fix(namespacesync): export PipelineRoleBinding for e2e test

The e2e test referenced tconfig.PipelineRoleBinding from the
tektonconfig package, which no longer exists after the rbac.go
cleanup. Export the constant from namespacesync (its new owner)
and update the test import alias accordingly.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jkhelil

config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml

@@ -1021,6 +1021,45 @@ spec:
                                   type: string
                                 type: object
                             type: object
+                          secretBindings:
+                            description: SecretBindings declares secrets to be automatically
+                              bound to the pipeline SA in each namespace. Each entry must
+                              set exactly one of labelSelector or secretName.
+                            items:
+                              description: SecretBinding describes a secret or class of
+                                secrets to bind to the pipeline SA.
+                              properties:
+                                labelSelector:
+                                  description: LabelSelector selects secrets by label.
+                                    All matching secrets in a namespace are bound.
+                                  properties:
+                                    matchExpressions:
+                                      items:
+                                        properties:
+                                          key:
+                                            type: string
+                                          operator:
+                                            type: string
+                                          values:
+                                            items:
+                                              type: string
+                                            type: array
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                    matchLabels:
+                                      additionalProperties:
+                                        type: string
+                                      type: object
+                                  type: object
+                                secretName:
+                                  description: SecretName binds a specific named secret
+                                    in each namespace to the pipeline SA.
+                                  type: string
+                              type: object
+                            type: array
                         type: object
                     type: object
                 type: object

pkg/apis/operator/v1alpha1/tektonconfig_defaults.go

@@ -29,21 +29,51 @@ import (
 // the equivalent typed fields in spec.platforms.openshift.namespaceSync, then removes
 // the migrated params from the slice. Params that are already absent are left at their
 // typed-field defaults (true). This runs only on OpenShift.
+//
+// Original semantics (preserved here):
+//   - createRbacResource=false  → master RBAC switch off; disables SA, SCC RoleBinding,
+//     AND edit RoleBinding, regardless of legacyPipelineRbac.
+//   - createCABundleConfigMaps=false → disables CA bundle ConfigMaps only.
+//   - legacyPipelineRbac=false → disables edit RoleBinding, but only when
+//     createRbacResource is true (or absent).
 func migrateNamespaceSyncParams(tc *TektonConfig) {
 	ns := tc.Spec.Platforms.OpenShift.NamespaceSync
+
+	// First pass: resolve the master RBAC switch so that its precedence over
+	// legacyPipelineRbac is respected regardless of param ordering in the slice.
+	masterRBACEnabled := true
+	for _, p := range tc.Spec.Params {
+		if p.Name == "createRbacResource" && p.Value == "false" {
+			masterRBACEnabled = false
+			break
+		}
+	}
+
 	remaining := tc.Spec.Params[:0]
 	for _, p := range tc.Spec.Params {
 		switch p.Name {
 		case "createRbacResource":
 			if ns.CreatePipelineSA == nil {
-				ns.CreatePipelineSA = ptr.Bool(p.Value != "false")
+				ns.CreatePipelineSA = ptr.Bool(masterRBACEnabled)
+			}
+			if !masterRBACEnabled {
+				// createRbacResource=false disabled all per-namespace RBAC in the
+				// old implementation. Carry that forward to the typed fields.
+				if ns.CreateSCCRoleBinding == nil {
+					ns.CreateSCCRoleBinding = ptr.Bool(false)
+				}
+				if ns.CreateEditRoleBinding == nil {
+					ns.CreateEditRoleBinding = ptr.Bool(false)
+				}
 			}
 		case "createCABundleConfigMaps":
 			if ns.CreateCABundles == nil {
 				ns.CreateCABundles = ptr.Bool(p.Value != "false")
 			}
 		case "legacyPipelineRbac":
-			if ns.CreateEditRoleBinding == nil {
+			// legacyPipelineRbac only had effect when createRbacResource was
+			// enabled; the master switch took precedence when it was false.
+			if masterRBACEnabled && ns.CreateEditRoleBinding == nil {
 				ns.CreateEditRoleBinding = ptr.Bool(p.Value != "false")
 			}
 		default:

pkg/reconciler/openshift/namespacesync/controller.go

@@ -25,15 +25,19 @@ import (
 	tektonConfigInformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonconfig"
 	pkgcommon "github.com/tektoncd/operator/pkg/common"
 
