undeprecate kaniko task by joeyslalom · Pull Request #1385 · tektoncd/catalog

joeyslalom · 2026-06-26T21:32:21Z

Changes

Add a new version of kaniko which uses a supported fork (https://github.com/osscontainertools/kaniko) to replace the archived version. This version can also build itself, in contrast to other versions (such as Chainguard's)

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Follows the authoring recommendations
Includes docs (if user facing)
Includes tests (for new tasks or changed functionality)
- See the end-to-end testing documentation for guidance and CI details.
Meets the Tekton contributor standards (including functionality, content, code)
Commit messages follow commit message best practices
Has a kind label. You can add one by adding a comment on this PR that
contains /kind <type>. Valid types are bug, cleanup, design, documentation,
feature, flake, misc, question, tep
Complies with Catalog Organization TEP, see example. Note An issue has been filed to automate this validation
- File path follows <kind>/<name>/<version>/name.yaml
- Has README.md at <kind>/<name>/<version>/README.md
- Has mandatory metadata.labels - app.kubernetes.io/version the same as the <version> of the resource
- Has mandatory metadata.annotations tekton.dev/pipelines.minVersion
- mandatory spec.description follows the convention
```
  ```
  
    spec:
      description: >-
        one line summary of the resource
  
        Paragraph(s) to describe the resource.
  ```
```

See the contribution guide for more details.

tekton-robot · 2026-06-26T21:32:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign vinamra28 after the PR has been reviewed.
You can assign the PR to them by writing /assign @vinamra28 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot · 2026-06-26T21:33:33Z

Diff between version 0.7 and 0.8

diff --git a/task/kaniko/0.7/README.md b/task/kaniko/0.8/README.md
index ca189cb..bc7ea13 100644
--- a/task/kaniko/0.7/README.md
+++ b/task/kaniko/0.8/README.md
@@ -1,29 +1,28 @@
 # Kaniko
 
-This Task builds source into a container image using Google's
-[`kaniko`](https://github.com/GoogleCloudPlatform/kaniko) tool.
+This Task builds source into a container image using the
+[`kaniko`](https://github.com/osscontainertools/kaniko) tool.
 
 >kaniko doesn't depend on a Docker daemon and executes each command within a
 >Dockerfile completely in userspace.  This enables building container images in
 >environments that can't easily or securely run a Docker daemon, such as a
 >standard Kubernetes cluster.
-> - [Kaniko website](https://github.com/GoogleCloudPlatform/kaniko)
+> - [Kaniko website](https://github.com/osscontainertools/kaniko)
 
-kaniko is meant to be run as an image, `gcr.io/kaniko-project/executor:v1.5.1`. This
+kaniko is meant to be run as an image, `ghcr.io/osscontainertools/kaniko:v1.27.6`. This
 makes it a perfect tool to be part of Tekton. This task can also be used with Tekton Chains to
 attest and sign the image.
 
 ## Changelog
 
-- Added `IMAGE_DIGEST` to the `Results` which get populated with the digest of a built image
-- Added `IMAGE_URL` to the `Results` which get populated with the URL of a built image
-
-Both these results are needed in order for Chains to sign the image. See Chains documentation for more information: https://github.com/tektoncd/chains/blob/main/docs/config.md#chains-type-hinting
+- Use a supported replacement (https://github.com/osscontainertools/kaniko) of the original archived
+  (https://github.com/GoogleContainerTools/kaniko) repository, so this task is no longer deprecated
+- Added `KANIKO_DIR` variable to allow building kaniko with itself, see https://github.com/osscontainertools/kaniko#bootstrapping-kaniko
 
