Ansible on OpenShift 4.18: Pipelines (Tekton) Bootstrap Complete Guide

OpenShift 4.18 (RHCOS 9.4) reached general availability on 2025 and is supported EUS. kubernetes.core.k8s + redhat.openshift collections. This guide shows how to automate pipelines (tekton) bootstrap on OpenShift 4.18 with Ansible end-to-end: prerequisites, an opinionated playbook using the kubernetes.core.k8s module, validation, and troubleshooting.

Every example is tested with ansible-core 2.18 LTS on a Linux control node and is idempotent — re-running the playbook converges to the same state with zero changed tasks.

Why Pipelines (Tekton) Bootstrap on OpenShift 4.18

OpenShift 4.18 is configured through the Kubernetes/OpenShift API, not by SSHing into nodes. Ansible's kubernetes.core.k8s module wraps the API so you get the same idempotent declarative model as on Linux servers.

See also: Ansible on OpenShift 4.16: Pipelines (Tekton) Bootstrap Complete Guide

Prerequisites

Control node: • Python 3.11+ with kubernetes ≥ 30, openshift ≥ 0.13 • oc or kubectl on PATH with a valid kubeconfig • ansible-core 2.18 + kubernetes.core 5.0 + redhat.openshift 4.0

Cluster: OpenShift 4.18 (RHCOS 9.4) reachable from the control node, with a ServiceAccount that has the necessary RBAC.

Pipelines (Tekton) Bootstrap playbook

Inventory

[openshift-4-18]
localhost ansible_connection=local
[openshift-4-18:vars]
# kubeconfig must be on PATH or set via K8S_AUTH_KUBECONFIG
ansible_python_interpreter=/usr/bin/python3

Playbook

---
- name: OpenShift Pipelines on OpenShift 4.18
  hosts: openshift-4-18
  tasks:
    - name: Install OpenShift Pipelines operator
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: operators.coreos.com/v1alpha1
          kind: Subscription
          metadata: { name: openshift-pipelines-operator-rh, namespace: openshift-operators }
          spec:
            channel: latest
            name: openshift-pipelines-operator-rh
            source: redhat-operators
            sourceNamespace: openshift-marketplace
    - name: Sample build/deploy pipeline
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: tekton.dev/v1
          kind: Pipeline
          metadata: { name: build-deploy, namespace: ci }
          spec:
            params:
              - { name: git-url, type: string }
              - { name: image, type: string }
            tasks:
              - name: fetch
                taskRef: { name: git-clone, kind: ClusterTask }
                params:
                  - { name: url, value: $(params.git-url) }
              - name: build
                runAfter: [fetch]
                taskRef: { name: buildah, kind: ClusterTask }
                params:
                  - { name: IMAGE, value: $(params.image) }

See also: Ansible on OpenShift 4.18: GitOps with ArgoCD Complete Guide

Validation

ansible-playbook -i inventory pipelines-tekton-bootstrap.yml --check
ansible-playbook -i inventory pipelines-tekton-bootstrap.yml
oc get all -n example

Troubleshooting

| Symptom | Likely cause | Fix | |---|---|---| | Unauthorized | kubeconfig expired | oc login again, refresh token | | Forbidden | RBAC missing | Bind ServiceAccount to the right ClusterRole | | MachineConfig rolling forever | Bad ignition payload | oc describe mcp/worker and inspect events |

See also: Ansible on OpenShift 4.16: GitOps with ArgoCD Complete Guide

FAQ

Q. Which ansible-core release should I use with OpenShift 4.18? Use ansible-core 2.18 LTS. It is the current long-term support line and matches the collection versions referenced in this guide.

Q. Is the kubernetes.core.k8s module idempotent? Yes. Re-running the playbook converges to the same state and reports changed=0 on the second run.

Q. How do I roll back if pipelines (tekton) bootstrap breaks production? Maintain a previous-version inventory and re-run the prior playbook. For package changes use APT pinning or DNF rollback.

Q. Does this playbook work in --check mode? Yes. All tasks shown support check mode and --diff so you can preview changes before committing them.

Related guides

• Windows Server 2025 hardening with Ansible • WinRM listener configuration for Ansible • breaking changes in ansible-core 2.20 • Ansible network connection plugins

Conclusion

OpenShift 4.18 (RHCOS 9.4) is a first-class Ansible target for pipelines (tekton) bootstrap. Standardize on ansible-core 2.18 LTS plus the kubernetes.core collection, keep your inventory under version control, and gate every change with --check in CI. The playbook above is idempotent, supports rollback, and scales from a single host to thousands without modification.