fix(chart): make the openshift flavor functional and align with kustomize

charts/tekton-operator/templates/_helpers.tpl

@@ -96,16 +96,54 @@ tekton-operator
 {{- end -}}
 {{- end -}}
 
+{{- define "tekton-operator.controllers" -}}
+{{- if .Values.openshift.enabled -}}
+tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonaddon,tektonresult,openshiftpipelinesascode,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,syncerservice
+{{- else -}}
+tektonconfig,tektonpipeline,tektontrigger,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,openshiftpipelinesascode
+{{- end -}}
+{{- end -}}
+
+{{- define "tekton-operator.validateTargetNamespace" -}}
+{{- if and .Values.openshift.enabled .Values.operator.defaultTargetNamespace (ne .Values.operator.defaultTargetNamespace "openshift-pipelines") -}}
+{{- fail (printf "operator.defaultTargetNamespace must be \"openshift-pipelines\" when openshift.enabled=true (got %q). The openshift addon sample pipelines hardcode that namespace, so a custom value breaks them; this is also first-install-only - once the TektonConfig CR exists the operator never re-reads it. To change the target namespace, set spec.targetNamespace on the TektonConfig CR (requires deleting and recreating the CR)." .Values.operator.defaultTargetNamespace) -}}
+{{- end -}}
+{{- end -}}
+
+{{/* validateControllers fails the render when the controllers value contains a
+     name the selected operator binary does not register — each binary exits
+     fatally at startup on unknown names (openshift has no tektondashboard,
+     kubernetes has no tektonaddon/syncerservice). Catches the v0.81.1
+     --reuse-values upgrade path, where the old chart's hardcoded kubernetes
+     list crash-loops the openshift operator. */}}
+{{- define "tekton-operator.validateControllers" -}}
+{{- $root := . -}}
+{{- $list := .Values.controllers | default (include "tekton-operator.controllers" .) -}}
+{{- $invalid := list "tektonaddon" "syncerservice" -}}
+{{- if .Values.openshift.enabled -}}
+{{- $invalid = list "tektondashboard" -}}
+{{- end -}}
+{{- range $raw := splitList "," $list -}}
+{{- $c := trim $raw -}}
+{{- if and $c (has $c $invalid) -}}
+{{- fail (printf "controllers must not contain %q: the %s operator binary does not register it and exits fatally at startup. This usually happens when upgrading with --reuse-values from a chart that hardcoded the kubernetes list; set controllers to \"\" to use the flavor default." $c (ternary "openshift" "kubernetes" $root.Values.openshift.enabled)) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Image repositories are the ko-published binary slugs from the v0.81.0
+     release assets; the tag follows Chart.AppVersion. If a release renames
+     the slugs, update all three (operator/webhook/proxy-webhook). */}}
 {{- define "tekton-operator.operator-image" -}}
 {{- $tag := default .Chart.AppVersion .Values.operator.image.tag -}}
 {{- $image := "" -}}
 {{- if .Values.operator.image.repository -}}
   {{- $image = .Values.operator.image.repository }}
 {{- else -}}
 {{- if .Values.openshift.enabled -}}
-  {{- $image = "ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77" -}}
+{{- $image = "ghcr.io/tektoncd/operator/operator-1d69a75f22dd094880847eac907fb2c1" -}}
 {{- else -}}
-  {{- $image = "ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77" -}}
+{{- $image = "ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77" -}}
 {{- end -}}
 {{- end -}}
 {{- printf "%s:%s" $image $tag -}}
@@ -126,9 +164,9 @@ tekton-operator
   {{- $image = .Values.webhook.image.repository }}
 {{- else -}}
 {{- if .Values.openshift.enabled -}}
-  {{- $image = "ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8" -}}
+{{- $image = "ghcr.io/tektoncd/operator/webhook-340ad78e88ca5477447aa144fedfe1a1" -}}
 {{- else -}}
-  {{- $image = "ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8" -}}
+{{- $image = "ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8" -}}
 {{- end -}}
 {{- end -}}
 {{- printf "%s:%s" $image $tag -}}
@@ -149,9 +187,9 @@ tekton-operator
   {{- $image = .Values.webhookProxy.image.repository }}
 {{- else -}}
 {{- if .Values.openshift.enabled -}}
-  {{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1" -}}
+{{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f8f95c9cea9508fe8915ae3d012d15fb" -}}
 {{- else -}}
-  {{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1" -}}
+{{- $image = "ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1" -}}
 {{- end -}}
 {{- end -}}
 {{- printf "%s:%s" $image $tag -}}

