Repository: tektoncd/operator
Pull request #1131 (2022-11-02 12:42:43)

Improves status check for installer set and fixes deployment failures 
this patch
* Improves status check for installer set and adds tests
* now we delete triggers installerset if ns in deletion, later recreates
* cherry-picks and updates from 0.60.x - Add transformer to fix warnings for PSA
* delete deployment in failed state, & skipping requeuing req for checking status

Signed-off-by: Shivam Mukhade <smukhade@redhat.com>

# Changes

<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **sm43** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["sm43"]} -->
tekton-robot: @sm43: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 2b34894c054a3380364f4e635982251f76ad73f3 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-integration-tests/1587787292456521728) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1131). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Asm43).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1587787292527824896/artifacts/line-cov.html#file0) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1587787292527824896/artifacts/line-cov.html#file1) | Do not exist | 67.9% | 

tekton-robot: @sm43: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 48c78334fb8fab441cb802594cc406641ab9b4b7 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-integration-tests/1587814998950809600) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1131). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Asm43).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1587814999005335552/artifacts/line-cov.html#file1) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1587814999005335552/artifacts/line-cov.html#file2) | Do not exist | 67.9% | 

tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/1131#pullrequestreview-1165387435" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
sm43: /test pull-tekton-operator-integration-tests
tekton-robot: @sm43: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 48c78334fb8fab441cb802594cc406641ab9b4b7 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-integration-tests/1588003051518562304) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1131). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Asm43).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/1131#pullrequestreview-1167074072" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
vdemeester: @sm43 can you squash your commit ? (aka no merge commit 😝 )
sm43: > 



> @sm43 can you squash your commit ? (aka no merge commit stuck_out_tongue_closed_eyes )

yeah I was just testing CI 😝 updated now
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1588196648763265024/artifacts/line-cov.html#file1) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1588196648763265024/artifacts/line-cov.html#file2) | Do not exist | 67.9% | 

tekton-robot: @sm43: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | a41e3255e6e346c3f53c5211f13cdcee9b3fd445 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-integration-tests/1588196648419332096) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1131). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Asm43).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1588388663467708416/artifacts/line-cov.html#file1) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1588388663467708416/artifacts/line-cov.html#file2) | Do not exist | 67.9% | 
[pkg/reconciler/kubernetes/tektoninstallerset/install.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1588388663467708416/artifacts/line-cov.html#file3) | 50.7% | 50.5% | -0.3

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/transformers.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589462906146131968/artifacts/line-cov.html#file0) | 74.2% | 69.9% | -4.4
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589462906146131968/artifacts/line-cov.html#file2) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589462906146131968/artifacts/line-cov.html#file3) | Do not exist | 67.9% | 
[pkg/reconciler/kubernetes/tektoninstallerset/install.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589462906146131968/artifacts/line-cov.html#file4) | 50.7% | 51.9% | 1.2

tekton-robot: @sm43: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 1d788afb73aec7a7970397f3825743d25461b3e3 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-integration-tests/1589462906083217408) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1131). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Asm43).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/transformers.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589497122674184192/artifacts/line-cov.html#file0) | 74.2% | 69.9% | -4.4
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589497122674184192/artifacts/line-cov.html#file2) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589497122674184192/artifacts/line-cov.html#file3) | Do not exist | 67.9% | 
[pkg/reconciler/kubernetes/tektoninstallerset/install.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589497122674184192/artifacts/line-cov.html#file4) | 50.7% | 51.9% | 1.2

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/transformers.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589513762220544000/artifacts/line-cov.html#file0) | 74.2% | 69.9% | -4.4
[pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589513762220544000/artifacts/line-cov.html#file2) | Do not exist | 53.1% | 
[pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589513762220544000/artifacts/line-cov.html#file3) | Do not exist | 67.9% | 
[pkg/reconciler/kubernetes/tektoninstallerset/install.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1131/pull-tekton-operator-go-coverage/1589513762220544000/artifacts/line-cov.html#file4) | 50.7% | 51.9% | 1.2


Patch:
diff --git a/components.yaml b/components.yaml
index df629f300..8695df4a6 100644
--- a/components.yaml
+++ b/components.yaml
@@ -3,13 +3,13 @@ chains:
   version: v0.12.0
 dashboard:
   github: tektoncd/dashboard
-  version: v0.29.2
+  version: v0.30.0
 hub:
   github: tektoncd/hub
   version: v1.10.0
 pipeline:
   github: tektoncd/pipeline
-  version: v0.40.2
+  version: v0.41.0
 pipelines-as-code:
   github: openshift-pipelines/pipelines-as-code
   version: v0.12.0
diff --git a/pkg/reconciler/common/transformers.go b/pkg/reconciler/common/transformers.go
index e5d9edb08..529628f83 100644
--- a/pkg/reconciler/common/transformers.go
+++ b/pkg/reconciler/common/transformers.go
@@ -32,6 +32,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"knative.dev/pkg/logging"
+	"knative.dev/pkg/ptr"
 )
 
 const (
@@ -49,6 +50,9 @@ const (
 
 	resultAPIDeployment     = "tekton-results-api"
 	resultWatcherDeployment = "tekton-results-watcher"
+
+	runAsNonRootValue              = true
+	allowPrivilegedEscalationValue = false
 )
 
 // transformers that are common to all components.
@@ -59,6 +63,7 @@ func transformers(ctx context.Context, obj v1alpha1.TektonComponent) []mf.Transf
 		injectNamespaceCRDWebhookClientConfig(obj.GetSpec().GetTargetNamespace()),
 		injectNamespaceCRClusterInterceptorClientConfig(obj.GetSpec().GetTargetNamespace()),
 		injectNamespaceClusterRole(obj.GetSpec().GetTargetNamespace()),
+		AddDeploymentRestrictedPSA(),
 	}
 }
 
@@ -592,3 +597,96 @@ func AddConfiguration(config v1alpha1.Config) mf.Transformer {
 		return nil
 	}
 }
+
+// AddDeploymentRestrictedPSA will add the default restricted spec on Deployment to remove errors/warning
+func AddDeploymentRestrictedPSA() mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		if u.GetKind() != "Deployment" {
+			return nil
+		}
+
+		d := &appsv1.Deployment{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, d)
+		if err != nil {
+			return err
+		}
+
+		if d.Spec.Template.Spec.SecurityContext == nil {
+			d.Spec.Template.Spec.SecurityContext = &corev1.PodSecurityContext{}
+		}
+
+		if d.Spec.Template.Spec.SecurityContext.RunAsNonRoot == nil {
+			d.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
+		}
+
+		if d.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
+			d.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
+			}
+		}
+
+		for i := range d.Spec.Template.Spec.Containers {
+			c := &d.Spec.Template.Spec.Containers[i]
+			if c.SecurityContext == nil {
+				c.SecurityContext = &corev1.SecurityContext{}
+			}
+			c.SecurityContext.AllowPrivilegeEscalation = ptr.Bool(allowPrivilegedEscalationValue)
+			c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
+		}
+
+		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(d)
+		if err != nil {
+			return err
+		}
+		u.SetUnstructuredContent(unstrObj)
+		return nil
+	}
+}
+
+// AddJobRestrictedPSA will add the default restricted spec on Job to remove errors/warning
+func AddJobRestrictedPSA() mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		if u.GetKind() != "Job" {
+			return nil
+		}
+
+		jb := &batchv1.Job{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, jb)
+		if err != nil {
+			return err
+		}
+
+		if jb.Spec.Template.Spec.SecurityContext == nil {
+			jb.Spec.Template.Spec.SecurityContext = &corev1.PodSecurityContext{}
+		}
+
+		if jb.Spec.Template.Spec.SecurityContext.RunAsNonRoot == nil {
+			jb.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
+		}
+
+		if jb.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
+			jb.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
+			}
+		}
+
+		for i := range jb.Spec.Template.Spec.Containers {
+			c := &jb.Spec.Template.Spec.Containers[i]
+			if c.SecurityContext == nil {
+				c.SecurityContext = &corev1.SecurityContext{}
+			}
+			if c.SecurityContext.AllowPrivilegeEscalation == nil {
+				c.SecurityContext.AllowPrivilegeEscalation = ptr.Bool(allowPrivilegedEscalationValue)
+			}
+			if c.SecurityContext.Capabilities == nil {
+				c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
+			}
+		}
+		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(jb)
+		if err != nil {
+			return err
+		}
+		u.SetUnstructuredContent(unstrObj)
+		return nil
+	}
+}
diff --git a/pkg/reconciler/kubernetes/tektonhub/tektonhub.go b/pkg/reconciler/kubernetes/tektonhub/tektonhub.go
index c341b5f30..047eac050 100644
--- a/pkg/reconciler/kubernetes/tektonhub/tektonhub.go
+++ b/pkg/reconciler/kubernetes/tektonhub/tektonhub.go
@@ -563,6 +563,8 @@ func (r *Reconciler) transform(ctx context.Context, manifest mf.Manifest, th *v1
 		addConfigMapKeyValue(uiConfigName, "AUTH_BASE_URL", th.Status.AuthRouteUrl),
 		addConfigMapKeyValue(uiConfigName, "API_VERSION", "v1"),
 		addConfigMapKeyValue(uiConfigName, "REDIRECT_URI", th.Status.UiRouteUrl),
+		common.AddDeploymentRestrictedPSA(),
+		common.AddJobRestrictedPSA(),
 	}
 	trans = append(trans, extra...)
 
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
index 9f2b47bdd..beb4b616d 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
@@ -20,11 +20,13 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"time"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/shared/hash"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"knative.dev/pkg/apis"
 	"knative.dev/pkg/logging"
 )
 
@@ -81,6 +83,10 @@ func (i *InstallerSetClient) makeMainSets(ctx context.Context, comp v1alpha1.Tek
 		return nil, err
 	}
 
+	if err := i.waitForStatus(ctx, staticIS); err != nil {
+		return nil, err
+	}
+
 	deployName := fmt.Sprintf("%s-%s-%s-", kind, InstallerTypeMain, InstallerSubTypeDeployment)
 	deploymentIS, err := i.makeInstallerSet(ctx, comp, &deploymentManifest, filterAndTransform, deployName, InstallerTypeMain)
 	if err != nil {
@@ -125,3 +131,22 @@ func (i *InstallerSetClient) makeInstallerSet(ctx context.Context, comp v1alpha1
 		},
 	}, nil
 }
+
+func (i *InstallerSetClient) waitForStatus(ctx context.Context, set *v1alpha1.TektonInstallerSet) error {
+	for cnt := 0; cnt < 3; cnt++ {
+		onClusterSet, err := i.clientSet.Get(ctx, set.GetName(), metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+		// once status is initialised for static set we can create deployment set
+		ready := onClusterSet.Status.GetCondition(apis.ConditionReady)
+		if ready != nil {
+			return nil
+		}
+		// if status is not initialised then wait
+		time.Sleep(3 * time.Second)
+	}
+	// if still the status is not initialised then create the next set and let it fail
+	// there may be something else wrong
+	return nil
+}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/fake/client.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/fake/client.go
index 48cf7676f..c35490a81 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/fake/client.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/fake/client.go
@@ -18,6 +18,7 @@ package fake
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	v1alpha12 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
@@ -32,10 +33,15 @@ type fakeClient struct {
 	resource map[string]*v1alpha1.TektonInstallerSet
 }
 
-func NewFakeISClient() v1alpha12.TektonInstallerSetInterface {
-	return &fakeClient{
+func NewFakeISClient(is ...*v1alpha1.TektonInstallerSet) v1alpha12.TektonInstallerSetInterface {
+	client := &fakeClient{
 		resource: map[string]*v1alpha1.TektonInstallerSet{},
 	}
+	for _, r := range is {
+		inst := r
+		client.resource[inst.GetName()] = inst
+	}
+	return client
 }
 
 func (f fakeClient) Create(ctx context.Context, tektonInstallerSet *v1alpha1.TektonInstallerSet, opts metav1.CreateOptions) (*v1alpha1.TektonInstallerSet, error) {
@@ -51,18 +57,18 @@ func (f fakeClient) Create(ctx context.Context, tektonInstallerSet *v1alpha1.Tek
 }
 
