When TektonConfig.spec.platforms.openShift.namespaceSync is configured
(which is now the default), the NamespaceSyncController owns all per-namespace
resources (pipeline SA, CA bundles, SCC RoleBinding, edit RoleBinding, secret
bindings). The legacy rbac.go createResources loop now skips per-namespace
iteration and only maintains cluster-scoped resources:

- ensurePreRequisites: RBACInstallerSet, pipelines-scc-clusterrole, SCC validation
- removeAndUpdateNSFromCI: ClusterInterceptors ClusterRoleBinding cleanup
- handleClusterRoleBinding: keep openshift-pipelines-clusterinterceptors in sync
  using existing pipeline SAs collected via the new collectExistingPipelineSAs helper

This commit can be reverted independently to restore the legacy scan-based
per-namespace reconciliation without losing the NamespaceSyncController changes.

Signed-off-by: Abdeljaouad Khelil <akhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6
Co-authored-by: Cursor <cursoragent@cursor.com>

…RoleBinding

The openshift-pipelines-clusterinterceptors ClusterRoleBinding grants the
pipeline SA in every user namespace get/list/watch access to
ClusterInterceptors, which EventListeners need to resolve webhook interceptors.

The previous implementation in rbac.go rebuilt the full subject list on every
TektonConfig reconcile (O(N) API calls). NamespaceSyncController now manages
this ClusterRoleBinding with a per-namespace patch:

- Pipeline SA created / namespace reconciled → subject is added (idempotent).
- Pipeline SA deleted → reconcile of that namespace removes the subject.
- RetryOnConflict handles concurrent updates from parallel namespace workers.
- ClusterRole is bootstrapped once; it never changes so no update path needed.

Five new tests cover: creation, no-op when SA absent, idempotency,
multi-namespace accumulation, and subject removal on SA deletion.

Signed-off-by: Abdeljaoued Khelil <abdeljaouedkhelil@example.com>
Assisted-by: Claude Sonnet 4.6
Co-authored-by: Cursor <cursoragent@cursor.com>

Now that NamespaceSyncController handles the openshift-pipelines-clusterinterceptors
ClusterRoleBinding incrementally per namespace, rbac.go no longer needs to:

- Accumulate all pipeline SAs via collectExistingPipelineSAs
- Rebuild the full subject list via handleClusterRoleBinding

The NamespaceSync guard in createResources is simplified: it now only calls
ensurePreRequisites (cluster-scoped SCC ClusterRole + validation) before
returning; all other RBAC and secret binding work is owned by the new controller.

Signed-off-by: Abdeljaoued Khelil <abdeljaouedkhelil@example.com>
Assisted-by: Claude Sonnet 4.6
Co-authored-by: Cursor <cursoragent@cursor.com>

…ped work

Now that NamespaceSyncController owns all per-namespace resources (pipeline SA,
CA bundles, SCC RoleBinding, edit RoleBinding, secret bindings, ClusterInterceptors
subjects) and NamespaceSync is always defaulted to non-nil, the legacy per-namespace
branch of rbac.go is permanently unreachable.

Removed (~1 350 lines):
  - shouldIgnoreNamespace, needsRBAC, needsCABundle, getNamespacesToBeReconciled
  - processRBAC, handleSCCInNamespace, getSCCRoleInNamespace, patchNamespaceLabel
  - ensureSA, createSA, ensureSCCRoleInNamespace
  - ensurePipelinesSCCRoleBinding, createSCCRoleBinding, updateRoleBinding
  - ensureCABundles, ensureCABundlesInNamespace, createCABundleConfigMaps
  - createServiceCABundleConfigMap, patchNamespaceTrustedConfigLabel
  - ensureRoleBindings, createRoleBinding, isLegacyRBACEnabled
  - handleClusterRoleBinding, bulkUpdateClusterRoleBinding, bulkCreateClusterRoleBinding
  - createClusterRole, removeAndUpdateNSFromCI, removeIndex
  - updateOwnerRefs, removeAndUpdate, hasSubject, CompareSubjects, mergeSubjects
  - hasOwnerRefernce, cleanUpRBACNameChange (TODO: remove after v0.55.0 - now done)
  - NamespaceServiceAccount, NamespacesToReconcile types

Kept:
  - createResources → only calls ensurePreRequisites (cluster-scoped)
  - ensurePreRequisites: InstallerSet, SCC validation, pipelines-scc-clusterrole
  - ensurePipelinesSCClusterRole: dynamic ClusterRole for default SCC
  - EnsureRBACInstallerSet, cleanUp, setDefault, removeObsoleteRBACInstallerSet

extension.go: removed rbacInformer field (no longer needed), removed
cleanUpRBACNameChange call, removed unused rbacV1 and rbacInformer imports.

rbac_test.go: replaced 500-line dead-path test with focused tests for
createResources (prerequisites path) and setDefault.

Signed-off-by: Abdeljaoued Khelil <abdeljaouedkhelil@example.com>
Assisted-by: Claude Sonnet 4.6
Co-authored-by: Cursor <cursoragent@cursor.com>

Add the namespacesync controller to the lifecycle container's
-controllers arg so it actually runs on OpenShift. Add the
namespaceSync field schema to the TektonConfig CRD so the
API server accepts it. Embed reconciler.LeaderAwareFuncs in
the Reconciler struct to satisfy Knative sharedmain's
leader-election requirement.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>

The e2e test referenced tconfig.PipelineRoleBinding from the
tektonconfig package, which no longer exists after the rbac.go
cleanup. Export the constant from namespacesync (its new owner)
and update the test import alias accordingly.

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>