Add ImageVolumeSource as a workspace binding type by bennyz · Pull Request #10593 · tektoncd/pipeline

bennyz · 2026-08-13T11:14:17Z

Add support for Kubernetes Image Volumes (corev1.ImageVolumeSource) as a new workspace volume source type in WorkspaceBinding. This allows users to mount container image filesystems as read-only workspace volumes in TaskRuns and PipelineRuns.

The feature is gated behind the "enable-image-workspace" per-feature flag at alpha stability, disabled by default.

Changes:

Add Image field to WorkspaceBinding in v1 and v1beta1 APIs
Add "enable-image-workspace" per-feature flag (alpha, default off)
Add validation requiring image.reference when Image is set
Gate Image workspace usage behind the feature flag
Add Image to allVolumeSourceFields (also adds missing projected/csi)
Add volume creation and parameter substitution support
Add v1beta1 <-> v1 conversion
Update deepcopy functions
Add documentation with Kubernetes version requirements
Add tests for validation, feature gating, volume creation, and parameter substitution

Fixes: #10592

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
pre-commit Passed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Add support for Kubernetes Image Volumes as a workspace binding type. When the `enable-image-workspace` feature flag is set to `true`, users can bind workspaces to container image filesystems using the new `image` field. Requires Kubernetes 1.31+ with the ImageVolume feature gate enabled.

/kind feature

linux-foundation-easycla · 2026-08-13T11:14:24Z

The committers listed above are authorized under a signed CLA.

✅ login: bennyz / name: Benny Zlotnik (a6aa9b0)

bennyz · 2026-08-13T11:30:53Z

/kind feature

Copilot

Pull request overview

Adds feature-gated Kubernetes image volumes as workspace bindings for TaskRuns and PipelineRuns.

Changes:

Extends v1/v1beta1 workspace APIs, validation, conversion, and volume creation.
Adds parameter substitution and tests.
Documents Kubernetes requirements.

Reviewed changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`pkg/workspace/apply.go`	Creates image volumes and substitutes references.
`pkg/workspace/apply_test.go`	Tests image mounting and substitution.
`pkg/apis/pipeline/v1beta1/zz_generated.deepcopy.go`	Deep-copies image sources.
`pkg/apis/pipeline/v1beta1/workspace_validation.go`	Validates and gates image bindings.
`pkg/apis/pipeline/v1beta1/workspace_validation_test.go`	Tests v1beta1 validation.
`pkg/apis/pipeline/v1beta1/workspace_types.go`	Adds the v1beta1 image field.
`pkg/apis/pipeline/v1beta1/workspace_conversion.go`	Converts image bindings between APIs.
`pkg/apis/pipeline/v1beta1/pipelinerun_validation_test.go`	Updates source-field expectations.
`pkg/apis/pipeline/v1/zz_generated.deepcopy.go`	Deep-copies image sources.
`pkg/apis/pipeline/v1/workspace_validation.go`	Validates and gates image bindings.
`pkg/apis/pipeline/v1/workspace_validation_test.go`	Tests v1 validation.
`pkg/apis/pipeline/v1/workspace_types.go`	Adds the v1 image field.
`pkg/apis/pipeline/v1/pipelinerun_validation_test.go`	Updates source-field expectations.
`pkg/apis/config/feature_flags.go`	Defines the feature flag.
`docs/workspaces.md`	Documents image workspaces.

