2026-06-29T11:32:23Z	INFO	setup	Initializing metrics certificate watcher using provided certificates	{"metrics-cert-path": "/tmp/k8s-metrics-server/metrics-certs", "metrics-cert-name": "tls.crt", "metrics-cert-key": "tls.key"}
2026-06-29T11:32:23Z	INFO	controller-runtime.certwatcher	Updated current TLS certificate	{"cert": "/tmp/k8s-metrics-server/metrics-certs/tls.crt", "key": "/tmp/k8s-metrics-server/metrics-certs/tls.key"}
2026-06-29T11:32:23Z	INFO	setup	Initializing webhook certificate watcher using provided certificates	{"webhook-cert-path": "/tmp/k8s-webhook-server/serving-certs", "webhook-cert-name": "tls.crt", "webhook-cert-key": "tls.key"}
2026-06-29T11:32:23Z	INFO	controller-runtime.certwatcher	Updated current TLS certificate	{"cert": "/tmp/k8s-webhook-server/serving-certs/tls.crt", "key": "/tmp/k8s-webhook-server/serving-certs/tls.key"}
2026-06-29T11:32:23Z	INFO	controller-runtime.webhook	Registering webhook	{"path": "/mutate-tekton-dev-v1-pipelinerun"}
2026-06-29T11:32:23Z	INFO	setup	Adding config watcher to manager
2026-06-29T11:32:23Z	INFO	setup	Adding webhook certificate watcher to manager
2026-06-29T11:32:23Z	INFO	setup	Adding metrics certificate watcher to manager
2026-06-29T11:32:23Z	INFO	setup	starting manager
2026-06-29T11:32:23Z	INFO	controller-runtime.metrics	Starting metrics server
2026-06-29T11:32:23Z	INFO	setup	disabling http/2
2026-06-29T11:32:23Z	INFO	controller-runtime.metrics	Serving metrics server	{"bindAddress": ":8443", "secure": true}
2026-06-29T11:32:23Z	INFO	starting server	{"name": "health probe", "addr": "[::]:8081"}
2026-06-29T11:32:23Z	INFO	controller-runtime.webhook	Starting webhook server
2026-06-29T11:32:23Z	INFO	setup	disabling http/2
2026-06-29T11:32:23Z	INFO	controller-runtime.webhook	Serving webhook server	{"host": "", "port": 9443}
2026-06-29T11:32:23Z	INFO	controller-runtime.certwatcher	Starting certificate poll+watcher	{"cert": "/tmp/k8s-webhook-server/serving-certs/tls.crt", "key": "/tmp/k8s-webhook-server/serving-certs/tls.key", "interval": "10s"}
2026-06-29T11:32:23Z	INFO	controller-runtime.certwatcher	Starting certificate poll+watcher	{"cert": "/tmp/k8s-metrics-server/metrics-certs/tls.crt", "key": "/tmp/k8s-metrics-server/metrics-certs/tls.key", "interval": "10s"}
2026-06-29T11:32:23Z	INFO	Starting EventSource	{"controller": "webhook-config", "controllerGroup": "", "controllerKind": "ConfigMap", "source": "kind source: *v1.ConfigMap"}
2026-06-29T11:32:23Z	INFO	Starting Controller	{"controller": "webhook-config", "controllerGroup": "", "controllerKind": "ConfigMap"}
2026-06-29T11:32:23Z	INFO	Starting workers	{"controller": "webhook-config", "controllerGroup": "", "controllerKind": "ConfigMap", "worker count": 1}
2026-06-29T11:32:23Z	INFO	Reconciling ConfigMap	{"controller": "webhook-config", "controllerGroup": "", "controllerKind": "ConfigMap", "ConfigMap": {"name":"tekton-kueue-config","namespace":"tekton-kueue"}, "namespace": "tekton-kueue", "name": "tekton-kueue-config", "reconcileID": "76211057-dd10-4786-8e70-bbfc2473e835"}
2026-06-29T11:32:23Z	INFO	config-store	Updating config	{"config": "queueName: pipelines-queue\ncel:\n  expressions:\n    # Set resource requests for multi platform pipelines\n    - |\n        has(pipelineRun.spec.params) &&\n        pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ?\n        pipelineRun.spec.params.filter(\n          p,\n          p.name == 'build-platforms')[0]\n        .value.map(\n          p,\n          resource(replace(replace(p, \"/\", \"-\"), \"_\", \"-\"), 1)\n        ) : []\n\n    # Request AWS IP for AWS-based platforms\n    - |\n        has(pipelineRun.spec.params) &&\n        pipelineRun.spec.params.exists(p, p.name == 'build-platforms') ?\n        pipelineRun.spec.params.filter(\n          p,\n          p.name == 'build-platforms')[0]\n        .value.filter(\n          p,\n          !(\n            p in [\n              'linux/ppc64le',\n              'linux/s390x',\n              'linux/x86_64',\n              'local',\n              'localhost',\n            ]\n          )\n        ).map(\n          p,\n          resource('aws-ip', 1)\n        ) : []\n\n    # Set resource requests for multi platform pipelines which doesn't use the build-platforms parameter (old style)\n    - |\n      !(\n        has(pipelineRun.spec.params) &&\n        pipelineRun.spec.params.exists(p, p.name == 'build-platforms')\n      ) &&\n      has(pipelineRun.spec.pipelineSpec) &&\n      has(pipelineRun.spec.pipelineSpec.tasks) &&\n      pipelineRun.spec.pipelineSpec.tasks.size() > 0 ?\n      pipelineRun.spec.pipelineSpec.tasks.map(\n        task,\n        has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : []\n      )\n      .filter(p, p.size() > 0)\n      .map(\n        p,\n        resource(replace(replace(p[0].value, \"/\", \"-\"), \"_\", \"-\"), 1)\n      ) : []\n\n    # Request AWS IP for AWS-based platforms which doesn't use the build-platforms parameter (old style)\n    - |\n      !(\n        has(pipelineRun.spec.params) &&\n        pipelineRun.spec.params.exists(p, p.name == 'build-platforms')\n      ) &&\n      has(pipelineRun.spec.pipelineSpec) &&\n      has(pipelineRun.spec.pipelineSpec.tasks) &&\n      pipelineRun.spec.pipelineSpec.tasks.size() > 0 ?\n      pipelineRun.spec.pipelineSpec.tasks.map(\n        task,\n        has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : []\n      )\n      .filter(p, p.size() > 0)\n      .filter(\n        p,\n        !(\n          p[0].value in [\n            'linux/ppc64le',\n            'linux/s390x',\n            'linux/x86_64',\n            'local',\n            'localhost',\n          ]\n        )\n      )\n      .map(\n        p,\n        resource('aws-ip', 1)\n      ) : []\n\n    # Set mintmaker resource requests.\n    # Necessary since mintmaker refreshes can overload clusters without a\n    # bottleneck on the number of pipelineruns running.\n    - |\n        plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : []\n\n    # Add a resource to restrict the number of concurrent release pipelineruns\n    - |\n        has(pipelineRun.metadata.labels) &&\n        'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n        'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ?\n        [resource('konflux-release', 1)] :\n\n        has(pipelineRun.metadata.labels) &&\n        'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n        'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ?\n        [resource('konflux-release', 1)] :\n\n        has(pipelineRun.metadata.labels) &&\n        'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ?\n        [resource('konflux-release', 1)] : []\n\n    # The token mechanism allows us to balance admitted PipelineRuns.\n    # Here we want to state that each PipelineRuns needs one token, but\n    # Build PipelineRuns are usually heavier, so they need 2.\n    #\n    # The total amount of PipelineRuns executing in the system at the same time\n    # will be decided by the first to saturate between `tekton.dev/pipelineruns`\n    # and `konflux-ci.dev/token`. This way we can tune the percentage of usually\n    # heavier PipelineRuns with respect to lighter ones.\n    #\n    # As an example, if both `tekton.dev/pipelineruns` and `konflux-ci.dev/token`\n    # are 600, we could have:\n    # * 300 Build PipelineRuns\n    # * 200 Build PipelineRuns + 200 Non-Build PipelineRuns\n    # * 100 Build PipelineRuns + 400 Non-Build PipelineRuns\n    # * 600 Non-Build PipelineRuns\n    - |\n        pacEventType == 'push' ||\n          pacEventType == 'pull_request' ||\n          pacEventType == \"Merge_Request\" ||\n          pacEventType == 'test-comment' ||\n          pacEventType == 'retest-comment' ||\n          pacEventType == 'retest-all-comment' ||\n          pacEventType == 'ok-to-test-comment'  ? resource('konflux-ci-dev-token', 2) :\n        resource('konflux-ci-dev-token', 1)\n\n    # Set the pipeline priority\n    - |\n        has(pipelineRun.metadata.labels) &&\n        'build.appstudio.redhat.com/type' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['build.appstudio.redhat.com/type'] == 'nudge' ?\n        priority('konflux-nudge') :\n\n        pacEventType == 'push' ? priority('konflux-post-merge-build') :\n        pacEventType == 'pull_request' ||\n          pacEventType == \"Merge_Request\" ||\n          pacEventType == 'test-comment' ||\n          pacEventType == 'retest-comment' ||\n          pacEventType == 'retest-all-comment' ||\n          pacEventType == 'ok-to-test-comment'  ? priority('konflux-pre-merge-build') :\n        pacTestEventType == 'push' ? priority('konflux-post-merge-test') :\n        pacTestEventType == 'pull_request' ||\n          pacTestEventType == \"Merge_Request\" ||\n          pacTestEventType == 'test-comment' ||\n          pacTestEventType == 'retest-comment' ||\n          pacTestEventType == 'retest-all-comment' ||\n          pacTestEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-test') :\n\n        has(pipelineRun.metadata.labels) &&\n        'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n        'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ?\n        priority('konflux-release') :\n\n        has(pipelineRun.metadata.labels) &&\n        'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n        'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels &&\n        pipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ?\n        priority('konflux-tenant-release') :\n\n        plrNamespace == 'mintmaker' ? priority('konflux-dependency-update') :\n\n        has(pipelineRun.metadata.labels) &&\n        'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ?\n        priority('konflux-release') :\n\n        priority('konflux-default')\n"}
2026-06-29T11:32:23Z	INFO	config-store	Updated config	{"config": {"queueName":"pipelines-queue","cel":{"expressions":["has(pipelineRun.spec.params) &&\npipelineRun.spec.params.exists(p, p.name == 'build-platforms') ?\npipelineRun.spec.params.filter(\n  p,\n  p.name == 'build-platforms')[0]\n.value.map(\n  p,\n  resource(replace(replace(p, \"/\", \"-\"), \"_\", \"-\"), 1)\n) : []\n","has(pipelineRun.spec.params) &&\npipelineRun.spec.params.exists(p, p.name == 'build-platforms') ?\npipelineRun.spec.params.filter(\n  p,\n  p.name == 'build-platforms')[0]\n.value.filter(\n  p,\n  !(\n    p in [\n      'linux/ppc64le',\n      'linux/s390x',\n      'linux/x86_64',\n      'local',\n      'localhost',\n    ]\n  )\n).map(\n  p,\n  resource('aws-ip', 1)\n) : []\n","!(\n  has(pipelineRun.spec.params) &&\n  pipelineRun.spec.params.exists(p, p.name == 'build-platforms')\n) &&\nhas(pipelineRun.spec.pipelineSpec) &&\nhas(pipelineRun.spec.pipelineSpec.tasks) &&\npipelineRun.spec.pipelineSpec.tasks.size() > 0 ?\npipelineRun.spec.pipelineSpec.tasks.map(\n  task,\n  has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : []\n)\n.filter(p, p.size() > 0)\n.map(\n  p,\n  resource(replace(replace(p[0].value, \"/\", \"-\"), \"_\", \"-\"), 1)\n) : []\n","!(\n  has(pipelineRun.spec.params) &&\n  pipelineRun.spec.params.exists(p, p.name == 'build-platforms')\n) &&\nhas(pipelineRun.spec.pipelineSpec) &&\nhas(pipelineRun.spec.pipelineSpec.tasks) &&\npipelineRun.spec.pipelineSpec.tasks.size() > 0 ?\npipelineRun.spec.pipelineSpec.tasks.map(\n  task,\n  has(task.params) ? task.params.filter(p, p.name == 'PLATFORM') : []\n)\n.filter(p, p.size() > 0)\n.filter(\n  p,\n  !(\n    p[0].value in [\n      'linux/ppc64le',\n      'linux/s390x',\n      'linux/x86_64',\n      'local',\n      'localhost',\n    ]\n  )\n)\n.map(\n  p,\n  resource('aws-ip', 1)\n) : []\n","plrNamespace == 'mintmaker' ? [resource('mintmaker', 1)] : []\n","has(pipelineRun.metadata.labels) &&\n'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ?\n[resource('konflux-release', 1)] :\n\nhas(pipelineRun.metadata.labels) &&\n'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ?\n[resource('konflux-release', 1)] :\n\nhas(pipelineRun.metadata.labels) &&\n'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ?\n[resource('konflux-release', 1)] : []\n","pacEventType == 'push' ||\n  pacEventType == 'pull_request' ||\n  pacEventType == \"Merge_Request\" ||\n  pacEventType == 'test-comment' ||\n  pacEventType == 'retest-comment' ||\n  pacEventType == 'retest-all-comment' ||\n  pacEventType == 'ok-to-test-comment'  ? resource('konflux-ci-dev-token', 2) :\nresource('konflux-ci-dev-token', 1)\n","has(pipelineRun.metadata.labels) &&\n'build.appstudio.redhat.com/type' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['build.appstudio.redhat.com/type'] == 'nudge' ?\npriority('konflux-nudge') :\n\npacEventType == 'push' ? priority('konflux-post-merge-build') :\npacEventType == 'pull_request' ||\n  pacEventType == \"Merge_Request\" ||\n  pacEventType == 'test-comment' ||\n  pacEventType == 'retest-comment' ||\n  pacEventType == 'retest-all-comment' ||\n  pacEventType == 'ok-to-test-comment'  ? priority('konflux-pre-merge-build') :\npacTestEventType == 'push' ? priority('konflux-post-merge-test') :\npacTestEventType == 'pull_request' ||\n  pacTestEventType == \"Merge_Request\" ||\n  pacTestEventType == 'test-comment' ||\n  pacTestEventType == 'retest-comment' ||\n  pacTestEventType == 'retest-all-comment' ||\n  pacTestEventType == 'ok-to-test-comment' ? priority('konflux-pre-merge-test') :\n\nhas(pipelineRun.metadata.labels) &&\n'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n'pipelines.appstudio.openshift.io/type' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['pipelines.appstudio.openshift.io/type'] == 'managed' ?\npriority('konflux-release') :\n\nhas(pipelineRun.metadata.labels) &&\n'appstudio.openshift.io/service' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['appstudio.openshift.io/service'] == 'release' &&\n'release.appstudio.openshift.io/namespace' in pipelineRun.metadata.labels &&\npipelineRun.metadata.labels['release.appstudio.openshift.io/namespace'] == plrNamespace ?\npriority('konflux-tenant-release') :\n\nplrNamespace == 'mintmaker' ? priority('konflux-dependency-update') :\n\nhas(pipelineRun.metadata.labels) &&\n'internal-services.appstudio.openshift.io/pipelinerun-uid' in pipelineRun.metadata.labels ?\npriority('konflux-release') :\n\npriority('konflux-default')\n"]}}}