Repository: tektoncd/operator
Pull request #1149 (2022-11-08 10:11:02)

Update pipeline-scc to not allow privilege escalation
# Changes

This SCC shouldn't allow privilege escalation at all.

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [x] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

```release-note
On Openshift, the pipelines-scc doesn't allow privilege escalation anymore
```


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please ask for approval from **vdemeester** after the PR has been reviewed.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["vdemeester"]} -->
tekton-robot: @vdemeester: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 804c87cadf9a1b6a836cc9982c39dcdd0b7df1b9 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1149/pull-tekton-operator-integration-tests/1589923446580580352) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1149). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Avdemeester).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
vdemeester: /hold
vdemeester: /hold cancel
/retest

adambkaplan: @vdemeester would this be a breaking change for users? Are there any Red Hat-supported tasks which require this in their pod security context?
tekton-robot: @vdemeester: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 804c87cadf9a1b6a836cc9982c39dcdd0b7df1b9 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1149/pull-tekton-operator-integration-tests/1590014595999731712) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1149). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3Avdemeester).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/cmd/openshift/operator/kodata/openshift/00-prereconcile/openshift-pipelines-scc.yaml b/cmd/openshift/operator/kodata/openshift/00-prereconcile/openshift-pipelines-scc.yaml
index dc14f02fb..2d787dd36 100644
--- a/cmd/openshift/operator/kodata/openshift/00-prereconcile/openshift-pipelines-scc.yaml
+++ b/cmd/openshift/operator/kodata/openshift/00-prereconcile/openshift-pipelines-scc.yaml
@@ -13,7 +13,7 @@ allowHostIPC: false
 allowHostNetwork: false
 allowHostPID: false
 allowHostPorts: false
-allowPrivilegeEscalation: true
+allowPrivilegeEscalation: false
 allowPrivilegedContainer: false
 allowedCapabilities:
 - SETFCAP
diff --git a/components.yaml b/components.yaml
index 8695df4a6..bf03ae83d 100644
--- a/components.yaml
+++ b/components.yaml
@@ -1,6 +1,6 @@
 chains:
   github: tektoncd/chains
-  version: v0.12.0
+  version: v0.13.0
 dashboard:
   github: tektoncd/dashboard
   version: v0.30.0
@@ -12,7 +12,7 @@ pipeline:
   version: v0.41.0
 pipelines-as-code:
   github: openshift-pipelines/pipelines-as-code
-  version: v0.12.0
+  version: v0.13.1
 results:
   github: tektoncd/results
   version: v0.4.0
diff --git a/config/base/300-operator_v1alpha1_chain_crd.yaml b/config/base/300-operator_v1alpha1_chain_crd.yaml
index 6308212d6..8e5297fbf 100644
--- a/config/base/300-operator_v1alpha1_chain_crd.yaml
+++ b/config/base/300-operator_v1alpha1_chain_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/base/300-operator_v1alpha1_config_crd.yaml b/config/base/300-operator_v1alpha1_config_crd.yaml
index a9388e59a..e1a5823a2 100644
--- a/config/base/300-operator_v1alpha1_config_crd.yaml
+++ b/config/base/300-operator_v1alpha1_config_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/base/300-operator_v1alpha1_hub_crd.yaml b/config/base/300-operator_v1alpha1_hub_crd.yaml
index 7729ba8b3..e143cf3a0 100644
--- a/config/base/300-operator_v1alpha1_hub_crd.yaml
+++ b/config/base/300-operator_v1alpha1_hub_crd.yaml
@@ -41,7 +41,7 @@ spec:
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
-        - jsonPath: '.status.conditions[?(@.type=="Ready")].reason'
+        - jsonPath: '.status.conditions[?(@.type=="Ready")].message'
           name: Reason
           type: string
         - jsonPath: .status.apiUrl
diff --git a/config/base/300-operator_v1alpha1_installer_set_crd.yaml b/config/base/300-operator_v1alpha1_installer_set_crd.yaml
index 0dd14f350..c9be91874 100644
--- a/config/base/300-operator_v1alpha1_installer_set_crd.yaml
+++ b/config/base/300-operator_v1alpha1_installer_set_crd.yaml
@@ -38,7 +38,7 @@ spec:
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
-        - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+        - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
           name: Reason
           type: string
       schema:
diff --git a/config/base/300-operator_v1alpha1_pipeline_crd.yaml b/config/base/300-operator_v1alpha1_pipeline_crd.yaml
index f82d63233..8a029f7eb 100644
--- a/config/base/300-operator_v1alpha1_pipeline_crd.yaml
+++ b/config/base/300-operator_v1alpha1_pipeline_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/base/300-operator_v1alpha1_trigger_crd.yaml b/config/base/300-operator_v1alpha1_trigger_crd.yaml
index 73361619e..d5c49f595 100644
--- a/config/base/300-operator_v1alpha1_trigger_crd.yaml
+++ b/config/base/300-operator_v1alpha1_trigger_crd.yaml
@@ -41,7 +41,7 @@ spec:
       - jsonPath: .status.conditions[?(@.type=="Ready")].status
         name: Ready
         type: string
-      - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+      - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
         name: Reason
         type: string
     schema:
diff --git a/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml b/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
index 3b224dd6b..0828e4f3b 100644
--- a/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
+++ b/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml b/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
index 859a8b9e6..67600701f 100644
--- a/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
+++ b/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml b/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
index 9309979be..b3bcbc7ae 100644
--- a/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
+++ b/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
@@ -41,7 +41,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/config/openshift/base/300-operator_v1alpha1_openshiftpipelinesascode_crd.yaml b/config/openshift/base/300-operator_v1alpha1_openshiftpipelinesascode_crd.yaml
index 741452d92..4be4d8909 100644
--- a/config/openshift/base/300-operator_v1alpha1_openshiftpipelinesascode_crd.yaml
+++ b/config/openshift/base/300-operator_v1alpha1_openshiftpipelinesascode_crd.yaml
@@ -44,7 +44,7 @@ spec:
     - jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
       type: string
-    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason"
+    - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message"
       name: Reason
       type: string
     schema:
diff --git a/go.mod b/go.mod
index 9af9476af..c1b3e6d53 100644
--- a/go.mod
+++ b/go.mod
@@ -14,6 +14,7 @@ require (
 	github.com/manifestival/controller-runtime-client v0.4.0
 	github.com/manifestival/manifestival v0.7.1
 	github.com/markbates/inflect v1.0.4
+	github.com/openshift-pipelines/pipelines-as-code v0.13.0
 	github.com/openshift/api v0.0.0-20210910062324-a41d3573a3ba
 	github.com/openshift/client-go v0.0.0-20210521082421-73d9475a9142
 	github.com/sigstore/cosign v1.13.1
@@ -44,7 +45,7 @@ require (
 	bitbucket.org/creachadair/shell v0.0.7 // indirect
 	cloud.google.com/go/compute v1.10.0 // indirect
 	contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d // indirect
-	contrib.go.opencensus.io/exporter/prometheus v0.4.0 // indirect
+	contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
 	cuelang.org/go v0.4.3 // indirect
 	github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go v67.0.0+incompatible // indirect
@@ -119,13 +120,13 @@ require (
 	github.com/emicklei/proto v1.6.15 // indirect
 	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
-	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/fullstorydev/grpcurl v1.8.7 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
-	github.com/go-kit/log v0.2.0 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -171,7 +172,7 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.1 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add // indirect
 	github.com/inconshreveable/mousetrap v1.0.1 // indirect
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
@@ -203,7 +204,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/openzipkin/zipkin-go v0.3.0 // indirect
+	github.com/openzipkin/zipkin-go v0.4.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -212,7 +213,7 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
-	github.com/prometheus/statsd_exporter v0.21.0 // indirect
+	github.com/prometheus/statsd_exporter v0.22.8 // indirect
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20201118171849-f6a6b3f636fc // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
@@ -296,9 +297,9 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/apiextensions-apiserver v0.25.2 // indirect
 	k8s.io/gengo v0.0.0-20220613173612-397b4ae3bce7 // indirect
-	k8s.io/klog/v2 v2.70.2-0.20220707122935-0990e81f1a8f // indirect
+	k8s.io/klog/v2 v2.80.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
-	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
+	k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 // indirect
 	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
 	sigs.k8s.io/release-utils v0.7.3 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
diff --git a/go.sum b/go.sum
index 15596e4b4..3a7dedd8a 100644
--- a/go.sum
+++ b/go.sum
@@ -82,8 +82,8 @@ contrib.go.opencensus.io/exporter/aws v0.0.0-20181029163544-2befc13012d0/go.mod
 contrib.go.opencensus.io/exporter/ocagent v0.5.0/go.mod h1:ImxhfLRpxoYiSq891pBrLVhN+qmP8BTVvdH2YLs7Gl0=
 contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d h1:LblfooH1lKOpp1hIhukktmSAxFkqMPFk9KR6iZ0MJNI=
 contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d/go.mod h1:IshRmMJBhDfFj5Y67nVhMYTTIze91RUeT73ipWKs/GY=
-contrib.go.opencensus.io/exporter/prometheus v0.4.0 h1:0QfIkj9z/iVZgK31D9H9ohjjIDApI2GOPScCKwxedbs=
-contrib.go.opencensus.io/exporter/prometheus v0.4.0/go.mod h1:o7cosnyfuPVK0tB8q0QmaQNhGnptITnPQB+z1+qeFB0=
+contrib.go.opencensus.io/exporter/prometheus v0.4.2 h1:sqfsYl5GIY/L570iT+l93ehxaWJs2/OwXtiWwew3oAg=
+contrib.go.opencensus.io/exporter/prometheus v0.4.2/go.mod h1:dvEHbiKmgvbr5pjaF9fpw1KeYcjrnC1J8B+JKjsZyRQ=
 contrib.go.opencensus.io/exporter/stackdriver v0.12.1/go.mod h1:iwB6wGarfphGGe/e5CWqyUk/cLzKnWsOKPVW3no6OTw=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.5/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.12/go.mod h1:mmxnWlrvrFdpiOHOhxBaVi1rkc0WOqhgfknj4Yg0SeQ=
@@ -217,6 +217,7 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
 github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.2/go.mod h1:sCavSAvdzOjul4cEqeVtvlSaSScfNsTQ+46HwlTL1hc=
 github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 h1:iC9YFYKDGEy3n/FtqJnOkZsene9olVspKmkX5A2YBEo=
@@ -259,7 +260,7 @@ github.com/aliyun/credentials-go v1.2.3/go.mod h1:/KowD1cfGSLrLsH28Jr8W+xwoId0yw
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20220418222510-f25a4f6275ed h1:ue9pVfIcP+QMEjfgo/Ez4ZjNZfonGgR6NgjMaJMu1Cg=
+github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 h1:yL7+Jz0jTC6yykIK/Wh74gnTJnrGr5AyrNMXuA0gves=
 github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
 github.com/apache/beam v2.28.0+incompatible/go.mod h1:/8NX3Qi8vGstDLLaeaU7+lzVEu/ACaQhYjeefzQ0y1o=
 github.com/apache/beam/sdks/v2 v2.0.0-20211012030016-ef4364519c94/go.mod h1:/kOom7hCyHVzAC/Z7HbZywkZZv6ywF+wb4CvgDVdcB8=
@@ -638,8 +639,8 @@ github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMi
 github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
+github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch/v5 v5.0.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
 github.com/evanphx/json-patch/v5 v5.2.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
 github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
@@ -691,8 +692,9 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-kit/log v0.2.0 h1:7i2K3eKTos3Vc0enKCfnVcgHh2olr/MyfboYq7cAcFw=
 github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
+github.com/go-kit/log v0.2.1 h1:MRVx0/zhvdseW+Gza6N9rVzU/IVzaeE1SFI4raAhmBU=
+github.com/go-kit/log v0.2.1/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
@@ -1124,8 +1126,8 @@ github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.9/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add h1:DAh7mHiRT7wc6kKepYdCpH16ElPciMPQWJaJ7H3l/ng=
 github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add/go.mod h1:DQI8vlV6h6qSY/tCOoYKtxjWrkyiNpJ3WTV/WoBllmQ=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
@@ -1425,6 +1427,8 @@ github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.m
 github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
 github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
 github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
+github.com/openshift-pipelines/pipelines-as-code v0.13.0 h1:k3QjGbQqPNzgkoAKm8HV1/c/hpc33mZbj35E+5WKCxY=
+github.com/openshift-pipelines/pipelines-as-code v0.13.0/go.mod h1:4oe67+pzT1JwOe2pQ4+uXy/YbFC6PCDIR7xdS3wbHKQ=
 github.com/openshift/api v0.0.0-20210521075222-e273a339932a/go.mod h1:izBmoXbUu3z5kUa4FjZhvekTsyzIWiOoaIgJiZBBMQs=
 github.com/openshift/api v0.0.0-20210910062324-a41d3573a3ba h1:aimcu15biJzq4gp0LPsa4cOucfiILIgy/PimUO9ncpc=
 github.com/openshift/api v0.0.0-20210910062324-a41d3573a3ba/go.mod h1:izBmoXbUu3z5kUa4FjZhvekTsyzIWiOoaIgJiZBBMQs=
@@ -1441,8 +1445,8 @@ github.com/openzipkin-contrib/zipkin-go-opentracing v0.4.5/go.mod h1:/wsWhb9smxS
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/openzipkin/zipkin-go v0.2.1/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
 github.com/openzipkin/zipkin-go v0.2.2/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
-github.com/openzipkin/zipkin-go v0.3.0 h1:XtuXmOLIXLjiU2XduuWREDT0LOKtSgos/g7i7RYyoZQ=
-github.com/openzipkin/zipkin-go v0.3.0/go.mod h1:4c3sLeE8xjNqehmF5RpAFLPLJxXscc0R4l6Zg0P1tTQ=
+github.com/openzipkin/zipkin-go v0.4.0 h1:CtfRrOVZtbDj8rt1WXjklw0kqqJQwICrCKmlfUuBUUw=
+github.com/openzipkin/zipkin-go v0.4.0/go.mod h1:4c3sLeE8xjNqehmF5RpAFLPLJxXscc0R4l6Zg0P1tTQ=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
@@ -1494,6 +1498,7 @@ github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3e
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
+github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_golang v1.13.0 h1:b71QUfeo5M8gq2+evJdTPfZhYMAU0uKPkyPJ7TPsloU=
 github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
@@ -1515,9 +1520,9 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.28.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
 github.com/prometheus/common v0.34.0/go.mod h1:gB3sOl7P0TvJabZpLY5uQMpUqRCPPCyRLCZYc7JZTNE=
+github.com/prometheus/common v0.35.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
 github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1536,8 +1541,9 @@ github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1
 github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
 github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/prometheus/prometheus v2.5.0+incompatible/go.mod h1:oAIUtOny2rjMX0OWN5vPR5/q/twIROJvdqnQKDdil/s=
-github.com/prometheus/statsd_exporter v0.21.0 h1:hA05Q5RFeIjgwKIYEdFd59xu5Wwaznf33yKI+pyX6T8=
-github.com/prometheus/statsd_exporter v0.21.0/go.mod h1:rbT83sZq2V+p73lHhPZfMc3MLCHmSHelCh9hSGYNLTQ=
+github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI=
+github.com/prometheus/statsd_exporter v0.22.8 h1:Qo2D9ZzaQG+id9i5NYNGmbf1aa/KxKbB9aKfMS+Yib0=
+github.com/prometheus/statsd_exporter v0.22.8/go.mod h1:/DzwbTEaFTE0Ojz5PqcSk6+PFHOPWGxdXVr6yC8eFOM=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20201118171849-f6a6b3f636fc h1:gSVONBi2HWMFXCa9jFdYvYk7IwW/mTLxWOF7rXS4LO0=
 github.com/protocolbuffers/txtpbfmt v0.0.0-20201118171849-f6a6b3f636fc/go.mod h1:KbKfKPy2I6ecOIGA9apfheFv14+P3RSmmQvshofQyMY=
@@ -1688,6 +1694,7 @@ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1F
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -2276,6 +2283,7 @@ golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220708085239-5a0f0661e09d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
@@ -2702,6 +2710,7 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
@@ -2782,8 +2791,8 @@ k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.8.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
 k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
 k8s.io/klog/v2 v2.40.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.70.2-0.20220707122935-0990e81f1a8f h1:dltw7bAn8bCrQ2CmzzhgoieUZEbWqrvIGVdHGioP5nY=
-k8s.io/klog/v2 v2.70.2-0.20220707122935-0990e81f1a8f/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
+k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30/go.mod h1:BXM9ceUBTj2QnfH2MK1odQs778ajze1RxcmP6S8RVVc=
 k8s.io/kube-openapi v0.0.0-20200204173128-addea2498afe/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
 k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
@@ -2798,9 +2807,9 @@ k8s.io/utils v0.0.0-20200729134348-d5654de09c73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20200912215256-4140de9c8800/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed h1:jAne/RjBTyawwAy0utX5eqigAwz/lQhTmy+Hr/Cpue4=
-k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-knative.dev/eventing v0.30.1-0.20220407170245-58865afba92c h1:5QvWwe3uB7BefHGMg6hC05YVi+zr1kGK7DVMFquqJMI=
+k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 h1:H9TCJUUx+2VA0ZiD9lvtaX8fthFsMoD+Izn93E/hm8U=
+k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+knative.dev/eventing v0.34.2 h1:JaY8WhpFQuwjI6PYvme3KS0kvX677F6rH16mI6IDYqk=
 knative.dev/networking v0.0.0-20220404212543-dde40b019aff h1:pqzWi29qb44TY+5xtc9vty4mSyUYvojXZGCp0y/91eo=
 knative.dev/pkg v0.0.0-20221011175852-714b7630a836 h1:0N7Zo/O+xeUUebJPm9keBaGclrUoEbljr3J1MsqtaIM=
 knative.dev/pkg v0.0.0-20221011175852-714b7630a836/go.mod h1:DMTRDJ5WRxf/DrlOPzohzfhSuJggscLZ8EavOq9O/x8=
diff --git a/pkg/apis/operator/v1alpha1/openshift_platform.go b/pkg/apis/operator/v1alpha1/openshift_platform.go
index 2268f90b1..aecf681f6 100644
--- a/pkg/apis/operator/v1alpha1/openshift_platform.go
+++ b/pkg/apis/operator/v1alpha1/openshift_platform.go
@@ -26,4 +26,7 @@ type PipelinesAsCode struct {
 	// Enable or disable pipelines as code by changing this bool
 	// +optional
 	Enable *bool `json:"enable,omitempty"`
+	// PACSettings allows user to configure PAC configurations
+	// +optional
+	PACSettings `json:",inline"`
 }
diff --git a/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_defaults.go b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_defaults.go
new file mode 100644
index 000000000..368660578
--- /dev/null
+++ b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_defaults.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	"context"
+
+	"github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings"
+)
+
+func (pac *OpenShiftPipelinesAsCode) SetDefaults(ctx context.Context) {
+	if pac.Spec.PACSettings.Settings == nil {
+		pac.Spec.PACSettings.Settings = map[string]string{}
+	}
+	setPACDefaults(pac.Spec.PACSettings)
+}
+
+func setPACDefaults(set PACSettings) {
+	if set.Settings == nil {
+		set.Settings = map[string]string{}
+	}
+	settings.SetDefaults(set.Settings)
+}
diff --git a/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_types.go b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_types.go
index 73376aa8d..706cc45e3 100644
--- a/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_types.go
+++ b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_types.go
@@ -46,8 +46,9 @@ func (pac *OpenShiftPipelinesAsCode) GetStatus() TektonComponentStatus {
 
 // OpenShiftPipelinesAsCodeSpec defines the desired state of OpenShiftPipelinesAsCode
 type OpenShiftPipelinesAsCodeSpec struct {
-	CommonSpec `json:",inline"`
-	Config     Config `json:"config,omitempty"`
+	CommonSpec  `json:",inline"`
+	Config      Config `json:"config,omitempty"`
+	PACSettings `json:",inline"`
 }
 
 // OpenShiftPipelinesAsCodeStatus defines the observed state of OpenShiftPipelinesAsCode
@@ -66,3 +67,7 @@ type OpenShiftPipelinesAsCodeList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []OpenShiftPipelinesAsCode `json:"items"`
 }
+
+type PACSettings struct {
+	Settings map[string]string `json:"settings,omitempty"`
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/pipelinesascode.go b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_validation.go
similarity index 51%
rename from pkg/reconciler/openshift/tektonaddon/pipelinesascode.go
rename to pkg/apis/operator/v1alpha1/openshiftpipelinesascode_validation.go
index 339b9d2ab..5f8d4f1aa 100644
--- a/pkg/reconciler/openshift/tektonaddon/pipelinesascode.go
+++ b/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_validation.go
@@ -14,29 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package tektonaddon
+package v1alpha1
 
 import (
 	"context"
 
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings"
+	"knative.dev/pkg/apis"
 )
 
-var pacLS = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.InstallerSetType: PACInstallerSet,
-	},
-}
-
-func (r *Reconciler) CleanupPipelinesAsCode(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	pacLabelSelector, err := common.LabelSelector(pacLS)
-	if err != nil {
-		return err
+func (pac *OpenShiftPipelinesAsCode) Validate(ctx context.Context) (errs *apis.FieldError) {
+	if apis.IsInDelete(ctx) {
+		return nil
 	}
-	if err := r.deleteInstallerSet(ctx, pacLabelSelector); err != nil {
+	if err := validatePACSetting(pac.Spec.PACSettings); err != nil {
 		return err
 	}
 	return nil
 }
+
+func validatePACSetting(pacSettings PACSettings) *apis.FieldError {
+	var errs *apis.FieldError
+
+	if err := settings.Validate(pacSettings.Settings); err != nil {
+		errs = errs.Also(apis.ErrInvalidValue(err, "spec.platforms.openshift.pipelinesAsCode"))
+	}
+	return errs
+}
diff --git a/pkg/apis/operator/v1alpha1/tektonconfig_defaults.go b/pkg/apis/operator/v1alpha1/tektonconfig_defaults.go
index 36576bd27..5e51739ea 100644
--- a/pkg/apis/operator/v1alpha1/tektonconfig_defaults.go
+++ b/pkg/apis/operator/v1alpha1/tektonconfig_defaults.go
@@ -34,6 +34,9 @@ func (tc *TektonConfig) SetDefaults(ctx context.Context) {
 		if tc.Spec.Platforms.OpenShift.PipelinesAsCode == nil {
 			tc.Spec.Platforms.OpenShift.PipelinesAsCode = &PipelinesAsCode{
 				Enable: ptr.Bool(true),
+				PACSettings: PACSettings{
+					Settings: map[string]string{},
+				},
 			}
 		} else {
 			tc.Spec.Addon.EnablePAC = nil
@@ -42,6 +45,12 @@ func (tc *TektonConfig) SetDefaults(ctx context.Context) {
 		// check if PAC is disabled through addon before enabling through OpenShiftPipelinesAsCode
 		if tc.Spec.Addon.EnablePAC != nil && !*tc.Spec.Addon.EnablePAC {
 			tc.Spec.Platforms.OpenShift.PipelinesAsCode.Enable = ptr.Bool(false)
+			tc.Spec.Platforms.OpenShift.PipelinesAsCode.PACSettings.Settings = nil
+		}
+
+		// pac defaulting
+		if *tc.Spec.Platforms.OpenShift.PipelinesAsCode.Enable {
+			setPACDefaults(tc.Spec.Platforms.OpenShift.PipelinesAsCode.PACSettings)
 		}
 
 		setAddonDefaults(&tc.Spec.Addon)
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
index 919888119..093ea582a 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
@@ -80,6 +80,20 @@ func (p *Pipeline) setDefaults() {
 		p.MetricsTaskrunLevel = config.DefaultTaskrunLevel
 	}
 
+	// Resolvers
+	if p.EnableBundlesResolver == nil {
+		p.EnableBundlesResolver = ptr.Bool(true)
+	}
+	if p.EnableClusterResolver == nil {
+		p.EnableClusterResolver = ptr.Bool(true)
+	}
+	if p.EnableHubResolver == nil {
+		p.EnableHubResolver = ptr.Bool(true)
+	}
+	if p.EnableGitResolver == nil {
+		p.EnableGitResolver = ptr.Bool(true)
+	}
+
 	// run platform specific defaulting
 	if IsOpenShiftPlatform() {
 		p.openshiftDefaulting()
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_types.go b/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
index 125bf509b..8bc0cf3e6 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
@@ -101,6 +101,8 @@ type PipelineProperties struct {
 	PipelineMetricsProperties  `json:",inline"`
 	// +optional
 	OptionalPipelineProperties `json:",inline"`
+	// +optional
+	Resolvers `json:",inline"`
 }
 
 // OptionalPipelineProperties defines the fields which are to be
@@ -124,3 +126,20 @@ type PipelineMetricsProperties struct {
 	MetricsPipelinerunLevel        string `json:"metrics.pipelinerun.level,omitempty"`
 	MetricsPipelinerunDurationType string `json:"metrics.pipelinerun.duration-type,omitempty"`
 }
+
+// Resolvers defines the fields to configure resolvers
+type Resolvers struct {
+	EnableBundlesResolver *bool `json:"enable-bundles-resolver,omitempty"`
+	EnableHubResolver     *bool `json:"enable-hub-resolver,omitempty"`
+	EnableGitResolver     *bool `json:"enable-git-resolver,omitempty"`
+	EnableClusterResolver *bool `json:"enable-cluster-resolver,omitempty"`
+	ResolversConfig       `json:",inline"`
+}
+
+// ResolversConfig defines the fields to configure each of the resolver
+type ResolversConfig struct {
+	BundlesResolverConfig map[string]string `json:"bundles-resolver-config,omitempty"`
+	HubResolverConfig     map[string]string `json:"hub-resolver-config,omitempty"`
+	GitResolverConfig     map[string]string `json:"git-resolver-config,omitempty"`
+	ClusterResolverConfig map[string]string `json:"cluster-resolver-config,omitempty"`
+}
diff --git a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
index c01836ed5..52c73c3a0 100644
--- a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
@@ -303,6 +303,7 @@ func (in *OpenShiftPipelinesAsCodeSpec) DeepCopyInto(out *OpenShiftPipelinesAsCo
 	*out = *in
 	out.CommonSpec = in.CommonSpec
 	in.Config.DeepCopyInto(&out.Config)
+	in.PACSettings.DeepCopyInto(&out.PACSettings)
 	return
 }
 
@@ -370,6 +371,29 @@ func (in *OptionalTriggersProperties) DeepCopy() *OptionalTriggersProperties {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PACSettings) DeepCopyInto(out *PACSettings) {
+	*out = *in
+	if in.Settings != nil {
+		in, out := &in.Settings, &out.Settings
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PACSettings.
+func (in *PACSettings) DeepCopy() *PACSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(PACSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Param) DeepCopyInto(out *Param) {
 	*out = *in
@@ -495,6 +519,7 @@ func (in *PipelineProperties) DeepCopyInto(out *PipelineProperties) {
 	}
 	out.PipelineMetricsProperties = in.PipelineMetricsProperties
 	in.OptionalPipelineProperties.DeepCopyInto(&out.OptionalPipelineProperties)
+	in.Resolvers.DeepCopyInto(&out.Resolvers)
 	return
 }
 
@@ -516,6 +541,7 @@ func (in *PipelinesAsCode) DeepCopyInto(out *PipelinesAsCode) {
 		*out = new(bool)
 		**out = **in
 	}
+	in.PACSettings.DeepCopyInto(&out.PACSettings)
 	return
 }
 
@@ -577,6 +603,87 @@ func (in *Prune) DeepCopy() *Prune {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resolvers) DeepCopyInto(out *Resolvers) {
+	*out = *in
+	if in.EnableBundlesResolver != nil {
+		in, out := &in.EnableBundlesResolver, &out.EnableBundlesResolver
+		*out = new(bool)
+		**out = **in
+	}
+	if in.EnableHubResolver != nil {
+		in, out := &in.EnableHubResolver, &out.EnableHubResolver
+		*out = new(bool)
+		**out = **in
+	}
+	if in.EnableGitResolver != nil {
+		in, out := &in.EnableGitResolver, &out.EnableGitResolver
+		*out = new(bool)
+		**out = **in
+	}
+	if in.EnableClusterResolver != nil {
+		in, out := &in.EnableClusterResolver, &out.EnableClusterResolver
+		*out = new(bool)
+		**out = **in
+	}
+	in.ResolversConfig.DeepCopyInto(&out.ResolversConfig)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resolvers.
+func (in *Resolvers) DeepCopy() *Resolvers {
+	if in == nil {
+		return nil
+	}
+	out := new(Resolvers)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResolversConfig) DeepCopyInto(out *ResolversConfig) {
+	*out = *in
+	if in.BundlesResolverConfig != nil {
+		in, out := &in.BundlesResolverConfig, &out.BundlesResolverConfig
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.HubResolverConfig != nil {
+		in, out := &in.HubResolverConfig, &out.HubResolverConfig
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.GitResolverConfig != nil {
+		in, out := &in.GitResolverConfig, &out.GitResolverConfig
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.ClusterResolverConfig != nil {
+		in, out := &in.ClusterResolverConfig, &out.ClusterResolverConfig
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResolversConfig.
+func (in *ResolversConfig) DeepCopy() *ResolversConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ResolversConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TektonAddon) DeepCopyInto(out *TektonAddon) {
 	*out = *in
diff --git a/pkg/reconciler/common/transformers.go b/pkg/reconciler/common/transformers.go
index 529628f83..ea580601d 100644
--- a/pkg/reconciler/common/transformers.go
+++ b/pkg/reconciler/common/transformers.go
@@ -643,6 +643,51 @@ func AddDeploymentRestrictedPSA() mf.Transformer {
 	}
 }
 
+// AddStatefulSetRestrictedPSA will add the default restricted spec on StatefulSet to remove errors/warning
+func AddStatefulSetRestrictedPSA() mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		if strings.ToLower(u.GetKind()) != "statefulset" {
+			return nil
+		}
+
+		s := &appsv1.StatefulSet{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, s)
+		if err != nil {
+			return err
+		}
+
+		if s.Spec.Template.Spec.SecurityContext == nil {
+			s.Spec.Template.Spec.SecurityContext = &corev1.PodSecurityContext{}
+		}
+
+		if s.Spec.Template.Spec.SecurityContext.RunAsNonRoot == nil {
+			s.Spec.Template.Spec.SecurityContext.RunAsNonRoot = ptr.Bool(runAsNonRootValue)
+		}
+
+		if s.Spec.Template.Spec.SecurityContext.SeccompProfile == nil {
+			s.Spec.Template.Spec.SecurityContext.SeccompProfile = &corev1.SeccompProfile{
+				Type: corev1.SeccompProfileTypeRuntimeDefault,
+			}
+		}
+
+		for i := range s.Spec.Template.Spec.Containers {
+			c := &s.Spec.Template.Spec.Containers[i]
+			if c.SecurityContext == nil {
+				c.SecurityContext = &corev1.SecurityContext{}
+			}
+			c.SecurityContext.AllowPrivilegeEscalation = ptr.Bool(allowPrivilegedEscalationValue)
+			c.SecurityContext.Capabilities = &corev1.Capabilities{Drop: []corev1.Capability{"ALL"}}
+		}
+
+		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(s)
+		if err != nil {
+			return err
+		}
+		u.SetUnstructuredContent(unstrObj)
+		return nil
+	}
+}
+
 // AddJobRestrictedPSA will add the default restricted spec on Job to remove errors/warning
 func AddJobRestrictedPSA() mf.Transformer {
 	return func(u *unstructured.Unstructured) error {
@@ -690,3 +735,45 @@ func AddJobRestrictedPSA() mf.Transformer {
 		return nil
 	}
 }
+
+// CopyConfigMap will copy all the values from the passed configmap to the configmap
+// in the manifest, the fields which are in manifest configmap will only be copied
+// any extra field will be ignored
+func CopyConfigMap(configMapName string, expectedValues map[string]string) mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		kind := strings.ToLower(u.GetKind())
+		if kind != "configmap" {
+			return nil
+		}
+		if u.GetName() != configMapName {
+			return nil
+		}
+
+		cm := &corev1.ConfigMap{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, cm)
+		if err != nil {
+			return err
+		}
+		if cm.Data == nil {
+			// we don't add any field in the manifest configmap
+			// we will copy any value if defined by user
+			return nil
+		}
+
+		for key := range cm.Data {
+			// check if the key is defined in the expected map
+			value, ok := expectedValues[key]
+			if ok {
+				// if yes then copy the value
+				cm.Data[key] = value
+			}
+		}
+		unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(cm)
+		if err != nil {
+			return err
+		}
+
+		u.SetUnstructuredContent(unstrObj)
+		return nil
+	}
+}
diff --git a/pkg/reconciler/kubernetes/tektonchain/tektonchain.go b/pkg/reconciler/kubernetes/tektonchain/tektonchain.go
index d5a8c63ca..4c9de4b1e 100644
--- a/pkg/reconciler/kubernetes/tektonchain/tektonchain.go
+++ b/pkg/reconciler/kubernetes/tektonchain/tektonchain.go
@@ -393,6 +393,7 @@ func (r *Reconciler) transform(ctx context.Context, manifest *mf.Manifest, comp
 		common.DeploymentImages(chainImages),
 		common.AddConfiguration(instance.Spec.Config),
 		common.AddConfigMapValues(ChainsConfig, instance.Spec.Chain),
+		common.AddDeploymentRestrictedPSA(),
 	}
 	extra = append(extra, r.extension.Transformers(instance)...)
 	return common.Transform(ctx, manifest, instance, extra...)
diff --git a/pkg/reconciler/kubernetes/tektonconfig/extension.go b/pkg/reconciler/kubernetes/tektonconfig/extension.go
index f6b1f759c..0a7361fdb 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/extension.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/extension.go
@@ -49,7 +49,7 @@ func (oe kubernetesExtension) PostReconcile(ctx context.Context, comp v1alpha1.T
 
 	if configInstance.Spec.Profile == v1alpha1.ProfileAll {
 		if _, err := extension.EnsureTektonDashboardExists(ctx, oe.operatorClientSet.OperatorV1alpha1().TektonDashboards(), configInstance); err != nil {
-			configInstance.Status.MarkComponentNotReady(fmt.Sprintf("TektonDashboard: %s", err.Error()))
+			configInstance.Status.MarkPostInstallFailed(fmt.Sprintf("TektonDashboard: %s", err.Error()))
 			return v1alpha1.REQUEUE_EVENT_AFTER
 		}
 	}
diff --git a/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go b/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
index a7f253f05..24261ca95 100644
--- a/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
+++ b/pkg/reconciler/kubernetes/tektondashboard/tektondashboard.go
@@ -112,10 +112,10 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.Tekton
 // ReconcileKind compares the actual state with the desired, and attempts to
 // converge the two.
 func (r *Reconciler) ReconcileKind(ctx context.Context, td *v1alpha1.TektonDashboard) pkgreconciler.Event {
-
 	logger := logging.FromContext(ctx)
 	td.Status.InitializeConditions()
 	td.Status.ObservedGeneration = td.Generation
+	td.Status.SetVersion(r.dashboardVersion)
 
 	logger.Infow("Reconciling TektonDashboards", "status", td.Status)
 
@@ -311,6 +311,7 @@ func (r *Reconciler) transform(ctx context.Context, manifest *mf.Manifest, comp
 		common.InjectOperandNameLabelOverwriteExisting(v1alpha1.OperandTektoncdDashboard),
 		common.ApplyProxySettings,
 		common.AddConfiguration(instance.Spec.Config),
+		common.AddDeploymentRestrictedPSA(),
 	}
 	extra = append(extra, r.extension.Transformers(instance)...)
 	return common.Transform(ctx, manifest, instance, extra...)
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/check.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/check.go
index 56a25a657..a2b7ee364 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/check.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/check.go
@@ -69,10 +69,14 @@ func (i *InstallerSetClient) checkSet(ctx context.Context, comp v1alpha1.TektonC
 			logger.Errorf("%v/%v: found multiple sets, expected one", i.resourceKind, isType)
 			return iSets, ErrInvalidState
 		}
-	case InstallerTypeCustom:
-		// TODO
 	default:
-		return nil, fmt.Errorf("invalid installerSet type")
+		if !strings.HasPrefix(isType, InstallerTypeCustom) {
+			return nil, fmt.Errorf("invalid installerSet type")
+		}
+		if len(iSets) != 1 {
+			logger.Errorf("%v/%v: found multiple sets, expected one", i.resourceKind, isType)
+			return iSets, ErrInvalidState
+		}
 	}
 
 	if err := verifyMeta(i.resourceKind, isType, logger, iSets[0], comp, i.releaseVersion); err != nil {
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/cleanup.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/cleanup.go
index 7c9c056d8..05d465109 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/cleanup.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/cleanup.go
@@ -21,8 +21,11 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/selection"
 	"knative.dev/pkg/logging"
 )
 
@@ -80,6 +83,26 @@ func (i *InstallerSetClient) CleanupPostSet(ctx context.Context) error {
 	return i.cleanup(ctx, InstallerTypePost)
 }
 
+func (i *InstallerSetClient) CleanupCustomSet(ctx context.Context, customName string) error {
+	setType := InstallerTypeCustom + "-" + strings.ToLower(customName)
+	return i.cleanup(ctx, setType)
+}
+
+func (i *InstallerSetClient) CleanupAllCustomSet(ctx context.Context) error {
+	labelSelector := labels.NewSelector()
+	createdReq, _ := labels.NewRequirement(v1alpha1.CreatedByKey, selection.Equals, []string{i.resourceKind})
+	if createdReq != nil {
+		labelSelector = labelSelector.Add(*createdReq)
+	}
+	err := i.clientSet.DeleteCollection(ctx, metav1.DeleteOptions{}, metav1.ListOptions{
+		LabelSelector: labelSelector.String(),
+	})
+	if err != nil {
+		return fmt.Errorf("failed to delete %s custom sets: %v", i.resourceKind, err)
+	}
+	return nil
+}
+
 func (i *InstallerSetClient) cleanup(ctx context.Context, isType string) error {
 	logger := logging.FromContext(ctx).With("kind", i.resourceKind, "type", isType)
 
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
index beb4b616d..7f59d9ad5 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/create.go
@@ -33,38 +33,28 @@ import (
 func (i *InstallerSetClient) create(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform, isType string) ([]v1alpha1.TektonInstallerSet, error) {
 	logger := logging.FromContext(ctx).With("kind", i.resourceKind, "type", isType)
 
-	switch isType {
-	case InstallerTypeMain:
+	if isType == InstallerTypeMain {
 		sets, err := i.makeMainSets(ctx, comp, manifest, filterAndTransform)
 		if err != nil {
 			logger.Errorf("installer set creation failed for main type: %v", err)
 			return sets, err
 		}
 		return sets, nil
+	}
 
-	case InstallerTypePre, InstallerTypePost:
-		kind := strings.ToLower(strings.TrimPrefix(i.resourceKind, "Tekton"))
-		isName := fmt.Sprintf("%s-%s-", kind, isType)
-
-		iS, err := i.makeInstallerSet(ctx, comp, manifest, filterAndTransform, isName, isType)
-		if err != nil {
-			return nil, err
-		}
-
-		iS, err = i.clientSet.Create(ctx, iS, metav1.CreateOptions{})
-		if err != nil {
-			return nil, err
-		}
-		return []v1alpha1.TektonInstallerSet{*iS}, nil
-
-	case InstallerTypeCustom:
-	// TODO
+	kind := strings.ToLower(strings.TrimPrefix(i.resourceKind, "Tekton"))
+	isName := fmt.Sprintf("%s-%s-", kind, isType)
 
-	default:
-		return nil, fmt.Errorf("invalid installer set type")
+	iS, err := i.makeInstallerSet(ctx, comp, manifest, filterAndTransform, isName, isType)
+	if err != nil {
+		return nil, err
 	}
 
-	return nil, nil
+	iS, err = i.clientSet.Create(ctx, iS, metav1.CreateOptions{})
+	if err != nil {
+		return nil, err
+	}
+	return []v1alpha1.TektonInstallerSet{*iS}, nil
 }
 
 func (i *InstallerSetClient) makeMainSets(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) ([]v1alpha1.TektonInstallerSet, error) {
@@ -100,6 +90,25 @@ func (i *InstallerSetClient) makeMainSets(ctx context.Context, comp v1alpha1.Tek
 	return []v1alpha1.TektonInstallerSet{*staticIS, *deploymentIS}, nil
 }
 
+func (i *InstallerSetClient) waitForStatus(ctx context.Context, set *v1alpha1.TektonInstallerSet) error {
+	for cnt := 0; cnt < 3; cnt++ {
+		onClusterSet, err := i.clientSet.Get(ctx, set.GetName(), metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+		// once status is initialised for static set we can create deployment set
+		ready := onClusterSet.Status.GetCondition(apis.ConditionReady)
+		if ready != nil {
+			return nil
+		}
+		// if status is not initialised then wait
+		time.Sleep(3 * time.Second)
+	}
+	// if still the status is not initialised then create the next set and let it fail
+	// there may be something else wrong
+	return nil
+}
+
 func (i *InstallerSetClient) makeInstallerSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform, isName, isType string) (*v1alpha1.TektonInstallerSet, error) {
 	specHash, err := hash.Compute(comp.GetSpec())
 	if err != nil {
@@ -131,22 +140,3 @@ func (i *InstallerSetClient) makeInstallerSet(ctx context.Context, comp v1alpha1
 		},
 	}, nil
 }
-
-func (i *InstallerSetClient) waitForStatus(ctx context.Context, set *v1alpha1.TektonInstallerSet) error {
-	for cnt := 0; cnt < 3; cnt++ {
-		onClusterSet, err := i.clientSet.Get(ctx, set.GetName(), metav1.GetOptions{})
-		if err != nil {
-			return err
-		}
-		// once status is initialised for static set we can create deployment set
-		ready := onClusterSet.Status.GetCondition(apis.ConditionReady)
-		if ready != nil {
-			return nil
-		}
-		// if status is not initialised then wait
-		time.Sleep(3 * time.Second)
-	}
-	// if still the status is not initialised then create the next set and let it fail
-	// there may be something else wrong
-	return nil
-}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/custom_versioned_clustertask.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/custom_versioned_clustertask.go
new file mode 100644
index 000000000..d4553f23e
--- /dev/null
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/custom_versioned_clustertask.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    hcompp://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"context"
+	"strings"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"github.com/tektoncd/operator/pkg/reconciler/common"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"knative.dev/pkg/logging"
+)
+
+var (
+	versionedClusterTaskInstallerSet = "VersionedClusterTask"
+)
+
+// VersionedClusterTaskSet this is an exception case where we create one installer set for one minor version
+// not for patch version and we don't remove older installer sets on upgrade, hence keeping it different
+// from custom set otherwise code becomes unnecessarily complex to handle this case
+func (i *InstallerSetClient) VersionedClusterTaskSet(ctx context.Context, comp v1alpha1.TektonComponent, customName string, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	logger := logging.FromContext(ctx)
+
+	setType := InstallerTypeCustom + "-" + strings.ToLower(versionedClusterTaskInstallerSet)
+	versionedClusterTaskLS := v1.LabelSelector{
+		MatchLabels: map[string]string{
+			v1alpha1.InstallerSetType:       setType,
+			v1alpha1.ReleaseMinorVersionKey: getPatchVersionTrimmed(i.releaseVersion),
+		},
+	}
+	versionedClusterTaskLabelSelector, err := common.LabelSelector(versionedClusterTaskLS)
+	if err != nil {
+		return err
+	}
+	is, err := i.clientSet.List(ctx, v1.ListOptions{LabelSelector: versionedClusterTaskLabelSelector})
+	if err != nil {
+		return err
+	}
+
+	if len(is.Items) == 0 {
+		vctSet, err := i.makeInstallerSet(ctx, comp, manifest, filterAndTransform, "addon-versioned-clustertasks", setType)
+		if err != nil {
+			return err
+		}
+		vctSet.Labels[v1alpha1.ReleaseMinorVersionKey] = getPatchVersionTrimmed(i.releaseVersion)
+		vctSet.GenerateName = "addon-versioned-clustertasks" + "-" + getPatchVersionTrimmed(i.releaseVersion) + "-"
+
+		_, err = i.clientSet.Create(ctx, vctSet, metav1.CreateOptions{})
+		if err != nil {
+			return err
+		}
+		return v1alpha1.REQUEUE_EVENT_AFTER
+	}
+
+	if err := i.statusCheck(logger, setType, is.Items); err != nil {
+		return err
+	}
+	return nil
+}
+
+func getPatchVersionTrimmed(version string) string {
+	endIndex := strings.LastIndex(version, ".")
+	if endIndex != -1 {
+		version = version[:endIndex]
+	}
+	return version
+}
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/obsolete_sets.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/obsolete_sets.go
index 6e374c15c..70c505bc2 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/obsolete_sets.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/obsolete_sets.go
@@ -31,6 +31,9 @@ func (i *InstallerSetClient) RemoveObsoleteSets(ctx context.Context) error {
 		sets = []string{"pipeline", "PrePipeline", "PostPipeline"}
 	} else if i.resourceKind == v1alpha1.KindTektonTrigger {
 		sets = []string{"trigger"}
+	} else if i.resourceKind == v1alpha1.KindTektonAddon {
+		// not adding VersionedClusterTask here, as we keep versioned clustertasks on upgrade
+		sets = []string{"ClusterTask", "CommunityClusterTask", "PipelinesTemplate", "TriggersResources", "ConsoleCLI", "MiscellaneousResources", "PipelinesAsCode"}
 	}
 	labelSelector := labels.NewSelector()
 	createdReq, _ := labels.NewRequirement(v1alpha1.CreatedByKey, selection.Equals, []string{i.resourceKind})
diff --git a/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go
index 4baff046f..25e13c877 100644
--- a/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go
+++ b/pkg/reconciler/kubernetes/tektoninstallerset/client/pre_post_custom_set.go
@@ -18,18 +18,24 @@ package client
 
 import (
 	"context"
+	"strings"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"knative.dev/pkg/logging"
 )
 
+func (i *InstallerSetClient) PostSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	return i.createSet(ctx, comp, InstallerTypePost, manifest, filterAndTransform)
+}
+
 func (i *InstallerSetClient) PreSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
 	return i.createSet(ctx, comp, InstallerTypePre, manifest, filterAndTransform)
 }
 
-func (i *InstallerSetClient) PostSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
-	return i.createSet(ctx, comp, InstallerTypePost, manifest, filterAndTransform)
+func (i *InstallerSetClient) CustomSet(ctx context.Context, comp v1alpha1.TektonComponent, customName string, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
+	setType := InstallerTypeCustom + "-" + strings.ToLower(customName)
+	return i.createSet(ctx, comp, setType, manifest, filterAndTransform)
 }
 
 func (i *InstallerSetClient) createSet(ctx context.Context, comp v1alpha1.TektonComponent, setType string, manifest *mf.Manifest, filterAndTransform FilterAndTransform) error {
diff --git a/pkg/reconciler/kubernetes/tektonpipeline/transform.go b/pkg/reconciler/kubernetes/tektonpipeline/transform.go
index 89c23be20..8e65c1ce4 100644
--- a/pkg/reconciler/kubernetes/tektonpipeline/transform.go
+++ b/pkg/reconciler/kubernetes/tektonpipeline/transform.go
@@ -27,9 +27,14 @@ import (
 
 const (
 	// Pipelines ConfigMap
-	FeatureFlag    = "feature-flags"
-	ConfigDefaults = "config-defaults"
-	ConfigMetrics  = "config-observability"
+	FeatureFlag           = "feature-flags"
+	ConfigDefaults        = "config-defaults"
+	ConfigMetrics         = "config-observability"
+	ResolverFeatureFlag   = "resolvers-feature-flags"
+	bundleResolverConfig  = "bundleresolver-config"
+	clusterResolverConfig = "cluster-resolver-config"
+	hubResolverConfig     = "hubresolver-config"
+	gitResolverConfig     = "git-resolver-config"
 )
 
 func filterAndTransform(extension common.Extension) client.FilterAndTransform {
@@ -47,10 +52,15 @@ func filterAndTransform(extension common.Extension) client.FilterAndTransform {
 			common.AddConfigMapValues(FeatureFlag, pipeline.Spec.PipelineProperties),
 			common.AddConfigMapValues(ConfigDefaults, pipeline.Spec.OptionalPipelineProperties),
 			common.AddConfigMapValues(ConfigMetrics, pipeline.Spec.PipelineMetricsProperties),
+			common.AddConfigMapValues(ResolverFeatureFlag, pipeline.Spec.Resolvers),
 			common.ApplyProxySettings,
 			common.DeploymentImages(images),
 			common.InjectLabelOnNamespace(proxyLabel),
 			common.AddConfiguration(pipeline.Spec.Config),
+			common.CopyConfigMap(bundleResolverConfig, pipeline.Spec.BundlesResolverConfig),
+			common.CopyConfigMap(hubResolverConfig, pipeline.Spec.HubResolverConfig),
+			common.CopyConfigMap(clusterResolverConfig, pipeline.Spec.ClusterResolverConfig),
+			common.CopyConfigMap(gitResolverConfig, pipeline.Spec.GitResolverConfig),
 		}
 		trns = append(trns, extra...)
 
diff --git a/pkg/reconciler/kubernetes/tektonresult/tektonresult.go b/pkg/reconciler/kubernetes/tektonresult/tektonresult.go
index 8f72f5af6..3be345609 100644
--- a/pkg/reconciler/kubernetes/tektonresult/tektonresult.go
+++ b/pkg/reconciler/kubernetes/tektonresult/tektonresult.go
@@ -311,6 +311,8 @@ func (r *Reconciler) transform(ctx context.Context, manifest *mf.Manifest, comp
 		common.ApplyProxySettings,
 		common.ReplaceNamespaceInDeploymentArgs(targetNs),
 		common.ReplaceNamespaceInDeploymentEnv(targetNs),
+		common.AddDeploymentRestrictedPSA(),
+		common.AddStatefulSetRestrictedPSA(),
 	}
 	extra = append(extra, r.extension.Transformers(instance)...)
 	return common.Transform(ctx, manifest, instance, extra...)
diff --git a/pkg/reconciler/openshift/openshiftpipelinesascode/transform.go b/pkg/reconciler/openshift/openshiftpipelinesascode/transform.go
index 95ddac48f..ef66285af 100644
--- a/pkg/reconciler/openshift/openshiftpipelinesascode/transform.go
+++ b/pkg/reconciler/openshift/openshiftpipelinesascode/transform.go
@@ -27,6 +27,8 @@ import (
 	occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 )
 
+const pipelinesAsCodeCM = "pipelines-as-code"
+
 func filterAndTransform(extension common.Extension) client.FilterAndTransform {
 	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
 		pac := comp.(*v1alpha1.OpenShiftPipelinesAsCode)
@@ -43,6 +45,7 @@ func filterAndTransform(extension common.Extension) client.FilterAndTransform {
 			common.AddConfiguration(pac.Spec.Config),
 			common.ApplyProxySettings,
 			occommon.ApplyCABundles,
+			common.CopyConfigMap(pipelinesAsCodeCM, pac.Spec.Settings),
 		}
 
 		allTfs := append(tfs, extension.Transformers(pac)...)
diff --git a/pkg/reconciler/openshift/tektonaddon/clustertTask.go b/pkg/reconciler/openshift/tektonaddon/clustertTask.go
index a9d80413b..4cef22521 100644
--- a/pkg/reconciler/openshift/tektonaddon/clustertTask.go
+++ b/pkg/reconciler/openshift/tektonaddon/clustertTask.go
@@ -23,73 +23,34 @@ import (
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 )
 
-var clusterTaskLS = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.InstallerSetType: ClusterTaskInstallerSet,
-	},
-}
-
 func (r *Reconciler) EnsureClusterTask(ctx context.Context, enable string, ta *v1alpha1.TektonAddon) error {
-
-	clusterTaskLabelSelector, err := common.LabelSelector(clusterTaskLS)
-	if err != nil {
-		return err
-	}
-
 	if enable == "true" {
-
-		exist, _, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.operatorVersion, clusterTaskLabelSelector)
-		if err != nil {
+		if err := r.installerSetClient.CustomSet(ctx, ta, ClusterTaskInstallerSet, r.clusterTaskManifest, filterAndTransformClusterTask()); err != nil {
 			return err
 		}
-
-		if !exist {
-			msg := fmt.Sprintf("%s being created/upgraded", ClusterTaskInstallerSet)
-			ta.Status.MarkInstallerSetNotReady(msg)
-			return r.ensureClusterTasks(ctx, ta)
-		}
-
-		if err := r.checkComponentStatus(ctx, clusterTaskLabelSelector); err != nil {
-			ta.Status.MarkInstallerSetNotReady(err.Error())
-			return nil
-		}
-
 	} else {
-		// if disabled then delete the installer Set if exist
-		if err := r.deleteInstallerSet(ctx, clusterTaskLabelSelector); err != nil {
+		if err := r.installerSetClient.CleanupCustomSet(ctx, ClusterTaskInstallerSet); err != nil {
 			return err
 		}
 	}
-
 	return nil
 }
 
-// installerset for non versioned clustertask like buildah and community clustertask
-func (r *Reconciler) ensureClusterTasks(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	clusterTaskManifest := mf.Manifest{}
-	// Read clusterTasks from ko data
-	if err := applyAddons(&clusterTaskManifest, "02-clustertasks"); err != nil {
-		return err
-	}
-	// Run transformers
-	tfs := []mf.Transformer{
-		replaceKind(KindTask, KindClusterTask),
-		injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
-	}
-	if err := r.addonTransform(ctx, &clusterTaskManifest, ta, tfs...); err != nil {
-		return err
-	}
-
-	if err := createInstallerSet(ctx, r.operatorClientSet, ta, clusterTaskManifest,
-		r.operatorVersion, ClusterTaskInstallerSet, "addon-clustertasks"); err != nil {
-		return err
+func filterAndTransformClusterTask() client.FilterAndTransform {
+	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
+		addon := comp.(*v1alpha1.TektonAddon)
+		tfs := []mf.Transformer{
+			replaceKind(KindTask, KindClusterTask),
+			injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
+		}
+		if err := transformers(ctx, manifest, addon, tfs...); err != nil {
+			return nil, err
+		}
+		return manifest, nil
 	}
-
-	return nil
 }
 
 func formattedVersionMajorMinorX(version, x string) string {
@@ -98,11 +59,6 @@ func formattedVersionMajorMinorX(version, x string) string {
 	return formattedVersionSnake(ver)
 }
 
-func formattedVersionMajorMinor(version string) string {
-	ver := getPatchVersionTrimmed(version)
-	return formattedVersionSnake(ver)
-}
-
 func formattedVersionSnake(version string) string {
 	ver := strings.TrimPrefix(version, "v")
 	return strings.Replace(ver, ".", "-", -1)
diff --git a/pkg/reconciler/openshift/tektonaddon/clustertTaskVersioned.go b/pkg/reconciler/openshift/tektonaddon/clustertTaskVersioned.go
index b04883d86..c7e204efb 100644
--- a/pkg/reconciler/openshift/tektonaddon/clustertTaskVersioned.go
+++ b/pkg/reconciler/openshift/tektonaddon/clustertTaskVersioned.go
@@ -18,89 +18,36 @@ package tektonaddon
 
 import (
 	"context"
-	"fmt"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 )
 
 func (r *Reconciler) EnsureVersionedClusterTask(ctx context.Context, enable string, ta *v1alpha1.TektonAddon) error {
-
-	versionedClusterTaskLS := metav1.LabelSelector{
-		MatchLabels: map[string]string{
-			v1alpha1.InstallerSetType:       VersionedClusterTaskInstallerSet,
-			v1alpha1.ReleaseMinorVersionKey: getPatchVersionTrimmed(r.operatorVersion),
-		},
-	}
-
-	versionedClusterTaskLabelSelector, err := common.LabelSelector(versionedClusterTaskLS)
-	if err != nil {
-		return err
-	}
-
 	if enable == "true" {
-
-		// here pass two labels one for type and other for minor release version to remove the previous minor release installerset only not all
-		exist, _, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.operatorVersion, versionedClusterTaskLabelSelector)
-		if err != nil {
-			return err
-		}
-
-		if !exist {
-			msg := fmt.Sprintf("%s being created/upgraded", VersionedClusterTaskInstallerSet)
-			ta.Status.MarkInstallerSetNotReady(msg)
-			return r.ensureVersionedClusterTasks(ctx, ta)
-		}
-
-		// here pass two labels one for type and other for operator release version to get the latest installerset of current version
-		vClusterTaskLS := metav1.LabelSelector{
-			MatchLabels: map[string]string{
-				v1alpha1.InstallerSetType:  VersionedClusterTaskInstallerSet,
-				v1alpha1.ReleaseVersionKey: r.operatorVersion,
-			},
-		}
-		vClusterTaskLabelSelector, err := common.LabelSelector(vClusterTaskLS)
-		if err != nil {
+		if err := r.installerSetClient.VersionedClusterTaskSet(ctx, ta, VersionedClusterTaskInstallerSet, r.clusterTaskManifest, filterAndTransformVersionedClusterTask(r.operatorVersion)); err != nil {
 			return err
 		}
-		if err := r.checkComponentStatus(ctx, vClusterTaskLabelSelector); err != nil {
-			ta.Status.MarkInstallerSetNotReady(err.Error())
-			return nil
-		}
-
 	} else {
-		// if disabled then delete the installer Set if exist
-		if err := r.deleteInstallerSet(ctx, versionedClusterTaskLabelSelector); err != nil {
+		if err := r.installerSetClient.CleanupCustomSet(ctx, VersionedClusterTaskInstallerSet); err != nil {
 			return err
 		}
 	}
-
 	return nil
 }
 
-// installerset for versioned clustertask like buildah-1-6-0
-func (r *Reconciler) ensureVersionedClusterTasks(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	clusterTaskManifest := mf.Manifest{}
-	// Read clusterTasks from ko data
-	if err := applyAddons(&clusterTaskManifest, "02-clustertasks"); err != nil {
-		return err
-	}
-	// Run transformers
-	tfs := []mf.Transformer{
-		replaceKind(KindTask, KindClusterTask),
-		injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
-		setVersionedNames(r.operatorVersion),
-	}
-	if err := r.addonTransform(ctx, &clusterTaskManifest, ta, tfs...); err != nil {
-		return err
-	}
-
-	if err := createInstallerSet(ctx, r.operatorClientSet, ta, clusterTaskManifest,
-		r.operatorVersion, VersionedClusterTaskInstallerSet, "addon-versioned-clustertasks"); err != nil {
-		return err
+func filterAndTransformVersionedClusterTask(version string) client.FilterAndTransform {
+	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
+		addon := comp.(*v1alpha1.TektonAddon)
+		tfs := []mf.Transformer{
+			replaceKind(KindTask, KindClusterTask),
+			injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
+			setVersionedNames(version),
+		}
+		if err := transformers(ctx, manifest, addon, tfs...); err != nil {
+			return nil, err
+		}
+		return manifest, nil
 	}
-
-	return nil
 }
diff --git a/pkg/reconciler/openshift/tektonaddon/communityClusterTasks.go b/pkg/reconciler/openshift/tektonaddon/communityClusterTasks.go
index bd63df24a..2d22f4bf4 100644
--- a/pkg/reconciler/openshift/tektonaddon/communityClusterTasks.go
+++ b/pkg/reconciler/openshift/tektonaddon/communityClusterTasks.go
@@ -18,30 +18,12 @@ package tektonaddon
 
 import (
 	"context"
-	"fmt"
 	"strings"
-	"time"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"knative.dev/pkg/logging"
-)
-
-var communityClusterTaskLS = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.InstallerSetType: CommunityClusterTaskInstallerSet,
-	},
-}
-
-// retryWaitTime holds value until the pod lives.
-// ones the pod restart resets the value back to ""
-// this is useful if the pod is not restarted and community task urls are not reachable
-// we see comparable less forbidden events
-var (
-	layout        = "2006-01-02 15:04:05"
-	retryWaitTime = ""
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 )
 
 var communityResourceURLs = []string{
@@ -56,73 +38,39 @@ var communityResourceURLs = []string{
 }
 
 func (r *Reconciler) EnsureCommunityClusterTask(ctx context.Context, enable string, ta *v1alpha1.TektonAddon) error {
-
-	communityClusterTaskLabelSelector, err := common.LabelSelector(communityClusterTaskLS)
-	if err != nil {
-		return err
+	if len(r.communityClusterTaskManifest.Resources()) == 0 {
+		return nil
 	}
-
 	if enable == "true" {
-
-		exist, _, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.operatorVersion, communityClusterTaskLabelSelector)
-		if err != nil {
+		if err := r.installerSetClient.CustomSet(ctx, ta, CommunityClusterTaskInstallerSet, r.communityClusterTaskManifest, filterAndTransformCommunityClusterTask()); err != nil {
 			return err
 		}
-
-		if !exist {
-			msg := fmt.Sprintf("%s being created/upgraded", CommunityClusterTaskInstallerSet)
-			ta.Status.MarkInstallerSetNotReady(msg)
-			return r.ensureCommunityClusterTasks(ctx, ta)
-		}
-
-		if err := r.checkComponentStatus(ctx, communityClusterTaskLabelSelector); err != nil {
-			ta.Status.MarkInstallerSetNotReady(err.Error())
-			return nil
-		}
-
 	} else {
-		// if disabled then delete the installer Set if exist
-		if err := r.deleteInstallerSet(ctx, communityClusterTaskLabelSelector); err != nil {
+		if err := r.installerSetClient.CleanupCustomSet(ctx, CommunityClusterTaskInstallerSet); err != nil {
 			return err
 		}
 	}
-
 	return nil
 }
 
-// installerset for communityclustertask
-func (r *Reconciler) ensureCommunityClusterTasks(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-
-	if SkipCommunityTaskFetch(retryWaitTime) {
-		return nil
-	}
-
-	communityClusterTaskManifest := mf.Manifest{}
-	if err := r.appendCommunityTarget(ctx, &communityClusterTaskManifest, ta); err != nil {
-		retryWaitTime = time.Now().Add(15 * time.Minute).Format(layout)
-
-		// Continue if failed to resolve community task URL.
-		// (Ex: on disconnected cluster community tasks won't be reachable because of proxy).
-		logging.FromContext(ctx).Error("Failed to get community task: Skipping community tasks installation  ", err)
-		return v1alpha1.REQUEUE_EVENT_AFTER
-	}
-
-	if err := r.communityTransform(ctx, &communityClusterTaskManifest, ta); err != nil {
-		return err
-	}
-
-	communityClusterTaskManifest = communityClusterTaskManifest.Append(communityClusterTaskManifest)
+func filterAndTransformCommunityClusterTask() client.FilterAndTransform {
+	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
+		instance := comp.(*v1alpha1.TektonAddon)
+		addonImages := common.ToLowerCaseKeys(common.ImagesFromEnv(common.AddonsImagePrefix))
 
-	if err := createInstallerSet(ctx, r.operatorClientSet, ta, communityClusterTaskManifest, r.operatorVersion, CommunityClusterTaskInstallerSet, "addon-communityclustertasks"); err != nil {
-		return err
+		extra := []mf.Transformer{
+			replaceKind("Task", "ClusterTask"),
+			injectLabel(labelProviderType, providerTypeCommunity, overwrite, "ClusterTask"),
+			common.TaskImages(addonImages),
+		}
+		if err := common.Transform(ctx, manifest, instance, extra...); err != nil {
+			return nil, err
+		}
+		return manifest, nil
 	}
-
-	return nil
 }
 
-// appendCommunityTarget mutates the passed manifest by appending one
-// appropriate for the passed TektonComponent
-func (r *Reconciler) appendCommunityTarget(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) error {
+func appendCommunityTasks(manifest *mf.Manifest) error {
 	urls := strings.Join(communityResourceURLs, ",")
 	m, err := mf.ManifestFrom(mf.Path(urls))
 	if err != nil {
@@ -132,31 +80,9 @@ func (r *Reconciler) appendCommunityTarget(ctx context.Context, manifest *mf.Man
 	return nil
 }
 
-// communityTransform mutates the passed manifest to one with common component
-// and platform transformations applied
-func (r *Reconciler) communityTransform(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) error {
-	instance := comp.(*v1alpha1.TektonAddon)
-	extra := []mf.Transformer{
-		replaceKind("Task", "ClusterTask"),
-		injectLabel(labelProviderType, providerTypeCommunity, overwrite, "ClusterTask"),
-	}
-	extra = append(extra, r.extension.Transformers(instance)...)
-	return common.Transform(ctx, manifest, instance, extra...)
-}
-
-// SkipCommunityTaskFetch skips community task fetch until retryWaitTime has passed
-// if there is no value int retryWaitTime that means no error occurred prior to the call
-// if there is some value that means error has occurred earlier and must try after 15 minutes
-func SkipCommunityTaskFetch(until string) bool {
-	skip := false
-	if until != "" {
-		t, err := time.Parse(layout, until)
-		if err != nil {
-			return false
-		}
-		if t.After(time.Now()) {
-			skip = true
-		}
+func fetchCommunityTasks(manifest *mf.Manifest) error {
+	if err := appendCommunityTasks(manifest); err != nil {
+		return err
 	}
-	return skip
+	return nil
 }
diff --git a/pkg/reconciler/openshift/tektonaddon/consolecli.go b/pkg/reconciler/openshift/tektonaddon/consolecli.go
new file mode 100644
index 000000000..31e6e4650
--- /dev/null
+++ b/pkg/reconciler/openshift/tektonaddon/consolecli.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tektonaddon
+
+import (
+	"context"
+	"fmt"
+
+	mf "github.com/manifestival/manifestival"
+	routev1 "github.com/openshift/api/route/v1"
+	"github.com/openshift/client-go/route/clientset/versioned/scheme"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"github.com/tektoncd/operator/pkg/reconciler/common"
+	"knative.dev/pkg/logging"
+)
+
+func (r *Reconciler) EnsureConsoleCLI(ctx context.Context, ta *v1alpha1.TektonAddon) error {
+	tknservecliManifest := r.openShiftConsoleManifest
+	if err := common.Transform(ctx, tknservecliManifest, ta); err != nil {
+		return err
+	}
+	routeHost, err := getRouteHost(tknservecliManifest)
+	if err != nil {
+		return err
+	}
+	if err := consoleCLITransform(ctx, r.consoleCLIManifest, routeHost); err != nil {
+		return err
+	}
+	if err := r.installerSetClient.CustomSet(ctx, ta, ConsoleCLIInstallerSet, r.consoleCLIManifest, filterAndTransformOCPResources()); err != nil {
+		return err
+	}
+	return nil
+}
+
+func getRouteHost(manifest *mf.Manifest) (string, error) {
+	var hostUrl string
+	for _, r := range manifest.Filter(mf.ByKind("Route")).Resources() {
+		u, err := manifest.Client.Get(&r)
+		if err != nil {
+			return "", err
+		}
+		if u.GetName() == "tkn-cli-serve" {
+			route := &routev1.Route{}
+			if err := scheme.Scheme.Convert(u, route, nil); err != nil {
+				return "", err
+			}
+			hostUrl = route.Spec.Host
+		}
+	}
+	return hostUrl, nil
+}
+
+func consoleCLITransform(ctx context.Context, manifest *mf.Manifest, baseURL string) error {
+	tknVersion := "0.24.0"
+
+	if baseURL == "" {
+		return fmt.Errorf("route url should not be empty")
+	}
+	logger := logging.FromContext(ctx)
+	logger.Debug("Transforming manifest")
+
+	transformers := []mf.Transformer{
+		replaceURLCCD(baseURL, tknVersion),
+	}
+
+	transformManifest, err := manifest.Transform(transformers...)
+	if err != nil {
+		return err
+	}
+
+	*manifest = transformManifest
+	return nil
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/const.go b/pkg/reconciler/openshift/tektonaddon/const.go
index 2fbe97f13..07717caa3 100644
--- a/pkg/reconciler/openshift/tektonaddon/const.go
+++ b/pkg/reconciler/openshift/tektonaddon/const.go
@@ -18,6 +18,7 @@ package tektonaddon
 
 const (
 	ClusterTaskInstallerSet            = "ClusterTask"
+	OpenShiftConsoleInstallerSet       = "OpenShiftConsole"
 	CommunityClusterTaskInstallerSet   = "CommunityClusterTask"
 	VersionedClusterTaskInstallerSet   = "VersionedClusterTask"
 	versionedClusterTaskPatchChar      = "0"
diff --git a/pkg/reconciler/openshift/tektonaddon/controller.go b/pkg/reconciler/openshift/tektonaddon/controller.go
index cc04b5420..0e88ecf83 100644
--- a/pkg/reconciler/openshift/tektonaddon/controller.go
+++ b/pkg/reconciler/openshift/tektonaddon/controller.go
@@ -31,6 +31,7 @@ import (
 	tektonTriggerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektontrigger"
 	tektonAddonreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonaddon"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 	"go.uber.org/zap"
 	"k8s.io/client-go/tools/cache"
 	"knative.dev/pkg/configmap"
@@ -46,7 +47,7 @@ const (
 // NewController initializes the controller and is called by the generated code
 // Registers eventhandlers to enqueue events
 func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
-	return NewExtendedController(OpenShiftExtension)(ctx, cmw)
+	return NewExtendedController(common.NoExtension)(ctx, cmw)
 }
 
 // NewExtendedController returns a controller extended to a specific platform
@@ -69,13 +70,60 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro
 			logger.Fatal("Failed to find version from env")
 		}
 
+		tisClient := operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets()
+		metrics, _ := NewRecorder()
+
+		clusterTaskManifest := &mf.Manifest{}
+		if err := applyAddons(clusterTaskManifest, "02-clustertasks"); err != nil {
+			logger.Fatalf("failed to read clustertask from kodata: %v", err)
+		}
+
+		communityClusterTaskManifest := &mf.Manifest{}
+		if err := fetchCommunityTasks(communityClusterTaskManifest); err != nil {
+			// if unable to fetch community task, don't fail
+			logger.Errorf("failed to read community task: %v", err)
+		}
+
+		triggersResourcesManifest := &mf.Manifest{}
+		if err := applyAddons(triggersResourcesManifest, "01-clustertriggerbindings"); err != nil {
+			logger.Fatalf("failed to read trigger Resources from kodata: %v", err)
+		}
+
+		pipelineTemplateManifest := &mf.Manifest{}
+		if err := applyAddons(pipelineTemplateManifest, "03-pipelines"); err != nil {
+			logger.Fatalf("failed to read pipeline template from kodata: %v", err)
+		}
+		if err := addPipelineTemplates(pipelineTemplateManifest); err != nil {
+			logger.Fatalf("failed to add pipeline templates: %v", err)
+		}
+
+		openShiftConsoleManifest := &mf.Manifest{Client: mfclient}
+		if err := applyAddons(openShiftConsoleManifest, "05-tkncliserve"); err != nil {
+			logger.Fatalf("failed to read openshift console resources from kodata: %v", err)
+		}
+		if err := getOptionalAddons(openShiftConsoleManifest); err != nil {
+			logger.Fatalf("failed to read optional addon resources from kodata: %v", err)
+		}
+
+		consoleCLIManifest := &mf.Manifest{}
+		if err := applyAddons(consoleCLIManifest, "04-consolecli"); err != nil {
+			logger.Fatalf("failed to read console cli from kodata: %v", err)
+		}
+
 		c := &Reconciler{
-			operatorClientSet: operatorclient.Get(ctx),
-			extension:         generator(ctx),
-			pipelineInformer:  tektonPipelineinformer.Get(ctx),
-			triggerInformer:   tektonTriggerinformer.Get(ctx),
-			manifest:          manifest,
-			operatorVersion:   version,
+			installerSetClient:           client.NewInstallerSetClient(tisClient, version, "addon", v1alpha1.KindTektonAddon, metrics),
+			operatorClientSet:            operatorclient.Get(ctx),
+			extension:                    generator(ctx),
+			pipelineInformer:             tektonPipelineinformer.Get(ctx),
+			triggerInformer:              tektonTriggerinformer.Get(ctx),
+			manifest:                     manifest,
+			operatorVersion:              version,
+			clusterTaskManifest:          clusterTaskManifest,
+			triggersResourcesManifest:    triggersResourcesManifest,
+			pipelineTemplateManifest:     pipelineTemplateManifest,
+			communityClusterTaskManifest: communityClusterTaskManifest,
+			openShiftConsoleManifest:     openShiftConsoleManifest,
+			consoleCLIManifest:           consoleCLIManifest,
 		}
 		impl := tektonAddonreconciler.NewImpl(ctx, c)
 
diff --git a/pkg/reconciler/openshift/tektonaddon/extension.go b/pkg/reconciler/openshift/tektonaddon/extension.go
deleted file mode 100644
index bdc38215d..000000000
--- a/pkg/reconciler/openshift/tektonaddon/extension.go
+++ /dev/null
@@ -1,309 +0,0 @@
-/*
-Copyright 2020 The Tekton Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package tektonaddon
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/go-logr/zapr"
-	mfc "github.com/manifestival/client-go-client"
-	mf "github.com/manifestival/manifestival"
-	routev1 "github.com/openshift/api/route/v1"
-	"github.com/openshift/client-go/route/clientset/versioned/scheme"
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
-	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
-	"github.com/tektoncd/operator/pkg/reconciler/shared/hash"
-	"go.uber.org/zap"
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"knative.dev/pkg/apis"
-	"knative.dev/pkg/injection"
-	"knative.dev/pkg/logging"
-)
-
-func OpenShiftExtension(ctx context.Context) common.Extension {
-	logger := logging.FromContext(ctx)
-
-	mfclient, err := mfc.NewClient(injection.GetConfig(ctx))
-	if err != nil {
-		logger.Fatalw("error creating client from injected config", zap.Error(err))
-	}
-	mflogger := zapr.NewLogger(logger.Named("manifestival").Desugar())
-	manifest, err := mf.ManifestFrom(mf.Slice{}, mf.UseClient(mfclient), mf.UseLogger(mflogger))
-	if err != nil {
-		logger.Fatalw("error creating initial manifest", zap.Error(err))
-	}
-
-	version := os.Getenv(versionKey)
-	if version == "" {
-		logger.Fatal("Failed to find version from env")
-	}
-
-	ext := openshiftExtension{
-		operatorClientSet: operatorclient.Get(ctx),
-		manifest:          manifest,
-		version:           version,
-	}
-	return ext
-}
-
-type openshiftExtension struct {
-	operatorClientSet versioned.Interface
-	manifest          mf.Manifest
-	version           string
-}
-
-func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
-	addonImages := common.ToLowerCaseKeys(common.ImagesFromEnv(common.AddonsImagePrefix))
-	return []mf.Transformer{
-		common.TaskImages(addonImages),
-	}
-}
-func (oe openshiftExtension) PreReconcile(context.Context, v1alpha1.TektonComponent) error {
-	return nil
-}
-func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
-	logger := logging.FromContext(ctx)
-	addon := comp.(*v1alpha1.TektonAddon)
-
-	miscellaneousLS := metav1.LabelSelector{
-		MatchLabels: map[string]string{
-			v1alpha1.InstallerSetType: MiscellaneousResourcesInstallerSet,
-		},
-	}
-	miscellaneousLabelSelector, err := common.LabelSelector(miscellaneousLS)
-	if err != nil {
-		return err
-	}
-	exist, _, err := checkIfInstallerSetExist(ctx, oe.operatorClientSet, oe.version, miscellaneousLabelSelector)
-	if err != nil {
-		return err
-	}
-	if !exist {
-		manifest, err := getMiscellaneousManifest(ctx, addon, oe.manifest, comp)
-		if err != nil {
-			return err
-		}
-
-		if err := createInstallerSet(ctx, oe.operatorClientSet, addon, manifest, oe.version,
-			MiscellaneousResourcesInstallerSet, "addon-openshift"); err != nil {
-			return err
-		}
-		return v1alpha1.RECONCILE_AGAIN_ERR
-	}
-
-	// Check if installer set is already created
-	installedTIS, err := oe.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		List(ctx, metav1.ListOptions{
-			LabelSelector: miscellaneousLabelSelector,
-		})
-	if err != nil {
-		if apierrors.IsNotFound(err) {
-			manifest, err := getMiscellaneousManifest(ctx, addon, oe.manifest, comp)
-			if err != nil {
-				return err
-			}
-
-			if err := createInstallerSet(ctx, oe.operatorClientSet, addon, manifest, oe.version,
-				MiscellaneousResourcesInstallerSet, "addon-openshift"); err != nil {
-				return err
-			}
-			return v1alpha1.RECONCILE_AGAIN_ERR
-		}
-		logger.Error("failed to get InstallerSet: %s", err)
-		return err
-	}
-
-	expectedSpecHash, err := hash.Compute(addon.Spec)
-	if err != nil {
-		return err
-	}
-
-	// spec hash stored on installerSet
-	lastAppliedHash := installedTIS.Items[0].GetAnnotations()[v1alpha1.LastAppliedHashKey]
-
-	if lastAppliedHash != expectedSpecHash {
-
-		manifest, err := getMiscellaneousManifest(ctx, addon, oe.manifest, comp)
-		if err != nil {
-			return err
-		}
-
-		// Update the spec hash
-		current := installedTIS.Items[0].GetAnnotations()
-		current[v1alpha1.LastAppliedHashKey] = expectedSpecHash
-		installedTIS.Items[0].SetAnnotations(current)
-
-		// Update the manifests
-		installedTIS.Items[0].Spec.Manifests = manifest.Resources()
-
-		if _, err = oe.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-			Update(ctx, &installedTIS.Items[0], metav1.UpdateOptions{}); err != nil {
-			return err
-		}
-
-		return v1alpha1.RECONCILE_AGAIN_ERR
-	}
-
-	installedAddonIS, err := oe.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		List(ctx, metav1.ListOptions{
-			LabelSelector: miscellaneousLabelSelector,
-		})
-	if err != nil {
-		logger.Error("failed to get InstallerSet: %s", err)
-		return err
-	}
-
-	ready := installedAddonIS.Items[0].Status.GetCondition(apis.ConditionReady)
-	if ready == nil {
-		return v1alpha1.RECONCILE_AGAIN_ERR
-	}
-
-	if ready.Status != corev1.ConditionTrue {
-		return v1alpha1.RECONCILE_AGAIN_ERR
-	}
-
-	consolecliManifest := oe.manifest
-
-	consoleCLILS := metav1.LabelSelector{
-		MatchLabels: map[string]string{
-			v1alpha1.InstallerSetType: ConsoleCLIInstallerSet,
-		},
-	}
-	consoleCLILabelSelector, err := common.LabelSelector(consoleCLILS)
-	if err != nil {
-		return err
-	}
-	exist, _, err = checkIfInstallerSetExist(ctx, oe.operatorClientSet, oe.version, consoleCLILabelSelector)
-	if err != nil {
-		return err
-	}
-	if !exist {
-		tknservecliManifest := oe.manifest
-		if err := applyAddons(&tknservecliManifest, "05-tkncliserve"); err != nil {
-			return err
-		}
-		if err := addonTransform(ctx, &tknservecliManifest, addon); err != nil {
-			return err
-		}
-
-		routeHost, err := getRouteHost(&tknservecliManifest)
-		if err != nil {
-			return err
-		}
-
-		if err := applyAddons(&consolecliManifest, "04-consolecli"); err != nil {
-			return err
-		}
-
-		if err := consoleCLITransform(ctx, &consolecliManifest, routeHost); err != nil {
-			return err
-		}
-
-		if err := createInstallerSet(ctx, oe.operatorClientSet, addon, consolecliManifest, oe.version,
-			ConsoleCLIInstallerSet, "addon-consolecli"); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-func (oe openshiftExtension) Finalize(context.Context, v1alpha1.TektonComponent) error {
-	return nil
-}
-
-func getOptionalAddons(manifest *mf.Manifest, comp v1alpha1.TektonComponent) error {
-	koDataDir := os.Getenv(common.KoEnvKey)
-
-	optionalLocation := filepath.Join(koDataDir, "tekton-addon", "optional", "samples")
-	if err := common.AppendManifest(manifest, optionalLocation); err != nil {
-		return err
-	}
-
-	optionalLocation = filepath.Join(koDataDir, "tekton-addon", "optional", "quickstarts")
-	return common.AppendManifest(manifest, optionalLocation)
-}
-
-func addonTransform(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent, extra ...mf.Transformer) error {
-	return common.Transform(ctx, manifest, comp, extra...)
-}
-
-func consoleCLITransform(ctx context.Context, manifest *mf.Manifest, baseURL string) error {
-	tknVersion := "0.24.0"
-
-	if baseURL == "" {
-		return fmt.Errorf("route url should not be empty")
-	}
-	logger := logging.FromContext(ctx)
-	logger.Debug("Transforming manifest")
-
-	transformers := []mf.Transformer{
-		replaceURLCCD(baseURL, tknVersion),
-	}
-
-	transformManifest, err := manifest.Transform(transformers...)
-	if err != nil {
-		return err
-	}
-
-	*manifest = transformManifest
-	return nil
-}
-
-func getRouteHost(manifest *mf.Manifest) (string, error) {
-	var hostUrl string
-	for _, r := range manifest.Filter(mf.ByKind("Route")).Resources() {
-		u, err := manifest.Client.Get(&r)
-		if err != nil {
-			return "", err
-		}
-		if u.GetName() == "tkn-cli-serve" {
-			route := &routev1.Route{}
-			if err := scheme.Scheme.Convert(u, route, nil); err != nil {
-				return "", err
-			}
-			hostUrl = route.Spec.Host
-		}
-	}
-	return hostUrl, nil
-}
-
-func getMiscellaneousManifest(ctx context.Context, addon *v1alpha1.TektonAddon, miscellaneousManifest mf.Manifest, comp v1alpha1.TektonComponent) (mf.Manifest, error) {
-	if err := applyAddons(&miscellaneousManifest, "05-tkncliserve"); err != nil {
-		return mf.Manifest{}, err
-	}
-
-	if err := getOptionalAddons(&miscellaneousManifest, comp); err != nil {
-		return mf.Manifest{}, err
-	}
-
-	images := common.ToLowerCaseKeys(common.ImagesFromEnv(common.AddonsImagePrefix))
-	extraTranformers := []mf.Transformer{
-		common.DeploymentImages(images),
-		common.AddConfiguration(addon.Spec.Config),
-	}
-	if err := addonTransform(ctx, &miscellaneousManifest, addon, extraTranformers...); err != nil {
-		return mf.Manifest{}, err
-	}
-	return miscellaneousManifest, nil
-}
diff --git a/pkg/reconciler/openshift/tektonaddon/installerset.go b/pkg/reconciler/openshift/tektonaddon/installerset.go
deleted file mode 100644
index c02fe6f23..000000000
--- a/pkg/reconciler/openshift/tektonaddon/installerset.go
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
-Copyright 2022 The Tekton Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package tektonaddon
-
-import (
-	"context"
-	"fmt"
-
-	mf "github.com/manifestival/manifestival"
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	clientset "github.com/tektoncd/operator/pkg/client/clientset/versioned"
-	"github.com/tektoncd/operator/pkg/reconciler/shared/hash"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"knative.dev/pkg/apis"
-)
-
-// checkIfInstallerSetExist checks if installer set exists for a component and return true/false based on it
-// and if installer set which already exist is of older version then it deletes and return false to create a new
-// installer set
-func checkIfInstallerSetExist(ctx context.Context, oc clientset.Interface, relVersion string,
-	labelSelector string) (bool, *v1alpha1.TektonInstallerSet, error) {
-
-	installerSets, err := oc.OperatorV1alpha1().TektonInstallerSets().
-		List(ctx, metav1.ListOptions{
-			LabelSelector: labelSelector,
-		})
-	if err != nil {
-		return false, nil, err
-	}
-
-	if len(installerSets.Items) == 0 {
-		return false, nil, nil
-	}
-
-	if len(installerSets.Items) == 1 {
-		// if already created then check which version it is
-		version, ok := installerSets.Items[0].Labels[v1alpha1.ReleaseVersionKey]
-		if ok && version == relVersion {
-			// if installer set already exist and release version is same
-			// then ignore and move on
-			return true, &installerSets.Items[0], nil
-		}
-	}
-
-	// release version doesn't exist or is different from expected
-	// deleted existing InstallerSet and create a new one
-	// or there is more than one installerset (unexpected)
-	if err = oc.OperatorV1alpha1().TektonInstallerSets().
-		DeleteCollection(ctx, metav1.DeleteOptions{}, metav1.ListOptions{
-			LabelSelector: labelSelector,
-		}); err != nil {
-		return false, nil, err
-	}
-
-	return false, nil, v1alpha1.RECONCILE_AGAIN_ERR
-}
-
-func createInstallerSet(ctx context.Context, oc clientset.Interface, ta *v1alpha1.TektonAddon,
-	manifest mf.Manifest, releaseVersion, component, installerSetPrefix string) error {
-
-	specHash, err := hash.Compute(ta.Spec)
-	if err != nil {
-		return err
-	}
-
-	is := makeInstallerSet(ta, manifest, installerSetPrefix, releaseVersion, component, specHash)
-
-	if _, err := oc.OperatorV1alpha1().TektonInstallerSets().
-		Create(ctx, is, metav1.CreateOptions{}); err != nil {
-		return err
-	}
-
-	return v1alpha1.RECONCILE_AGAIN_ERR
-}
-
-func makeInstallerSet(ta *v1alpha1.TektonAddon, manifest mf.Manifest, prefix, releaseVersion, component, specHash string) *v1alpha1.TektonInstallerSet {
-	ownerRef := *metav1.NewControllerRef(ta, ta.GetGroupVersionKind())
-	labels := map[string]string{
-		v1alpha1.CreatedByKey:      CreatedByValue,
-		v1alpha1.InstallerSetType:  component,
-		v1alpha1.ReleaseVersionKey: releaseVersion,
-	}
-	namePrefix := fmt.Sprintf("%s-", prefix)
-	// special label to make sure no two versioned clustertask installerset exist
-	// for all patch releases
-	if component == VersionedClusterTaskInstallerSet {
-		labels[v1alpha1.ReleaseMinorVersionKey] = getPatchVersionTrimmed(releaseVersion)
-		namePrefix = fmt.Sprintf("%s%s-", namePrefix, formattedVersionMajorMinor(releaseVersion))
-	}
-	return &v1alpha1.TektonInstallerSet{
-		ObjectMeta: metav1.ObjectMeta{
-			GenerateName: namePrefix,
-			Labels:       labels,
-			Annotations: map[string]string{
-				v1alpha1.TargetNamespaceKey: ta.Spec.TargetNamespace,
-				v1alpha1.LastAppliedHashKey: specHash,
-			},
-			OwnerReferences: []metav1.OwnerReference{ownerRef},
-		},
-		Spec: v1alpha1.TektonInstallerSetSpec{
-			Manifests: manifest.Resources(),
-		},
-	}
-}
-
-func (r *Reconciler) checkComponentStatus(ctx context.Context, labelSelector string) error {
-
-	// Check if installer set is already created
-	installerSets, err := r.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		List(ctx, metav1.ListOptions{
-			LabelSelector: labelSelector,
-		})
-
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return nil
-		}
-		return err
-	}
-
-	// To make sure there won't be duplicate installersets.
-	if len(installerSets.Items) == 1 {
-		ready := installerSets.Items[0].Status.GetCondition(apis.ConditionReady)
-		if ready == nil || ready.Status == corev1.ConditionUnknown {
-			return fmt.Errorf("InstallerSet %s: waiting for installation", installerSets.Items[0].Name)
-		} else if ready.Status == corev1.ConditionFalse {
-			return fmt.Errorf("InstallerSet %s: ", ready.Message)
-		}
-	}
-	return nil
-}
-
-func (r *Reconciler) deleteInstallerSet(ctx context.Context, labelSelector string) error {
-
-	err := r.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		DeleteCollection(ctx, metav1.DeleteOptions{}, metav1.ListOptions{
-			LabelSelector: labelSelector,
-		})
-	if err != nil && !errors.IsNotFound(err) {
-		return err
-	}
-
-	return nil
-}
diff --git a/pkg/reconciler/openshift/tektonaddon/metrics.go b/pkg/reconciler/openshift/tektonaddon/metrics.go
new file mode 100644
index 000000000..9ba1c2fff
--- /dev/null
+++ b/pkg/reconciler/openshift/tektonaddon/metrics.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tektonaddon
+
+import "go.uber.org/zap"
+
+type Recorder struct {
+}
+
+func NewRecorder() (*Recorder, error) {
+	return &Recorder{}, nil
+}
+
+func (m *Recorder) LogMetrics(status, version string, logger *zap.SugaredLogger) {
+	// TODO
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/openshiftConsole.go b/pkg/reconciler/openshift/tektonaddon/openshiftConsole.go
new file mode 100644
index 000000000..f7a1171ca
--- /dev/null
+++ b/pkg/reconciler/openshift/tektonaddon/openshiftConsole.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tektonaddon
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"github.com/tektoncd/operator/pkg/reconciler/common"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
+)
+
+func (r *Reconciler) EnsureOpenShiftConsoleResources(ctx context.Context, ta *v1alpha1.TektonAddon) error {
+	if err := r.installerSetClient.CustomSet(ctx, ta, OpenShiftConsoleInstallerSet, r.openShiftConsoleManifest, filterAndTransformOCPResources()); err != nil {
+		return err
+	}
+	return nil
+}
+
+func filterAndTransformOCPResources() client.FilterAndTransform {
+	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
+		addon := comp.(*v1alpha1.TektonAddon)
+		images := common.ToLowerCaseKeys(common.ImagesFromEnv(common.AddonsImagePrefix))
+		tfs := []mf.Transformer{
+			common.DeploymentImages(images),
+			common.AddConfiguration(addon.Spec.Config),
+		}
+		if err := transformers(ctx, manifest, addon, tfs...); err != nil {
+			return nil, err
+		}
+		return manifest, nil
+	}
+}
+
+func getOptionalAddons(manifest *mf.Manifest) error {
+	koDataDir := os.Getenv(common.KoEnvKey)
+
+	optionalLocation := filepath.Join(koDataDir, "tekton-addon", "optional", "samples")
+	if err := common.AppendManifest(manifest, optionalLocation); err != nil {
+		return err
+	}
+
+	optionalLocation = filepath.Join(koDataDir, "tekton-addon", "optional", "quickstarts")
+	return common.AppendManifest(manifest, optionalLocation)
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/pipelinetemplate.go b/pkg/reconciler/openshift/tektonaddon/pipelinetemplate.go
index 2d5f0e23a..3ed26e07b 100644
--- a/pkg/reconciler/openshift/tektonaddon/pipelinetemplate.go
+++ b/pkg/reconciler/openshift/tektonaddon/pipelinetemplate.go
@@ -18,7 +18,6 @@ package tektonaddon
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"path/filepath"
 
@@ -26,71 +25,18 @@ import (
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	tektonaddon "github.com/tektoncd/operator/pkg/reconciler/openshift/tektonaddon/pipelinetemplates"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-var pipelineTemplateLS = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.InstallerSetType: PipelinesTemplateInstallerSet,
-	},
-}
-
 func (r *Reconciler) EnsurePipelineTemplates(ctx context.Context, enable string, ta *v1alpha1.TektonAddon) error {
-
-	pipelineTemplateLSLabelSelector, err := common.LabelSelector(pipelineTemplateLS)
-	if err != nil {
-		return err
-	}
 	if enable == "true" {
-
-		exist, _, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.operatorVersion, pipelineTemplateLSLabelSelector)
-		if err != nil {
+		if err := r.installerSetClient.CustomSet(ctx, ta, PipelinesTemplateInstallerSet, r.pipelineTemplateManifest, filterAndTransformCommon()); err != nil {
 			return err
 		}
-		if !exist {
-			msg := fmt.Sprintf("%s being created/upgraded", PipelinesTemplateInstallerSet)
-			ta.Status.MarkInstallerSetNotReady(msg)
-			return r.ensurePipelineTemplates(ctx, ta)
-		}
-
-		if err := r.checkComponentStatus(ctx, pipelineTemplateLSLabelSelector); err != nil {
-			ta.Status.MarkInstallerSetNotReady(err.Error())
-			return nil
-		}
-
 	} else {
-		// if disabled then delete the installer Set if exist
-		if err := r.deleteInstallerSet(ctx, pipelineTemplateLSLabelSelector); err != nil {
+		if err := r.installerSetClient.CleanupCustomSet(ctx, PipelinesTemplateInstallerSet); err != nil {
 			return err
 		}
 	}
-
-	return nil
-}
-
-func (r *Reconciler) ensurePipelineTemplates(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	pipelineTemplateManifest := mf.Manifest{}
-
-	// Read pipeline template manifest from kodata
-	if err := applyAddons(&pipelineTemplateManifest, "03-pipelines"); err != nil {
-		return err
-	}
-
-	// generate pipeline templates
-	if err := addPipelineTemplates(&pipelineTemplateManifest); err != nil {
-		return err
-	}
-
-	// Run transformers
-	if err := r.addonTransform(ctx, &pipelineTemplateManifest, ta); err != nil {
-		return err
-	}
-
-	if err := createInstallerSet(ctx, r.operatorClientSet, ta, pipelineTemplateManifest, r.operatorVersion,
-		PipelinesTemplateInstallerSet, "addon-pipelines"); err != nil {
-		return err
-	}
-
 	return nil
 }
 
diff --git a/pkg/reconciler/openshift/tektonaddon/tektonaddon.go b/pkg/reconciler/openshift/tektonaddon/tektonaddon.go
index 24a9eaa79..d7eb50239 100644
--- a/pkg/reconciler/openshift/tektonaddon/tektonaddon.go
+++ b/pkg/reconciler/openshift/tektonaddon/tektonaddon.go
@@ -30,23 +30,27 @@ import (
 	informer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1"
 	tektonaddonreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonaddon"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
-	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset"
-	"github.com/tektoncd/operator/pkg/reconciler/openshift"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 	"knative.dev/pkg/logging"
 	pkgreconciler "knative.dev/pkg/reconciler"
 )
 
 // Reconciler implements controller.Reconciler for TektonAddon resources.
 type Reconciler struct {
-	manifest          mf.Manifest
-	operatorClientSet clientset.Interface
-	extension         common.Extension
-
-	pipelineInformer informer.TektonPipelineInformer
-	triggerInformer  informer.TektonTriggerInformer
-
-	operatorVersion string
+	// installer Set client to do CRUD operations for components
+	installerSetClient           *client.InstallerSetClient
+	manifest                     mf.Manifest
+	operatorClientSet            clientset.Interface
+	extension                    common.Extension
+	pipelineInformer             informer.TektonPipelineInformer
+	triggerInformer              informer.TektonTriggerInformer
+	operatorVersion              string
+	clusterTaskManifest          *mf.Manifest
+	triggersResourcesManifest    *mf.Manifest
+	pipelineTemplateManifest     *mf.Manifest
+	communityClusterTaskManifest *mf.Manifest
+	openShiftConsoleManifest     *mf.Manifest
+	consoleCLIManifest           *mf.Manifest
 }
 
 const (
@@ -62,32 +66,13 @@ const (
 var _ tektonaddonreconciler.Interface = (*Reconciler)(nil)
 var _ tektonaddonreconciler.Finalizer = (*Reconciler)(nil)
 
-var ls = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.CreatedByKey: CreatedByValue,
-	},
-}
-
 // FinalizeKind removes all resources after deletion of a TektonTriggers.
 func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.TektonAddon) pkgreconciler.Event {
 	logger := logging.FromContext(ctx)
-
-	labelSelector, err := common.LabelSelector(ls)
-	if err != nil {
+	if err := r.installerSetClient.CleanupAllCustomSet(ctx); err != nil {
+		logger.Errorf("failed to cleanup custom set: %v", err)
 		return err
 	}
-	if err := r.operatorClientSet.OperatorV1alpha1().TektonInstallerSets().
-		DeleteCollection(ctx, metav1.DeleteOptions{}, metav1.ListOptions{
-			LabelSelector: labelSelector,
-		}); err != nil {
-		logger.Error("Failed to delete installer set created by TektonAddon", err)
-		return err
-	}
-
-	if err := r.extension.Finalize(ctx, original); err != nil {
-		logger.Error("Failed to finalize platform resources", err)
-	}
-
 	return nil
 }
 
@@ -96,6 +81,7 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.Tekton
 func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon) pkgreconciler.Event {
 	logger := logging.FromContext(ctx)
 	ta.Status.InitializeConditions()
+	ta.Status.SetVersion(r.operatorVersion)
 
 	if ta.GetName() != v1alpha1.AddonResourceName {
 		msg := fmt.Sprintf("Resource ignored, Expected Name: %s, Got Name: %s",
@@ -110,16 +96,11 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon
 	// Pass the object through defaulting
 	ta.SetDefaults(ctx)
 
-	// Mark TektonAddon Instance as Not Ready if an upgrade is needed
-	if err := r.markUpgrade(ctx, ta); err != nil {
-		return err
-	}
-
 	// Make sure TektonPipeline & TektonTrigger is installed before proceeding with
 	// TektonAddons
 
 	if _, err := common.PipelineReady(r.pipelineInformer); err != nil {
-		if err.Error() == common.PipelineNotReady {
+		if err.Error() == common.PipelineNotReady || err == v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR {
 			ta.Status.MarkDependencyInstalling("tekton-pipelines is still installing")
 			// wait for pipeline status to change
 			return v1alpha1.REQUEUE_EVENT_AFTER
@@ -130,7 +111,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon
 	}
 
 	if _, err := common.TriggerReady(r.triggerInformer); err != nil {
-		if err.Error() == common.TriggerNotReady {
+		if err.Error() == common.TriggerNotReady || err == v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR {
 			ta.Status.MarkDependencyInstalling("tekton-triggers is still installing")
 			// wait for trigger status to change
 			return v1alpha1.REQUEUE_EVENT_AFTER
@@ -142,10 +123,6 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon
 
 	ta.Status.MarkDependenciesInstalled()
 
-	if err := tektoninstallerset.CleanUpObsoleteResources(ctx, r.operatorClientSet, CreatedByValue); err != nil {
-		return err
-	}
-
 	// validate the params
 	ptVal, _ := findValue(ta.Spec.Params, v1alpha1.PipelineTemplatesParam)
 	ctVal, _ := findValue(ta.Spec.Params, v1alpha1.ClusterTasksParam)
@@ -156,6 +133,10 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon
 		return nil
 	}
 
+	if err := r.installerSetClient.RemoveObsoleteSets(ctx); err != nil {
+		return err
+	}
+
 	if err := r.extension.PreReconcile(ctx, ta); err != nil {
 		ta.Status.MarkPreReconcilerFailed(err.Error())
 		return err
@@ -163,47 +144,65 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ta *v1alpha1.TektonAddon
 
 	ta.Status.MarkPreReconcilerComplete()
 
+	// this to check if all sets are in ready set
+	ready := true
+	var errorMsg string
+
 	if err := r.EnsureClusterTask(ctx, ctVal, ta); err != nil {
-		return err
+		ready = false
+		errorMsg = fmt.Sprintf("cluster tasks not yet ready: %v", err)
+		logger.Error(errorMsg)
 	}
 
 	if err := r.EnsureVersionedClusterTask(ctx, ctVal, ta); err != nil {
-		return err
+		ready = false
+		errorMsg = fmt.Sprintf("versioned cluster tasks not yet ready:  %v", err)
+		logger.Error(errorMsg)
 	}
 
 	if err := r.EnsureCommunityClusterTask(ctx, cctVal, ta); err != nil {
-		return err
+		ready = false
+		errorMsg = fmt.Sprintf("community cluster tasks not yet ready:  %v", err)
+		logger.Error(errorMsg)
 	}
 
 	if err := r.EnsurePipelineTemplates(ctx, ptVal, ta); err != nil {
-		return err
+		ready = false
+		errorMsg = fmt.Sprintf("pipelines templates not yet ready:  %v", err)
+		logger.Error(errorMsg)
 	}
 
 	if err := r.EnsureTriggersResources(ctx, ta); err != nil {
-		return err
+		ready = false
+		errorMsg = fmt.Sprintf("triggers resources not yet ready:  %v", err)
+		logger.Error(errorMsg)
 	}
 
-	// Pipelines As Code is installed as a separate component now, so
-	// cleanup any of its installer set created previously
-	// this can be removed in future release
-	if err := r.CleanupPipelinesAsCode(ctx, ta); err != nil {
-		return err
+	if err := r.EnsureOpenShiftConsoleResources(ctx, ta); err != nil {
+		ready = false
+		errorMsg = fmt.Sprintf("openshift console resources not yet ready:  %v", err)
+		logger.Error(errorMsg)
+	}
+
+	if err := r.EnsureConsoleCLI(ctx, ta); err != nil {
+		ready = false
+		errorMsg = fmt.Sprintf("console cli not yet ready:  %v", err)
+		logger.Error(errorMsg)
+	}
+
+	if !ready {
+		ta.Status.MarkInstallerSetNotReady(errorMsg)
+		return nil
 	}
 
 	ta.Status.MarkInstallerSetReady()
 
 	if err := r.extension.PostReconcile(ctx, ta); err != nil {
-		if err == v1alpha1.RECONCILE_AGAIN_ERR {
-			return v1alpha1.REQUEUE_EVENT_AFTER
-		}
 		ta.Status.MarkPostReconcilerFailed(err.Error())
 		return err
 	}
 
 	ta.Status.MarkPostReconcilerComplete()
-
-	ta.Status.SetVersion(r.operatorVersion)
-
 	return nil
 }
 
@@ -232,25 +231,6 @@ func applyAddons(manifest *mf.Manifest, subpath string) error {
 	return nil
 }
 
-// addonTransform mutates the passed manifest to one with common, component
-// and platform transformations applied
-func (r *Reconciler) addonTransform(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent, addnTfs ...mf.Transformer) error {
-	instance := comp.(*v1alpha1.TektonAddon)
-	addonTfs := []mf.Transformer{
-		// using common.InjectOperandNameLabelPreserveExisting instead of common.InjectLabelOverwriteExisting
-		// to highlight that TektonAddon is a basket of various operands(components)
-		// note: using common.InjectLabelOverwriteExisting here  doesnot affect the ability to
-		// use InjectOperandNameLabelPreserveExisting or InjectLabelOverwriteExisting again in the transformer chain
-		// However, it is recomended to use InjectOperandNameLabelPreserveExisting here (in Addons) as we cannot be sure
-		// about order of future addition of transformers in this reconciler or in sub functions which take care of various addons
-		common.InjectOperandNameLabelPreserveExisting(openshift.OperandOpenShiftPipelinesAddons),
-		injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
-	}
-	addonTfs = append(addonTfs, addnTfs...)
-	addonTfs = append(addonTfs, r.extension.Transformers(instance)...)
-	return common.Transform(ctx, manifest, instance, addonTfs...)
-}
-
 func findValue(params []v1alpha1.Param, name string) (string, bool) {
 	for _, p := range params {
 		if p.Name == name {
@@ -259,28 +239,3 @@ func findValue(params []v1alpha1.Param, name string) (string, bool) {
 	}
 	return "", false
 }
-
-func (r *Reconciler) markUpgrade(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	labels := ta.GetLabels()
-	ver, ok := labels[v1alpha1.ReleaseVersionKey]
-	if ok && ver == r.operatorVersion {
-		return nil
-	}
-	if ok && ver != r.operatorVersion {
-		ta.Status.MarkInstallerSetNotReady(v1alpha1.UpgradePending)
-		ta.Status.MarkPreReconcilerFailed(v1alpha1.UpgradePending)
-		ta.Status.MarkPostReconcilerFailed(v1alpha1.UpgradePending)
-		ta.Status.MarkNotReady(v1alpha1.UpgradePending)
-	}
-	if labels == nil {
-		labels = map[string]string{}
-	}
-	labels[v1alpha1.ReleaseVersionKey] = r.operatorVersion
-	ta.SetLabels(labels)
-
-	if _, err := r.operatorClientSet.OperatorV1alpha1().TektonAddons().Update(ctx,
-		ta, metav1.UpdateOptions{}); err != nil {
-		return err
-	}
-	return v1alpha1.RECONCILE_AGAIN_ERR
-}
diff --git a/pkg/reconciler/openshift/tektonaddon/transform.go b/pkg/reconciler/openshift/tektonaddon/transform.go
new file mode 100644
index 000000000..bf6cbdae3
--- /dev/null
+++ b/pkg/reconciler/openshift/tektonaddon/transform.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tektonaddon
+
+import (
+	"context"
+
+	mf "github.com/manifestival/manifestival"
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	"github.com/tektoncd/operator/pkg/reconciler/common"
+	"github.com/tektoncd/operator/pkg/reconciler/openshift"
+)
+
+func transformers(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent, addnTfs ...mf.Transformer) error {
+	instance := comp.(*v1alpha1.TektonAddon)
+	addonImages := common.ToLowerCaseKeys(common.ImagesFromEnv(common.AddonsImagePrefix))
+
+	addonTfs := []mf.Transformer{
+		// using common.InjectOperandNameLabelPreserveExisting instead of common.InjectLabelOverwriteExisting
+		// to highlight that TektonAddon is a basket of various operands(components)
+		// note: using common.InjectLabelOverwriteExisting here  doesnot affect the ability to
+		// use InjectOperandNameLabelPreserveExisting or InjectLabelOverwriteExisting again in the transformer chain
+		// However, it is recomended to use InjectOperandNameLabelPreserveExisting here (in Addons) as we cannot be sure
+		// about order of future addition of transformers in this reconciler or in sub functions which take care of various addons
+		common.InjectOperandNameLabelPreserveExisting(openshift.OperandOpenShiftPipelinesAddons),
+		injectLabel(labelProviderType, providerTypeRedHat, overwrite, "ClusterTask"),
+		common.TaskImages(addonImages),
+	}
+	addonTfs = append(addonTfs, addnTfs...)
+	return common.Transform(ctx, manifest, instance, addonTfs...)
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/triggers.go b/pkg/reconciler/openshift/tektonaddon/triggers.go
index c7130c133..37415a1dc 100644
--- a/pkg/reconciler/openshift/tektonaddon/triggers.go
+++ b/pkg/reconciler/openshift/tektonaddon/triggers.go
@@ -18,60 +18,25 @@ package tektonaddon
 
 import (
 	"context"
-	"fmt"
 
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
 )
 
-var triggerResourceLS = metav1.LabelSelector{
-	MatchLabels: map[string]string{
-		v1alpha1.InstallerSetType: TriggersResourcesInstallerSet,
-	},
-}
-
 func (r *Reconciler) EnsureTriggersResources(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-
-	triggerResourceLabelSelector, err := common.LabelSelector(triggerResourceLS)
-	if err != nil {
-		return err
-	}
-	exist, _, err := checkIfInstallerSetExist(ctx, r.operatorClientSet, r.operatorVersion, triggerResourceLabelSelector)
-	if err != nil {
+	if err := r.installerSetClient.CustomSet(ctx, ta, TriggersResourcesInstallerSet, r.triggersResourcesManifest, filterAndTransformCommon()); err != nil {
 		return err
 	}
-	if !exist {
-		msg := fmt.Sprintf("%s being created/upgraded", TriggersResourcesInstallerSet)
-		ta.Status.MarkInstallerSetNotReady(msg)
-		return r.ensureTriggerResources(ctx, ta)
-	}
-
-	err = r.checkComponentStatus(ctx, triggerResourceLabelSelector)
-	if err != nil {
-		ta.Status.MarkInstallerSetNotReady(err.Error())
-		return nil
-	}
-
 	return nil
 }
 
-func (r *Reconciler) ensureTriggerResources(ctx context.Context, ta *v1alpha1.TektonAddon) error {
-	triggerResourcesManifest := mf.Manifest{}
-
-	if err := applyAddons(&triggerResourcesManifest, "01-clustertriggerbindings"); err != nil {
-		return err
+func filterAndTransformCommon() client.FilterAndTransform {
+	return func(ctx context.Context, manifest *mf.Manifest, comp v1alpha1.TektonComponent) (*mf.Manifest, error) {
+		addon := comp.(*v1alpha1.TektonAddon)
+		if err := transformers(ctx, manifest, addon); err != nil {
+			return nil, err
+		}
+		return manifest, nil
 	}
-	// Run transformers
-	if err := r.addonTransform(ctx, &triggerResourcesManifest, ta); err != nil {
-		return err
-	}
-
-	if err := createInstallerSet(ctx, r.operatorClientSet, ta, triggerResourcesManifest, r.operatorVersion,
-		TriggersResourcesInstallerSet, "addon-triggers"); err != nil {
-		return err
-	}
-
-	return nil
 }
diff --git a/pkg/reconciler/openshift/tektonconfig/controller.go b/pkg/reconciler/openshift/tektonconfig/controller.go
index b6a445e65..91cddd7f2 100644
--- a/pkg/reconciler/openshift/tektonconfig/controller.go
+++ b/pkg/reconciler/openshift/tektonconfig/controller.go
@@ -20,6 +20,7 @@ import (
 	"context"
 
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+	openshiftpipelinesascodeinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/openshiftpipelinesascode"
 	tektonAddoninformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonaddon"
 	"github.com/tektoncd/operator/pkg/reconciler/shared/tektonconfig"
 	"k8s.io/client-go/tools/cache"
@@ -32,9 +33,12 @@ import (
 func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
 	ctrl := tektonconfig.NewExtensibleController(OpenShiftExtension)(ctx, cmw)
 	tektonAddoninformer.Get(ctx).Informer().AddEventHandler(cache.FilteringResourceEventHandler{
-		FilterFunc: controller.FilterControllerGVK(v1alpha1.SchemeGroupVersion.WithKind("TektonConfig")),
+		FilterFunc: controller.FilterController(&v1alpha1.TektonConfig{}),
+		Handler:    controller.HandleAll(ctrl.EnqueueControllerOf),
+	})
+	openshiftpipelinesascodeinformer.Get(ctx).Informer().AddEventHandler(cache.FilteringResourceEventHandler{
+		FilterFunc: controller.FilterController(&v1alpha1.TektonConfig{}),
 		Handler:    controller.HandleAll(ctrl.EnqueueControllerOf),
 	})
-
 	return ctrl
 }
diff --git a/pkg/reconciler/openshift/tektonconfig/extension.go b/pkg/reconciler/openshift/tektonconfig/extension.go
index 4af60365b..81ec6ec8c 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension.go
@@ -109,31 +109,29 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.Tekto
 func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
 	configInstance := comp.(*v1alpha1.TektonConfig)
 
-	pac := configInstance.Spec.Platforms.OpenShift.PipelinesAsCode
-	if pac != nil && *pac.Enable {
-		if _, err := extension.EnsureOpenShiftPipelinesAsCodeExists(ctx, oe.operatorClientSet.OperatorV1alpha1().OpenShiftPipelinesAsCodes(), configInstance); err != nil {
-			configInstance.Status.MarkComponentNotReady(fmt.Sprintf("OpenShiftPipelinesAsCode: %s", err.Error()))
-			return v1alpha1.REQUEUE_EVENT_AFTER
-		}
-	} else {
-		if err := extension.EnsureOpenShiftPipelinesAsCodeCRNotExists(ctx, oe.operatorClientSet.OperatorV1alpha1().OpenShiftPipelinesAsCodes()); err != nil {
-			return err
-		}
-	}
-
 	if configInstance.Spec.Profile == v1alpha1.ProfileAll {
 		if _, err := extension.EnsureTektonAddonExists(ctx, oe.operatorClientSet.OperatorV1alpha1().TektonAddons(), configInstance); err != nil {
 			configInstance.Status.MarkComponentNotReady(fmt.Sprintf("TektonAddon: %s", err.Error()))
 			return v1alpha1.REQUEUE_EVENT_AFTER
 		}
 	}
-
 	if configInstance.Spec.Profile == v1alpha1.ProfileLite || configInstance.Spec.Profile == v1alpha1.ProfileBasic {
 		if err := extension.EnsureTektonAddonCRNotExists(ctx, oe.operatorClientSet.OperatorV1alpha1().TektonAddons()); err != nil {
 			return err
 		}
 	}
 
+	pac := configInstance.Spec.Platforms.OpenShift.PipelinesAsCode
+	if pac != nil && *pac.Enable {
+		if _, err := extension.EnsureOpenShiftPipelinesAsCodeExists(ctx, oe.operatorClientSet.OperatorV1alpha1().OpenShiftPipelinesAsCodes(), configInstance); err != nil {
+			configInstance.Status.MarkComponentNotReady(fmt.Sprintf("OpenShiftPipelinesAsCode: %s", err.Error()))
+			return v1alpha1.REQUEUE_EVENT_AFTER
+		}
+	} else {
+		if err := extension.EnsureOpenShiftPipelinesAsCodeCRNotExists(ctx, oe.operatorClientSet.OperatorV1alpha1().OpenShiftPipelinesAsCodes()); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
@@ -143,6 +141,11 @@ func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonC
 			return err
 		}
 	}
+	if configInstance.Spec.Platforms.OpenShift.PipelinesAsCode != nil && *configInstance.Spec.Platforms.OpenShift.PipelinesAsCode.Enable {
+		if err := extension.EnsureOpenShiftPipelinesAsCodeCRNotExists(ctx, oe.operatorClientSet.OperatorV1alpha1().OpenShiftPipelinesAsCodes()); err != nil {
+			return err
+		}
+	}
 
 	r := rbac{
 		kubeClientSet: oe.kubeClientSet,
diff --git a/pkg/reconciler/openshift/tektonconfig/extension/addon.go b/pkg/reconciler/openshift/tektonconfig/extension/addon.go
index 02f25042e..58d58073b 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension/addon.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension/addon.go
@@ -20,12 +20,13 @@ import (
 	"context"
 	"fmt"
 	"reflect"
+	"strings"
 
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	op "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
-	"github.com/tektoncd/operator/pkg/reconciler/common"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"knative.dev/pkg/apis"
 )
 
 func EnsureTektonAddonExists(ctx context.Context, clients op.TektonAddonInterface, config *v1alpha1.TektonConfig) (*v1alpha1.TektonAddon, error) {
@@ -124,14 +125,12 @@ func updateAddon(ctx context.Context, taCR *v1alpha1.TektonAddon, config *v1alph
 
 // isTektonAddonReady will check the status conditions of the TektonAddon and return true if the TektonAddon is ready.
 func isTektonAddonReady(s *v1alpha1.TektonAddon, err error) (bool, error) {
-	upgradePending, errInternal := common.CheckUpgradePending(s)
-	if err != nil {
-		return false, errInternal
-	}
-	if upgradePending {
-		return false, v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR
+	if s.GetStatus() != nil && s.GetStatus().GetCondition(apis.ConditionReady) != nil {
+		if strings.Contains(s.GetStatus().GetCondition(apis.ConditionReady).Message, v1alpha1.UpgradePending) {
+			return false, v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR
+		}
 	}
-	return s.Status.IsReady(), err
+	return s.Status.IsReady(), nil
 }
 
 func EnsureTektonAddonCRNotExists(ctx context.Context, clients op.TektonAddonInterface) error {
diff --git a/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode.go b/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode.go
index ffb7f661a..741769b4d 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode.go
@@ -70,6 +70,9 @@ func createOPAC(ctx context.Context, clients op.OpenShiftPipelinesAsCodeInterfac
 				TargetNamespace: config.Spec.TargetNamespace,
 			},
 			Config: config.Spec.Config,
+			PACSettings: v1alpha1.PACSettings{
+				Settings: config.Spec.Platforms.OpenShift.PipelinesAsCode.Settings,
+			},
 		},
 	}
 	if _, err := clients.Create(ctx, opacCR, metav1.CreateOptions{}); err != nil {
@@ -97,6 +100,11 @@ func updateOPAC(ctx context.Context, opacCR *v1alpha1.OpenShiftPipelinesAsCode,
 		updated = true
 	}
 
+	if !reflect.DeepEqual(opacCR.Spec.Settings, config.Spec.Platforms.OpenShift.PipelinesAsCode.Settings) {
+		opacCR.Spec.PACSettings.Settings = config.Spec.Platforms.OpenShift.PipelinesAsCode.PACSettings.Settings
+		updated = true
+	}
+
 	if opacCR.ObjectMeta.OwnerReferences == nil {
 		ownerRef := *metav1.NewControllerRef(config, config.GroupVersionKind())
 		opacCR.ObjectMeta.OwnerReferences = []metav1.OwnerReference{ownerRef}
diff --git a/pkg/reconciler/shared/tektonconfig/tektonconfig.go b/pkg/reconciler/shared/tektonconfig/tektonconfig.go
index e9a54e286..8b44043f6 100644
--- a/pkg/reconciler/shared/tektonconfig/tektonconfig.go
+++ b/pkg/reconciler/shared/tektonconfig/tektonconfig.go
@@ -145,8 +145,7 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, tc *v1alpha1.TektonConfi
 	tc.Status.MarkComponentsReady()
 
 	if err := r.extension.PostReconcile(ctx, tc); err != nil {
-		tc.Status.MarkPostInstallFailed(err.Error())
-		return v1alpha1.REQUEUE_EVENT_AFTER
+		return err
 	}
 
 	tc.Status.MarkPostInstallComplete()
diff --git a/pkg/webhook/webhook.go b/pkg/webhook/webhook.go
index 3915a9cf8..e88cb3051 100644
--- a/pkg/webhook/webhook.go
+++ b/pkg/webhook/webhook.go
@@ -31,18 +31,19 @@ import (
 )
 
 var types = map[schema.GroupVersionKind]resourcesemantics.GenericCRD{
-	v1alpha1.SchemeGroupVersion.WithKind("TektonConfig"):   &v1alpha1.TektonConfig{},
-	v1alpha1.SchemeGroupVersion.WithKind("TektonPipeline"): &v1alpha1.TektonPipeline{},
-	v1alpha1.SchemeGroupVersion.WithKind("TektonTrigger"):  &v1alpha1.TektonTrigger{},
-	v1alpha1.SchemeGroupVersion.WithKind("TektonHub"):      &v1alpha1.TektonHub{},
-	v1alpha1.SchemeGroupVersion.WithKind("TektonChain"):    &v1alpha1.TektonChain{},
+	v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonConfig):   &v1alpha1.TektonConfig{},
+	v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonPipeline): &v1alpha1.TektonPipeline{},
+	v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonTrigger):  &v1alpha1.TektonTrigger{},
+	v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonHub):      &v1alpha1.TektonHub{},
+	v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonChain):    &v1alpha1.TektonChain{},
 }
 
 func SetTypes(platform string) {
 	if platform == "openshift" {
-		types[v1alpha1.SchemeGroupVersion.WithKind("TektonAddon")] = &v1alpha1.TektonAddon{}
+		types[v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonAddon)] = &v1alpha1.TektonAddon{}
+		types[v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindOpenShiftPipelinesAsCode)] = &v1alpha1.OpenShiftPipelinesAsCode{}
 	} else {
-		types[v1alpha1.SchemeGroupVersion.WithKind("TektonDashboard")] = &v1alpha1.TektonDashboard{}
+		types[v1alpha1.SchemeGroupVersion.WithKind(v1alpha1.KindTektonDashboard)] = &v1alpha1.TektonDashboard{}
 	}
 }
 
diff --git a/third_party/github.com/emicklei/go-restful/LICENSE b/third_party/github.com/emicklei/go-restful/v3/LICENSE
similarity index 100%
rename from third_party/github.com/emicklei/go-restful/LICENSE
rename to third_party/github.com/emicklei/go-restful/v3/LICENSE
diff --git a/third_party/github.com/googleapis/gnostic/LICENSE b/third_party/github.com/google/gnostic/LICENSE
similarity index 100%
rename from third_party/github.com/googleapis/gnostic/LICENSE
rename to third_party/github.com/google/gnostic/LICENSE
diff --git a/third_party/github.com/munnerz/goautoneg/LICENSE b/third_party/github.com/munnerz/goautoneg/LICENSE
new file mode 100644
index 000000000..bbc7b897c
--- /dev/null
+++ b/third_party/github.com/munnerz/goautoneg/LICENSE
@@ -0,0 +1,31 @@
+Copyright (c) 2011, Open Knowledge Foundation Ltd.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+
+    Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in
+    the documentation and/or other materials provided with the
+    distribution.
+
+    Neither the name of the Open Knowledge Foundation Ltd. nor the
+    names of its contributors may be used to endorse or promote
+    products derived from this software without specific prior written
+    permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/third_party/github.com/prometheus/statsd_exporter/pkg/mapper/LICENSE b/third_party/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/LICENSE
similarity index 99%
rename from third_party/github.com/prometheus/statsd_exporter/pkg/mapper/LICENSE
rename to third_party/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/LICENSE
index 261eeb9e9..d64569567 100644
--- a/third_party/github.com/prometheus/statsd_exporter/pkg/mapper/LICENSE
+++ b/third_party/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/LICENSE
@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
diff --git a/third_party/github.com/LICENSE b/third_party/github.com/prometheus/statsd_exporter/pkg/LICENSE
similarity index 100%
rename from third_party/github.com/LICENSE
rename to third_party/github.com/prometheus/statsd_exporter/pkg/LICENSE
diff --git a/third_party/github.com/prometheus/statsd_exporter/pkg/mapper/NOTICE b/third_party/github.com/prometheus/statsd_exporter/pkg/NOTICE
similarity index 100%
rename from third_party/github.com/prometheus/statsd_exporter/pkg/mapper/NOTICE
rename to third_party/github.com/prometheus/statsd_exporter/pkg/NOTICE
diff --git a/vendor/github.com/evanphx/json-patch/patch.go b/vendor/github.com/evanphx/json-patch/patch.go
index dc2b7e51e..4bce5936d 100644
--- a/vendor/github.com/evanphx/json-patch/patch.go
+++ b/vendor/github.com/evanphx/json-patch/patch.go
@@ -568,29 +568,6 @@ func (p Patch) replace(doc *container, op Operation) error {
 		return errors.Wrapf(err, "replace operation failed to decode path")
 	}
 
-	if path == "" {
-		val := op.value()
-
-		if val.which == eRaw {
-			if !val.tryDoc() {
-				if !val.tryAry() {
-					return errors.Wrapf(err, "replace operation value must be object or array")
-				}
-			}
-		}
-
-		switch val.which {
-		case eAry:
-			*doc = &val.ary
-		case eDoc:
-			*doc = &val.doc
-		case eRaw:
-			return errors.Wrapf(err, "replace operation hit impossible case")
-		}
-
-		return nil
-	}
-
 	con, key := findObject(doc, path)
 
 	if con == nil {
@@ -657,25 +634,6 @@ func (p Patch) test(doc *container, op Operation) error {
 		return errors.Wrapf(err, "test operation failed to decode path")
 	}
 
-	if path == "" {
-		var self lazyNode
-
-		switch sv := (*doc).(type) {
-		case *partialDoc:
-			self.doc = *sv
-			self.which = eDoc
-		case *partialArray:
-			self.ary = *sv
-			self.which = eAry
-		}
-
-		if self.equal(op.value()) {
-			return nil
-		}
-
-		return errors.Wrapf(ErrTestFailed, "testing value %s failed", path)
-	}
-
 	con, key := findObject(doc, path)
 
 	if con == nil {
diff --git a/vendor/github.com/go-kit/log/README.md b/vendor/github.com/go-kit/log/README.md
index a0931951d..806779465 100644
--- a/vendor/github.com/go-kit/log/README.md
+++ b/vendor/github.com/go-kit/log/README.md
@@ -1,5 +1,10 @@
 # package log
 
+[![Go Reference](https://pkg.go.dev/badge/github.com/go-kit/log.svg)](https://pkg.go.dev/github.com/go-kit/log)
+[![Go Report Card](https://goreportcard.com/badge/go-kit/log)](https://goreportcard.com/report/go-kit/log)
+[![GitHub Actions](https://github.com/go-kit/log/actions/workflows/test.yml/badge.svg)](https://github.com/go-kit/log/actions/workflows/test.yml)
+[![Coverage Status](https://coveralls.io/repos/github/go-kit/log/badge.svg?branch=main)](https://coveralls.io/github/go-kit/log?branch=main)
+
 `package log` provides a minimal interface for structured logging in services.
 It may be wrapped to encode conventions, enforce type-safety, provide leveled
 logging, and so on. It can be used for both typical application log events,
diff --git a/vendor/github.com/go-kit/log/json_logger.go b/vendor/github.com/go-kit/log/json_logger.go
index 0cedbf824..d0faed4f0 100644
--- a/vendor/github.com/go-kit/log/json_logger.go
+++ b/vendor/github.com/go-kit/log/json_logger.go
@@ -68,7 +68,7 @@ func safeString(str fmt.Stringer) (s string) {
 			if v := reflect.ValueOf(str); v.Kind() == reflect.Ptr && v.IsNil() {
 				s = "NULL"
 			} else {
-				panic(panicVal)
+				s = fmt.Sprintf("PANIC in String method: %v", panicVal)
 			}
 		}
 	}()
@@ -82,7 +82,7 @@ func safeError(err error) (s interface{}) {
 			if v := reflect.ValueOf(err); v.Kind() == reflect.Ptr && v.IsNil() {
 				s = nil
 			} else {
-				panic(panicVal)
+				s = fmt.Sprintf("PANIC in Error method: %v", panicVal)
 			}
 		}
 	}()
diff --git a/vendor/github.com/go-kit/log/level/doc.go b/vendor/github.com/go-kit/log/level/doc.go
index 505d307b1..fd681dcf9 100644
--- a/vendor/github.com/go-kit/log/level/doc.go
+++ b/vendor/github.com/go-kit/log/level/doc.go
@@ -7,6 +7,17 @@
 //    logger = level.NewFilter(logger, level.AllowInfo()) // <--
 //    logger = log.With(logger, "ts", log.DefaultTimestampUTC)
 //
+// It's also possible to configure log level from a string. For instance from
+// a flag, environment variable or configuration file.
+//
+//    fs := flag.NewFlagSet("myprogram")
+//    lvl := fs.String("log", "info", "debug, info, warn, error")
+//
+//    var logger log.Logger
+//    logger = log.NewLogfmtLogger(os.Stderr)
+//    logger = level.NewFilter(logger, level.Allow(level.ParseDefault(*lvl, level.InfoValue()))) // <--
+//    logger = log.With(logger, "ts", log.DefaultTimestampUTC)
+//
 // Then, at the callsites, use one of the level.Debug, Info, Warn, or Error
 // helper methods to emit leveled log events.
 //
diff --git a/vendor/github.com/go-kit/log/level/level.go b/vendor/github.com/go-kit/log/level/level.go
index c94756c6b..c641d9855 100644
--- a/vendor/github.com/go-kit/log/level/level.go
+++ b/vendor/github.com/go-kit/log/level/level.go
@@ -1,6 +1,14 @@
 package level
 
-import "github.com/go-kit/log"
+import (
+	"errors"
+	"strings"
+
+	"github.com/go-kit/log"
+)
+
+// ErrInvalidLevelString is returned whenever an invalid string is passed to Parse.
+var ErrInvalidLevelString = errors.New("invalid level string")
 
 // Error returns a logger that includes a Key/ErrorValue pair.
 func Error(logger log.Logger) log.Logger {
@@ -66,6 +74,22 @@ func (l *logger) Log(keyvals ...interface{}) error {
 // Option sets a parameter for the leveled logger.
 type Option func(*logger)
 
+// Allow the provided log level to pass.
+func Allow(v Value) Option {
+	switch v {
+	case debugValue:
+		return AllowDebug()
+	case infoValue:
+		return AllowInfo()
+	case warnValue:
+		return AllowWarn()
+	case errorValue:
+		return AllowError()
+	default:
+		return AllowNone()
+	}
+}
+
 // AllowAll is an alias for AllowDebug.
 func AllowAll() Option {
 	return AllowDebug()
@@ -100,6 +124,33 @@ func allowed(allowed level) Option {
 	return func(l *logger) { l.allowed = allowed }
 }
 
+// Parse a string to its corresponding level value. Valid strings are "debug",
+// "info", "warn", and "error". Strings are normalized via strings.TrimSpace and
+// strings.ToLower.
+func Parse(level string) (Value, error) {
+	switch strings.TrimSpace(strings.ToLower(level)) {
+	case debugValue.name:
+		return debugValue, nil
+	case infoValue.name:
+		return infoValue, nil
+	case warnValue.name:
+		return warnValue, nil
+	case errorValue.name:
+		return errorValue, nil
+	default:
+		return nil, ErrInvalidLevelString
+	}
+}
+
+// ParseDefault calls Parse and returns the default Value on error.
+func ParseDefault(level string, def Value) Value {
+	v, err := Parse(level)
+	if err != nil {
+		return def
+	}
+	return v
+}
+
 // ErrNotAllowed sets the error to return from Log when it squelches a log
 // event disallowed by the configured Allow[Level] option. By default,
 // ErrNotAllowed is nil; in this case the log event is squelched with no
diff --git a/vendor/github.com/go-kit/log/staticcheck.conf b/vendor/github.com/go-kit/log/staticcheck.conf
new file mode 100644
index 000000000..528438b97
--- /dev/null
+++ b/vendor/github.com/go-kit/log/staticcheck.conf
@@ -0,0 +1,1 @@
+checks = ["all"]
diff --git a/vendor/github.com/imdario/mergo/README.md b/vendor/github.com/imdario/mergo/README.md
index aa8cbd7ce..7e6f7aeee 100644
--- a/vendor/github.com/imdario/mergo/README.md
+++ b/vendor/github.com/imdario/mergo/README.md
@@ -8,8 +8,7 @@
 [![Coverage Status][9]][10]
 [![Sourcegraph][11]][12]
 [![FOSSA Status][13]][14]
-
-[![GoCenter Kudos][15]][16]
+[![Become my sponsor][15]][16]
 
 [1]: https://travis-ci.org/imdario/mergo.png
 [2]: https://travis-ci.org/imdario/mergo
@@ -25,8 +24,8 @@
 [12]: https://sourcegraph.com/github.com/imdario/mergo?badge
 [13]: https://app.fossa.io/api/projects/git%2Bgithub.com%2Fimdario%2Fmergo.svg?type=shield
 [14]: https://app.fossa.io/projects/git%2Bgithub.com%2Fimdario%2Fmergo?ref=badge_shield
-[15]: https://search.gocenter.io/api/ui/badge/github.com%2Fimdario%2Fmergo
-[16]: https://search.gocenter.io/github.com/imdario/mergo
+[15]: https://img.shields.io/github/sponsors/imdario
+[16]: https://github.com/sponsors/imdario
 
 A helper to merge structs and maps in Golang. Useful for configuration default values, avoiding messy if-statements.
 
@@ -36,11 +35,11 @@ Also a lovely [comune](http://en.wikipedia.org/wiki/Mergo) (municipality) in the
 
 ## Status
 
-It is ready for production use. [It is used in several projects by Docker, Google, The Linux Foundation, VMWare, Shopify, etc](https://github.com/imdario/mergo#mergo-in-the-wild).
+It is ready for production use. [It is used in several projects by Docker, Google, The Linux Foundation, VMWare, Shopify, Microsoft, etc](https://github.com/imdario/mergo#mergo-in-the-wild).
 
 ### Important note
 
-Please keep in mind that a problematic PR broke [0.3.9](//github.com/imdario/mergo/releases/tag/0.3.9). I reverted it in [0.3.10](//github.com/imdario/mergo/releases/tag/0.3.10), and I consider it stable but not bug-free. Also, this version adds suppot for go modules.
+Please keep in mind that a problematic PR broke [0.3.9](//github.com/imdario/mergo/releases/tag/0.3.9). I reverted it in [0.3.10](//github.com/imdario/mergo/releases/tag/0.3.10), and I consider it stable but not bug-free. Also, this version adds support for go modules.
 
 Keep in mind that in [0.3.2](//github.com/imdario/mergo/releases/tag/0.3.2), Mergo changed `Merge()`and `Map()` signatures to support [transformers](#transformers). I added an optional/variadic argument so that it won't break the existing code.
 
@@ -51,12 +50,12 @@ If you were using Mergo before April 6th, 2015, please check your project works
 If Mergo is useful to you, consider buying me a coffee, a beer, or making a monthly donation to allow me to keep building great free software. :heart_eyes:
 
 <a href='https://ko-fi.com/B0B58839' target='_blank'><img height='36' style='border:0px;height:36px;' src='https://az743702.vo.msecnd.net/cdn/kofi1.png?v=0' border='0' alt='Buy Me a Coffee at ko-fi.com' /></a>
-[![Beerpay](https://beerpay.io/imdario/mergo/badge.svg)](https://beerpay.io/imdario/mergo)
-[![Beerpay](https://beerpay.io/imdario/mergo/make-wish.svg)](https://beerpay.io/imdario/mergo)
 <a href="https://liberapay.com/dario/donate"><img alt="Donate using Liberapay" src="https://liberapay.com/assets/widgets/donate.svg"></a>
+<a href='https://github.com/sponsors/imdario' target='_blank'><img alt="Become my sponsor" src="https://img.shields.io/github/sponsors/imdario?style=for-the-badge" /></a>
 
 ### Mergo in the wild
 
+- [cli/cli](https://github.com/cli/cli)
 - [moby/moby](https://github.com/moby/moby)
 - [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
 - [vmware/dispatch](https://github.com/vmware/dispatch)
@@ -98,6 +97,8 @@ If Mergo is useful to you, consider buying me a coffee, a beer, or making a mont
 - [jnuthong/item_search](https://github.com/jnuthong/item_search)
 - [bukalapak/snowboard](https://github.com/bukalapak/snowboard)
 - [containerssh/containerssh](https://github.com/containerssh/containerssh)
+- [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
+- [tjpnz/structbot](https://github.com/tjpnz/structbot)
 
 ## Install
 
@@ -168,7 +169,7 @@ func main() {
 
 Note: if test are failing due missing package, please execute:
 
-    go get gopkg.in/yaml.v2
+    go get gopkg.in/yaml.v3
 
 ### Transformers
 
@@ -218,7 +219,6 @@ func main() {
 }
 ```
 
-
 ## Contact me
 
 If I can help you, you have an idea or you are using Mergo in your projects, don't hesitate to drop me a line (or a pull request): [@im_dario](https://twitter.com/im_dario)
@@ -227,18 +227,6 @@ If I can help you, you have an idea or you are using Mergo in your projects, don
 
 Written by [Dario Castañé](http://dario.im).
 
-## Top Contributors
-
-[![0](https://sourcerer.io/fame/imdario/imdario/mergo/images/0)](https://sourcerer.io/fame/imdario/imdario/mergo/links/0)
-[![1](https://sourcerer.io/fame/imdario/imdario/mergo/images/1)](https://sourcerer.io/fame/imdario/imdario/mergo/links/1)
-[![2](https://sourcerer.io/fame/imdario/imdario/mergo/images/2)](https://sourcerer.io/fame/imdario/imdario/mergo/links/2)
-[![3](https://sourcerer.io/fame/imdario/imdario/mergo/images/3)](https://sourcerer.io/fame/imdario/imdario/mergo/links/3)
-[![4](https://sourcerer.io/fame/imdario/imdario/mergo/images/4)](https://sourcerer.io/fame/imdario/imdario/mergo/links/4)
-[![5](https://sourcerer.io/fame/imdario/imdario/mergo/images/5)](https://sourcerer.io/fame/imdario/imdario/mergo/links/5)
-[![6](https://sourcerer.io/fame/imdario/imdario/mergo/images/6)](https://sourcerer.io/fame/imdario/imdario/mergo/links/6)
-[![7](https://sourcerer.io/fame/imdario/imdario/mergo/images/7)](https://sourcerer.io/fame/imdario/imdario/mergo/links/7)
-
-
 ## License
 
 [BSD 3-Clause](http://opensource.org/licenses/BSD-3-Clause) license, as [Go language](http://golang.org/LICENSE).
diff --git a/vendor/github.com/imdario/mergo/merge.go b/vendor/github.com/imdario/mergo/merge.go
index 8c2a8fcd9..8b4e2f47a 100644
--- a/vendor/github.com/imdario/mergo/merge.go
+++ b/vendor/github.com/imdario/mergo/merge.go
@@ -79,7 +79,7 @@ func deepMerge(dst, src reflect.Value, visited map[uintptr]*visit, depth int, co
 		visited[h] = &visit{addr, typ, seen}
 	}
 
-	if config.Transformers != nil && !isEmptyValue(dst) {
+	if config.Transformers != nil && !isReflectNil(dst) && dst.IsValid() {
 		if fn := config.Transformers.Transformer(dst.Type()); fn != nil {
 			err = fn(dst, src)
 			return
diff --git a/vendor/github.com/imdario/mergo/mergo.go b/vendor/github.com/imdario/mergo/mergo.go
index 3cc926c7f..9fe362d47 100644
--- a/vendor/github.com/imdario/mergo/mergo.go
+++ b/vendor/github.com/imdario/mergo/mergo.go
@@ -17,7 +17,7 @@ import (
 var (
 	ErrNilArguments                = errors.New("src and dst must not be nil")
 	ErrDifferentArgumentsTypes     = errors.New("src and dst must be of same type")
-	ErrNotSupported                = errors.New("only structs and maps are supported")
+	ErrNotSupported                = errors.New("only structs, maps, and slices are supported")
 	ErrExpectedMapAsDestination    = errors.New("dst was expected to be a map")
 	ErrExpectedStructAsDestination = errors.New("dst was expected to be a struct")
 	ErrNonPointerAgument           = errors.New("dst must be a pointer")
@@ -65,7 +65,7 @@ func resolveValues(dst, src interface{}) (vDst, vSrc reflect.Value, err error) {
 		return
 	}
 	vDst = reflect.ValueOf(dst).Elem()
-	if vDst.Kind() != reflect.Struct && vDst.Kind() != reflect.Map {
+	if vDst.Kind() != reflect.Struct && vDst.Kind() != reflect.Map && vDst.Kind() != reflect.Slice {
 		err = ErrNotSupported
 		return
 	}
diff --git a/vendor/github.com/openshift-pipelines/pipelines-as-code/LICENSE b/vendor/github.com/openshift-pipelines/pipelines-as-code/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/vendor/github.com/openshift-pipelines/pipelines-as-code/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/config.go b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/config.go
new file mode 100644
index 000000000..96916f841
--- /dev/null
+++ b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/config.go
@@ -0,0 +1,121 @@
+package settings
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"go.uber.org/zap"
+)
+
+const (
+	ApplicationNameKey                    = "application-name"
+	SecretAutoCreateKey                   = "secret-auto-create"
+	HubURLKey                             = "hub-url"
+	HubCatalogNameKey                     = "hub-catalog-name"
+	MaxKeepRunUpperLimitKey               = "max-keep-run-upper-limit"
+	DefaultMaxKeepRunsKey                 = "default-max-keep-runs"
+	RemoteTasksKey                        = "remote-tasks"
+	BitbucketCloudCheckSourceIPKey        = "bitbucket-cloud-check-source-ip"
+	BitbucketCloudAdditionalSourceIPKey   = "bitbucket-cloud-additional-source-ip"
+	TektonDashboardURLKey                 = "tekton-dashboard-url"
+	AutoConfigureNewGitHubRepoKey         = "auto-configure-new-github-repo"
+	AutoConfigureRepoNamespaceTemplateKey = "auto-configure-repo-namespace-template"
+
+	secretAutoCreateDefaultValue            = "true"
+	remoteTasksDefaultValue                 = "true"
+	bitbucketCloudCheckSourceIPDefaultValue = "true"
+	PACApplicationNameDefaultValue          = "Pipelines as Code CI"
+	HubURLDefaultValue                      = "https://api.hub.tekton.dev/v1"
+	hubCatalogNameDefaultValue              = "tekton"
+	AutoConfigureNewGitHubRepoDefaultValue  = "false"
+)
+
+type Settings struct {
+	ApplicationName                    string
+	SecretAutoCreation                 bool
+	HubURL                             string
+	HubCatalogName                     string
+	RemoteTasks                        bool
+	MaxKeepRunsUpperLimit              int
+	DefaultMaxKeepRuns                 int
+	BitbucketCloudCheckSourceIP        bool
+	BitbucketCloudAdditionalSourceIP   string
+	TektonDashboardURL                 string
+	AutoConfigureNewGitHubRepo         bool
+	AutoConfigureRepoNamespaceTemplate string
+}
+
+func ConfigToSettings(logger *zap.SugaredLogger, setting *Settings, config map[string]string) error {
+	// pass through defaulting
+	SetDefaults(config)
+
+	// validate fields
+	if err := Validate(config); err != nil {
+		return fmt.Errorf("config validation failed: %w", err)
+	}
+
+	if setting.ApplicationName != config[ApplicationNameKey] {
+		logger.Infof("CONFIG: application name updated to %v", config[ApplicationNameKey])
+		setting.ApplicationName = config[ApplicationNameKey]
+	}
+	secretAutoCreate := StringToBool(config[SecretAutoCreateKey])
+	if setting.SecretAutoCreation != secretAutoCreate {
+		logger.Infof("CONFIG: secret auto create updated to %v", secretAutoCreate)
+		setting.SecretAutoCreation = secretAutoCreate
+	}
+	if setting.HubURL != config[HubURLKey] {
+		logger.Infof("CONFIG: hub URL updated to %v", config[HubURLKey])
+		setting.HubURL = config[HubURLKey]
+	}
+	if setting.HubCatalogName != config[HubCatalogNameKey] {
+		logger.Infof("CONFIG: hub catalog name updated to %v", config[HubCatalogNameKey])
+		setting.HubCatalogName = config[HubCatalogNameKey]
+	}
+	remoteTask := StringToBool(config[RemoteTasksKey])
+	if setting.RemoteTasks != remoteTask {
+		logger.Infof("CONFIG: remote tasks setting updated to %v", remoteTask)
+		setting.RemoteTasks = remoteTask
+	}
+	maxKeepRunUpperLimit, _ := strconv.Atoi(config[MaxKeepRunUpperLimitKey])
+	if setting.MaxKeepRunsUpperLimit != maxKeepRunUpperLimit {
+		logger.Infof("CONFIG: max keep runs upper limit updated to %v", maxKeepRunUpperLimit)
+		setting.MaxKeepRunsUpperLimit = maxKeepRunUpperLimit
+	}
+	defaultMaxKeepRun, _ := strconv.Atoi(config[DefaultMaxKeepRunsKey])
+	if setting.DefaultMaxKeepRuns != defaultMaxKeepRun {
+		logger.Infof("CONFIG: default keep runs updated to %v", defaultMaxKeepRun)
+		setting.DefaultMaxKeepRuns = defaultMaxKeepRun
+	}
+	check := StringToBool(config[BitbucketCloudCheckSourceIPKey])
+	if setting.BitbucketCloudCheckSourceIP != check {
+		logger.Infof("CONFIG: bitbucket cloud check source ip setting updated to %v", check)
+		setting.BitbucketCloudCheckSourceIP = check
+	}
+	if setting.BitbucketCloudAdditionalSourceIP != config[BitbucketCloudAdditionalSourceIPKey] {
+		logger.Infof("CONFIG: bitbucket cloud additional source ip updated to %v", config[BitbucketCloudAdditionalSourceIPKey])
+		setting.BitbucketCloudAdditionalSourceIP = config[BitbucketCloudAdditionalSourceIPKey]
+	}
+	if setting.TektonDashboardURL != config[TektonDashboardURLKey] {
+		logger.Infof("CONFIG: tekton dashboard url updated to %v", config[TektonDashboardURLKey])
+		setting.TektonDashboardURL = config[TektonDashboardURLKey]
+	}
+	autoConfigure := StringToBool(config[AutoConfigureNewGitHubRepoKey])
+	if setting.AutoConfigureNewGitHubRepo != autoConfigure {
+		logger.Infof("CONFIG: auto configure GitHub repo setting updated to %v", autoConfigure)
+		setting.AutoConfigureNewGitHubRepo = autoConfigure
+	}
+	if setting.AutoConfigureRepoNamespaceTemplate != config[AutoConfigureRepoNamespaceTemplateKey] {
+		logger.Infof("CONFIG: auto configure repo namespace template updated to %v", config[AutoConfigureRepoNamespaceTemplateKey])
+		setting.AutoConfigureRepoNamespaceTemplate = config[AutoConfigureRepoNamespaceTemplateKey]
+	}
+	return nil
+}
+
+func StringToBool(s string) bool {
+	if strings.ToLower(s) == "true" ||
+		strings.ToLower(s) == "yes" || s == "1" {
+		return true
+	}
+	return false
+}
diff --git a/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/default.go b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/default.go
new file mode 100644
index 000000000..9ff0acc17
--- /dev/null
+++ b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/default.go
@@ -0,0 +1,31 @@
+package settings
+
+func SetDefaults(config map[string]string) {
+	if appName, ok := config[ApplicationNameKey]; !ok || appName == "" {
+		config[ApplicationNameKey] = PACApplicationNameDefaultValue
+	}
+
+	if secretAutoCreation, ok := config[SecretAutoCreateKey]; !ok || secretAutoCreation == "" {
+		config[SecretAutoCreateKey] = secretAutoCreateDefaultValue
+	}
+
+	if hubURL, ok := config[HubURLKey]; !ok || hubURL == "" {
+		config[HubURLKey] = HubURLDefaultValue
+	}
+
+	if hubCatalogName, ok := config[HubCatalogNameKey]; !ok || hubCatalogName == "" {
+		config[HubCatalogNameKey] = hubCatalogNameDefaultValue
+	}
+
+	if remoteTasks, ok := config[RemoteTasksKey]; !ok || remoteTasks == "" {
+		config[RemoteTasksKey] = remoteTasksDefaultValue
+	}
+
+	if check, ok := config[BitbucketCloudCheckSourceIPKey]; !ok || check == "" {
+		config[BitbucketCloudCheckSourceIPKey] = bitbucketCloudCheckSourceIPDefaultValue
+	}
+
+	if autoConfigure, ok := config[AutoConfigureNewGitHubRepoKey]; !ok || autoConfigure == "" {
+		config[AutoConfigureNewGitHubRepoKey] = AutoConfigureNewGitHubRepoDefaultValue
+	}
+}
diff --git a/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/validation.go b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/validation.go
new file mode 100644
index 000000000..bd620d7b9
--- /dev/null
+++ b/vendor/github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings/validation.go
@@ -0,0 +1,58 @@
+package settings
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+)
+
+func Validate(config map[string]string) error {
+	if secretAutoCreation, ok := config[SecretAutoCreateKey]; ok {
+		if !isValidBool(secretAutoCreation) {
+			return fmt.Errorf("invalid value for key %v, acceptable values: true or false", SecretAutoCreateKey)
+		}
+	}
+
+	if remoteTask, ok := config[RemoteTasksKey]; ok {
+		if !isValidBool(remoteTask) {
+			return fmt.Errorf("invalid value for key %v, acceptable values: true or false", RemoteTasksKey)
+		}
+	}
+
+	if check, ok := config[BitbucketCloudCheckSourceIPKey]; ok {
+		if !isValidBool(check) {
+			return fmt.Errorf("invalid value for key %v, acceptable values: true or false", BitbucketCloudCheckSourceIPKey)
+		}
+	}
+
+	if runs, ok := config[MaxKeepRunUpperLimitKey]; ok && runs != "" {
+		_, err := strconv.Atoi(runs)
+		if err != nil {
+			return fmt.Errorf("failed to convert %v value to int: %w", MaxKeepRunUpperLimitKey, err)
+		}
+	}
+
+	if runs, ok := config[DefaultMaxKeepRunsKey]; ok && runs != "" {
+		_, err := strconv.Atoi(runs)
+		if err != nil {
+			return fmt.Errorf("failed to convert %v value to int: %w", DefaultMaxKeepRunsKey, err)
+		}
+	}
+
+	if check, ok := config[AutoConfigureNewGitHubRepoKey]; ok {
+		if !isValidBool(check) {
+			return fmt.Errorf("invalid value for key %v, acceptable values: true or false", AutoConfigureNewGitHubRepoKey)
+		}
+	}
+
+	if dashboardURL, ok := config[TektonDashboardURLKey]; ok {
+		if _, err := url.ParseRequestURI(dashboardURL); err != nil {
+			return fmt.Errorf("invalid value for key %v, invalid url: %w", TektonDashboardURLKey, err)
+		}
+	}
+	return nil
+}
+
+func isValidBool(value string) bool {
+	return value == "true" || value == "false"
+}
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/annotation.go b/vendor/github.com/openzipkin/zipkin-go/model/annotation.go
index 7511bd69b..02d09fb15 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/annotation.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/annotation.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/doc.go b/vendor/github.com/openzipkin/zipkin-go/model/doc.go
index 72c695c1f..4cae4e07a 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/doc.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/doc.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/endpoint.go b/vendor/github.com/openzipkin/zipkin-go/model/endpoint.go
index 619eea78b..48e2afd62 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/endpoint.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/kind.go b/vendor/github.com/openzipkin/zipkin-go/model/kind.go
index 06f16226c..d247c0200 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/kind.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/kind.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/span.go b/vendor/github.com/openzipkin/zipkin-go/model/span.go
index 78467aba8..cf30bfac8 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/span.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/span.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -28,14 +28,34 @@ var (
 	ErrValidDurationRequired = errors.New("valid duration required")
 )
 
+// BaggageFields holds the interface for consumers needing to interact with
+// the fields in application logic.
+type BaggageFields interface {
+	// Get returns the values for a field identified by its key.
+	Get(key string) []string
+	// Add adds the provided values to a header designated by key. If not
+	// accepted by the baggage implementation, it will return false.
+	Add(key string, value ...string) bool
+	// Set sets the provided values to a header designated by key. If not
+	// accepted by the baggage implementation, it will return false.
+	Set(key string, value ...string) bool
+	// Delete removes the field data designated by key. If not accepted by the
+	// baggage implementation, it will return false.
+	Delete(key string) bool
+	// Iterate will iterate over the available fields and for each one it will
+	// trigger the callback function.
+	Iterate(f func(key string, values []string))
+}
+
 // SpanContext holds the context of a Span.
 type SpanContext struct {
-	TraceID  TraceID `json:"traceId"`
-	ID       ID      `json:"id"`
-	ParentID *ID     `json:"parentId,omitempty"`
-	Debug    bool    `json:"debug,omitempty"`
-	Sampled  *bool   `json:"-"`
-	Err      error   `json:"-"`
+	TraceID  TraceID       `json:"traceId"`
+	ID       ID            `json:"id"`
+	ParentID *ID           `json:"parentId,omitempty"`
+	Debug    bool          `json:"debug,omitempty"`
+	Sampled  *bool         `json:"-"`
+	Err      error         `json:"-"`
+	Baggage  BaggageFields `json:"-"`
 }
 
 // SpanModel structure.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/span_id.go b/vendor/github.com/openzipkin/zipkin-go/model/span_id.go
index 56d6f5dbc..acd72ea7b 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/span_id.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/span_id.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/openzipkin/zipkin-go/model/traceid.go b/vendor/github.com/openzipkin/zipkin-go/model/traceid.go
index 2f29a0011..dca655350 100644
--- a/vendor/github.com/openzipkin/zipkin-go/model/traceid.go
+++ b/vendor/github.com/openzipkin/zipkin-go/model/traceid.go
@@ -1,4 +1,4 @@
-// Copyright 2021 The OpenZipkin Authors
+// Copyright 2022 The OpenZipkin Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vendor/github.com/prometheus/statsd_exporter/pkg/level/level.go b/vendor/github.com/prometheus/statsd_exporter/pkg/level/level.go
new file mode 100644
index 000000000..5b03c6d6c
--- /dev/null
+++ b/vendor/github.com/prometheus/statsd_exporter/pkg/level/level.go
@@ -0,0 +1,97 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package level
+
+import (
+	"fmt"
+
+	"github.com/go-kit/log"
+	"github.com/go-kit/log/level"
+)
+
+var logLevel = LevelInfo
+
+// A Level is a logging priority. Higher levels are more important.
+type Level int
+
+const (
+	// LevelDebug logs are typically voluminous, and are usually disabled in
+	// production.
+	LevelDebug Level = iota
+	// LevelInfo is the default logging priority.
+	LevelInfo
+	// LevelWarn logs are more important than Info, but don't need individual
+	// human review.
+	LevelWarn
+	// LevelError logs are high-priority. If an application is running smoothly,
+	// it shouldn't generate any error-level logs.
+	LevelError
+)
+
+var emptyLogger = &EmptyLogger{}
+
+type EmptyLogger struct{}
+
+func (l *EmptyLogger) Log(keyvals ...interface{}) error {
+	return nil
+}
+
+// SetLogLevel sets the log level.
+func SetLogLevel(level string) error {
+	switch level {
+	case "debug":
+		logLevel = LevelDebug
+	case "info":
+		logLevel = LevelInfo
+	case "warn":
+		logLevel = LevelWarn
+	case "error":
+		logLevel = LevelError
+	default:
+		return fmt.Errorf("unrecognized log level %s", level)
+	}
+	return nil
+}
+
+// Error returns a logger that includes a Key/ErrorValue pair.
+func Error(logger log.Logger) log.Logger {
+	if logLevel <= LevelError {
+		return level.Error(logger)
+	}
+	return emptyLogger
+}
+
+// Warn returns a logger that includes a Key/WarnValue pair.
+func Warn(logger log.Logger) log.Logger {
+	if logLevel <= LevelWarn {
+		return level.Warn(logger)
+	}
+	return emptyLogger
+}
+
+// Info returns a logger that includes a Key/InfoValue pair.
+func Info(logger log.Logger) log.Logger {
+	if logLevel <= LevelInfo {
+		return level.Info(logger)
+	}
+	return emptyLogger
+}
+
+// Debug returns a logger that includes a Key/DebugValue pair.
+func Debug(logger log.Logger) log.Logger {
+	if logLevel <= LevelDebug {
+		return level.Debug(logger)
+	}
+	return emptyLogger
+}
diff --git a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/escape.go b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/escape.go
index fc8d194f1..f73b16d45 100644
--- a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/escape.go
+++ b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/escape.go
@@ -39,6 +39,9 @@ func EscapeMetricName(metricName string) string {
 	// This is an character replacement method optimized for this limited
 	// use case.  It is much faster than using a regex.
 	offset := 0
+
+	var prevChar rune
+
 	for i, c := range metricName {
 		// Seek forward, skipping valid characters until we find one that needs
 		// to be replaced, then add all the characters we've seen so far to the
@@ -47,6 +50,13 @@ func EscapeMetricName(metricName string) string {
 			(c >= '0' && c <= '9') || (c == '_') {
 			// Character is valid, so skip over it without doing anything.
 		} else {
+			// Double-dashes are allowed if there is a corresponding mapping.
+			// For consistency, double-dashes should also be allowed in the default case.
+			if c == '-' && prevChar == '-' {
+				offset = i + utf8.RuneLen(c)
+				continue
+			}
+
 			if !escaped {
 				// Up until now we've been lazy and avoided actually allocating
 				// memory.  Unfortunately we've now determined this string needs
@@ -58,6 +68,8 @@ func EscapeMetricName(metricName string) string {
 			offset = i + utf8.RuneLen(c)
 			sb.WriteByte('_')
 		}
+
+		prevChar = c
 	}
 
 	if !escaped {
diff --git a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/dump.go b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/dump.go
index d91e2cf36..35772f9c7 100644
--- a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/dump.go
+++ b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/dump.go
@@ -43,6 +43,6 @@ func (f *FSM) DumpFSM(w io.Writer) {
 		idx++
 	}
 	// color for start state
-	w.Write([]byte(fmt.Sprintf("0 [color=\"#a94442\",fillcolor=\"#f2dede\"];\n")))
+	w.Write([]byte(fmt.Sprintln("0 [color=\"#a94442\",fillcolor=\"#f2dede\"];")))
 	w.Write([]byte("}"))
 }
diff --git a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/fsm.go b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/fsm.go
index 96a162c78..85068f7f6 100644
--- a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/fsm.go
+++ b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/fsm/fsm.go
@@ -18,7 +18,8 @@ import (
 	"strings"
 
 	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
+
+	"github.com/prometheus/statsd_exporter/pkg/level"
 )
 
 type mappingState struct {
diff --git a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/mapper.go b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/mapper.go
index 12340d9c0..879f18c59 100644
--- a/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/mapper.go
+++ b/vendor/github.com/prometheus/statsd_exporter/pkg/mapper/mapper.go
@@ -15,25 +15,25 @@ package mapper
 
 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"regexp"
 	"sync"
 	"time"
 
 	"github.com/go-kit/log"
-	"github.com/go-kit/log/level"
 	"github.com/prometheus/client_golang/prometheus"
-	yaml "gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v2"
 
+	"github.com/prometheus/statsd_exporter/pkg/level"
 	"github.com/prometheus/statsd_exporter/pkg/mapper/fsm"
 )
 
 var (
 	// The first segment of a match cannot start with a number
-	statsdMetricRE = `[a-zA-Z_](-?[a-zA-Z0-9_])*`
+	statsdMetricRE = `[a-zA-Z_]([a-zA-Z0-9_\-])*`
 	// The subsequent segments of a match can start with a number
 	// See https://github.com/prometheus/statsd_exporter/issues/328
-	statsdMetricSubsequentRE = `[a-zA-Z0-9_](-?[a-zA-Z0-9_])*`
+	statsdMetricSubsequentRE = `[a-zA-Z0-9_]([a-zA-Z0-9_\-])*`
 	templateReplaceRE        = `(\$\{?\d+\}?)`
 
 	metricLineRE = regexp.MustCompile(`^(\*|` + statsdMetricRE + `)(\.\*|\.` + statsdMetricSubsequentRE + `)*$`)
@@ -233,6 +233,10 @@ func (m *MetricMapper) InitFromYAMLString(fileContents string) error {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
+	if m.Logger == nil {
+		m.Logger = log.NewNopLogger()
+	}
+
 	m.Defaults = n.Defaults
 	m.Mappings = n.Mappings
 
@@ -259,15 +263,11 @@ func (m *MetricMapper) InitFromYAMLString(fileContents string) error {
 		m.MappingsCount.Set(float64(len(n.Mappings)))
 	}
 
-	if m.Logger == nil {
-		m.Logger = log.NewNopLogger()
-	}
-
 	return nil
 }
 
 func (m *MetricMapper) InitFromFile(fileName string) error {
-	mappingStr, err := ioutil.ReadFile(fileName)
+	mappingStr, err := os.ReadFile(fileName)
 	if err != nil {
 		return err
 	}
@@ -381,7 +381,6 @@ func (m *MetricMapper) GetMapping(statsdMetric string, statsdMetricType MetricTy
 // make a shallow copy so that we do not overwrite name
 // as multiple names can be matched by same mapping
 func copyMetricMapping(in *MetricMapping) *MetricMapping {
-	var out MetricMapping
-	out = *in
+	out := *in
 	return &out
 }
diff --git a/vendor/k8s.io/klog/v2/contextual.go b/vendor/k8s.io/klog/v2/contextual.go
index 65ac479ab..2428963c0 100644
--- a/vendor/k8s.io/klog/v2/contextual.go
+++ b/vendor/k8s.io/klog/v2/contextual.go
@@ -47,8 +47,9 @@ var (
 // If set, all log lines will be suppressed from the regular output, and
 // redirected to the logr implementation.
 // Use as:
-//   ...
-//   klog.SetLogger(zapr.NewLogger(zapLog))
+//
+//	...
+//	klog.SetLogger(zapr.NewLogger(zapLog))
 //
 // To remove a backing logr implemention, use ClearLogger. Setting an
 // empty logger with SetLogger(logr.Logger{}) does not work.
diff --git a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
index f85d7ccf8..ad6bf1116 100644
--- a/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
+++ b/vendor/k8s.io/klog/v2/internal/serialize/keyvalues.go
@@ -145,7 +145,7 @@ func KVListFormat(b *bytes.Buffer, keysAndValues ...interface{}) {
 			case string:
 				writeStringValue(b, true, value)
 			default:
-				writeStringValue(b, false, fmt.Sprintf("%+v", v))
+				writeStringValue(b, false, fmt.Sprintf("%+v", value))
 			}
 		case []byte:
 			// In https://github.com/kubernetes/klog/pull/237 it was decided
diff --git a/vendor/k8s.io/klog/v2/klog.go b/vendor/k8s.io/klog/v2/klog.go
index 652fadcd4..1bd11b675 100644
--- a/vendor/k8s.io/klog/v2/klog.go
+++ b/vendor/k8s.io/klog/v2/klog.go
@@ -39,39 +39,38 @@
 // This package provides several flags that modify this behavior.
 // As a result, flag.Parse must be called before any logging is done.
 //
-//	-logtostderr=true
-//		Logs are written to standard error instead of to files.
-//              This shortcuts most of the usual output routing:
-//              -alsologtostderr, -stderrthreshold and -log_dir have no
-//              effect and output redirection at runtime with SetOutput is
-//              ignored.
-//	-alsologtostderr=false
-//		Logs are written to standard error as well as to files.
-//	-stderrthreshold=ERROR
-//		Log events at or above this severity are logged to standard
-//		error as well as to files.
-//	-log_dir=""
-//		Log files will be written to this directory instead of the
-//		default temporary directory.
+//		-logtostderr=true
+//			Logs are written to standard error instead of to files.
+//	             This shortcuts most of the usual output routing:
+//	             -alsologtostderr, -stderrthreshold and -log_dir have no
+//	             effect and output redirection at runtime with SetOutput is
+//	             ignored.
+//		-alsologtostderr=false
+//			Logs are written to standard error as well as to files.
+//		-stderrthreshold=ERROR
+//			Log events at or above this severity are logged to standard
+//			error as well as to files.
+//		-log_dir=""
+//			Log files will be written to this directory instead of the
+//			default temporary directory.
 //
-//	Other flags provide aids to debugging.
-//
-//	-log_backtrace_at=""
-//		When set to a file and line number holding a logging statement,
-//		such as
-//			-log_backtrace_at=gopherflakes.go:234
-//		a stack trace will be written to the Info log whenever execution
-//		hits that statement. (Unlike with -vmodule, the ".go" must be
-//		present.)
-//	-v=0
-//		Enable V-leveled logging at the specified level.
-//	-vmodule=""
-//		The syntax of the argument is a comma-separated list of pattern=N,
-//		where pattern is a literal file name (minus the ".go" suffix) or
-//		"glob" pattern and N is a V level. For instance,
-//			-vmodule=gopher*=3
-//		sets the V level to 3 in all Go files whose names begin "gopher".
+//		Other flags provide aids to debugging.
 //
+//		-log_backtrace_at=""
+//			When set to a file and line number holding a logging statement,
+//			such as
+//				-log_backtrace_at=gopherflakes.go:234
+//			a stack trace will be written to the Info log whenever execution
+//			hits that statement. (Unlike with -vmodule, the ".go" must be
+//			present.)
+//		-v=0
+//			Enable V-leveled logging at the specified level.
+//		-vmodule=""
+//			The syntax of the argument is a comma-separated list of pattern=N,
+//			where pattern is a literal file name (minus the ".go" suffix) or
+//			"glob" pattern and N is a V level. For instance,
+//				-vmodule=gopher*=3
+//			sets the V level to 3 in all Go files whose names begin "gopher".
 package klog
 
 import (
@@ -397,45 +396,48 @@ type flushSyncWriter interface {
 	io.Writer
 }
 
-// init sets up the defaults.
+var logging loggingT
+var commandLine flag.FlagSet
+
+// init sets up the defaults and creates command line flags.
 func init() {
+	commandLine.StringVar(&logging.logDir, "log_dir", "", "If non-empty, write log files in this directory (no effect when -logtostderr=true)")
+	commandLine.StringVar(&logging.logFile, "log_file", "", "If non-empty, use this log file (no effect when -logtostderr=true)")
+	commandLine.Uint64Var(&logging.logFileMaxSizeMB, "log_file_max_size", 1800,
+		"Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. "+
+			"If the value is 0, the maximum file size is unlimited.")
+	commandLine.BoolVar(&logging.toStderr, "logtostderr", true, "log to standard error instead of files")
+	commandLine.BoolVar(&logging.alsoToStderr, "alsologtostderr", false, "log to standard error as well as files (no effect when -logtostderr=true)")
+	logging.setVState(0, nil, false)
+	commandLine.Var(&logging.verbosity, "v", "number for the log level verbosity")
+	commandLine.BoolVar(&logging.addDirHeader, "add_dir_header", false, "If true, adds the file directory to the header of the log messages")
+	commandLine.BoolVar(&logging.skipHeaders, "skip_headers", false, "If true, avoid header prefixes in the log messages")
+	commandLine.BoolVar(&logging.oneOutput, "one_output", false, "If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)")
+	commandLine.BoolVar(&logging.skipLogHeaders, "skip_log_headers", false, "If true, avoid headers when opening log files (no effect when -logtostderr=true)")
 	logging.stderrThreshold = severityValue{
 		Severity: severity.ErrorLog, // Default stderrThreshold is ERROR.
 	}
-	logging.setVState(0, nil, false)
-	logging.logDir = ""
-	logging.logFile = ""
-	logging.logFileMaxSizeMB = 1800
-	logging.toStderr = true
-	logging.alsoToStderr = false
-	logging.skipHeaders = false
-	logging.addDirHeader = false
-	logging.skipLogHeaders = false
-	logging.oneOutput = false
+	commandLine.Var(&logging.stderrThreshold, "stderrthreshold", "logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=false)")
+	commandLine.Var(&logging.vmodule, "vmodule", "comma-separated list of pattern=N settings for file-filtered logging")
+	commandLine.Var(&logging.traceLocation, "log_backtrace_at", "when logging hits line file:N, emit a stack trace")
+
+	logging.settings.contextualLoggingEnabled = true
 	logging.flushD = newFlushDaemon(logging.lockAndFlushAll, nil)
 }
 
 // InitFlags is for explicitly initializing the flags.
+// It may get called repeatedly for different flagsets, but not
+// twice for the same one. May get called concurrently
+// to other goroutines using klog. However, only some flags
+// may get set concurrently (see implementation).
 func InitFlags(flagset *flag.FlagSet) {
 	if flagset == nil {
 		flagset = flag.CommandLine
 	}
 
-	flagset.StringVar(&logging.logDir, "log_dir", logging.logDir, "If non-empty, write log files in this directory (no effect when -logtostderr=true)")
-	flagset.StringVar(&logging.logFile, "log_file", logging.logFile, "If non-empty, use this log file (no effect when -logtostderr=true)")
-	flagset.Uint64Var(&logging.logFileMaxSizeMB, "log_file_max_size", logging.logFileMaxSizeMB,
-		"Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. "+
-			"If the value is 0, the maximum file size is unlimited.")
-	flagset.BoolVar(&logging.toStderr, "logtostderr", logging.toStderr, "log to standard error instead of files")
-	flagset.BoolVar(&logging.alsoToStderr, "alsologtostderr", logging.alsoToStderr, "log to standard error as well as files (no effect when -logtostderr=true)")
-	flagset.Var(&logging.verbosity, "v", "number for the log level verbosity")
-	flagset.BoolVar(&logging.addDirHeader, "add_dir_header", logging.addDirHeader, "If true, adds the file directory to the header of the log messages")
-	flagset.BoolVar(&logging.skipHeaders, "skip_headers", logging.skipHeaders, "If true, avoid header prefixes in the log messages")
-	flagset.BoolVar(&logging.oneOutput, "one_output", logging.oneOutput, "If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)")
-	flagset.BoolVar(&logging.skipLogHeaders, "skip_log_headers", logging.skipLogHeaders, "If true, avoid headers when opening log files (no effect when -logtostderr=true)")
-	flagset.Var(&logging.stderrThreshold, "stderrthreshold", "logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=false)")
-	flagset.Var(&logging.vmodule, "vmodule", "comma-separated list of pattern=N settings for file-filtered logging")
-	flagset.Var(&logging.traceLocation, "log_backtrace_at", "when logging hits line file:N, emit a stack trace")
+	commandLine.VisitAll(func(f *flag.Flag) {
+		flagset.Var(f.Value, f.Name, f.Usage)
+	})
 }
 
 // Flush flushes all pending log I/O.
@@ -550,12 +552,6 @@ type loggingT struct {
 	vmap map[uintptr]Level
 }
 
-var logging = loggingT{
-	settings: settings{
-		contextualLoggingEnabled: true,
-	},
-}
-
 // setVState sets a consistent state for V logging.
 // l.mu is held.
 func (l *loggingT) setVState(verbosity Level, filter []modulePat, setFilter bool) {
@@ -633,8 +629,11 @@ It returns a buffer containing the formatted header and the user's file and line
 The depth specifies how many stack frames above lives the source line to be identified in the log message.
 
 Log lines have this form:
+
 	Lmmdd hh:mm:ss.uuuuuu threadid file:line] msg...
+
 where the fields are defined as follows:
+
 	L                A single character, representing the log level (eg 'I' for INFO)
 	mm               The month (zero padded; ie May is '05')
 	dd               The day (zero padded)
@@ -1298,9 +1297,13 @@ func newVerbose(level Level, b bool) Verbose {
 // The returned value is a struct of type Verbose, which implements Info, Infoln
 // and Infof. These methods will write to the Info log if called.
 // Thus, one may write either
+//
 //	if klog.V(2).Enabled() { klog.Info("log this") }
+//
 // or
+//
 //	klog.V(2).Info("log this")
+//
 // The second form is shorter but the first is cheaper if logging is off because it does
 // not evaluate its arguments.
 //
@@ -1582,10 +1585,10 @@ func ErrorSDepth(depth int, err error, msg string, keysAndValues ...interface{})
 //
 // Callers who want more control over handling of fatal events may instead use a
 // combination of different functions:
-// - some info or error logging function, optionally with a stack trace
-//   value generated by github.com/go-logr/lib/dbg.Backtrace
-// - Flush to flush pending log data
-// - panic, os.Exit or returning to the caller with an error
+//   - some info or error logging function, optionally with a stack trace
+//     value generated by github.com/go-logr/lib/dbg.Backtrace
+//   - Flush to flush pending log data
+//   - panic, os.Exit or returning to the caller with an error
 //
 // Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
 func Fatal(args ...interface{}) {
diff --git a/vendor/k8s.io/utils/pointer/pointer.go b/vendor/k8s.io/utils/pointer/pointer.go
index e745a81be..638e27d41 100644
--- a/vendor/k8s.io/utils/pointer/pointer.go
+++ b/vendor/k8s.io/utils/pointer/pointer.go
@@ -103,6 +103,62 @@ func Int32Equal(a, b *int32) bool {
 	return *a == *b
 }
 
+// Uint returns a pointer to an uint
+func Uint(i uint) *uint {
+	return &i
+}
+
+// UintPtr is a function variable referring to Uint.
+// Deprecated: Use Uint instead.
+var UintPtr = Uint // for back-compat
+
+// UintDeref dereferences the uint ptr and returns it if not nil, or else
+// returns def.
+func UintDeref(ptr *uint, def uint) uint {
+	if ptr != nil {
+		return *ptr
+	}
+	return def
+}
+
+// UintPtrDerefOr is a function variable referring to UintDeref.
+// Deprecated: Use UintDeref instead.
+var UintPtrDerefOr = UintDeref // for back-compat
+
+// Uint32 returns a pointer to an uint32.
+func Uint32(i uint32) *uint32 {
+	return &i
+}
+
+// Uint32Ptr is a function variable referring to Uint32.
+// Deprecated: Use Uint32 instead.
+var Uint32Ptr = Uint32 // for back-compat
+
+// Uint32Deref dereferences the uint32 ptr and returns it if not nil, or else
+// returns def.
+func Uint32Deref(ptr *uint32, def uint32) uint32 {
+	if ptr != nil {
+		return *ptr
+	}
+	return def
+}
+
+// Uint32PtrDerefOr is a function variable referring to Uint32Deref.
+// Deprecated: Use Uint32Deref instead.
+var Uint32PtrDerefOr = Uint32Deref // for back-compat
+
+// Uint32Equal returns true if both arguments are nil or both arguments
+// dereference to the same value.
+func Uint32Equal(a, b *uint32) bool {
+	if (a == nil) != (b == nil) {
+		return false
+	}
+	if a == nil {
+		return true
+	}
+	return *a == *b
+}
+
 // Int64 returns a pointer to an int64.
 func Int64(i int64) *int64 {
 	return &i
@@ -137,6 +193,40 @@ func Int64Equal(a, b *int64) bool {
 	return *a == *b
 }
 
+// Uint64 returns a pointer to an uint64.
+func Uint64(i uint64) *uint64 {
+	return &i
+}
+
+// Uint64Ptr is a function variable referring to Uint64.
+// Deprecated: Use Uint64 instead.
+var Uint64Ptr = Uint64 // for back-compat
+
+// Uint64Deref dereferences the uint64 ptr and returns it if not nil, or else
+// returns def.
+func Uint64Deref(ptr *uint64, def uint64) uint64 {
+	if ptr != nil {
+		return *ptr
+	}
+	return def
+}
+
+// Uint64PtrDerefOr is a function variable referring to Uint64Deref.
+// Deprecated: Use Uint64Deref instead.
+var Uint64PtrDerefOr = Uint64Deref // for back-compat
+
+// Uint64Equal returns true if both arguments are nil or both arguments
+// dereference to the same value.
+func Uint64Equal(a, b *uint64) bool {
+	if (a == nil) != (b == nil) {
+		return false
+	}
+	if a == nil {
+		return true
+	}
+	return *a == *b
+}
+
 // Bool returns a pointer to a bool.
 func Bool(b bool) *bool {
 	return &b
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 29f87b9cd..fd2bc9849 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -7,7 +7,7 @@ cloud.google.com/go/compute/metadata
 # contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d
 ## explicit; go 1.13
 contrib.go.opencensus.io/exporter/ocagent
-# contrib.go.opencensus.io/exporter/prometheus v0.4.0
+# contrib.go.opencensus.io/exporter/prometheus v0.4.2
 ## explicit; go 1.13
 contrib.go.opencensus.io/exporter/prometheus
 # cuelang.org/go v0.4.3
@@ -433,7 +433,7 @@ github.com/envoyproxy/go-control-plane/envoy/type/v3
 # github.com/envoyproxy/protoc-gen-validate v0.6.2
 ## explicit; go 1.12
 github.com/envoyproxy/protoc-gen-validate/validate
-# github.com/evanphx/json-patch v4.12.0+incompatible
+# github.com/evanphx/json-patch v5.6.0+incompatible
 ## explicit
 github.com/evanphx/json-patch
 # github.com/evanphx/json-patch/v5 v5.6.0
@@ -453,7 +453,7 @@ github.com/ghodss/yaml
 ## explicit
 github.com/go-chi/chi
 github.com/go-chi/chi/middleware
-# github.com/go-kit/log v0.2.0
+# github.com/go-kit/log v0.2.1
 ## explicit; go 1.17
 github.com/go-kit/log
 github.com/go-kit/log/level
@@ -710,7 +710,7 @@ github.com/hashicorp/hcl/hcl/token
 github.com/hashicorp/hcl/json/parser
 github.com/hashicorp/hcl/json/scanner
 github.com/hashicorp/hcl/json/token
-# github.com/imdario/mergo v0.3.12
+# github.com/imdario/mergo v0.3.13
 ## explicit; go 1.13
 github.com/imdario/mergo
 # github.com/in-toto/in-toto-golang v0.3.4-0.20220709202702-fa494aaa0add
@@ -921,6 +921,9 @@ github.com/opencontainers/go-digest
 ## explicit; go 1.17
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
+# github.com/openshift-pipelines/pipelines-as-code v0.13.0
+## explicit; go 1.18
+github.com/openshift-pipelines/pipelines-as-code/pkg/params/settings
 # github.com/openshift/api v0.0.0-20210910062324-a41d3573a3ba
 ## explicit; go 1.16
 github.com/openshift/api/console/v1
@@ -933,7 +936,7 @@ github.com/openshift/client-go/route/clientset/versioned/scheme
 github.com/opentracing/opentracing-go
 github.com/opentracing/opentracing-go/ext
 github.com/opentracing/opentracing-go/log
-# github.com/openzipkin/zipkin-go v0.3.0
+# github.com/openzipkin/zipkin-go v0.4.0
 ## explicit; go 1.14
 github.com/openzipkin/zipkin-go/model
 # github.com/pelletier/go-toml v1.9.5
@@ -969,8 +972,9 @@ github.com/prometheus/common/model
 github.com/prometheus/procfs
 github.com/prometheus/procfs/internal/fs
 github.com/prometheus/procfs/internal/util
-# github.com/prometheus/statsd_exporter v0.21.0
-## explicit; go 1.13
+# github.com/prometheus/statsd_exporter v0.22.8
+## explicit; go 1.17
+github.com/prometheus/statsd_exporter/pkg/level
 github.com/prometheus/statsd_exporter/pkg/mapper
 github.com/prometheus/statsd_exporter/pkg/mapper/fsm
 # github.com/protocolbuffers/txtpbfmt v0.0.0-20201118171849-f6a6b3f636fc
@@ -2274,7 +2278,7 @@ k8s.io/gengo/generator
 k8s.io/gengo/namer
 k8s.io/gengo/parser
 k8s.io/gengo/types
-# k8s.io/klog/v2 v2.70.2-0.20220707122935-0990e81f1a8f
+# k8s.io/klog/v2 v2.80.1
 ## explicit; go 1.13
 k8s.io/klog/v2
 k8s.io/klog/v2/internal/buffer
@@ -2294,7 +2298,7 @@ k8s.io/kube-openapi/pkg/schemamutation
 k8s.io/kube-openapi/pkg/spec3
 k8s.io/kube-openapi/pkg/util/proto
 k8s.io/kube-openapi/pkg/validation/spec
-# k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed
+# k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73
 ## explicit; go 1.12
 k8s.io/utils/buffer
 k8s.io/utils/clock


Test patch:
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
index 487b7343f..d5eeec86e 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
@@ -57,6 +57,12 @@ func Test_SetDefaults_PipelineProperties(t *testing.T) {
 			MetricsTaskrunDurationType:     "histogram",
 			MetricsTaskrunLevel:            "task",
 		},
+		Resolvers: Resolvers{
+			EnableBundlesResolver: ptr.Bool(true),
+			EnableHubResolver:     ptr.Bool(true),
+			EnableGitResolver:     ptr.Bool(true),
+			EnableClusterResolver: ptr.Bool(true),
+		},
 	}
 
 	tp.SetDefaults(context.TODO())
diff --git a/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml b/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml
new file mode 100644
index 000000000..7c1baf91e
--- /dev/null
+++ b/pkg/reconciler/common/testdata/test-add-psa-expected-statefulset.yaml
@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: tekton-results-postgres
+    app.kubernetes.io/part-of: tekton-results
+    app.kubernetes.io/version: v0.4.0
+  name: tekton-results-postgres
+  namespace: tekton-pipelines
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tekton-results-postgres
+      app.kubernetes.io/part-of: tekton-results
+      app.kubernetes.io/version: v0.4.0
+  serviceName: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tekton-results-postgres
+        app.kubernetes.io/part-of: tekton-results
+        app.kubernetes.io/version: v0.4.0
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: tekton-results-postgres
+            - secretRef:
+                name: tekton-results-postgres
+          image: postgres@sha256:6647385dd9ae11aa2216bf55c54d126b0a85637b3cf4039ef24e3234113588e3
+          name: postgres
+          ports:
+            - containerPort: 5432
+              name: postgredb
+          volumeMounts:
+            - mountPath: /var/data
+              name: postgredb
+            - mountPath: /docker-entrypoint-initdb.d
+              name: sql-initdb
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - configMap:
+            name: tekton-results-sql-initdb-config
+          name: sql-initdb
+  volumeClaimTemplates:
+    - metadata:
+        labels:
+          app.kubernetes.io/part-of: tekton-results
+          app.kubernetes.io/version: v0.4.0
+        name: postgredb
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
diff --git a/pkg/reconciler/common/testdata/test-add-psa-statefulset.yaml b/pkg/reconciler/common/testdata/test-add-psa-statefulset.yaml
new file mode 100644
index 000000000..4b9f62244
--- /dev/null
+++ b/pkg/reconciler/common/testdata/test-add-psa-statefulset.yaml
@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  labels:
+    app.kubernetes.io/name: tekton-results-postgres
+    app.kubernetes.io/part-of: tekton-results
+    app.kubernetes.io/version: v0.4.0
+  name: tekton-results-postgres
+  namespace: tekton-pipelines
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tekton-results-postgres
+      app.kubernetes.io/part-of: tekton-results
+      app.kubernetes.io/version: v0.4.0
+  serviceName: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tekton-results-postgres
+        app.kubernetes.io/part-of: tekton-results
+        app.kubernetes.io/version: v0.4.0
+    spec:
+      containers:
+        - envFrom:
+            - configMapRef:
+                name: tekton-results-postgres
+            - secretRef:
+                name: tekton-results-postgres
+          image: postgres@sha256:6647385dd9ae11aa2216bf55c54d126b0a85637b3cf4039ef24e3234113588e3
+          name: postgres
+          ports:
+            - containerPort: 5432
+              name: postgredb
+          volumeMounts:
+            - mountPath: /var/data
+              name: postgredb
+            - mountPath: /docker-entrypoint-initdb.d
+              name: sql-initdb
+      volumes:
+        - configMap:
+            name: tekton-results-sql-initdb-config
+          name: sql-initdb
+  volumeClaimTemplates:
+    - metadata:
+        labels:
+          app.kubernetes.io/part-of: tekton-results
+          app.kubernetes.io/version: v0.4.0
+        name: postgredb
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
diff --git a/pkg/reconciler/common/testdata/test-resolver-config.yaml b/pkg/reconciler/common/testdata/test-resolver-config.yaml
new file mode 100644
index 000000000..10d7ce4c0
--- /dev/null
+++ b/pkg/reconciler/common/testdata/test-resolver-config.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hubresolver-config
+  namespace: tekton-pipelines-resolvers
+  labels:
+    app.kubernetes.io/component: resolvers
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+data:
+  # the default Tekton Hub catalog from where to pull the resource.
+  default-tekton-hub-catalog: "Tekton"
+  # the default Artifact Hub Task catalog from where to pull the resource.
+  default-artifact-hub-task-catalog: "tekton-catalog-tasks"
+  # the default Artifact Hub Pipeline catalog from where to pull the resource.
+  default-artifact-hub-pipeline-catalog: "tekton-catalog-pipelines"
+  # the default layer kind in the hub image.
+  default-kind: "task"
+  # the default hub source to pull the resource from.
+  default-type: "artifact"
diff --git a/pkg/reconciler/common/transformers_test.go b/pkg/reconciler/common/transformers_test.go
index 751200b3d..30be23ee5 100644
--- a/pkg/reconciler/common/transformers_test.go
+++ b/pkg/reconciler/common/transformers_test.go
@@ -543,3 +543,62 @@ func TestAddPSA(t *testing.T) {
 		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
 	}
 }
+
+func TestAddStatefulSetPSA(t *testing.T) {
+	testData := path.Join("testdata", "test-add-psa-statefulset.yaml")
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	newManifest, err := manifest.Transform(AddStatefulSetRestrictedPSA())
+	assert.NilError(t, err)
+
+	got := &appsv1.StatefulSet{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(newManifest.Resources()[0].Object, got)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	testData = path.Join("testdata", "test-add-psa-expected-statefulset.yaml")
+	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	expected := &appsv1.StatefulSet{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(expectedManifest.Resources()[0].Object, expected)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	if d := cmp.Diff(expected, got); d != "" {
+		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
+	}
+}
+
+func TestCopyConfigMapValues(t *testing.T) {
+	testData := path.Join("testdata", "test-resolver-config.yaml")
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assertNoEror(t, err)
+
+	expectedValues := map[string]string{
+		"default-tekton-hub-catalog":        "abc-catalog",
+		"default-artifact-hub-task-catalog": "some-random-catalog",
+		"ignore-me-field":                   "ignore-me",
+	}
+
+	manifest, err = manifest.Transform(CopyConfigMap("hubresolver-config", expectedValues))
+	assertNoEror(t, err)
+
+	cm := &corev1.ConfigMap{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(manifest.Resources()[0].Object, cm)
+	assertNoEror(t, err)
+	// ConfigMap will have values changed only for field which are defined
+	assert.Equal(t, cm.Data["default-tekton-hub-catalog"], "abc-catalog")
+	assert.Equal(t, cm.Data["default-artifact-hub-task-catalog"], "some-random-catalog")
+
+	// fields which are not defined in expected configmap will be same as before
+	assert.Equal(t, cm.Data["default-kind"], "task")
+	assert.Equal(t, cm.Data["default-type"], "artifact")
+
+	// extra fields in expected configmap will be ignore and will not be added
+	assert.Equal(t, cm.Data["ignore-me-field"], "")
+
+}
diff --git a/pkg/reconciler/openshift/tektonconfig/extension/addon_test.go b/pkg/reconciler/openshift/tektonconfig/extension/addon_test.go
index 4dc76031c..7fdc7c4fd 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension/addon_test.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension/addon_test.go
@@ -44,7 +44,7 @@ func TestEnsureTektonAddonCRExists(t *testing.T) {
 	// during second invocation instance exists but waiting on dependencies (pipeline, triggers)
 	// hence returns DEPENDENCY_UPGRADE_PENDING_ERR
 	_, err = EnsureTektonAddonExists(ctx, c.OperatorV1alpha1().TektonAddons(), tConfig)
-	util.AssertEqual(t, err, v1alpha1.DEPENDENCY_UPGRADE_PENDING_ERR)
+	util.AssertEqual(t, err, v1alpha1.RECONCILE_AGAIN_ERR)
 
 	// make upgrade checks pass
 	makeUpgradeCheckPass(t, ctx, c.OperatorV1alpha1().TektonAddons())
diff --git a/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode_test.go b/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode_test.go
index 0a1604081..c457cce8f 100644
--- a/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode_test.go
+++ b/pkg/reconciler/openshift/tektonconfig/extension/pipelinesascode_test.go
@@ -18,9 +18,11 @@ package extension
 
 import (
 	"context"
+	"os"
 	"testing"
 
 	"github.com/tektoncd/operator/pkg/reconciler/shared/tektonconfig/pipeline"
+	"gotest.tools/v3/assert"
 
 	op "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
 
@@ -36,6 +38,10 @@ func TestEnsureOpenShiftPipelinesAsCodeExists(t *testing.T) {
 	c := fake.Get(ctx)
 	tConfig := pipeline.GetTektonConfig()
 
+	assert.NilError(t, os.Setenv("PLATFORM", "openshift"))
+	defer os.Clearenv()
+
+	tConfig.SetDefaults(ctx)
 	// first invocation should create instance as it is non-existent and return RECONCILE_AGAIN_ERR
 	_, err := EnsureOpenShiftPipelinesAsCodeExists(ctx, c.OperatorV1alpha1().OpenShiftPipelinesAsCodes(), tConfig)
 	util.AssertEqual(t, err, v1alpha1.RECONCILE_AGAIN_ERR)
@@ -65,12 +71,16 @@ func TestEnsureOpenShiftPipelinesAsCodeCRNotExists(t *testing.T) {
 	ctx, _, _ := ts.SetupFakeContextWithCancel(t)
 	c := fake.Get(ctx)
 
+	assert.NilError(t, os.Setenv("PLATFORM", "openshift"))
+	defer os.Clearenv()
+
 	// when no instance exists, nil error is returned immediately
 	err := EnsureOpenShiftPipelinesAsCodeCRNotExists(ctx, c.OperatorV1alpha1().OpenShiftPipelinesAsCodes())
 	util.AssertEqual(t, err, nil)
 
 	// create an instance for testing other cases
 	tConfig := pipeline.GetTektonConfig()
+	tConfig.SetDefaults(ctx)
 	_, err = EnsureOpenShiftPipelinesAsCodeExists(ctx, c.OperatorV1alpha1().OpenShiftPipelinesAsCodes(), tConfig)
 	util.AssertEqual(t, err, v1alpha1.RECONCILE_AGAIN_ERR)
 
diff --git a/test/e2e/kubernetes/tektonresultdeployment_test.go b/test/e2e/kubernetes/tektonresultdeployment_test.go
index b9f281ac2..7e6b689ec 100644
--- a/test/e2e/kubernetes/tektonresultdeployment_test.go
+++ b/test/e2e/kubernetes/tektonresultdeployment_test.go
@@ -37,6 +37,7 @@ import (
 
 // TestTektonResultDeployment verifies the TektonResult creation, deployment recreation, and TektonResult deletion.
 func TestTektonResultDeployment(t *testing.T) {
+	t.Skip()
 	platform := os.Getenv("PLATFORM")
 	if platform == "linux/ppc64le" || platform == "linux/s390x" {
 		t.Skipf("Tekton Result is not available for %q", platform)