diff --git a/charts/tekton-operator/templates/_helpers.tpl b/charts/tekton-operator/templates/_helpers.tpl index 76a01005fc..f3a8344057 100644 --- a/charts/tekton-operator/templates/_helpers.tpl +++ b/charts/tekton-operator/templates/_helpers.tpl @@ -96,6 +96,20 @@ tekton-operator {{- end -}} {{- end -}} +{{- define "tekton-operator.controllers" -}} +{{- if .Values.openshift.enabled -}} +tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonaddon,tektonresult,openshiftpipelinesascode,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,syncerservice +{{- else -}} +tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,openshiftpipelinesascode +{{- end -}} +{{- end -}} + +{{- define "tekton-operator.validateTargetNamespace" -}} +{{- if and .Values.openshift.enabled .Values.operator.defaultTargetNamespace (ne .Values.operator.defaultTargetNamespace "openshift-pipelines") -}} +{{- fail (printf "operator.defaultTargetNamespace must be \"openshift-pipelines\" when openshift.enabled=true (got %q). The openshift addon sample pipelines hardcode that namespace, so a custom value breaks them; this is also first-install-only - once the TektonConfig CR exists the operator never re-reads it. To change the target namespace, set spec.targetNamespace on the TektonConfig CR (requires deleting and recreating the CR)." .Values.operator.defaultTargetNamespace) -}} +{{- end -}} +{{- end -}} + {{- define "tekton-operator.operator-image" -}} {{- $tag := default .Chart.AppVersion .Values.operator.image.tag -}} {{- $image := "" -}} @@ -103,10 +117,10 @@ tekton-operator {{- $image = .Values.operator.image.repository }} {{- else -}} {{- if .Values.openshift.enabled -}} + {{- $image = "ghcr.io/tektoncd/operator/operator-1d69a75f22dd094880847eac907fb2c1" -}} + {{- else -}} {{- $image = "ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77" -}} -{{- else -}} - {{- $image = "ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77" -}} -{{- end -}} + {{- end -}} {{- end -}} {{- printf "%s:%s" $image $tag -}} {{- end -}} @@ -126,10 +140,10 @@ tekton-operator {{- $image = .Values.webhook.image.repository }} {{- else -}} {{- if .Values.openshift.enabled -}} + {{- $image = "ghcr.io/tektoncd/operator/webhook-340ad78e88ca5477447aa144fedfe1a1" -}} + {{- else -}} {{- $image = "ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8" -}} -{{- else -}} - {{- $image = "ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8" -}} -{{- end -}} + {{- end -}} {{- end -}} {{- printf "%s:%s" $image $tag -}} {{- end -}} @@ -149,10 +163,10 @@ tekton-operator {{- $image = .Values.webhookProxy.image.repository }} {{- else -}} {{- if .Values.openshift.enabled -}} + {{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f8f95c9cea9508fe8915ae3d012d15fb" -}} + {{- else -}} {{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1" -}} -{{- else -}} - {{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1" -}} -{{- end -}} + {{- end -}} {{- end -}} {{- printf "%s:%s" $image $tag -}} {{- end -}} diff --git a/charts/tekton-operator/templates/common-rbac.yaml b/charts/tekton-operator/templates/common-rbac.yaml new file mode 100644 index 0000000000..535126db15 --- /dev/null +++ b/charts/tekton-operator/templates/common-rbac.yaml @@ -0,0 +1,156 @@ +{{- if .Values.rbac.create -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tekton-operator-info + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resourceNames: + - tekton-operator-info + resources: + - configmaps + verbs: + - get + - describe +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-operator-info +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-config-read-role + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonconfigs + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-config-read-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-config-read-role +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "tekton-operator.fullname" . }}-scheduler-role + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - kueue.x-k8s.io + resources: + - resourceflavors + - workloads + - workloads/finalizers + - workloads/status + - workloadpriorityclasses + - multikueueclusters + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - cert-manager.io + resources: + - certificates + - issuers + verbs: + - get + - create + - update + - list + - nonResourceURLs: + - /metrics + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "tekton-operator.fullname" . }}-scheduler-rolebinding + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "tekton-operator.fullname" . }}-scheduler-role +subjects: + - kind: ServiceAccount + name: {{ include "tekton-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "tekton-operator.fullname" . }}-result-read-role + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonresults + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "tekton-operator.fullname" . }}-result-read-rolebinding + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "tekton-operator.fullname" . }}-result-read-role +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +{{- end -}} diff --git a/charts/tekton-operator/templates/config.yaml b/charts/tekton-operator/templates/config.yaml index d3aef19a89..94e527d317 100644 --- a/charts/tekton-operator/templates/config.yaml +++ b/charts/tekton-operator/templates/config.yaml @@ -75,6 +75,85 @@ data: --- apiVersion: v1 kind: ConfigMap +metadata: + name: {{ include "tekton-operator.fullname" . }}-controller-config-leader-election + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "tekton-operator.fullname" . }}-webhook-config-leader-election + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: tekton-operator-info + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +data: + # Contains operator version which can be queried by external + # tools such as CLI. + version: {{ .Chart.AppVersion | quote }} +--- +apiVersion: v1 +kind: ConfigMap metadata: name: {{ include "tekton-operator.fullname" . }}-observability labels: diff --git a/charts/tekton-operator/templates/deployment.yaml b/charts/tekton-operator/templates/deployment.yaml index 5045360cd5..98847fa75e 100644 --- a/charts/tekton-operator/templates/deployment.yaml +++ b/charts/tekton-operator/templates/deployment.yaml @@ -1,3 +1,4 @@ +{{- include "tekton-operator.validateTargetNamespace" . -}} --- apiVersion: apps/v1 kind: Deployment @@ -48,6 +49,10 @@ spec: value: tekton-operator {{- end }} {{- end }} + {{- if .Values.openshift.enabled }} + - name: PLATFORM + value: openshift + {{- end }} - name: IMAGE_PIPELINES_PROXY value: {{ include "tekton-operator.webhook-proxy-image" . }} - name: IMAGE_JOB_PRUNER_TKN @@ -72,6 +77,8 @@ spec: value: {{ include "tekton-operator.fullname" . }}-config-logging - name: CONFIG_OBSERVABILITY_NAME value: {{ include "tekton-operator.fullname" . }}-observability + - name: CONFIG_LEADERELECTION_NAME + value: {{ include "tekton-operator.fullname" . }}-controller-config-leader-election {{- include "tekton-operator.kubernetesMinVersionEnv" . | nindent 12 }} {{- range .Values.operator.additionalEnvs }} - name: {{ .name }} @@ -79,7 +86,7 @@ spec: {{- end }} args: - "-controllers" - - {{ .Values.controllers | default "tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,openshiftpipelinesascode" | quote }} + - {{ .Values.controllers | default (include "tekton-operator.controllers" .) | quote }} - "-unique-process-name" - "tekton-operator-lifecycle" image: {{ include "tekton-operator.operator-image" . }} @@ -110,28 +117,18 @@ spec: value: tekton-operator {{- end }} {{- end }} - - name: IMAGE_PIPELINES_PROXY - value: {{ include "tekton-operator.webhook-proxy-image" . }} + - name: PROFILING_PORT + value: "9009" - name: METRICS_DOMAIN value: {{ .Values.service.metricsDomain }} - name: VERSION value: {{ .Values.webhook.image.tag | default .Chart.AppVersion | quote }} - - name: AUTOINSTALL_COMPONENTS - value: {{ .Values.operator.autoInstallComponents | quote }} - - name: DEFAULT_TARGET_NAMESPACE - {{- if .Values.operator.defaultTargetNamespace }} - value: {{ .Values.operator.defaultTargetNamespace | quote }} - {{- else }} - {{- if .Values.openshift.enabled }} - value: openshift-pipelines - {{- else }} - value: tekton-pipelines - {{- end }} - {{- end }} - name: CONFIG_LOGGING_NAME value: {{ include "tekton-operator.fullname" . }}-config-logging - name: CONFIG_OBSERVABILITY_NAME value: {{ include "tekton-operator.fullname" . }}-observability + - name: CONFIG_LEADERELECTION_NAME + value: {{ include "tekton-operator.fullname" . }}-controller-config-leader-election {{- include "tekton-operator.kubernetesMinVersionEnv" . | nindent 12 }} {{- range .Values.operator.additionalEnvs }} - name: {{ .name }} @@ -209,6 +206,10 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace + {{- if .Values.openshift.enabled }} + - name: PLATFORM + value: openshift + {{- end }} - name: CONFIG_LOGGING_NAME value: {{ include "tekton-operator.fullname" . }}-config-logging - name: WEBHOOK_POD_NAME @@ -219,6 +220,8 @@ spec: value: {{ include "tekton-operator.fullname" . }}-webhook - name: WEBHOOK_SECRET_NAME value: {{ .Values.webhook.certSecret.name | default (include "tekton-operator.fullname" .) }}-webhook-certs + - name: CONFIG_LEADERELECTION_NAME + value: {{ include "tekton-operator.fullname" . }}-webhook-config-leader-election - name: WEBHOOK_PORT value: {{ .Values.webhook.httpsWebhookPort | quote }} - name: METRICS_DOMAIN @@ -230,7 +233,7 @@ spec: {{- end }} image: {{ include "tekton-operator.webhook-image" . }} imagePullPolicy: {{ .Values.webhook.image.pullPolicy }} - name: {{ include "tekton-operator.operator-name" . -}}-webhook + name: {{ include "tekton-operator.fullname" . -}}-webhook resources: {{- toYaml .Values.webhook.resources | nindent 12 }} {{- with .Values.securityContext }} diff --git a/charts/tekton-operator/templates/kubernetes-rbac.yaml b/charts/tekton-operator/templates/kubernetes-rbac.yaml index 73a6ae7a49..1dee0b3c4a 100644 --- a/charts/tekton-operator/templates/kubernetes-rbac.yaml +++ b/charts/tekton-operator/templates/kubernetes-rbac.yaml @@ -6,39 +6,6 @@ metadata: name: {{ include "tekton-operator.fullname" . }} --- apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "tekton-operator.fullname" . }}-info - labels: - {{- include "tekton-operator.labels" . | nindent 4 }} -rules: - - apiGroups: - - "" - resourceNames: - - tekton-operator-info - resources: - - configmaps - verbs: - - get - - describe ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: tekton-config-read-role - labels: - {{- include "tekton-operator.labels" . | nindent 4 }} -rules: - - apiGroups: - - operator.tekton.dev - resources: - - tektonconfigs - verbs: - - get - - watch - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ include "tekton-operator.fullname" . }} @@ -467,43 +434,52 @@ rules: - watch --- apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding +kind: ClusterRoleBinding metadata: - labels: - app.kubernetes.io/instance: default - name: {{ include "tekton-operator.fullname" . }}-info + name: {{ include "tekton-operator.fullname" . }} roleRef: apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "tekton-operator.fullname" . }}-info + kind: ClusterRole + name: {{ include "tekton-operator.fullname" . }} subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated + - kind: ServiceAccount + name: {{ include "tekton-operator.fullname" . }} + namespace: {{ .Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding +kind: ClusterRole metadata: - name: tekton-config-read-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: tekton-config-read-role -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated + name: {{ include "tekton-operator.fullname" . }}-pac-controller-role + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - pipelinesascode.tekton.dev + resources: + - repositories + - webhooks + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "tekton-operator.fullname" . }} + name: {{ include "tekton-operator.fullname" . }}-pac-controller-rolebinding + labels: + {{- include "tekton-operator.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "tekton-operator.fullname" . }} + name: {{ include "tekton-operator.fullname" . }}-pac-controller-role subjects: - kind: ServiceAccount - name: {{ include "tekton-operator.fullname" . }} + name: {{ include "tekton-operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} {{- end -}} diff --git a/charts/tekton-operator/templates/openshift-rbac.yaml b/charts/tekton-operator/templates/openshift-rbac.yaml index 56dbeb2647..8adbce9ee3 100644 --- a/charts/tekton-operator/templates/openshift-rbac.yaml +++ b/charts/tekton-operator/templates/openshift-rbac.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: openshift-pipelines-operator + name: {{ include "tekton-operator.serviceAccountName" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -24,45 +24,18 @@ rules: - watch --- apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: tekton-operator-info - labels: - {{- include "tekton-operator.labels" . | nindent 4 }} -rules: - - apiGroups: - - "" - resourceNames: - - tekton-operator-info - resources: - - configmaps - verbs: - - get - - describe ---- -apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: tekton-config-read-role + name: tekton-operator labels: {{- include "tekton-operator.labels" . | nindent 4 }} rules: - apiGroups: - - operator.tekton.dev + - "" resources: - - tektonconfigs + - nodes verbs: - - get - - watch - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: tekton-operator - labels: - {{- include "tekton-operator.labels" . | nindent 4 }} -rules: - apiGroups: - "" resources: @@ -270,6 +243,7 @@ rules: - tekton.dev - triggers.tekton.dev - operator.tekton.dev + - pipelinesascode.tekton.dev resources: - '*' verbs: @@ -303,9 +277,19 @@ rules: verbs: - use - get + - list - create - update - delete + - apiGroups: + - config.openshift.io + resources: + - apiservers + - clusterversions + verbs: + - get + - list + - watch - apiGroups: - route.openshift.io resources: @@ -319,6 +303,31 @@ rules: - list - update - watch + - apiGroups: + - route.openshift.io + resources: + - routes/custom-host + verbs: + - create + - update + - apiGroups: + - events.k8s.io + resources: + - events + verbs: + - create + - apiGroups: + - console.openshift.io + resources: + - consoleplugins + verbs: + - delete + - create + - patch + - get + - list + - update + - watch - apiGroups: - coordination.k8s.io resources: @@ -409,12 +418,15 @@ rules: - resolution.tekton.dev resources: - resolutionrequests + - resolutionrequests/status verbs: - get - list - watch - create - delete + - update + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -430,34 +442,6 @@ subjects: namespace: openshift-monitoring --- apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/instance: default - name: tekton-operator-info -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: tekton-operator-info -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: tekton-config-read-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: tekton-config-read-role -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:authenticated ---- -apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: tekton-operator @@ -467,6 +451,6 @@ roleRef: name: tekton-operator subjects: - kind: ServiceAccount - name: openshift-pipelines-operator + name: {{ include "tekton-operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} -{{- end -}} \ No newline at end of file +{{- end -}} diff --git a/charts/tekton-operator/values.yaml b/charts/tekton-operator/values.yaml index 52b4d4bd2c..db07474a4a 100644 --- a/charts/tekton-operator/values.yaml +++ b/charts/tekton-operator/values.yaml @@ -12,6 +12,12 @@ kubernetesMinVersion: "v1.34.0" ## Choose between the vanilla Kubernetes flavor and the Openshift flavor of this Helm chart ## Container images, RBAC resources and operator settings will be adjusted automatically, ## unless explicitly overridden by a Helm value. +## +## Note for the Openshift flavor: the chart does not set the IMAGE_ADDONS_* env vars. +## TektonAddon image defaults come from the operator's built-in manifests; to use a +## custom registry (e.g. a mirror of registry.redhat.io), set TEKTON_REGISTRY_OVERRIDE +## or the per-image IMAGE_ADDONS_* env vars via operator.additionalEnvs — see +## https://github.com/tektoncd/operator/blob/main/docs/AirGapImageConfiguration.md openshift: enabled: false @@ -19,8 +25,14 @@ openshift: ## Setting this to true will cause a cascade deletion of all Tekton resources when you uninstall the chart - danger! installCRDs: false -## Controllers to install -controllers: "tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,openshiftpipelinesascode" +## Controllers to install (comma-separated list passed to the operator's +## -controllers flag). Leave empty for the flavor default: +## common: tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonresult, +## manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae, +## openshiftpipelinesascode +## kubernetes: common + tektondashboard +## openshift: common + tektonaddon,syncerservice +controllers: "" ## Control the creation of RBAC resources (Serviceaccount, Role, ClusterRole, ClusterRoleBinding) rbac: @@ -51,6 +63,11 @@ operator: autoInstallComponents: true # The namespace in which Tekton components should be deployed # Defaults to "tekton-pipelines" for Kubernetes and to "openshift-pipelines" for Openshift flavor. + # First-install-only: it seeds the auto-created TektonConfig CR; once the CR exists, + # the operator never re-reads this value. To change it later, set spec.targetNamespace + # on the TektonConfig CR (requires deleting and recreating the CR). + # On the Openshift flavor it must be "openshift-pipelines": the addon sample pipelines + # hardcode that namespace, so the chart fails to render with any other value. defaultTargetNamespace: "" # Log level of the operator logLevel: info