Repository: tektoncd/operator
Pull request #704 (2022-03-21 10:46:45)

[Cherry-pick] Removes security context for Hub Api deployment in case of openshift
With Hub v1.7.1 release SecurityContext of fsGroup with id 101 is added,
because the pod didn't have permissions to create a new directory,
but this SecurityContext is not supported by Openshift

Hence this patch removes the SecurityContext using a transformer as
the pod has the permissions already to create a directory

Signed-off-by: Puneet Punamiya <ppunamiy@redhat.com>

# Changes

<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **nikhil-thomas**
You can assign the PR to them by writing `/assign @nikhil-thomas` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/release-v0.55.x/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["nikhil-thomas"]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/transformer.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-go-coverage/1505858612075958272/artifacts/line-cov.html#file0) | 81.2% | 79.2% | -2.1

tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | c98a720cce3bbdf366a77dcf865bb52dc7b671dc | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-integration-tests/1505858612075958273/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/704). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | c98a720cce3bbdf366a77dcf865bb52dc7b671dc | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-integration-tests/1505858612075958273/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/704). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/reconciler/openshift/common/transformer.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-go-coverage/1505865155055980547/artifacts/line-cov.html#file0) | 81.2% | 79.2% | -2.1

tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | 9b2a45ba974e51e6c5a45df80a60e394da21faa2 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-integration-tests/1505865155055980546/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/704). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun them all:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-tekton-operator-integration-tests | 9b2a45ba974e51e6c5a45df80a60e394da21faa2 | [link](https://tekton-releases.appspot.com/build/tekton-prow/pr-logs/pull/tektoncd_operator/704/pull-tekton-operator-integration-tests/1505865155055980546/) | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://tekton-releases.appspot.com/pr/tektoncd_operator/704). [Your PR dashboard](https://prow.tekton.dev/pr/PuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/Makefile b/Makefile
index bf354667d..42e751e95 100644
--- a/Makefile
+++ b/Makefile
@@ -23,10 +23,13 @@ export GO111MODULE=on
 $(BIN):
 	@mkdir -p $@
 $(BIN)/%: | $(BIN) ; $(info $(M) building $(PACKAGE)…)
-	$Q tmp=$$(mktemp -d); \
-	   env GO111MODULE=off GOPATH=$$tmp GOBIN=$(BIN) $(GO) get $(PACKAGE) \
+	$Q tmp=$$(mktemp -d); cd $$tmp; \
+  		env GO111MODULE=on GOPATH=$$tmp GOBIN=$(BIN) $(GO) get $(PACKAGE) \
 		|| ret=$$?; \
-	   rm -rf $$tmp ; exit $$ret
+  		env GO111MODULE=on GOPATH=$$tmp GOBIN=$(BIN) $(GO) clean -modcache \
+        || ret=$$?; \
+		cd - ; \
+	  	rm -rf $$tmp ; exit $$ret
 
 KO = $(or ${KO_BIN},${KO_BIN},$(BIN)/ko)
 
@@ -38,7 +41,9 @@ PAC_VERSION ?= 0.5.4
 TEKTON_HUB_VERSION ?= v1.7.0 # latest doesn't returns any version hence hard coding to v1.7.0 for now
 TEKTON_CHAINS_VERSION ?= latest
 
-$(BIN)/ko: PACKAGE=github.com/google/ko
+# TODO: after updating go version to 1.17 uncommnent the line below to install latest version of ko
+# $(BIN)/ko: PACKAGE=github.com/google/ko
+$(BIN)/ko: PACKAGE=github.com/google/ko@v0.9.3
 
 KUSTOMIZE = $(or ${KUSTOMIZE_BIN},${KUSTOMIZE_BIN},$(BIN)/kustomize)
 $(BIN)/kustomize: | $(BIN) ; $(info $(M) getting kustomize)
diff --git a/cmd/kubernetes/operator/kodata/webhook/webhook.yaml b/cmd/kubernetes/operator/kodata/webhook/webhook.yaml
index cea0ea689..3cf1d49f9 100644
--- a/cmd/kubernetes/operator/kodata/webhook/webhook.yaml
+++ b/cmd/kubernetes/operator/kodata/webhook/webhook.yaml
@@ -86,8 +86,8 @@ metadata:
   name: tekton-operator-proxy-webhook
   namespace: tekton-pipelines
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   replicas: 1
   selector:
@@ -129,8 +129,8 @@ metadata:
   name: tekton-operator-proxy-webhook
   namespace: tekton-pipelines
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   ports:
     - name: https-webhook
diff --git a/cmd/openshift/operator/kodata/tekton-addon/addons/02-clustertasks/source_local/maven/maven-task.yaml b/cmd/openshift/operator/kodata/tekton-addon/addons/02-clustertasks/source_local/maven/maven-task.yaml
index 51ac33ec7..ac5b99449 100644
--- a/cmd/openshift/operator/kodata/tekton-addon/addons/02-clustertasks/source_local/maven/maven-task.yaml
+++ b/cmd/openshift/operator/kodata/tekton-addon/addons/02-clustertasks/source_local/maven/maven-task.yaml
@@ -23,7 +23,7 @@ spec:
     - name: MAVEN_IMAGE
       type: string
       description: Maven base image
-      default: image-registry.openshift-image-registry.svc:5000/openshift/openjdk-11-rhel8:1.0
+      default: image-registry.openshift-image-registry.svc:5000/openshift/java:latest
     - name: GOALS
       description: maven goals to run
       type: array
diff --git a/cmd/openshift/operator/kodata/webhook/webhook.yaml b/cmd/openshift/operator/kodata/webhook/webhook.yaml
index 5a069ec58..21c168fb6 100644
--- a/cmd/openshift/operator/kodata/webhook/webhook.yaml
+++ b/cmd/openshift/operator/kodata/webhook/webhook.yaml
@@ -86,8 +86,8 @@ metadata:
   name: tekton-operator-proxy-webhook
   namespace: tekton-pipelines
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   replicas: 1
   selector:
@@ -128,8 +128,8 @@ metadata:
   name: tekton-operator-proxy-webhook
   namespace: tekton-pipelines
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   ports:
     - name: https-webhook
diff --git a/config/base/300-operator_v1alpha1_chain_crd.yaml b/config/base/300-operator_v1alpha1_chain_crd.yaml
index 6308212d6..9167b4599 100644
--- a/config/base/300-operator_v1alpha1_chain_crd.yaml
+++ b/config/base/300-operator_v1alpha1_chain_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonchains.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/300-operator_v1alpha1_config_crd.yaml b/config/base/300-operator_v1alpha1_config_crd.yaml
index a9388e59a..6922fce0d 100644
--- a/config/base/300-operator_v1alpha1_config_crd.yaml
+++ b/config/base/300-operator_v1alpha1_config_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonconfigs.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/300-operator_v1alpha1_hub_crd.yaml b/config/base/300-operator_v1alpha1_hub_crd.yaml
index 7729ba8b3..5a7d06056 100644
--- a/config/base/300-operator_v1alpha1_hub_crd.yaml
+++ b/config/base/300-operator_v1alpha1_hub_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonhubs.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/300-operator_v1alpha1_installer_set_crd.yaml b/config/base/300-operator_v1alpha1_installer_set_crd.yaml
index e7d9fd8a6..3cccdf5ef 100644
--- a/config/base/300-operator_v1alpha1_installer_set_crd.yaml
+++ b/config/base/300-operator_v1alpha1_installer_set_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektoninstallersets.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/300-operator_v1alpha1_pipeline_crd.yaml b/config/base/300-operator_v1alpha1_pipeline_crd.yaml
index e696ae491..2b803794b 100644
--- a/config/base/300-operator_v1alpha1_pipeline_crd.yaml
+++ b/config/base/300-operator_v1alpha1_pipeline_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonpipelines.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/300-operator_v1alpha1_trigger_crd.yaml b/config/base/300-operator_v1alpha1_trigger_crd.yaml
index 73361619e..0a4625b42 100644
--- a/config/base/300-operator_v1alpha1_trigger_crd.yaml
+++ b/config/base/300-operator_v1alpha1_trigger_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektontriggers.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/base/operator.yaml b/config/base/operator.yaml
index 4b3a47484..41d01a42d 100644
--- a/config/base/operator.yaml
+++ b/config/base/operator.yaml
@@ -17,6 +17,6 @@ kind: Deployment
 metadata:
   name: tekton-operator
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec: {}
diff --git a/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml b/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
index d93746e07..f74235d85 100644
--- a/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
+++ b/config/kubernetes/base/300-operator_v1alpha1_dashboard_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektondashboards.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml b/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
index 859a8b9e6..f78b8da26 100644
--- a/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
+++ b/config/kubernetes/base/300-operator_v1alpha1_result_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonresults.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/kubernetes/base/operator.yaml b/config/kubernetes/base/operator.yaml
index 42ffd95db..a3597cecf 100644
--- a/config/kubernetes/base/operator.yaml
+++ b/config/kubernetes/base/operator.yaml
@@ -50,7 +50,7 @@ spec:
         - name: METRICS_DOMAIN
           value: tekton.dev/operator
         - name: VERSION
-          value: "devel"
+          value: v0.55.1
         - name: CONFIG_OBSERVABILITY_NAME
           value: tekton-config-observability
         - name: AUTOINSTALL_COMPONENTS
diff --git a/config/kubernetes/base/operator_service.yaml b/config/kubernetes/base/operator_service.yaml
index 95db74b11..548eddb22 100644
--- a/config/kubernetes/base/operator_service.yaml
+++ b/config/kubernetes/base/operator_service.yaml
@@ -16,7 +16,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    version: "devel"
+    version: v0.55.1
     app: tekton-pipelines-controller
   name: tekton-operator
 spec:
diff --git a/config/kubernetes/base/webhook.yaml b/config/kubernetes/base/webhook.yaml
index 915ede0a6..9feba86f6 100644
--- a/config/kubernetes/base/webhook.yaml
+++ b/config/kubernetes/base/webhook.yaml
@@ -17,8 +17,8 @@ kind: Deployment
 metadata:
   name: tekton-operator-webhook
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   replicas: 1
   selector:
diff --git a/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml b/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
index 9309979be..d0a885f1a 100644
--- a/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
+++ b/config/openshift/base/300-operator_v1alpha1_addon_crd.yaml
@@ -17,8 +17,8 @@ kind: CustomResourceDefinition
 metadata:
   name: tektonaddons.operator.tekton.dev
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   group: operator.tekton.dev
   names:
diff --git a/config/openshift/base/operator.yaml b/config/openshift/base/operator.yaml
index 8964fbc9e..725473799 100644
--- a/config/openshift/base/operator.yaml
+++ b/config/openshift/base/operator.yaml
@@ -51,7 +51,7 @@ spec:
         - name: METRICS_DOMAIN
           value: tekton.dev/operator
         - name: VERSION
-          value: "devel"
+          value: v0.55.1
         - name: AUTOINSTALL_COMPONENTS
           valueFrom:
             configMapKeyRef:
@@ -67,11 +67,13 @@ spec:
         - name: IMAGE_HUB_TEKTON_HUB_DB
           value: registry.redhat.io/rhel8/postgresql-13@sha256:6032adb3eac903ee8aa61f296ca9aaa57f5709e5673504b609222e042823f195
         - name: IMAGE_ADDONS_PARAM_BUILDER_IMAGE
-          value: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+          value: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
         - name: IMAGE_ADDONS_PARAM_KN_IMAGE
           value: registry.redhat.io/openshift-serverless-1/client-kn-rhel8@sha256:b8b992e36f76d80b1daeed0532adf94b1ce570a6aaef1dbcc2a28c666f8cd296
+        - name: IMAGE_ADDONS_MVN_SETTINGS
+          value: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
         - name: IMAGE_ADDONS_SKOPEO_COPY
-          value: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+          value: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
         - name: IMAGE_ADDONS_GENERATE
           value: registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8@sha256:98d8cb3a255641ca6a1bce854e5e2460c20de9fb9b28e3cc67eb459f122873dd
 #          - name: IMAGE_ADDONS_TKN_CLI_SERVE
diff --git a/config/openshift/base/operator_service.yaml b/config/openshift/base/operator_service.yaml
index e265000e9..4eceeb42d 100644
--- a/config/openshift/base/operator_service.yaml
+++ b/config/openshift/base/operator_service.yaml
@@ -16,7 +16,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    version: "devel"
+    version: v0.55.1
     name: openshift-pipelines-operator
   name: tekton-operator
 spec:
diff --git a/config/openshift/base/webhook.yaml b/config/openshift/base/webhook.yaml
index f4b7a16b5..e4399d10d 100644
--- a/config/openshift/base/webhook.yaml
+++ b/config/openshift/base/webhook.yaml
@@ -17,8 +17,8 @@ kind: Deployment
 metadata:
   name: tekton-operator-webhook
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec:
   replicas: 1
   selector:
diff --git a/config/webhooks/webhook-service.yaml b/config/webhooks/webhook-service.yaml
index 0e11de4aa..d700b6404 100644
--- a/config/webhooks/webhook-service.yaml
+++ b/config/webhooks/webhook-service.yaml
@@ -17,8 +17,8 @@ kind: Service
 metadata:
   name: tekton-operator-webhook
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
     name: tekton-operator-webhook
     app: tekton-operator
 spec:
diff --git a/config/webhooks/webhook.yaml b/config/webhooks/webhook.yaml
index a08e1bcec..36aec1a26 100644
--- a/config/webhooks/webhook.yaml
+++ b/config/webhooks/webhook.yaml
@@ -17,6 +17,6 @@ kind: Deployment
 metadata:
   name: tekton-operator-webhook
   labels:
-    version: "devel"
-    operator.tekton.dev/release: "devel"
+    version: v0.55.1
+    operator.tekton.dev/release: v0.55.1
 spec: {}
diff --git a/hack/openshift/update-image-sha.sh b/hack/openshift/update-image-sha.sh
index b10289bc9..665aeb34c 100755
--- a/hack/openshift/update-image-sha.sh
+++ b/hack/openshift/update-image-sha.sh
@@ -48,6 +48,7 @@ declare -A IMAGES=(
   ["kn"]="registry.redhat.io/openshift-serverless-1/client-kn-rhel8"
   ["skopeo-copy"]="registry.redhat.io/rhel8/skopeo"
   ["s2i"]="registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8"
+  ["ubi-minimal"]="registry.redhat.io/ubi8/ubi-minimal"
 )
 
 find_latest_versions() {
diff --git a/hack/release-common.sh b/hack/release-common.sh
new file mode 100644
index 000000000..72a1d974f
--- /dev/null
+++ b/hack/release-common.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -u
+
+function set_version_label() {
+  local operator_version="v${1}"
+
+  shift
+  local operator_platforms=${*:-"kubernetes openshift"}
+
+  echo ${operator_platforms}
+  printf "%-20s: %s\n" "Platforms" "${operator_platforms}"
+  printf "%-20s: %s\n" "Operator version" "${operator_version}"
+  echo '---------------------'
+  for platform in ${operator_platforms}; do
+    echo updating version labels for platform: ${platform}, version: ${operator_version}
+    sed -i -e 's/\(operator.tekton.dev\/release\): "devel"/\1: '${operator_version}'/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: '${operator_version}'/g' -e 's/\(version\): "devel"/\1: '${operator_version}'/g' -e 's/\("-version"\), "devel"/\1, '${operator_version}'/g' config/base/*.yaml
+    sed -i -e 's/\(operator.tekton.dev\/release\): "devel"/\1: '${operator_version}'/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: '${operator_version}'/g' -e 's/\(version\): "devel"/\1: '${operator_version}'/g' -e 's/\("-version"\), "devel"/\1, '${operator_version}'/g' config/webhooks/*.yaml
+    sed -i -e 's/\(operator.tekton.dev\/release\): "devel"/\1: '${operator_version}'/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: '${operator_version}'/g' -e 's/\(version\): "devel"/\1: '${operator_version}'/g' -e 's/\("-version"\), "devel"/\1, '${operator_version}'/g' config/${platform}/base/*.yaml
+    sed -i -e 's/\(operator.tekton.dev\/release\): "devel"/\1: '${operator_version}'/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: '${operator_version}'/g' -e 's/\(version\): "devel"/\1: '${operator_version}'/g' -e 's/\("-version"\), "devel"/\1, '${operator_version}'/g' config/${platform}/overlays/default/*.yaml
+    sed -i -e 's/\(operator.tekton.dev\/release\): "devel"/\1: '${operator_version}'/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: '${operator_version}'/g' -e 's/\(version\): "devel"/\1: '${operator_version}'/g' -e 's/\("-version"\), "devel"/\1, '${operator_version}'/g' cmd/${platform}/operator/kodata/webhook/*.yaml
+    sed -i 's/\(value\): "devel"/\1: '${operator_version}'/g' config/${platform}/base/operator.yaml
+  done
+}
diff --git a/hack/release-setup-branch.sh b/hack/release-setup-branch.sh
new file mode 100755
index 000000000..90172c2a1
--- /dev/null
+++ b/hack/release-setup-branch.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -u
+
+source ./hack/release-common.sh
+
+OPERATOR_RELEASE_VERSION=${1}
+set_version_label ${OPERATOR_RELEASE_VERSION}
diff --git a/operatorhub/openshift/config.yaml b/operatorhub/openshift/config.yaml
index 4d23c5c93..5e59ba7f2 100644
--- a/operatorhub/openshift/config.yaml
+++ b/operatorhub/openshift/config.yaml
@@ -56,6 +56,13 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_PIPELINES_ARG__KUBECONFIG_WRITER_IMAGE
+- image: registry.redhat.io/openshift-pipelines/pipelines-workingdirinit-rhel8@
+  replaceLocations:
+    envTargets:
+      - deploymentName: openshift-pipelines-operator
+        containerName: openshift-pipelines-operator
+        envKeys:
+          - IMAGE_PIPELINES_ARG__WORKINGDIRINIT_IMAGE
 - image: registry.redhat.io/openshift-pipelines/pipelines-pullrequest-init-rhel8@
   replaceLocations:
     envTargets:
@@ -112,14 +119,14 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_PARAM_KN_IMAGE
-- image: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+- image: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
   replaceLocations:
     envTargets:
     - deploymentName: openshift-pipelines-operator
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_SKOPEO_COPY
-- image: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+- image: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
   replaceLocations:
     envTargets:
     - deploymentName: openshift-pipelines-operator
@@ -133,6 +140,14 @@ image-substitutions:
       containerName: openshift-pipelines-operator
       envKeys:
       - IMAGE_ADDONS_GENERATE
+
+- image: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
+  replaceLocations:
+    envTargets:
+      - deploymentName: openshift-pipelines-operator
+        containerName: openshift-pipelines-operator
+        envKeys:
+          - IMAGE_ADDONS_MVN_SETTINGS
 - image: registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel8@
   replaceLocations:
     envTargets:
@@ -199,13 +214,15 @@ image-substitutions:
 # add thrid party images which are not replaced by operator
 # but pulled directly by tasks here
 defaultRelatedImages:
-- image: registry.redhat.io/rhel8/buildah@sha256:31f84b19a0774be7cfad751be38fc97f5e86cefd26e0abaec8047ddc650b00bf
+- image: registry.redhat.io/rhel8/buildah@sha256:23fb7971ea6ac4aaaaa1139473a602df0df19222a3b5a76b551b2b9ddd92e927
   name: IMAGE_ADDONS_PARAM_BUILDER_IMAGE
 - image: registry.redhat.io/openshift-serverless-1/client-kn-rhel8@sha256:b8b992e36f76d80b1daeed0532adf94b1ce570a6aaef1dbcc2a28c666f8cd296
   name: IMAGE_ADDONS_PARAM_KN_IMAGE
-- image: registry.redhat.io/rhel8/skopeo@sha256:a458abaee565344e8c31468bb5bec26bdc622c559678ab73b07ee4998de68bd0
+- image: registry.redhat.io/rhel8/skopeo@sha256:cc58da50c3842f5f2a4ba8781b60f6052919a5555a000cb4eb18a0bd0241b2b3
   name: IMAGE_ADDONS_SKOPEO_COPY
 - image: registry.redhat.io/ocp-tools-4-tech-preview/source-to-image-rhel8@sha256:98d8cb3a255641ca6a1bce854e5e2460c20de9fb9b28e3cc67eb459f122873dd
   name: IMAGE_ADDONS_GENERATE
+- image: registry.redhat.io/ubi8/ubi-minimal@sha256:574f201d7ed185a9932c91cef5d397f5298dff9df08bc2ebb266c6d1e6284cd1
+  name: IMAGE_ADDONS_MVN_SETTINGS
 #- image: "" ##<imagename>:<tag> or <imagename>@<sha>
 #  name: "" # ENV key name value
diff --git a/operatorhub/openshift/manifests/bases/openshift-pipelines-operator-rh.clusterserviceversion.template.yaml b/operatorhub/openshift/manifests/bases/openshift-pipelines-operator-rh.clusterserviceversion.template.yaml
index 506e1d2ed..92ceaebf9 100644
--- a/operatorhub/openshift/manifests/bases/openshift-pipelines-operator-rh.clusterserviceversion.template.yaml
+++ b/operatorhub/openshift/manifests/bases/openshift-pipelines-operator-rh.clusterserviceversion.template.yaml
@@ -199,7 +199,7 @@ spec:
     - Pipelines as Code (tech-preview): v0.5.3
 
     ## Getting Started
-    In order to get familiar with _OpenShift Pipelines_ concepts and create your first pipeline, follow the [OpenShift Pipelines Docs](https://docs.openshift.com/container-platform/latest/pipelines/creating-applications-with-cicd-pipelines.html).
+    In order to get familiar with _OpenShift Pipelines_ concepts and create your first pipeline, follow the [OpenShift Pipelines Docs](https://docs.openshift.com/container-platform/OPENSHIFT_DOCS_VERSION/cicd/pipelines/creating-applications-with-cicd-pipelines.html).
 
     ## CLI (tkn)
     Tekton Pipelines cli project provides a CLI (tkn) for interacting with OpenShift Pipelines.
diff --git a/pkg/reconciler/openshift/common/transformer.go b/pkg/reconciler/openshift/common/transformer.go
index c975b5a52..eca614eee 100644
--- a/pkg/reconciler/openshift/common/transformer.go
+++ b/pkg/reconciler/openshift/common/transformer.go
@@ -84,3 +84,34 @@ func RemoveRunAsGroup() mf.Transformer {
 		return nil
 	}
 }
+
+// RemoveFsGroup will remove FsGroup in a deployment
+func RemoveFsGroup(obj string) mf.Transformer {
+	return func(u *unstructured.Unstructured) error {
+		if u.GetKind() != "Deployment" {
+			return nil
+		}
+
+		d := &appsv1.Deployment{}
+		err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, d)
+		if err != nil {
+			return err
+		}
+
+		if d.Name == obj {
+			if d.Spec.Template.Spec.SecurityContext != nil {
+				d.Spec.Template.Spec.SecurityContext = nil
+			}
+
+			unstrObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(d)
+			if err != nil {
+				return err
+			}
+			u.SetUnstructuredContent(unstrObj)
+
+			return nil
+		}
+
+		return nil
+	}
+}
diff --git a/pkg/reconciler/openshift/tektonhub/extension.go b/pkg/reconciler/openshift/tektonhub/extension.go
index 8eddeea06..9c4e157c0 100644
--- a/pkg/reconciler/openshift/tektonhub/extension.go
+++ b/pkg/reconciler/openshift/tektonhub/extension.go
@@ -31,6 +31,7 @@ import (
 	"github.com/tektoncd/operator/pkg/client/clientset/versioned"
 	operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
 	"github.com/tektoncd/operator/pkg/reconciler/common"
+	openshiftCommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 	"go.uber.org/zap"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -88,7 +89,7 @@ type openshiftExtension struct {
 }
 
 func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
-	return []mf.Transformer{UpdateDbDeployment()}
+	return []mf.Transformer{UpdateDbDeployment(), openshiftCommon.RemoveFsGroup(api)}
 }
 
 func (oe openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.TektonComponent) error {
diff --git a/pkg/reconciler/shared/tektonconfig/instance.go b/pkg/reconciler/shared/tektonconfig/instance.go
index 2d97d1b73..52e3d8ed7 100644
--- a/pkg/reconciler/shared/tektonconfig/instance.go
+++ b/pkg/reconciler/shared/tektonconfig/instance.go
@@ -84,7 +84,7 @@ func (tc tektonConfig) ensureInstance(ctx context.Context) {
 		err = tc.createInstance(ctx)
 		if err != nil {
 			//log error and retry
-			logger.Errorf("error creating Tektonconfig instance, Name: ", instance.GetName())
+			logger.Errorf("error creating Tektonconfig instance, Name: %s, Err: %v", instance.GetName(), err)
 			return false, nil
 		}
 		// even if there is no error after create,


Test patch:
diff --git a/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml
new file mode 100644
index 000000000..a220b5bc5
--- /dev/null
+++ b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group-expected.yaml
@@ -0,0 +1,51 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      volumes:
+      - name: catalog-source
+        persistentVolumeClaim:
+          claimName: tekton-hub-api
+      - name: ssh-creds
+        secret:
+          secretName: tekton-hub-api-ssh-crds
+          optional: true
+      securityContext:
+        fsGroup: 101
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+          - name: catalog-source
+            mountPath: "/tmp/catalog"
+          - name: ssh-creds
+            mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
diff --git a/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml
new file mode 100644
index 000000000..480f29d19
--- /dev/null
+++ b/pkg/reconciler/openshift/common/testdata/test-remove-fs-group.yaml
@@ -0,0 +1,49 @@
+# Copyright © 2022 The Tekton Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tekton-hub-api
+  labels:
+    app: tekton-hub-api
+spec:
+  selector:
+    matchLabels:
+      app: tekton-hub-api
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: tekton-hub-api
+    spec:
+      volumes:
+      - name: catalog-source
+        persistentVolumeClaim:
+          claimName: tekton-hub-api
+      - name: ssh-creds
+        secret:
+          secretName: tekton-hub-api-ssh-crds
+          optional: true
+      containers:
+        - name: tekton-hub-api
+          image: quay.io/tekton-hub/api
+          volumeMounts:
+          - name: catalog-source
+            mountPath: "/tmp/catalog"
+          - name: ssh-creds
+            mountPath: "/home/hub/.ssh"
+          ports:
+            - containerPort: 8000
+            - containerPort: 4200
diff --git a/pkg/reconciler/openshift/common/transformer_test.go b/pkg/reconciler/openshift/common/transformer_test.go
index 6abc4cd6d..f0c46fe28 100644
--- a/pkg/reconciler/openshift/common/transformer_test.go
+++ b/pkg/reconciler/openshift/common/transformer_test.go
@@ -118,3 +118,32 @@ func TestUpdateDeploymentsInterceptor(t *testing.T) {
 		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
 	}
 }
+
+func TestRemoveFsGroup(t *testing.T) {
+	testData := path.Join("testdata", "test-remove-fs-group.yaml")
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	testData = path.Join("testdata", "test-remove-fs-group-expected.yaml")
+	expectedManifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assert.NilError(t, err)
+
+	newManifest, err := expectedManifest.Transform(RemoveFsGroup("tekton-hub-api"))
+	assert.NilError(t, err)
+
+	got := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(newManifest.Resources()[0].Object, got)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	expected := &appsv1.Deployment{}
+	err = runtime.DefaultUnstructuredConverter.FromUnstructured(manifest.Resources()[0].Object, expected)
+	if err != nil {
+		t.Errorf("failed to load deployment yaml")
+	}
+
+	if d := cmp.Diff(expected, got); d != "" {
+		t.Errorf("failed to update deployment %s", diff.PrintWantGot(d))
+	}
+}