Description of problem:

Until OpenShift Pipelines 1.16.1, it was possible to cancel a PipelineRun by patching the object and setting .spec.status=Cancelled. Starting with OpenShift Pipelines 1.16.1, this no longer works when the patch is applied after the first TaskRun successfully completed. If the PipelineRun is canceled after the first TaskRun completed, canceling the PipelineRun won't work and report the below error.

- lastTransitionTime: "2024-11-28T16:06:41Z"
  message: 'PipelineRun "pipeline-1-run-4-1p0zt8" was cancelled but had errors trying
    to cancel TaskRuns and/or Runs: failed to patch TaskRun `pipeline-1-run-4-1p0zt8-run-1`
    with cancellation: admission webhook "validation.webhook.pipeline.tekton.dev"
    denied the request: validation failed: invalid value: Once the TaskRun is complete,
    no updates are allowed: spec'
  reason: PipelineRunCouldntCancel

Workaround

N/A

Prerequisites (if any, like setup, operators/versions):

OpenShift Pipelines 1.16.1 and the fist TaskRUn must have been completed

Steps to Reproduce

1. Install OpenShift Pipelines 1.16
2. Run Pipeline that does include multiple TaskRun
3. Patch the PipelineRun with .spec.status=Cancelled after the first TaskRun completed.

Actual results:

The Below condition is being reported and the PipelineRun remains in Unknown state.

- lastTransitionTime: "2024-11-28T16:06:41Z"
  message: 'PipelineRun "pipeline-1-run-4-1p0zt8" was cancelled but had errors trying
    to cancel TaskRuns and/or Runs: failed to patch TaskRun `pipeline-1-run-4-1p0zt8-run-1`
    with cancellation: admission webhook "validation.webhook.pipeline.tekton.dev"
    denied the request: validation failed: invalid value: Once the TaskRun is complete,
    no updates are allowed: spec'
  reason: PipelineRunCouldntCancel

Expected results:

The PipelineRun should get properly canceled like it was the case, prior to OpenShift Pipelines 1.16.1

Reproducibility (Always/Intermittent/Only Once):

Always

Acceptance criteria: 

N/A