feat(Tekton Multicluster ProxyAAE): onboard MulticlusterProxyAAE component #3201

mbpavan · 2026-02-05T13:18:42Z

Changes

This PR adds support for the Tekton Multicluster Proxy AAE component so it can be installed and managed by the operator when running as a multi-cluster Hub (with Tekton Scheduler and Kueue/MultiKueue).

Prerequisites

Kueue and MultiKueue (or equivalent) installed when using the proxy; at least one valid MultiKueueCluster (and kubeconfig secret) for the proxy to report Ready.

Manual Testing

Install on OpenShift and Kubernetes
Upgrade on OpenShift and Kubernetes
Enable and disable on OpenShift and Kubernetes
Functional validation on Hub (OCP) and Spoke (OCP), including checks on several API endpoints

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Run make test lint before submitting a PR
Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

New component Tekton Multicluster Proxy AAE for multi-cluster Hub setups: installs and manages the multicluster-proxy-aae deployment used with Tekton Scheduler and Kueue MultiKueue.
TektonConfig: When the Scheduler is enabled with multi-cluster and role set to Hub, TektonConfig automatically creates and reconciles the TektonMulticlusterProxyAAE CR. On Spoke clusters the proxy is not installed.

mbpavan · 2026-02-05T13:21:55Z

/kind feature

mbpavan · 2026-02-05T13:37:41Z

As part of testing I performed the following:

Install on OpenShift and Kubernetes
Upgrade on OpenShift and Kubernetes
Enable and disable on OpenShift and Kubernetes
Functional validation on Hub (OCP) and Spoke (OCP), including checks on several API endpoints

No E2E tests right now due to dependencies of components even outside of tekton ecosystem like multicluster

anithapriyanatarajan · 2026-02-06T14:46:22Z

@mbpavan - Please includes tests to make sure that proxy service behaves the expected way in hub and spoke cluster. https://github.com/tektoncd/operator/tree/main/test

mbpavan · 2026-02-06T15:24:15Z

@mbpavan - Please includes tests to make sure that proxy service behaves the expected way in hub and spoke cluster. https://github.com/tektoncd/operator/tree/main/test

#2934 (comment) - referring to this, we need mutlicluster setup done for running e2e which requites spoke, hub config and cer manager, keueue etc, so I refrained from e2e as plan is to add it in different repo

also for ProxyAAE specifically currently we have a dependency of installing hub and spoke along with Kueue and cert-manager manually,For the readiness probe on multicluster-proxy-aae, we need the secret and MultiKueue to be installed. So thinling of handling E2e later. Also this kind of setup is needed generally for multicluster component and much broder, would like to have more clarity to cover those as well to cover E2e. Due to these, would like to adress E2e in another PR later

jkhelil · 2026-02-08T14:47:18Z

pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/reconcile.go

+func (r *Reconciler) ensureDependenciesInstalled(proxy *v1alpha1.TektonMulticlusterProxyAAE) error {
+	if _, err := common.PipelineReady(r.pipelineInformer); err != nil {
+		if err.Error() == common.PipelineNotReady || err == v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR {
+			proxy.Status.MarkDependencyInstalling("tekton-pipelines is still installing")


s/tekton-pipelines is still installing/Waiting for TektonPipeline 'pipeline' to become ready

jkhelil · 2026-02-08T14:50:35Z

pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_validation_test.go

+)
+
+// Test_ValidateTektonMulticlusterProxyAAE is a placeholder for future validation tests.
+func Test_ValidateTektonMulticlusterProxyAAE(t *testing.T) {}


Add minimal test
func Test_ValidateTektonMulticlusterProxyAAE(t *testing.T) {
tests := []struct {
name string
proxy *TektonMulticlusterProxyAAE
wantErr bool
}{
{
name: "valid proxy",
proxy: &TektonMulticlusterProxyAAE{
ObjectMeta: metav1.ObjectMeta{
Name: MultiClusterProxyAAEResourceName,
},
Spec: TektonMulticlusterProxyAAESpec{
CommonSpec: CommonSpec{
TargetNamespace: "tekton-pipelines",
},
},
},
wantErr: false,
},
}
}

jkhelil · 2026-02-08T14:52:24Z

pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae.go

+
+// IsMulticlusterProxyAAEEnabled returns true when TektonMulticlusterProxyAAE should be deployed:
+// scheduler is not disabled, multi-cluster is enabled, and role is Hub.
+func IsMulticlusterProxyAAEEnabled(tc *v1alpha1.TektonConfig) bool {


Add unit tests

done. Added pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae_test.go

jkhelil · 2026-02-08T14:54:43Z

pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go

+	logger := logging.FromContext(ctx)
+
+	if err := r.manifest.Filter(mf.CRDs).Delete(); err != nil {
+		logger.Error("Failed to delete CRDs for TektonMulticlusterProxyAAE")


Add which crds are failed to delete
if err := r.manifest.Filter(mf.CRDs).Delete(); err != nil {
logger.Errorw("Failed to delete CRDs for TektonMulticlusterProxyAAE", "error", err)
return err
}

mbpavan · 2026-02-09T06:25:52Z

@jkhelil I have addressed your review comments, please check again

jkhelil · 2026-02-09T11:39:12Z

/approve

tekton-robot · 2026-02-09T11:39:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

anithapriyanatarajan

@mbpavan I attempted to enable scheduler and set the role to "" but got an error that certificate server should be installed. Then when I edited the Tektonconfig and set the role to "spoke" expecting the error to be removed, but the proxyinstallerset was stuck with the same error. Could you please clarify the expected behavior when scheduler is enabled and role set to empty & scheduler enabled and role set to spoke in sequence?

anithapriyanatarajan · 2026-02-10T07:40:27Z

docs/TektonConfig.md

+
+- `disabled`: set to `false` to enable the Scheduler component (default is `true`).
+- `multi-cluster-disabled`: when `false`, multi-cluster features are enabled (default is `true`).
+- `multi-cluster-role`: `Hub` or `Spoke`. When set to **Hub**, TektonConfig also creates and manages the [TektonMulticlusterProxyAAE](./TektonMulticlusterProxyAAE.md) component automatically (the proxy is used to communicate with spoke clusters, e.g. for [Kueue MultiKueue](https://kueue.sigs.k8s.io/docs/concepts/multikueue/)). On spoke clusters use `Spoke`; the proxy is not installed there.


what is the default behavior if the user neither mentions Hub or Spoke?

If the user doesn’t mention Hub or Spoke, the intended default behavior is: multi-cluster is disabled.
Hub or Spoke only need to be set when the user explicitly enables multi-cluster (multi-cluster-disabled: false); in that case they must set one of Hub or Spoke or the CR is invalid.

Could you please add a validation to explicitly error if multicluster is enabled and role value is set to empty appropriate validation error message is displayed?

We can take this up in a separate PR, as these are not introduced by this change and relate to general multi-cluster prerequisites and missing validation.
cc @pramodbindal
@pramodbindal can you add missing validation please and any doc changes needed for prereq in a separate PR

anithapriyanatarajan · 2026-02-10T07:43:11Z

docs/TektonMulticlusterProxyAAE.md

+
+- Scheduler is **not** disabled (`spec.scheduler.disabled` is not `true`).
+- Multi-cluster is **enabled** (`spec.scheduler.multi-cluster-disabled` is `false`).
+- Cluster role is **Hub** (`spec.scheduler.multi-cluster-role` is `Hub`).


While attempting to install the proxy, getting this error - "config devel False Components not in ready state: Please install cert-manager (cert-manager.io/v1) First, the server could not find the requested resource
" - Does that mean this is a pre-requisite? if so please update the document on this should be installed ?

Done. It is a prereq. I had added it to docs/TektonConfig.md, which was missed in #2934. This is a general prerequisite for multi-cluster.

I have also added it now to docs/TektonMulticlusterProxyAAE.md to avoid further confusion.

anithapriyanatarajan · 2026-02-10T07:50:55Z

pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go

+	logger := logging.FromContext(ctx)
+
+	if err := r.manifest.Filter(mf.CRDs).Delete(); err != nil {
+		logger.Errorw("Failed to delete CRDs for TektonMulticlusterProxyAAE", "error", err)


NIT: Please follow consistent error logging approach.

this is coming from other code review comment - #3201 (comment)

Err logging is fine. Please use either logger.Error or logger.Errorw

ahh ok ok, done

khrm

You need to update console plugin cr with service of MulticlusterProxyAAE

mbpavan · 2026-02-10T08:20:49Z

Just a general clarification in case there’s any confusion: tektonscheduler is not part of this change. It’s covered under #2934. I’m only adding it here because tektonconfig.md was missed there.
@anithapriyanatarajan . Please ignore if you already knew

khrm

Please check this PR: https://github.com/tektoncd/operator/pull/2545/changes

We need to add a proxy for the proxy entry for ProxyAAE also.

…onent

mbpavan · 2026-02-10T15:58:17Z

Please check this PR: https://github.com/tektoncd/operator/pull/2545/changes

We need to add a proxy for the proxy entry for ProxyAAE also.

thank you! I have added, can you check now please @khrm

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Feb 5, 2026

tekton-robot requested review from PuneetPunamiya and anithapriyanatarajan February 5, 2026 13:18

tekton-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesnt merit a release note. labels Feb 5, 2026

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Feb 5, 2026

mbpavan force-pushed the pbheeman-onboard branch from aa12d1d to c31262f Compare February 5, 2026 13:34

mbpavan force-pushed the pbheeman-onboard branch 2 times, most recently from 9164347 to 44a1b18 Compare February 5, 2026 14:00

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 6, 2026

jkhelil reviewed Feb 8, 2026

View reviewed changes

mbpavan force-pushed the pbheeman-onboard branch from 44a1b18 to e2b8285 Compare February 9, 2026 05:38

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 9, 2026

mbpavan force-pushed the pbheeman-onboard branch from e2b8285 to 851ad81 Compare February 9, 2026 05:39

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 9, 2026

anithapriyanatarajan reviewed Feb 10, 2026

View reviewed changes

khrm reviewed Feb 10, 2026

View reviewed changes

mbpavan force-pushed the pbheeman-onboard branch 3 times, most recently from 3f021c5 to 060a1ba Compare February 10, 2026 09:23

khrm reviewed Feb 10, 2026

View reviewed changes

feat(Tekton Multicluster ProxyAAE): onboard MulticlusterProxyAAE comp…

4b6e52c

…onent

mbpavan force-pushed the pbheeman-onboard branch from 060a1ba to 4b6e52c Compare February 10, 2026 15:57

feat(Tekton Multicluster ProxyAAE): onboard MulticlusterProxyAAE component #3201

Are you sure you want to change the base?

feat(Tekton Multicluster ProxyAAE): onboard MulticlusterProxyAAE component #3201

Uh oh!

Conversation

mbpavan commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Prerequisites

Manual Testing

Submitter Checklist

Release Notes

Uh oh!

mbpavan commented Feb 5, 2026

Uh oh!

mbpavan commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anithapriyanatarajan commented Feb 6, 2026

Uh oh!

mbpavan commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbpavan commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkhelil commented Feb 9, 2026

Uh oh!

tekton-robot commented Feb 9, 2026

Uh oh!

anithapriyanatarajan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbpavan Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbpavan Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

khrm left a comment

Choose a reason for hiding this comment

Uh oh!

mbpavan commented Feb 10, 2026

Uh oh!

khrm left a comment

Choose a reason for hiding this comment

Uh oh!

mbpavan commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

mbpavan commented Feb 5, 2026 •

edited

Loading

mbpavan commented Feb 5, 2026 •

edited

Loading

mbpavan commented Feb 6, 2026 •

edited

Loading

mbpavan commented Feb 9, 2026 •

edited

Loading

mbpavan Feb 10, 2026 •

edited

Loading

mbpavan Feb 10, 2026 •

edited

Loading

mbpavan commented Feb 10, 2026 •

edited

Loading