feat: Conditional installation and migration of openshift builds by avinal · Pull Request #4378 · tektoncd/operator

avinal · 2026-11-03T09:50:05Z

Changes

feat(shipwright): add Shipwright Build and Shared Resource CSI driver component
fix(releases): make custom fetches atomic
fix(shipwright): adapt OpenShift payloads
fix(installerset): handle oversized CRDs
feat(openshift): migrate standalone Builds
fix(crds): sync generated component manifests

Depends on #4130
Assisted-by: GPT Sol, GPT Luna, Claude Opus

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

Adds operator-managed Shipwright Build and Shared Resource CSI components. OpenShift upgrades automatically detect and migrate standalone OpenShift Builds installations while preserving existing Builds, BuildRuns, and shared data.

tekton-robot · 2026-11-03T09:50:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign anithapriyanatarajan after the PR has been reviewed.
You can assign the PR to them by writing /assign @anithapriyanatarajan in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot · 2026-11-03T09:50:15Z

@avinal: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copilot

🟡 Changes recommended

Missing CRDs block informer synchronization on fresh Kubernetes Helm installations, while webhook TLS and reconciliation defects prevent reliable component operation.

10 open issues

What changed in this PR

Adds conditional, operator-managed Shipwright Build installation on Kubernetes and OpenShift, OpenShift Shared Resource CSI support, and migration of standalone OpenShift Builds installations.

Changes:

Adds component APIs, generated clients, controllers, and TektonConfig enablement handling.
Introduces migration coordination, webhook certificates, network policies, and OpenShift security adaptations.
Updates release tooling, oversized-CRD handling, deployment schemas, and unit/E2E coverage.

This pull request requires changes.

Unresolved findings affect Helm CRD/controller availability, namespace validation, Kubernetes webhook TLS and conversion trust, profile handling, repeatable transformations, platform-setting propagation, CSI readiness reporting, and component test assertions.

