live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releaseSUPPLY CHAIN

Tekton Pipelines 1.16 turns on restricted security contexts by default

The release improves compatibility with Kubernetes restricted Pod Security Standards, but user-authored steps and sidecars still need their own settings.

Tekton security defaults: injected containers restricted, user steps still manual.
Side by side: what changed
By The News Desk· Sep 1, 2026the quick take — two AI hosts, this story only

Tekton Pipelines 1.16 changes a security default that platform teams should review before upgrading: set-security-context is now enabled by default for containers Tekton injects into TaskRuns and for Affinity Assistants.

The project published version 1.16.0 on Aug. 31 and labels the change as requiring action. Tekton says the new default is intended to align generated workloads with Kubernetes security practices and improve operation in namespaces enforcing the restricted Pod Security Standard.

What changed

With the flag enabled, Tekton-generated containers receive a restricted security context, including runAsNonRoot: true. The change applies to Tekton-injected TaskRun containers and Affinity Assistants, according to the release notes and the implementation pull request.

That scope matters. Tekton does not add the same settings to user-defined Steps and Sidecars. Pipeline authors remain responsible for supplying security contexts that are compatible with restricted namespaces for those containers.

The release notes include an explicit rollback: operators whose images or Kubernetes implementation are incompatible with the generated settings can set set-security-context to "false" in Tekton's feature-flags configuration.

What operators should check

Before moving production controllers to 1.16, platform teams should test representative TaskRuns in namespaces that match their production Pod Security admission settings. Images that assume root execution are the most obvious compatibility risk when Tekton applies runAsNonRoot to injected containers.

Teams should also inspect pipeline definitions rather than assuming the controller now makes every container restricted-compatible. User-supplied Steps and Sidecars remain outside the feature flag's scope, so those definitions may still need explicit securityContext fields.

Beyond the default change, 1.16 adds tracing spans around task-parameter and workspace substitution and fixes the lifecycle of root reconciliation spans so they cover the full TaskRun and PipelineRun reconciliation cycle. Those changes are aimed at observability and performance analysis rather than pipeline behavior.

Tekton Pipelines is upstream of Red Hat OpenShift Pipelines, but this upstream release is not itself a statement about when or how the change will appear in a supported Red Hat product. OpenShift administrators should use the release notes for their installed operator channel when planning a product upgrade.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk