feat(tekton): Day 2 - Deploy Tekton Operator and components
- Downloaded Tekton Operator v0.79.1 release manifest - Created TektonConfig CR enabling all components in innoventions namespace - Pipelines v1.13.0 with OCI bundles and custom tasks - Triggers v0.36.0 with stable API fields - Dashboard v0.69.0 with read-write access - Addon components (cluster tasks, templates) - Pruner configured (keep 100, daily at 2 AM) - Created Dashboard HTTPRoute for mission-space.local.mk-labs.cloud - Certificate via letsencrypt-prod ClusterIssuer - Routes via fastpass-gateway (Cilium Gateway API) - Backend: tekton-dashboard service port 9097 - Created ArgoCD Application manifest (wave 8) - Automated sync with prune/selfHeal - ServerSideApply for CRD compatibility - Ignore differences for operator-managed resources Directory: cluster/platform/tekton/ (functional naming) Namespace: innoventions (thematic naming) DNS: mission-space.local.mk-labs.cloud Ready for deployment to fastpass cluster.
This commit is contained in:
Hermes Agent service account
342
cluster/tekton/pipelines/README.md
Normal file
342
cluster/tekton/pipelines/README.md
Normal file
@@ -0,0 +1,342 @@
|
||||
# Tekton Pipeline Library
|
||||
|
||||
Reusable Tekton Pipelines for common workflows across the mk-labs homelab.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Pipelines orchestrate multiple Tasks into a complete workflow. They define the sequence, data flow, and conditions for task execution.
|
||||
|
||||
**Key characteristics:**
|
||||
- Compose multiple tasks into workflows
|
||||
- Define parameters passed to tasks
|
||||
- Manage workspaces shared between tasks
|
||||
- Support parallel and sequential execution
|
||||
- Can be triggered manually or via webhooks
|
||||
|
||||
---
|
||||
|
||||
## Available Pipelines
|
||||
|
||||
### container-build.yaml
|
||||
|
||||
Complete container image build workflow from Git source to Harbor registry.
|
||||
|
||||
**What it does:**
|
||||
1. Clone Git repository (git-clone task)
|
||||
2. Build container image with Kaniko (kaniko-build task)
|
||||
3. Push image to Harbor registry
|
||||
|
||||
**Parameters:**
|
||||
- `git-url` - Git repository URL
|
||||
- `git-revision` - Branch, tag, or commit (default: main)
|
||||
- `image-name` - Target image name (without tag)
|
||||
- `image-tag` - Image tag (default: latest)
|
||||
|
||||
**Workspaces:**
|
||||
- `shared-workspace` - Shared between clone and build steps
|
||||
|
||||
**Usage (manual):**
|
||||
```bash
|
||||
tkn pipeline start container-build \
|
||||
--param git-url=https://gitea.mk-labs.cloud/rblundon/my-app.git \
|
||||
--param git-revision=main \
|
||||
--param image-name=the-seas.local.mk-labs.cloud/library/my-app \
|
||||
--param image-tag=v1.0.0 \
|
||||
--workspace name=shared-workspace,volumeClaimTemplateFile=workspace-template.yaml \
|
||||
--showlog \
|
||||
--namespace innoventions
|
||||
```
|
||||
|
||||
**Usage (from another pipeline):**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: build-my-app
|
||||
taskRef:
|
||||
name: container-build
|
||||
params:
|
||||
- name: git-url
|
||||
value: $(params.repo-url)
|
||||
- name: image-tag
|
||||
value: $(params.version)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Pipeline Execution Model
|
||||
|
||||
**Sequential tasks:**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: first
|
||||
taskRef:
|
||||
name: some-task
|
||||
- name: second
|
||||
runAfter:
|
||||
- first
|
||||
taskRef:
|
||||
name: another-task
|
||||
```
|
||||
|
||||
**Parallel tasks:**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: lint
|
||||
taskRef:
|
||||
name: golangci-lint
|
||||
- name: test
|
||||
taskRef:
|
||||
name: go-test
|
||||
# Both run in parallel
|
||||
```
|
||||
|
||||
**Conditional execution:**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: deploy-to-prod
|
||||
when:
|
||||
- input: "$(params.environment)"
|
||||
operator: in
|
||||
values: ["production"]
|
||||
taskRef:
|
||||
name: deploy
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Creating New Pipelines
|
||||
|
||||
Basic pipeline structure:
|
||||
|
||||
```yaml
|
||||
apiVersion: tekton.dev/v1beta1
|
||||
kind: Pipeline
|
||||
metadata:
|
||||
name: my-pipeline
|
||||
namespace: innoventions
|
||||
spec:
|
||||
params:
|
||||
- name: my-param
|
||||
description: Parameter description
|
||||
default: default-value
|
||||
workspaces:
|
||||
- name: shared-data
|
||||
description: Workspace shared between tasks
|
||||
tasks:
|
||||
- name: step1
|
||||
taskRef:
|
||||
name: some-task
|
||||
params:
|
||||
- name: task-param
|
||||
value: $(params.my-param)
|
||||
workspaces:
|
||||
- name: output
|
||||
workspace: shared-data
|
||||
|
||||
- name: step2
|
||||
runAfter:
|
||||
- step1
|
||||
taskRef:
|
||||
name: another-task
|
||||
workspaces:
|
||||
- name: source
|
||||
workspace: shared-data
|
||||
```
|
||||
|
||||
**Best practices:**
|
||||
- Keep pipelines focused on a single workflow
|
||||
- Use meaningful task names that describe the action
|
||||
- Document parameters and expected values
|
||||
- Consider workspace size requirements
|
||||
- Test manually before setting up webhooks
|
||||
|
||||
---
|
||||
|
||||
## Workspace Management
|
||||
|
||||
Pipelines require workspace storage for sharing data between tasks.
|
||||
|
||||
**Option 1: VolumeClaimTemplate (recommended for webhooks)**
|
||||
```yaml
|
||||
workspaces:
|
||||
- name: shared-workspace
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: nfs-emporium
|
||||
```
|
||||
|
||||
**Option 2: Existing PVC (for manual runs)**
|
||||
```yaml
|
||||
workspaces:
|
||||
- name: shared-workspace
|
||||
persistentVolumeClaim:
|
||||
claimName: my-workspace-pvc
|
||||
```
|
||||
|
||||
**Option 3: EmptyDir (for ephemeral data)**
|
||||
```yaml
|
||||
workspaces:
|
||||
- name: shared-workspace
|
||||
emptyDir: {}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Monitoring Pipeline Runs
|
||||
|
||||
**List recent runs:**
|
||||
```bash
|
||||
tkn pipelinerun list -n innoventions
|
||||
```
|
||||
|
||||
**Get run details:**
|
||||
```bash
|
||||
tkn pipelinerun describe BUILD-NAME -n innoventions
|
||||
```
|
||||
|
||||
**Follow logs:**
|
||||
```bash
|
||||
tkn pipelinerun logs BUILD-NAME -f -n innoventions
|
||||
```
|
||||
|
||||
**Delete old runs:**
|
||||
```bash
|
||||
kubectl delete pipelinerun -n innoventions --field-selector=status.conditions[0].reason=Succeeded
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Pipeline Templates
|
||||
|
||||
Create parameterized templates for common patterns:
|
||||
|
||||
```yaml
|
||||
apiVersion: tekton.dev/v1beta1
|
||||
kind: Pipeline
|
||||
metadata:
|
||||
name: template-container-build
|
||||
namespace: innoventions
|
||||
labels:
|
||||
type: template
|
||||
spec:
|
||||
params:
|
||||
- name: git-url
|
||||
- name: git-revision
|
||||
default: main
|
||||
- name: harbor-project
|
||||
default: library
|
||||
- name: app-name
|
||||
- name: version
|
||||
tasks:
|
||||
- name: clone-source
|
||||
taskRef:
|
||||
name: git-clone
|
||||
params:
|
||||
- name: url
|
||||
value: $(params.git-url)
|
||||
- name: revision
|
||||
value: $(params.git-revision)
|
||||
workspaces:
|
||||
- name: output
|
||||
workspace: workspace
|
||||
|
||||
- name: build-and-push
|
||||
runAfter:
|
||||
- clone-source
|
||||
taskRef:
|
||||
name: kaniko-build
|
||||
params:
|
||||
- name: image
|
||||
value: the-seas.local.mk-labs.cloud/$(params.harbor-project)/$(params.app-name):$(params.version)
|
||||
workspaces:
|
||||
- name: source
|
||||
workspace: workspace
|
||||
|
||||
workspaces:
|
||||
- name: workspace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Integration with Triggers
|
||||
|
||||
Pipelines can be automatically triggered by webhooks via Tekton Triggers.
|
||||
|
||||
See: `cluster/tekton/triggers/` for EventListener, TriggerBinding, and TriggerTemplate configurations.
|
||||
|
||||
**Flow:**
|
||||
1. Git push to Gitea
|
||||
2. Gitea sends webhook to EventListener
|
||||
3. TriggerBinding extracts event data (repo URL, commit SHA)
|
||||
4. TriggerTemplate creates PipelineRun with extracted parameters
|
||||
5. Pipeline executes automatically
|
||||
|
||||
---
|
||||
|
||||
## Future Pipeline Ideas
|
||||
|
||||
**Multi-stage builds:**
|
||||
- Build → Test → Scan → Push
|
||||
- Conditional deployment based on test results
|
||||
|
||||
**Multi-arch builds:**
|
||||
- Build for amd64 and arm64
|
||||
- Create multi-arch manifest
|
||||
|
||||
**Monorepo support:**
|
||||
- Detect changed directories
|
||||
- Build only affected services
|
||||
|
||||
**Advanced workflows:**
|
||||
- Helm chart linting and publishing
|
||||
- Documentation generation
|
||||
- Release artifact creation
|
||||
- Changelog generation
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
**Pipeline fails to start:**
|
||||
- Check task references exist
|
||||
- Verify workspace configuration
|
||||
- Check RBAC permissions
|
||||
|
||||
**Tasks timeout:**
|
||||
- Increase timeout in pipeline spec
|
||||
- Check for stuck processes in task logs
|
||||
|
||||
**Workspace errors:**
|
||||
- Verify StorageClass exists
|
||||
- Check NFS CSI driver status
|
||||
- Ensure PVC can be created
|
||||
|
||||
**Image push fails:**
|
||||
- Verify harbor-credentials secret exists
|
||||
- Test credentials manually with docker login
|
||||
- Check Harbor project permissions
|
||||
|
||||
---
|
||||
|
||||
## References
|
||||
|
||||
**Tekton Pipeline Docs:**
|
||||
- Pipelines: https://tekton.dev/docs/pipelines/pipelines/
|
||||
- PipelineRuns: https://tekton.dev/docs/pipelines/pipelineruns/
|
||||
- Workspaces: https://tekton.dev/docs/pipelines/workspaces/
|
||||
|
||||
**Examples:**
|
||||
- Official examples: https://github.com/tektoncd/pipeline/tree/main/examples
|
||||
- Community examples: https://github.com/tektoncd/catalog
|
||||
|
||||
---
|
||||
|
||||
**Location:** cluster/tekton/pipelines/
|
||||
**Deployed to:** innoventions namespace
|
||||
**Owner:** Platform Team
|
||||
204
cluster/tekton/tasks/README.md
Normal file
204
cluster/tekton/tasks/README.md
Normal file
@@ -0,0 +1,204 @@
|
||||
# Tekton Task Library
|
||||
|
||||
Reusable Tekton Tasks for common CI/CD operations across the mk-labs homelab.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Tasks are the building blocks of Tekton Pipelines. Each task defines a series of steps that execute in sequence within a container.
|
||||
|
||||
**Key characteristics:**
|
||||
- Parameterized for flexibility
|
||||
- Work with workspaces for file I/O
|
||||
- Can be referenced by multiple pipelines
|
||||
- Deployed to `innoventions` namespace but usable across the cluster
|
||||
|
||||
---
|
||||
|
||||
## Available Tasks
|
||||
|
||||
### git-clone.yaml
|
||||
|
||||
Clone a Git repository from Gitea.
|
||||
|
||||
**Parameters:**
|
||||
- `url` - Git repository URL (e.g., https://gitea.mk-labs.cloud/rblundon/my-app.git)
|
||||
- `revision` - Branch, tag, or commit SHA (default: main)
|
||||
- `subdirectory` - Clone into subdirectory (default: "")
|
||||
|
||||
**Workspaces:**
|
||||
- `output` - Where the repository will be cloned
|
||||
|
||||
**Usage:**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: fetch-source
|
||||
taskRef:
|
||||
name: git-clone
|
||||
params:
|
||||
- name: url
|
||||
value: https://gitea.mk-labs.cloud/rblundon/my-app.git
|
||||
- name: revision
|
||||
value: main
|
||||
workspaces:
|
||||
- name: output
|
||||
workspace: shared-workspace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### kaniko-build.yaml
|
||||
|
||||
Build and push a container image using Kaniko (rootless builds).
|
||||
|
||||
**Parameters:**
|
||||
- `image` - Full image name including tag (e.g., the-seas.local.mk-labs.cloud/library/app:v1.0)
|
||||
- `context` - Build context directory relative to workspace (default: .)
|
||||
- `dockerfile` - Path to Dockerfile (default: ./Dockerfile)
|
||||
|
||||
**Workspaces:**
|
||||
- `source` - Source code containing Dockerfile
|
||||
|
||||
**Secrets Required:**
|
||||
- `harbor-credentials` - Docker config JSON for Harbor authentication
|
||||
|
||||
**Usage:**
|
||||
```yaml
|
||||
tasks:
|
||||
- name: build-image
|
||||
taskRef:
|
||||
name: kaniko-build
|
||||
params:
|
||||
- name: image
|
||||
value: the-seas.local.mk-labs.cloud/library/my-app:v1.0
|
||||
- name: dockerfile
|
||||
value: ./Dockerfile
|
||||
workspaces:
|
||||
- name: source
|
||||
workspace: shared-workspace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Testing Tasks Standalone
|
||||
|
||||
Each task can be tested independently before integrating into pipelines.
|
||||
|
||||
**Example: Test git-clone**
|
||||
|
||||
1. Create test workspace:
|
||||
```bash
|
||||
kubectl apply -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: test-workspace
|
||||
namespace: innoventions
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 500Mi
|
||||
storageClassName: nfs-emporium
|
||||
EOF
|
||||
```
|
||||
|
||||
2. Run task:
|
||||
```bash
|
||||
tkn task start git-clone \
|
||||
--param url=https://gitea.mk-labs.cloud/rblundon/homelab.git \
|
||||
--param revision=main \
|
||||
--workspace name=output,claimName=test-workspace \
|
||||
--showlog \
|
||||
--namespace innoventions
|
||||
```
|
||||
|
||||
3. Inspect result:
|
||||
```bash
|
||||
# Create debug pod
|
||||
kubectl run -it --rm debug --image=busybox --restart=Never \
|
||||
--overrides='{"spec":{"volumes":[{"name":"workspace","persistentVolumeClaim":{"claimName":"test-workspace"}}],"containers":[{"name":"debug","image":"busybox","stdin":true,"tty":true,"volumeMounts":[{"name":"workspace","mountPath":"/workspace"}]}]}}' \
|
||||
-n innoventions -- sh
|
||||
|
||||
# Inside pod:
|
||||
ls -la /workspace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Creating New Tasks
|
||||
|
||||
Follow the Tekton Task specification:
|
||||
|
||||
```yaml
|
||||
apiVersion: tekton.dev/v1beta1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: my-task
|
||||
namespace: innoventions
|
||||
spec:
|
||||
params:
|
||||
- name: my-param
|
||||
description: Parameter description
|
||||
default: default-value
|
||||
workspaces:
|
||||
- name: my-workspace
|
||||
description: Workspace description
|
||||
steps:
|
||||
- name: step-name
|
||||
image: container-image:tag
|
||||
script: |
|
||||
#!/bin/sh
|
||||
echo "Task logic here"
|
||||
echo "Param value: $(params.my-param)"
|
||||
ls $(workspaces.my-workspace.path)
|
||||
```
|
||||
|
||||
**Best practices:**
|
||||
- Pin container image versions (no `:latest`)
|
||||
- Provide parameter defaults where sensible
|
||||
- Document parameters and workspaces clearly
|
||||
- Use script blocks for complex shell logic
|
||||
- Test standalone before using in pipelines
|
||||
|
||||
---
|
||||
|
||||
## Task Catalog Reference
|
||||
|
||||
Official Tekton task catalog: https://hub.tekton.dev/
|
||||
|
||||
**Popular tasks to consider adding:**
|
||||
- `buildpacks` - Build images without Dockerfile
|
||||
- `helm-upgrade` - Deploy Helm charts
|
||||
- `trivy-scanner` - Scan images for vulnerabilities
|
||||
- `git-cli` - Advanced Git operations
|
||||
- `pytest` - Run Python tests
|
||||
|
||||
**Installation from catalog:**
|
||||
```bash
|
||||
kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/TASK-NAME/VERSION/TASK-NAME.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Version Management
|
||||
|
||||
All task image references should be pinned to specific versions.
|
||||
|
||||
**Current image versions:**
|
||||
- Git init: `gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.43.0`
|
||||
- Kaniko: `gcr.io/kaniko-project/executor:v1.24.0`
|
||||
|
||||
**Update procedure:**
|
||||
1. Check for new image releases
|
||||
2. Update task YAML with new version
|
||||
3. Test standalone
|
||||
4. Commit and deploy via ArgoCD
|
||||
|
||||
---
|
||||
|
||||
**Location:** cluster/tekton/tasks/
|
||||
**Deployed to:** innoventions namespace
|
||||
**Owner:** Platform Team
|
||||
352
cluster/tekton/triggers/README.md
Normal file
352
cluster/tekton/triggers/README.md
Normal file
@@ -0,0 +1,352 @@
|
||||
# Tekton Triggers Library
|
||||
|
||||
Webhook integration for automatic pipeline execution from Git events.
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
Tekton Triggers enable event-driven CI/CD by listening for webhooks from Git providers (Gitea, GitHub, GitLab) and automatically starting pipeline runs.
|
||||
|
||||
**Components:**
|
||||
- **EventListener** - HTTP endpoint that receives webhooks
|
||||
- **TriggerBinding** - Extracts data from webhook payload
|
||||
- **TriggerTemplate** - Creates PipelineRun from extracted data
|
||||
|
||||
**Flow:**
|
||||
```
|
||||
Git Push → Gitea Webhook → EventListener → TriggerBinding → TriggerTemplate → PipelineRun
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Available Triggers
|
||||
|
||||
### gitea-listener (EventListener)
|
||||
|
||||
HTTP service that receives webhooks from Gitea.
|
||||
|
||||
**Endpoint:** `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||
|
||||
**Supported events:**
|
||||
- Push (branch commits)
|
||||
- Tag creation (future)
|
||||
- Pull request (future)
|
||||
|
||||
**Security:**
|
||||
- Validates webhook secret from 1Password
|
||||
- Only processes push events
|
||||
- Uses Gitea interceptor for payload validation
|
||||
|
||||
---
|
||||
|
||||
### gitea-binding (TriggerBinding)
|
||||
|
||||
Extracts information from Gitea webhook payload.
|
||||
|
||||
**Extracted parameters:**
|
||||
- `git-repo-url` - Repository clone URL
|
||||
- `git-revision` - Commit SHA
|
||||
- `repo-name` - Repository name (for image naming)
|
||||
|
||||
**Gitea webhook payload structure:**
|
||||
```json
|
||||
{
|
||||
"repository": {
|
||||
"clone_url": "https://gitea.mk-labs.cloud/rblundon/my-app.git",
|
||||
"name": "my-app"
|
||||
},
|
||||
"after": "abc123def456...",
|
||||
"ref": "refs/heads/main"
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### gitea-template (TriggerTemplate)
|
||||
|
||||
Creates a PipelineRun when webhook is received.
|
||||
|
||||
**What it creates:**
|
||||
- PipelineRun with generateName (unique per trigger)
|
||||
- Parameters from TriggerBinding
|
||||
- Workspace using volumeClaimTemplate (auto-created)
|
||||
|
||||
**Image naming convention:**
|
||||
- Target: `the-seas.local.mk-labs.cloud/library/REPO-NAME`
|
||||
- Tag: Git commit SHA (enables traceability)
|
||||
|
||||
---
|
||||
|
||||
## Configuring Gitea Webhooks
|
||||
|
||||
**Per-repository setup:**
|
||||
|
||||
1. Navigate to repository in Gitea
|
||||
2. Settings → Webhooks → Add Webhook → Gitea
|
||||
3. Configure:
|
||||
- **URL:** `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||
- **HTTP Method:** POST
|
||||
- **Content Type:** application/json
|
||||
- **Secret:** (get from 1Password vault `innoventions`, field `gitea-webhook-secret`)
|
||||
- **Trigger On:** Push events
|
||||
- **Branch filter:** (leave empty for all branches, or specify like `main`)
|
||||
- **Active:** ✓ Enabled
|
||||
|
||||
4. Click "Add Webhook"
|
||||
5. Test with "Test Delivery" button
|
||||
|
||||
**Webhook URL alternatives:**
|
||||
- Inside cluster: `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||
- Via Gateway (if exposed): TBD in future phase
|
||||
|
||||
---
|
||||
|
||||
## Testing Webhook Integration
|
||||
|
||||
**1. Check EventListener is running:**
|
||||
```bash
|
||||
kubectl get pods -l eventlistener=gitea-listener -n innoventions
|
||||
kubectl get svc el-gitea-listener -n innoventions
|
||||
```
|
||||
|
||||
**2. Watch EventListener logs:**
|
||||
```bash
|
||||
kubectl logs -l eventlistener=gitea-listener -n innoventions -f
|
||||
```
|
||||
|
||||
**3. Make a test commit:**
|
||||
```bash
|
||||
cd /path/to/repo
|
||||
git commit --allow-empty -m "Test webhook trigger"
|
||||
git push origin main
|
||||
```
|
||||
|
||||
**4. Verify PipelineRun created:**
|
||||
```bash
|
||||
kubectl get pipelinerun -n innoventions -w
|
||||
```
|
||||
|
||||
**5. Check webhook delivery in Gitea:**
|
||||
- Repository → Settings → Webhooks → Click webhook
|
||||
- View "Recent Deliveries" tab
|
||||
- Should show 200 OK response
|
||||
|
||||
---
|
||||
|
||||
## Debugging Webhooks
|
||||
|
||||
**Webhook not triggering:**
|
||||
|
||||
1. **Check EventListener logs:**
|
||||
```bash
|
||||
kubectl logs -l eventlistener=gitea-listener -n innoventions --tail=100
|
||||
```
|
||||
|
||||
Look for:
|
||||
- Incoming requests
|
||||
- Secret validation failures
|
||||
- TriggerBinding errors
|
||||
|
||||
2. **Verify webhook secret:**
|
||||
```bash
|
||||
# Get secret from Kubernetes
|
||||
kubectl get secret gitea-webhook-secret -n innoventions -o jsonpath='{.data.secret}' | base64 -d
|
||||
|
||||
# Compare with 1Password vault `innoventions` field
|
||||
```
|
||||
|
||||
3. **Check Gitea webhook deliveries:**
|
||||
- Green checkmark = successful
|
||||
- Red X = failed
|
||||
- Click delivery to see request/response details
|
||||
|
||||
4. **Test EventListener directly:**
|
||||
```bash
|
||||
# From within cluster
|
||||
kubectl run -it --rm curl --image=curlimages/curl --restart=Never -- \
|
||||
curl -X POST http://el-gitea-listener.innoventions.svc.cluster.local:8080 \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "X-Gitea-Event: push" \
|
||||
-d '{"repository":{"clone_url":"https://gitea.mk-labs.cloud/rblundon/test.git","name":"test"},"after":"abc123"}'
|
||||
```
|
||||
|
||||
**PipelineRun created but fails:**
|
||||
|
||||
1. **Check PipelineRun details:**
|
||||
```bash
|
||||
kubectl describe pipelinerun -n innoventions PIPELINERUN-NAME
|
||||
```
|
||||
|
||||
2. **Check task logs:**
|
||||
```bash
|
||||
tkn pipelinerun logs PIPELINERUN-NAME -n innoventions
|
||||
```
|
||||
|
||||
3. **Common issues:**
|
||||
- Git clone fails: Check Gitea connectivity, credentials
|
||||
- Image build fails: Check Dockerfile syntax
|
||||
- Image push fails: Check Harbor credentials
|
||||
|
||||
---
|
||||
|
||||
## Customizing Triggers
|
||||
|
||||
### Add Tag Triggers
|
||||
|
||||
Create separate trigger for Git tags:
|
||||
|
||||
```yaml
|
||||
apiVersion: triggers.tekton.dev/v1beta1
|
||||
kind: EventListener
|
||||
metadata:
|
||||
name: gitea-listener
|
||||
spec:
|
||||
triggers:
|
||||
- name: gitea-push
|
||||
# ... existing push trigger
|
||||
|
||||
- name: gitea-tag
|
||||
interceptors:
|
||||
- ref:
|
||||
name: gitea
|
||||
params:
|
||||
- name: secretRef
|
||||
value:
|
||||
secretName: gitea-webhook-secret
|
||||
secretKey: secret
|
||||
- name: eventTypes
|
||||
value:
|
||||
- create # Tag creation
|
||||
bindings:
|
||||
- ref: gitea-tag-binding
|
||||
template:
|
||||
ref: gitea-tag-template
|
||||
```
|
||||
|
||||
### Filter by Branch
|
||||
|
||||
Only trigger on specific branches:
|
||||
|
||||
```yaml
|
||||
apiVersion: triggers.tekton.dev/v1beta1
|
||||
kind: EventListener
|
||||
spec:
|
||||
triggers:
|
||||
- name: gitea-main-branch
|
||||
interceptors:
|
||||
- ref:
|
||||
name: gitea
|
||||
- ref:
|
||||
name: cel
|
||||
params:
|
||||
- name: filter
|
||||
value: "body.ref == 'refs/heads/main'"
|
||||
# ... rest of config
|
||||
```
|
||||
|
||||
### Custom Image Tagging
|
||||
|
||||
Modify TriggerTemplate to use semantic versioning:
|
||||
|
||||
```yaml
|
||||
