feat: Add NetworkPolicy support for chains by ngelman1 · Pull Request #3776 · tektoncd/operator

ngelman1 · 2026-07-20T17:55:34Z

Changes

Implements NetworkPolicy resources to restrict network access for the Tekton Chains controller.
Adds a spec.networkPolicy field to TektonChainSpec (propagated from TektonConfig) and a new pkg/reconciler/kubernetes/tektonchain/networkpolicies.go
that reconciles default-deny + allow policies in the operand namespace.
Default policies for the Chains controller pod:

Ingress: Prometheus metrics scraping on port 9090
Egress: DNS resolution via platform resolver + unrestricted egress (API server, OCI registries, Sigstore, KMS providers, storage backends)
Both platforms (Kubernetes and OpenShift) are supported via the existing networkpolicy.PlatformParams helper. Updates generated CRDs/Helm chart output and docs/NetworkPolicy.md.
Ref: SRVKP-12056

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

Add NetworkPolicy support for the Chains controller. Default policies allow Prometheus metrics ingress on port 9090 and unrestricted egress, to reach the API server, OCI registries, Sigstore services, KMS providers, and various storage backends depending on configuration.

tekton-robot · 2026-07-20T17:55:37Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign savitaashture after the PR has been reviewed.
You can assign the PR to them by writing /assign @savitaashture in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov-commenter · 2026-07-20T17:59:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.38%. Comparing base (89d6463) to head (967caab).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3776      +/-   ##
==========================================
- Coverage   25.40%   25.38%   -0.03%     
==========================================
  Files         449      450       +1     
  Lines       23477    23535      +58     
==========================================
+ Hits         5964     5974      +10     
- Misses      16822    16870      +48     
  Partials      691      691

Flag	Coverage Δ
unit-tests	`25.38% <ø> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jkhelil · 2026-07-21T06:46:09Z

@ngelman1 have you verified this once on openshift ?

jkhelil · 2026-07-21T07:12:18Z

+
+// chainsControllerPodSelector matches the tekton-chains-controller Deployment's
+// spec.selector.matchLabels shipped in the upstream release manifest.
+var chainsControllerPodSelector = metav1.LabelSelector{


Can you add e2e for chains network policies please (similar to triggers, etc)

I added test simialr to triggers with a small difference:

setup is using TektonConfig instead of chain + pipeline, because creating CRs dierclty caused pre-reconciliation failures.

update of the NP is done through config and not directly through chain cause when I tried the latter chain was immediatly reverted by the tektonConfig reconciler

Also- I named the file 03_tektonchain_networkpolicy_test.go cause I saw this is how the triggers test is named. let me know if I need to change the number

@jkhelil was triggers e2e test was tested on openshift? I tested on ROSA and kept getting tektonconfig.operator.tekton.dev "config" not found when I tried creating standalone CRs withou TektonConfig like in here https://github.com/tektoncd/operator/blob/main/test/e2e/common/03_tektontrigger_networkpolicy_test.go#L61

@ngelman1 e2e are running on kind, you need to add the test, and do manual testing on openshift as complementary test

khrm

@ngelman1 Can you check why e2e tests failing?

ngelman1 · 2026-07-27T11:35:32Z

@ngelman1 Can you check why e2e tests failing?

this was my fault, I used Tektonconfig instead of standalone CRs so that it will pass on ROSA.
I changed it back to be the same as in the triggers PR. seems all good now @khrm

zakisk · 2026-07-27T12:55:38Z

+| | egress | UDP+TCP/53 or 5353 | DNS resolver pods |
+| | egress | all | Unrestricted (API server, OCI registries, Sigstore, KMS, storage backends — NP cannot select host-network endpoints) |


what's the reason to have a separate policy for DNS if we're allowing egress to all? policy towards egress-all will allow to DNS as well.

Currently no reason.
In the original ticket definition the egress rule was not allow-all, it was separated to DNS, API, and also 27017 and 8200 specifically for chains.
After it was decided to allow all, I was pretty much following the patterns in othe NP PRs.
I thought leaving it this way to keep the same line as other components, but I can definitly remove the DNS rule.
What do you say? @zakisk

I didn't follow the discussion but it doesn't make sense to me. cc: @jkhelil @khrm you would know better?

zakisk · 2026-07-28T09:59:02Z

+                required:
+                - options


@ngelman1 I don't see this in MAG network policy PR, why is it needed?

this is not related to my change. I regenrated the CRDs using ./hack/update-codegen.sh and it comes from there.
I see this commit manually removes it..
let me remove them here as well

removed this and the DNS rule @zakisk

zakisk · 2026-07-28T18:14:26Z

@@ -31,6 +31,7 @@ import (
 	pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1"


also for pkg/reconciler/kubernetes/tektonchain/tektonchain.go, I see there is no unit test file for this but it's good to have

should I create the file and only test NP related things, or add tets for the entire file? (out of scope here?)

reconciliation is also tested in e2e

you can just write unit tests for your changes and do for others in separate PR if you want

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Jul 20, 2026

tekton-robot requested review from divyansh42 and jkhelil July 20, 2026 17:55

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 20, 2026

jkhelil reviewed Jul 21, 2026

View reviewed changes

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from 0222aa4 to c741785 Compare July 21, 2026 14:41

tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 21, 2026

khrm reviewed Jul 26, 2026

View reviewed changes

Comment thread docs/NetworkPolicy.md Outdated

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch 3 times, most recently from 6fcac66 to 0f2cc56 Compare July 27, 2026 10:39

zakisk reviewed Jul 27, 2026

View reviewed changes

zakisk reviewed Jul 28, 2026

View reviewed changes

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from 0f2cc56 to fdb36ce Compare July 28, 2026 10:36

zakisk reviewed Jul 28, 2026

View reviewed changes

Comment thread pkg/apis/operator/v1alpha1/tektonchain_validation.go

zakisk reviewed Jul 28, 2026

View reviewed changes

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from fdb36ce to 2a5f077 Compare July 29, 2026 15:12

khrm reviewed Jul 29, 2026

View reviewed changes

Comment thread docs/NetworkPolicy.md

khrm reviewed Jul 29, 2026

View reviewed changes

Comment thread pkg/apis/operator/v1alpha1/tektonchain_types.go

khrm reviewed Jul 30, 2026

View reviewed changes

Comment thread pkg/reconciler/kubernetes/tektonchain/networkpolicies.go Outdated

feat(tektonchain): add NetworkPolicy for Chains controller

967caab

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from 2a5f077 to 967caab Compare July 30, 2026 08:46

		\| \| egress \| UDP+TCP/53 or 5353 \| DNS resolver pods \|
		\| \| egress \| all \| Unrestricted (API server, OCI registries, Sigstore, KMS, storage backends — NP cannot select host-network endpoints) \|

		@@ -31,6 +31,7 @@ import (
		pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1"

Uh oh!

Conversation

ngelman1 commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

tekton-robot commented Jul 20, 2026

Uh oh!

codecov-commenter commented Jul 20, 2026 • edited by codecov Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jkhelil commented Jul 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

khrm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ngelman1 commented Jul 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ngelman1 commented Jul 20, 2026 •

edited

Loading

codecov-commenter commented Jul 20, 2026 •

edited by codecov Bot

Loading