Repository: tektoncd/operator
Pull request #787 (2022-05-14 09:40:02)

[openshift] [cherry-pick] Improve/rbac reconciling
# Changes

[OpenShift] Fix RBAC bugs

- Rename rolebinding created by RBAC reconciler to
  'openshift-pipelines-edit' (was 'edit' earlier)

- Add mechanism to ensure that missing RBAC resources are recreated if
  the RBAC installerSet is recreated during an upgrade.
- this ensures that RBAC in the version label in RBAC reconciled
  namespaces are removed during an upgrade and the presence of RBAC
  resources are verified

- Make TektonConfig reconciler listen to TektonInstallerSet events so
  that it can recreate RBAC InstallerSet if it is deleted manually from
  a cluster

- Add a mechanism to remove ownerReference and 'pipeline' sa subject
  from 'edit' rolebinding in namespaces
  - This ensures that operator upgrades won't delete/reset 'edit'
    rolebinding in usernamespaces.

Remove redundant 'UpdateStatus()' calls
    
Remove redundant UpdateStatus calls as UpdateStaus api call is carried
out by knative/pkg generated code at the end of each reconcile loop

[openshift] Use label selectors to find RBAC instalelr set name

Use labelselectr based list query to find the existing RBAC installerset
name, instead of looking it up from a map in tektonconfig.status.

Kubernetes being "optimistically consistent" we cannot guarantee that
the value in tektonconfig status will be updated withing a predictable
time or that whether/when the update will pass or fail.
    
List queries based on label selectors is more reliable

[openshift] Fix upgrade: Tektonconfig staying in Ready: False

Repalce metada.name with metadata.generateName in rbac installerSet creation

Add a mechanism to remove constant name based rbac installer set before an upgrade

[openshift] Fix rbac disable not working bug

Make the delete rbac installerSet logic use labelSelctor based `DeleteCollection` instead of
constant name based `Delete`.

<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **nikhil-thomas**
You can assign the PR to them by writing `/assign @nikhil-thomas` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.50.x/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["nikhil-thomas"]} -->
tekton-robot: @nikhil-thomas: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @nikhil-thomas: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @nikhil-thomas: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-build-tests/1525410662841323521/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @nikhil-thomas: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-build-tests/1525410662841323521/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @nikhil-thomas: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-build-tests/1525410662841323521/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-integration-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-integration-tests/1525410662837129217/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @nikhil-thomas: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-unit-tests/1525410662841323520/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-build-tests/1525410662841323521/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-integration-tests | 5498da0c5a7d56328f61d9caa3f51f7348edd752 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/787/pull-tekton-operator-integration-tests/1525410662837129217/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/787). [Your PR dashboard](https://prow.tekton.dev/pr/nikhil-thomas).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
concaf: /lgtm

Patch:
diff --git a/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go b/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
index a33dc9fb0..a55ef69a5 100644
--- a/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
+++ b/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
@@ -297,16 +297,7 @@ func (r *Reconciler) updateTektonDashboardStatus(ctx context.Context, td *v1alph
 	// update the td with TektonInstallerSet and releaseVersion
 	td.Status.SetTektonInstallerSet(createdIs.Name)
 	td.Status.SetVersion(r.dashboardVersion)
-
-	// Update the status with TektonInstallerSet so that any new thread
-	// reconciling with know that TektonInstallerSet is created otherwise
-	// there will be 2 instance created if we don't update status here
-	if _, err := r.operatorClientSet.OperatorV1alpha1().TektonDashboards().
-		UpdateStatus(ctx, td, metav1.UpdateOptions{}); err != nil {
-		return err
-	}
-
-	return v1alpha1.RECONCILE_AGAIN_ERR
+	return nil
 }
 
 // transform mutates the passed manifest to one with common, component
diff --git a/pkg/reconciler/kubernetes/tektonpipeline/tektonpipeline.go b/pkg/reconciler/kubernetes/tektonpipeline/tektonpipeline.go
index f771da65d..e000db008 100644
--- a/pkg/reconciler/kubernetes/tektonpipeline/tektonpipeline.go
+++ b/pkg/reconciler/kubernetes/tektonpipeline/tektonpipeline.go
@@ -18,7 +18,6 @@ package tektonpipeline
 
 import (
 	"context"
-	stdError "errors"
 	"fmt"
 	"time"
 
