Repository: tektoncd/operator
Pull request #246 (2021-03-05 14:23:28)

Add internal registry CA certificates to Tekton resources
This commit allows the operator to inject:
- trusted CA certificates which is a merge of user provided and system certificates
- service serving certificates which are required to talk to the
  internal OpenShift registry over the service

Both of these entries are mounted under SSL_CERT_DIR.

```release-note
OpenShift: the operator now mounts the internal registry certificates in the controller pods (pipelines, triggers)
```

tekton-robot: @concaf: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our [release note process](https://git.k8s.io/community/contributors/guide/release-notes.md) to remove it.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **sthaha**
You can assign the PR to them by writing `/assign @sthaha` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["sthaha"]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1367843243688988673/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1367843243688988673/artifacts/line-cov.html#file1) | Do not exist | 67.6% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 880684ea840149c30272978f8f27faa5705cc342 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367843243688988675/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 880684ea840149c30272978f8f27faa5705cc342 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367843243688988675/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1367917231710670848/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1367917231710670848/artifacts/line-cov.html#file1) | Do not exist | 67.6% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 4c0b827a209f4ff45fb13f8f1625778cb4c9d57f | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367917231706476545/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 4c0b827a209f4ff45fb13f8f1625778cb4c9d57f | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367917231706476545/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368609416869318657/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368609416869318657/artifacts/line-cov.html#file1) | Do not exist | 67.6% | 

tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 4c0b827a209f4ff45fb13f8f1625778cb4c9d57f | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367917231706476545/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368609416869318658/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 4c0b827a209f4ff45fb13f8f1625778cb4c9d57f | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1367917231706476545/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368609416869318658/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368609416869318658/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368609416873512960/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368609416869318658/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368609416873512960/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368609416873512960/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368800677173661698/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | c36dcac789d20dec1f9454adbd69683bf7355255 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368609416873512960/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368800677173661698/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368800677173661696/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368800677173661696/artifacts/line-cov.html#file1) | Do not exist | 67.6% | 

tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368800677173661698/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368800677173661697/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368820054791032835/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368820054791032835/artifacts/line-cov.html#file1) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368800677173661697/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368820054791032833/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 2b33b7a4cac19cfca90577eabd6af9cece420cc5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368800677173661697/) | `/test pull-tekton-operator-build-tests`
pull-tekton-operator-unit-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368820054791032833/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368820054791032833/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368820054791032834/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1368820054791032833/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 01eb705ca851f5a694411093f0bfe221b504743e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368820054791032834/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368822320356921346/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368822320356921346/artifacts/line-cov.html#file1) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | adb663797e07dab5ba7127801a17caf9419374b9 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368822320356921345/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | adb663797e07dab5ba7127801a17caf9419374b9 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1368822320356921345/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
concaf: /test pull-tekton-operator-build-tests
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368828988658552832/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368828988658552832/artifacts/line-cov.html#file1) | Do not exist | 65.8% | 

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368838426144542721/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368838426144542721/artifacts/line-cov.html#file1) | Do not exist | 65.8% | 

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/common/extensions.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368841697546473473/artifacts/line-cov.html#file0) | 100.0% | 83.3% | -16.7
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1368841697546473473/artifacts/line-cov.html#file1) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 41766943bfc2c1602905a09bc5dd94f5a5d30ab4 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369611395552776192/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 41766943bfc2c1602905a09bc5dd94f5a5d30ab4 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369611395552776192/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1369612527234715648/artifacts/line-cov.html#file0) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 8a1917031c8f2ca98c171f4161e415b7586ccce7 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369612527230521345/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | 8a1917031c8f2ca98c171f4161e415b7586ccce7 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369612527230521345/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
vdemeester: ```
-------------------------------------------
---- Checking go code style with gofmt ----
-------------------------------------------
diff -u pkg/reconciler/openshift/tektonpipeline/extension.go.orig pkg/reconciler/openshift/tektonpipeline/extension.go
--- pkg/reconciler/openshift/tektonpipeline/extension.go.orig	2021-03-10 11:34:26.445204655 +0000
+++ pkg/reconciler/openshift/tektonpipeline/extension.go	2021-03-10 11:34:26.445204655 +0000
@@ -19,10 +19,10 @@
 import (
 	"context"
 	"github.com/go-logr/zapr"
+	mfc "github.com/manifestival/client-go-client"
 	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
 	"go.uber.org/zap"
-	mfc "github.com/manifestival/client-go-client"
 	"knative.dev/pkg/injection"
 	"knative.dev/pkg/logging"
 	"os"
```

Needs some `gofmt`/`goimports` magic 😅 
concaf: > Needs some `gofmt`/`goimports` magic

yep, still fixing a couple of things.
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1369717847126708226/artifacts/line-cov.html#file0) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | ee7f1c1c46bb9afca4fac835c177fb70ec984e3e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369717847126708224/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-build-tests | ee7f1c1c46bb9afca4fac835c177fb70ec984e3e | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369717847126708224/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1369720363147071490/artifacts/line-cov.html#file0) | Do not exist | 65.8% | 

tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1369731436323540992/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1369731436323540992/) | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1369731436323540992/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369731436323540993/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @concaf: The following tests **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-unit-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-unit-tests/1369731436323540992/) | `/test pull-tekton-operator-unit-tests`
pull-tekton-operator-build-tests | 5f6d01c6126cfee11393c8833b03cfe20592dfb5 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-build-tests/1369731436323540993/) | `/test pull-tekton-operator-build-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/246). [Your PR dashboard](https://prow.tekton.dev/pr/concaf).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
concaf: @vdemeester I also had to split the one configmap with both labels into two because having both in one was producing inconsistent results due to a race condition.
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1369736595225186307/artifacts/line-cov.html#file0) | Do not exist | 67.5% | 

tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/246#pullrequestreview-609583295" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/246#pullrequestreview-609628697" title="Approved">piyush-garg</a>*, *<a href="https://github.com/tektoncd/operator/pull/246#pullrequestreview-609583295" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
vdemeester: Added the `release-note` part in the PR description 😉 
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1369973280500355072/artifacts/line-cov.html#file4) | Do not exist | 67.5% | 

piyush-garg: /lgtm
tekton-robot: @piyush-garg: changing LGTM is restricted to collaborators

<details>

In response to [this](https://github.com/tektoncd/operator/pull/246#issuecomment-796691928):

>/lgtm


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>
nikhil-thomas: /lgtm
nikhil-thomas: /approve
tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/246#issuecomment-797321523" title="Approved">nikhil-thomas</a>*, *<a href="https://github.com/tektoncd/operator/pull/246#pullrequestreview-609628697" title="Approved">piyush-garg</a>*, *<a href="https://github.com/tektoncd/operator/pull/246#pullrequestreview-609583295" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [nikhil-thomas,vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
tekton-robot: New changes are detected. LGTM label has been removed.
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1370290370054721537/artifacts/line-cov.html#file4) | Do not exist | 67.5% | 

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1370290998172717056/artifacts/line-cov.html#file4) | Do not exist | 67.5% | 

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/cabundle.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/246/pull-tekton-operator-go-coverage/1370291627603529731/artifacts/line-cov.html#file4) | Do not exist | 67.5% | 

vdemeester: /lgtm

Patch:
diff --git a/cmd/openshift/operator/kodata/cabundles/config-service-cabundle.yaml b/cmd/openshift/operator/kodata/cabundles/config-service-cabundle.yaml
new file mode 100644
index 000000000..41a38fd53
--- /dev/null
+++ b/cmd/openshift/operator/kodata/cabundles/config-service-cabundle.yaml
@@ -0,0 +1,27 @@
+# Copyright 2020 The Tekton Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This ConfigMap is only meant to be applied to the openshift-pipelines
+# namespace and should be treated as an installation manifest for OpenShift
+# Pipelines. Other namespaces are taken care of by the reconcile loop.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-service-cabundle
+  namespace: openshift-pipelines
+  labels:
+    operator.tekton.dev/release: devel
+    app.kubernetes.io/part-of: tekton-pipelines
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
diff --git a/cmd/openshift/operator/kodata/cabundles/config-trusted-cabundle.yaml b/cmd/openshift/operator/kodata/cabundles/config-trusted-cabundle.yaml
new file mode 100644
index 000000000..66b3d7b1c
--- /dev/null
+++ b/cmd/openshift/operator/kodata/cabundles/config-trusted-cabundle.yaml
@@ -0,0 +1,26 @@
+# Copyright 2020 The Tekton Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This ConfigMap is only meant to be applied to the openshift-pipelines
+# namespace and should be treated as an installation manifest for OpenShift
+# Pipelines. Other namespaces are taken care of by the reconcile loop.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config-trusted-cabundle
+  namespace: openshift-pipelines
+  labels:
+    operator.tekton.dev/release: devel
+    app.kubernetes.io/part-of: tekton-pipelines
+    config.openshift.io/inject-trusted-cabundle: "true"
diff --git a/cmd/openshift/operator/kodata/tekton-namespace/operator-namespace.yaml b/cmd/openshift/operator/kodata/tekton-namespace/operator-namespace.yaml
new file mode 100644
index 000000000..115ed60d0
--- /dev/null
+++ b/cmd/openshift/operator/kodata/tekton-namespace/operator-namespace.yaml
@@ -0,0 +1,21 @@
+# Copyright 2020 The Tekton Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openshift-pipelines
+  labels:
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
diff --git a/pkg/reconciler/common/install.go b/pkg/reconciler/common/install.go
index d98ce2178..86820f116 100644
--- a/pkg/reconciler/common/install.go
+++ b/pkg/reconciler/common/install.go
@@ -19,6 +19,7 @@ package common
 import (
 	"context"
 	"fmt"
+
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"knative.dev/pkg/logging"
diff --git a/pkg/reconciler/kubernetes/tektonconfig/controller.go b/pkg/reconciler/kubernetes/tektonconfig/controller.go
index f374b5f75..4b52cd4ae 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/controller.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/controller.go
@@ -18,6 +18,7 @@ package tektonconfig
 
 import (
 	"context"
+
 	"github.com/go-logr/zapr"
 	mfc "github.com/manifestival/client-go-client"
 	mf "github.com/manifestival/manifestival"
diff --git a/pkg/reconciler/kubernetes/tektonconfig/extension/dashboard.go b/pkg/reconciler/kubernetes/tektonconfig/extension/dashboard.go
index ed2eb711d..c5cab839e 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/extension/dashboard.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/extension/dashboard.go
@@ -20,9 +20,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"log"
 
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+
 	op "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
 	operatorv1alpha1 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
diff --git a/pkg/reconciler/kubernetes/tektonconfig/pipeline/pipeline.go b/pkg/reconciler/kubernetes/tektonconfig/pipeline/pipeline.go
index cff033efb..f1c061a9e 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/pipeline/pipeline.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/pipeline/pipeline.go
@@ -20,9 +20,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"log"
 
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+
 	op "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
 	operatorv1alpha1 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
diff --git a/pkg/reconciler/kubernetes/tektonconfig/trigger/trigger.go b/pkg/reconciler/kubernetes/tektonconfig/trigger/trigger.go
index 1f761c5ab..4705c5c1b 100644
--- a/pkg/reconciler/kubernetes/tektonconfig/trigger/trigger.go
+++ b/pkg/reconciler/kubernetes/tektonconfig/trigger/trigger.go
@@ -20,9 +20,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"log"
 
+	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
+
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/wait"
diff --git a/pkg/reconciler/openshift/common/cabundle.go b/pkg/reconciler/openshift/common/cabundle.go
new file mode 100644
index 000000000..77e6c005b
--- /dev/null
+++ b/pkg/reconciler/openshift/common/cabundle.go
@@ -0,0 +1,169 @@
+/*
+Copyright 2020 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"encoding/json"
+	"path/filepath"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/kubernetes/scheme"
+)
+
+const (
+	// user-provided and system CA certificates
+	trustedCAConfigMapName   = "config-trusted-cabundle"
+	trustedCAConfigMapVolume = "config-trusted-cabundle-volume"
+	trustedCAKey             = "ca-bundle.crt"
+
+	// service serving certificates (required to talk to the internal registry)
+	serviceCAConfigMapName   = "config-service-cabundle"
+	serviceCAConfigMapVolume = "config-service-cabundle-volume"
+	serviceCAKey             = "service-ca.crt"
+)
+
+// ApplyCABundles is a transformer that add the trustedCA volume, mount and
+// environment variables so that the deployment uses it.
+func ApplyCABundles(u *unstructured.Unstructured) error {
+	if u.GetKind() != "Deployment" {
+		// Don't do anything on something else than Deployment
+		return nil
+	}
+
+	deployment := &appsv1.Deployment{}
+	if err := scheme.Scheme.Convert(u, deployment, nil); err != nil {
+		return err
+	}
+
+	volumes := deployment.Spec.Template.Spec.Volumes
+
+	// If CA bundle volumes already exists in the PodSpec, then remove it
+	for _, volumeName := range []string{trustedCAConfigMapVolume, serviceCAConfigMapVolume} {
+		for i, v := range volumes {
+			if v.Name == volumeName {
+				volumes = append(volumes[:i], volumes[i+1:]...)
+				break
+			}
+		}
+	}
+
+	// Let's add the trusted and service CA bundle ConfigMaps as a volume in
+	// the PodSpec which will later be mounted to add certs in the pod.
+	volumes = append(volumes,
+		// Add trusted CA bundle
+		corev1.Volume{
+			Name: trustedCAConfigMapVolume,
+			VolumeSource: corev1.VolumeSource{
+				ConfigMap: &corev1.ConfigMapVolumeSource{
+					LocalObjectReference: corev1.LocalObjectReference{Name: trustedCAConfigMapName},
+					Items: []corev1.KeyToPath{
+						{
+							Key:  trustedCAKey,
+							Path: trustedCAKey,
+						},
+					},
+				},
+			},
+		},
+		// Add service serving certificates bundle
+		corev1.Volume{
+			Name: serviceCAConfigMapVolume,
+			VolumeSource: corev1.VolumeSource{
+				ConfigMap: &corev1.ConfigMapVolumeSource{
+					LocalObjectReference: corev1.LocalObjectReference{Name: serviceCAConfigMapName},
+					Items: []corev1.KeyToPath{
+						{
+							Key:  serviceCAKey,
+							Path: serviceCAKey,
+						},
+					},
+				},
+			},
+		})
+	deployment.Spec.Template.Spec.Volumes = volumes
+
+	// Now that the injected certificates have been added as a volume, let's
+	// mount them via volumeMounts in the containers
+	for i, c := range deployment.Spec.Template.Spec.Containers {
+		volumeMounts := c.VolumeMounts
+
+		// If volume mounts for injected certificates already exist then remove them
+		for _, volumeName := range []string{trustedCAConfigMapVolume, serviceCAConfigMapVolume} {
+			for i, vm := range volumeMounts {
+				if vm.Name == volumeName {
+					volumeMounts = append(volumeMounts[:i], volumeMounts[i+1:]...)
+					break
+				}
+			}
+		}
+
+		// /etc/ssl/certs is the default place where CA certs reside in *nix
+		// however this can be overridden using SSL_CERT_DIR, let's check for
+		// that here.
+		sslCertDir := "/etc/ssl/certs"
+		for _, env := range c.Env {
+			if env.Name == "SSL_CERT_DIR" {
+				sslCertDir = env.Value
+			}
+		}
+
+		// Let's mount the certificates now.
+		volumeMounts = append(volumeMounts,
+			corev1.VolumeMount{
+				Name:      trustedCAConfigMapVolume,
+				MountPath: filepath.Join(sslCertDir, trustedCAKey),
+				SubPath:   trustedCAKey,
+				ReadOnly:  true,
+			},
+			corev1.VolumeMount{
+				Name:      serviceCAConfigMapVolume,
+				MountPath: filepath.Join(sslCertDir, serviceCAKey),
+				SubPath:   serviceCAKey,
+				ReadOnly:  true,
+			},
+		)
+		c.VolumeMounts = volumeMounts
+		deployment.Spec.Template.Spec.Containers[i] = c
+	}
+
+	deployment.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   appsv1.SchemeGroupVersion.Group,
+		Version: appsv1.SchemeGroupVersion.Version,
+		Kind:    "Deployment",
+	})
+	m, err := toUnstructured(deployment)
+	if err != nil {
+		return err
+	}
+	u.SetUnstructuredContent(m.Object)
+	return nil
+}
+
+func toUnstructured(v interface{}) (*unstructured.Unstructured, error) {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	ud := &unstructured.Unstructured{}
+	if err := json.Unmarshal(b, ud); err != nil {
+		return nil, err
+	}
+	return ud, nil
+}
diff --git a/pkg/reconciler/openshift/rbac/rbac.go b/pkg/reconciler/openshift/rbac/rbac.go
index 454162dd4..e6c5d5590 100644
--- a/pkg/reconciler/openshift/rbac/rbac.go
+++ b/pkg/reconciler/openshift/rbac/rbac.go
@@ -40,8 +40,10 @@ type Reconciler struct {
 var _ nsreconciler.Interface = (*Reconciler)(nil)
 
 const (
-	pipelineAnyuid = "pipeline-anyuid"
-	pipelineSA     = "pipeline"
+	pipelineAnyuid           = "pipeline-anyuid"
+	pipelineSA               = "pipeline"
+	serviceCABundleCofigMap  = "config-service-cabundle"
+	trustedCABundleConfigMap = "config-trusted-cabundle"
 )
 
 // FinalizeKind removes all resources after deletion of a TektonPipelines.
@@ -60,6 +62,12 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ns *corev1.Namespace) pk
 		logger.Infow("Reconciling Namespace: IGNORE", "status", ns.GetName())
 		return nil
 	}
+
+	logger.Infow("Reconciling inject CA bundle configmap in ", "Namespace", ns.GetName())
+	if err := r.ensureCABundles(ctx, ns); err != nil {
+		return err
+	}
+
 	logger.Infow("Reconciling Default SA in ", "Namespace", ns.GetName())
 
 	sa, err := r.ensureSA(ctx, ns)
@@ -85,6 +93,39 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ns *corev1.Namespace) pk
 	return nil
 }
 
+func (r *Reconciler) ensureCABundles(ctx context.Context, ns *corev1.Namespace) error {
+	logger := logging.FromContext(ctx)
+	cfgInterface := r.kubeClientSet.CoreV1().ConfigMaps(ns.Name)
+
+	// Ensure trusted CA bundle
+	logger.Info("finding configmap: %s/%s", ns.Name, trustedCABundleConfigMap)
+	_, err := cfgInterface.Get(ctx, trustedCABundleConfigMap, metav1.GetOptions{})
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	if err != nil && errors.IsNotFound(err) {
+		logger.Info("creating configmap", trustedCABundleConfigMap, "ns", ns.Name)
+		if err := createTrustedCABundleConfigMap(ctx, cfgInterface, trustedCABundleConfigMap, ns.Name); err != nil {
+			return err
+		}
+	}
+
+	// Ensure service CA bundle
+	logger.Info("finding configmap: %s/%s", ns.Name, serviceCABundleCofigMap)
+	_, err = cfgInterface.Get(ctx, serviceCABundleCofigMap, metav1.GetOptions{})
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	if err != nil && errors.IsNotFound(err) {
+		logger.Info("creating configmap", serviceCABundleCofigMap, "ns", ns.Name)
+		if err := createServiceCABundleConfigMap(ctx, cfgInterface, serviceCABundleCofigMap, ns.Name); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 func (r *Reconciler) ensureSA(ctx context.Context, ns *corev1.Namespace) (*corev1.ServiceAccount, error) {
 	logger := logging.FromContext(ctx)
 	logger.Info("finding sa: %s/%s", ns.Name, "pipeline")
@@ -274,3 +315,45 @@ func createSA(ctx context.Context, saInterface v1.ServiceAccountInterface, ns st
 
 	return sa, nil
 }
+
+func createTrustedCABundleConfigMap(ctx context.Context, cfgInterface v1.ConfigMapInterface, name, ns string) error {
+	c := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: ns,
+			Labels: map[string]string{
+				"app.kubernetes.io/part-of": "tekton-pipelines",
+				// user-provided and system CA certificates
+				"config.openshift.io/inject-trusted-cabundle": "true",
+			},
+		},
+	}
+
+	_, err := cfgInterface.Create(ctx, c, metav1.CreateOptions{})
+	if err != nil && !errors.IsAlreadyExists(err) {
+		return err
+	}
+	return nil
+}
+
+func createServiceCABundleConfigMap(ctx context.Context, cfgInterface v1.ConfigMapInterface, name, ns string) error {
+	c := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: ns,
+			Labels: map[string]string{
+				"app.kubernetes.io/part-of": "tekton-pipelines",
+			},
+			Annotations: map[string]string{
+				// service serving certificates (required to talk to the internal registry)
+				"service.beta.openshift.io/inject-cabundle": "true",
+			},
+		},
+	}
+
+	_, err := cfgInterface.Create(ctx, c, metav1.CreateOptions{})
+	if err != nil && !errors.IsAlreadyExists(err) {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/controller.go b/pkg/reconciler/openshift/tektonaddon/controller.go
index a8ef7fa28..6ddb3e038 100644
--- a/pkg/reconciler/openshift/tektonaddon/controller.go
+++ b/pkg/reconciler/openshift/tektonaddon/controller.go
@@ -18,6 +18,7 @@ package tektonaddon
 
 import (
 	"context"
+
 	"github.com/go-logr/zapr"
 	mfc "github.com/manifestival/client-go-client"
 	mf "github.com/manifestival/manifestival"
@@ -27,6 +28,7 @@ import (
 	tektonTriggerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektontrigger"
 	tektonAddonreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonaddon"
 	"go.uber.org/zap"
+
 	//deploymentinformer "knative.dev/pkg/client/injection/kube/informers/apps/v1/deployment"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
 	kubeclient "knative.dev/pkg/client/injection/kube/client"
diff --git a/pkg/reconciler/openshift/tektonpipeline/extension.go b/pkg/reconciler/openshift/tektonpipeline/extension.go
index 6c17d29ba..092946047 100644
--- a/pkg/reconciler/openshift/tektonpipeline/extension.go
+++ b/pkg/reconciler/openshift/tektonpipeline/extension.go
@@ -18,11 +18,22 @@ package tektonpipeline
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"strings"
 
+	"github.com/go-logr/zapr"
+	mfc "github.com/manifestival/client-go-client"
+	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
+	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
+	"go.uber.org/zap"
+	"knative.dev/pkg/injection"
+	"knative.dev/pkg/logging"
+
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
+	occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -33,26 +44,60 @@ const (
 	DefaultSA = "pipeline"
 	// DefaultDisableAffinityAssistant is default value of disable affinity assistant flag
 	DefaultDisableAffinityAssistant = "true"
+	DefaultTargetNamespace          = "openshift-pipelines"
 	AnnotationPreserveNS            = "operator.tekton.dev/preserve-namespace"
 	AnnotationPreserveRBSubjectNS   = "operator.tekton.dev/preserve-rb-subject-namespace"
 )
 
 // NoPlatform "generates" a NilExtension
-func OpenShiftExtension(context.Context) common.Extension {
-	return openshiftExtension{}
+func OpenShiftExtension(ctx context.Context) common.Extension {
+	logger := logging.FromContext(ctx)
+	mfclient, err := mfc.NewClient(injection.GetConfig(ctx))
+	if err != nil {
+		logger.Fatalw("error creating client from injected config", zap.Error(err))
+	}
+	mflogger := zapr.NewLogger(logger.Named("manifestival").Desugar())
+	manifest, err := mf.ManifestFrom(mf.Slice{}, mf.UseClient(mfclient), mf.UseLogger(mflogger))
+	if err != nil {
+		logger.Fatalw("error creating initial manifest", zap.Error(err))
+	}
+	ext := openshiftExtension{
+		operatorClientSet: operatorclient.Get(ctx),
+		manifest:          manifest,
+	}
+	return ext
 }
 
-type openshiftExtension struct{}
+type openshiftExtension struct {
+	operatorClientSet versioned.Interface
+	manifest          mf.Manifest
+}
 
 func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
 	return []mf.Transformer{
 		injectDefaultSA(DefaultSA),
 		setDisableAffinityAssistant(DefaultDisableAffinityAssistant),
+		occommon.ApplyCABundles,
 	}
 }
-func (oe openshiftExtension) PreReconcile(context.Context, v1alpha1.TektonComponent) error {
-	return nil
+func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.TektonComponent) error {
+	koDataDir := os.Getenv(common.KoEnvKey)
+
+	// make sure that openshift-pipelines namespace exists
+	namespaceLocation := filepath.Join(koDataDir, "tekton-namespace")
+	if err := common.AppendManifest(&oe.manifest, namespaceLocation); err != nil {
+		return err
+	}
+
+	// add inject CA bundles manifests
+	cabundlesLocation := filepath.Join(koDataDir, "cabundles")
+	if err := common.AppendManifest(&oe.manifest, cabundlesLocation); err != nil {
+		return err
+	}
+
+	return common.Install(ctx, &oe.manifest, tc)
 }
+
 func (oe openshiftExtension) PostReconcile(context.Context, v1alpha1.TektonComponent) error {
 	return nil
 }
diff --git a/pkg/reconciler/openshift/tektontrigger/extension.go b/pkg/reconciler/openshift/tektontrigger/extension.go
index eb2a5cb9d..496b184ce 100644
--- a/pkg/reconciler/openshift/tektontrigger/extension.go
+++ b/pkg/reconciler/openshift/tektontrigger/extension.go
@@ -22,6 +22,7 @@ import (
 	mf "github.com/manifestival/manifestival"
 	"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
+	occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 )
 
 // NoPlatform "generates" a NilExtension
@@ -35,6 +36,7 @@ func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Tr
 	triggerImages := common.ToLowerCaseKeys(common.ImagesFromEnv(common.TriggersImagePrefix))
 	return []mf.Transformer{
 		common.DeploymentImages(triggerImages),
+		occommon.ApplyCABundles,
 	}
 }
 func (oe openshiftExtension) PreReconcile(context.Context, v1alpha1.TektonComponent) error {
diff --git a/pkg/reconciler/proxy/controller.go b/pkg/reconciler/proxy/controller.go
index 572dd03a8..b1ea4efcd 100644
--- a/pkg/reconciler/proxy/controller.go
+++ b/pkg/reconciler/proxy/controller.go
@@ -18,11 +18,13 @@ package proxy
 
 import (
 	"context"
-	"knative.dev/pkg/configmap"
 	"os"
 
+	"knative.dev/pkg/configmap"
+
 	"knative.dev/pkg/injection"
 	"knative.dev/pkg/signals"
+
 	// Injection stuff
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/cache"


Test patch:
diff --git a/pkg/reconciler/openshift/common/cabundle_test.go b/pkg/reconciler/openshift/common/cabundle_test.go
new file mode 100644
index 000000000..ee4a0a6f4
--- /dev/null
+++ b/pkg/reconciler/openshift/common/cabundle_test.go
@@ -0,0 +1,147 @@
+/*
+Copyright 2020 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package common
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"testing"
+
+	"gotest.tools/v3/assert"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestApplyCABundles(t *testing.T) {
+	actual := unstructuredDeployment(t)
+	expected := unstructuredDeployment(t,
+		withVolumes(corev1.Volume{
+			Name: trustedCAConfigMapVolume,
+			VolumeSource: corev1.VolumeSource{
+				ConfigMap: &corev1.ConfigMapVolumeSource{
+					LocalObjectReference: corev1.LocalObjectReference{Name: trustedCAConfigMapName},
+					Items: []corev1.KeyToPath{
+						{
+							Key:  trustedCAKey,
+							Path: trustedCAKey,
+						},
+					},
+				},
+			},
+		},
+			corev1.Volume{
+				Name: serviceCAConfigMapVolume,
+				VolumeSource: corev1.VolumeSource{
+					ConfigMap: &corev1.ConfigMapVolumeSource{
+						LocalObjectReference: corev1.LocalObjectReference{Name: serviceCAConfigMapName},
+						Items: []corev1.KeyToPath{
+							{
+								Key:  serviceCAKey,
+								Path: serviceCAKey,
+							},
+						},
+					},
+				},
+			}),
+		withVolumeMounts(corev1.VolumeMount{
+			Name:      trustedCAConfigMapVolume,
+			MountPath: filepath.Join("/etc/ssl/certs", trustedCAKey),
+			SubPath:   trustedCAKey,
+			ReadOnly:  true,
+		},
+			corev1.VolumeMount{
+				Name:      serviceCAConfigMapVolume,
+				MountPath: filepath.Join("/etc/ssl/certs", serviceCAKey),
+				SubPath:   serviceCAKey,
+				ReadOnly:  true,
+			}),
+	)
+
+	if err := ApplyCABundles(actual); err != nil {
+		t.Fatal(err)
+	}
+
+	assert.DeepEqual(t, actual, expected)
+}
+
+type deploymentModifier func(*appsv1.Deployment)
+
+func unstructuredDeployment(t *testing.T, modifiers ...deploymentModifier) *unstructured.Unstructured {
+	deploy := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: "foo",
+			Name:      "registry",
+		},
+		Spec: appsv1.DeploymentSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": "registry",
+				},
+			},
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"app": "registry",
+					},
+				},
+				Spec: corev1.PodSpec{
+					Containers: []corev1.Container{{
+						Name:  "registry",
+						Image: "registry",
+					}},
+				},
+			},
+		},
+	}
+
+	for _, modifier := range modifiers {
+		modifier(deploy)
+	}
+
+	deploy.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   appsv1.SchemeGroupVersion.Group,
+		Version: appsv1.SchemeGroupVersion.Version,
+		Kind:    "Deployment",
+	})
+	b, err := json.Marshal(deploy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ud := &unstructured.Unstructured{}
+	if err := json.Unmarshal(b, ud); err != nil {
+		t.Fatal(err)
+	}
+	return ud
+}
+
+func withVolumes(volumes ...corev1.Volume) func(*appsv1.Deployment) {
+	return func(d *appsv1.Deployment) {
+		d.Spec.Template.Spec.Volumes = append(d.Spec.Template.Spec.Volumes, volumes...)
+	}
+}
+
+func withVolumeMounts(volumeMounts ...corev1.VolumeMount) func(*appsv1.Deployment) {
+	return func(d *appsv1.Deployment) {
+		for i, c := range d.Spec.Template.Spec.Containers {
+			c.VolumeMounts = append(c.VolumeMounts, volumeMounts...)
+			d.Spec.Template.Spec.Containers[i] = c
+		}
+	}
+}
diff --git a/pkg/reconciler/openshift/tektonaddon/pipelinetemplates/pipelinetemplates_test.go b/pkg/reconciler/openshift/tektonaddon/pipelinetemplates/pipelinetemplates_test.go
index e849ef7b8..9abcd38be 100644
--- a/pkg/reconciler/openshift/tektonaddon/pipelinetemplates/pipelinetemplates_test.go
+++ b/pkg/reconciler/openshift/tektonaddon/pipelinetemplates/pipelinetemplates_test.go
@@ -2,6 +2,10 @@ package tektonaddon
 
 import (
 	"fmt"
+	"path/filepath"
+	"strings"
+	"testing"
+
 	mfc "github.com/manifestival/controller-runtime-client"
 	mf "github.com/manifestival/manifestival"
 	op "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
@@ -9,11 +13,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/kubernetes/scheme"
-	"path/filepath"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
-	"strings"
-	"testing"
 )
 
 func TestSomething(t *testing.T) {