Repository: tektoncd/operator
Pull request #394 (2021-08-27 09:41:05)

Removes the resources based on the profile set
When the Tekton Config profile is changed, based on the profile set 
components are deleted

For example:
If the profile is changed from all to basic:
* In case of Kubernetes: `Dashboard` Component is deleted
* In case of Openshift: `Addon` Component is deleted

Fixes: #358

Signed-off-by: Puneet Punamiya <ppunamiy@redhat.com>

# Changes

<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | 556af319a77eafc22c6588b71d2bc206f18ec8fa | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/394/pull-tekton-operator-integration-tests/1433322740810518530/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/394). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | 556af319a77eafc22c6588b71d2bc206f18ec8fa | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/394/pull-tekton-operator-integration-tests/1433322740810518530/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/394). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
PuneetPunamiya: /test pull-tekton-operator-integration-tests


Patch:
diff --git a/config/base/operator.yaml b/config/base/operator.yaml
index ce3a71138..5c290941f 100644
--- a/config/base/operator.yaml
+++ b/config/base/operator.yaml
@@ -35,6 +35,8 @@ spec:
         - name: tekton-operator
           image: ko://github.com/tektoncd/operator/cmd/kubernetes/operator
           env:
+            - name: VERSION
+              value: "devel"
             - name: SYSTEM_NAMESPACE
               valueFrom:
                 fieldRef:
diff --git a/pkg/reconciler/kubernetes/tektonconfig/extension.go b/pkg/reconciler/kubernetes/tektonconfig/extension.go
index a648ac71d..76b5a5c55 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/extension.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/extension.go
@@ -25,6 +25,7 @@ import (
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektonconfig/extension"
+	"k8s.io/apimachinery/pkg/api/errors"
 )
 
 func KubernetesExtension(ctx context.Context) common.Extension {
@@ -45,9 +46,21 @@ func (oe kubernetesExtension) PreReconcile(context.Context, v1alpha1.TektonCompo
 }
 func (oe kubernetesExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
 	configInstance := comp.(*v1alpha1.TektonConfig)
+
 	if configInstance.Spec.Profile == common.ProfileAll {
 		return extension.CreateDashboardCR(comp, oe.operatorClientSet.OperatorV1alpha1())
 	}
+
+	if configInstance.Spec.Profile == common.ProfileLite || configInstance.Spec.Profile == common.ProfileBasic {
+		err := extension.TektonDashboardCRDelete(oe.operatorClientSet.OperatorV1alpha1().TektonDashboards(), common.DashboardResourceName)
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return nil
+			}
+			return err
+		}
+	}
+
 	return nil
 }
 func (oe kubernetesExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
diff --git a/pkg/reconciler/kubernetes/tektonconfig/tektonconfig.go b/pkg/reconciler/kubernetes/tektonconfig/tektonconfig.go
index a27990547..92dde629b 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/tektonconfig.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/tektonconfig.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	mf "github.com/manifestival/manifestival"
+	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 
@@ -30,6 +31,7 @@ import (
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektonconfig/pipeline"
 	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektonconfig/trigger"
+	tt "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektonconfig/trigger"
 	"knative.dev/pkg/logging"
 	pkgreconciler "knative.dev/pkg/reconciler"
 )
@@ -119,6 +121,13 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tc *v1alpha1.TektonConfi
 
 	var stages common.Stages
 	if tc.Spec.Profile == common.ProfileLite {
+		err := tt.TektonTriggerCRDelete(r.operatorClientSet.OperatorV1alpha1().TektonTriggers(), common.TriggerResourceName)
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return nil
+			}
+			return err
+		}
 		stages = common.Stages{
 			r.createPipelineCR,
 		}
diff --git a/pkg/reconciler/openshift/common/transformer.go b/pkg/reconciler/openshift/common/transformer.go
index 571bd086d..f0a8d794f 100644
--- a/pkg/reconciler/openshift/common/transformer.go
+++ b/pkg/reconciler/openshift/common/transformer.go
@@ -17,24 +17,14 @@ limitations under the License.
 package common
 
 import (
-	"strings"
-
 	mf "github.com/manifestival/manifestival"
 	appsv1 "k8s.io/api/apps/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-// UpdateDeployments will add a prefix to container image and images in args
-// a list of images can be passed to with their name to replace them with any specific image
-// a list of tags can be passed so their images will be skipped
-// eg. replaceImages := map[string]string{
-//		"-shell-image": "registry.access.redhat.com/ubi8/ubi-minimal:latest",
-//	}
-// here `-shell-image` images will be replace by one in map
-// UpdateDeployments will also remove runAsUser from container
-
-func UpdateDeployments(prefix string, replaceImg map[string]string) mf.Transformer {
+// RemoveRunAsUser will remove RunAsUser from all container in a deployment
+func RemoveRunAsUser() mf.Transformer {
 	return func(u *unstructured.Unstructured) error {
 		if u.GetKind() != "Deployment" {
 			return nil
@@ -47,22 +37,7 @@ func UpdateDeployments(prefix string, replaceImg map[string]string) mf.Transform
 		}
 
 		for i := range d.Spec.Template.Spec.Containers {
-
-			// Prefix Container Image
 			c := &d.Spec.Template.Spec.Containers[i]
-			c.Image = prefixImage(prefix, c.Image)
-
-			// Prefix Images in Args if there
-			for i := 0; i < len(c.Args); i++ {
-				val, ok := replaceImg[c.Args[i]]
-				if ok {
-					c.Args[i+1] = val
-					i++
-					continue
-				}
-				c.Args[i] = prefixImage(prefix, c.Args[i])
-			}
-
 			// Remove runAsUser
 			c.SecurityContext.RunAsUser = nil
 		}
@@ -77,14 +52,6 @@ func UpdateDeployments(prefix string, replaceImg map[string]string) mf.Transform
 	}
 }
 
-func prefixImage(prefix, img string) string {
-	if !strings.Contains(img, ".io/") {
-		return img
-	}
-	arr := strings.Split(strings.Split(img, "@")[0], "/")
-	return prefix + arr[len(arr)-1]
-}
-
 // RemoveRunAsGroup will remove runAsGroup from all container in a deployment
 func RemoveRunAsGroup() mf.Transformer {
 	return func(u *unstructured.Unstructured) error {
diff --git a/pkg/reconciler/openshift/tektonconfig/extension.go b/pkg/reconciler/openshift/tektonconfig/extension.go
index 1d32b08a9..25a9add8e 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension.go
@@ -18,6 +18,7 @@ package tektonconfig
 
 import (
 	"context"
+	"os"
 
 	"github.com/go-logr/zapr"
 	mfc "github.com/manifestival/client-go-client"
@@ -30,6 +31,7 @@ import (
 	openshiftPipeline "github.com/tektoncd/operator/pkg/reconciler/openshift/tektonpipeline"
 	openshiftTrigger "github.com/tektoncd/operator/pkg/reconciler/openshift/tektontrigger"
 	"go.uber.org/zap"
+	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -38,6 +40,10 @@ import (
 	"knative.dev/pkg/logging"
 )
 
+const (
+	versionKey = "VERSION"
+)
+
 func OpenShiftExtension(ctx context.Context) common.Extension {
 
 	logger := logging.FromContext(ctx)
@@ -84,16 +90,29 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.Tekto
 		operatorClientSet: oe.operatorClientSet,
 		manifest:          oe.manifest,
 		ownerRef:          configOwnerRef(tc),
+		version:           os.Getenv(versionKey),
 	}
 	return r.createResources(ctx)
 }
 func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
 	configInstance := comp.(*v1alpha1.TektonConfig)
+
 	if configInstance.Spec.Profile == common.ProfileAll {
 		if err := extension.CreateAddonCR(comp, oe.operatorClientSet.OperatorV1alpha1()); err != nil {
 			return err
 		}
 	}
+
+	if configInstance.Spec.Profile == common.ProfileBasic || configInstance.Spec.Profile == common.ProfileLite {
+		err := extension.TektonAddonCRDelete(oe.operatorClientSet.OperatorV1alpha1().TektonAddons(), common.AddonResourceName)
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return nil
+			}
+			return err
+		}
+	}
+
 	return nil
 }
 func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
@@ -106,6 +125,7 @@ func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonC
 
 	r := rbac{
 		kubeClientSet: oe.kubeClientSet,
+		version:       os.Getenv(versionKey),
 	}
 	return r.cleanUp(ctx)
 }
diff --git a/pkg/reconciler/openshift/tektonconfig/rbac.go b/pkg/reconciler/openshift/tektonconfig/rbac.go
index 3ed1f6b32..1d36831e8 100644
--- a/pkg/reconciler/openshift/tektonconfig/rbac.go
+++ b/pkg/reconciler/openshift/tektonconfig/rbac.go
@@ -42,7 +42,6 @@ const (
 	trustedCABundleConfigMap = "config-trusted-cabundle"
 	clusterInterceptors      = "openshift-pipelines-clusterinterceptors"
 	namespaceVersionLabel    = "openshift-pipelines.tekton.dev/namespace-reconcile-version"
-	version                  = "v1.5"
 )
 
 // Namespace Regex to ignore the namespace for creating rbac resources.
@@ -53,14 +52,15 @@ type rbac struct {
 	operatorClientSet clientset.Interface
 	manifest          mf.Manifest
 	ownerRef          metav1.OwnerReference
+	version           string
 }
 
 func (r *rbac) cleanUp(ctx context.Context) error {
 
 	// fetch the list of all namespaces which have label
-	// `openshift-pipelines.tekton.dev/namespace-ready: true`
+	// `openshift-pipelines.tekton.dev/namespace-ready: <release-version>`
 	namespaces, err := r.kubeClientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{
-		LabelSelector: fmt.Sprintf("%s = %s", namespaceVersionLabel, version),
+		LabelSelector: fmt.Sprintf("%s = %s", namespaceVersionLabel, r.version),
 	})
 	if err != nil {
 		return err
@@ -82,9 +82,9 @@ func (r *rbac) createResources(ctx context.Context) error {
 	logger := logging.FromContext(ctx)
 
 	// fetch the list of all namespaces which doesn't have label
-	// `openshift-pipelines.tekton.dev/namespace-ready: true`
+	// `openshift-pipelines.tekton.dev/namespace-ready: <release-version>`
 	namespaces, err := r.kubeClientSet.CoreV1().Namespaces().List(ctx, metav1.ListOptions{
-		LabelSelector: fmt.Sprintf("%s != %s", namespaceVersionLabel, version),
+		LabelSelector: fmt.Sprintf("%s != %s", namespaceVersionLabel, r.version),
 	})
 	if err != nil {
 		return err
@@ -144,7 +144,7 @@ func (r *rbac) createResources(ctx context.Context) error {
 		if len(nsLabels) == 0 {
 			nsLabels = map[string]string{}
 		}
-		nsLabels[namespaceVersionLabel] = version
+		nsLabels[namespaceVersionLabel] = r.version
 		n.SetLabels(nsLabels)
 		if _, err := r.kubeClientSet.CoreV1().Namespaces().Update(ctx, &n, metav1.UpdateOptions{}); err != nil {
 			return err
diff --git a/pkg/reconciler/openshift/tektonpipeline/extension.go b/pkg/reconciler/openshift/tektonpipeline/extension.go
index d973302fe..7e4113251 100644
--- a/pkg/reconciler/openshift/tektonpipeline/extension.go
+++ b/pkg/reconciler/openshift/tektonpipeline/extension.go
@@ -40,14 +40,6 @@ const (
 	// DefaultDisableAffinityAssistant is default value of disable affinity assistant flag
 	DefaultDisableAffinityAssistant = true
 	monitoringLabel                 = "openshift.io/cluster-monitoring=true"
-	pipelinesPrefix                 = "quay.io/openshift-pipeline/tektoncd-pipeline-"
-)
-
-var (
-	replaceImgs = map[string]string{
-		"-shell-image":  "registry.access.redhat.com/ubi8/ubi-minimal:latest",
-		"-gsutil-image": "no-image-available",
-	}
 )
 
 func OpenShiftExtension(ctx context.Context) common.Extension {
@@ -77,7 +69,7 @@ func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Tr
 	return []mf.Transformer{
 		common.InjectLabelOnNamespace(monitoringLabel),
 		occommon.ApplyCABundles,
-		occommon.UpdateDeployments(pipelinesPrefix, replaceImgs),
+		occommon.RemoveRunAsUser(),
 	}
 }
 func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.TektonComponent) error {
diff --git a/pkg/reconciler/openshift/tektontrigger/extension.go b/pkg/reconciler/openshift/tektontrigger/extension.go
index 2ae65a2c5..ee2ddbfee 100644
--- a/pkg/reconciler/openshift/tektontrigger/extension.go
+++ b/pkg/reconciler/openshift/tektontrigger/extension.go
@@ -28,8 +28,6 @@ import (
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-const triggersPrefix = "quay.io/openshift-pipeline/tektoncd-triggers-"
-
 func OpenShiftExtension(ctx context.Context) common.Extension {
 	ext := openshiftExtension{
 		operatorClientSet: operatorclient.Get(ctx),
@@ -43,7 +41,7 @@ type openshiftExtension struct {
 
 func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
 	return []mf.Transformer{
-		occommon.UpdateDeployments(triggersPrefix, map[string]string{}),
+		occommon.RemoveRunAsUser(),
 		occommon.RemoveRunAsGroup(),
 		occommon.ApplyCABundles,
 	}


Test patch:
diff --git a/pkg/reconciler/openshift/common/testdata/test-prefix-images-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-prefix-images-expected.yaml
index 6a4f2ca5c..3ccde86b3 100644
--- a/pkg/reconciler/openshift/common/testdata/test-prefix-images-expected.yaml
+++ b/pkg/reconciler/openshift/common/testdata/test-prefix-images-expected.yaml
@@ -7,12 +7,12 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: v0.24.3
+    app.kubernetes.io/version: "v0.24.3"
     app.kubernetes.io/part-of: tekton-pipelines
     # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-    pipeline.tekton.dev/release: v0.24.3
+    pipeline.tekton.dev/release: "v0.24.3"
     # labels below are related to istio and should not be used for resource lookup
-    version: v0.24.3
+    version: "v0.24.3"
 spec:
   replicas: 1
   selector:
@@ -29,13 +29,13 @@ spec:
         app.kubernetes.io/name: controller
         app.kubernetes.io/component: controller
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: v0.24.3
+        app.kubernetes.io/version: "v0.24.3"
         app.kubernetes.io/part-of: tekton-pipelines
         # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
-        pipeline.tekton.dev/release: v0.24.3
+        pipeline.tekton.dev/release: "v0.24.3"
         # labels below are related to istio and should not be used for resource lookup
         app: tekton-pipelines-controller
-        version: v0.24.3
+        version: "v0.24.3"
     spec:
       affinity:
         nodeAffinity:
@@ -49,26 +49,19 @@ spec:
       serviceAccountName: tekton-pipelines-controller
       containers:
         - name: tekton-pipelines-controller
-          image: quay.io/openshift-pipeline/tektoncd-pipeline-controller:v0.24.3
+          image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/controller:v0.24.3@sha256:18d0fb34fda7c5c877bca20ad700dee7a8accdde82a1e4c316c0e26ebe34ec2f
           args: [
             # Version, to be replace at release time
             "-version", "v0.24.3",
             # These images are built on-demand by `ko resolve` and are replaced
             # by image references by digest.
-            "-kubeconfig-writer-image", "quay.io/openshift-pipeline/tektoncd-pipeline-kubeconfigwriter:v0.24.3",
-            "-git-image", "quay.io/openshift-pipeline/tektoncd-pipeline-git-init:v0.24.3",
-            "-entrypoint-image", "quay.io/openshift-pipeline/tektoncd-pipeline-entrypoint:v0.24.3",
-            "-nop-image", "quay.io/openshift-pipeline/tektoncd-pipeline-nop:v0.24.3",
-            "-imagedigest-exporter-image", "quay.io/openshift-pipeline/tektoncd-pipeline-imagedigestexporter:v0.24.3",
-            "-pr-image", "quay.io/openshift-pipeline/tektoncd-pipeline-pullrequest-init:v0.24.3",
-
+            "-kubeconfig-writer-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/kubeconfigwriter:v0.24.3@sha256:d3266fba61acff36135f76b23190a8440eaaaa9ccd3e4da5cad69ef018db876a", "-git-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.24.3@sha256:a1dd5935163f54ef9585b393c6f1cef08199b349a0db3e9632013797f5c7eedf", "-entrypoint-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/entrypoint:v0.24.3@sha256:aeaa85954d7ccec1a1cc297aeb2d774cf9aa1345a2e1a93b38b6073114cd47c0", "-nop-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/nop:v0.24.3@sha256:e6e5fd3e5664cae763eb461908004cc3629578084e75edcd64600edcfe8dbf2c", "-imagedigest-exporter-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/imagedigestexporter:v0.24.3@sha256:6e891b023d2194fd9e796a1420a8179766de444fee2626272cde3b60259c51d9", "-pr-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/pullrequest-init:v0.24.3@sha256:ae7622314107d174acb94d42ddc76e05fe8c644855da5c1d48036f6aea645047",
             # This is gcr.io/google.com/cloudsdktool/cloud-sdk:302.0.0-slim
-            "-gsutil-image", "no-image-available",
+            "-gsutil-image", "gcr.io/google.com/cloudsdktool/cloud-sdk@sha256:27b2c22bf259d9bc1a291e99c63791ba0c27a04d2db0a43241ba0f1f20f4067f",
             # The shell image must be root in order to create directories and copy files to PVCs.
             # gcr.io/distroless/base:debug as of Apirl 17, 2021
             # image shall not contains tag, so it will be supported on a runtime like cri-o
-            "-shell-image", "registry.access.redhat.com/ubi8/ubi-minimal:latest"
-          ]
+            "-shell-image", "gcr.io/distroless/base@sha256:aa4fd987555ea10e1a4ec8765da8158b5ffdfef1e72da512c7ede509bc9966c4"]
           volumeMounts:
             - name: config-logging
               mountPath: /etc/config-logging
@@ -134,4 +127,4 @@ spec:
             name: config-logging
         - name: config-registry-cert
           configMap:
-            name: config-registry-cert
\ No newline at end of file
+            name: config-registry-cert
diff --git a/pkg/reconciler/openshift/common/testdata/test-prefix-images-interceptor-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-prefix-images-interceptor-expected.yaml
index 29d3f0566..5affdaf89 100644
--- a/pkg/reconciler/openshift/common/testdata/test-prefix-images-interceptor-expected.yaml
+++ b/pkg/reconciler/openshift/common/testdata/test-prefix-images-interceptor-expected.yaml
@@ -7,10 +7,10 @@ metadata:
     app.kubernetes.io/name: core-interceptors
     app.kubernetes.io/component: interceptors
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: v0.14.2
+    app.kubernetes.io/version: "v0.14.2"
     app.kubernetes.io/part-of: tekton-triggers
     # tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-    triggers.tekton.dev/release: v0.14.2
+    triggers.tekton.dev/release: "v0.14.2"
 spec:
   replicas: 1
   selector:
@@ -25,21 +25,18 @@ spec:
         app.kubernetes.io/name: core-interceptors
         app.kubernetes.io/component: interceptors
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: v0.14.2
+        app.kubernetes.io/version: "v0.14.2"
         app.kubernetes.io/part-of: tekton-triggers
         app: tekton-triggers-core-interceptors
-        triggers.tekton.dev/release: v0.14.2
+        triggers.tekton.dev/release: "v0.14.2"
         # version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-        version: v0.14.2
+        version: "v0.14.2"
     spec:
       serviceAccountName: tekton-triggers-core-interceptors
       containers:
         - name: tekton-triggers-core-interceptors
-          image: "quay.io/openshift-pipeline/tektoncd-triggers-interceptors:v0.14.2"
-          args: [
-            "-logtostderr",
-            "-stderrthreshold", "INFO",
-          ]
+          image: "gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/interceptors:v0.14.2@sha256:d62beb1410c8200837176799f6424da6eafebc577af067743399a31360cca63e"
+          args: ["-logtostderr", "-stderrthreshold", "INFO"]
           env:
             - name: SYSTEM_NAMESPACE
               valueFrom:
diff --git a/pkg/reconciler/openshift/common/testdata/test-prefix-images-triggers-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-prefix-images-triggers-expected.yaml
index 300ee304e..bd62db038 100644
--- a/pkg/reconciler/openshift/common/testdata/test-prefix-images-triggers-expected.yaml
+++ b/pkg/reconciler/openshift/common/testdata/test-prefix-images-triggers-expected.yaml
@@ -7,10 +7,10 @@ metadata:
     app.kubernetes.io/name: controller
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: default
-    app.kubernetes.io/version: v0.14.2
+    app.kubernetes.io/version: "v0.14.2"
     app.kubernetes.io/part-of: tekton-triggers
     # tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-    triggers.tekton.dev/release: v0.14.2
+    triggers.tekton.dev/release: "v0.14.2"
 spec:
   replicas: 1
   selector:
@@ -27,29 +27,18 @@ spec:
         app.kubernetes.io/name: controller
         app.kubernetes.io/component: controller
         app.kubernetes.io/instance: default
-        app.kubernetes.io/version: v0.14.2
+        app.kubernetes.io/version: "v0.14.2"
         app.kubernetes.io/part-of: tekton-triggers
         app: tekton-triggers-controller
-        triggers.tekton.dev/release: v0.14.2
+        triggers.tekton.dev/release: "v0.14.2"
         # version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
-        version: v0.14.2
+        version: "v0.14.2"
     spec:
       serviceAccountName: tekton-triggers-controller
       containers:
         - name: tekton-triggers-controller
-          image: "quay.io/openshift-pipeline/tektoncd-triggers-controller:v0.14.2"
-          args: [
-            "-logtostderr",
-            "-stderrthreshold", "INFO",
-            "-el-image", "quay.io/openshift-pipeline/tektoncd-triggers-eventlistenersink:v0.14.2",
-            "-el-port", "8080",
-            "-el-readtimeout", "5",
-            "-el-writetimeout", "40",
-            "-el-idletimeout", "120",
-            "-el-timeouthandler", "30",
-            "-period-seconds", "10",
-            "-failure-threshold", "1"
-          ]
+          image: "gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/controller:v0.14.2@sha256:58baa0aa0eaca368b8090bcb6e88024847d14df2952cdfe7f22be6132a7732c9"
+          args: ["-logtostderr", "-stderrthreshold", "INFO", "-el-image", "gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/eventlistenersink:v0.14.2@sha256:b653776331a65a239df4bf833fc91bd0fe4dc28008ff4475f4cdd19415d93e55", "-el-port", "8080", "-el-readtimeout", "5", "-el-writetimeout", "40", "-el-idletimeout", "120", "-el-timeouthandler", "30", "-period-seconds", "10", "-failure-threshold", "1"]
           env:
             - name: SYSTEM_NAMESPACE
               valueFrom:
diff --git a/pkg/reconciler/openshift/common/transformer_test.go b/pkg/reconciler/openshift/common/transformer_test.go
index 4881482b0..6abc4cd6d 100644
--- a/pkg/reconciler/openshift/common/transformer_test.go
+++ b/pkg/reconciler/openshift/common/transformer_test.go
@@ -37,14 +37,7 @@ func TestUpdateDeployments(t *testing.T) {
 	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
 	assert.NilError(t, err)
 
-	pipelinesPrefix := "quay.io/openshift-pipeline/tektoncd-pipeline-"
-
-	replaceImages := map[string]string{
-		"-shell-image":  "registry.access.redhat.com/ubi8/ubi-minimal:latest",
-		"-gsutil-image": "no-image-available",
-	}
-
-	newManifest, err := manifest.Transform(UpdateDeployments(pipelinesPrefix, replaceImages))
+	newManifest, err := manifest.Transform(RemoveRunAsUser())
 	assert.NilError(t, err)
 
 	got := &appsv1.Deployment{}
@@ -73,9 +66,7 @@ func TestUpdateDeploymentsTriggers(t *testing.T) {
 	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
 	assert.NilError(t, err)
 
-	triggersPrefix := "quay.io/openshift-pipeline/tektoncd-triggers-"
-
-	newManifest, err := manifest.Transform(UpdateDeployments(triggersPrefix, map[string]string{}))
+	newManifest, err := manifest.Transform(RemoveRunAsUser())
 	assert.NilError(t, err)
 	newManifest, err = newManifest.Transform(RemoveRunAsGroup())
 	assert.NilError(t, err)
@@ -106,9 +97,7 @@ func TestUpdateDeploymentsInterceptor(t *testing.T) {
 	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
 	assert.NilError(t, err)
 
-	triggersPrefix := "quay.io/openshift-pipeline/tektoncd-triggers-"
-
-	newManifest, err := manifest.Transform(UpdateDeployments(triggersPrefix, map[string]string{}))
+	newManifest, err := manifest.Transform(RemoveRunAsUser())
 	assert.NilError(t, err)
 	newManifest, err = newManifest.Transform(RemoveRunAsGroup())
 	assert.NilError(t, err)