charts/tekton-operator/templates/common-rbac.yaml

@@ -0,0 +1,156 @@
+{{- if .Values.rbac.create -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-info
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resourceNames:
+      - tekton-operator-info
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - describe
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: default
+  name: {{ include "tekton-operator.fullname" . }}-info
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "tekton-operator.fullname" . }}-info
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-config-read-role
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - operator.tekton.dev
+    resources:
+      - tektonconfigs
+    verbs:
+      - get
+      - watch
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-config-read-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "tekton-operator.fullname" . }}-config-read-role
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-scheduler-role
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - kueue.x-k8s.io
+    resources:
+      - resourceflavors
+      - workloads
+      - workloads/finalizers
+      - workloads/status
+      - workloadpriorityclasses
+      - multikueueclusters
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+      - patch
+      - watch
+  - apiGroups:
+      - scheduling.k8s.io
+    resources:
+      - priorityclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cert-manager.io
+    resources:
+      - certificates
+      - issuers
+    verbs:
+      - get
+      - create
+      - update
+      - list
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-scheduler-rolebinding
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "tekton-operator.fullname" . }}-scheduler-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "tekton-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-result-read-role
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - operator.tekton.dev
+    resources:
+      - tektonresults
+    verbs:
+      - get
+      - watch
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-result-read-rolebinding
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "tekton-operator.fullname" . }}-result-read-role
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+{{- end -}}

charts/tekton-operator/templates/config.yaml

@@ -75,6 +75,85 @@ data:
 ---
 apiVersion: v1
 kind: ConfigMap
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-controller-config-leader-election
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # lease-duration is how long non-leaders will wait to try to acquire the
+    # lock; 15 seconds is the value used by core kubernetes controllers.
+    lease-duration: "60s"
+    # renew-deadline is how long a leader will try to renew the lease before
+    # giving up; 10 seconds is the value used by core kubernetes controllers.
+    renew-deadline: "40s"
+    # retry-period is how long the leader election client waits between tries of
+    # actions; 2 seconds is the value used by core kubernetes controllers.
+    retry-period: "10s"
+    # buckets is the number of buckets used to partition key space of each
+    # Reconciler. If this number is M and the replica number of the controller
+    # is N, the N replicas will compete for the M buckets. The owner of a
+    # bucket will take care of the reconciling for the keys partitioned into
+    # that bucket.
+    buckets: "1"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "tekton-operator.fullname" . }}-webhook-config-leader-election
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+data:
+  _example: |
+    ################################
+    #                              #
+    #    EXAMPLE CONFIGURATION     #
+    #                              #
+    ################################
+    # This block is not actually functional configuration,
+    # but serves to illustrate the available configuration
+    # options and document them in a way that is accessible
+    # to users that `kubectl edit` this config map.
+    #
+    # lease-duration is how long non-leaders will wait to try to acquire the
+    # lock; 15 seconds is the value used by core kubernetes controllers.
+    lease-duration: "60s"
+    # renew-deadline is how long a leader will try to renew the lease before
+    # giving up; 10 seconds is the value used by core kubernetes controllers.
+    renew-deadline: "40s"
+    # retry-period is how long the leader election client waits between tries of
+    # actions; 2 seconds is the value used by core kubernetes controllers.
+    retry-period: "10s"
+    # buckets is the number of buckets used to partition key space of each
+    # Reconciler. If this number is M and the replica number of the controller
+    # is N, the N replicas will compete for the M buckets. The owner of a
+    # bucket will take care of the reconciling for the keys partitioned into
+    # that bucket.
+    buckets: "1"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tekton-operator-info
+  labels:
+    {{- include "tekton-operator.labels" . | nindent 4 }}
+data:
+  # Contains operator version which can be queried by external
+  # tools such as CLI.
+  version: {{ .Chart.AppVersion | quote }}
+---
+apiVersion: v1
+kind: ConfigMap
 metadata:
   name: {{ include "tekton-operator.fullname" . }}-observability
   labels: