fix: block system namespace creation by krishhlogan · Pull Request #2940 · tektoncd/pipelines-as-code

krishhlogan · 2026-08-27T11:42:45Z

📝 Description of the Change

Add validation in tkn pac to restrict repository creation in system namespaces (kube-, openshift-, tekton-*, tekton-pipelines, openshift-pipelines)

The checkSystemNamespace helper is called at two points:

When --namespace flag is passed explicitly
After the user selects a namespace via the interactive prompt

Behaviour by namespace:

openshift-pipelines, tekton-pipelines — error, not supported as targets
openshift-* prefix — error, system namespaces are not supported
tekton-* prefix — warning shown, user can still proceed
kube-* prefix — warning shown, user can still proceed

🔗 Linked GitHub Issue

Fixes #1350

🧪 Testing Strategy

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

linux-foundation-easycla · 2026-08-27T11:42:51Z

The committers listed above are authorized under a signed CLA.

✅ login: krishhlogan / name: krishhlogan (94f94ff, cbd211c)

theakshaypant

Thanks @krishhlogan for picking this up!
request you to remove the jira references and sign the CLA.

krishhlogan · 2026-08-27T12:13:26Z

done @theakshaypant

theakshaypant

Thanks @krishhlogan ! As a follow up to earlier request

Please squash your commits into a single one
Amend the message on the first commit top remove jira reference

krishhlogan · 2026-08-31T05:43:06Z

done @theakshaypant

theakshaypant · 2026-08-31T08:45:41Z

/ok-to-test

theakshaypant

Overall looks fine, only recommend adding a couple more test cases for completeness.

zakisk · 2026-09-01T05:23:11Z

@krishhlogan can you please ensure always squashing your commits into one and rebasing with upstream/main

zakisk · 2026-09-01T05:24:28Z

/ok-to-test

codecov · 2026-09-01T05:25:41Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.66%. Comparing base (aeed7ee) to head (97ceb08).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2940   +/-   ##
=======================================
  Coverage   80.66%   80.66%           
=======================================
  Files         164      164           
  Lines       13910    13910           
=======================================
  Hits        11221    11221           
  Misses       1967     1967           
  Partials      722      722

Flag	Coverage Δ
unit-tests	`80.66% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

krishhlogan · 2026-09-01T05:31:12Z

@krishhlogan can you please ensure always squashing your commits into one and rebasing with upstream/main

@zakisk Sure, will do! Thanks for the heads up

Prevent tkn pac create repo from creating repositories in system namespaces where the default service account is not auto-created and pipelines would fail. - openshift-pipelines, tektoncd-pipelines: return error - openshift-* prefix: return error (system namespaces) - kube-* prefix: show warning, allow with confirmation Signed-off-by: krishhlogan <kloganat@redhat.com> Assisted-by: Claude Sonnet 4.6 (via Claude Code) fix: use correct tekton system namespace name Replace tektoncd-pipelines with tekton-pipelines which is the actual namespace used by Tekton Pipelines installation. Signed-off-by: krishhlogan <kloganat@redhat.com> fix: warn on tekton- prefixed system namespaces Add warning for tekton-* namespaces (other than tekton-pipelines) similar to kube-* handling. tekton-pipelines remains an error. Signed-off-by: krishhlogan <kloganat@redhat.com>

chmouel · 2026-09-04T09:00:54Z

/ok-to-test

chmouel · 2026-09-04T09:01:00Z

/paco review

pipelines-as-code · 2026-09-04T09:02:20Z

Paco Review 🔍

This PR adds a checkSystemNamespace helper in the tknpac repository create command to prevent (or warn about) creating Pipelines-as-Code Repository CRs in Kubernetes/OpenShift/Tekton system namespaces, wiring it into both the flag-based and interactive-prompt namespace resolution paths in getOrCreateNamespace. It also adds a substantial set of table-driven tests covering the new hard-error and warning behaviors for each namespace prefix.

Review difficulty: 2/5 (Easy) — The change is small and localized to one file plus tests, with a straightforward helper function and two call sites.

1 new inline comment(s) found.

_{Reviewed commit: 97ceb08}

pipelines-as-code

Paco inline comments -- see the Paco Review summary comment for the overview.

pipelines-as-code · 2026-09-04T09:02:30Z

+	}
+	if strings.HasPrefix(ns, "openshift-") {
+		return fmt.Errorf("cannot create a repository in namespace %s as system namespaces are not supported", ns)
+	}


[MEDIUM] The system-namespace protection is applied inconsistently: any openshift--prefixed namespace is hard-blocked, but kube--prefixed namespaces (e.g. kube-system, kube-public, kube-node-lease — arguably the most sensitive Kubernetes system namespaces) and non-exact tekton--prefixed namespaces only produce a warning and still allow repository creation to proceed. If the intent of this change is to prevent accidental repository creation in system namespaces, kube- should likely be hard-blocked the same way openshift- is, rather than just warned about.

Copilot

🟡 Changes recommended

The exact reserved openshift namespace remains allowed and must be rejected.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds safeguards for repository creation in system namespaces.

Changes:

Validates explicit and interactively selected namespaces.
Rejects pipeline and openshift-* namespaces; warns for kube-* and tekton-*.
Adds unit tests for both selection paths.

File summaries

File	Review
`pkg/cmd/tknpac/create/repository.go`	Moderate (1 vote): Exact `openshift` namespace is not rejected. Nit (2 votes): Update the validation comment to accurately distinguish errors from warnings.
`pkg/cmd/tknpac/create/repository_test.go`	Adds coverage for rejected and warned namespaces.

Review details

Files reviewed: 2/2 changed files
Comments generated: 2
Review effort level: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+	if ns == "openshift-pipelines" || ns == "tekton-pipelines" {
+		return fmt.Errorf("namespace %s is not supported as a target for repositories", ns)
+	}
+	if strings.HasPrefix(ns, "openshift-") {


 	return repoName, repoNamespace, err
 }

+// checkSystemNamespace returns an error for system namespaces and prints a warning for kube-* prefixes.


theakshaypant reviewed Aug 27, 2026

View reviewed changes

krishhlogan changed the title ~~fix(SRVKP-13948): block system namespace creation~~ fix: block system namespace creation Aug 27, 2026

theakshaypant added the ok-to-test label Aug 31, 2026

tekton-pac-bot removed the ok-to-test label Aug 31, 2026

theakshaypant reviewed Aug 31, 2026

View reviewed changes

krishhlogan force-pushed the fix/block-system-namespace-repo-creation branch from cbd211c to 60eea39 Compare August 31, 2026 05:41

theakshaypant added the ok-to-test label Aug 31, 2026

tekton-pac-bot removed the ok-to-test label Aug 31, 2026

theakshaypant reviewed Sep 1, 2026

View reviewed changes

Comment thread pkg/cmd/tknpac/create/repository_test.go

zakisk reviewed Sep 1, 2026

View reviewed changes

Comment thread pkg/cmd/tknpac/create/repository.go Outdated

krishhlogan requested review from theakshaypant and zakisk September 1, 2026 05:19

zakisk force-pushed the fix/block-system-namespace-repo-creation branch from 3f87590 to 1e1f7da Compare September 1, 2026 05:23

zakisk added the ok-to-test label Sep 1, 2026

tekton-pac-bot removed the ok-to-test label Sep 1, 2026

zakisk reviewed Sep 1, 2026

View reviewed changes

Comment thread pkg/cmd/tknpac/create/repository.go

theakshaypant reviewed Sep 1, 2026

View reviewed changes

Comment thread pkg/cmd/tknpac/create/repository.go

Comment thread pkg/cmd/tknpac/create/repository.go

krishhlogan force-pushed the fix/block-system-namespace-repo-creation branch from 1e1f7da to 97ceb08 Compare September 2, 2026 08:11

krishhlogan requested review from theakshaypant and zakisk September 2, 2026 08:16

chmouel added the ok-to-test label Sep 4, 2026

tekton-pac-bot removed the ok-to-test label Sep 4, 2026

chmouel requested a balanced review from Copilot September 4, 2026 09:00

Copilot started reviewing on behalf of chmouel September 4, 2026 09:01 View session

pipelines-as-code Bot added paco/review-easy Paco review difficulty security-review Flagged as security-sensitive by Paco labels Sep 4, 2026

pipelines-as-code Bot reviewed Sep 4, 2026

View reviewed changes

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Uh oh!

Conversation

krishhlogan commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

🔗 Linked GitHub Issue

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

linux-foundation-easycla Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

krishhlogan commented Aug 27, 2026

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

krishhlogan commented Aug 31, 2026

Uh oh!

theakshaypant commented Aug 31, 2026

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

zakisk commented Sep 1, 2026

Uh oh!

zakisk commented Sep 1, 2026

Uh oh!

codecov Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

krishhlogan commented Sep 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chmouel commented Sep 4, 2026

Uh oh!

chmouel commented Sep 4, 2026

Uh oh!

pipelines-as-code Bot commented Sep 4, 2026

Paco Review 🔍

Uh oh!

pipelines-as-code Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pipelines-as-code Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

krishhlogan commented Aug 27, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Aug 27, 2026 •

edited

Loading

codecov Bot commented Sep 1, 2026 •

edited

Loading