Skip to content

feat: add NetworkPolicy support for TektonTrigger - #3531

Merged
tekton-robot merged 3 commits into
tektoncd:mainfrom
khrm:feat/networkpolicy-support
Jul 6, 2026
Merged

feat: add NetworkPolicy support for TektonTrigger#3531
tekton-robot merged 3 commits into
tektoncd:mainfrom
khrm:feat/networkpolicy-support

Conversation

@khrm

@khrm khrm commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Changes

Changes:

Introduces opt-in NetworkPolicy support for the TektonTrigger component.

New shared infrastructure (pkg/reconciler/common/networkpolicy):

  • NetworkPolicyConfig API type embedded in component specs — supports disabled flag and per-policy overrides via a policies map
  • Generate() — merges user-supplied policies over defaults with deterministic sorted output for stable InstallerSet checksums
  • DefaultDenyPolicy() — shared helper for component-scoped or namespace-wide default-deny policies
  • Platform-specific defaults (PlatformParams) for Kubernetes and OpenShift DNS resolver and Prometheus namespace selectors
  • Rule constructors: DNSEgressRule, APIServerEgressRule, InternetEgressRule, PrometheusIngressRule, WebhookIngressRule

TektonTrigger wiring:

  • Five default NetworkPolicies applied as a named CustomSet (triggers-network-policies):
    • tekton-default-deny — default-deny scoped to app.kubernetes.io/part-of: tekton-triggers pods (temporary; will move to TektonPipeline and become namespace-wide once all components
      implement NP support)
    • triggers-controller — allows Prometheus ingress on port 9000
    • triggers-webhook — allows webhook ingress on 8443 and Prometheus ingress on 9000
    • triggers-core-interceptors — allows ingress on 8443 from all namespaces (EventListeners are user-controlled)
    • triggers-core-interceptors-egress-internet — allows egress on TCP 80/443 for external API calls
  • Platform detection via v1alpha1.IsOpenShiftPlatform() at controller startup; no extra parameters threaded through public APIs
  • Setting spec.networkPolicy.disabled: true cleans up all policies
  • NetworkPolicyConfig field also added to TektonConfigSpec (reconciler integration deferred)

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

See the contribution guide for more details.

Release Notes

NONE

@tekton-robot tekton-robot added release-note-none Denotes a PR that doesnt merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Jun 23, 2026
@tekton-robot tekton-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 23, 2026
@khrm
khrm force-pushed the feat/networkpolicy-support branch 7 times, most recently from 5fe4ace to 323945d Compare June 30, 2026 16:42
@khrm khrm changed the title [WIP] feat: add NetworkPolicy support for TektonTrigger feat: add NetworkPolicy support for TektonTrigger Jun 30, 2026
@tekton-robot tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 30, 2026
@khrm
feat: add NetworkPolicyConfig API type and shared networkpolicy package
59a9639 
Introduce NetworkPolicyConfig struct embedded in component specs, allowing
operators to disable NetworkPolicies or override individual policies by name.

Add pkg/reconciler/common/networkpolicy with:
- platform.go: PlatformParams for Kubernetes and OpenShift DNS/Prometheus defaults
- networkpolicy.go: Generate() with map-merge and deterministic sorted output
- networkpolicy_test.go: 13 unit tests covering merge, disable, and rule helpers

Wire NetworkPolicyConfig into TektonTriggerSpec and TektonConfigSpec (reconciler
integration for TektonConfig is deferred). Regenerate zz_generated.deepcopy.go.

Signed-off-by: Khurram Baig <khurram.baig@gmail.com>
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@khrm
khrm force-pushed the feat/networkpolicy-support branch 5 times, most recently from f59a9a6 to 3b008f5 Compare July 1, 2026 13:05
@tekton-robot tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 1, 2026
@khrm
khrm force-pushed the feat/networkpolicy-support branch 5 times, most recently from d1dccb4 to 6b86fa4 Compare July 1, 2026 17:51
@khrm
feat(triggers): wire NetworkPolicy reconciliation into TektonTrigger
2b6f6d9 
Add triggersDefaultPolicies() defining four NetworkPolicies for the
Triggers workloads (controller, webhook, core-interceptors ingress,
core-interceptors egress). Platform-specific DNS and Prometheus values
are resolved at controller startup via v1alpha1.IsOpenShiftPlatform().

reconcileNetworkPolicies() applies policies as a named CustomSet
("triggers-network-policies") or cleans it up when disabled.

Signed-off-by: Khurram Baig <khurram.baig@gmail.com>
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@khrm
khrm force-pushed the feat/networkpolicy-support branch 2 times, most recently from 4768921 to 232b762 Compare July 2, 2026 09:43
@khrm
khrm force-pushed the feat/networkpolicy-support branch 3 times, most recently from 037c7e5 to fcfc1ff Compare July 3, 2026 02:21
@jkhelil

jkhelil commented Jul 3, 2026

Copy link
Copy Markdown
Member

/retest

@khrm
khrm force-pushed the feat/networkpolicy-support branch from fcfc1ff to eb83f3d Compare July 3, 2026 05:42
jkhelil
jkhelil reviewed Jul 3, 2026
View reviewed changes
Comment thread pkg/reconciler/common/networkpolicy/networkpolicy.go Outdated
Comment thread pkg/reconciler/common/networkpolicy/networkpolicy.go
},
}
}

@jkhelil jkhelil Jul 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Are we missing some rules .
  • liveness and readiness probe rules from kubelet
  • EventListner rules (events from github to trigger event listner)

Can we also have a human readble table for the rules we allow/deny as part of the docs

@khrm khrm Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

EventListener lives in the user namespace. This is for the operands namespace.

If we want that change, it will go in the triggers repo, not this.

Probes bypass NetworkPolicy. So not needed.

Comment thread pkg/reconciler/common/networkpolicy/networkpolicy.go
for _, p := range defaults {
merged[p.Name] = p
}
for name, spec := range cfg.Policies {

@jkhelil jkhelil Jul 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no validation for the user input, if name is empty, it will be rejected by the apiserver

@khrm
khrm force-pushed the feat/networkpolicy-support branch from eb83f3d to d8c44b9 Compare July 3, 2026 08:01
@jkhelil

jkhelil commented Jul 3, 2026

Copy link
Copy Markdown
Member

@khrm Lease add release note

@khrm
khrm force-pushed the feat/networkpolicy-support branch 2 times, most recently from b7ebd5c to 66f20ba Compare July 6, 2026 07:03
@khrm
test(triggers): add e2e tests for NetworkPolicy support
6387f82 
Add TestTektonTriggerNetworkPolicy covering:
- Default NetworkPolicies created when TektonTrigger is Ready
- Triggers functional end-to-end with policies in place:
  - CEL interceptor matching event (action=push) → PipelineRun created,
    exercising interceptors ingress from all namespaces on port 8443
    and interceptors → API server egress
  - CEL interceptor non-matching event (action=open) → blocked by
    interceptor, no new PipelineRun created
- spec.networkPolicy.disabled=true removes all policies
- Re-enabling restores all policies

Add helper functions in test/resources/networkpolicies.go:
AssertNetworkPoliciesExist, AssertNetworkPoliciesAbsent,
AssertEventListenerReady, AssertPipelineRunCreated,
AssertPipelineRunCountUnchanged.

Add testdata/triggers/ with Pipeline, TriggerBinding, TriggerTemplate,
and EventListener (with CEL interceptor) YAML fixtures.

Signed-off-by: Khurram Baig <khurram.baig@gmail.com>
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@khrm
khrm force-pushed the feat/networkpolicy-support branch from 66f20ba to 6387f82 Compare July 6, 2026 07:09
@khrm

khrm commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

@pramodbindal @vdemeester @jkhelil Can you do the review this again?

@tekton-robot

tekton-robot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pramodbindal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 6, 2026
@pramodbindal

pramodbindal commented Jul 6, 2026

Copy link
Copy Markdown
Member

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 6, 2026
infernus01
infernus01 reviewed Jul 6, 2026
View reviewed changes

@infernus01 infernus01 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@tekton-robot
tekton-robot merged commit 2ba5c9a into tektoncd:main Jul 6, 2026
16 checks passed
@khrm
khrm deleted the feat/networkpolicy-support branch July 6, 2026 15:45
@jkhelil jkhelil mentioned this pull request Jul 15, 2026
Open
5 tasks
@jkhelil jkhelil mentioned this pull request Aug 6, 2026
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkhelil jkhelil jkhelil left review comments
@pramodbindal pramodbindal pramodbindal approved these changes
@enarha enarha Awaiting requested review from enarha
@pratap0007 pratap0007 Awaiting requested review from pratap0007
+1 more reviewer
@infernus01 infernus01 infernus01 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@pramodbindal pramodbindal

@infernus01 infernus01

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesnt merit a release note. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@khrm @jkhelil @tekton-robot @pramodbindal @infernus01