the Alauda DevOps Pipelines operator and ACP versions.

The following table shows the recommended version mapping between Alauda DevOps Pipelines and Alauda DevOps Connectors.

#Channel mapping

For details about channel behavior and upgrade targeting, see Upgrade Path and Lifecycle Policy.

#v4.14.0

#New and Optimized Features

Operator

• With this update, the whole Tekton stack moves to a new baseline: Tekton Pipelines v1.12, Triggers v0.36, Chains v0.27, Results v0.19, Pipelines as Code v0.48, Manual Approval Gate v0.9, Pruner v0.4, and the tkn CLI v0.45. See the Compatibility and support matrix for the full mapping.

Triggers

• With this update, an EventListener export rule can be exposed through Gateway API HTTPRoute by setting type: HTTPRoute, in addition to the existing Ingress mode. This makes automatic webhook exposure work on clusters that provide no IngressClass and route external traffic through a Gateway implementation such as Envoy Gateway. An empty type still defaults to Ingress, so existing rules are unaffected. For details, see Gateway API (HTTPRoute) mode.
• With this update, the time zone used to render the $(context.date) and $(context.datetime) placeholders injected by ScheduledTrigger is defined and documented: the same effective zone evaluates the cron schedule and renders the placeholders, resolved from spec.timeZone, then the controller's process time zone, and finally UTC as the out-of-the-box default. Previously the value carried whatever local zone the controller image happened to bake in, so the same ScheduledTrigger produced different offsets on different clusters. For details, see Time Zone Resolution for Context Parameters.

Pipelines as Code

• With this update, Pipelines as Code is configured through TektonConfig on Kubernetes. On the default spec.profile: all the operator derives the OpenShiftPipelinesAsCode CR from TektonConfig and keeps it in sync, so TektonConfig is the only resource to edit. For details, see Manage PAC Component.
• With this update, PAC resolves catalog resources through the in-cluster artifacthub-shim service. An administrator-configured hub URL is preserved, and additional PAC controllers are covered as well, including controllers declared after the upgrade.

Catalog

• With this update, legacy TektonHub custom catalog configuration is migrated to ArtifactHub Shim before the removed Tekton Hub runtime is cleaned up. The operator reads TektonHub.spec.catalogs[] and the old tekton-hub-api ConfigMap CATALOGS data, then creates an ArtifactHub Shim repository ConfigMap named artifacthub-shim-legacy-tekton-hub-catalogs.
• Migrated catalog entries are generated as <catalog> for Tasks, <catalog>-pipelines for Pipelines, and <catalog>-stepactions for StepActions. Generated entries use optional: true; Pipeline and StepAction entries also use legacyCatalogAliases so old resolver references can keep using the original catalog name.
• If the legacy Tekton Hub SSH credential Secret tekton-hub-api-ssh-crds exists in the old Hub target namespace, the operator normalizes it into the ArtifactHub Shim namespace as artifacthub-shim-legacy-tekton-hub-ssh-creds and references it from migrated SSH catalog repositories. The normalized Secret contains sshPrivateKey and known_hosts; if known_hosts is missing or multiple private key candidates are present, the catalog entry is still migrated without credentialRef.
• With this update, the default backend of the Hub resolver is the in-cluster artifacthub-shim service using Artifact Hub-compatible APIs. For details, see Resolvers.

Web Console

• With this update, the run dialog can configure computeResources — CPU and memory requests and limits — for a PipelineRun without hand-editing YAML. The values are preserved when the run is saved as a TriggerTemplate and when the PipelineRun is executed again.
• With this update, the run configuration also covers timeouts, with unit selection and validation, so the common PipelineRun execution settings no longer require switching to YAML.
• With this update, re-running a PipelineRun falls back to the run configuration recorded in the original PipelineRun when the console cannot resolve its pipelineRef. Params, workspaces, and taskRunTemplate are no longer lost or reset when a Pipeline is referenced through a resolver the console does not fully parse.
• With this update, a pipeline can bind Integrations of different types at the same time through Multi Connector.
• With this update, Hub catalog requests carry the current Workspace namespace, and list, detail, and manifest caches are isolated per cluster and namespace. Switching Workspace no longer shows or resolves catalog resources that are invisible in the target namespace.
• With this update, Task and Pipeline lists use a lightweight pagination API and load README and manifest content on demand, which shortens the time to first render on large catalogs.
• With this update, multiple UI details are refined, including dynamic form authoring (multi-language display fields for workspaces and results, code editing for string fields, Integration form-mode compatibility, and Result type and object property rendering), pipeline topology layout, detail pages defaulting to the Details tab, breadcrumbs and browser title, tag-triggered run source navigation, and cluster resolver PipelineRuns in the Repository detail page.

