fix(chart): make the openshift flavor functional and align with kustomize by aqeelat · Pull Request #3945 · tektoncd/operator

aqeelat · 2026-08-17T21:07:09Z

Changes

The openshift flavor of the Helm chart (openshift.enabled=true) did not work out of the box, and the chart had drifted from the kustomize installation manifests. This PR fixes the openshift flavor and aligns both flavors with config/kubernetes/base and config/openshift/base (verified by diffing helm template output against kubectl kustomize for both flavors; remaining differences are limited to release-name-parameterized resource names, digest-pinned images instead of ko:// refs, and inlined ConfigMap defaults).

Commits are separated so anything unneeded can be dropped:

Template the openshift ServiceAccount name — the openshift RBAC file hardcoded openshift-pipelines-operator while the Deployments resolve the SA via the fullname helper, so the pods referenced an SA the chart never created unless the user set rbac.serviceAccount.name manually.
Set PLATFORM=openshift on the lifecycle and webhook containers in the openshift flavor, so IsOpenShiftPlatform() activates the openshift reconciler branches, defaults and validation.
Add missing RBAC — pac-controller (kubernetes), result-read and scheduler roles/bindings (both flavors, in a new common-rbac.yaml, fullname-prefixed), plus openshift ClusterRole rule alignment (nodes:list, SCC list, config.openshift.io reads, routes/custom-host, events, consoleplugins, pipelinesascode.tekton.dev group, resolutionrequests/status).
Use platform images and controllers per flavor — the openshift branches of the image helpers now select the openshift operator/webhook/proxy images (digest-pinned from the v0.81.0 openshift release), and -controllers gets a flavor-aware default matching the kustomize deployments. Note: the previous kubernetes default was missing tektonscheduler and tektonmulticlusterproxyaae; the new default adds them (additive change, nothing is removed from vanilla).
Wire leader election and add missing ConfigMaps — controller/webhook leader-election ConfigMaps + CONFIG_LEADERELECTION_NAME on all containers, and the tekton-operator-info ConfigMap consumed by tkn version (the chart already shipped the Role granting read access to it).
Fix webhook logLevel wiring — the webhook container was named after the operator name while the logging ConfigMap keys off the fullname, so webhook.logLevel never applied.
Reject a custom operator.defaultTargetNamespace on the openshift flavor — the openshift addon sample pipelines hardcode the openshift-pipelines namespace in their cluster-resolver taskRefs, so any other value ships a broken config; the chart now fails the render with an explanatory message instead. The kubernetes flavor keeps accepting any namespace. Also documented in values.yaml: the value is first-install-only — it seeds the auto-created TektonConfig CR, and once the CR exists the operator never re-reads it (retargeting requires deleting and recreating the CR; spec.targetNamespace updates are rejected by validation).

Decisions worth flagging for reviewers:

IMAGE_ADDONS_* env vars are deliberately not set: addon image defaults come from the operator's built-in manifests and registries can be rewritten with TEKTON_REGISTRY_OVERRIDE or per-image envs via operator.additionalEnvs (documented in values.yaml; see AirGapImageConfiguration.md).
The openshift flavor's ServiceMonitor remains behind service.createServiceMonitor (default off) — upstream ships one unconditionally; happy to flip the default if parity is wanted.
The new roles are not gated on the controllers value; happy to follow up if per-controller RBAC gating is preferred.
The new result-read-role grants system:authenticated get/watch/list on tektonresults CRs — exact parity with upstream config/base/tekton_result_role_binding.yaml and the same pattern as the chart's existing tekton-config-read-role, but it does widen read access for chart upgrades that previously lacked it.
The operator.defaultTargetNamespace guard exists because the upstream openshift addon reconciler hardcodes openshift-pipelines in the generated sample pipelines (pkg/reconciler/openshift/tektonaddon/pipelinetemplates/pipelinetemplates.go, getTaskRef). Upstream fix: thread the addon CR's targetNamespace through GeneratePipelineTemplates; once landed, this guard can be relaxed. Relatedly, upstream reads DEFAULT_TARGET_NAMESPACE only once when auto-creating the config CR — changing the env afterwards is silently ignored.

Submitter Checklist

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

Chart-only change; verified via helm template for both flavors and value overrides, and yamllint.