File	Description
`test/utils/names.go`	Adds component resource names.
`test/utils/e2e_flags.go`	Adds component deployment selectors.
`test/utils/clients.go`	Adds typed component client accessors.
`test/utils/cleanup.go`	Adds component teardown helpers.
`test/resources/sharedresources.go`	Adds SharedResource creation, readiness, and deletion helpers.
`test/e2e/openshift/shipwrightbuild_test.go`	Tests OpenShift Shipwright installation and deletion.
`test/e2e/openshift/sharedresource_test.go`	Tests SharedResource lifecycle and recovery.
`test/e2e/kubernetes/shipwrightbuild_test.go`	Tests Kubernetes Shipwright lifecycle and recovery.
`pkg/webhook/webhook.go`	Registers component admission types.
`pkg/reconciler/shared/tektonconfig/upgrade/upgrade.go`	Registers legacy Builds adoption during upgrades.
`pkg/reconciler/shared/tektonconfig/upgrade/upgrade_test.go`	Restores modified upgrade hooks after tests.
`pkg/reconciler/shared/tektonconfig/upgrade/legacy_builds.go`	Adopts legacy component enablement into TektonConfig.
`pkg/reconciler/shared/tektonconfig/shipwrightbuild/shipwrightbuild_test.go`	Tests Shipwright configuration reconciliation.
`pkg/reconciler/shared/tektonconfig/sharedresource/sharedresource_test.go`	Tests SharedResource configuration reconciliation.
`pkg/reconciler/shared/tektonconfig/controller.go`	Watches component CRs managed by TektonConfig.
`pkg/reconciler/platform/const.go`	Defines component controller names.
`pkg/reconciler/openshift/tektonconfig/testdata/tekton-pipeline/00-prereconcile/openshift-pipelines-scc.yaml`	Updates permitted seccomp profiles in the SCC fixture.
`pkg/reconciler/openshift/tektonconfig/rbac_test.go`	Verifies installed SCC settings.
`pkg/reconciler/openshift/tektonconfig/extension.go`	Adds conditional component installation and cleanup.
`pkg/reconciler/openshift/shipwrightbuild/transformer.go`	Adapts Buildah strategy seccomp settings.
`pkg/reconciler/openshift/shipwrightbuild/transformer_test.go`	Tests scoped strategy transformations.
`pkg/reconciler/openshift/shipwrightbuild/networkpolicies.go`	Defines Shipwright controller and webhook network policies.
`pkg/reconciler/openshift/shipwrightbuild/networkpolicies_test.go`	Tests network-policy names and selectors.
`pkg/reconciler/openshift/shipwrightbuild/controller.go`	Registers the controller and legacy deployment watches.
`pkg/reconciler/openshift/shipwrightbuild/controller_test.go`	Tests legacy deployment event filtering.
`pkg/reconciler/openshift/shipwrightbuild/common.go`	Defines webhook TLS flags.
`pkg/reconciler/openshift/sharedresource/transformer.go`	Transforms SharedResource payload images and options.
`pkg/reconciler/openshift/sharedresource/transformer_test.go`	Tests image overrides and namespace adaptation.
`pkg/reconciler/openshift/sharedresource/reconciler.go`	Implements SharedResource installation and finalization.
`pkg/reconciler/openshift/sharedresource/networkpolicies.go`	Defines CSI node and webhook network policies.
`pkg/reconciler/openshift/sharedresource/networkpolicies_test.go`	Tests network-policy names and selectors.
`pkg/reconciler/openshift/sharedresource/migration.go`	Coordinates legacy CSI retirement and replacement readiness.
`pkg/reconciler/openshift/sharedresource/extension_test.go`	Tests extension hooks and transformations.
`pkg/reconciler/openshift/sharedresource/controller_test.go`	Tests legacy workload event filtering.
`pkg/reconciler/openshift/sharedresource/common.go`	Defines workload names, labels, and TLS flags.
`pkg/reconciler/openshift/openshiftplatform/config.go`	Registers both OpenShift component controllers.
`pkg/reconciler/openshift/common/serviceca.go`	Adds service-CA annotation transformers.
`pkg/reconciler/openshift/common/serviceca_test.go`	Tests certificate and CA-injection annotations.
`pkg/reconciler/openshift/common/legacybuilds/webhook.go`	Adds webhook readiness and conversion-routing checks.
`pkg/reconciler/openshift/common/legacybuilds/webhook_test.go`	Tests webhook handoff prerequisites.
`pkg/reconciler/kubernetes/tektoninstallerset/install.go`	Selects the CRD-specific update client.
`pkg/reconciler/kubernetes/tektoninstallerset/crd_client.go`	Removes oversized last-applied CRD annotations during updates.
`pkg/reconciler/kubernetes/tektoninstallerset/crd_client_test.go`	Tests large-schema adoption and metadata preservation.
`pkg/reconciler/kubernetes/tektonconfig/extension.go`	Adds Kubernetes Shipwright enablement and cleanup.
`pkg/reconciler/kubernetes/shipwrightbuild/transformer.go`	Transforms core and build-strategy payloads.
`pkg/reconciler/kubernetes/shipwrightbuild/extension.go`	Provisions the Kubernetes webhook certificate Secret.
`pkg/reconciler/kubernetes/shipwrightbuild/controller.go`	Initializes Shipwright payloads and controller watches.
`pkg/reconciler/kubernetes/shipwrightbuild/common.go`	Defines workload names and certificate provisioning.
`pkg/reconciler/kubernetes/shipwrightbuild/common_test.go`	Tests certificate Secret creation and reuse.
`pkg/reconciler/kubernetes/kubernetesplatform/config.go`	Registers the Kubernetes Shipwright controller.
`pkg/reconciler/common/transformers.go`	Adds DaemonSet image and container-argument transformers.
`pkg/reconciler/common/transformers_test.go`	Tests DaemonSet transformer filtering and decode errors.
`pkg/reconciler/common/testdata/kodata/shipwright-build/0.21.0/release.yaml`	Adds a Shipwright release-discovery fixture.
`pkg/reconciler/common/testdata/kodata/shipwright-build/0.20.0/release.yaml`	Adds an older Shipwright release fixture.
`pkg/reconciler/common/testdata/kodata/shared-resource/0.2.0/release.yaml`	Adds a SharedResource release-discovery fixture.
`pkg/reconciler/common/testdata/kodata/shared-resource/0.1.0/release.yaml`	Adds an older SharedResource release fixture.
`pkg/reconciler/common/releases.go`	Maps component types to payload directories.