Files not reviewed (2)

pkg/apis/pipeline/v1/zz_generated.deepcopy.go: Generated file
pkg/apis/pipeline/v1beta1/zz_generated.deepcopy.go: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+	// Image represents a volume populated from a container image's filesystem.
+	// The image is pulled at pod startup. Contents are mounted read-only.
+	// Requires Kubernetes 1.31+ with the ImageVolume feature gate enabled.
+	// +optional
+	Image *corev1.ImageVolumeSource `json:"image,omitempty"`


+	// DefaultEnableImageWorkspaceFlag is the default PerFeatureFlag value for "enable-image-workspace"
+	DefaultEnableImageWorkspaceFlag = PerFeatureFlag{
+		Name:      EnableImageWorkspace,
+		Stability: AlphaAPIFields,
+		Enabled:   DefaultAlphaFeatureEnabled,
+	}


 	sink.Secret = w.Secret
 	sink.Projected = w.Projected
 	sink.CSI = w.CSI
+	sink.Image = w.Image


tekton-robot · 2026-08-17T16:13:38Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from vdemeester after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

Copilot reviewed 22 out of 26 changed files in this pull request and generated 1 comment.

Files not reviewed (4)

pkg/apis/pipeline/v1/openapi_generated.go: Generated file
pkg/apis/pipeline/v1/zz_generated.deepcopy.go: Generated file
pkg/apis/pipeline/v1beta1/openapi_generated.go: Generated file
pkg/apis/pipeline/v1beta1/zz_generated.deepcopy.go: Generated file

Add support for Kubernetes Image Volumes (corev1.ImageVolumeSource) as a new workspace volume source type in WorkspaceBinding. This allows users to mount container image filesystems as read-only workspace volumes in TaskRuns and PipelineRuns. The feature is gated behind the "enable-image-workspace" per-feature flag at alpha stability, disabled by default. Changes: - Add Image field to WorkspaceBinding in v1 and v1beta1 APIs - Add "enable-image-workspace" per-feature flag (alpha, default off) - Add validation requiring image.reference when Image is set - Gate Image workspace usage behind the feature flag - Add Image to allVolumeSourceFields (also adds missing projected/csi) - Add volume creation and parameter substitution support - Add v1beta1 <-> v1 conversion - Update deepcopy functions - Add documentation with Kubernetes version requirements - Add tests for validation, feature gating, volume creation, and parameter substitution Fixes: tektoncd#10592 Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com> Assisted-by: claude-opus-4.6

tekton-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesnt merit a release note. labels Aug 13, 2026

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Aug 13, 2026

tekton-robot requested review from abayer and twoGiants August 13, 2026 11:14

tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesnt merit a release note. labels Aug 13, 2026

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Aug 13, 2026

vdemeester self-assigned this Aug 17, 2026

vdemeester requested a balanced review from Copilot August 17, 2026 11:06

Copilot started reviewing on behalf of vdemeester August 17, 2026 11:06 View session

Copilot AI reviewed Aug 17, 2026

View reviewed changes

bennyz force-pushed the add-image-workspace-binding branch from a6aa9b0 to c81fbcd Compare August 17, 2026 16:04

bennyz marked this pull request as ready for review August 18, 2026 09:21

tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 18, 2026

tekton-robot requested review from dibyom and pritidesai August 18, 2026 09:21

bennyz force-pushed the add-image-workspace-binding branch from c81fbcd to e2e35dc Compare August 22, 2026 08:33

bennyz requested a balanced review from Copilot August 22, 2026 08:36

Copilot started reviewing on behalf of bennyz August 22, 2026 08:37 View session

Copilot AI reviewed Aug 22, 2026

View reviewed changes

Comment thread config/config-feature-flags.yaml Outdated

bennyz force-pushed the add-image-workspace-binding branch from e2e35dc to 531c771 Compare August 22, 2026 09:02

Navigation Menu

Uh oh!

Add ImageVolumeSource as a workspace binding type - #10593

Add ImageVolumeSource as a workspace binding type#10593
bennyz wants to merge 1 commit into
tektoncd:mainfrom
bennyz:add-image-workspace-binding

bennyz commented Aug 13, 2026 •

edited

Loading

Uh oh!

linux-foundation-easycla Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

bennyz commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

tekton-robot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

bennyz commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

linux-foundation-easycla Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bennyz commented Aug 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

tekton-robot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bennyz commented Aug 13, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Aug 13, 2026 •

edited

Loading