feat(openshiftpipelinesascode): add NetworkPolicy support

[zakisk]

Add default-deny and per-pod NetworkPolicies for the three OpenShiftPipelinesAsCode workloads (controller, watcher, webhook), following the pattern established by TektonPipeline and TektonTrigger.

Default policies:

• pac-default-deny: deny all traffic to pods with app.kubernetes.io/part-of=pipelines-as-code
• pac-controller: allow Prometheus metrics ingress (TCP/9090), Git provider webhook ingress (TCP/8082), DNS egress, API server egress, and internet egress (TCP/80,443)
• pac-watcher: allow Prometheus metrics ingress (TCP/9090), DNS egress, API server egress, and internet egress (TCP/80,443)
• pac-webhook: allow admission webhook ingress (TCP/8443), Prometheus metrics ingress (TCP/9090), DNS egress, and API server egress

Policies are reconciled via InstallerSet.CustomSet and respect the spec.networkPolicy.disabled toggle. The NetworkPolicy field is propagated from TektonConfig to the OpenShiftPipelinesAsCode CR.

Includes unit tests for NetworkPolicyConfig validation, an E2E test for policy creation/disable/re-enable, and updated NetworkPolicy documentation.

Changes

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

NONE

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.41%. Comparing base (d64b59c) to head (6320c6f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3828      +/-   ##
==========================================
- Coverage   25.49%   25.41%   -0.09%     
==========================================
  Files         449      450       +1     
  Lines       23508    23607      +99     
==========================================
+ Hits         5994     5999       +5     
- Misses      16824    16918      +94     
  Partials      690      690              

Flag	Coverage Δ
unit-tests	25.41% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[khrm]

/ok-to-test

[khrm]

/lgtm

[khrm]

Can you also update release note?

[theakshaypant]

s/2025/2026/g

[zakisk]

it's generated and I think the copyright notice is taken from original file from where it's generated and year shows when this file is copied

[zakisk]

...

[theakshaypant]

s/2024/2026/g

[zakisk]

same

[Copilot]

Pull request overview

This PR adds first-class NetworkPolicy reconciliation for the OpenShift Pipelines-as-Code (OpenShiftPipelinesAsCode) component, aligning it with existing NetworkPolicy support patterns in the operator (e.g., TektonPipeline / TektonTrigger). It wires the NetworkPolicy config through the API surface, reconciler, tests, and documentation.

Changes:

• Introduces default-deny + per-workload NetworkPolicies for OpenShift Pipelines-as-Code and reconciles them via an InstallerSet CustomSet, respecting spec.networkPolicy.disabled.
• Propagates spec.networkPolicy from TektonConfig into the OpenShiftPipelinesAsCode CR and adds validation + deepcopy support for the new field.
• Adds E2E/unit tests and updates NetworkPolicy documentation and generated CRD/chart schemas.

Reviewed changes

Copilot reviewed 26 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/e2e/common/11_openshiftpipelinesascode_networkpolicy_test.go	Adds E2E coverage for PAC NetworkPolicy create/disable/re-enable.
pkg/reconciler/shared/tektonconfig/pipelinesascode/pipelinesascode.go	Propagates TektonConfig networkPolicy into the OpenShiftPipelinesAsCode spec.
pkg/reconciler/openshift/openshiftpipelinesascode/reconcile.go	Hooks NetworkPolicy reconciliation into PAC reconciler flow.
pkg/reconciler/openshift/openshiftpipelinesascode/networkpolicies.go	Defines PAC default NetworkPolicies and reconciles them via CustomSet.
pkg/reconciler/openshift/openshiftpipelinesascode/controller.go	Initializes platform-specific NetworkPolicy parameters for PAC reconciler.
pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go	Adds DeepCopy support for the new NetworkPolicy field in PAC spec.
pkg/apis/operator/v1alpha1/openshiftpipelinesascode_validation.go	Validates spec.networkPolicy for OpenShiftPipelinesAsCode.
pkg/apis/operator/v1alpha1/openshiftpipelinesascode_validation_test.go	Adds unit tests for NetworkPolicyConfig validation behavior.
pkg/apis/operator/v1alpha1/openshiftpipelinesascode_types.go	Extends PAC API type with spec.networkPolicy.
docs/NetworkPolicy.md	Documents default PAC policies and expected ingress/egress behavior.
config/openshift/base/300-operator_v1alpha1_openshiftpipelinesascode_crd.yaml	CRD schema includes spec.networkPolicy for PAC (OpenShift base).
config/openshift/base/300-operator_v1alpha1_addon_crd.yaml	Adds/updates CRD manifest in OpenShift base bundle.
config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml	Adds/updates CRD manifest in Kubernetes base bundle.
config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml	Updates generated TektonConfig CRD schema text for NetworkPolicy.
config/base/generated-crds/operator.tekton.dev_openshiftpipelinesascodes.yaml	Updates generated PAC CRD schema to include spec.networkPolicy.
config/base/300-operator_v1alpha1_trigger_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_syncerservice_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_scheduler_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_result_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_pruner_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_pipeline_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_multiclusterproxyaae_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_manualapprovalgate_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_installer_set_crd.yaml	Adds/updates CRD manifest in base bundle.
config/base/300-operator_v1alpha1_config_crd.yaml	Adds/updates TektonConfig CRD manifest in base bundle.
config/base/300-operator_v1alpha1_chain_crd.yaml	Adds/updates CRD manifest in base bundle.
charts/tekton-operator/templates/kubernetes-crds.yaml	Updates Helm chart CRD templates for PAC + TektonConfig schema text.

