fix(namespacesync): export PipelineRoleBinding for e2e test

The e2e test referenced tconfig.PipelineRoleBinding from the
tektonconfig package, which no longer exists after the rbac.go
cleanup. Export the constant from namespacesync (its new owner)
and update the test import alias accordingly.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jkhelil

config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml

@@ -1021,6 +1021,45 @@ spec:
                                   type: string
                                 type: object
                             type: object
+                          secretBindings:
+                            description: SecretBindings declares secrets to be automatically
+                              bound to the pipeline SA in each namespace. Each entry must
+                              set exactly one of labelSelector or secretName.
+                            items:
+                              description: SecretBinding describes a secret or class of
+                                secrets to bind to the pipeline SA.
+                              properties:
+                                labelSelector:
+                                  description: LabelSelector selects secrets by label.
+                                    All matching secrets in a namespace are bound.
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                secretName:
+                                  description: SecretName binds a specific named secret
+                                    in each namespace to the pipeline SA.
+                                  type: string
+                              type: object
+                            type: array
                         type: object
                     type: object
                 type: object

docs/TektonConfig.md

@@ -575,6 +575,129 @@ In the deployment the environment name will be converted as follows,
 - `tekton-hub-api` => `TEKTON_HUB_API`
 - `artifact-hub-api` => `ARTIFACT_HUB_API`
 
+### NamespaceSync (OpenShift only)
+
+The `namespaceSync` block under `spec.platforms.openshift` controls the **NamespaceSyncController**, which watches every user namespace and ensures Tekton-required resources are present and up to date. It replaces the legacy per-namespace batch loop that was part of the RBAC reconciler.
+
+#### Resources managed per namespace
+
+| Resource | Kind | Purpose |
+|---|---|---|
+| `pipeline` | `ServiceAccount` | Identity for PipelineRun pods |
+| `pipelines-scc-rolebinding` | `RoleBinding` → `pipelines-scc-clusterrole` | Grants the pipeline SA permission to use the default SCC |
+| `openshift-pipelines-edit` | `RoleBinding` → `ClusterRole/edit` | Gives the pipeline SA edit access within its namespace |
+| `config-trusted-cabundle` | `ConfigMap` | CA bundle for custom/internal PKI trust |
+| `config-service-cabundle` | `ConfigMap` | OpenShift service CA bundle |
+| `openshift-pipelines-clusterinterceptors` | `ClusterRoleBinding` subject | Lets the pipeline SA call ClusterInterceptors |
+
+#### Configuration fields
+
+```yaml
+spec:
+  platforms:
+    openshift:
+      namespaceSync:
+        createPipelineSA: true          # create/maintain the pipeline SA
+        createSCCRoleBinding: true      # create/maintain pipelines-scc-rolebinding
+        createEditRoleBinding: true     # create/maintain openshift-pipelines-edit
+        createCABundles: true           # inject CA bundle ConfigMaps
+
+        # Optional: restrict which namespaces are synced.
+        # Omit entirely to sync all non-system namespaces (default).
+        # Set to {} to opt out all namespaces without changing the flags above.
+        namespaceSelector:
+          matchLabels:
+            pipelines.openshift.io/sync: "true"
+
+        # Optional: automatically bind secrets to the pipeline SA.
+        # Use secretName for an exact name, or labelSelector to match by label.
+        secretBindings:
+          - secretName: pipeline-quay-openshift     # Quay Bridge robot account secret
+          - labelSelector:
+              matchLabels:
+                quay-integration: my-quay            # all secrets with this label
+```
+
+All boolean fields default to `true` when the `namespaceSync` block is present.
+
+#### Disabling individual features
+
+Set the flag to `false` to stop managing that resource class. Existing resources
+are **not deleted** — the controller simply stops reconciling them:
+
+```yaml
+spec:
+  platforms:
+    openshift:
+      namespaceSync:
+        createEditRoleBinding: false   # do not create openshift-pipelines-edit
+```
+
+#### Restricting sync to specific namespaces
+
+Use `namespaceSelector` to limit which namespaces the controller acts on.
+Label namespaces you want synced, then configure the selector to match:
+
+```bash
+# Label a namespace to opt in
+oc label namespace my-project pipelines.openshift.io/sync=true
+```
+
+```yaml
+spec:
+  platforms:
+    openshift:
+      namespaceSync:
+        namespaceSelector:
+          matchLabels:
+            pipelines.openshift.io/sync: "true"
+```
+
+To disable sync for **all** namespaces while keeping the feature flags intact,
+set an empty selector:
+
+```yaml
+namespaceSync:
+  namespaceSelector: {}   # matches nothing → no namespace is synced
+```
+
+#### Quay Bridge secret auto-binding
+
+When the [Quay Bridge Operator](https://github.com/quay/quay-bridge-operator) is
+installed, it creates a robot-account secret named `pipeline-quay-openshift` in
+each namespace. Declare a `secretBinding` to have the NamespaceSyncController
+automatically bind that secret to the `pipeline` SA as an image pull secret:
+
+```yaml
+spec:
+  platforms:
+    openshift:
+      namespaceSync:
+        secretBindings:
+          - secretName: pipeline-quay-openshift
+```
+
+Once configured:
+- When the secret appears in a namespace it is added to both `imagePullSecrets`
+  and `secrets` on the `pipeline` SA within seconds.
+- When the secret is deleted the reference is removed automatically.
+
+#### Migration from legacy `spec.params`
+
+Older releases controlled this behaviour through `spec.params` entries. The
+operator automatically migrates these on the first webhook call after an upgrade:
+
+| Legacy `spec.params` | Typed field |
+|---|---|
+| `createRbacResource: "false"` | `createPipelineSA`, `createSCCRoleBinding`, `createEditRoleBinding` all set to `false` |
+| `createCABundleConfigMaps: "false"` | `createCABundles: false` |
+| `legacyPipelineRbac: "false"` | `createEditRoleBinding: false` |
+
+After migration the legacy params are removed from `spec.params` and the typed
+fields take effect. There is no need to manually update the TektonConfig CR.
+
+---
+
 ### OpenShiftPipelinesAsCode
 
