feat(manualapprovalgate): add NetworkPolicy support

[divyansh42]

Changes

Add default-deny, controller, and webhook NetworkPolicies for the ManualApprovalGate component, following the same pattern used by TektonTrigger and TektonPipeline. Policies are reconciled via a CustomSet and respect the spec.networkPolicy toggle for disabling and custom overrides. Includes validation, cleanup on CR deletion, e2e test, CRD schema updates, and documentation.

Assisted-by: Claude Opus 4.6 (via Cursor)

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

ManualApprovalGate now creates default NetworkPolicies that restrict ingress/egress for its controller and webhook pods. These are enabled by default. To opt out, set `spec.networkPolicy.disabled: true` on the ManualApprovalGate CR.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.36%. Comparing base (dfd582f) to head (7e33bbb).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3801      +/-   ##
==========================================
- Coverage   25.45%   25.36%   -0.10%     
==========================================
  Files         451      453       +2     
  Lines       23666    23750      +84     
==========================================
  Hits         6024     6024              
- Misses      16951    17035      +84     
  Partials      691      691              

Flag	Coverage Δ
unit-tests	25.36% <ø> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds first-class NetworkPolicy management for the ManualApprovalGate component, aligning it with existing operator support for TektonPipeline and TektonTrigger. It introduces default-deny plus workload-scoped policies, wires reconciliation/cleanup via an InstallerSet CustomSet, and exposes configuration via spec.networkPolicy on the ManualApprovalGate CR.

Changes:

• Add reconciliation + finalizer cleanup for ManualApprovalGate NetworkPolicies using a CustomSet("mag-network-policies", ...).
• Extend the ManualApprovalGate API with spec.networkPolicy including validation + deepcopy generation, and update CRD schemas/Helm templates accordingly.
• Add e2e coverage and update NetworkPolicy documentation to include ManualApprovalGate defaults and configuration.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/e2e/common/06_manualapprovalgate_networkpolicy_test.go	Adds an e2e test that asserts MAG NetworkPolicies are created by default and removed/restored when toggling spec.networkPolicy.disabled.
pkg/reconciler/kubernetes/manualapprovalgate/reconcile.go	Invokes NetworkPolicy reconciliation after the main InstallerSet is applied.
pkg/reconciler/kubernetes/manualapprovalgate/networkpolicies.go	Defines default MAG NetworkPolicies and reconciles them via an InstallerSet CustomSet, respecting spec.networkPolicy.disabled and overrides.
pkg/reconciler/kubernetes/manualapprovalgate/finalize.go	Cleans up the MAG NetworkPolicy CustomSet on CR deletion.
pkg/reconciler/kubernetes/manualapprovalgate/controller.go	Initializes platform-specific NetworkPolicy parameters (Kubernetes vs OpenShift) for rule generation.
pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go	Ensures ManualApprovalGateSpec.NetworkPolicy is deep-copied.
pkg/apis/operator/v1alpha1/manualapprovalgate_validation.go	Adds validation for one-instance naming plus spec.networkPolicy validation.
pkg/apis/operator/v1alpha1/manualapprovalgate_types.go	Adds the networkPolicy field to the ManualApprovalGate spec.
docs/NetworkPolicy.md	Documents the new MAG policies and configuration on the MAG CR.
config/base/generated-crds/operator.tekton.dev_manualapprovalgates.yaml	Updates the generated CRD schema to include spec.networkPolicy.
charts/tekton-operator/templates/openshift-crds.yaml	Updates Helm-rendered OpenShift CRD schema for spec.networkPolicy.
charts/tekton-operator/templates/kubernetes-crds.yaml	Updates Helm-rendered Kubernetes CRD schema for spec.networkPolicy.

Files not reviewed (1)

• pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[divyansh42]

I have manually tested this on OpenShift.

[jkhelil]

/kind misc

[khrm]

Did you run code gen ?

[divyansh42]

Did you run code gen ?

Yes, it is already done.

[khrm]

Please rebase with main.

[divyansh42]

Please rebase with main.

Done

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[enarha]

/lgtm