#Breaking Changes

• Starting from this release, the built-in Tekton Hub runtime is no longer shipped. The operator carries no Tekton Hub manifests, and the AUTOINSTALL_TEKTONHUB switch introduced in v4.12.0 has been removed, so the built-in Tekton Hub cannot be re-enabled after upgrading. The Hub column of the compatibility matrix is empty from 4.14.x onward for this reason.

  • Catalog publishing and consumption are served by ArtifactHub Shim, which has its own lifecycle. Custom catalog configuration is migrated automatically — see Catalog above and the Upgrade Notes below for what the migration does and does not cover.
  • The Tekton Hub documentation section has been removed along with the runtime. For catalog authoring and consumption guides, see ArtifactHub Shim Catalog.

• Starting from this release, TektonConfig owns the Pipelines as Code deployment on the Kubernetes platform. Up to v4.12.x there was no PAC block in TektonConfig on Kubernetes, so PAC was configured by editing the OpenShiftPipelinesAsCode CR directly. That CR is now derived from TektonConfig: the operator sets an owner reference on it and overwrites targetNamespace, config, settings, options, and additionalPACControllers on every reconcile. Read it for troubleshooting, but write to TektonConfig. Note that PAC is only reconciled on spec.profile: all; on basic or lite the operator does not touch PAC at all. For details, see Manage PAC Component.

#Upgrade Notes

Pipelines as Code

• Upgrading a Kubernetes cluster that configured a standalone OpenShiftPipelinesAsCode CR copies its settings, its additionalPACControllers, and the Alauda-specific settings that TektonConfig has no field for into TektonConfig before adoption overwrites them. A value already present in TektonConfig is never overwritten, and the standalone CR is never deleted. spec.config has no per-component equivalent in TektonConfig; the operator warns about it rather than guessing.
• Adoption also relocates PAC into the TektonConfig target namespace. The Git provider credential Secret pipelines-as-code-secret is copied and the global Repository is moved into the new namespace, both annotated with operator.tekton.dev/copied-from-namespace. Neither overwrites an object that already exists in the target namespace, and user-created Repository resources are left untouched.
• A catalog that genuinely speaks the Tekton Hub API must now declare catalog-<n>-type: tektonhub explicitly. Catalog type auto-detection no longer probes the network from the admission path, so it cannot stall on an air-gapped cluster.

Catalog

• The migration writes resources into the ArtifactHub Shim namespace resolved from TektonConfig.spec.pipeline.hub-resolver-config.artifact-hub-api; when that value is unavailable, the default namespace is artifacthub-shim-system.
• The migration does not fetch TektonHub.spec.api.hubConfigUrl and does not clone Git repositories. Make sure custom catalog definitions are present in TektonHub.spec.catalogs[] or in the in-cluster tekton-hub-api ConfigMap CATALOGS data before upgrading. For details about configuring migrated custom catalog sources, see Configure Custom Git Repositories.
• The operator skips generated entries that conflict with existing ArtifactHub Shim repository names or same-kind aliases. It also preserves same-name ConfigMaps or Secrets that were not generated by this migration.

#Fixed Issues

• Before this update, when a Task contained two or more steps referencing StepActions together with an object parameter that both declared a default value and was set by the TaskRun, resolving those StepAction references concurrently triggered a Go runtime concurrent map writes fatal error, crashing and restarting the entire tekton-pipelines-controller process and interrupting the reconciliation of PipelineRuns and TaskRuns handled by that replica; with this update, the concurrent write issue is fixed and this scenario no longer crashes the controller.
• Before this update, in environments holding a large number of run records the pipeline pages in the console were slow to the point of being unusable: listing PipelineRuns on a pipeline detail page took about 76 seconds, opening a single PipelineRun took about 55 seconds, and listing the child records of a run took about 99 seconds, because the Tekton Results records table lacked the indexes required by these frequent console queries and the database had to scan and decompress JSONB data row by row; with this update, the required indexes are added to the records table and their creation is part of the automatic migration performed when the API starts, so the indexes are in place after a fresh installation or an upgrade without anyone running DDL manually, and the affected queries returned to sub-second times in the verified environment.
• Before this update, when a new branch was created on GitLab from the current commit of the default branch without producing any new commit, the push webhook carried an empty commits array and Pipelines as Code skipped the event as invalid with the message "no commits attached to this push event", so creating the branch did not trigger a pipeline and users had to trigger it manually with a /test comment on the target commit; with this update, Pipelines as Code uses the after field to identify the commit even when commits is empty and continues with the normal Repository and PipelineRun matching, so these branch-creation events trigger pipelines as expected. GitHub was not affected by this issue.
• Before this update, Manual Approval Gate rejected approval group names containing a colon, so approvals that used standard Kubernetes groups such as system:authenticated failed validation, leaving the approval task in the pending state and blocking the downstream pipeline until it timed out; with this update, standard Kubernetes group names containing colons are accepted, and multi-approver flows based on group membership complete normally.
• Before this update, once completed runs were removed from etcd by the pruner or deleted by the user, the pipeline run list did not automatically load those archived records from Tekton Results, a manual refresh was required, and records could be found by name search while being absent from the list, leading users to believe the records had been lost; with this update, the run list correctly reads archived data from Results, so the list stays consistent with search by name.
• Before this update, PipelineRuns and TaskRuns that had been archived while their recorded condition was still Running or Pending kept appearing as Running with a loading indicator, which could mislead users into thinking the resources were still executing; with this update, such records are shown with a neutral Archived status in the list, the status tooltip also reports Archived while keeping the original reason and message, and archived running tasks are counted in a neutral segment of the PipelineRun task status breakdown, so users can tell archived records apart from runs that are genuinely still in progress.
• Before this update, mirroring a larger set of images (about 14 or more in practice) produced a task result whose image list exceeded the 4096-byte Tekton termination message limit, so the PipelineRun failed with "Termination message is above max allowed size 4096" even though all images had been copied successfully, and users had to split the images across several runs; with this update, skopeo-copy provides a maxResultImages parameter that caps how many image entries are written to the results and reports the full count through dst-images-count, so mirroring a larger set of images no longer fails the pipeline.
• Before this update, when a TriggerTemplate parameter declared an empty string as its default value and the ScheduledTrigger did not explicitly provide that parameter, the PipelineRun created by the scheduled trigger still contained the unresolved placeholder $(tt.params.<name>); with this update, an empty string is treated as a valid default value during rendering, and PipelineRuns created by scheduled triggers no longer contain unresolved parameter placeholders.
• Before this update, the recent-run indicators shown for each pipeline in the pipeline list were not ordered by run time, so they did not always represent the most recent runs; with this update, the runs are sorted by creation time in descending order, so the indicators show the latest runs of that pipeline.
• Before this update, when switching between Tasks on the pipeline editing page, parameters from the previous Task remained in the form whenever the two Tasks referenced different definitions, so fields unrelated to the current Task appeared; with this update, stale parameters are cleared when the Task changes and the form keeps only the parameters declared by the current Task definition, while values already entered are preserved during automatic form population until the current definitions finish loading, so user input is not cleared by mistake.
• Before this update, clicking the "Go To SonarQube" link in the Task Overview of a PipelineRun detail page did not open the report in a new browser tab, because the link's target attribute was stripped during rendering; with this update, the link opens in a new tab as expected.
• Before this update, the Tekton Results watcher stored TaskRun and PipelineRun records as soon as the runs were created and kept upserting them as the resources changed, so incomplete runs were archived as well and the list contained archived records that were still marked as Running, leaving users unable to tell from the status whether a resource was still executing while also adding write load to the Results API and database; with this update, a guide is provided for disabling live collection of incomplete runs: after the --disable_storing_incomplete_runs=true argument is added to tekton-results-watcher through TektonConfig, runs that have not reached a terminal state are no longer stored in Tekton Results and a run is stored only after it finishes, so the status of archived records matches their actual state and the Results API and database receive fewer updates.

#Known Issues

No issues in this release.