Skip to content

add NetworkPolicy for MultiCluster Components - #3839

Merged
tekton-robot merged 1 commit into
tektoncd:mainfrom
khrm:feat/networkpolicy-scheduler-proxyaae-syncerservice
Aug 6, 2026
Merged

add NetworkPolicy for MultiCluster Components#3839
tekton-robot merged 1 commit into
tektoncd:mainfrom
khrm:feat/networkpolicy-scheduler-proxyaae-syncerservice

Conversation

@khrm

@khrm khrm commented Jul 29, 2026 •
edited by jkhelil
Loading

Copy link
Copy Markdown
Contributor

Add reconciler-based NetworkPolicy management for three components:

  • TektonScheduler: default-deny + controller (Prometheus 8443) + webhook (9443, Prometheus 8443) policies in tekton-kueue namespace
  • TektonMulticlusterProxyAAE: default-deny + proxy (ingress 8080) policies in proxy-aae namespace
  • SyncerService (OpenShift only): default-deny + controller (egress-only) policies in syncer-service namespace

Each component gets spec.networkPolicy (NetworkPolicyConfig) wired from TektonConfig, with validation, CustomSet-based InstallerSet management, and FinalizeKind cleanup.

Assisted-by: Claude Code (claude-opus-4-6)

Changes

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

See the contribution guide for more details.

Release Notes

Add NetworkPolicy support for TektonScheduler, TektonMulticlusterProxyAAE, and SyncerService components, giving each a default-deny policy plus targeted allow rules for required traffic.

@tekton-robot tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Jul 29, 2026
@tekton-robot tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jul 29, 2026
@codecov

codecov Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.78%. Comparing base (c315fb7) to head (76877c3).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #3839      +/-   ##
==========================================
- Coverage   25.93%   25.78%   -0.15%     
==========================================
  Files         456      463       +7     
  Lines       24086    24530     +444     
==========================================
+ Hits         6246     6325      +79     
- Misses      17144    17507     +363     
- Partials      696      698       +2
Flag Coverage Δ
unit-tests 25.78% <ø> (-0.15%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@khrm khrm changed the title feat: add NetworkPolicy for MultiCluster Compo… [WIP] add NetworkPolicy for MultiCluster Components Jul 30, 2026
@tekton-robot tekton-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 30, 2026
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from de4a20c to 8eb9955 Compare July 30, 2026 00:29
@tekton-robot tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 3, 2026
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 8eb9955 to ada63ee Compare August 5, 2026 05:07
@tekton-robot tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 5, 2026
@khrm khrm changed the title [WIP] add NetworkPolicy for MultiCluster Components add NetworkPolicy for MultiCluster Components Aug 5, 2026
@tekton-robot tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 5, 2026
@jkhelil

jkhelil commented Aug 5, 2026

Copy link
Copy Markdown
Member

@khrm can you squash the two commits please

@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch 4 times, most recently from b87261c to 8a219f0 Compare August 5, 2026 10:59
khrm
khrm commented Aug 5, 2026
View reviewed changes

@khrm khrm left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/assign @pramodbindal
/assign @jkhelil

I have squashed commits.

Can you please review and merge?

@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch 3 times, most recently from 48e5407 to a9adbb4 Compare August 5, 2026 13:20
@tekton-robot tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 5, 2026
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from a9adbb4 to 2dfb726 Compare August 5, 2026 21:14
@jkhelil

jkhelil commented Aug 6, 2026

Copy link
Copy Markdown
Member

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 14908fb to 56e727c Compare August 6, 2026 05:27
@tekton-robot tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026
@khrm

khrm commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

We can run this e2e test in OpenShift only.

@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 56e727c to 385103d Compare August 6, 2026 07:55
pratap0007
pratap0007 reviewed Aug 6, 2026
View reviewed changes
Comment thread pkg/apis/operator/v1alpha1/syncerservice_types.go
@pratap0007

pratap0007 commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026
@jkhelil

jkhelil commented Aug 6, 2026

Copy link
Copy Markdown
Member

@khrm can you add rn please

@jkhelil

jkhelil commented Aug 6, 2026

Copy link
Copy Markdown
Member

/kind misc

@tekton-robot tekton-robot added kind/misc Categorizes issue or PR as a miscellaneuous one. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesnt merit a release note. labels Aug 6, 2026
@jkhelil

jkhelil commented Aug 6, 2026

Copy link
Copy Markdown
Member

/approve

@tekton-robot

tekton-robot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
@pratap0007

pratap0007 commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 385103d to 2bf5e0c Compare August 6, 2026 12:31
@tekton-robot tekton-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed lgtm Indicates that a PR is ready to be merged. labels Aug 6, 2026
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 2bf5e0c to 3280eb4 Compare August 6, 2026 12:49
@tekton-robot tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 6, 2026
@khrm
feat: add NetworkPolicy for MultiCluster Components
76877c3 
Add NetworkPolicy support for TektonScheduler, TektonMulticlusterProxyAAE,
and SyncerService components. Each component gets a default-deny policy
and specific allow policies for required traffic.

E2E tests create a self-referential dummy worker cluster (secret +
MultiKueueCluster CR) so proxy-aae passes its readiness probe.
MultiCluster tests are skipped on non-OpenShift clusters.

Signed-off-by: Khurram Baig <kbaig@redhat.com>
@khrm
khrm force-pushed the feat/networkpolicy-scheduler-proxyaae-syncerservice branch from 3280eb4 to 76877c3 Compare August 6, 2026 12:55
@pratap0007

pratap0007 commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026
@tekton-robot
tekton-robot merged commit b3aa987 into tektoncd:main Aug 6, 2026
17 checks passed
@khrm
khrm deleted the feat/networkpolicy-scheduler-proxyaae-syncerservice branch August 6, 2026 14:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pratap0007 pratap0007 pratap0007 left review comments
@divyansh42 divyansh42 Awaiting requested review from divyansh42

Assignees

@pramodbindal pramodbindal

@jkhelil jkhelil

@pratap0007 pratap0007

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/misc Categorizes issue or PR as a miscellaneuous one. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@khrm @jkhelil @pratap0007 @tekton-robot @pramodbindal