 The PipelinesAsCode section allows you to customize the Pipelines as Code features on both Kubernetes and OpenShift. When you change the TektonConfig CR, the Operator automatically applies the settings to custom resources and configmaps in your installation. On Kubernetes, configure `spec.platforms.kubernetes.pipelinesAsCode` (the managed CR remains `OpenShiftPipelinesAsCode` for API compatibility).

pkg/apis/operator/v1alpha1/openshift_platform.go

@@ -87,6 +87,14 @@ type NamespaceSyncConfig struct {
 	// Each entry must set exactly one of labelSelector or secretName.
 	// +optional
 	SecretBindings []SecretBinding `json:"secretBindings,omitempty"`
+
+	// NamespaceSelector is an optional label selector that restricts which
+	// namespaces are synced. When absent every non-system namespace is synced
+	// (the default). Use matchLabels/matchExpressions to limit sync to a subset
+	// of namespaces, or set it to an empty object ({}) to opt out all namespaces
+	// without touching the individual feature flags.
+	// +optional
+	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
 }
 
 // SecretBinding describes a secret (or class of secrets by label) that the

pkg/apis/operator/v1alpha1/tektonconfig_defaults.go

@@ -29,21 +29,51 @@ import (
 // the equivalent typed fields in spec.platforms.openshift.namespaceSync, then removes
 // the migrated params from the slice. Params that are already absent are left at their
 // typed-field defaults (true). This runs only on OpenShift.
+//
+// Original semantics (preserved here):
+//   - createRbacResource=false  → master RBAC switch off; disables SA, SCC RoleBinding,
+//     AND edit RoleBinding, regardless of legacyPipelineRbac.
+//   - createCABundleConfigMaps=false → disables CA bundle ConfigMaps only.
+//   - legacyPipelineRbac=false → disables edit RoleBinding, but only when
+//     createRbacResource is true (or absent).
 func migrateNamespaceSyncParams(tc *TektonConfig) {
 	ns := tc.Spec.Platforms.OpenShift.NamespaceSync
+
+	// First pass: resolve the master RBAC switch so that its precedence over
+	// legacyPipelineRbac is respected regardless of param ordering in the slice.
+	masterRBACEnabled := true
+	for _, p := range tc.Spec.Params {
+		if p.Name == "createRbacResource" && p.Value == "false" {
+			masterRBACEnabled = false
+			break
+		}
+	}
+
 	remaining := tc.Spec.Params[:0]
 	for _, p := range tc.Spec.Params {
 		switch p.Name {
 		case "createRbacResource":
 			if ns.CreatePipelineSA == nil {
-				ns.CreatePipelineSA = ptr.Bool(p.Value != "false")
+				ns.CreatePipelineSA = ptr.Bool(masterRBACEnabled)
+			}
+			if !masterRBACEnabled {
+				// createRbacResource=false disabled all per-namespace RBAC in the
+				// old implementation. Carry that forward to the typed fields.
+				if ns.CreateSCCRoleBinding == nil {
+					ns.CreateSCCRoleBinding = ptr.Bool(false)
+				}
+				if ns.CreateEditRoleBinding == nil {
+					ns.CreateEditRoleBinding = ptr.Bool(false)
+				}
 			}
 		case "createCABundleConfigMaps":
 			if ns.CreateCABundles == nil {
 				ns.CreateCABundles = ptr.Bool(p.Value != "false")
 			}
 		case "legacyPipelineRbac":
-			if ns.CreateEditRoleBinding == nil {
+			// legacyPipelineRbac only had effect when createRbacResource was
+			// enabled; the master switch took precedence when it was false.
+			if masterRBACEnabled && ns.CreateEditRoleBinding == nil {
 				ns.CreateEditRoleBinding = ptr.Bool(p.Value != "false")
 			}
 		default:

pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go

@@ -26,14 +26,18 @@ import (
 	pkgcommon "github.com/tektoncd/operator/pkg/common"
 
 	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/cache"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
 	nsinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/namespace"
+	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	sainformer "knative.dev/pkg/client/injection/kube/informers/core/v1/serviceaccount"
+	rbinformer "knative.dev/pkg/client/injection/kube/informers/rbac/v1/rolebinding"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
-	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
 	"knative.dev/pkg/logging"
 )
 
@@ -45,6 +49,7 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	nsInf := nsinformer.Get(ctx)
 	saInf := sainformer.Get(ctx)
 	secretInf := secretinformer.Get(ctx)
+	rbInf := rbinformer.Get(ctx)
 	tcInf := tektonConfigInformer.Get(ctx)
 
 	rec := &Reconciler{
@@ -132,15 +137,20 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	//   - A newly created secret that matches a binding rule is bound immediately.
 	//   - A deleted named secret is unbound from the pipeline SA.
 	//
-	// Only trigger re-reconciliation when NamespaceSync has SecretBindings
-	// configured, to avoid a thundering herd on clusters without secret bindings.
+	// We use the cluster-wide kube factory here (NOT the namespacedkube one)
+	// because we need to observe secrets in all user namespaces, not just the
+	// operator's own namespace.
+	//
+	// To avoid a thundering-herd on clusters that don't use secret bindings,
+	// we only enqueue when NamespaceSync has SecretBindings configured AND the
+	// secret name/labels match at least one binding rule.
 	if _, err := secretInf.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
 		AddFunc: func(obj interface{}) {
 			secret, ok := obj.(*corev1.Secret)
 			if !ok {
 				return
 			}
-			if namespaceSyncHasSecretBindings(tcInf.Lister()) {
+			if secretMatchesBinding(secret, tcInf.Lister()) {
 				impl.EnqueueKey(types.NamespacedName{Name: secret.Namespace})
 			}
 		},
@@ -154,14 +164,41 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 					return
 				}
 			}
-			if namespaceSyncHasSecretBindings(tcInf.Lister()) {
+			if secretMatchesBinding(secret, tcInf.Lister()) {
 				impl.EnqueueKey(types.NamespacedName{Name: secret.Namespace})
 			}
 		},
 	}); err != nil {
 		logger.Panicf("Couldn't register Secret informer event handler: %v", err)
 	}
 
+	// RoleBinding Delete → re-enqueue the namespace for self-healing.
+	// We only watch the two RoleBindings that NamespaceSyncController owns:
+	// pipelines-scc-rolebinding and openshift-pipelines-edit. Watching all
+	// RoleBindings would be too noisy; we filter by name at the handler level.
+	managedRoleBindings := map[string]struct{}{
+		pipelinesSCCRoleBinding: {},
+		PipelineRoleBinding:     {},
+	}
+	if _, err := rbInf.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: func(obj interface{}) {
+			rb, ok := obj.(*rbacv1.RoleBinding)
+			if !ok {
+				if d, ok := obj.(cache.DeletedFinalStateUnknown); ok {
+					rb, ok = d.Obj.(*rbacv1.RoleBinding)
+				}
+				if !ok {
+					return
+				}
+			}
+			if _, watched := managedRoleBindings[rb.Name]; watched {
+				impl.EnqueueKey(types.NamespacedName{Name: rb.Namespace})
+			}
+		},
+	}); err != nil {
+		logger.Panicf("Couldn't register RoleBinding informer event handler: %v", err)
+	}
+
 	// TektonConfig changed → re-enqueue all namespaces only when the NamespaceSync
 	// config itself changed. Unrelated TektonConfig field changes (e.g. pipeline
 	// options, pruner settings) must not trigger a full namespace sweep — that
@@ -190,16 +227,35 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	return impl
 }
 
-// namespaceSyncHasSecretBindings returns true when TektonConfig has at least one
-// SecretBinding configured. Used to short-circuit Secret event handling when
-// no secret binding is needed.
-func namespaceSyncHasSecretBindings(lister interface {
+// secretMatchesBinding returns true when the given secret matches at least one
+// SecretBinding rule in the current TektonConfig. This is used to filter Secret
+// events so we only re-enqueue namespaces for secrets we actually care about,
+// avoiding unnecessary reconciles for the high volume of dockercfg / token
+// secrets that Kubernetes creates automatically.
+func secretMatchesBinding(secret *corev1.Secret, lister interface {
 	Get(string) (*v1alpha1.TektonConfig, error)
 }) bool {
 	tc, err := lister.Get(v1alpha1.ConfigResourceName)
 	if err != nil {
 		return false
 	}
 	cfg := tc.Spec.Platforms.OpenShift.NamespaceSync
-	return cfg != nil && len(cfg.SecretBindings) > 0
+	if cfg == nil || len(cfg.SecretBindings) == 0 {
+		return false
+	}
+	for _, b := range cfg.SecretBindings {
+		if b.SecretName != "" && b.SecretName == secret.Name {
+			return true
+		}
+		if b.LabelSelector != nil {
+			sel, err := metav1.LabelSelectorAsSelector(b.LabelSelector)
+			if err != nil {
+				continue
+			}
+			if sel.Matches(labels.Set(secret.Labels)) {
+				return true
+			}
+		}
+	}
+	return false
 }