fix(manualapprovalgate): propagate TLS profile hash via TektonConfig

ManualApprovalGate is a standalone CR (not created by TektonConfig),
so it was never part of the platform-data-hash propagation chain.
When the cluster TLS profile changed, all other components updated
their webhook deployments automatically — but the MAG webhook stayed
stale, still showing the old TLS version and cipher suites.

Root cause: the InstallerSet client detects TLS changes via the
platform-data-hash annotation on the component CR. TektonConfig
writes this annotation onto every child CR it owns (TektonPipeline,
TektonChain, etc.) during PostReconcile. MAG was never wired in.

Fix: add propagateMAGPlatformData() called from TektonConfig's
OpenShiftExtension.PostReconcile(). It lists existing MAG CRs and
writes the current TLS profile hash into their platform-data-hash
annotation. The existing MAG controller informer then fires,
triggers a reconcile, and the webhook deployment is re-applied with
the correct TLS env vars.

This is best-effort and safe when MAG is not installed:
- no MAG CR present → list returns empty, loop is a no-op
- MAG CRD absent → list error is logged as a warning, PostReconcile
  continues normally and TektonConfig reconciliation is unaffected

The proper long-term fix (integrate MAG as a full TektonConfig child
with ownerRef and spec field) is tracked in:
#3656

Relates-To: SRVKP-9613

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

pkg/reconciler/openshift/tektonconfig/extension.go

@@ -217,11 +217,49 @@ func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.Te
 		}
 	}
 
+	// Propagate platform-data-hash to any existing ManualApprovalGate CR.
+	// ManualApprovalGate is a standalone CR (not created by TektonConfig — see
+	// https://github.com/tektoncd/operator/issues/3656), so it never receives
+	// platform-data-hash through the normal child-CR path. We update it here
+	// (same PostReconcile layer as PAC) so that the MAG controller re-applies
+	// the webhook deployment with updated TLS env vars when the cluster TLS
+	// profile changes.
+	oe.propagateMAGPlatformData(ctx)
+
 	// execute console plugin reconciler
 	// TLS config was already resolved and cached in PreReconcile via SetTLSConfig.
 	return oe.consolePluginReconciler.reconcile(ctx, configInstance)
 }
 
+// propagateMAGPlatformData writes the current TLS profile hash into the
+// platform-data-hash annotation of every existing ManualApprovalGate CR.
+// It is a best-effort operation — failures are logged but do not block the
+// TektonConfig reconciliation.
+func (oe openshiftExtension) propagateMAGPlatformData(ctx context.Context) {
+	platformData := oe.GetPlatformData()
+	if platformData == "" {
+		return
+	}
+	logger := logging.FromContext(ctx)
+	magList, err := oe.operatorClientSet.OperatorV1alpha1().ManualApprovalGates().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		logger.Warnf("failed to list ManualApprovalGate CRs for platform-data-hash propagation: %v", err)
+		return
+	}
+	for i := range magList.Items {
+		mag := &magList.Items[i]
+		if mag.Annotations[v1alpha1.PlatformDataHashKey] == platformData {
+			continue
+		}
+		patch := fmt.Sprintf(`{"metadata":{"annotations":{%q:%q}}}`, v1alpha1.PlatformDataHashKey, platformData)
+		if _, patchErr := oe.operatorClientSet.OperatorV1alpha1().ManualApprovalGates().Patch(
+			ctx, mag.Name, types.MergePatchType, []byte(patch), metav1.PatchOptions{},
+		); patchErr != nil {
+			logger.Warnf("failed to patch platform-data-hash on ManualApprovalGate %s: %v", mag.Name, patchErr)
+		}
+	}
+}
+
 func (oe openshiftExtension) GetPlatformData() string {
 	tc, err := oe.tektonConfigLister.Get("config")
 	if err != nil {