Release Notes

Fix the openshift flavor of the Helm chart: openshift operator/webhook/proxy images and controller list are now selected per flavor, PLATFORM=openshift is set, the operator ServiceAccount follows the chart fullname, missing RBAC roles (pac, result-read, scheduler) and ConfigMaps (leader election, operator-info) are shipped, and webhook.logLevel is wired correctly. The kubernetes controllers default additionally includes tektonscheduler and tektonmulticlusterproxyaae. The openshift flavor now rejects a custom operator.defaultTargetNamespace while the addon sample pipelines hardcode the openshift-pipelines namespace (first-install-only value; documented in values.yaml).

The openshift RBAC template hardcoded the ServiceAccount name (openshift-pipelines-operator) while the operator Deployment resolves the name via the tekton-operator.serviceAccountName helper. With rbac.create enabled the pod referenced a ServiceAccount the chart never created, so OpenShift users had to set rbac.serviceAccount.name manually. Use the same helper for the ServiceAccount and its ClusterRoleBinding subject so both flavors follow the chart fullname default and the rbac.serviceAccount.name override. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

tekton-robot · 2026-08-17T21:07:12Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign khrm after the PR has been reviewed.
You can assign the PR to them by writing /assign @khrm in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-08-17T21:12:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.33%. Comparing base (332b6f7) to head (2f345ab).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3945   +/-   ##
=======================================
  Coverage   26.33%   26.33%           
=======================================
  Files         465      465           
  Lines       24951    24951           
=======================================
  Hits         6572     6572           
  Misses      17661    17661           
  Partials      718      718

Flag	Coverage Δ
unit-tests	`26.33% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The operator and webhook Deployments never set the PLATFORM env, so the openshift chart flavor ran the operator in kubernetes mode: IsOpenShiftPlatform() returned false and the openshift-specific reconciler branches, defaults, and TektonConfig platform validation never activated. Set PLATFORM=openshift on the lifecycle and webhook containers when openshift.enabled is true, mirroring the upstream openshift kustomize overlay (the tektoninstallerset cluster-operations container does not use it). Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

waveywaves · 2026-08-18T14:51:00Z

              {{- end }}
              {{- end }}
+            {{- if .Values.openshift.enabled }}
+            - name: PLATFORM


PLATFORM does not switch the compiled operator binary. The OpenShift branch in _helpers.tpl still selects the Kubernetes operator image. The correct OpenShift binary also rejects the default tektondashboard controller. Please make the image and controller defaults flavor-aware, or narrow the PR title, description, and release note.

Addressed in 59d667f: the openshift branches of the image helpers now select the openshift operator/webhook/proxy images (digest-pinned from the v0.81.0 openshift release), and the -controllers flag gets a flavor-aware default matching config/openshift/base/operator.yaml (tektonaddon and syncerservice instead of tektondashboard, plus tektonscheduler and tektonmulticlusterproxyaae). IMAGE_ADDONS_* is deliberately not set — defaults come from the operator's built-in manifests and TEKTON_REGISTRY_OVERRIDE covers registry rewrites; noted in values.yaml and the PR description.

waveywaves · 2026-08-18T14:51:00Z

                fieldRef:
                  fieldPath: metadata.namespace
+            {{- if .Values.openshift.enabled }}
+            - name: PLATFORM


The OpenShift branches in _helpers.tpl also select the Kubernetes webhook and proxy images. Please use the OpenShift image repositories, or narrow the PR scope and release note.

Addressed in 59d667f: the openshift webhook and proxy-webhook image helpers now select the openshift image repositories, digest-pinned from the v0.81.0 openshift release.

Add the pac-controller, result-read and scheduler ClusterRoles and bindings that the kustomize installation ships but the chart never did (scheduler and result-read are shared by both flavors and live in a new common-rbac.yaml; pac is kubernetes-only). The new roles are fullname-prefixed like the rest of the chart resources. Also align the openshift operator ClusterRole rules with config/openshift/base/role.yaml: nodes:list, securitycontextconstraints list, config.openshift.io apiservers/clusterversions reads, routes/custom-host, events.k8s.io event creation, consoleplugins, pipelinesascode.tekton.dev in the tekton api-group wildcard, and resolutionrequests/status with update. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

The openshift flavor selected the kubernetes operator, webhook and proxy-webhook images, and PLATFORM alone does not switch the compiled binary. Point the openshift branches of the image helpers at the openshift image repositories (digest-pinned from the v0.81.0 openshift release) and give the controllers flag a flavor-aware default helper, matching the kustomize overlays: - kubernetes adds tektonscheduler and tektonmulticlusterproxyaae which were missing from the chart default (additive change; openshiftpipelinesascode remains) - openshift uses tektonaddon and syncerservice instead of tektondashboard, which the openshift binary does not register The chart deliberately does not set IMAGE_ADDONS_*: addon image defaults come from the operator's built-in manifests and can be rewritten with TEKTON_REGISTRY_OVERRIDE (documented in values.yaml). Fixes review feedback on tektoncd#3945. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