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.8/raw
 ```
 
 ## Parameters
@@ -32,8 +31,9 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/r
 * **DOCKERFILE**: The path to the `Dockerfile` to execute (_default:_ `./Dockerfile`)
 * **CONTEXT**: The build context used by Kaniko (_default:_ `./`)
 * **EXTRA_ARGS**: Additional args to pass to the Kaniko executor.
-* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `gcr.io/kaniko-project/executor:v1.5.1`)
+* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `ghcr.io/osscontainertools/kaniko:v1.27.6`)
 * **WRITER_IMAGE**: The image to use for the write-url step (_default:_ `docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9`)
+* **KANIKO_DIR**: Specifies the location of the kaniko binaries (_default:_ `/kaniko`)
 
 ## Workspaces
 
diff --git a/task/kaniko/0.7/kaniko.yaml b/task/kaniko/0.8/kaniko.yaml
index e10cb3e..4aa138b 100644
--- a/task/kaniko/0.7/kaniko.yaml
+++ b/task/kaniko/0.8/kaniko.yaml
@@ -3,14 +3,13 @@ kind: Task
 metadata:
   name: kaniko
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/pipelines.minVersion: "0.43.0"
     tekton.dev/categories: Image Build
     tekton.dev/tags: image-build
     tekton.dev/displayName: "Build and upload container image using Kaniko"
     tekton.dev/platforms: "linux/amd64,linux/arm64,linux/ppc64le"
-    tekton.dev/deprecated: "true"
 spec:
   description: >-
     This Task builds a simple Dockerfile with kaniko and pushes to a registry.
@@ -29,11 +28,14 @@ spec:
       type: array
       default: []
     - name: BUILDER_IMAGE
-      description: The image on which builds will run (default is v1.5.1)
-      default: gcr.io/kaniko-project/executor:v1.5.1@sha256:c6166717f7fe0b7da44908c986137ecfeab21f31ec3992f6e128fff8a94be8a5
+      description: The image on which builds will run (default is v1.27.6)
+      default: ghcr.io/osscontainertools/kaniko:v1.27.6@sha256:95779f52d460ca70b65a4f4679d4f5163ad6c33edea3303dc8bbff847de5e05c
     - name: WRITER_IMAGE
       description: The image on which the write-url step will run (default is docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9)
       default: docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9
+    - name: KANIKO_DIR
+      description: Specifies the location of the kaniko binaries
+      default: /kaniko
   workspaces:
     - name: source
       description: Holds the context and Dockerfile
@@ -56,6 +58,9 @@ spec:
         - --context=$(workspaces.source.path)/$(params.CONTEXT) # The user does not need to care the workspace and the source.
         - --destination=$(params.IMAGE)
         - --digest-file=$(results.IMAGE_DIGEST.path)
+      env:
+      - name: KANIKO_DIR
+        value: $(params.KANIKO_DIR)
       # kaniko assumes it is running as root, which means this example fails on platforms
       # that default to run containers as random uid (like OpenShift). Adding this securityContext
       # makes it explicit that it needs to run as root.

tekton-robot · 2026-06-26T21:40:53Z

Diff between version 0.7 and 0.8

diff --git a/task/kaniko/0.7/README.md b/task/kaniko/0.8/README.md
index ca189cb..bc7ea13 100644
--- a/task/kaniko/0.7/README.md
+++ b/task/kaniko/0.8/README.md
@@ -1,29 +1,28 @@
 # Kaniko
 
-This Task builds source into a container image using Google's
-[`kaniko`](https://github.com/GoogleCloudPlatform/kaniko) tool.
+This Task builds source into a container image using the
+[`kaniko`](https://github.com/osscontainertools/kaniko) tool.
 
 >kaniko doesn't depend on a Docker daemon and executes each command within a
 >Dockerfile completely in userspace.  This enables building container images in
 >environments that can't easily or securely run a Docker daemon, such as a
 >standard Kubernetes cluster.
-> - [Kaniko website](https://github.com/GoogleCloudPlatform/kaniko)
+> - [Kaniko website](https://github.com/osscontainertools/kaniko)
 
-kaniko is meant to be run as an image, `gcr.io/kaniko-project/executor:v1.5.1`. This
+kaniko is meant to be run as an image, `ghcr.io/osscontainertools/kaniko:v1.27.6`. This
 makes it a perfect tool to be part of Tekton. This task can also be used with Tekton Chains to
 attest and sign the image.
 
 ## Changelog
 
-- Added `IMAGE_DIGEST` to the `Results` which get populated with the digest of a built image
-- Added `IMAGE_URL` to the `Results` which get populated with the URL of a built image
-
-Both these results are needed in order for Chains to sign the image. See Chains documentation for more information: https://github.com/tektoncd/chains/blob/main/docs/config.md#chains-type-hinting
+- Use a supported replacement (https://github.com/osscontainertools/kaniko) of the original archived
+  (https://github.com/GoogleContainerTools/kaniko) repository, so this task is no longer deprecated
+- Added `KANIKO_DIR` variable to allow building kaniko with itself, see https://github.com/osscontainertools/kaniko#bootstrapping-kaniko
 
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.8/raw
 ```
 