apiVersion: triggers.tekton.dev/v1beta1
|
||||
kind: TriggerTemplate
|
||||
spec:
|
||||
params:
|
||||
- name: git-revision
|
||||
- name: repo-name
|
||||
resourcetemplates:
|
||||
- apiVersion: tekton.dev/v1beta1
|
||||
kind: PipelineRun
|
||||
spec:
|
||||
params:
|
||||
- name: image-tag
|
||||
value: "$(tt.params.git-revision)-$(date +%Y%m%d-%H%M%S)"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Security Considerations
|
||||
|
||||
**Webhook secret validation:**
|
||||
- ALWAYS use webhook secrets
|
||||
- Rotate secrets periodically
|
||||
- Store in 1Password, sync via ExternalSecret
|
||||
|
||||
**Network policies:**
|
||||
- EventListener only accessible from Gitea
|
||||
- Consider adding NetworkPolicy to restrict access
|
||||
|
||||
**RBAC:**
|
||||
- EventListener ServiceAccount has minimal permissions
|
||||
- Can only create PipelineRuns in innoventions namespace
|
||||
|
||||
**Resource limits:**
|
||||
- Consider rate limiting in future (max runs per hour)
|
||||
- Set PipelineRun timeouts to prevent runaway builds
|
||||
|
||||
---
|
||||
|
||||
## Monitoring & Observability
|
||||
|
||||
**EventListener metrics:**
|
||||
```bash
|
||||
# Prometheus metrics endpoint
|
||||
kubectl port-forward svc/el-gitea-listener 8080:8080 -n innoventions
|
||||
curl http://localhost:8080/metrics
|
||||
```
|
||||
|
||||
**Key metrics:**
|
||||
- `eventlistener_triggered_total` - Total webhooks processed
|
||||
- `eventlistener_event_count` - Events by type
|
||||
- `tekton_pipelinerun_duration_seconds` - Build duration
|
||||
|
||||
**Logs aggregation:**
|
||||
- EventListener logs show webhook receipt
|
||||
- PipelineRun logs show build execution
|
||||
- Consider centralizing logs (Loki/ELK in future)
|
||||
|
||||
---
|
||||
|
||||
## Advanced Patterns
|
||||
|
||||
**Multi-pipeline triggers:**
|
||||
Trigger different pipelines based on event type:
|
||||
- Push to main → Production build
|
||||
- Push to dev → Development build
|
||||
- PR created → Test run only
|
||||
|
||||
**Conditional execution:**
|
||||
Use CEL interceptors to filter:
|
||||
- Only build if Dockerfile changed
|
||||
- Skip builds for doc-only commits
|
||||
- Build specific services in monorepo
|
||||
|
||||
**Fan-out builds:**
|
||||
One webhook triggers multiple pipelines:
|
||||
- Build multiple architectures
|
||||
- Build and deploy to multiple environments
|
||||
- Run parallel test suites
|
||||
|
||||
---
|
||||
|
||||
## References
|
||||
|
||||
**Tekton Triggers Docs:**
|
||||
- EventListeners: https://tekton.dev/docs/triggers/eventlisteners/
|
||||
- TriggerBindings: https://tekton.dev/docs/triggers/triggerbindings/
|
||||
- TriggerTemplates: https://tekton.dev/docs/triggers/triggertemplates/
|
||||
- Interceptors: https://tekton.dev/docs/triggers/interceptors/
|
||||
|
||||
**Gitea Webhook Docs:**
|
||||
- https://docs.gitea.io/en-us/webhooks/
|
||||
|
||||
**Examples:**
|
||||
- https://github.com/tektoncd/triggers/tree/main/examples
|
||||
|
||||
---
|
||||
|
||||
**Location:** cluster/tekton/triggers/
|
||||
**Deployed to:** innoventions namespace
|
||||
**Owner:** Platform Team
|
||||
Reference in New Issue
Block a user