+	rbacv1 "k8s.io/api/rbac/v1"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/cache"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
 	nsinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/namespace"
+	secretinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/secret"
 	sainformer "knative.dev/pkg/client/injection/kube/informers/core/v1/serviceaccount"
+	rbinformer "knative.dev/pkg/client/injection/kube/informers/rbac/v1/rolebinding"
 	"knative.dev/pkg/configmap"
 	"knative.dev/pkg/controller"
-	secretinformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/secret"
 	"knative.dev/pkg/logging"
 )
 
@@ -45,6 +49,7 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	nsInf := nsinformer.Get(ctx)
 	saInf := sainformer.Get(ctx)
 	secretInf := secretinformer.Get(ctx)
+	rbInf := rbinformer.Get(ctx)
 	tcInf := tektonConfigInformer.Get(ctx)
 
 	rec := &Reconciler{
@@ -132,15 +137,20 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	//   - A newly created secret that matches a binding rule is bound immediately.
 	//   - A deleted named secret is unbound from the pipeline SA.
 	//
-	// Only trigger re-reconciliation when NamespaceSync has SecretBindings
-	// configured, to avoid a thundering herd on clusters without secret bindings.
+	// We use the cluster-wide kube factory here (NOT the namespacedkube one)
+	// because we need to observe secrets in all user namespaces, not just the
+	// operator's own namespace.
+	//
+	// To avoid a thundering-herd on clusters that don't use secret bindings,
+	// we only enqueue when NamespaceSync has SecretBindings configured AND the
+	// secret name/labels match at least one binding rule.
 	if _, err := secretInf.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
 		AddFunc: func(obj interface{}) {
 			secret, ok := obj.(*corev1.Secret)
 			if !ok {
 				return
 			}
-			if namespaceSyncHasSecretBindings(tcInf.Lister()) {
+			if secretMatchesBinding(secret, tcInf.Lister()) {
 				impl.EnqueueKey(types.NamespacedName{Name: secret.Namespace})
 			}
 		},
@@ -154,14 +164,41 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 					return
 				}
 			}
-			if namespaceSyncHasSecretBindings(tcInf.Lister()) {
+			if secretMatchesBinding(secret, tcInf.Lister()) {
 				impl.EnqueueKey(types.NamespacedName{Name: secret.Namespace})
 			}
 		},
 	}); err != nil {
 		logger.Panicf("Couldn't register Secret informer event handler: %v", err)
 	}
 
+	// RoleBinding Delete → re-enqueue the namespace for self-healing.
+	// We only watch the two RoleBindings that NamespaceSyncController owns:
+	// pipelines-scc-rolebinding and openshift-pipelines-edit. Watching all
+	// RoleBindings would be too noisy; we filter by name at the handler level.
+	managedRoleBindings := map[string]struct{}{
+		pipelinesSCCRoleBinding: {},
+		PipelineRoleBinding:     {},
+	}
+	if _, err := rbInf.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: func(obj interface{}) {
+			rb, ok := obj.(*rbacv1.RoleBinding)
+			if !ok {
+				if d, ok := obj.(cache.DeletedFinalStateUnknown); ok {
+					rb, ok = d.Obj.(*rbacv1.RoleBinding)
+				}
+				if !ok {
+					return
+				}
+			}
+			if _, watched := managedRoleBindings[rb.Name]; watched {
+				impl.EnqueueKey(types.NamespacedName{Name: rb.Namespace})
+			}
+		},
+	}); err != nil {
+		logger.Panicf("Couldn't register RoleBinding informer event handler: %v", err)
+	}
+
 	// TektonConfig changed → re-enqueue all namespaces only when the NamespaceSync
 	// config itself changed. Unrelated TektonConfig field changes (e.g. pipeline
 	// options, pruner settings) must not trigger a full namespace sweep — that
@@ -190,16 +227,35 @@ func NewController(ctx context.Context, _ configmap.Watcher) *controller.Impl {
 	return impl
 }
 
-// namespaceSyncHasSecretBindings returns true when TektonConfig has at least one
-// SecretBinding configured. Used to short-circuit Secret event handling when
-// no secret binding is needed.
-func namespaceSyncHasSecretBindings(lister interface {
+// secretMatchesBinding returns true when the given secret matches at least one
+// SecretBinding rule in the current TektonConfig. This is used to filter Secret
+// events so we only re-enqueue namespaces for secrets we actually care about,
+// avoiding unnecessary reconciles for the high volume of dockercfg / token
+// secrets that Kubernetes creates automatically.
+func secretMatchesBinding(secret *corev1.Secret, lister interface {
 	Get(string) (*v1alpha1.TektonConfig, error)
 }) bool {
 	tc, err := lister.Get(v1alpha1.ConfigResourceName)
 	if err != nil {
 		return false
 	}
 	cfg := tc.Spec.Platforms.OpenShift.NamespaceSync
-	return cfg != nil && len(cfg.SecretBindings) > 0
+	if cfg == nil || len(cfg.SecretBindings) == 0 {
+		return false
+	}
+	for _, b := range cfg.SecretBindings {
+		if b.SecretName != "" && b.SecretName == secret.Name {
+			return true
+		}
+		if b.LabelSelector != nil {
+			sel, err := metav1.LabelSelectorAsSelector(b.LabelSelector)
+			if err != nil {
+				continue
+			}
+			if sel.Matches(labels.Set(secret.Labels)) {
+				return true
+			}
+		}
+	}
+	return false
 }

pkg/reconciler/openshift/namespacesync/reconciler.go

@@ -47,11 +47,14 @@ import (
 )
 
 const (
-	pipelineSA                     = "pipeline"
-	pipelinesSCCRole               = "pipelines-scc-role"
-	pipelinesSCCClusterRole        = "pipelines-scc-clusterrole"
-	pipelinesSCCRoleBinding        = "pipelines-scc-rolebinding"
-	editRoleBinding                = "openshift-pipelines-edit"
+	pipelineSA              = "pipeline"
+	pipelinesSCCRole        = "pipelines-scc-role"
+	pipelinesSCCClusterRole = "pipelines-scc-clusterrole"
+	pipelinesSCCRoleBinding = "pipelines-scc-rolebinding"
+	// PipelineRoleBinding is the name of the edit RoleBinding created in each
+	// user namespace so that the pipeline SA has edit access. Exported for use
+	// in e2e tests.
+	PipelineRoleBinding            = "openshift-pipelines-edit"
 	editClusterRole                = "edit"
 	serviceCABundleConfigMap       = "config-service-cabundle"
 	trustedCABundleConfigMap       = "config-trusted-cabundle"
@@ -421,7 +424,7 @@ func (r *Reconciler) ensureEditRoleBinding(ctx context.Context, ns *corev1.Names
 	logger := logging.FromContext(ctx)
 	rbClient := r.kubeClient.RbacV1().RoleBindings(ns.Name)
 
-	_, err := rbClient.Get(ctx, editRoleBinding, metav1.GetOptions{})
+	_, err := rbClient.Get(ctx, PipelineRoleBinding, metav1.GetOptions{})
 	if err == nil {
 		return nil
 	}
@@ -437,7 +440,7 @@ func (r *Reconciler) ensureEditRoleBinding(ctx context.Context, ns *corev1.Names
 	logger.Infof("Creating edit RoleBinding in namespace %s", ns.Name)
 	_, err = rbClient.Create(ctx, &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      editRoleBinding,
+			Name:      PipelineRoleBinding,
 			Namespace: ns.Name,
 		},
 		RoleRef: rbacv1.RoleRef{
@@ -457,7 +460,7 @@ func (r *Reconciler) ensureEditRoleBinding(ctx context.Context, ns *corev1.Names
 // removeEditRoleBindingIfPresent deletes the openshift-pipelines-edit RoleBinding
 // when createEditRoleBinding is disabled.
 func (r *Reconciler) removeEditRoleBindingIfPresent(ctx context.Context, nsName string) error {
-	err := r.kubeClient.RbacV1().RoleBindings(nsName).Delete(ctx, editRoleBinding, metav1.DeleteOptions{})
+	err := r.kubeClient.RbacV1().RoleBindings(nsName).Delete(ctx, PipelineRoleBinding, metav1.DeleteOptions{})
 	if errors.IsNotFound(err) {
 		return nil
 	}

pkg/reconciler/openshift/namespacesync/reconciler_test.go

@@ -231,7 +231,7 @@ func TestEnsureEditRoleBinding_CreatesWhenAbsent(t *testing.T) {
 	err = r.Reconcile(context.Background(), "my-ns")
 	assert.NilError(t, err)
 
-	rb, err := kubeClient.RbacV1().RoleBindings("my-ns").Get(context.Background(), editRoleBinding, metav1.GetOptions{})
+	rb, err := kubeClient.RbacV1().RoleBindings("my-ns").Get(context.Background(), PipelineRoleBinding, metav1.GetOptions{})
 	assert.NilError(t, err)
 	assert.Equal(t, editClusterRole, rb.RoleRef.Name)
 	assert.Equal(t, pipelineSA, rb.Subjects[0].Name)
@@ -250,7 +250,7 @@ func TestEnsureEditRoleBinding_IdempotentWhenPresent(t *testing.T) {
 	}, metav1.CreateOptions{})
 	assert.NilError(t, err)
 	_, err = kubeClient.RbacV1().RoleBindings("my-ns").Create(context.Background(), &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{Name: editRoleBinding, Namespace: "my-ns"},
+		ObjectMeta: metav1.ObjectMeta{Name: PipelineRoleBinding, Namespace: "my-ns"},
 		RoleRef:    rbacv1.RoleRef{Kind: "ClusterRole", Name: editClusterRole},
 	}, metav1.CreateOptions{})
 	assert.NilError(t, err)
@@ -270,14 +270,14 @@ func TestRemoveEditRoleBinding_DeletesWhenPresent(t *testing.T) {
 
 	// pre-create the RoleBinding — reconcile must delete it.
 	_, err := kubeClient.RbacV1().RoleBindings("my-ns").Create(context.Background(), &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{Name: editRoleBinding, Namespace: "my-ns"},
+		ObjectMeta: metav1.ObjectMeta{Name: PipelineRoleBinding, Namespace: "my-ns"},
 	}, metav1.CreateOptions{})
 	assert.NilError(t, err)
 
 	err = r.Reconcile(context.Background(), "my-ns")
 	assert.NilError(t, err)
 
-	_, err = kubeClient.RbacV1().RoleBindings("my-ns").Get(context.Background(), editRoleBinding, metav1.GetOptions{})
+	_, err = kubeClient.RbacV1().RoleBindings("my-ns").Get(context.Background(), PipelineRoleBinding, metav1.GetOptions{})
 	assert.ErrorContains(t, err, "not found")
 }
 

test/e2e/common/00_tektonconfigdeployment_test.go

@@ -33,7 +33,7 @@ import (
 	"github.com/stretchr/testify/suite"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
-	tconfig "github.com/tektoncd/operator/pkg/reconciler/openshift/tektonconfig"
+	tconfig "github.com/tektoncd/operator/pkg/reconciler/openshift/namespacesync"
 	"github.com/tektoncd/operator/test/client"
 	"github.com/tektoncd/operator/test/resources"
 	"github.com/tektoncd/operator/test/utils"