[RHDEVDOCS-6753_new] Add TektonConfig RN configuration to base

install_config/customizing-configurations-in-the-tektonconfig-cr.adoc

@@ -14,9 +14,16 @@ In {pipelines-title}, you can customize the following configurations by using th
 * Changing the default service account
 * Disabling the service monitor
 * Configuring pipeline resolvers
+* Configuring pipeline resolver timeouts
+* Configuring resolver caching
 * Disabling pipeline templates
 * Disabling the integration of {tekton-hub}
 * Disabling the automatic creation of RBAC resources
+* Customizing {tekton-results} deployments
+* Configuring fine-grained retention policies for {tekton-results}
+* Generating cosign key pairs for {tekton-chains}
+* Configuring automatic cancellation for {pac}
+* Configuring the central TLS profile for {pipelines-shortname} components
 * Pruning of task runs and pipeline runs
 
 include::modules/op-performance-tuning-using-tektonconfig-cr.adoc[leveloffset=+1]
@@ -37,6 +44,10 @@ include::modules/op-disabling-the-service-monitor.adoc[leveloffset=+1]
 
 include::modules/op-configuring-pipeline-resolvers.adoc[leveloffset=+1]
 
+include::modules/op-configuring-pipeline-resolver-timeouts.adoc[leveloffset=+1]
+
+include::modules/op-configuring-resolver-caching.adoc[leveloffset=+1]
+
 include::modules/op-disabling-pipeline-templates.adoc[leveloffset=+1]
 
 include::modules/op-disabling-pipeline-triggers.adoc[leveloffset=+1]
@@ -57,6 +68,16 @@ include::modules/op-disabling-inline-spec.adoc[leveloffset=+1]
 
 include::modules/op-configuration-rbac-trusted-ca-flags.adoc[leveloffset=+1]
 
+include::modules/op-customizing-tekton-results-deployments.adoc[leveloffset=+1]
+
+include::modules/op-configuring-tekton-results-retention-policies.adoc[leveloffset=+1]
+
+include::modules/op-generating-cosign-key-pairs.adoc[leveloffset=+1]
+
+include::modules/op-configuring-pac-cancel-in-progress.adoc[leveloffset=+1]
+
+include::modules/op-configuring-central-tls.adoc[leveloffset=+1]
+
 include::modules/op-automatic-pruning-taskrun-pipelinerun.adoc[leveloffset=+1]
 
 include::modules/op-default-pruner-configuration.adoc[leveloffset=+2]

modules/op-configuring-central-tls.adoc

@@ -0,0 +1,55 @@
+// Module included in the following assemblies:
+//
+// * install_config/customizing-configurations-in-the-tektonconfig-cr.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="op-configuring-central-tls_{context}"]
+= Configuring the central TLS profile for {pipelines-shortname} components
+
+[role="_abstract"]
+By default, {pipelines-shortname} inherits the cluster APIServer TLS security profile, including the minimum TLS version and cipher suites. You can opt out of this behavior by setting `enableCentralTLSConfig` to `false` in the `TektonConfig` custom resource.
+
+The central TLS configuration applies to all TLS-enabled {pipelines-shortname} services: Operator webhooks, the Pipelines webhook, the Triggers webhook and core interceptors, the {pac} webhook, the Manual Approval Gate webhook, and the console plugin server. Changes to the cluster TLS profile are propagated automatically without restarting the Operator.
+
+.Prerequisites
+
+* You have access to an {OCP} cluster with cluster administrator permissions.
+* You have installed the {pipelines-title} Operator.
+
+.Procedure
+
+. Edit the `TektonConfig` custom resource:
++
+[source,terminal]
+----
+$ oc edit tektonconfig config
+----
+
+. Set `enableCentralTLSConfig` to `false` to opt out of inheriting the cluster TLS profile:
++
+[source,yaml]
+----
+apiVersion: operator.tekton.dev/v1alpha1
+kind: TektonConfig
+metadata:
+  name: config
+spec:
+  enableCentralTLSConfig: false
+# ...
+----
+
+. Save the changes and exit the editor.
+
+.Verification
+
+. Verify the updated `TektonConfig` value:
++
+[source,terminal]
+----
+$ oc get tektonconfig config -o jsonpath='{.spec.enableCentralTLSConfig}'
+----
+
+[NOTE]
+====
+When `enableCentralTLSConfig` is set to `true` (the default), any change to the cluster APIServer TLS profile is automatically applied to all {pipelines-shortname} components on the next Operator reconcile. You do not need to restart the Operator for the changes to take effect.
+====

modules/op-configuring-pac-cancel-in-progress.adoc

@@ -0,0 +1,90 @@
+// Module included in the following assemblies:
+//
+// * install_config/customizing-configurations-in-the-tektonconfig-cr.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="op-configuring-pac-cancel-in-progress_{context}"]
+= Configuring automatic cancellation for Pipelines as Code
+
+[role="_abstract"]
+You can configure {pac} to automatically cancel in-progress pipeline runs when new commits are pushed to a pull request or branch. This helps conserve resources and ensures that only the most recent code changes are being tested.
+
+.Prerequisites
+
+* You have access to an {OCP} cluster with cluster administrator permissions.
+* You have installed the {pipelines-title} Operator.
+* {pac} is enabled in your {pipelines-shortname} installation.
+
+.Procedure
+
+. In your `TektonConfig` custom resource, configure cancel-in-progress settings in the `spec.platforms.openshift.pipelinesAsCode.settings` section:
++
+[source,yaml]
+----
+apiVersion: operator.tekton.dev/v1alpha1
+kind: TektonConfig
+metadata:
+  name: config
+spec:
+  platforms:
+    openshift:
+      pipelinesAsCode:
+        enable: true
+        settings:
+          enable-cancel-in-progress-on-pull-requests: "true"
+          enable-cancel-in-progress-on-push: "true"
+# ...
+----
++
+where:
++
+`enable-cancel-in-progress-on-pull-requests`:: Specifies whether to automatically cancel in-progress pipeline runs when new commits are pushed to a pull request. Set to `true` to enable automatic cancellation. The default value is `false`.
+`enable-cancel-in-progress-on-push`:: Specifies whether to automatically cancel in-progress pipeline runs when new commits are pushed to a branch. Set to `true` to enable automatic cancellation. The default value is `false`.
+
+. Save the changes and exit the editor.
+
+.Verification
+
+. Verify that the {pac} configuration is updated:
++
+[source,terminal]
+----
+$ oc get configmap pipelines-as-code -n openshift-pipelines -o yaml
+----
++
+[source,yaml]
+----
+apiVersion: v1
+data:
+  enable-cancel-in-progress-on-pull-requests: "true"
+  enable-cancel-in-progress-on-push: "true"
+kind: ConfigMap
+# ...
+----
+
+. Test the configuration by pushing multiple commits to a pull request or branch:
+.. Create a pull request or push to a branch that triggers a pipeline run.
+.. Before the pipeline run completes, push another commit to the same pull request or branch.
+.. Verify that the first pipeline run is automatically canceled:
++
+[source,terminal]
+----
+$ oc get pipelinerun -n <namespace> --sort-by=.metadata.creationTimestamp
+----
++
+[source,terminal]
+----
+NAME                STATUS      AGE
+pipeline-run-abc    Cancelled   5m
+pipeline-run-xyz    Running     1m
+----
+
+[IMPORTANT]
+====
+Individual `PipelineRun` resources can override these global settings by using the `pipelinesascode.tekton.dev/cancel-in-progress` annotation. If this annotation is present on a `PipelineRun`, it takes precedence over the global `TektonConfig` settings.
+====
+
+[NOTE]
+====
+When cancel-in-progress is enabled, older pipeline runs are canceled as soon as a new commit triggers a new pipeline run. This helps prevent wasting resources on testing outdated code but means that you might not have complete test results for every commit in a pull request.
+====

modules/op-configuring-pipeline-resolver-timeouts.adoc

@@ -0,0 +1,79 @@
+// Module included in the following assemblies:
+//
+// * install_config/customizing-configurations-in-the-tektonconfig-cr.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="op-configuring-pipeline-resolver-timeouts_{context}"]
+= Configuring pipeline resolver timeouts
+
+[role="_abstract"]
+You can configure resolution timeout settings for pipeline resolvers to gain greater flexibility and control when running a pipeline. This enables you to set a global maximum timeout for resolution requests and configure resolver-specific timeouts.
+
+.Prerequisites
+
+* You have access to an {OCP} cluster with cluster administrator permissions.
+* You have installed the {pipelines-shortname} Operator.
+
+.Procedure
+
+. In your `TektonConfig` custom resource, add or update the timeout settings in the `spec.pipeline.options.configMaps` section:
++
+[source,yaml]
+----
+apiVersion: operator.tekton.dev/v1alpha1
+kind: TektonConfig
+metadata:
+  name: config
+spec:
+  pipeline:
+    options:
+      configMaps:
+        config-defaults:
+          data:
+            default-maximum-resolution-timeout: 5m
+        bundleresolver-config:
+          data:
+            fetch-timeout: 1m
+# ...
+----
++
+where:
++
+`default-maximum-resolution-timeout`:: Specifies the global maximum timeout for resolution requests. The default value is `1m`.
+`fetch-timeout`:: Specifies the timeout for bundle resolution requests.
+
+. Save the changes and exit the editor.
+
+.Verification
+
+. Verify that the timeout settings are applied:
++
+[source,terminal]
+----
+$ oc get configmap config-defaults -n openshift-pipelines -o yaml
+----
++
+[source,terminal]
+----
+apiVersion: v1
+data:
+  default-maximum-resolution-timeout: 5m
+kind: ConfigMap
+# ...
+----
+
+. Verify the bundle resolver configuration:
++
+[source,terminal]
+----
+$ oc get configmap bundleresolver-config -n openshift-pipelines -o yaml
+----
++
+[source,terminal]
+----
+apiVersion: v1
+data:
+  fetch-timeout: 1m
+kind: ConfigMap
+# ...
+----

modules/op-configuring-pipeline-resolvers.adoc

@@ -39,7 +39,7 @@ metadata:
   name: config
 spec:
   pipeline:
-    bundles-resolver-config:
+    bundleresolver-config:
       default-service-account: pipelines
     cluster-resolver-config:
       default-namespace: test

modules/op-configuring-pipelines-control-plane.adoc

@@ -47,5 +47,4 @@ spec:
     enable-provenance-in-status: false
     enable-custom-tasks: true
     disable-creds-init: false
-    disable-affinity-assistant: true
 ----