`pkg/reconciler/common/releases_test.go`	Tests release discovery for both components.
`pkg/reconciler/common/initcontroller.go`	Registers component payload loading.
`pkg/reconciler/common/common.go`	Adds shared Service and CRD kind constants.
`pkg/reconciler/common/certificates.go`	Adds configurable-duration certificate Secret generation.
`pkg/reconciler/common/certificates_test.go`	Tests generated certificate Secret contents.
`pkg/common/scc.go`	Uses injected configuration for the security client.
`pkg/client/listers/operator/v1alpha1/shipwrightbuild.go`	Adds the generated Shipwright lister.
`pkg/client/listers/operator/v1alpha1/sharedresource.go`	Adds the generated SharedResource lister.
`pkg/client/listers/operator/v1alpha1/expansion_generated.go`	Adds component lister extension interfaces.
`pkg/client/injection/reconciler/operator/v1alpha1/shipwrightbuild/state.go`	Adds generated Shipwright reconciliation state handling.
`pkg/client/injection/reconciler/operator/v1alpha1/sharedresource/state.go`	Adds generated SharedResource reconciliation state handling.
`pkg/client/injection/informers/operator/v1alpha1/shipwrightbuild/shipwrightbuild.go`	Adds Shipwright informer injection.
`pkg/client/injection/informers/operator/v1alpha1/shipwrightbuild/filtered/shipwrightbuild.go`	Adds filtered Shipwright informer injection.
`pkg/client/injection/informers/operator/v1alpha1/shipwrightbuild/filtered/fake/fake.go`	Adds fake filtered Shipwright informer injection.
`pkg/client/injection/informers/operator/v1alpha1/shipwrightbuild/fake/fake.go`	Adds fake Shipwright informer injection.
`pkg/client/injection/informers/operator/v1alpha1/sharedresource/sharedresource.go`	Adds SharedResource informer injection.
`pkg/client/injection/informers/operator/v1alpha1/sharedresource/filtered/sharedresource.go`	Adds filtered SharedResource informer injection.
`pkg/client/injection/informers/operator/v1alpha1/sharedresource/filtered/fake/fake.go`	Adds fake filtered SharedResource informer injection.
`pkg/client/injection/informers/operator/v1alpha1/sharedresource/fake/fake.go`	Adds fake SharedResource informer injection.
`pkg/client/informers/externalversions/operator/v1alpha1/interface.go`	Exposes both component informers.
`pkg/client/informers/externalversions/generic.go`	Registers generic component informer lookup.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/shipwrightbuild.go`	Adds the generated Shipwright API client.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/sharedresource.go`	Adds the generated SharedResource API client.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/operator_client.go`	Exposes component clients from the operator client.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/generated_expansion.go`	Adds component client extension interfaces.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/fake/fake_shipwrightbuild.go`	Adds the generated fake Shipwright client.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/fake/fake_sharedresource.go`	Adds the generated fake SharedResource client.
`pkg/client/clientset/versioned/typed/operator/v1alpha1/fake/fake_operator_client.go`	Exposes both fake component clients.
`pkg/apis/operator/v1alpha1/shipwrightbuild_validation.go`	Enforces the Shipwright singleton name.
`pkg/apis/operator/v1alpha1/shipwrightbuild_validation_test.go`	Tests Shipwright name and deletion validation.
`pkg/apis/operator/v1alpha1/shipwrightbuild_types.go`	Defines Shipwright component API types.
`pkg/apis/operator/v1alpha1/shipwrightbuild_lifecycle.go`	Defines Shipwright status conditions and accessors.
`pkg/apis/operator/v1alpha1/shipwrightbuild_defaults.go`	Adds the Shipwright admission-defaulting hook.
`pkg/apis/operator/v1alpha1/sharedresource_validation.go`	Enforces the SharedResource singleton name.
`pkg/apis/operator/v1alpha1/sharedresource_validation_test.go`	Tests SharedResource name and deletion validation.
`pkg/apis/operator/v1alpha1/sharedresource_types.go`	Defines SharedResource component API types.
`pkg/apis/operator/v1alpha1/sharedresource_lifecycle.go`	Defines SharedResource status conditions and accessors.
`pkg/apis/operator/v1alpha1/sharedresource_lifecycle_test.go`	Tests SharedResource status transitions.
`pkg/apis/operator/v1alpha1/sharedresource_defaults.go`	Adds the SharedResource admission-defaulting hook.
`pkg/apis/operator/v1alpha1/register.go`	Registers component kinds and lists in the scheme.
`pkg/apis/operator/v1alpha1/openshift_platform.go`	Adds OpenShift component enablement configuration.
`pkg/apis/operator/v1alpha1/kubernetes_platform.go`	Adds Kubernetes Shipwright enablement configuration.
`pkg/apis/operator/v1alpha1/const.go`	Defines singleton component resource names.
`Makefile`	Adjusts cleanup and CRD-generation status messages.
`hack/sync-helm-crds.sh`	Adds component CRDs to the OpenShift Helm assembly.
`hack/README.md`	Documents payload-fetch regression-test requirements.
`hack/openshift/fetch-build-strategies.sh`	Adds semantic-version tag selection support.
`config/openshift/base/role.yaml`	Adds legacy detection and component-management permissions.
`config/openshift/base/operator.yaml`	Enables both OpenShift component controllers.
`config/kubernetes/base/operator.yaml`	Enables the Kubernetes Shipwright controller.
`config/base/role.yaml`	Adds Shipwright strategy-management permissions.
`config/base/kustomization.yaml`	Includes generated component CRDs.
`config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml`	Adds component enablement fields to the TektonConfig schema.
`components.yaml`	Configures component releases and OpenShift strategy assets.
`cmd/openshift/operator/kodata/openshift/00-prereconcile/openshift-pipelines-scc.yaml`	Permits runtime/default and unconfined seccomp profiles.
`charts/tekton-operator/templates/kubernetes-crds.yaml`	Adds component enablement fields to Helm’s TektonConfig schema.

_{Review effort: Balanced}

sayan-biswas · 2026-11-04T00:39:55Z

@avinal Most of these issues are addressed in my latest commit. Please rebase your PR.

… component Changes: Adds two new operator-managed components: ShipwrightBuild and SharedResource. New CRDs & API types — ShipwrightBuild and SharedResource added to pkg/apis/operator/v1alpha1/ (types, defaults, lifecycle, validation), registered in the scheme (register.go) with resource-name constants and the one-CR-per-type Validate() check. ShipwrightBuild component — Kubernetes reconciler + transformer and an OpenShift extension/controller, wired through TektonConfig on both platforms. Installs the Shipwright Build controller. SharedResource component — OpenShift-only reconciler, extension, controller, and transformer, plus NetworkPolicies and service-CA handling. OpenShift service-CA helper — new pkg/reconciler/openshift/common/serviceca.go for injecting the service CA bundle. Platform wiring — registered both components in TektonConfig extensions (Kubernetes & OpenShift), platform constants, the webhook, and the shared/init controllers. TektonInstallerSet DaemonSet support — adds a DaemonSet installer to the InstallerSet reconcile flow and client (new DaemonSetReady condition), mirroring the StatefulSet handling for apply, readiness wait, and cleanup, so components can ship DaemonSet workloads. RBAC / config — updates to config/base/role.yaml, kustomization, and operator manifests. Tests — unit tests for reconcilers, transformers, validation, lifecycle, NetworkPolicies, service-CA, and the DaemonSet installer; e2e tests and test/resources / test/utils helpers for both new components. Installs cert-manager on Kubernetes (skipped on OpenShift) on E2E workflow, so the ShipwrightBuild webhook certificate can be provisioned. Signed-off-by: Sayan Biswas <sabiswas@redhat.com>

Add operator-managed Shipwright Build and Shared Resource CSI components. Detect standalone OpenShift Builds installations during upgrade and enable the matching components automatically. Quiesce legacy workloads before handoff, then wait for replacement webhooks, conversion routing, and CSI readiness. Preserve existing Builds, BuildRuns, parent resources, finalizers, and shared data. Keep fresh installs unchanged. Fetch custom payloads atomically, adapt bundled workloads for OpenShift security and registry overrides, and avoid oversized last-applied annotations when adopting CRDs. Signed-off-by: Avinal Kumar <avinal@redhat.com>

tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Nov 3, 2026

tekton-robot requested review from anithapriyanatarajan and jkhelil November 3, 2026 09:50

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 3, 2026

tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Nov 3, 2026

avinal changed the title ~~Conditional installation and migration of openshift builds installation~~ feat: Conditional installation and migration of openshift builds installation Nov 3, 2026

avinal changed the title ~~feat: Conditional installation and migration of openshift builds installation~~ feat: Conditional installation and migration of openshift builds Nov 3, 2026

jkhelil requested a balanced review from Copilot November 3, 2026 15:39

Copilot started reviewing on behalf of jkhelil November 3, 2026 15:40

View session

Copilot AI reviewed Nov 3, 2026

View reviewed changes

sayan-biswas and others added 2 commits November 5, 2026 07:51

avinal force-pushed the openshift-builds-detection branch from 10a3eac to ccbdd5f Compare November 5, 2026 10:44

Navigation Menu

Repository navigation

feat: Conditional installation and migration of openshift builds - #4378

feat: Conditional installation and migration of openshift builds #4378
avinal wants to merge 2 commits into
tektoncd:mainfrom
avinal:openshift-builds-detection

avinal commented Nov 3, 2026 •

edited

Loading

Uh oh!

tekton-robot commented Nov 3, 2026

Uh oh!

tekton-robot commented Nov 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sayan-biswas commented Nov 4, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

avinal commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

tekton-robot commented Nov 3, 2026

Uh oh!

tekton-robot commented Nov 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sayan-biswas commented Nov 4, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

avinal commented Nov 3, 2026 •

edited

Loading