@@ -308,16 +307,7 @@ func (r *Reconciler) updateTektonPipelineStatus(ctx context.Context, tp *v1alpha
 	// update the tp with TektonInstallerSet and releaseVersion
 	tp.Status.SetTektonInstallerSet(createdIs.Name)
 	tp.Status.SetVersion(r.pipelineVersion)
-
-	// Update the status with TektonInstallerSet so that any new thread
-	// reconciling with know that TektonInstallerSet is created otherwise
-	// there will be 2 instance created if we don't update status here
-	if _, err := r.operatorClientSet.OperatorV1alpha1().TektonPipelines().
-		UpdateStatus(ctx, tp, metav1.UpdateOptions{}); err != nil {
-		return err
-	}
-
-	return stdError.New("ensuring Reconcile TektonPipeline status update")
+	return nil
 }
 
 func (r *Reconciler) createInstallerSet(ctx context.Context, tp *v1alpha1.TektonPipeline) (*v1alpha1.TektonInstallerSet, error) {
diff --git a/pkg/reconciler/kubernetes/tektontrigger/tektontrigger.go b/pkg/reconciler/kubernetes/tektontrigger/tektontrigger.go
index 1ef35e284..743343dbf 100644
--- a/pkg/reconciler/kubernetes/tektontrigger/tektontrigger.go
+++ b/pkg/reconciler/kubernetes/tektontrigger/tektontrigger.go
@@ -18,7 +18,6 @@ package tektontrigger
 
 import (
 	"context"
-	stdError "errors"
 	"fmt"
 	"time"
 
@@ -348,16 +347,7 @@ func (r *Reconciler) updateTektonTriggerStatus(ctx context.Context, tt *v1alpha1
 	// update the tt with TektonInstallerSet and releaseVersion
 	tt.Status.SetTektonInstallerSet(createdIs.Name)
 	tt.Status.SetVersion(r.triggersVersion)
-
-	// Update the status with TektonInstallerSet so that any new thread
-	// reconciling with know that TektonInstallerSet is created otherwise
-	// there will be 2 instance created if we don't update status here
-	if _, err := r.operatorClientSet.OperatorV1alpha1().TektonTriggers().
-		UpdateStatus(ctx, tt, metav1.UpdateOptions{}); err != nil {
-		return err
-	}
-
-	return stdError.New("ensuring Reconcile TektonTrigger status update")
+	return nil
 }
 
 func (r *Reconciler) createInstallerSet(ctx context.Context, tt *v1alpha1.TektonTrigger) (*v1alpha1.TektonInstallerSet, error) {
diff --git a/pkg/reconciler/openshift/tektonconfig/common.go b/pkg/reconciler/openshift/tektonconfig/common.go
index eb02f686e..ec88685ff 100644
--- a/pkg/reconciler/openshift/tektonconfig/common.go
+++ b/pkg/reconciler/openshift/tektonconfig/common.go
@@ -18,17 +18,17 @@ package tektonconfig
 
 import (
 	"context"
-
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
+	"github.com/tektoncd/operator/pkg/reconciler/common"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func createInstallerSet(ctx context.Context, oc versioned.Interface, tc *v1alpha1.TektonConfig, labels map[string]string,
-	releaseVersion, component, installerSetName string) error {
+func createInstallerSet(ctx context.Context, oc versioned.Interface, tc *v1alpha1.TektonConfig, releaseVersion string) error {
 
-	is := makeInstallerSet(tc, installerSetName, releaseVersion, labels)
+	is := makeInstallerSet(tc, releaseVersion)
 
 	createdIs, err := oc.OperatorV1alpha1().TektonInstallerSets().
 		Create(ctx, is, metav1.CreateOptions{})
@@ -41,31 +41,21 @@ func createInstallerSet(ctx context.Context, oc versioned.Interface, tc *v1alpha
 	}
 
 	// Update the status of tektonConfig with created installerSet name
-	tc.Status.TektonInstallerSet[component] = createdIs.Name
+	tc.Status.TektonInstallerSet[rbacInstallerSetType] = createdIs.Name
 	tc.Status.SetVersion(releaseVersion)
-
-	return updateTektonConfigStatus(ctx, oc, tc)
-}
-
-func updateTektonConfigStatus(ctx context.Context, oc versioned.Interface, tc *v1alpha1.TektonConfig) error {
-
-	_, err := oc.OperatorV1alpha1().TektonConfigs().
-		UpdateStatus(ctx, tc, metav1.UpdateOptions{})
-	if err != nil {
-		return err
-	}
-
-	// here we return an error intentionally so that we reconcile again
-	// and proceed further with updated object instead
-	return v1alpha1.RECONCILE_AGAIN_ERR
+	return nil
 }
 
-func makeInstallerSet(tc *v1alpha1.TektonConfig, name, releaseVersion string, labels map[string]string) *v1alpha1.TektonInstallerSet {
+func makeInstallerSet(tc *v1alpha1.TektonConfig, releaseVersion string) *v1alpha1.TektonInstallerSet {
 	ownerRef := *metav1.NewControllerRef(tc, tc.GetGroupVersionKind())
 	return &v1alpha1.TektonInstallerSet{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:   name,
-			Labels: labels,
+			GenerateName: rbacInstallerSetNamePrefix,
+			Labels: map[string]string{
+				v1alpha1.CreatedByKey:      createdByValue,
+				v1alpha1.InstallerSetType:  rbacInstallerSetType,
+				v1alpha1.ReleaseVersionKey: releaseVersion,
+			},
 			Annotations: map[string]string{
 				v1alpha1.ReleaseVersionKey:  releaseVersion,
 				v1alpha1.TargetNamespaceKey: tc.Spec.TargetNamespace,
@@ -76,25 +66,18 @@ func makeInstallerSet(tc *v1alpha1.TektonConfig, name, releaseVersion string, la
 }
 
 func deleteInstallerSet(ctx context.Context, oc versioned.Interface, tc *v1alpha1.TektonConfig, component string) error {
-
-	compInstallerSet, ok := tc.Status.TektonInstallerSet[component]
-	if !ok {
-		return nil
+	labelSelector, err := common.LabelSelector(rbacInstallerSetSelector)
+	if err != nil {
+		return err
 	}
-
-	if compInstallerSet != "" {
-		// delete the installer set
-		err := oc.OperatorV1alpha1().TektonInstallerSets().
-			Delete(ctx, tc.Status.TektonInstallerSet[component], metav1.DeleteOptions{})
-		if err != nil && !errors.IsNotFound(err) {
-			return err
-		}
-
-		// clear the name of installer set from TektonConfig status
-		delete(tc.Status.TektonInstallerSet, component)
-
-		return updateTektonConfigStatus(ctx, oc, tc)
+	err = oc.OperatorV1alpha1().TektonInstallerSets().DeleteCollection(ctx, metav1.DeleteOptions{}, metav1.ListOptions{
+		LabelSelector: labelSelector,
+	})
+	if err != nil {
+		return err
 	}
+	// clear the name of installer set from TektonConfig status
+	delete(tc.Status.TektonInstallerSet, component)
 
 	return nil
 }
@@ -103,40 +86,43 @@ func deleteInstallerSet(ctx context.Context, oc versioned.Interface, tc *v1alpha
 // and if installer set which already exist is of older version then it deletes and return false to create a new
 // installer set
 func checkIfInstallerSetExist(ctx context.Context, oc versioned.Interface, relVersion string,
-	tc *v1alpha1.TektonConfig, component string) (bool, error) {
+	tc *v1alpha1.TektonConfig) (*v1alpha1.TektonInstallerSet, error) {
 
-	// Check if installer set is already created
-	compInstallerSet, ok := tc.Status.TektonInstallerSet[component]
-	if !ok {
-		return false, nil
+	labelSelector, err := common.LabelSelector(rbacInstallerSetSelector)
+	if err != nil {
+		return nil, err
+	}
+	existingInstallerSet, err := tektoninstallerset.CurrentInstallerSetName(ctx, oc, labelSelector)
+	if err != nil {
+		return nil, err
+	}
+	if existingInstallerSet == "" {
+		return nil, nil
 	}
 
-	if compInstallerSet != "" {
-		// if already created then check which version it is
-		ctIs, err := oc.OperatorV1alpha1().TektonInstallerSets().
-			Get(ctx, compInstallerSet, metav1.GetOptions{})
-		if err != nil {
-			if errors.IsNotFound(err) {
-				return false, nil
-			}
-			return false, err
+	// if already created then check which version it is
+	ctIs, err := oc.OperatorV1alpha1().TektonInstallerSets().
+		Get(ctx, existingInstallerSet, metav1.GetOptions{})
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return nil, nil
 		}
+		return nil, err
+	}
 
-		if version, ok := ctIs.Annotations[v1alpha1.ReleaseVersionKey]; ok && version == relVersion {
-			// if installer set already exist and release version is same
-			// then ignore and move on
-			return true, nil
-		}
+	if version, ok := ctIs.Annotations[v1alpha1.ReleaseVersionKey]; ok && version == relVersion {
+		// if installer set already exist and release version is same
+		// then ignore and move on
+		return ctIs, nil
+	}
 
-		// release version doesn't exist or is different from expected
-		// deleted existing InstallerSet and create a new one
+	// release version doesn't exist or is different from expected
+	// deleted existing InstallerSet and create a new one
 
-		err = oc.OperatorV1alpha1().TektonInstallerSets().
-			Delete(ctx, compInstallerSet, metav1.DeleteOptions{})
-		if err != nil {
-			return false, err
-		}
+	err = oc.OperatorV1alpha1().TektonInstallerSets().
+		Delete(ctx, existingInstallerSet, metav1.DeleteOptions{})
+	if err != nil {
+		return nil, err
 	}
-
-	return false, nil
+	return nil, v1alpha1.RECONCILE_AGAIN_ERR
 }
diff --git a/pkg/reconciler/openshift/tektonconfig/extension.go b/pkg/reconciler/openshift/tektonconfig/extension.go
index 88db04a48..15d1f3a9d 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension.go
@@ -73,7 +73,7 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.Tekto
 		// then disable auto creation of RBAC resources by deleting installerSet
 		if v.Name == rbacParamName && v.Value == "false" {
 			createRBACResource = false
-			if err := deleteInstallerSet(ctx, r.operatorClientSet, r.tektonConfig, componentName); err != nil {
+			if err := deleteInstallerSet(ctx, r.operatorClientSet, r.tektonConfig, componentNameRBAC); err != nil {
 				return err
 			}
 			// remove openshift-pipelines.tekton.dev/namespace-reconcile-version label from namespaces while deleting RBAC resources.
@@ -83,10 +83,16 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.Tekto
 		}
 	}
 
+	// TODO: Remove this after v0.55.0 release, by following a depreciation notice
+	// --------------------
+	if err := r.cleanUpRBACNameChange(ctx); err != nil {
+		return err
+	}
+	// --------------------
+
 	if createRBACResource {
 		return r.createResources(ctx)
 	}
-
 	return nil
 }
 
diff --git a/pkg/reconciler/openshift/tektonconfig/rbac.go b/pkg/reconciler/openshift/tektonconfig/rbac.go
index 2b6771f90..418d11cdf 100644
--- a/pkg/reconciler/openshift/tektonconfig/rbac.go
+++ b/pkg/reconciler/openshift/tektonconfig/rbac.go
@@ -19,6 +19,7 @@ package tektonconfig
 import (
 	"context"
 	"fmt"
+	"math"
 	"regexp"
 
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
@@ -34,17 +35,34 @@ import (
 )
 
 const (
-	pipelinesSCCClusterRole  = "pipelines-scc-clusterrole"
-	pipelinesSCCRoleBinding  = "pipelines-scc-rolebinding"
-	pipelinesSCC             = "pipelines-scc"
-	pipelineSA               = "pipeline"
-	serviceCABundleConfigMap = "config-service-cabundle"
-	trustedCABundleConfigMap = "config-trusted-cabundle"
-	clusterInterceptors      = "openshift-pipelines-clusterinterceptors"
-	namespaceVersionLabel    = "openshift-pipelines.tekton.dev/namespace-reconcile-version"
-	createdByValue           = "RBAC"
-	componentName            = "rhosp-rbac"
-	rbacParamName            = "createRbacResource"
+	pipelinesSCCClusterRole = "pipelines-scc-clusterrole"
+	pipelinesSCCRoleBinding = "pipelines-scc-rolebinding"
+	pipelinesSCC            = "pipelines-scc"
+	pipelineSA              = "pipeline"
+	PipelineRoleBinding     = "openshift-pipelines-edit"
+	// TODO: Remove this after v0.55.0 release, by following a depreciation notice
+	// --------------------
+	pipelineRoleBindingOld  = "edit"
+	rbacInstallerSetNameOld = "rbac-resources"
+	// --------------------
+	serviceCABundleConfigMap   = "config-service-cabundle"
+	trustedCABundleConfigMap   = "config-trusted-cabundle"
+	clusterInterceptors        = "openshift-pipelines-clusterinterceptors"
+	namespaceVersionLabel      = "openshift-pipelines.tekton.dev/namespace-reconcile-version"
+	createdByValue             = "RBAC"
+	componentNameRBAC          = "rhosp-rbac"
+	rbacInstallerSetType       = "rhosp-rbac"
+	rbacInstallerSetNamePrefix = "rhosp-rbac-"
+	rbacParamName              = "createRbacResource"
+)
+
+var (
+	rbacInstallerSetSelector = metav1.LabelSelector{
+		MatchLabels: map[string]string{
+			v1alpha1.CreatedByKey:     createdByValue,
+			v1alpha1.InstallerSetType: componentNameRBAC,
+		},
+	}
 )
 
 // Namespace Regex to ignore the namespace for creating rbac resources.
@@ -80,6 +98,36 @@ func (r *rbac) cleanUp(ctx context.Context) error {
 	return nil
 }
 
+func (r *rbac) EnsureRBACInstallerSet(ctx context.Context) (*v1alpha1.TektonInstallerSet, error) {
+	if err := r.removeObsoleteRBACInstallerSet(ctx); err != nil {
+		return nil, err
+	}
+
+	rbacISet, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.version, r.tektonConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if rbacISet != nil {
+		return rbacISet, nil
+	}
+	// A new installer needs to be created
+	// either because of operator version upgrade or installerSet gone missing;
+	// therefore all relevant namespaces need to be reconciled for RBAC resources.
+	// Hence, remove the necessary labels to ensure that the namespaces will be 'not skipped'
+	// RBAC reconcile logic
+	err = r.cleanUp(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	err = createInstallerSet(ctx, r.operatorClientSet, r.tektonConfig, r.version)
+	if err != nil {
+		return nil, err
+	}
+	return nil, v1alpha1.RECONCILE_AGAIN_ERR
+}
+
 func (r *rbac) setDefault() {
 	var (
 		found = false
@@ -107,6 +155,13 @@ func (r *rbac) createResources(ctx context.Context) error {
 
 	logger := logging.FromContext(ctx)
 
+	rbacISet, err := r.EnsureRBACInstallerSet(ctx)
+	if err != nil {
+		return err
+	}
+
+	r.ownerRef = configOwnerRef(*rbacISet)
+
 	// fetch the list of all namespaces which doesn't have label
 	// `openshift-pipelines.tekton.dev/namespace-reconcile-version: <release-version>`
 	namespaces, err := r.kubeClientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{
@@ -132,26 +187,6 @@ func (r *rbac) createResources(ctx context.Context) error {
 		return nil
 	}
 
-	exist, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.version, r.tektonConfig, componentName)
-	if err != nil {
-		return err
-	}
-	if !exist {
-		if err := createInstallerSet(ctx, r.operatorClientSet, r.tektonConfig, map[string]string{
-			v1alpha1.CreatedByKey: createdByValue,
-		}, r.version, componentName, "rbac-resources"); err != nil {
-			return err
-		}
-	}
-
-	getdIs, err := r.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		Get(ctx, "rbac-resources", metav1.GetOptions{})
-	if err != nil {
-		return err
-	}
-
-	r.ownerRef = configOwnerRef(*getdIs)
-
 	// Maintaining a separate cluster role for the scc declaration.
 	// to assist us in managing this the scc association in a
 	// granular way.
@@ -455,14 +490,14 @@ func (r *rbac) updateRoleBinding(ctx context.Context, rb *rbacv1.RoleBinding, sa
 		return nil
 	}
 
-	logger.Info("update existing rolebinding edit")
+	logger.Infof("update existing rolebinding %s/%s", rb.Namespace, rb.Name)
 
 	_, err := rbacClient.RoleBindings(sa.Namespace).Update(ctx, rb, metav1.UpdateOptions{})
 	if err != nil {
-		logger.Error(err, "failed to update edit rb")
+		logger.Errorf("%v: failed to update rolebinding %s/%s", err, rb.Namespace, rb.Name)
 		return err
 	}
-	logger.Error(err, "successfully updated edit rb")
+	logger.Infof("successfully updated rolebinding %s/%s", rb.Namespace, rb.Name)
 	return nil
 }
 
@@ -487,10 +522,10 @@ func hasOwnerRefernce(old []metav1.OwnerReference, new metav1.OwnerReference) bo
 func (r *rbac) ensureRoleBindings(ctx context.Context, sa *corev1.ServiceAccount) error {
 	logger := logging.FromContext(ctx)
 
-	logger.Info("finding role-binding edit")
+	logger.Infof("finding role-binding: %s/%s", sa.Namespace, PipelineRoleBinding)
 	rbacClient := r.kubeClientSet.RbacV1()
 
-	editRB, err := rbacClient.RoleBindings(sa.Namespace).Get(ctx, "edit", metav1.GetOptions{})
+	editRB, err := rbacClient.RoleBindings(sa.Namespace).Get(ctx, PipelineRoleBinding, metav1.GetOptions{})
 
 	if err == nil {
 		logger.Infof("found rolebinding %s/%s", editRB.Namespace, editRB.Name)
@@ -507,7 +542,7 @@ func (r *rbac) ensureRoleBindings(ctx context.Context, sa *corev1.ServiceAccount
 func (r *rbac) createRoleBinding(ctx context.Context, sa *corev1.ServiceAccount) error {
 	logger := logging.FromContext(ctx)
 
-	logger.Info("create new rolebinding edit, in Namespace", sa.GetNamespace())
+	logger.Infof("create new rolebinding %s/%s", sa.Namespace, sa.Name)
 	rbacClient := r.kubeClientSet.RbacV1()
 
 	logger.Info("finding clusterrole edit")
@@ -518,7 +553,7 @@ func (r *rbac) createRoleBinding(ctx context.Context, sa *corev1.ServiceAccount)
 
 	rb := &rbacv1.RoleBinding{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:            "edit",
+			Name:            PipelineRoleBinding,
 			Namespace:       sa.Namespace,
 			OwnerReferences: []metav1.OwnerReference{r.ownerRef},
 		},
@@ -527,7 +562,7 @@ func (r *rbac) createRoleBinding(ctx context.Context, sa *corev1.ServiceAccount)
 	}
 
 	if _, err := rbacClient.RoleBindings(sa.Namespace).Create(ctx, rb, metav1.CreateOptions{}); err != nil {
-		logger.Error(err, "creation of 'edit' rolebinding failed, in Namespace", sa.GetNamespace())
+		logger.Errorf("%v: failed creation of rolebinding %s/%s", err, rb.Namespace, rb.Name)
 		return err
 	}
 	return nil
@@ -672,3 +707,106 @@ func (r *rbac) removeAndUpdate(slice []metav1.OwnerReference, s int) []metav1.Ow
 	ownerRef = append(ownerRef, r.ownerRef)
 	return ownerRef
 }
+
+// TODO: Remove this after v0.55.0 release, by following a depreciation notice
+// --------------------
+// cleanUpRBACNameChange will check remove ownerReference: RBAC installerset from
+// 'edit' rolebindings from all relevant namespaces
+// it will also remove 'pipeline' sa from subject list as
+// the new 'openshift-pipelines-edit' rolebinding
+func (r *rbac) cleanUpRBACNameChange(ctx context.Context) error {
+	rbacClient := r.kubeClientSet.RbacV1()
+
+	// fetch the list of all namespaces
+	namespaces, err := r.kubeClientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	for _, ns := range namespaces.Items {
+		nsName := ns.GetName()
+
+		// filter namespaces:
+		// ignore ns with name passing regex `^(openshift|kube)-`
+		if ignore := nsRegex.MatchString(nsName); ignore {
+			continue
+		}
+
+		// check if "edit" rolebinding exists in "ns" namespace
+		editRB, err := rbacClient.RoleBindings(ns.GetName()).
+			Get(ctx, pipelineRoleBindingOld, metav1.GetOptions{})
+		if err != nil {
+			// if "edit" rolebinding does not exists in "ns" namesapce, then do nothing
+			if errors.IsNotFound(err) {
+				continue
+			}
+			return err
+		}
+
+		// check if 'pipeline' serviceaccount is listed as a subject in 'edit' rolebinding
+		depSub := rbacv1.Subject{Kind: rbacv1.ServiceAccountKind, Name: pipelineSA, Namespace: nsName}
+		subIdx := math.MinInt16
+		for i, s := range editRB.Subjects {
+			if s.Name == depSub.Name && s.Kind == depSub.Kind && s.Namespace == depSub.Namespace {
+				subIdx = i
+				break
+			}
+		}
+
+		// if 'pipeline' serviceaccount is listed as a subject in 'edit' rolebinding
+		// remove 'pipeline' serviceaccount from subject list
+		if subIdx >= 0 {
+			editRB.Subjects = append(editRB.Subjects[:subIdx], editRB.Subjects[subIdx+1:]...)
+		}
+
+		// if 'pipeline' serviceaccount was the only item in the subject list of 'edit' rolebinding,
+		// then we can delete 'edit' rolebinding as nobody else is using it
+		if len(editRB.Subjects) == 0 {
+			if err := rbacClient.RoleBindings(nsName).Delete(ctx, editRB.GetName(), metav1.DeleteOptions{}); err != nil {
+				return err
+			}
+			continue
+		}
+
+		// remove TektonInstallerSet ownerReferece from "edit" rolebinding
+		ownerRefs := editRB.GetOwnerReferences()
+		ownerRefIdx := math.MinInt16
+		for i, ownerRef := range ownerRefs {
+			if ownerRef.Kind == "TektonInstallerSet" {
+				ownerRefIdx = i
+				break
+			}
+		}
+		if ownerRefIdx >= 0 {
+			ownerRefs := append(ownerRefs[:ownerRefIdx], ownerRefs[ownerRefIdx+1:]...)
+			editRB.SetOwnerReferences(ownerRefs)
+
+		}
+
+		// if ownerReference or subject was updated, then update editRB resource on cluster
+		if ownerRefIdx < 0 && subIdx < 0 {
+			continue
+		}
+		if _, err := rbacClient.RoleBindings(nsName).Update(ctx, editRB, metav1.UpdateOptions{}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// --------------------
+
+// TODO: Remove this after v0.55.0 release, by following a depreciation notice
+// --------------------
+func (r *rbac) removeObsoleteRBACInstallerSet(ctx context.Context) error {
+	isClient := r.operatorClientSet.OperatorV1alpha1().TektonInstallerSets()
+	err := isClient.Delete(ctx, rbacInstallerSetNameOld, metav1.DeleteOptions{})
+	if err != nil {
+		if !errors.IsNotFound(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+// --------------------
diff --git a/pkg/reconciler/openshift/tektonpipeline/installerset.go b/pkg/reconciler/openshift/tektonpipeline/installerset.go
index 23b8dacb0..6d2119426 100644
--- a/pkg/reconciler/openshift/tektonpipeline/installerset.go
+++ b/pkg/reconciler/openshift/tektonpipeline/installerset.go
@@ -18,14 +18,12 @@ package tektonpipeline
 
 import (
 	"context"
-	stdError "errors"
 	"fmt"
 	"strings"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	clientset "github.com/tektoncd/operator/pkg/client/clientset/versioned"
-	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -114,16 +112,9 @@ func createInstallerSet(ctx context.Context, oc clientset.Interface, tp *v1alpha
 		tp.Status.ExtentionInstallerSets = map[string]string{}
 	}
 
