NetworkPolicy

The operator can manage NetworkPolicy resources for Tekton component workloads. Currently TektonPipeline (core controllers, resolvers, and proxy-webhook) and TektonTrigger are supported; other components will be added later.

Configuration is available via TektonConfig:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  networkPolicy:
    disabled: false          # set to true to remove all managed NetworkPolicies
    policies:                # override or add policies by name
      triggers-controller:   # replaces the default triggers-controller policy
        podSelector:
          matchLabels:
            app: tekton-triggers-controller
        policyTypes: [Ingress]
        ingress:
          - ports:
              - port: 9000

The networkPolicy field is propagated from TektonConfig to TektonTrigger and TektonPipeline. Users can also configure it directly on the TektonTrigger or TektonPipeline CR.

Default Policies

When NetworkPolicy is enabled (the default), the following policies are applied to the operand namespace (e.g. tekton-pipelines or openshift-pipelines):

TektonPipeline

TektonTrigger

Console Plugin (OpenShift only)

The console plugin is a static file server (nginx) — all API calls run in the user’s browser via the OpenShift Console’s proxy, not on this pod.

These are static manifests shipped with the TektonConfig console plugin resources, not reconciled via spec.networkPolicy.

All policies above are applied to the operand namespace (e.g. tekton-pipelines or openshift-pipelines). They do not cover the operator’s own namespace (tekton-operator / openshift-operators), which ships fixed, non-configurable NetworkPolicies as part of the operator’s own install manifests/bundle (see Operator’s own namespace below).

Platform differences

Operator’s own namespace

The operator’s own namespace (tekton-operator on Kubernetes, openshift-operators on OpenShift) ships two fixed NetworkPolicies as static manifests alongside the operator’s Deployment/RBAC — in config/kubernetes/base/networkpolicy.yaml and config/openshift/base/networkpolicy.yaml respectively. These are not reconciled by a controller and are not configurable via spec.networkPolicy: no CR watches the operator’s own namespace, so there is nothing to gate this on. They are also not a namespace-wide default-deny — each policy’s podSelector is scoped to one of the operator’s own pods (name: tekton-operator / name: openshift-pipelines-operator for the main controller, and name: tekton-operator-webhook for the CR admission webhook) so that installing the operator’s bundle never affects unrelated pods that might share the namespace (openshift-operators in particular is commonly shared by many operators).

OpenShift caveat: openshift-operators is a shared namespace where OLM installs operators from OperatorHub, many of which ship no NetworkPolicy of their own. To avoid silently breaking those operators’ networking, OpenShift’s platform payload ships a permissive default-allow-all NetworkPolicy in that namespace out of the box (labeled capability.openshift.io/name: OperatorLifecycleManager), with an empty podSelector allowing all ingress/egress for every pod in the namespace. Because NetworkPolicy rules are additive (a pod’s allowed traffic is the union of every policy that selects it, not the intersection), this platform-shipped policy supersedes the two policies above in practice — the operator’s own pods remain fully open on a stock OpenShift cluster until a cluster admin removes or replaces default-allow-all. The openshift-pipelines (operand) namespace has no such baseline policy, so the proxy-webhook policies further up this page are enforced as documented without this caveat.

Disabling

spec:
  networkPolicy:
    disabled: true

This removes all managed NetworkPolicies from the operand namespace.

Overriding a policy

Entries in spec.networkPolicy.policies replace or add policies by name. To override a default policy, use the same name (e.g. triggers-controller). New names add additional policies alongside the defaults.