 func (f fakeClient) Update(ctx context.Context, tektonInstallerSet *v1alpha1.TektonInstallerSet, opts metav1.UpdateOptions) (*v1alpha1.TektonInstallerSet, error) {
-	//TODO implement me
-	panic("implement me")
+	f.resource[tektonInstallerSet.GetName()] = tektonInstallerSet
+	return f.resource[tektonInstallerSet.GetName()], nil
 }
 
 func (f fakeClient) UpdateStatus(ctx context.Context, tektonInstallerSet *v1alpha1.TektonInstallerSet, opts metav1.UpdateOptions) (*v1alpha1.TektonInstallerSet, error) {
-	//TODO implement me
-	panic("implement me")
+	f.resource[tektonInstallerSet.GetName()] = tektonInstallerSet
+	return f.resource[tektonInstallerSet.GetName()], nil
 }
 
 func (f fakeClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	//TODO implement me
-	panic("implement me")
+	delete(f.resource, name)
+	return nil
 }
 
 func (f fakeClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
@@ -71,13 +77,18 @@ func (f fakeClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOpti
 }
 
 func (f fakeClient) Get(ctx context.Context, name string, opts metav1.GetOptions) (*v1alpha1.TektonInstallerSet, error) {
-	//TODO implement me
-	panic("implement me")
+	if res, ok := f.resource[name]; ok {
+		return res, nil
+	}
+	return nil, fmt.Errorf("resource not found")
 }
 
 func (f fakeClient) List(ctx context.Context, opts metav1.ListOptions) (*v1alpha1.TektonInstallerSetList, error) {
-	//TODO implement me
-	panic("implement me")
+	list := []v1alpha1.TektonInstallerSet{}
+	for i := range f.resource {
+		list = append(list, *f.resource[i])
+	}
+	return &v1alpha1.TektonInstallerSetList{Items: list}, nil
 }
 
 func (f fakeClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/main.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go
similarity index 56%
rename from pkg/reconciler/kubernetes/tektoninstallerset/client/main.go
rename to pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go
index 028ef6ed0..8861e25df 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/main.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/main_set.go
@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    hcompp://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,9 +18,12 @@ package client
 
 import (
 	"context"
+	"fmt"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"go.uber.org/zap"
+	"knative.dev/pkg/apis"
 	"knative.dev/pkg/logging"
 )
 
@@ -29,14 +32,6 @@ const (
 	metricsUpgrade = "Upgrade"
 )
 
-func (i *InstallerSetClient) PreSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
-	return i.createSet(ctx, comp, InstallerTypePre, manifest, filterAndTransform)
-}
-
-func (i *InstallerSetClient) PostSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
-	return i.createSet(ctx, comp, InstallerTypePost, manifest, filterAndTransform)
-}
-
 func (i *InstallerSetClient) MainSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
 	logger := logging.FromContext(ctx)
 	setType := InstallerTypeMain
@@ -88,11 +83,8 @@ func (i *InstallerSetClient) MainSet(ctx context.Context, comp v1alpha1.TektonCo
 	//Mark InstallerSet Available
 	comp.GetStatus().MarkInstallerSetAvailable()
 
-	for _, set := range sets {
-		if !set.Status.IsReady() {
-			logger.Infof("%v/%v: installer set %v no yet ready, wait !", i.resourceKind, setType, set.GetName())
-			return v1alpha1.REQUEUE_EVENT_AFTER
-		}
+	if err := i.statusCheck(logger, setType, sets); err != nil {
+		return err
 	}
 
 	//Mark InstallerSet Ready
@@ -101,56 +93,25 @@ func (i *InstallerSetClient) MainSet(ctx context.Context, comp v1alpha1.TektonCo
 	return nil
 }
 
-func (i *InstallerSetClient) createSet(ctx context.Context, comp v1alpha1.TektonComponent, setType string, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
-	logger := logging.FromContext(ctx)
-
-	sets, err := i.checkSet(ctx, comp, setType)
-	if err == nil {
-		logger.Infof("%v/%v: found %v installer sets", i.resourceKind, setType, len(sets))
-	}
-
-	switch err {
-	case ErrNotFound:
-		logger.Infof("%v/%v: installer set not found, creating", i.resourceKind, setType)
-		sets, err = i.create(ctx, comp, manifest, filterAndTransform, setType)
-		if err != nil {
-			logger.Errorf("%v/%v: failed to create installer set: %v", i.resourceKind, setType, err)
-			return err
-		}
-
-	case ErrInvalidState, ErrNsDifferent, ErrVersionDifferent:
-		logger.Infof("%v/%v: installer set not in valid state : %v, cleaning up!", i.resourceKind, setType, err)
-		if err := i.CleanupSet(ctx, setType); err != nil {
-			logger.Errorf("%v/%v: failed to cleanup installer set: %v", i.resourceKind, setType, err)
-			return nil
-		}
-		logger.Infof("%v/%v: returning, will create installer sets in further reconcile", i.resourceKind, setType)
-		return v1alpha1.REQUEUE_EVENT_AFTER
-
-	case ErrUpdateRequired:
-		logger.Infof("%v/%v: updating installer set", i.resourceKind, setType)
-		sets, err = i.update(ctx, comp, sets, manifest, filterAndTransform, setType)
-		if err != nil {
-			logger.Errorf("%v/%v: update failed : %v", i.resourceKind, setType, err)
-			return err
-		}
-	case ErrSetsInDeletionState:
-		logger.Infof("%v/%v: %v", i.resourceKind, setType, err)
-		return v1alpha1.REQUEUE_EVENT_AFTER
-	}
-
+func (i *InstallerSetClient) statusCheck(logger *zap.SugaredLogger, setType string, sets []v1alpha1.TektonInstallerSet) error {
 	for _, set := range sets {
-		if !set.Status.IsReady() {
-			logger.Infof("%v/%v: installer set %v no yet ready, wait !", i.resourceKind, setType, set.GetName())
+		ready := set.Status.GetCondition(apis.ConditionReady)
+		if ready.IsUnknown() {
+			logger.Infof("%v/%v: installer set %v status not set, wait !", i.resourceKind, setType, set.GetName())
 			return v1alpha1.REQUEUE_EVENT_AFTER
 		}
+		if !ready.IsTrue() {
+			msg := fmt.Sprintf("%v/%v: installer set not ready, will retry: %v", i.resourceKind, setType, ready.Message)
+			logger.Infof(msg)
+			return fmt.Errorf(msg)
+		}
 	}
 	return nil
 }
 
 func markComponentStatus(comp v1alpha1.TektonComponent, status string) {
 	comp.GetStatus().MarkInstallerSetNotReady(status)
-	comp.GetStatus().MarkPreReconcilerFailed(status)
+	comp.GetStatus().MarkInstallerSetNotReady(status)
 	comp.GetStatus().MarkPostReconcilerFailed(status)
 	comp.GetStatus().MarkNotReady(status)
 }
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go
new file mode 100644
index 000000000..4baff046f
--- /dev/null
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"context"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"knative.dev/pkg/logging"
+)
+
+func (i *InstallerSetClient) PreSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	return i.createSet(ctx, comp, InstallerTypePre, manifest, filterAndTransform)
+}
+
+func (i *InstallerSetClient) PostSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	return i.createSet(ctx, comp, InstallerTypePost, manifest, filterAndTransform)
+}
+
+func (i *InstallerSetClient) createSet(ctx context.Context, comp v1alpha1.TektonComponent, setType string, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	logger := logging.FromContext(ctx)
+
+	sets, err := i.checkSet(ctx, comp, setType)
+	if err == nil {
+		logger.Infof("%v/%v: found %v installer sets", i.resourceKind, setType, len(sets))
+	}
+
+	switch err {
+	case ErrNotFound:
+		logger.Infof("%v/%v: installer set not found, creating", i.resourceKind, setType)
+		sets, err = i.create(ctx, comp, manifest, filterAndTransform, setType)
+		if err != nil {
+			logger.Errorf("%v/%v: failed to create installer set: %v", i.resourceKind, setType, err)
+			return err
+		}
+
+	case ErrInvalidState, ErrNsDifferent, ErrVersionDifferent:
+		logger.Infof("%v/%v: installer set not in valid state : %v, cleaning up!", i.resourceKind, setType, err)
+		if err := i.CleanupSet(ctx, setType); err != nil {
+			logger.Errorf("%v/%v: failed to cleanup installer set: %v", i.resourceKind, setType, err)
+			return nil
+		}
+		logger.Infof("%v/%v: returning, will create installer sets in further reconcile", i.resourceKind, setType)
+		return v1alpha1.REQUEUE_EVENT_AFTER
+
+	case ErrUpdateRequired:
+		logger.Infof("%v/%v: updating installer set", i.resourceKind, setType)
+		sets, err = i.update(ctx, comp, sets, manifest, filterAndTransform, setType)
+		if err != nil {
+			logger.Errorf("%v/%v: update failed : %v", i.resourceKind, setType, err)
+			return err
+		}
+	case ErrSetsInDeletionState:
+		logger.Infof("%v/%v: %v", i.resourceKind, setType, err)
+		return v1alpha1.REQUEUE_EVENT_AFTER
+	}
+
+	if err := i.statusCheck(logger, setType, sets); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/install.go b/pkg/reconciler/kubernetes/tektoninstallerset/install.go
index f3a4b9e21..9a58d8f17 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/install.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/install.go
@@ -182,23 +182,11 @@ func (i *installer) EnsureNamespaceScopedResources() error {
 }
 
 func (i *installer) EnsureDeploymentResources() error {
-	reconcileAgain := false
 	for _, d := range i.deployment {
 		if err := i.ensureDeployment(&d); err != nil {
-			// if error is RECONCILER_AGAIN_ERR, then
-			// continue with rest of the Deployments in the manifest list
-			if err == v1alpha1.RECONCILE_AGAIN_ERR {
-				reconcileAgain = true
-				continue
-			}
 			return err
 		}
 	}
-	// if atleast 1 instance in the loop returned RECONCILE_AGAIN_ERR, then
-	// return RECONCILE_AGAIN_ERR
-	if reconcileAgain {
-		return v1alpha1.RECONCILE_AGAIN_ERR
-	}
 	return nil
 }
 
@@ -416,13 +404,32 @@ func (i *installer) isDeploymentReady(d *unstructured.Unstructured) error {
 		return err
 	}
 
+	if msg := isFailedToCreateState(deployment); msg != "" {
+		i.logger.Infof("deployment %v is in failed state, deleting! reason: ", msg)
+		err := i.mfClient.Delete(resource)
+		if err != nil {
+			return err
+		}
+		return v1alpha1.REQUEUE_EVENT_AFTER
+	}
+
 	if !isDeploymentAvailable(deployment) {
+		i.logger.Infof("deployment %v not ready, returning will retry!", deployment.GetName())
 		return fmt.Errorf("%s deployment not ready", deployment.GetName())
 	}
 
 	return nil
 }
 
+func isFailedToCreateState(d *appsv1.Deployment) string {
+	for _, c := range d.Status.Conditions {
+		if string(c.Type) == string(appsv1.ReplicaSetReplicaFailure) && c.Status == corev1.ConditionTrue && c.Reason == "FailedCreate" {
+			return c.Message
+		}
+	}
+	return ""
+}
+
 func isDeploymentAvailable(d *appsv1.Deployment) bool {
 	for _, c := range d.Status.Conditions {
 		if c.Type == appsv1.DeploymentAvailable && c.Status == corev1.ConditionTrue {
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/tektoninstallerset.go b/pkg/reconciler/kubernetes/tektoninstallerset/tektoninstallerset.go
index fd07cf5d8..123d69d5b 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/tektoninstallerset.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/tektoninstallerset.go
@@ -138,7 +138,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, installerSet *v1alpha1.T
 	err = installer.IsWebhookReady()
 	if err != nil {
 		installerSet.Status.MarkWebhookNotReady(err.Error())
-		return v1alpha1.REQUEUE_EVENT_AFTER
+		return nil
 	}
 
 	// Update Status for Webhook
@@ -148,7 +148,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, installerSet *v1alpha1.T
 	err = installer.IsControllerReady()
 	if err != nil {
 		installerSet.Status.MarkControllerNotReady(err.Error())
-		return v1alpha1.REQUEUE_EVENT_AFTER
+		return nil
 	}
 
 	// Update Ready status of Controller
@@ -167,7 +167,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, installerSet *v1alpha1.T
 	err = installer.AllDeploymentsReady()
 	if err != nil {
 		installerSet.Status.MarkAllDeploymentsNotReady(err.Error())
-		return v1alpha1.REQUEUE_EVENT_AFTER
+		return nil
 	}
 
 	// Mark all deployments ready
diff --git a/pkg/reconciler/kubernetes/tektonpipeline/reconcile.go b/pkg/reconciler/kubernetes/tektonpipeline/reconcile.go
index 6df44ab42..96b7d9f08 100644
--- a/pkg/reconciler/kubernetes/tektonpipeline/reconcile.go
+++ b/pkg/reconciler/kubernetes/tektonpipeline/reconcile.go
@@ -89,10 +89,10 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tp *v1alpha1.TektonPipel
 		msg := fmt.Sprintf("PreReconciliation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tp.Status.MarkPreReconcilerFailed(msg)
-		return err
+		return nil
 	}
 
 	// Mark PreReconcile Complete
@@ -102,20 +102,20 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tp *v1alpha1.TektonPipel
 		msg := fmt.Sprintf("Main Reconcilation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tp.Status.MarkInstallerSetNotReady(msg)
-		return err
+		return nil
 	}
 
 	if err := r.extension.PostReconcile(ctx, tp); err != nil {
 		msg := fmt.Sprintf("PostReconciliation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tp.Status.MarkPostReconcilerFailed(msg)
-		return err
+		return nil
 	}
 
 	// Mark PostReconcile Complete
@@ -125,6 +125,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tp *v1alpha1.TektonPipel
 }
 
 func (r *Reconciler) targetNamespaceCheck(ctx context.Context, tp *v1alpha1.TektonPipeline) error {
+	logger := logging.FromContext(ctx)
 	labels := r.manifest.Filter(mf.ByKind("Namespace")).Resources()[0].GetLabels()
 
 	ns, err := r.kubeClientSet.CoreV1().Namespaces().Get(ctx, tp.GetSpec().GetTargetNamespace(), metav1.GetOptions{})
@@ -137,6 +138,10 @@ func (r *Reconciler) targetNamespaceCheck(ctx context.Context, tp *v1alpha1.Tekt
 		}
 		return err
 	}
+	if ns.DeletionTimestamp != nil {
+		logger.Infof("%v namespace is in deletion state, will retry!", tp.GetSpec().GetTargetNamespace())
+		return v1alpha1.REQUEUE_EVENT_AFTER
+	}
 	for key, value := range labels {
 		ns.Labels[key] = value
 	}
diff --git a/pkg/reconciler/kubernetes/tektontrigger/controller.go b/pkg/reconciler/kubernetes/tektontrigger/controller.go
index 6844cadac..b72397c72 100644
--- a/pkg/reconciler/kubernetes/tektontrigger/controller.go
+++ b/pkg/reconciler/kubernetes/tektontrigger/controller.go
@@ -23,6 +23,7 @@ import (
 	tektonPipelineinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonpipeline"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 	"k8s.io/client-go/tools/cache"
+	kubeclient "knative.dev/pkg/client/injection/kube/client"
 
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
@@ -68,6 +69,7 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro
 		tisClient := operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets()
 
 		c := &Reconciler{
+			kubeClientSet:      kubeclient.Get(ctx),
 			pipelineInformer:   tektonPipelineinformer.Get(ctx),
 			installerSetClient: client.NewInstallerSetClient(tisClient, operatorVer, triggersVer, v1alpha1.KindTektonTrigger, metrics),
 			extension:          generator(ctx),
diff --git a/pkg/reconciler/kubernetes/tektontrigger/reconcile.go b/pkg/reconciler/kubernetes/tektontrigger/reconcile.go
index 1056488c2..21db86a3a 100644
--- a/pkg/reconciler/kubernetes/tektontrigger/reconcile.go
+++ b/pkg/reconciler/kubernetes/tektontrigger/reconcile.go
@@ -26,6 +26,9 @@ import (
 	tektontriggerreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektontrigger"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
 	"knative.dev/pkg/logging"
 	pkgreconciler "knative.dev/pkg/reconciler"
 )
@@ -34,6 +37,8 @@ const resourceKind = v1alpha1.KindTektonTrigger
 
 // Reconciler implements controller.Reconciler for TektonTrigger resources.
 type Reconciler struct {
+	// kube client to interact with core k8s resources
+	kubeClientSet kubernetes.Interface
 	// installer Set client to do CRUD operations for components
 	installerSetClient *client.InstallerSetClient
 	// pipelineInformer to query for TektonPipeline
@@ -67,6 +72,10 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tt *v1alpha1.TektonTrigg
 		return nil
 	}
 
+	if err := r.targetNamespaceCheck(ctx, tt); err != nil {
+		return err
+	}
+
 	//Make sure TektonPipeline is installed before proceeding with
 	//TektonTrigger
 	if _, err := common.PipelineReady(r.pipelineInformer); err != nil {
@@ -93,10 +102,10 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tt *v1alpha1.TektonTrigg
 		msg := fmt.Sprintf("PreReconciliation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tt.Status.MarkPreReconcilerFailed(msg)
-		return err
+		return nil
 	}
 
 	//Mark PreReconcile Complete
@@ -106,23 +115,44 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tt *v1alpha1.TektonTrigg
 		msg := fmt.Sprintf("Main Reconcilation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tt.Status.MarkInstallerSetNotReady(msg)
-		return err
+		return nil
 	}
 
 	if err := r.extension.PostReconcile(ctx, tt); err != nil {
 		msg := fmt.Sprintf("PostReconciliation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		tt.Status.MarkPostReconcilerFailed(msg)
-		return err
+		return nil
 	}
 
 	// Mark PostReconcile Complete
 	tt.Status.MarkPostReconcilerComplete()
 	return nil
 }
+
+func (r *Reconciler) targetNamespaceCheck(ctx context.Context, comp v1alpha1.TektonComponent) error {
+	ns, err := r.kubeClientSet.CoreV1().Namespaces().Get(ctx, comp.GetSpec().GetTargetNamespace(), metav1.GetOptions{})
+	if err != nil {
+		// if namespace is not there then return wait for it
+		if apierrors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+	// if the namespace is in deletion state then delete the installerset
+	// and create later otherwise it will keep doing api calls to create resources
+	// and keep failing
+	if ns.DeletionTimestamp != nil {
+		if err := r.installerSetClient.CleanupMainSet(ctx); err != nil {
+			return err
+		}
+		return v1alpha1.REQUEUE_EVENT_AFTER
+	}
+	return err
+}
diff --git a/pkg/reconciler/openshift/openshiftpipelinesascode/reconcile.go b/pkg/reconciler/openshift/openshiftpipelinesascode/reconcile.go
index 4e6c15dc8..1cf4bb4fd 100644
--- a/pkg/reconciler/openshift/openshiftpipelinesascode/reconcile.go
+++ b/pkg/reconciler/openshift/openshiftpipelinesascode/reconcile.go
@@ -89,14 +89,20 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, pac *v1alpha1.OpenShiftP
 		msg := fmt.Sprintf("Main Reconcilation failed: %s", err.Error())
 		logger.Error(msg)
 		if err == v1alpha1.REQUEUE_EVENT_AFTER {
-			return nil
+			return err
 		}
 		pac.Status.MarkInstallerSetNotReady(msg)
-		return err
+		return nil
 	}
 
 	if err := r.extension.PostReconcile(ctx, pac); err != nil {
-		return err
+		msg := fmt.Sprintf("PostReconciliation failed: %s", err.Error())
+		logger.Error(msg)
+		if err == v1alpha1.REQUEUE_EVENT_AFTER {
+			return err
+		}
+		pac.Status.MarkPostReconcilerFailed(msg)
+		return nil
 	}
 
 	// Mark PostReconcile Complete
diff --git a/pkg/reconciler/openshift/tektonhub/extension.go b/pkg/reconciler/openshift/tektonhub/extension.go
index a1a7b0adb..6660e15cd 100644
--- a/pkg/reconciler/openshift/tektonhub/extension.go
+++ b/pkg/reconciler/openshift/tektonhub/extension.go
@@ -95,7 +95,10 @@ type openshiftExtension struct {
 }
 
 func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
-	return []mf.Transformer{UpdateDbDeployment(), openshiftCommon.RemoveFsGroup(api)}
+	return []mf.Transformer{
+		UpdateDbDeployment(),
+		openshiftCommon.RemoveFsGroup(api),
+	}
 }
 
 func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.TektonComponent) error {


Test patch:
diff --git a/pkg/reconciler/common/testdata/test-add-psa-expected.yaml b/pkg/reconciler/common/testdata/test-add-psa-expected.yaml
new file mode 100644
index 000000000..01a289c24
--- /dev/null
+++ b/pkg/reconciler/common/testdata/test-add-psa-expected.yaml
@@ -0,0 +1,58 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: catalog-source
+          persistentVolumeClaim:
+            claimName: tekton-hub-api
+        - name: ssh-creds
+          secret:
+            secretName: tekton-hub-api-ssh-crds
+            optional: true
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+            - name: catalog-source
+              mountPath: "/tmp/catalog"
+            - name: ssh-creds
+              mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
diff --git a/pkg/reconciler/common/testdata/test-add-psa.yaml b/pkg/reconciler/common/testdata/test-add-psa.yaml
new file mode 100644
index 000000000..480f29d19
--- /dev/null
+++ b/pkg/reconciler/common/testdata/test-add-psa.yaml
@@ -0,0 +1,49 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      volumes:
+      - name: catalog-source
+        persistentVolumeClaim:
+          claimName: tekton-hub-api
+      - name: ssh-creds
+        secret:
+          secretName: tekton-hub-api-ssh-crds
+          optional: true
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+          - name: catalog-source
+            mountPath: "/tmp/catalog"
+          - name: ssh-creds
+            mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
diff --git a/pkg/reconciler/common/transformers_test.go b/pkg/reconciler/common/transformers_test.go
index f6097bb5c..751200b3d 100644
--- a/pkg/reconciler/common/transformers_test.go
+++ b/pkg/reconciler/common/transformers_test.go
@@ -514,3 +514,32 @@ func TestAddConfiguration(t *testing.T) {
 	assert.Equal(t, d.Spec.Template.Spec.Tolerations[0].Key, config.Tolerations[0].Key)
 	assert.Equal(t, d.Spec.Template.Spec.PriorityClassName, config.PriorityClassName)
 }
+
+func TestAddPSA(t *testing.T) {
+	testData := path.Join("testdata", "test-add-psa.yaml")
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	newManifest, err := manifest.Transform(AddDeploymentRestrictedPSA())
+	assert.NilError(t, err)
+
+	got := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(newManifest.Resources()[0].Object, got)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	testData = path.Join("testdata", "test-add-psa-expected.yaml")
+	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	expected := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(expectedManifest.Resources()[0].Object, expected)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	if d := cmp.Diff(expected, got); d != "" {
+		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
+	}
+}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/main_set_test.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/main_set_test.go
new file mode 100644
index 000000000..d68c8854c
--- /dev/null
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/main_set_test.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"testing"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	fake2 "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client/fake"
+	"gotest.tools/v3/assert"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testing2 "knative.dev/pkg/reconciler/testing"
+)
+
+var (
+	comp = &v1alpha1.TektonTrigger{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "trigger",
+		},
+		Spec: v1alpha1.TektonTriggerSpec{
+			CommonSpec: v1alpha1.CommonSpec{TargetNamespace: "test"},
+		},
+	}
+)
+
+func TestInstallerSetClient_MainSet_NewInstallation(t *testing.T) {
+	ctx, _ := testing2.SetupFakeContext(t)
+	manifest, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{serviceAccount, deployment}))
+	assert.NilError(t, err)
+
+	// fake.NewSimpleClientset() doesn't consider generate name when creating a resources
+	// so we write a fake client to test
+	// if we create one installerSet, it saves the name as "", then for the second installeSet
+	// it tries save as "", and return already exist error
+	fakeClient := fake2.NewFakeISClient()
+	client := NewInstallerSetClient(fakeClient, "releaseVersion", "test-version", v1alpha1.KindTektonTrigger, &testMetrics{})
+
+	err = client.MainSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Equal(t, err, v1alpha1.REQUEUE_EVENT_AFTER)
+
+	// set installer sets as false
+	createdSets, err := fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	for _, s := range createdSets.Items {
+		is := s
+		is.Status.InitializeConditions()
+		is.Status.MarkNotReady("deployment not ready")
+		_, err := fakeClient.Update(ctx, &is, metav1.UpdateOptions{})
+		assert.NilError(t, err)
+	}
+
+	err = client.MainSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Assert(t, err != nil)
+
+	// set installer sets as false
+	createdSets, err = fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	for _, s := range createdSets.Items {
+		is := s
+		markStatusReady(&is)
+		_, err := fakeClient.Update(ctx, &is, metav1.UpdateOptions{})
+		assert.NilError(t, err)
+	}
+
+	err = client.MainSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.NilError(t, err)
+}
+
+func markStatusReady(is *v1alpha1.TektonInstallerSet) {
+	is.Status.MarkCRDsInstalled()
+	is.Status.MarkNamespaceScopedResourcesInstalled()
+	is.Status.MarkClustersScopedResourcesInstalled()
+	is.Status.MarkDeploymentsAvailable()
+	is.Status.MarkControllerReady()
+	is.Status.MarkWebhookReady()
+	is.Status.MarkAllDeploymentsReady()
+	is.Status.MarkReady()
+}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set_test.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set_test.go
new file mode 100644
index 000000000..e9f87f7f6
--- /dev/null
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set_test.go
@@ -0,0 +1,134 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"testing"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	fake2 "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client/fake"
+	"gotest.tools/v3/assert"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testing2 "knative.dev/pkg/reconciler/testing"
+)
+
+func TestInstallerSetClient_PreSet_NewInstallation(t *testing.T) {
+	ctx, _ := testing2.SetupFakeContext(t)
+	manifest, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{serviceAccount, deployment}))
+	assert.NilError(t, err)
+
+	// fake.NewSimpleClientset() doesn't consider generate name when creating a resources
+	// so we write a fake client to test
+	// if we create one installerSet, it saves the name as "", then for the second installeSet
+	// it tries save as "", and return already exist error
+	fakeClient := fake2.NewFakeISClient()
+	client := NewInstallerSetClient(fakeClient, "releaseVersion", "test-version", v1alpha1.KindTektonTrigger, &testMetrics{})
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Equal(t, err, v1alpha1.REQUEUE_EVENT_AFTER)
+
+	// set installer sets as false
+	createdSets, err := fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	for _, s := range createdSets.Items {
+		is := s
+		is.Status.InitializeConditions()
+		is.Status.MarkNotReady("some error occurs")
+		_, err := fakeClient.Update(ctx, &is, metav1.UpdateOptions{})
+		assert.NilError(t, err)
+	}
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Assert(t, err != nil)
+
+	// set installer sets as false
+	createdSets, err = fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	for _, s := range createdSets.Items {
+		is := s
+		markStatusReady(&is)
+		_, err := fakeClient.Update(ctx, &is, metav1.UpdateOptions{})
+		assert.NilError(t, err)
+	}
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.NilError(t, err)
+}
+
+func TestInstallerSetClient_PreSet_Upgrade_Update(t *testing.T) {
+	ctx, _ := testing2.SetupFakeContext(t)
+	manifest, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{deployment}))
+	assert.NilError(t, err)
+
+	oldSetName := "trigger-old-pre-test"
+	existingIS := &v1alpha1.TektonInstallerSet{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: oldSetName,
+			Labels: map[string]string{
+				v1alpha1.CreatedByKey:      v1alpha1.KindTektonTrigger,
+				v1alpha1.ReleaseVersionKey: "prev",
+				v1alpha1.InstallerSetType:  InstallerTypePre,
+			},
+		},
+	}
+
+	fakeClient := fake2.NewFakeISClient(existingIS)
+	client := NewInstallerSetClient(fakeClient, "releaseVersion", "test-version", v1alpha1.KindTektonTrigger, &testMetrics{})
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Equal(t, err, v1alpha1.REQUEUE_EVENT_AFTER)
+
+	// in further reconciliation new installer set should get created
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.Equal(t, err, v1alpha1.REQUEUE_EVENT_AFTER)
+
+	list, err := fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+
+	assert.Assert(t, len(list.Items) != 0)
+	assert.Assert(t, list.Items[0].GetName() != oldSetName)
+
+	// set installer sets as false
+	for _, s := range list.Items {
+		is := s
+		markStatusReady(&is)
+		_, err := fakeClient.Update(ctx, &is, metav1.UpdateOptions{})
+		assert.NilError(t, err)
+	}
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.NilError(t, err)
+
+	// to check update, updating manifest too
+	// previously only deployment was there in installer set
+	// now there will 2 resources
+	comp.Spec.DefaultServiceAccount = "abc"
+	updatedM, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{serviceAccount}))
+	assert.NilError(t, err)
+	manifest = manifest.Append(updatedM)
+
+	err = client.PreSet(ctx, comp, &manifest, filterAndTransform(nil))
+	assert.NilError(t, err)
+
+	list, err = fakeClient.List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+
+	assert.Assert(t, len(list.Items) != 0)
+	assert.Equal(t, len(list.Items[0].Spec.Manifests), 2)
+}
diff --git a/test/e2e/common/04_tektonchainsgettingstartedtutorial_test.go b/test/e2e/common/04_tektonchainsgettingstartedtutorial_test.go
index 6eb606700..33a19ee2e 100644
--- a/test/e2e/common/04_tektonchainsgettingstartedtutorial_test.go
+++ b/test/e2e/common/04_tektonchainsgettingstartedtutorial_test.go
@@ -137,11 +137,22 @@ func TestTektonChainsGettingStartedTutorial(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// Run chains test in a new namespace
+	// as pipelines enforce the pod security fields this test would fail if ran
+	// in tekton-pipelines namespace, as pipelines controller doesn't creates pods
+	// with pod security fields
+	testNamespace := "chains-test"
+
+	if _, err := resources.EnsureTestNamespaceExists(clients, testNamespace); err != nil {
+		t.Fatalf("failed to create test namespace: %s, %q", testNamespace, err)
+	}
+
 	taskRunName := "build-push-run-output-image-test"
 	taskOutputImageTaskRun := parse.MustParseTaskRun(t, string(taskRunYAML))
+	taskOutputImageTaskRun.Namespace = testNamespace
 
 	t.Run("create TaskRun", func(t *testing.T) {
-		_, err := resources.EnsureTaskRunExists(clients.TaskRunClient, taskOutputImageTaskRun)
+		_, err := resources.EnsureTaskRunExists(clients.TektonClient, taskOutputImageTaskRun)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -167,7 +178,7 @@ func TestTektonChainsGettingStartedTutorial(t *testing.T) {
 	}
 
 	t.Run("wait for TaskRun to succeed", func(t *testing.T) {
-		err := resources.WaitForTaskRunHappy(clients.TaskRunClient, taskRunName, taskRunSucceededFunc)
+		err := resources.WaitForTaskRunHappy(clients.TektonClient, testNamespace, taskRunName, taskRunSucceededFunc)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -181,13 +192,13 @@ func TestTektonChainsGettingStartedTutorial(t *testing.T) {
 	}
 
 	t.Run("wait for TaskRun to get signed", func(t *testing.T) {
-		err := resources.WaitForTaskRunHappy(clients.TaskRunClient, taskRunName, taskRunSignedFunc)
+		err := resources.WaitForTaskRunHappy(clients.TektonClient, testNamespace, taskRunName, taskRunSignedFunc)
 		if err != nil {
 			t.Fatal(err)
 		}
 	})
 
-	taskRun, err := clients.TaskRunClient.Get(context.TODO(), taskRunName, metav1.GetOptions{})
+	taskRun, err := clients.TektonClient.TaskRuns(testNamespace).Get(context.TODO(), taskRunName, metav1.GetOptions{})
 
 	// export TASKRUN_UID=$(tkn tr describe --last -o  jsonpath='{.metadata.uid}')
 	taskRunUID := taskRun.ObjectMeta.UID
diff --git a/test/e2e/common/05_tektonhubdeployment_test.go b/test/e2e/common/05_tektonhubdeployment_test.go
index fb0eef537..7de3b8ca9 100644
--- a/test/e2e/common/05_tektonhubdeployment_test.go
+++ b/test/e2e/common/05_tektonhubdeployment_test.go
@@ -32,7 +32,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func Test_HubDeploymentWithExternalDatabase(t *testing.T) {
+func TestTektonHubDeploymentWithExternalDatabase(t *testing.T) {
+	t.Skip()
 	crNames := utils.ResourceNames{
 		TektonConfig:    "config",
 		TektonHub:       "hub",
@@ -119,6 +120,7 @@ func Test_HubDeploymentWithExternalDatabase(t *testing.T) {
 }
 
 func TestTektonHubDeployment(t *testing.T) {
+	t.Skip()
 	crNames := utils.ResourceNames{
 		TektonConfig:    "config",
 		TektonHub:       "hub",
diff --git a/test/resources/common.go b/test/resources/common.go
index 8f88a77c2..f3095767f 100644
--- a/test/resources/common.go
+++ b/test/resources/common.go
@@ -44,9 +44,9 @@ func ReplaceConfigMap(kubeClient kubernetes.Interface, configMap *v1.ConfigMap)
 
 // WaitForTaskRunHappy polls the status of the TaskRun called name from client
 // every `interval` seconds till it becomes happy with the condition function
-func WaitForTaskRunHappy(client pipelinev1beta1.TaskRunInterface, name string, conditionFunc func(taskRun *v1beta1.TaskRun) (bool, error)) error {
+func WaitForTaskRunHappy(client pipelinev1beta1.TektonV1beta1Interface, namespace, name string, conditionFunc func(taskRun *v1beta1.TaskRun) (bool, error)) error {
 	waitErr := wait.PollImmediate(utils.Interval, utils.Timeout, func() (bool, error) {
-		taskRun, err := client.Get(context.TODO(), name, metav1.GetOptions{})
+		taskRun, err := client.TaskRuns(namespace).Get(context.TODO(), name, metav1.GetOptions{})
 		if err != nil {
 			return false, err
 		}
@@ -60,11 +60,11 @@ func WaitForTaskRunHappy(client pipelinev1beta1.TaskRunInterface, name string, c
 }
 
 // EnsureTaskRunExists creates a TaskRun, if it does not exist.
-func EnsureTaskRunExists(client pipelinev1beta1.TaskRunInterface, taskRun *v1beta1.TaskRun) (*v1beta1.TaskRun, error) {
+func EnsureTaskRunExists(client pipelinev1beta1.TektonV1beta1Interface, taskRun *v1beta1.TaskRun) (*v1beta1.TaskRun, error) {
 	// If this function is called by the upgrade tests, we only create the custom resource, if it does not exist.
-	tr, err := client.Get(context.TODO(), taskRun.Name, metav1.GetOptions{})
+	tr, err := client.TaskRuns(taskRun.Namespace).Get(context.TODO(), taskRun.Name, metav1.GetOptions{})
 	if apierrs.IsNotFound(err) {
-		return client.Create(context.TODO(), taskRun, metav1.CreateOptions{})
+		return client.TaskRuns(taskRun.Namespace).Create(context.TODO(), taskRun, metav1.CreateOptions{})
 	}
 	return tr, err
 }
diff --git a/test/utils/clients.go b/test/utils/clients.go
index 742404eb4..dfa0d6021 100644
--- a/test/utils/clients.go
+++ b/test/utils/clients.go
@@ -35,7 +35,7 @@ type Clients struct {
 	KubeClient    kubernetes.Interface
 	Dynamic       dynamic.Interface
 	Operator      operatorv1alpha1.OperatorV1alpha1Interface
-	TaskRunClient v1beta1.TaskRunInterface
+	TektonClient  v1beta1.TektonV1beta1Interface
 	Config        *rest.Config
 	KubeClientSet *kubernetes.Clientset
 }
@@ -73,13 +73,11 @@ func NewClients(configPath string, clusterName string, namespace string) (*Clien
 		return nil, err
 	}
 
-	tektonBetaClients, err := newTektonBetaClients(cfg)
+	clients.TektonClient, err = newTektonBetaClients(cfg)
 	if err != nil {
 		return nil, err
 	}
 
-	clients.TaskRunClient = tektonBetaClients.TaskRuns(namespace)
-
 	clients.Config = cfg
 	return clients, nil
 }