Tekton Multicluster Proxy AAE

TektonMulticlusterProxyAAE deploys the multicluster-proxy-aae component used in multi-cluster setups with Tekton Kueue and Kueue. The proxy runs on the Hub cluster and communicates with Spoke clusters (e.g. via MultiKueue).

It is recommended to install this component through TektonConfig by enabling Tekton Kueue with multi-cluster and setting the cluster role to Hub. TektonConfig will create and reconcile the TektonMulticlusterProxyAAE CR automatically; you do not need to create it manually when using TektonConfig.

When is TektonMulticlusterProxyAAE installed?

TektonConfig creates and manages TektonMulticlusterProxyAAE only when all of the following are true:

  • Tekton Kueue is not disabled (spec.kueue.disabled is not true).
  • Multi-cluster is enabled (spec.kueue.multi-cluster-disabled is false).
  • Cluster role is Hub (spec.kueue.multi-cluster-role is Hub).

On Spoke clusters, leave multi-cluster-role as Spoke; the proxy is not installed there.

Prerequisites

The proxy is only installed when the Tekton Kueue is enabled with multi-cluster (Hub role). cert-manager and Kueue (and MultiKueue for the proxy) are required for Tekton Kueue and multi-cluster in general; you must install them before enabling Tekton Kueue. For full prerequisites and multi-cluster configuration, see Tekton Kueue. TektonConfig (Tekton Kueue section) also summarizes this and points to Tekton Kueue.

If you see a config status error such as:

Components not in ready state: Please install cert-manager (cert-manager.io/v1) First, the server could not find the requested resource

cert-manager is not installed or its APIs are not available. Install cert-manager (v1 API) and ensure Kueue (and for the proxy, MultiKueue) are installed as described in Tekton Kueue, then re-apply or reconcile TektonConfig.

  • The proxy’s readiness endpoint returns ready only when at least one worker cluster is registered; ensure you have at least one valid MultiKueueCluster (and corresponding kubeconfig secret in kueue-system) if you want the proxy to report Ready.

TektonMulticlusterProxyAAE CR

The TektonMulticlusterProxyAAE CR is cluster-scoped. When managed by TektonConfig, the operator creates a single instance named multicluster-proxy-aae.

Example (for reference; TektonConfig creates this when kueue multi-cluster Hub is enabled):

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonMulticlusterProxyAAE
metadata:
  name: multicluster-proxy-aae
spec:
  targetNamespace: tekton-pipelines   # or openshift-pipelines on OpenShift
  options: {}

Properties

  • targetNamespace: Namespace where the proxy deployment and related resources are installed (e.g. tekton-pipelines or openshift-pipelines). Set via TektonConfig when the CR is created by the operator.
  • options: Optional AdditionalOptions for customizing deployments, ConfigMaps, or webhook configuration.

Checking installation status

kubectl get tektonmulticlusterproxyaaes.operator.tekton.dev
# or
oc get tektonmulticlusterproxyaaes.operator.tekton.dev

Check the proxy deployment and pods in the target namespace (e.g. openshift-pipelines or tekton-pipelines):

kubectl get deployment -n <target-namespace> -l app.kubernetes.io/component=proxy-aae
kubectl get pods -n <target-namespace> -l app.kubernetes.io/component=proxy-aae

Standalone installation

If you are not using TektonConfig (e.g. you manage kueue and multi-cluster yourself), you can create a TektonMulticlusterProxyAAE CR manually. Ensure the cluster has Kueue and MultiKueue APIs and that the operator is installed; the operator will reconcile the CR and deploy the proxy in the specified targetNamespace.