Tekton

v1.17.0CI/CD & App Delivery

2026年10月1日

オプトインの可観測性とパラメーター対応が加わり、Windowsのスクリプト注入対策を含む正確性の問題が修正されています。依存関係も更新されていますが、オペレーターに広範な対応を求める変更ではありません。

要対応 (1)

securityWindowsスクリプト注入対策の強化
Windowsでスクリプトをコンテナに配置する際、placeScriptInContainer が展開されない PowerShell here-string を使うようになりました。スクリプト本文にリテラルの "@ 行が含まれていても、生成されたコマンドを途中で終了させなくなります。

その他の記録済み変更 28 件すべてvalue changes 20 · fixes 4 · additions 2 · removals 1 · renames 1

Add a reconcile.write_intent attribute (no-op, status-only, metadata-only, metadata-and-status) to PipelineRun and TaskRun reconcile spans so operators can distinguish reconciliations that intend an etcd write.
build(deps): bump the kubernetes group with 5 updates
build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0
build(deps): bump github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2
build(deps): bump the sigstore group with 5 updates
build(deps): bump github.com/jenkins-x/go-scm from … to …×2
build(deps): bump the all group in /tekton with 4 updates
build(deps): bump the all group in /tekton with 6 updates
build(deps): bump golang.org/x/crypto from … to …×2
build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.10.9 to 1.10.10
build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp from 1.10.9 to 1.10.10
build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.9 to 1.10.10
build(deps): bump github.com/sigstore/sigstore from 1.10.9 to 1.10.10
build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/azure from 1.10.9 to 1.10.10
build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0
build(deps): bump github.com/prometheus/common from 0.70.1 to 0.71.0
build(deps): bump github.com/google/go-containerregistry from … to …×2

Before this update, when resolver fails to get any task, controller showed the error message without containing the task name which was hard to detect which one is failed or having bad resolution config. Now task name is added to the error message from template.
Pipelines can now reference $(tt.params.<name>) in task params, when expressions, and matrix params/includes. This lets a PipelineSpec embedded by Tekton Triggers keep its tt.params.* substitutions without failing pipeline validation.
Resolvers no longer fail ResolutionRequests belonging to a different resolver after a leader election or a resolver pod restart.
Fixed controller startup panic messages that printed a malformed %!w(...) marker instead of the underlying error when an informer event handler failed to register.

Gated behind the new surface-pod-events alpha feature flag (disabled by default).
feat(tracing): tag TaskRun ReconcileKind span on cancel/timeout

Tektonをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回のセキュリティパッチも、その一例です。