feat: Add NetworkPolicy support for chains

[ngelman1]

Changes

Implements NetworkPolicy resources to restrict network access for the Tekton Chains controller.
Adds a spec.networkPolicy field to TektonChainSpec (propagated from TektonConfig) and a new pkg/reconciler/kubernetes/tektonchain/networkpolicies.go
that reconciles default-deny + allow policies in the operand namespace.
Default policies for the Chains controller pod:

• Ingress: Prometheus metrics scraping on port 9090
• Egress: DNS resolution via platform resolver + unrestricted egress (API server, OCI registries, Sigstore, KMS providers, storage backends)
  Both platforms (Kubernetes and OpenShift) are supported via the existing networkpolicy.PlatformParams helper. Updates generated CRDs/Helm chart output and docs/NetworkPolicy.md.
  Ref: SRVKP-12056

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

Add NetworkPolicy support for the Chains controller. Default policies allow Prometheus metrics ingress on port 9090 and unrestricted egress, to reach the API server, OCI registries, Sigstore services, KMS providers, and various storage backends depending on configuration.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign savitaashture after the PR has been reviewed.
You can assign the PR to them by writing /assign @savitaashture in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.36%. Comparing base (89d6463) to head (c741785).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3776      +/-   ##
==========================================
- Coverage   25.40%   25.36%   -0.05%     
==========================================
  Files         449      450       +1     
  Lines       23477    23534      +57     
==========================================
+ Hits         5964     5969       +5     
- Misses      16822    16873      +51     
- Partials      691      692       +1     

Flag	Coverage Δ
unit-tests	25.36% <ø> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkhelil]

@ngelman1 have you verified this once on openshift ?

[jkhelil]

Can you add e2e for chains network policies please (similar to triggers, etc)

[ngelman1]

I added test simialr to triggers with a small difference:

1. setup is using TektonConfig instead of chain + pipeline, because creating CRs dierclty caused pre-reconciliation failures.
2. update of the NP is done through config and not directly through chain cause when I tried the latter chain was immediatly reverted by the tektonConfig reconciler

Also- I named the file 03_tektonchain_networkpolicy_test.go cause I saw this is how the triggers test is named. let me know if I need to change the number

[ngelman1]

@jkhelil was triggers e2e test was tested on openshift? I tested on ROSA and kept getting tektonconfig.operator.tekton.dev "config" not found when I tried creating standalone CRs withou TektonConfig like in here https://github.com/tektoncd/operator/blob/main/test/e2e/common/03_tektontrigger_networkpolicy_test.go#L61

[jkhelil]

@ngelman1 e2e are running on kind, you need to add the test, and do manual testing on openshift as complementary test