feat(manualapprovalgate): add NetworkPolicy support

[divyansh42]

Changes

Add default-deny, controller, and webhook NetworkPolicies for the ManualApprovalGate component, following the same pattern used by TektonTrigger and TektonPipeline. Policies are reconciled via a CustomSet and respect the spec.networkPolicy toggle for disabling and custom overrides. Includes validation, cleanup on CR deletion, e2e test, CRD schema updates, and documentation.

Assisted-by: Claude Opus 4.6 (via Cursor)

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

ManualApprovalGate now creates default NetworkPolicies that restrict ingress/egress for its controller and webhook pods. These are enabled by default. To opt out, set `spec.networkPolicy.disabled: true` on the ManualApprovalGate CR.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign enarha after the PR has been reviewed.
You can assign the PR to them by writing /assign @enarha in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.31%. Comparing base (2a953b3) to head (973134f).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3801      +/-   ##
==========================================
- Coverage   25.40%   25.31%   -0.10%     
==========================================
  Files         449      451       +2     
  Lines       23477    23561      +84     
==========================================
  Hits         5964     5964              
- Misses      16822    16906      +84     
  Partials      691      691              

Flag	Coverage Δ
unit-tests	25.31% <ø> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds first-class NetworkPolicy management for the ManualApprovalGate component, aligning it with existing operator support for TektonPipeline and TektonTrigger. It introduces default-deny plus workload-scoped policies, wires reconciliation/cleanup via an InstallerSet CustomSet, and exposes configuration via spec.networkPolicy on the ManualApprovalGate CR.

Changes:

• Add reconciliation + finalizer cleanup for ManualApprovalGate NetworkPolicies using a CustomSet("mag-network-policies", ...).
• Extend the ManualApprovalGate API with spec.networkPolicy including validation + deepcopy generation, and update CRD schemas/Helm templates accordingly.
• Add e2e coverage and update NetworkPolicy documentation to include ManualApprovalGate defaults and configuration.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/e2e/common/06_manualapprovalgate_networkpolicy_test.go	Adds an e2e test that asserts MAG NetworkPolicies are created by default and removed/restored when toggling spec.networkPolicy.disabled.
pkg/reconciler/kubernetes/manualapprovalgate/reconcile.go	Invokes NetworkPolicy reconciliation after the main InstallerSet is applied.
pkg/reconciler/kubernetes/manualapprovalgate/networkpolicies.go	Defines default MAG NetworkPolicies and reconciles them via an InstallerSet CustomSet, respecting spec.networkPolicy.disabled and overrides.
pkg/reconciler/kubernetes/manualapprovalgate/finalize.go	Cleans up the MAG NetworkPolicy CustomSet on CR deletion.
pkg/reconciler/kubernetes/manualapprovalgate/controller.go	Initializes platform-specific NetworkPolicy parameters (Kubernetes vs OpenShift) for rule generation.
pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go	Ensures ManualApprovalGateSpec.NetworkPolicy is deep-copied.
pkg/apis/operator/v1alpha1/manualapprovalgate_validation.go	Adds validation for one-instance naming plus spec.networkPolicy validation.
pkg/apis/operator/v1alpha1/manualapprovalgate_types.go	Adds the networkPolicy field to the ManualApprovalGate spec.
docs/NetworkPolicy.md	Documents the new MAG policies and configuration on the MAG CR.
config/base/generated-crds/operator.tekton.dev_manualapprovalgates.yaml	Updates the generated CRD schema to include spec.networkPolicy.
charts/tekton-operator/templates/openshift-crds.yaml	Updates Helm-rendered OpenShift CRD schema for spec.networkPolicy.
charts/tekton-operator/templates/kubernetes-crds.yaml	Updates Helm-rendered Kubernetes CRD schema for spec.networkPolicy.

Files not reviewed (1)

• pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[divyansh42]

I have manually tested this on OpenShift.

[jkhelil]

/kind misc

[khrm]

We need ingress for prometheus also. Did we forget that in other controllers?

[divyansh42]

isn't it present here https://github.com/tektoncd/operator/pull/3801/changes#diff-ddcad145c90e972039422fe17dfbf5efec52688755da7e3c1e94386ec4d6c631
Correct me if my understanding is not correct.

[khrm]

It should be present.

[khrm]

I read wrongly.

[khrm]

Did you run code gen ?