Set CONFIG_LEADERELECTION_NAME on the lifecycle, cluster-operations and webhook containers, and ship the controller and webhook leader election ConfigMaps the operator expects (both were absent, so the knative leader election machinery fell back to default ConfigMap names the chart never created - relevant now that replicas >= 2 is documented as supported). Add the tekton-operator-info ConfigMap consumed by tkn version; the chart already shipped the Role granting read access to it but never created the object. On the cluster-operations container, replace envs that only the tektonconfig/tektonpipeline reconcilers read (IMAGE_PIPELINES_PROXY, AUTOINSTALL_COMPONENTS, DEFAULT_TARGET_NAMESPACE) with the envs the kustomize deployment sets (PROFILING_PORT) while keeping CONFIG_LOGGING_NAME/CONFIG_OBSERVABILITY_NAME, which stay necessary because the chart names those ConfigMaps after the release instead of the knative defaults. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

The webhook container was named after the operator name (redhat-openshift-pipelines-operator-webhook on openshift) while the logging ConfigMap writes loglevel.<fullname>-webhook, so the webhook.logLevel value never matched any container and was silently ignored. Name the container after the fullname to match the ConfigMap key, as the kubernetes deployment manifest does. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

The openshift addon sample pipelines hardcode the openshift-pipelines namespace in their cluster-resolver taskRefs, so a custom target namespace breaks them on the openshift flavor. Fail the render with an explanatory message instead of shipping a broken configuration, and document that the value is first-install-only: once the TektonConfig CR exists the operator never re-reads it, and retargeting requires deleting and recreating the CR. The kubernetes flavor is unaffected and keeps accepting any namespace. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

Move the tekton-operator-info Role/RoleBinding and the tekton-config-read-role ClusterRole/ClusterRoleBinding, which were duplicated byte-identically in both flavor files, into common-rbac.yaml alongside the scheduler and result-read roles. The kubernetes flavor's info Role/RoleBinding drop the fullname prefix to use the literal tekton-operator-info name, the same as the ConfigMap they grant access to and the same as the openshift flavor and upstream. Upgrades rename the objects accordingly. Also align the pac binding name with the other bindings (*-rolebinding instead of *-role-binding) and restructure the controllers comment in values.yaml as common + per-flavor additions instead of transcribing both full lists. Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Aug 17, 2026

tekton-robot requested a review from infernus01 August 17, 2026 21:07

tekton-robot requested a review from khrm August 17, 2026 21:07

tekton-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Aug 17, 2026

tekton-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 18, 2026

aqeelat changed the title ~~fix(chart): template openshift operator SA name~~ fix(chart): make the openshift flavor functional Aug 18, 2026

waveywaves suggested changes Aug 18, 2026

View reviewed changes

aqeelat added 4 commits August 19, 2026 14:41

aqeelat changed the title ~~fix(chart): make the openshift flavor functional~~ fix(chart): make the openshift flavor functional and align with kustomize Aug 19, 2026

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 19, 2026

aqeelat added 3 commits August 19, 2026 16:49

chore(chart): add trailing newline to openshift-rbac template

b7d7c43

Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)

tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 19, 2026

Navigation Menu

Uh oh!

fix(chart): make the openshift flavor functional and align with kustomize - #3945

fix(chart): make the openshift flavor functional and align with kustomize#3945
aqeelat wants to merge 9 commits into
tektoncd:mainfrom
aqeelat:fix/chart-openshift-sa-name

aqeelat commented Aug 17, 2026 •

edited

Loading

Uh oh!

tekton-robot commented Aug 17, 2026

Uh oh!

codecov Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

waveywaves Aug 18, 2026

Uh oh!

aqeelat Aug 19, 2026

Uh oh!

waveywaves Aug 18, 2026

Uh oh!

aqeelat Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

aqeelat commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

tekton-robot commented Aug 17, 2026

Uh oh!

codecov Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

waveywaves Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

aqeelat Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

waveywaves Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

aqeelat Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aqeelat commented Aug 17, 2026 •

edited

Loading

codecov Bot commented Aug 17, 2026 •

edited

Loading