Upgrading TAP (Tanzu Application Platform) to v1.12.6 failed at Tekton Pipelines package update.

Products

• VMware Tanzu Application Platform

Issue/Introduction

Upgrading TAP (Tanzu Application Platform) to v1.12.6 failed at Tekton Pipelines package update with the following error message.

  Updating resource configmap/feature-flags (v1) namespace: tekton-pipelines:
    API server says: admission webhook "config.webhook.pipeline.tekton.dev" denied the request: validation failed: coschedule value disabled is incompatible with disable-affinity-assistant setting to false (reason: BadRequest)

Cause

As explained in TAP v1.12.6 Breaking changes: Tekton Pipelines :

Tekton Pipelines upgraded from v0.56.x to v1.6.x introduces several breaking changes:

• Tekton Pipelines upgrade can fail due to Affinity Assistant feature flag migration:

Tanzu Application Platform v1.12.6 upgrades Tekton Pipelines from the 0.59.x line to 1.6.x. This upgrade crosses a Tekton feature-flag migration boundary for Affinity Assistant configuration.

In Tekton Pipelines 0.59.x, the package default included:

disable-affinity-assistant: "true"

 

In Tekton Pipelines 1.6.x, the deprecated disable-affinity-assistant feature flag has been removed, and the package default now includes:

coschedule: "disabled"

 

Because the old Tekton admission webhook is still running while kapp applies the new feature-flags ConfigMap, the old webhook can reject the new default configuration. Older Tekton validation logic evaluates coschedule together with disable-affinity-assistant.

During the upgrade, disable-affinity-assistant is no longer present in the target ConfigMap, so the old webhook treats it as unset or false and rejects coschedule: "disabled".

This failure can occur even when users have not customized these feature flags.

Resolution

This article provides detailed workaround steps to supplement the release notes.

1. In the tap-values.yaml file, add coschedule: workspaces and remove disable_affinity_assistant line if there it exists. Something looks like:

...
tekton_pipelines:
  feature_flags:
    coschedule: workspaces  
...

2. Run the Tanzu Application Platform upgrade and wait for the Tekton Pipelines components to roll out successfully:

• kubectl -n tekton-pipelines rollout status deploy/tekton-pipelines-webhook
• kubectl -n tekton-pipelines rollout status deploy/tekton-pipelines-controller

3. Once the upgrade completes, update the tap-values.yaml file again and change tekton_pipelines.feature_flags.coschedule to disabled. It should look like:

...
tekton_pipelines:
  feature_flags:
    coschedule: disabled  
...

4. Then run the commands again to make the change take effect.

• kubectl -n tekton-pipelines rollout status deploy/tekton-pipelines-webhook
• kubectl -n tekton-pipelines rollout status deploy/tekton-pipelines-controller