Where should we take `ClusterTasks` next?

Feature request

We've discussed the possible future of ClusterTasks in our API Working Group but haven't created an issue for it yet as far as I can see. The intention for this issue is to act as the focal point for discussion around the feature, its future, and where we see it going within the context of Tekton Pipelines' other features.

Background

ClusterTask is a CRD that Tekton Pipelines provides that is the cluster-scoped equivalent of a Task. It shares all of the same fields as a Task but can be referenced regardless of the namespace that a TaskRun is executing in. By contrast a Task can only be referred to by a TaskRun in the same namespace.

While ClusterTask has been part of the codebase for a long time it's unclear precisely how much use it actually sees in practice. In our own dogfooding of Tekton Pipelines we don't currently leverage the resource but it does get exercised by unit and integration testing.

There have been some requests for a cluster-scoped Pipeline (#1876, #4432) and as part of those discussions there have definitely been a number of messages in support of ClusterTasks too. At the same time Tekton has introduced support for Bundles (an OCI image with Tasks and Pipelines, stored in a registry) that seems to provide a lot of the same benefit as cluster-scoped Task / Pipeline resources (accessible regardless of the namespace that a TaskRun or PipelineRun is executing in). More recently we've also been making moves to expand the number of places that Tekton Pipelines can access Tasks and Pipelines from, such as git repositories.

Next Steps

• Solicit feedback from the community on usage of ClusterTask
• Present the results from this feedback to the API WG
• Assess overlap of ClusterTasks with other features Tekton Pipelines is pursuing
• ... figure out the next next steps ...

[vdemeester]

One quick note there, OpenShift Pipelines ships with several ClusterTask by default, so any user of OpenShift Pipelines might be using them — and we know some of them use it a lot. That said, one of our goal is to migrate from ClusterTask to oci bundle once those are considered stable.

Using Remote Resolution it's possible to emulate ClusterTasks and ClusterPipelines. Here's a resolver that does exactly this: https://github.com/sbwsg/clusterresolver

This works by keeping all the "Cluster-Scoped" Tasks and Pipelines in one private namespace. The Resolver has exclusive access to those resources and returns them to anyone who asks from any namespace. So an operator/admin can add or remove "ClusterTask" and "ClusterPipeline" by applying or deleteing the Tasks and Pipelines from that private namespace.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[jerop]

we still need to figure this out

/remove-lifecycle stale