feat: Add NetworkPolicy support for chains by ngelman1 · Pull Request #3776 · tektoncd/operator

ngelman1 · 2026-07-20T17:55:34Z

Changes

Implements NetworkPolicy resources to restrict network access for the Tekton Chains controller.
Adds a spec.networkPolicy field to TektonChainSpec (propagated from TektonConfig) and a new pkg/reconciler/kubernetes/tektonchain/networkpolicies.go
that reconciles default-deny + allow policies in the operand namespace.
Default policies for the Chains controller pod:

Ingress: Prometheus metrics scraping on port 9090
Egress: DNS resolution via platform resolver + unrestricted egress (API server, OCI registries, Sigstore, KMS providers, storage backends)
Both platforms (Kubernetes and OpenShift) are supported via the existing networkpolicy.PlatformParams helper. Updates generated CRDs/Helm chart output and docs/NetworkPolicy.md.
Ref: SRVKP-12056

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

Add NetworkPolicy support for the Chains controller. Default policies allow Prometheus metrics ingress on port 9090 and unrestricted egress, to reach the API server, OCI registries, Sigstore services, KMS providers, and various storage backends depending on configuration.

codecov-commenter · 2026-07-20T17:59:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.54%. Comparing base (d64b59c) to head (ae07ba8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3776      +/-   ##
==========================================
+ Coverage   25.49%   25.54%   +0.05%     
==========================================
  Files         449      450       +1     
  Lines       23508    23566      +58     
==========================================
+ Hits         5994     6021      +27     
- Misses      16824    16855      +31     
  Partials      690      690

Flag	Coverage Δ
unit-tests	`25.54% <ø> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jkhelil · 2026-07-21T06:46:09Z

@ngelman1 have you verified this once on openshift ?

jkhelil · 2026-07-21T07:12:18Z

+
+// chainsControllerPodSelector matches the tekton-chains-controller Deployment's
+// spec.selector.matchLabels shipped in the upstream release manifest.
+var chainsControllerPodSelector = metav1.LabelSelector{


Can you add e2e for chains network policies please (similar to triggers, etc)

I added test simialr to triggers with a small difference:

setup is using TektonConfig instead of chain + pipeline, because creating CRs dierclty caused pre-reconciliation failures.

update of the NP is done through config and not directly through chain cause when I tried the latter chain was immediatly reverted by the tektonConfig reconciler

Also- I named the file 03_tektonchain_networkpolicy_test.go cause I saw this is how the triggers test is named. let me know if I need to change the number

@jkhelil was triggers e2e test was tested on openshift? I tested on ROSA and kept getting tektonconfig.operator.tekton.dev "config" not found when I tried creating standalone CRs withou TektonConfig like in here https://github.com/tektoncd/operator/blob/main/test/e2e/common/03_tektontrigger_networkpolicy_test.go#L61

@ngelman1 e2e are running on kind, you need to add the test, and do manual testing on openshift as complementary test

khrm

@ngelman1 Can you check why e2e tests failing?

ngelman1 · 2026-07-27T11:35:32Z

@ngelman1 Can you check why e2e tests failing?

this was my fault, I used Tektonconfig instead of standalone CRs so that it will pass on ROSA.
I changed it back to be the same as in the triggers PR. seems all good now @khrm

zakisk · 2026-07-28T18:14:26Z

@@ -31,6 +31,7 @@ import (
 	pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1"


also for pkg/reconciler/kubernetes/tektonchain/tektonchain.go, I see there is no unit test file for this but it's good to have

should I create the file and only test NP related things, or add tets for the entire file? (out of scope here?)

reconciliation is also tested in e2e

you can just write unit tests for your changes and do for others in separate PR if you want

added pkg/reconciler/kubernetes/tektonchain/networkpolicies_test.go

zakisk · 2026-08-03T11:11:32Z

@ngelman1 you've conflict on this with recent merge on main.

khrm

@ngelman1 Can you rebase with main?

tekton-robot · 2026-08-03T15:49:37Z

@ngelman1: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

zakisk · 2026-08-03T17:24:26Z

/approve

tekton-robot · 2026-08-03T17:24:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: zakisk
To complete the pull request process, please assign savitaashture after the PR has been reviewed.
You can assign the PR to them by writing /assign @savitaashture in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Jul 20, 2026

tekton-robot requested review from divyansh42 and jkhelil July 20, 2026 17:55

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 20, 2026

jkhelil reviewed Jul 21, 2026

View reviewed changes

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from 0222aa4 to c741785 Compare July 21, 2026 14:41

tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 21, 2026

khrm reviewed Jul 26, 2026

View reviewed changes

Comment thread docs/NetworkPolicy.md Outdated

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch 3 times, most recently from 6fcac66 to 0f2cc56 Compare July 27, 2026 10:39

zakisk reviewed Jul 27, 2026

View reviewed changes

Comment thread docs/NetworkPolicy.md Outdated

zakisk reviewed Jul 28, 2026

View reviewed changes

Comment thread config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml Outdated

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from 0f2cc56 to fdb36ce Compare July 28, 2026 10:36

zakisk reviewed Jul 28, 2026

View reviewed changes

Comment thread pkg/apis/operator/v1alpha1/tektonchain_validation.go

zakisk reviewed Jul 28, 2026

View reviewed changes

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from fdb36ce to 2a5f077 Compare July 29, 2026 15:12

khrm reviewed Jul 29, 2026

View reviewed changes

Comment thread docs/NetworkPolicy.md

khrm reviewed Jul 29, 2026

View reviewed changes

Comment thread pkg/apis/operator/v1alpha1/tektonchain_types.go

khrm reviewed Jul 30, 2026

View reviewed changes

Comment thread pkg/reconciler/kubernetes/tektonchain/networkpolicies.go Outdated

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch 3 times, most recently from 7ce5f60 to bdab246 Compare August 2, 2026 10:55

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 3, 2026

feat(tektonchain): add NetworkPolicy for Chains controller

ae07ba8

ngelman1 force-pushed the srvkp-12056-networkpolicy-chains branch from bdab246 to ae07ba8 Compare August 3, 2026 12:26

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 3, 2026

khrm reviewed Aug 3, 2026

View reviewed changes

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 3, 2026

		@@ -31,6 +31,7 @@ import (
		pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1"

Uh oh!

Conversation

ngelman1 commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

codecov-commenter commented Jul 20, 2026 • edited by codecov Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jkhelil commented Jul 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

khrm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ngelman1 commented Jul 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zakisk commented Aug 3, 2026

Uh oh!

khrm left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tekton-robot commented Aug 3, 2026

Uh oh!

zakisk commented Aug 3, 2026

Uh oh!

tekton-robot commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ngelman1 commented Jul 20, 2026 •

edited

Loading

codecov-commenter commented Jul 20, 2026 •

edited by codecov Bot

Loading

khrm left a comment •

edited

Loading