-	// Update the status of pipeline with created installerSet name
+	//// Update the status of pipeline with created installerSet name
 	tp.Status.ExtentionInstallerSets[component] = createdIs.Name
-
-	_, err = oc.OperatorV1alpha1().TektonPipelines().
-		UpdateStatus(ctx, tp, metav1.UpdateOptions{})
-	if err != nil {
-		return err
-	}
-
-	return stdError.New("ensuring TektonPipeline status update")
+	return nil
 }
 
 func makeInstallerSet(tp *v1alpha1.TektonPipeline, manifest mf.Manifest, installerSetType, releaseVersion string) *v1alpha1.TektonInstallerSet {
@@ -162,10 +153,5 @@ func deleteInstallerSet(ctx context.Context, oc clientset.Interface, ta *v1alpha
 
 	// clear the name of installer set from TektonPipeline status
 	delete(ta.Status.ExtentionInstallerSets, component)
-	_, err = oc.OperatorV1alpha1().TektonPipelines().UpdateStatus(ctx, ta, metav1.UpdateOptions{})
-	if err != nil && !errors.IsNotFound(err) {
-		return err
-	}
-
 	return nil
 }
diff --git a/pkg/reconciler/shared/tektonconfig/controller.go b/pkg/reconciler/shared/tektonconfig/controller.go
index dafed46ce..6c71f2edc 100644
--- a/pkg/reconciler/shared/tektonconfig/controller.go
+++ b/pkg/reconciler/shared/tektonconfig/controller.go
@@ -29,6 +29,7 @@ import (
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
 	tektonConfiginformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonconfig"
+	tektonInstallerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektoninstallerset"
 	tektonPipelineinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonpipeline"
 	tektonTriggerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektontrigger"
 	tektonConfigreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonconfig"
@@ -76,7 +77,12 @@ func NewExtensibleController(generator common.ExtensionGenerator) injection.Cont
 			Handler:    controller.HandleAll(impl.EnqueueControllerOf),
 		})
 
-		namespaceinformer.Get(ctx).Informer().AddEventHandler(controller.HandleAll(enqueueCustomName(impl, common.ConfigResourceName)))
+		namespaceinformer.Get(ctx).Informer().AddEventHandler(controller.HandleAll(enqueueCustomName(impl, v1alpha1.ConfigResourceName)))
+
+		tektonInstallerinformer.Get(ctx).Informer().AddEventHandler(cache.FilteringResourceEventHandler{
+			FilterFunc: controller.FilterController(&v1alpha1.TektonConfig{}),
+			Handler:    controller.HandleAll(impl.EnqueueControllerOf),
+		})
 
 		if os.Getenv("AUTOINSTALL_COMPONENTS") == "true" {
 			// try to ensure that there is an instance of tektonConfig


Test patch:
diff --git a/test/e2e/common/tektonconfigdeployment_test.go b/test/e2e/common/tektonconfigdeployment_test.go
index 00fcae9dd..c57fa1268 100644
--- a/test/e2e/common/tektonconfigdeployment_test.go
+++ b/test/e2e/common/tektonconfigdeployment_test.go
@@ -29,6 +29,7 @@ import (
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektonpipeline"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektontrigger"
+	tconfig "github.com/tektoncd/operator/pkg/reconciler/openshift/tektonconfig"
 	"github.com/tektoncd/operator/test/client"
 	"github.com/tektoncd/operator/test/resources"
 	"github.com/tektoncd/operator/test/utils"
@@ -392,7 +393,7 @@ func runRbacTest(t *testing.T, clients *utils.Clients) {
 	})
 
 	pipelinesSCCRoleBinding := "pipelines-scc-rolebinding"
-	editRoleBinding := "edit"
+	editRoleBinding := tconfig.PipelineRoleBinding
 
 	// Test whether the roleBindings are created
 	t.Run("verify-rolebindings", func(t *testing.T) {