 ## Parameters
@@ -32,8 +31,9 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/r
 * **DOCKERFILE**: The path to the `Dockerfile` to execute (_default:_ `./Dockerfile`)
 * **CONTEXT**: The build context used by Kaniko (_default:_ `./`)
 * **EXTRA_ARGS**: Additional args to pass to the Kaniko executor.
-* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `gcr.io/kaniko-project/executor:v1.5.1`)
+* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `ghcr.io/osscontainertools/kaniko:v1.27.6`)
 * **WRITER_IMAGE**: The image to use for the write-url step (_default:_ `docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9`)
+* **KANIKO_DIR**: Specifies the location of the kaniko binaries (_default:_ `/kaniko`)
 
 ## Workspaces
 
diff --git a/task/kaniko/0.7/kaniko.yaml b/task/kaniko/0.8/kaniko.yaml
index e10cb3e..8ef3ad4 100644
--- a/task/kaniko/0.7/kaniko.yaml
+++ b/task/kaniko/0.8/kaniko.yaml
@@ -1,16 +1,15 @@
-apiVersion: tekton.dev/v1
+apiVersion: tekton.dev/v1beta1
 kind: Task
 metadata:
   name: kaniko
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/pipelines.minVersion: "0.43.0"
     tekton.dev/categories: Image Build
     tekton.dev/tags: image-build
     tekton.dev/displayName: "Build and upload container image using Kaniko"
     tekton.dev/platforms: "linux/amd64,linux/arm64,linux/ppc64le"
-    tekton.dev/deprecated: "true"
 spec:
   description: >-
     This Task builds a simple Dockerfile with kaniko and pushes to a registry.
@@ -29,11 +28,14 @@ spec:
       type: array
       default: []
     - name: BUILDER_IMAGE
-      description: The image on which builds will run (default is v1.5.1)
-      default: gcr.io/kaniko-project/executor:v1.5.1@sha256:c6166717f7fe0b7da44908c986137ecfeab21f31ec3992f6e128fff8a94be8a5
+      description: The image on which builds will run (default is v1.27.6)
+      default: ghcr.io/osscontainertools/kaniko:v1.27.6@sha256:95779f52d460ca70b65a4f4679d4f5163ad6c33edea3303dc8bbff847de5e05c
     - name: WRITER_IMAGE
       description: The image on which the write-url step will run (default is docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9)
       default: docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9
+    - name: KANIKO_DIR
+      description: Specifies the location of the kaniko binaries
+      default: /kaniko
   workspaces:
     - name: source
       description: Holds the context and Dockerfile
@@ -56,6 +58,9 @@ spec:
         - --context=$(workspaces.source.path)/$(params.CONTEXT) # The user does not need to care the workspace and the source.
         - --destination=$(params.IMAGE)
         - --digest-file=$(results.IMAGE_DIGEST.path)
+      env:
+      - name: KANIKO_DIR
+        value: $(params.KANIKO_DIR)
       # kaniko assumes it is running as root, which means this example fails on platforms
       # that default to run containers as random uid (like OpenShift). Adding this securityContext
       # makes it explicit that it needs to run as root.

Error: parse error: invalid resource <nil>:

tekton-robot · 2026-06-26T21:45:53Z

Diff between version 0.7 and 0.8

diff --git a/task/kaniko/0.7/README.md b/task/kaniko/0.8/README.md
index ca189cb..bc7ea13 100644
--- a/task/kaniko/0.7/README.md
+++ b/task/kaniko/0.8/README.md
@@ -1,29 +1,28 @@
 # Kaniko
 
-This Task builds source into a container image using Google's
-[`kaniko`](https://github.com/GoogleCloudPlatform/kaniko) tool.
+This Task builds source into a container image using the
+[`kaniko`](https://github.com/osscontainertools/kaniko) tool.
 
