WIP(openshift builds extension): add Shipwright Build and Shared Res… by sayan-biswas · Pull Request #4130 · tektoncd/operator

sayan-biswas · 2026-09-21T13:06:42Z

Changes

Replace the OpenShiftBuild component with two dedicated components: ShipwrightBuild, reconciled on both Kubernetes and OpenShift, and SharedResource. Add their API types, defaults, validation, lifecycle helpers, reconcilers, generated clients, and CRDs, and wire them into TektonConfig and the platform component lists.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

NONE

…ource Replace the OpenShiftBuild component with two dedicated components: ShipwrightBuild, reconciled on both Kubernetes and OpenShift, and SharedResource. Add their API types, defaults, validation, lifecycle helpers, reconcilers, generated clients, and CRDs, and wire them into TektonConfig and the platform component lists. Signed-off-by: Sayan Biswas <[email protected]>

tekton-robot · 2026-09-21T13:06:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign pramodbindal after the PR has been reviewed.
You can assign the PR to them by writing /assign @pramodbindal in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-09-21T13:12:06Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.01%. Comparing base (7dfc9db) to head (7191617).
⚠️ Report is 41 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4130      +/-   ##
==========================================
- Coverage   27.64%   26.01%   -1.64%     
==========================================
  Files         477      520      +43     
  Lines       25458    27114    +1656     
==========================================
+ Hits         7039     7054      +15     
- Misses      17696    19336    +1640     
- Partials      723      724       +1

Flag	Coverage Δ
unit-tests	`26.01% <ø> (-1.64%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jkhelil · 2026-09-22T08:46:53Z

+
+func IsEnabled(config *v1alpha1.TektonConfig) bool {
+	if v1alpha1.IsOpenShiftPlatform() {
+		return *config.Spec.Platforms.OpenShift.ShipwrightBuild.Enabled


check for nil dereference if config.Spec.Platforms.OpenShift.ShipwrightBuild is nil

Line 44, the Kubernetes side, has the same problem, and it crashes the operator on a default Kubernetes install.

I deployed this branch to kind with ko and the default Kubernetes overlay. The TektonConfig the operator creates for itself has no shipwrightBuild block. The tekton-operator-lifecycle container restarted twice in 10 minutes with panic: runtime error: invalid memory address or nil pointer dereference at shipwrightbuild.go:44, called from PostReconcile at extension.go:76.

After I set shipwrightBuild.enabled: true, it did not restart again in the next 7 minutes.

jkhelil · 2026-09-22T08:51:43Z

  case $version in
    latest)
-      dirVersion=$(curl -sL https://api.github.com/repos/$github_component/releases | jq -r ".[].tag_name" | sort -Vr | head -n1)
+      dirVersion=$(curl -sL https://api.github.com/repositorys/$github_component/releases | jq -r ".[].tag_name" | sort -Vr | head -n1)


why this change ? it will break gh api call

Same, not intended. Shipwright will need a separate pull mechanism, because there are different file names and more files to pull. Will clean up in final PR.

jkhelil · 2026-09-22T08:52:49Z

 ##@ Apply
 .PHONY: apply
-apply: | $(KO) $(KUSTOMIZE) get-releases ; $(info $(M) ko apply on $(TARGET)) @ ## Apply config to the current cluster
+apply: #| $(KO) $(KUSTOMIZE) get-releases ; $(info $(M) ko apply on $(TARGET)) @ ## Apply config to the current cluster


#? this is breakin apply command

This is not intended. Commented for local testing. Will clean up in the final PR.

jkhelil · 2026-09-22T08:53:50Z

+	return func(ctx context.Context, manifest *manifestival.Manifest, component v1alpha1.TektonComponent) (*manifestival.Manifest, error) {
+		sr := component.(*v1alpha1.SharedResource)
+		*manifest = manifest.Filter(manifestival.Not(manifestival.ByKind("Namespace")))
+		images := common.ToLowerCaseKeys(common.ImagesFromEnv(common.ShipwrightBuildImagePrefix))


common.ShipwrightBuildImagePrefix ?? isnt it sharedresource here

jkhelil · 2026-09-22T08:54:26Z

 multicluster-proxy-aae:
  github: openshift-pipelines/multicluster-proxy-aae
  version: v0.1.1
+shipwright-build:


missing sharedresource component entry ?

jkhelil · 2026-09-22T10:27:44Z

+)
+
+// FilterAndTransform installs the Builds manifests into the openshift-builds
+// namespace. The upstream operator applies the same InjectNamespace transform;


remove openshift-builds namespace, lets have evrything in openshfit-pipelines namespace if possible

jkhelil · 2026-09-22T10:28:10Z

+
+// Package sharedresource installs the Shared Resource component whose desired
+// state is expressed through the SharedResource CRD. It is an OpenShift-only
+// component sourced from the upstream openshift-builds operator.


probably not mention legacy openshift-builds operator

jkhelil · 2026-09-22T10:28:19Z

+// targetNamespace is the namespace where the OpenShift Builds components are
+// installed. It matches the namespace used by the upstream openshift-builds
+// operator.
+//const targetNamespace = "openshift-builds"


remove this

jkhelil · 2026-09-22T10:28:44Z

+
+func (sr *SharedResource) SetDefaults(ctx context.Context) {
+	// Both components default to Enabled when their block is present but the
+	// state is unset, mirroring the upstream openshift-builds operator.


same here, we need to remove reference to upstream builds operator

jkhelil · 2026-09-22T10:30:26Z


+	// Ensure Shipwright Build CR
+	if shipwrightbuild.IsEnabled(configInstance) {
+		if _, err := shipwrightbuild.CreateOrUpdate(ctx, ke.operatorClientSet.OperatorV1alpha1().ShipwrightBuilds(), configInstance, configInstance.Status.Version); err != nil {


Please ensure here that function doesnt create tektonconfig (thinking about some code in builds) , the ownership should look like this: TektonConfig (parent) → ShipwrightBuild / SharedResource CRs → InstallerSets → operand

Right. But I believe that part in the Shipwright Operator, which we have bypassed here and directly deploying controller. I'll check and confirm. this.

psrvere · 2026-09-30T06:00:40Z

 		ControllerTektonResults: injection.NamedControllerConstructor{
 			Name:                  string(ControllerTektonResults),
 			ControllerConstructor: k8sResult.NewController},
+		platform.ControllerShipwrightBuild: injection.NamedControllerConstructor{


Neither operator Deployment starts this controller. The -controllers lists in config/kubernetes/base/operator.yaml and config/openshift/base/operator.yaml have no shipwrightbuild or sharedresource.

I deployed this branch to kind with ko and set shipwrightBuild.enabled: true with profile all. The operator created the ShipwrightBuild CR, but nothing reconciled it. Its status stayed empty, and TektonConfig stayed Ready=False with ShipwrightBuild: reconcile again and proceed for 8 minutes.

When I added shipwrightbuild to the Kubernetes list, the controller picked up the CR and installed Shipwright. Could we add it to both lists, and sharedresource to the OpenShift one?

psrvere · 2026-09-30T06:02:23Z

+	}
+
+	// Create Post InstallerSet of installing Build Strategies
+	if err := r.installerSetClient.PostSet(ctx, sb, r.strategyManifest, NilFilterAndTransform(r)); err != nil {


The operator's service account can't install the ClusterBuildStrategies this post set applies, because no role under config/ grants shipwright.io.

On kind, with this branch deployed with ko and shipwrightbuild added to -controllers, the post InstallerSet failed with clusterbuildstrategies.shipwright.io "buildah-shipwright-managed-push" is forbidden: User "system:serviceaccount:tekton-operator:tekton-operator" cannot get resource "clusterbuildstrategies". TektonConfig stayed not ready.

After I bound a ClusterRole for shipwright.io to that account, the ShipwrightBuild CR and TektonConfig were both Ready within 3 minutes. Could the operator's ClusterRole get these rules?

psrvere · 2026-09-30T06:03:02Z

+	WebhookSecretName     = "shipwright-build-webhook-cert"
+	WebhookServiceName    = "shp-build-webhook"
+	WebhookSecretDuration = 365 * 24 * time.Hour
+	WebhookVersionFlag = "-version"


The Shipwright webhook reads its flags with pflag, which treats a single dash as a short flag. So -version is read as -v and the pod exits with unknown shorthand flag: 'v' in -version.

On a kind cluster, the operator from this branch left shipwright-build-webhook in CrashLoopBackOff. With --version the pod runs. The OpenShift -tls-min-version and -tls-cipher-suites flags fail the same way (unknown shorthand flag: 't').

Could these use --?

tekton-robot added release-note-none Denotes a PR that doesnt merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Sep 21, 2026

tekton-robot requested review from infernus01 and pratap0007 September 21, 2026 13:06

tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Sep 21, 2026

sayan-biswas mentioned this pull request Sep 21, 2026

ADR for integrating OpenShift Builds in OpenShift Pipelines openshift-pipelines/architecture#4

Open

4 of 7 tasks

jkhelil reviewed Sep 22, 2026

View reviewed changes

psrvere reviewed Sep 30, 2026

View reviewed changes

Conversation

sayan-biswas commented Sep 21, 2026

Changes

Submitter Checklist

Release Notes

Uh oh!

tekton-robot commented Sep 21, 2026

Uh oh!

codecov Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov Bot commented Sep 21, 2026 •

edited

Loading