Files not reviewed (1)

• pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jkhelil]

/hold

[jkhelil]

Why this diff touches 14 unrelated CRDs

Most of this PR's ~8,900 lines have nothing to do with the NetworkPolicy feature. The only intentional CRD change is config/base/generated-crds/operator.tekton.dev_openshiftpipelinesascodes.yaml (+18 lines, the new networkPolicy field).

Root cause: hack/sync-helm-crds.sh (run via make sync-helm-crds, a standard step after any API type change) still regenerates the manual per-component CRD copies under config/base/, config/kubernetes/base/, and config/openshift/base/ (300-operator_v1alpha1_<component>_crd.yaml). Those files were deleted from the repo by #1ae0906b3 ("Cleanup manual CRDs and use generated CRDs in kustomize"), which pointed every kustomization.yaml at config/base/generated-crds/*.yaml directly — but the sync script was never updated to match. Running it faithfully resurrects ~4,700 lines of dead, unreferenced manifests (verified via git grep — nothing in the repo references them besides the script itself). Separately, charts/tekton-operator/templates/openshift-crds.yaml on main has drifted and only bundles 3 of the 13 CRDs the script says it should, so a full re-run also pulls in +3,767 unrelated lines fixing that pre-existing gap.

I've opened #3842 to fix the script so it stops reviving the dead manual CRDs.

Two ways to unblock this PR, whichever is faster for you:

1. Wait for fix(hack): stop sync-helm-crds.sh reviving dead manual CRDs #3842 to merge, rebase this branch on main, then re-run make sync-helm-crds. The manual CRD files won't come back, and only openshiftpipelinesascodes.yaml + the legitimate openshift-crds.yaml Helm bundle fix should remain (the latter is arguably worth splitting into its own PR too, since it changes what CRDs get installed on OpenShift independent of NetworkPolicy).
2. Or, don't wait — just hand-revert the unrelated files now so the diff is scoped to the feature:

   git checkout main -- \
     config/base/300-operator_v1alpha1_*.yaml \
     config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml \
     config/openshift/base/300-operator_v1alpha1_addon_crd.yaml \
     charts/tekton-operator/templates/kubernetes-crds.yaml \
     charts/tekton-operator/templates/openshift-crds.yaml

   and keep only config/base/generated-crds/operator.tekton.dev_openshiftpipelinesascodes.yaml.

Either way, please see the follow-up comment below — there's one regression hiding in the regenerated CRDs that needs fixing regardless of which path you take.

[jkhelil]

🔴 Regression hiding in the regenerated CRDs: TektonConfig.spec.hub.options becomes required

Separate from the scope issue above, one specific piece of the regenerated output is a real bug, not just noise:

config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml gains a required: [options] entry under spec.hub (also duplicated in the resurrected config/base/300-operator_v1alpha1_config_crd.yaml):

              hub:
                description: Hub holds the hub config
                properties:
                  options: ...
                  params: ...
                required:
                - options

This makes spec.hub.options mandatory on TektonConfig — a cluster-scoped singleton CR — even though it isn't supposed to be. The cause is in pkg/apis/operator/v1alpha1/tektonconfig_types.go:

type Hub struct {
	// Params is the list of params passed for Hub customization
	// +optional
	Params []Param `json:"params,omitempty"`
	// options holds additions fields and these fields will be updated on the manifests
	Options AdditionalOptions `json:"options"`
}

Every other component's Options AdditionalOptions field (TektonPipeline, TektonTrigger, TektonChain, TektonDashboard, TektonAddon, ManualApprovalGate, TektonPruner, TektonScheduler, TektonMulticlusterProxyAAE, SyncerService) has // +optional; Hub.Options is the only one missing it — almost certainly an oversight from the earlier "fix: options field should be optional in all components" work. It's latent on main today because the checked-in generated CRD hasn't been regenerated since, but this PR's full CRD regeneration surfaces it for real. Since generated-crds/operator.tekton.dev_tektonconfigs.yaml is what kustomize actually applies to clusters, merging as-is would reject any TektonConfig CR that doesn't explicitly set spec.hub.options — a breaking regression for existing users on upgrade.

Suggested fix (small, can go in this PR or a quick follow-up before merge):

	// options holds additions fields and these fields will be updated on the manifests
	// +optional
	Options AdditionalOptions `json:"options,omitempty"`

then re-run make sync-helm-crds so the required entry drops out of the generated schema.

[jkhelil]

/unhold

[tekton-robot]

New changes are detected. LGTM label has been removed.

[zakisk]

@jkhelil addressed your comments!

[zakisk]

the failing test TestTektonResultsWatcherStatefulset is passing locally but failing here, force pushed to run the tests again

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment