RHBA-2023:4315 - Bug Fix Advisory

Topic

Red Hat OpenShift Pipelines 1.10.5 General Availability release - A cloud-native Continuous Integration and Delivery solution on OpenShift.

Description

Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery (CI/CD) solution for building pipelines using Tekton. Tekton is a flexible, Kubernetes-native, open-source CI/CD framework that enables automating deployments across multiple platforms such as Kubernetes, Serverless, and VMs by abstracting away the underlying details.

Red Hat OpenShift Pipelines consists of:

• Tekton Pipelines 0.44.x
• Tekton Triggers 0.23.x
• ClusterTasks based on Tekton Catalog
• Tekton tkn CLI 0.30.x
• Tekton Operator 0.65.x
• Tekton Chains 0.15.x (TP)
• Tekton Hub 1.12.x (TP)
• Pipelines-as-Code 0.17.x (GA)

## Features

• Standard CI/CD pipelines definition
• Build images with Kubernetes tools such as S2I, Buildah, Buildpacks, Kaniko, etc.
• Deploy applications to multiple platforms such as Kubernetes, Serverless, and VMs
• Easy to extend and integrate with existing tools
• Scale pipelines on-demand
• Portable across any Kubernetes platform
• Designed for microservices and decentralized teams
• Integrated with OpenShift Developer Console
• Enhance supply chain security with Tekton Chains (Technology Preview)
• Install and deploy Tekton Hub (Technology Preview) with custom catalog on enterprise cluster
• Maintain pipelines definition as part of application repository with Pipelines-as-Code (PAC) (General Availability)

Solution

For more information, see the Release Notes linked from the References section.

Affected Products

• Red Hat OpenShift Pipelines 1.10 x86_64
• Red Hat OpenShift Pipelines for IBM Power, little endian 1.10 ppc64le
• Red Hat OpenShift Pipelines for IBM Z and LinuxONE 1.10 s390x
• Red Hat OpenShift Pipelines for ARM 1.10 aarch64

Fixes

• SRVKP-3302 - Release OpenShift Pipelines Operator for 1.10.5

CVEs

• CVE-2020-24736
• CVE-2022-42898
• CVE-2023-1667
• CVE-2023-2283
• CVE-2023-2828
• CVE-2023-24329
• CVE-2023-26604
• CVE-2023-28154

References

• https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/cicd/pipelines#release-notes-1-10-5_op-release-notes
• https://docs.openshift.com/container-platform/4.13/cicd/pipelines/op-release-notes.html#release-notes-1-10-5_op-release-notes