 >kaniko doesn't depend on a Docker daemon and executes each command within a
 >Dockerfile completely in userspace.  This enables building container images in
 >environments that can't easily or securely run a Docker daemon, such as a
 >standard Kubernetes cluster.
-> - [Kaniko website](https://github.com/GoogleCloudPlatform/kaniko)
+> - [Kaniko website](https://github.com/osscontainertools/kaniko)
 
-kaniko is meant to be run as an image, `gcr.io/kaniko-project/executor:v1.5.1`. This
+kaniko is meant to be run as an image, `ghcr.io/osscontainertools/kaniko:v1.27.6`. This
 makes it a perfect tool to be part of Tekton. This task can also be used with Tekton Chains to
 attest and sign the image.
 
 ## Changelog
 
-- Added `IMAGE_DIGEST` to the `Results` which get populated with the digest of a built image
-- Added `IMAGE_URL` to the `Results` which get populated with the URL of a built image
-
-Both these results are needed in order for Chains to sign the image. See Chains documentation for more information: https://github.com/tektoncd/chains/blob/main/docs/config.md#chains-type-hinting
+- Use a supported replacement (https://github.com/osscontainertools/kaniko) of the original archived
+  (https://github.com/GoogleContainerTools/kaniko) repository, so this task is no longer deprecated
+- Added `KANIKO_DIR` variable to allow building kaniko with itself, see https://github.com/osscontainertools/kaniko#bootstrapping-kaniko
 
 ## Install the Task
 
 ```
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/raw
+kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.8/raw
 ```
 
 ## Parameters
@@ -32,8 +31,9 @@ kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/kaniko/0.7/r
 * **DOCKERFILE**: The path to the `Dockerfile` to execute (_default:_ `./Dockerfile`)
 * **CONTEXT**: The build context used by Kaniko (_default:_ `./`)
 * **EXTRA_ARGS**: Additional args to pass to the Kaniko executor.
-* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `gcr.io/kaniko-project/executor:v1.5.1`)
+* **BUILDER_IMAGE**: The Kaniko executor image to use (_default:_ `ghcr.io/osscontainertools/kaniko:v1.27.6`)
 * **WRITER_IMAGE**: The image to use for the write-url step (_default:_ `docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9`)
+* **KANIKO_DIR**: Specifies the location of the kaniko binaries (_default:_ `/kaniko`)
 
 ## Workspaces
 
diff --git a/task/kaniko/0.7/kaniko.yaml b/task/kaniko/0.8/kaniko.yaml
index e10cb3e..8ef3ad4 100644
--- a/task/kaniko/0.7/kaniko.yaml
+++ b/task/kaniko/0.8/kaniko.yaml
@@ -1,16 +1,15 @@
-apiVersion: tekton.dev/v1
+apiVersion: tekton.dev/v1beta1
 kind: Task
 metadata:
   name: kaniko
   labels:
-    app.kubernetes.io/version: "0.7"
+    app.kubernetes.io/version: "0.8"
   annotations:
     tekton.dev/pipelines.minVersion: "0.43.0"
     tekton.dev/categories: Image Build
     tekton.dev/tags: image-build
     tekton.dev/displayName: "Build and upload container image using Kaniko"
     tekton.dev/platforms: "linux/amd64,linux/arm64,linux/ppc64le"
-    tekton.dev/deprecated: "true"
 spec:
   description: >-
     This Task builds a simple Dockerfile with kaniko and pushes to a registry.
@@ -29,11 +28,14 @@ spec:
       type: array
       default: []
     - name: BUILDER_IMAGE
-      description: The image on which builds will run (default is v1.5.1)
-      default: gcr.io/kaniko-project/executor:v1.5.1@sha256:c6166717f7fe0b7da44908c986137ecfeab21f31ec3992f6e128fff8a94be8a5
+      description: The image on which builds will run (default is v1.27.6)
+      default: ghcr.io/osscontainertools/kaniko:v1.27.6@sha256:95779f52d460ca70b65a4f4679d4f5163ad6c33edea3303dc8bbff847de5e05c
     - name: WRITER_IMAGE
       description: The image on which the write-url step will run (default is docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9)
       default: docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9
+    - name: KANIKO_DIR
+      description: Specifies the location of the kaniko binaries
+      default: /kaniko
   workspaces:
     - name: source
       description: Holds the context and Dockerfile
@@ -56,6 +58,9 @@ spec:
         - --context=$(workspaces.source.path)/$(params.CONTEXT) # The user does not need to care the workspace and the source.
         - --destination=$(params.IMAGE)
         - --digest-file=$(results.IMAGE_DIGEST.path)
+      env:
+      - name: KANIKO_DIR
+        value: $(params.KANIKO_DIR)
       # kaniko assumes it is running as root, which means this example fails on platforms
       # that default to run containers as random uid (like OpenShift). Adding this securityContext
       # makes it explicit that it needs to run as root.
diff --git a/task/kaniko/0.7/tests/resources.yaml b/task/kaniko/0.8/tests/resources.yaml
index 195051e..d375144 100644
--- a/task/kaniko/0.7/tests/resources.yaml
+++ b/task/kaniko/0.8/tests/resources.yaml
@@ -1,4 +1,3 @@
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:

