RHSA-2026:1049 - Security Advisory

Topic

The 1.21.0 GA release of Red Hat OpenShift Pipelines Operator..
For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).

Description

The 1.21.0 release of Red Hat OpenShift Pipelines Operator.

Solution

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.

Fixes

• SRVKP-6166 - Reduce the role for pipeline service account when we set customRBACresource to true.
• SRVKP-8057 - Automatically create route for results API end point
• SRVKP-8891 - tekton-operator-proxy-webhook certificate having issues auto rotating in HCP cluster
• SRVKP-8922 - The Results configuration is not being propagated from TektonConfig to Results.
• SRVKP-9126 - Optimize OpenShift Pipelines Operator Logging
• SRVKP-9425 - Can no longer set maxRetention for results

CVEs

• CVE-2025-66506

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines