Skip to content

fix(chart): make the openshift flavor functional - #3945

Open
aqeelat wants to merge 2 commits into
tektoncd:mainfrom
aqeelat:fix/chart-openshift-sa-name
Open

fix(chart): make the openshift flavor functional#3945
aqeelat wants to merge 2 commits into
tektoncd:mainfrom
aqeelat:fix/chart-openshift-sa-name

Conversation

@aqeelat

@aqeelat aqeelat commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

Fixes two bugs in the OpenShift flavor (openshift.enabled=true) of the Helm chart:

ServiceAccount name mismatch. openshift-rbac.yaml hardcoded the ServiceAccount as openshift-pipelines-operator, while the Deployments resolve the name via the tekton-operator.serviceAccountName helper (chart fullname by default). The operator pods referenced a ServiceAccount the chart never created, so OpenShift users had to manually set rbac.serviceAccount.name: openshift-pipelines-operator. The ServiceAccount and its ClusterRoleBinding subject now use the same helper, so both flavors follow the chart fullname default and the rbac.serviceAccount.name override.

Missing PLATFORM=openshift env. The Deployments never set PLATFORM, so the operator ran in kubernetes mode even in the OpenShift flavor: IsOpenShiftPlatform() returned false, disabling the openshift-specific reconciler branches, defaults, and TektonConfig platform validation. PLATFORM=openshift is now set on the lifecycle and webhook containers when openshift.enabled=true, mirroring the upstream openshift kustomize overlay (the tektoninstallerset cluster-operations container does not use it upstream).

Verified with helm template for both flavors, with and without rbac.serviceAccount.name override: SA, binding subject, and Deployment serviceAccountName all match, and PLATFORM appears only in the OpenShift flavor. Chart-only change; no Go code touched.

Submitter Checklist

Release Notes

Fix OpenShift chart flavor: the operator ServiceAccount and its ClusterRoleBinding now follow the chart fullname and rbac.serviceAccount.name override instead of a hardcoded name, and PLATFORM=openshift is set on the operator and webhook Deployments so openshift-specific reconcilers, defaults, and validation are activated.

@aqeelat
fix(chart): template openshift operator SA name
e2adcc0 
The openshift RBAC template hardcoded the ServiceAccount name
(openshift-pipelines-operator) while the operator Deployment
resolves the name via the tekton-operator.serviceAccountName
helper. With rbac.create enabled the pod referenced a
ServiceAccount the chart never created, so OpenShift users had
to set rbac.serviceAccount.name manually.

Use the same helper for the ServiceAccount and its
ClusterRoleBinding subject so both flavors follow the chart
fullname default and the rbac.serviceAccount.name override.

Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com>
Assisted-by: GLM (via opencode)
@tekton-robot tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Aug 17, 2026
@tekton-robot

tekton-robot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign khrm after the PR has been reviewed.
You can assign the PR to them by writing /assign @khrm in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot
tekton-robot requested a review from khrm August 17, 2026 21:07
@tekton-robot tekton-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Aug 17, 2026
@codecov

codecov Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.33%. Comparing base (332b6f7) to head (6d84cb3).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #3945   +/-   ##
=======================================
  Coverage   26.33%   26.33%           
=======================================
  Files         465      465           
  Lines       24951    24951           
=======================================
  Hits         6572     6572           
  Misses      17661    17661           
  Partials      718      718
Flag Coverage Δ
unit-tests 26.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@aqeelat
fix(chart): set PLATFORM=openshift in openshift flavor
6d84cb3 
The operator and webhook Deployments never set the PLATFORM
env, so the openshift chart flavor ran the operator in
kubernetes mode: IsOpenShiftPlatform() returned false and the
openshift-specific reconciler branches, defaults, and
TektonConfig platform validation never activated.

Set PLATFORM=openshift on the lifecycle and webhook containers
when openshift.enabled is true, mirroring the upstream
openshift kustomize overlay (the tektoninstallerset
cluster-operations container does not use it).

Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com>
Assisted-by: GLM (via opencode)
@tekton-robot tekton-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 18, 2026
@aqeelat aqeelat changed the title fix(chart): template openshift operator SA name fix(chart): make the openshift flavor functional Aug 18, 2026
waveywaves
waveywaves suggested changes Aug 18, 2026
View reviewed changes
Comment thread charts/tekton-operator/templates/deployment.yaml
{{- end }}
{{- end }}
{{- if .Values.openshift.enabled }}
- name: PLATFORM

@waveywaves waveywaves Aug 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PLATFORM does not switch the compiled operator binary. The OpenShift branch in _helpers.tpl still selects the Kubernetes operator image. The correct OpenShift binary also rejects the default tektondashboard controller. Please make the image and controller defaults flavor-aware, or narrow the PR title, description, and release note.

Comment thread charts/tekton-operator/templates/deployment.yaml
fieldRef:
fieldPath: metadata.namespace
{{- if .Values.openshift.enabled }}
- name: PLATFORM

@waveywaves waveywaves Aug 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The OpenShift branches in _helpers.tpl also select the Kubernetes webhook and proxy images. Please use the OpenShift image repositories, or narrow the PR scope and release note.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@infernus01 infernus01 Awaiting requested review from infernus01
@khrm khrm Awaiting requested review from khrm
1 more reviewer
@waveywaves waveywaves waveywaves requested changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@aqeelat @tekton-robot @waveywaves