vdemeester · 2026-07-03T13:58:59Z

Thanks for working on this @joeyslalom! The move to osscontainertools/kaniko is exactly what's needed now that Google archived the original repo.

FYI — we've used this PR as the basis to modernize the dedicated tektoncd-catalog/kaniko repository (https://github.com/tektoncd-catalog/kaniko), following the same pattern as tektoncd-catalog/git-clone and tektoncd-catalog/golang:

Task upgraded to tekton.dev/v1 API with osscontainertools/kaniko:v1.27.6
Multi-arch support (linux/amd64, linux/arm64, linux/ppc64le)
KANIKO_DIR param (for bootstrapping)
Derived StepAction (auto-generated from the Task)
CI with e2e tests across Tekton Pipelines LTS versions
Tekton Bundle published at ghcr.io/tektoncd-catalog/kaniko/bundle:v0.1.0
ArtifactHub integration

Release: https://github.com/tektoncd-catalog/kaniko/releases/tag/v0.1.0

As tektoncd/catalog is progressively moving to per-component repos under tektoncd-catalog/, your changes are already incorporated in the new repo. Closing this PR in favor of https://github.com/tektoncd-catalog/kaniko.

joeyslalom · 2026-07-04T19:38:36Z

Hello, thanks for taking my work. Can we still merge this PR since I still use this repo? It still appears to be updated and maintained, and so I bet I'm not alone...

vdemeester · 2026-07-08T10:29:31Z

@joeyslalom for some context : tektoncd/community#1283 = in a gist, this repository will be slowly sunset so I am less and less inclined of merging PRs (especially if there is already an alternative of the same task or stepaction elsewhere). Can you also try using https://github.com/tektoncd-catalog/kaniko/releases/tag/v0.1.0 (it should be relatively straightforward to change the reference)

undeprecate kaniko task

534811e

tekton-robot requested a review from vdemeester June 26, 2026 21:32

tekton-robot requested a review from vinamra28 June 26, 2026 21:32

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jun 26, 2026

use apiVersion v1beta1

14dfa48

lint error

5fb2396

Error: parse error: invalid resource <nil>:

vdemeester mentioned this pull request Jul 3, 2026

feat: modernize kaniko repo on par with git-clone and golang tektoncd-catalog/kaniko#2

Merged

4 tasks

vdemeester closed this Jul 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

undeprecate kaniko task#1385

undeprecate kaniko task#1385
joeyslalom wants to merge 3 commits into
tektoncd:mainfrom
joeyslalom:jt/kaniko08

joeyslalom commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

vdemeester commented Jul 3, 2026

Uh oh!

joeyslalom commented Jul 4, 2026

Uh oh!

vdemeester commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

joeyslalom commented Jun 26, 2026

Changes

Submitter Checklist

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

tekton-robot commented Jun 26, 2026

Uh oh!

vdemeester commented Jul 3, 2026

Uh oh!

joeyslalom commented Jul 4, 2026

Uh oh!

vdemeester commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants