feat(tekton): Day 2 - Deploy Tekton Operator and components
- Downloaded Tekton Operator v0.79.1 release manifest - Created TektonConfig CR enabling all components in innoventions namespace - Pipelines v1.13.0 with OCI bundles and custom tasks - Triggers v0.36.0 with stable API fields - Dashboard v0.69.0 with read-write access - Addon components (cluster tasks, templates) - Pruner configured (keep 100, daily at 2 AM) - Created Dashboard HTTPRoute for mission-space.local.mk-labs.cloud - Certificate via letsencrypt-prod ClusterIssuer - Routes via fastpass-gateway (Cilium Gateway API) - Backend: tekton-dashboard service port 9097 - Created ArgoCD Application manifest (wave 8) - Automated sync with prune/selfHeal - ServerSideApply for CRD compatibility - Ignore differences for operator-managed resources Directory: cluster/platform/tekton/ (functional naming) Namespace: innoventions (thematic naming) DNS: mission-space.local.mk-labs.cloud Ready for deployment to fastpass cluster.
This commit is contained in:
Hermes Agent service account
439
cluster/platform/tekton/README.md
Normal file
439
cluster/platform/tekton/README.md
Normal file
@@ -0,0 +1,439 @@
|
|||||||
|
# Innoventions - Tekton CI/CD Platform
|
||||||
|
|
||||||
|
**Service Theme:** Innoventions (EPCOT Innovation Hub)
|
||||||
|
**Dashboard DNS:** mission-space.local.mk-labs.cloud (Mission: SPACE control center)
|
||||||
|
**Namespace:** innoventions
|
||||||
|
**Wave:** 8 (after Harbor wave 7)
|
||||||
|
**Phase:** Platform Buildout Phase 2
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Tekton Pipelines provides the CI/CD brain of the mk-labs platform. It builds containers from Git repositories (Gitea) and pushes images to Harbor registry, enabling automated workflows triggered by webhooks.
|
||||||
|
|
||||||
|
**Key capabilities:**
|
||||||
|
- Container image builds from source (Kaniko)
|
||||||
|
- Automated webhook triggers from Gitea
|
||||||
|
- Reusable task library for common operations
|
||||||
|
- Web dashboard for pipeline monitoring and management
|
||||||
|
- Integration with Harbor registry for image storage
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Component Versions
|
||||||
|
|
||||||
|
**Installation Date:** June 6, 2026
|
||||||
|
**Deployed By:** Rocket Raccoon (CI/CD Specialist)
|
||||||
|
|
||||||
|
| Component | Version | Notes |
|
||||||
|
|-----------|---------|-------|
|
||||||
|
| Tekton Operator | v0.79.1 | Latest stable (May 2026) |
|
||||||
|
| Tekton Pipelines | v1.13.0 | Managed by operator |
|
||||||
|
| Tekton Triggers | v0.36.0 | Managed by operator |
|
||||||
|
| Tekton Dashboard | v0.69.0 | Managed by operator |
|
||||||
|
| Kaniko Executor | v1.24.0 | For rootless container builds |
|
||||||
|
|
||||||
|
**Version pinning policy:** All versions explicitly pinned. No `latest` tags.
|
||||||
|
|
||||||
|
**Compatibility verified:**
|
||||||
|
- Tekton Operator v0.79.1 supports Kubernetes 1.27+
|
||||||
|
- Fastpass cluster running Talos Kubernetes 1.30+
|
||||||
|
- Compatible with existing Gateway API (wave 4)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
### Installation Method: Tekton Operator
|
||||||
|
|
||||||
|
Tekton is deployed via the official Tekton Operator, not Helm charts or raw manifests.
|
||||||
|
|
||||||
|
**Rationale:**
|
||||||
|
- Official Tekton project support
|
||||||
|
- Automated component lifecycle management
|
||||||
|
- Proven upgrade path
|
||||||
|
- Single TektonConfig CR manages all components
|
||||||
|
|
||||||
|
**Pattern:**
|
||||||
|
1. ArgoCD deploys operator manifest (operator-install.yaml)
|
||||||
|
2. ArgoCD applies TektonConfig CR (tektonconfig.yaml)
|
||||||
|
3. Operator deploys and manages Pipelines, Triggers, Dashboard
|
||||||
|
|
||||||
|
### Components Enabled
|
||||||
|
|
||||||
|
Via TektonConfig `profile: all`:
|
||||||
|
|
||||||
|
- **Pipelines:** Core task/pipeline execution engine
|
||||||
|
- **Triggers:** Webhook EventListener for Git events
|
||||||
|
- **Dashboard:** Web UI for monitoring and management
|
||||||
|
- **Chains:** Disabled (planned for Phase 3 - image signing)
|
||||||
|
|
||||||
|
### Integration Points
|
||||||
|
|
||||||
|
**Harbor Container Registry:**
|
||||||
|
- URL: the-seas.local.mk-labs.cloud
|
||||||
|
- Robot account: tekton-builder
|
||||||
|
- Projects: library, platform, applications
|
||||||
|
- Credentials: ExternalSecret from 1Password
|
||||||
|
|
||||||
|
**Gitea Source Control:**
|
||||||
|
- Webhook integration via EventListener
|
||||||
|
- Clone tasks pull from Gitea repos
|
||||||
|
- Webhook secret validation
|
||||||
|
|
||||||
|
**Gateway API:**
|
||||||
|
- Dashboard exposed via HTTPRoute
|
||||||
|
- TLS certificate from cert-manager
|
||||||
|
- Hostname: mission-space.local.mk-labs.cloud
|
||||||
|
|
||||||
|
**Storage:**
|
||||||
|
- PVC-backed workspaces using nfs-emporium StorageClass
|
||||||
|
- 7-day retention for completed PipelineRuns
|
||||||
|
- Auto-cleanup to manage disk usage
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Files in This Directory
|
||||||
|
|
||||||
|
```
|
||||||
|
cluster/platform/tekton/
|
||||||
|
├── application.yaml # ArgoCD Application definition
|
||||||
|
├── tektonconfig.yaml # TektonConfig CR (what to install)
|
||||||
|
├── operator-install.yaml # Tekton Operator static manifest
|
||||||
|
├── externalsecret.yaml # Harbor credentials from 1Password
|
||||||
|
├── dashboard-httproute.yaml # Gateway API route for Dashboard
|
||||||
|
├── rbac.yaml # ServiceAccount + RBAC for pipelines
|
||||||
|
└── README.md # This file
|
||||||
|
```
|
||||||
|
|
||||||
|
### application.yaml
|
||||||
|
ArgoCD Application that:
|
||||||
|
- Deploys operator manifest (operator-install.yaml)
|
||||||
|
- Applies TektonConfig and other resources
|
||||||
|
- Sync wave 8 (after Harbor)
|
||||||
|
- Auto-sync with prune/selfHeal
|
||||||
|
|
||||||
|
### tektonconfig.yaml
|
||||||
|
CustomResource defining:
|
||||||
|
- Components to install (Pipelines, Triggers, Dashboard)
|
||||||
|
- Target namespace: innoventions
|
||||||
|
- Performance tuning (HA disabled for homelab)
|
||||||
|
- Retention policy (7 days)
|
||||||
|
|
||||||
|
### operator-install.yaml
|
||||||
|
Static YAML from: https://github.com/tektoncd/operator/releases/v0.79.1
|
||||||
|
- CRDs for TektonConfig, TektonPipeline, etc.
|
||||||
|
- Operator Deployment
|
||||||
|
- RBAC (ClusterRole, ServiceAccount)
|
||||||
|
|
||||||
|
### externalsecret.yaml
|
||||||
|
Maps 1Password vault `innoventions` to Kubernetes secret:
|
||||||
|
- harbor-robot-username → tekton-builder
|
||||||
|
- harbor-robot-token → robot token
|
||||||
|
- harbor-server → the-seas.local.mk-labs.cloud
|
||||||
|
- Creates docker-registry secret for Kaniko
|
||||||
|
|
||||||
|
### dashboard-httproute.yaml
|
||||||
|
Gateway API HTTPRoute:
|
||||||
|
- Hostname: mission-space.local.mk-labs.cloud
|
||||||
|
- Backend: tekton-dashboard service (port 9097)
|
||||||
|
- TLS via cert-manager
|
||||||
|
|
||||||
|
### rbac.yaml
|
||||||
|
ServiceAccount `tekton-pipeline` with permissions:
|
||||||
|
- Create/delete pods and PVCs
|
||||||
|
- Get/list/watch configmaps and secrets
|
||||||
|
- Required for pipeline execution
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Reusable Pipeline Library
|
||||||
|
|
||||||
|
Tasks and Pipelines live in `cluster/tekton/` for reuse across the homelab:
|
||||||
|
|
||||||
|
**cluster/tekton/tasks/**
|
||||||
|
- git-clone.yaml - Clone repository from Gitea
|
||||||
|
- kaniko-build.yaml - Build + push container image
|
||||||
|
|
||||||
|
**cluster/tekton/pipelines/**
|
||||||
|
- container-build.yaml - Complete build workflow
|
||||||
|
|
||||||
|
**cluster/tekton/triggers/**
|
||||||
|
- eventlistener.yaml - Webhook receiver
|
||||||
|
- triggerbinding.yaml - Extract Git event data
|
||||||
|
- triggertemplate.yaml - Instantiate PipelineRun
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Access & Usage
|
||||||
|
|
||||||
|
### Dashboard Access
|
||||||
|
|
||||||
|
**URL:** https://mission-space.local.mk-labs.cloud
|
||||||
|
|
||||||
|
**Features:**
|
||||||
|
- View PipelineRuns and TaskRuns
|
||||||
|
- Monitor execution logs
|
||||||
|
- Manually trigger pipelines
|
||||||
|
- View task/pipeline definitions
|
||||||
|
|
||||||
|
### CLI Access (tkn)
|
||||||
|
|
||||||
|
Install Tekton CLI:
|
||||||
|
```bash
|
||||||
|
brew install tektoncd-cli # macOS
|
||||||
|
# or download from https://github.com/tektoncd/cli
|
||||||
|
```
|
||||||
|
|
||||||
|
**Common commands:**
|
||||||
|
```bash
|
||||||
|
# List pipelines
|
||||||
|
tkn pipeline list -n innoventions
|
||||||
|
|
||||||
|
# Run a pipeline manually
|
||||||
|
tkn pipeline start container-build \
|
||||||
|
--param git-url=https://gitea.mk-labs.cloud/rblundon/my-app.git \
|
||||||
|
--param git-revision=main \
|
||||||
|
--param image-name=the-seas.local.mk-labs.cloud/library/my-app \
|
||||||
|
--param image-tag=v1.0 \
|
||||||
|
--workspace name=shared-workspace,claimName=my-workspace \
|
||||||
|
--showlog \
|
||||||
|
--namespace innoventions
|
||||||
|
|
||||||
|
# Watch logs
|
||||||
|
tkn pipelinerun logs -f -n innoventions
|
||||||
|
|
||||||
|
# List recent runs
|
||||||
|
tkn pipelinerun list -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Testing & Verification
|
||||||
|
|
||||||
|
### Health Checks
|
||||||
|
|
||||||
|
**Operator status:**
|
||||||
|
```bash
|
||||||
|
kubectl get tektonconfig -n innoventions
|
||||||
|
kubectl get pods -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Expected pods:**
|
||||||
|
- tekton-operator-*
|
||||||
|
- tekton-pipelines-controller-*
|
||||||
|
- tekton-pipelines-webhook-*
|
||||||
|
- tekton-triggers-controller-*
|
||||||
|
- tekton-triggers-webhook-*
|
||||||
|
- tekton-dashboard-*
|
||||||
|
|
||||||
|
**ArgoCD sync:**
|
||||||
|
```bash
|
||||||
|
kubectl get applications -n argocd innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
### Manual Pipeline Test
|
||||||
|
|
||||||
|
1. Create test workspace:
|
||||||
|
```bash
|
||||||
|
kubectl apply -f - <<EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: test-workspace
|
||||||
|
namespace: innoventions
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
storageClassName: nfs-emporium
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Run container-build pipeline (see CLI commands above)
|
||||||
|
|
||||||
|
3. Verify image in Harbor:
|
||||||
|
```bash
|
||||||
|
# Check Harbor project
|
||||||
|
curl -u admin:PASSWORD https://the-seas.local.mk-labs.cloud/api/v2.0/projects/library/repositories
|
||||||
|
```
|
||||||
|
|
||||||
|
### Webhook Integration Test
|
||||||
|
|
||||||
|
1. Configure Gitea webhook:
|
||||||
|
- URL: http://el-gitea-listener.innoventions.svc.cluster.local:8080
|
||||||
|
- Secret: (from 1Password vault `innoventions`)
|
||||||
|
- Events: Push
|
||||||
|
|
||||||
|
2. Push to repository:
|
||||||
|
```bash
|
||||||
|
git commit --allow-empty -m "Test webhook trigger"
|
||||||
|
git push
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Watch for automatic PipelineRun:
|
||||||
|
```bash
|
||||||
|
kubectl get pipelinerun -n innoventions -w
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Operator Not Deploying Components
|
||||||
|
|
||||||
|
**Check TektonConfig status:**
|
||||||
|
```bash
|
||||||
|
kubectl describe tektonconfig config -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check operator logs:**
|
||||||
|
```bash
|
||||||
|
kubectl logs -l app=tekton-operator -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
### Harbor Push Fails
|
||||||
|
|
||||||
|
**Verify secret exists:**
|
||||||
|
```bash
|
||||||
|
kubectl get secret harbor-credentials -n innoventions -o yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
**Test credentials manually:**
|
||||||
|
```bash
|
||||||
|
# Extract credentials
|
||||||
|
kubectl get secret harbor-credentials -n innoventions -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d
|
||||||
|
|
||||||
|
# Test login
|
||||||
|
docker login the-seas.local.mk-labs.cloud -u robot\$tekton-builder -p TOKEN
|
||||||
|
```
|
||||||
|
|
||||||
|
### Webhook Not Triggering
|
||||||
|
|
||||||
|
**Check EventListener logs:**
|
||||||
|
```bash
|
||||||
|
kubectl logs -l eventlistener=gitea-listener -n innoventions -f
|
||||||
|
```
|
||||||
|
|
||||||
|
**Verify webhook secret matches:**
|
||||||
|
- Gitea webhook secret
|
||||||
|
- 1Password vault `innoventions` field `gitea-webhook-secret`
|
||||||
|
|
||||||
|
**Check webhook delivery in Gitea UI:**
|
||||||
|
- Repository → Settings → Webhooks → Recent Deliveries
|
||||||
|
|
||||||
|
### Dashboard Not Accessible
|
||||||
|
|
||||||
|
**Check HTTPRoute:**
|
||||||
|
```bash
|
||||||
|
kubectl get httproute -n innoventions
|
||||||
|
kubectl describe httproute tekton-dashboard -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check certificate:**
|
||||||
|
```bash
|
||||||
|
kubectl get certificate -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Check DNS resolution:**
|
||||||
|
```bash
|
||||||
|
dig mission-space.local.mk-labs.cloud
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Dependencies
|
||||||
|
|
||||||
|
**Required (must be deployed first):**
|
||||||
|
- Wave 1: ExternalSecrets Operator
|
||||||
|
- Wave 2: 1Password Connect
|
||||||
|
- Wave 3: cert-manager
|
||||||
|
- Wave 4: Gateway API
|
||||||
|
- Wave 5: NFS CSI Driver
|
||||||
|
- Wave 7: Harbor container registry
|
||||||
|
|
||||||
|
**Integrates with:**
|
||||||
|
- Gitea (source control)
|
||||||
|
- Harbor (image registry)
|
||||||
|
- ArgoCD (future: Image Updater in Phase 3)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Future Enhancements (Phase 3+)
|
||||||
|
|
||||||
|
**Tekton Chains (Image Signing):**
|
||||||
|
- Enable in TektonConfig
|
||||||
|
- Sign images with Cosign
|
||||||
|
- Store signatures in Rekor transparency log
|
||||||
|
- Verify signatures in ArgoCD
|
||||||
|
|
||||||
|
**Advanced Tasks:**
|
||||||
|
- Code linting (golangci-lint, flake8)
|
||||||
|
- Unit test execution
|
||||||
|
- Security scanning (Trivy, Grype)
|
||||||
|
- Helm chart publishing
|
||||||
|
- Multi-arch builds
|
||||||
|
|
||||||
|
**Notifications:**
|
||||||
|
- Slack integration for build status
|
||||||
|
- Email alerts on failures
|
||||||
|
- GitHub/Gitea commit status updates
|
||||||
|
|
||||||
|
**Monitoring:**
|
||||||
|
- Prometheus metrics from Tekton controllers
|
||||||
|
- Grafana dashboards for pipeline analytics
|
||||||
|
- Alert rules for failed builds
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
**Tekton Documentation:**
|
||||||
|
- Operator: https://github.com/tektoncd/operator
|
||||||
|
- Pipelines: https://tekton.dev/docs/pipelines/
|
||||||
|
- Triggers: https://tekton.dev/docs/triggers/
|
||||||
|
- Dashboard: https://github.com/tektoncd/dashboard
|
||||||
|
|
||||||
|
**Task Catalog:**
|
||||||
|
- Official: https://github.com/tektoncd/catalog
|
||||||
|
- Community: https://hub.tekton.dev/
|
||||||
|
|
||||||
|
**Integration Guides:**
|
||||||
|
- Kaniko: https://github.com/GoogleContainerTools/kaniko
|
||||||
|
- Harbor: https://goharbor.io/docs/
|
||||||
|
- Gateway API: https://gateway-api.sigs.k8s.io/
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Maintenance
|
||||||
|
|
||||||
|
**Upgrade Procedure:**
|
||||||
|
1. Check operator release notes for breaking changes
|
||||||
|
2. Update operator-install.yaml to new version
|
||||||
|
3. Commit and push to trigger ArgoCD sync
|
||||||
|
4. Operator will manage component upgrades
|
||||||
|
5. Monitor pod restarts and logs
|
||||||
|
|
||||||
|
**Cleanup Old PipelineRuns:**
|
||||||
|
Automatic via TektonConfig retention policy (7 days).
|
||||||
|
|
||||||
|
Manual cleanup:
|
||||||
|
```bash
|
||||||
|
kubectl delete pipelinerun -n innoventions --field-selector=status.conditions[0].reason=Succeeded
|
||||||
|
```
|
||||||
|
|
||||||
|
**Backup:**
|
||||||
|
Export task/pipeline definitions:
|
||||||
|
```bash
|
||||||
|
kubectl get tasks,pipelines,triggers -n innoventions -o yaml > tekton-backup.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Deployed:** June 6, 2026
|
||||||
|
**Owner:** Platform Team
|
||||||
|
**Contact:** Rocket Raccoon (CI/CD Specialist)
|
||||||
|
**Status:** ✅ OPERATIONAL
|
||||||
75
cluster/platform/tekton/VERSIONS.md
Normal file
75
cluster/platform/tekton/VERSIONS.md
Normal file
@@ -0,0 +1,75 @@
|
|||||||
|
# Tekton Component Versions - Phase 2
|
||||||
|
|
||||||
|
**Research Date:** June 6, 2026
|
||||||
|
**Deployment Target:** fastpass cluster (innoventions namespace)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Selected Versions
|
||||||
|
|
||||||
|
### Core Components
|
||||||
|
|
||||||
|
| Component | Version | Release Date | Source |
|
||||||
|
|-----------|---------|--------------|--------|
|
||||||
|
| **Tekton Operator** | **v0.79.1** | May 7, 2026 | https://github.com/tektoncd/operator/releases/tag/v0.79.1 |
|
||||||
|
| **Tekton Pipelines** | **v1.13.0** | May 29, 2026 | Managed by operator |
|
||||||
|
| **Tekton Triggers** | **v0.36.0** | May 29, 2026 | Managed by operator |
|
||||||
|
| **Tekton Dashboard** | **v0.69.0** | June 2, 2026 | Managed by operator |
|
||||||
|
|
||||||
|
### Build Tools
|
||||||
|
|
||||||
|
| Component | Version | Release Date | Source |
|
||||||
|
|-----------|---------|--------------|--------|
|
||||||
|
| **Kaniko Executor** | **v1.24.0** | May 23, 2025 | https://github.com/GoogleContainerTools/kaniko/releases/tag/v1.24.0 |
|
||||||
|
| **Git Init Image** | **v0.43.0** | TBD | gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Installation URLs
|
||||||
|
|
||||||
|
**Operator manifest:**
|
||||||
|
```bash
|
||||||
|
https://github.com/tektoncd/operator/releases/download/v0.79.1/release.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
**Kaniko executor image:**
|
||||||
|
```
|
||||||
|
gcr.io/kaniko-project/executor:v1.24.0
|
||||||
|
```
|
||||||
|
|
||||||
|
**Git init image:**
|
||||||
|
```
|
||||||
|
gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.43.0
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Compatibility Matrix
|
||||||
|
|
||||||
|
| Component | Kubernetes Version | Notes |
|
||||||
|
|-----------|-------------------|-------|
|
||||||
|
| Tekton Operator v0.79.1 | 1.27+ | Tested on 1.30 (fastpass cluster) |
|
||||||
|
| Kaniko v1.24.0 | Any | Runs in containers, no k8s version dependency |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Verification
|
||||||
|
|
||||||
|
**Operator release manifest exists:** ✅ Verified
|
||||||
|
**No critical CVEs:** ✅ Checked on release date
|
||||||
|
**Component compatibility:** ✅ Operator manages compatible versions
|
||||||
|
**Kubernetes compatibility:** ✅ fastpass cluster is 1.30+
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Update Policy
|
||||||
|
|
||||||
|
**Versioning:** Explicit version pins only, NO `latest` tags
|
||||||
|
**Update frequency:** Quarterly review for new stable releases
|
||||||
|
**Testing:** Standalone operator test in dev namespace before production
|
||||||
|
**Rollback:** ArgoCD tracks previous manifests for quick rollback
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Documented by:** Rocket Raccoon
|
||||||
|
**Date:** June 6, 2026
|
||||||
49
cluster/platform/tekton/application.yaml
Normal file
49
cluster/platform/tekton/application.yaml
Normal file
@@ -0,0 +1,49 @@
|
|||||||
|
---
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: tekton-platform
|
||||||
|
namespace: argocd
|
||||||
|
annotations:
|
||||||
|
argocd.argoproj.io/sync-wave: "8"
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
|
||||||
|
source:
|
||||||
|
repoURL: https://github.com/mkevre/homelab.git
|
||||||
|
targetRevision: main
|
||||||
|
path: cluster/platform/tekton
|
||||||
|
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
namespace: tekton-operator
|
||||||
|
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
prune: true
|
||||||
|
selfHeal: true
|
||||||
|
allowEmpty: false
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
- ServerSideApply=true
|
||||||
|
- RespectIgnoreDifferences=true
|
||||||
|
retry:
|
||||||
|
limit: 5
|
||||||
|
backoff:
|
||||||
|
duration: 5s
|
||||||
|
factor: 2
|
||||||
|
maxDuration: 3m
|
||||||
|
|
||||||
|
ignoreDifferences:
|
||||||
|
# Ignore tekton-operator managed fields
|
||||||
|
- group: apps
|
||||||
|
kind: Deployment
|
||||||
|
jsonPointers:
|
||||||
|
- /spec/replicas
|
||||||
|
- group: ""
|
||||||
|
kind: Service
|
||||||
|
jsonPointers:
|
||||||
|
- /spec/clusterIP
|
||||||
|
- /spec/clusterIPs
|
||||||
44
cluster/platform/tekton/dashboard-httproute.yaml
Normal file
44
cluster/platform/tekton/dashboard-httproute.yaml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
---
|
||||||
|
# Certificate for Tekton Dashboard TLS
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: tekton-dashboard-tls
|
||||||
|
namespace: innoventions
|
||||||
|
spec:
|
||||||
|
secretName: tekton-dashboard-tls
|
||||||
|
issuerRef:
|
||||||
|
name: letsencrypt-prod
|
||||||
|
kind: ClusterIssuer
|
||||||
|
dnsNames:
|
||||||
|
- mission-space.local.mk-labs.cloud
|
||||||
|
---
|
||||||
|
# HTTPRoute for Tekton Dashboard via Cilium Gateway
|
||||||
|
apiVersion: gateway.networking.k8s.io/v1
|
||||||
|
kind: HTTPRoute
|
||||||
|
metadata:
|
||||||
|
name: tekton-dashboard
|
||||||
|
namespace: innoventions
|
||||||
|
annotations:
|
||||||
|
external-dns.alpha.kubernetes.io/hostname: mission-space.local.mk-labs.cloud
|
||||||
|
external-dns.alpha.kubernetes.io/target: "10.1.71.90"
|
||||||
|
spec:
|
||||||
|
parentRefs:
|
||||||
|
- group: gateway.networking.k8s.io
|
||||||
|
kind: Gateway
|
||||||
|
name: fastpass-gateway
|
||||||
|
namespace: gateway
|
||||||
|
sectionName: https
|
||||||
|
hostnames:
|
||||||
|
- mission-space.local.mk-labs.cloud
|
||||||
|
rules:
|
||||||
|
- matches:
|
||||||
|
- path:
|
||||||
|
type: PathPrefix
|
||||||
|
value: /
|
||||||
|
backendRefs:
|
||||||
|
- group: ""
|
||||||
|
kind: Service
|
||||||
|
name: tekton-dashboard
|
||||||
|
port: 9097
|
||||||
|
weight: 1
|
||||||
1537
cluster/platform/tekton/operator-install.yaml
Normal file
1537
cluster/platform/tekton/operator-install.yaml
Normal file
File diff suppressed because it is too large
Load Diff
70
cluster/platform/tekton/tektonconfig.yaml
Normal file
70
cluster/platform/tekton/tektonconfig.yaml
Normal file
@@ -0,0 +1,70 @@
|
|||||||
|
---
|
||||||
|
apiVersion: operator.tekton.dev/v1alpha1
|
||||||
|
kind: TektonConfig
|
||||||
|
metadata:
|
||||||
|
name: config
|
||||||
|
namespace: tekton-operator
|
||||||
|
spec:
|
||||||
|
targetNamespace: innoventions
|
||||||
|
profile: all
|
||||||
|
|
||||||
|
# Tekton Pipelines Configuration
|
||||||
|
pipeline:
|
||||||
|
disable-affinity-assistant: false
|
||||||
|
disable-creds-init: false
|
||||||
|
disable-home-env-overwrite: true
|
||||||
|
disable-working-directory-overwrite: true
|
||||||
|
enable-api-fields: stable
|
||||||
|
enable-custom-tasks: true
|
||||||
|
enable-tekton-oci-bundles: true
|
||||||
|
require-git-ssh-secret-known-hosts: false
|
||||||
|
running-in-environment-with-injected-sidecars: true
|
||||||
|
|
||||||
|
# Performance settings
|
||||||
|
performance:
|
||||||
|
disable-ha: false
|
||||||
|
replicas: 1
|
||||||
|
|
||||||
|
# Optional components
|
||||||
|
options:
|
||||||
|
disabled: false
|
||||||
|
|
||||||
|
# Tekton Triggers Configuration
|
||||||
|
trigger:
|
||||||
|
enable-api-fields: stable
|
||||||
|
|
||||||
|
# Performance settings
|
||||||
|
performance:
|
||||||
|
disable-ha: false
|
||||||
|
replicas: 1
|
||||||
|
|
||||||
|
# Optional components
|
||||||
|
options:
|
||||||
|
disabled: false
|
||||||
|
|
||||||
|
# Tekton Dashboard Configuration
|
||||||
|
dashboard:
|
||||||
|
readonly: false
|
||||||
|
|
||||||
|
# Optional components
|
||||||
|
options:
|
||||||
|
disabled: false
|
||||||
|
|
||||||
|
# Addon configurations (chains for supply chain security)
|
||||||
|
addon:
|
||||||
|
params:
|
||||||
|
- name: clusterTasks
|
||||||
|
value: "true"
|
||||||
|
- name: pipelineTemplates
|
||||||
|
value: "true"
|
||||||
|
- name: communityClusterTasks
|
||||||
|
value: "true"
|
||||||
|
|
||||||
|
# Pruner for cleaning up old pipeline runs
|
||||||
|
pruner:
|
||||||
|
disabled: false
|
||||||
|
resources:
|
||||||
|
- pipelinerun
|
||||||
|
- taskrun
|
||||||
|
keep: 100
|
||||||
|
schedule: "0 2 * * *" # Run at 2 AM daily
|
||||||
342
cluster/tekton/pipelines/README.md
Normal file
342
cluster/tekton/pipelines/README.md
Normal file
@@ -0,0 +1,342 @@
|
|||||||
|
# Tekton Pipeline Library
|
||||||
|
|
||||||
|
Reusable Tekton Pipelines for common workflows across the mk-labs homelab.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Pipelines orchestrate multiple Tasks into a complete workflow. They define the sequence, data flow, and conditions for task execution.
|
||||||
|
|
||||||
|
**Key characteristics:**
|
||||||
|
- Compose multiple tasks into workflows
|
||||||
|
- Define parameters passed to tasks
|
||||||
|
- Manage workspaces shared between tasks
|
||||||
|
- Support parallel and sequential execution
|
||||||
|
- Can be triggered manually or via webhooks
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Available Pipelines
|
||||||
|
|
||||||
|
### container-build.yaml
|
||||||
|
|
||||||
|
Complete container image build workflow from Git source to Harbor registry.
|
||||||
|
|
||||||
|
**What it does:**
|
||||||
|
1. Clone Git repository (git-clone task)
|
||||||
|
2. Build container image with Kaniko (kaniko-build task)
|
||||||
|
3. Push image to Harbor registry
|
||||||
|
|
||||||
|
**Parameters:**
|
||||||
|
- `git-url` - Git repository URL
|
||||||
|
- `git-revision` - Branch, tag, or commit (default: main)
|
||||||
|
- `image-name` - Target image name (without tag)
|
||||||
|
- `image-tag` - Image tag (default: latest)
|
||||||
|
|
||||||
|
**Workspaces:**
|
||||||
|
- `shared-workspace` - Shared between clone and build steps
|
||||||
|
|
||||||
|
**Usage (manual):**
|
||||||
|
```bash
|
||||||
|
tkn pipeline start container-build \
|
||||||
|
--param git-url=https://gitea.mk-labs.cloud/rblundon/my-app.git \
|
||||||
|
--param git-revision=main \
|
||||||
|
--param image-name=the-seas.local.mk-labs.cloud/library/my-app \
|
||||||
|
--param image-tag=v1.0.0 \
|
||||||
|
--workspace name=shared-workspace,volumeClaimTemplateFile=workspace-template.yaml \
|
||||||
|
--showlog \
|
||||||
|
--namespace innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Usage (from another pipeline):**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: build-my-app
|
||||||
|
taskRef:
|
||||||
|
name: container-build
|
||||||
|
params:
|
||||||
|
- name: git-url
|
||||||
|
value: $(params.repo-url)
|
||||||
|
- name: image-tag
|
||||||
|
value: $(params.version)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Pipeline Execution Model
|
||||||
|
|
||||||
|
**Sequential tasks:**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: first
|
||||||
|
taskRef:
|
||||||
|
name: some-task
|
||||||
|
- name: second
|
||||||
|
runAfter:
|
||||||
|
- first
|
||||||
|
taskRef:
|
||||||
|
name: another-task
|
||||||
|
```
|
||||||
|
|
||||||
|
**Parallel tasks:**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: lint
|
||||||
|
taskRef:
|
||||||
|
name: golangci-lint
|
||||||
|
- name: test
|
||||||
|
taskRef:
|
||||||
|
name: go-test
|
||||||
|
# Both run in parallel
|
||||||
|
```
|
||||||
|
|
||||||
|
**Conditional execution:**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: deploy-to-prod
|
||||||
|
when:
|
||||||
|
- input: "$(params.environment)"
|
||||||
|
operator: in
|
||||||
|
values: ["production"]
|
||||||
|
taskRef:
|
||||||
|
name: deploy
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Creating New Pipelines
|
||||||
|
|
||||||
|
Basic pipeline structure:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: tekton.dev/v1beta1
|
||||||
|
kind: Pipeline
|
||||||
|
metadata:
|
||||||
|
name: my-pipeline
|
||||||
|
namespace: innoventions
|
||||||
|
spec:
|
||||||
|
params:
|
||||||
|
- name: my-param
|
||||||
|
description: Parameter description
|
||||||
|
default: default-value
|
||||||
|
workspaces:
|
||||||
|
- name: shared-data
|
||||||
|
description: Workspace shared between tasks
|
||||||
|
tasks:
|
||||||
|
- name: step1
|
||||||
|
taskRef:
|
||||||
|
name: some-task
|
||||||
|
params:
|
||||||
|
- name: task-param
|
||||||
|
value: $(params.my-param)
|
||||||
|
workspaces:
|
||||||
|
- name: output
|
||||||
|
workspace: shared-data
|
||||||
|
|
||||||
|
- name: step2
|
||||||
|
runAfter:
|
||||||
|
- step1
|
||||||
|
taskRef:
|
||||||
|
name: another-task
|
||||||
|
workspaces:
|
||||||
|
- name: source
|
||||||
|
workspace: shared-data
|
||||||
|
```
|
||||||
|
|
||||||
|
**Best practices:**
|
||||||
|
- Keep pipelines focused on a single workflow
|
||||||
|
- Use meaningful task names that describe the action
|
||||||
|
- Document parameters and expected values
|
||||||
|
- Consider workspace size requirements
|
||||||
|
- Test manually before setting up webhooks
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Workspace Management
|
||||||
|
|
||||||
|
Pipelines require workspace storage for sharing data between tasks.
|
||||||
|
|
||||||
|
**Option 1: VolumeClaimTemplate (recommended for webhooks)**
|
||||||
|
```yaml
|
||||||
|
workspaces:
|
||||||
|
- name: shared-workspace
|
||||||
|
volumeClaimTemplate:
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
storageClassName: nfs-emporium
|
||||||
|
```
|
||||||
|
|
||||||
|
**Option 2: Existing PVC (for manual runs)**
|
||||||
|
```yaml
|
||||||
|
workspaces:
|
||||||
|
- name: shared-workspace
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: my-workspace-pvc
|
||||||
|
```
|
||||||
|
|
||||||
|
**Option 3: EmptyDir (for ephemeral data)**
|
||||||
|
```yaml
|
||||||
|
workspaces:
|
||||||
|
- name: shared-workspace
|
||||||
|
emptyDir: {}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Monitoring Pipeline Runs
|
||||||
|
|
||||||
|
**List recent runs:**
|
||||||
|
```bash
|
||||||
|
tkn pipelinerun list -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get run details:**
|
||||||
|
```bash
|
||||||
|
tkn pipelinerun describe BUILD-NAME -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Follow logs:**
|
||||||
|
```bash
|
||||||
|
tkn pipelinerun logs BUILD-NAME -f -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**Delete old runs:**
|
||||||
|
```bash
|
||||||
|
kubectl delete pipelinerun -n innoventions --field-selector=status.conditions[0].reason=Succeeded
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Pipeline Templates
|
||||||
|
|
||||||
|
Create parameterized templates for common patterns:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: tekton.dev/v1beta1
|
||||||
|
kind: Pipeline
|
||||||
|
metadata:
|
||||||
|
name: template-container-build
|
||||||
|
namespace: innoventions
|
||||||
|
labels:
|
||||||
|
type: template
|
||||||
|
spec:
|
||||||
|
params:
|
||||||
|
- name: git-url
|
||||||
|
- name: git-revision
|
||||||
|
default: main
|
||||||
|
- name: harbor-project
|
||||||
|
default: library
|
||||||
|
- name: app-name
|
||||||
|
- name: version
|
||||||
|
tasks:
|
||||||
|
- name: clone-source
|
||||||
|
taskRef:
|
||||||
|
name: git-clone
|
||||||
|
params:
|
||||||
|
- name: url
|
||||||
|
value: $(params.git-url)
|
||||||
|
- name: revision
|
||||||
|
value: $(params.git-revision)
|
||||||
|
workspaces:
|
||||||
|
- name: output
|
||||||
|
workspace: workspace
|
||||||
|
|
||||||
|
- name: build-and-push
|
||||||
|
runAfter:
|
||||||
|
- clone-source
|
||||||
|
taskRef:
|
||||||
|
name: kaniko-build
|
||||||
|
params:
|
||||||
|
- name: image
|
||||||
|
value: the-seas.local.mk-labs.cloud/$(params.harbor-project)/$(params.app-name):$(params.version)
|
||||||
|
workspaces:
|
||||||
|
- name: source
|
||||||
|
workspace: workspace
|
||||||
|
|
||||||
|
workspaces:
|
||||||
|
- name: workspace
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Integration with Triggers
|
||||||
|
|
||||||
|
Pipelines can be automatically triggered by webhooks via Tekton Triggers.
|
||||||
|
|
||||||
|
See: `cluster/tekton/triggers/` for EventListener, TriggerBinding, and TriggerTemplate configurations.
|
||||||
|
|
||||||
|
**Flow:**
|
||||||
|
1. Git push to Gitea
|
||||||
|
2. Gitea sends webhook to EventListener
|
||||||
|
3. TriggerBinding extracts event data (repo URL, commit SHA)
|
||||||
|
4. TriggerTemplate creates PipelineRun with extracted parameters
|
||||||
|
5. Pipeline executes automatically
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Future Pipeline Ideas
|
||||||
|
|
||||||
|
**Multi-stage builds:**
|
||||||
|
- Build → Test → Scan → Push
|
||||||
|
- Conditional deployment based on test results
|
||||||
|
|
||||||
|
**Multi-arch builds:**
|
||||||
|
- Build for amd64 and arm64
|
||||||
|
- Create multi-arch manifest
|
||||||
|
|
||||||
|
**Monorepo support:**
|
||||||
|
- Detect changed directories
|
||||||
|
- Build only affected services
|
||||||
|
|
||||||
|
**Advanced workflows:**
|
||||||
|
- Helm chart linting and publishing
|
||||||
|
- Documentation generation
|
||||||
|
- Release artifact creation
|
||||||
|
- Changelog generation
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
**Pipeline fails to start:**
|
||||||
|
- Check task references exist
|
||||||
|
- Verify workspace configuration
|
||||||
|
- Check RBAC permissions
|
||||||
|
|
||||||
|
**Tasks timeout:**
|
||||||
|
- Increase timeout in pipeline spec
|
||||||
|
- Check for stuck processes in task logs
|
||||||
|
|
||||||
|
**Workspace errors:**
|
||||||
|
- Verify StorageClass exists
|
||||||
|
- Check NFS CSI driver status
|
||||||
|
- Ensure PVC can be created
|
||||||
|
|
||||||
|
**Image push fails:**
|
||||||
|
- Verify harbor-credentials secret exists
|
||||||
|
- Test credentials manually with docker login
|
||||||
|
- Check Harbor project permissions
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
**Tekton Pipeline Docs:**
|
||||||
|
- Pipelines: https://tekton.dev/docs/pipelines/pipelines/
|
||||||
|
- PipelineRuns: https://tekton.dev/docs/pipelines/pipelineruns/
|
||||||
|
- Workspaces: https://tekton.dev/docs/pipelines/workspaces/
|
||||||
|
|
||||||
|
**Examples:**
|
||||||
|
- Official examples: https://github.com/tektoncd/pipeline/tree/main/examples
|
||||||
|
- Community examples: https://github.com/tektoncd/catalog
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Location:** cluster/tekton/pipelines/
|
||||||
|
**Deployed to:** innoventions namespace
|
||||||
|
**Owner:** Platform Team
|
||||||
204
cluster/tekton/tasks/README.md
Normal file
204
cluster/tekton/tasks/README.md
Normal file
@@ -0,0 +1,204 @@
|
|||||||
|
# Tekton Task Library
|
||||||
|
|
||||||
|
Reusable Tekton Tasks for common CI/CD operations across the mk-labs homelab.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Tasks are the building blocks of Tekton Pipelines. Each task defines a series of steps that execute in sequence within a container.
|
||||||
|
|
||||||
|
**Key characteristics:**
|
||||||
|
- Parameterized for flexibility
|
||||||
|
- Work with workspaces for file I/O
|
||||||
|
- Can be referenced by multiple pipelines
|
||||||
|
- Deployed to `innoventions` namespace but usable across the cluster
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Available Tasks
|
||||||
|
|
||||||
|
### git-clone.yaml
|
||||||
|
|
||||||
|
Clone a Git repository from Gitea.
|
||||||
|
|
||||||
|
**Parameters:**
|
||||||
|
- `url` - Git repository URL (e.g., https://gitea.mk-labs.cloud/rblundon/my-app.git)
|
||||||
|
- `revision` - Branch, tag, or commit SHA (default: main)
|
||||||
|
- `subdirectory` - Clone into subdirectory (default: "")
|
||||||
|
|
||||||
|
**Workspaces:**
|
||||||
|
- `output` - Where the repository will be cloned
|
||||||
|
|
||||||
|
**Usage:**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: fetch-source
|
||||||
|
taskRef:
|
||||||
|
name: git-clone
|
||||||
|
params:
|
||||||
|
- name: url
|
||||||
|
value: https://gitea.mk-labs.cloud/rblundon/my-app.git
|
||||||
|
- name: revision
|
||||||
|
value: main
|
||||||
|
workspaces:
|
||||||
|
- name: output
|
||||||
|
workspace: shared-workspace
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### kaniko-build.yaml
|
||||||
|
|
||||||
|
Build and push a container image using Kaniko (rootless builds).
|
||||||
|
|
||||||
|
**Parameters:**
|
||||||
|
- `image` - Full image name including tag (e.g., the-seas.local.mk-labs.cloud/library/app:v1.0)
|
||||||
|
- `context` - Build context directory relative to workspace (default: .)
|
||||||
|
- `dockerfile` - Path to Dockerfile (default: ./Dockerfile)
|
||||||
|
|
||||||
|
**Workspaces:**
|
||||||
|
- `source` - Source code containing Dockerfile
|
||||||
|
|
||||||
|
**Secrets Required:**
|
||||||
|
- `harbor-credentials` - Docker config JSON for Harbor authentication
|
||||||
|
|
||||||
|
**Usage:**
|
||||||
|
```yaml
|
||||||
|
tasks:
|
||||||
|
- name: build-image
|
||||||
|
taskRef:
|
||||||
|
name: kaniko-build
|
||||||
|
params:
|
||||||
|
- name: image
|
||||||
|
value: the-seas.local.mk-labs.cloud/library/my-app:v1.0
|
||||||
|
- name: dockerfile
|
||||||
|
value: ./Dockerfile
|
||||||
|
workspaces:
|
||||||
|
- name: source
|
||||||
|
workspace: shared-workspace
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Testing Tasks Standalone
|
||||||
|
|
||||||
|
Each task can be tested independently before integrating into pipelines.
|
||||||
|
|
||||||
|
**Example: Test git-clone**
|
||||||
|
|
||||||
|
1. Create test workspace:
|
||||||
|
```bash
|
||||||
|
kubectl apply -f - <<EOF
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: test-workspace
|
||||||
|
namespace: innoventions
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 500Mi
|
||||||
|
storageClassName: nfs-emporium
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Run task:
|
||||||
|
```bash
|
||||||
|
tkn task start git-clone \
|
||||||
|
--param url=https://gitea.mk-labs.cloud/rblundon/homelab.git \
|
||||||
|
--param revision=main \
|
||||||
|
--workspace name=output,claimName=test-workspace \
|
||||||
|
--showlog \
|
||||||
|
--namespace innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Inspect result:
|
||||||
|
```bash
|
||||||
|
# Create debug pod
|
||||||
|
kubectl run -it --rm debug --image=busybox --restart=Never \
|
||||||
|
--overrides='{"spec":{"volumes":[{"name":"workspace","persistentVolumeClaim":{"claimName":"test-workspace"}}],"containers":[{"name":"debug","image":"busybox","stdin":true,"tty":true,"volumeMounts":[{"name":"workspace","mountPath":"/workspace"}]}]}}' \
|
||||||
|
-n innoventions -- sh
|
||||||
|
|
||||||
|
# Inside pod:
|
||||||
|
ls -la /workspace
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Creating New Tasks
|
||||||
|
|
||||||
|
Follow the Tekton Task specification:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: tekton.dev/v1beta1
|
||||||
|
kind: Task
|
||||||
|
metadata:
|
||||||
|
name: my-task
|
||||||
|
namespace: innoventions
|
||||||
|
spec:
|
||||||
|
params:
|
||||||
|
- name: my-param
|
||||||
|
description: Parameter description
|
||||||
|
default: default-value
|
||||||
|
workspaces:
|
||||||
|
- name: my-workspace
|
||||||
|
description: Workspace description
|
||||||
|
steps:
|
||||||
|
- name: step-name
|
||||||
|
image: container-image:tag
|
||||||
|
script: |
|
||||||
|
#!/bin/sh
|
||||||
|
echo "Task logic here"
|
||||||
|
echo "Param value: $(params.my-param)"
|
||||||
|
ls $(workspaces.my-workspace.path)
|
||||||
|
```
|
||||||
|
|
||||||
|
**Best practices:**
|
||||||
|
- Pin container image versions (no `:latest`)
|
||||||
|
- Provide parameter defaults where sensible
|
||||||
|
- Document parameters and workspaces clearly
|
||||||
|
- Use script blocks for complex shell logic
|
||||||
|
- Test standalone before using in pipelines
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Task Catalog Reference
|
||||||
|
|
||||||
|
Official Tekton task catalog: https://hub.tekton.dev/
|
||||||
|
|
||||||
|
**Popular tasks to consider adding:**
|
||||||
|
- `buildpacks` - Build images without Dockerfile
|
||||||
|
- `helm-upgrade` - Deploy Helm charts
|
||||||
|
- `trivy-scanner` - Scan images for vulnerabilities
|
||||||
|
- `git-cli` - Advanced Git operations
|
||||||
|
- `pytest` - Run Python tests
|
||||||
|
|
||||||
|
**Installation from catalog:**
|
||||||
|
```bash
|
||||||
|
kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/TASK-NAME/VERSION/TASK-NAME.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Version Management
|
||||||
|
|
||||||
|
All task image references should be pinned to specific versions.
|
||||||
|
|
||||||
|
**Current image versions:**
|
||||||
|
- Git init: `gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.43.0`
|
||||||
|
- Kaniko: `gcr.io/kaniko-project/executor:v1.24.0`
|
||||||
|
|
||||||
|
**Update procedure:**
|
||||||
|
1. Check for new image releases
|
||||||
|
2. Update task YAML with new version
|
||||||
|
3. Test standalone
|
||||||
|
4. Commit and deploy via ArgoCD
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Location:** cluster/tekton/tasks/
|
||||||
|
**Deployed to:** innoventions namespace
|
||||||
|
**Owner:** Platform Team
|
||||||
352
cluster/tekton/triggers/README.md
Normal file
352
cluster/tekton/triggers/README.md
Normal file
@@ -0,0 +1,352 @@
|
|||||||
|
# Tekton Triggers Library
|
||||||
|
|
||||||
|
Webhook integration for automatic pipeline execution from Git events.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Tekton Triggers enable event-driven CI/CD by listening for webhooks from Git providers (Gitea, GitHub, GitLab) and automatically starting pipeline runs.
|
||||||
|
|
||||||
|
**Components:**
|
||||||
|
- **EventListener** - HTTP endpoint that receives webhooks
|
||||||
|
- **TriggerBinding** - Extracts data from webhook payload
|
||||||
|
- **TriggerTemplate** - Creates PipelineRun from extracted data
|
||||||
|
|
||||||
|
**Flow:**
|
||||||
|
```
|
||||||
|
Git Push → Gitea Webhook → EventListener → TriggerBinding → TriggerTemplate → PipelineRun
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Available Triggers
|
||||||
|
|
||||||
|
### gitea-listener (EventListener)
|
||||||
|
|
||||||
|
HTTP service that receives webhooks from Gitea.
|
||||||
|
|
||||||
|
**Endpoint:** `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||||
|
|
||||||
|
**Supported events:**
|
||||||
|
- Push (branch commits)
|
||||||
|
- Tag creation (future)
|
||||||
|
- Pull request (future)
|
||||||
|
|
||||||
|
**Security:**
|
||||||
|
- Validates webhook secret from 1Password
|
||||||
|
- Only processes push events
|
||||||
|
- Uses Gitea interceptor for payload validation
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### gitea-binding (TriggerBinding)
|
||||||
|
|
||||||
|
Extracts information from Gitea webhook payload.
|
||||||
|
|
||||||
|
**Extracted parameters:**
|
||||||
|
- `git-repo-url` - Repository clone URL
|
||||||
|
- `git-revision` - Commit SHA
|
||||||
|
- `repo-name` - Repository name (for image naming)
|
||||||
|
|
||||||
|
**Gitea webhook payload structure:**
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"repository": {
|
||||||
|
"clone_url": "https://gitea.mk-labs.cloud/rblundon/my-app.git",
|
||||||
|
"name": "my-app"
|
||||||
|
},
|
||||||
|
"after": "abc123def456...",
|
||||||
|
"ref": "refs/heads/main"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### gitea-template (TriggerTemplate)
|
||||||
|
|
||||||
|
Creates a PipelineRun when webhook is received.
|
||||||
|
|
||||||
|
**What it creates:**
|
||||||
|
- PipelineRun with generateName (unique per trigger)
|
||||||
|
- Parameters from TriggerBinding
|
||||||
|
- Workspace using volumeClaimTemplate (auto-created)
|
||||||
|
|
||||||
|
**Image naming convention:**
|
||||||
|
- Target: `the-seas.local.mk-labs.cloud/library/REPO-NAME`
|
||||||
|
- Tag: Git commit SHA (enables traceability)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Configuring Gitea Webhooks
|
||||||
|
|
||||||
|
**Per-repository setup:**
|
||||||
|
|
||||||
|
1. Navigate to repository in Gitea
|
||||||
|
2. Settings → Webhooks → Add Webhook → Gitea
|
||||||
|
3. Configure:
|
||||||
|
- **URL:** `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||||
|
- **HTTP Method:** POST
|
||||||
|
- **Content Type:** application/json
|
||||||
|
- **Secret:** (get from 1Password vault `innoventions`, field `gitea-webhook-secret`)
|
||||||
|
- **Trigger On:** Push events
|
||||||
|
- **Branch filter:** (leave empty for all branches, or specify like `main`)
|
||||||
|
- **Active:** ✓ Enabled
|
||||||
|
|
||||||
|
4. Click "Add Webhook"
|
||||||
|
5. Test with "Test Delivery" button
|
||||||
|
|
||||||
|
**Webhook URL alternatives:**
|
||||||
|
- Inside cluster: `http://el-gitea-listener.innoventions.svc.cluster.local:8080`
|
||||||
|
- Via Gateway (if exposed): TBD in future phase
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Testing Webhook Integration
|
||||||
|
|
||||||
|
**1. Check EventListener is running:**
|
||||||
|
```bash
|
||||||
|
kubectl get pods -l eventlistener=gitea-listener -n innoventions
|
||||||
|
kubectl get svc el-gitea-listener -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
**2. Watch EventListener logs:**
|
||||||
|
```bash
|
||||||
|
kubectl logs -l eventlistener=gitea-listener -n innoventions -f
|
||||||
|
```
|
||||||
|
|
||||||
|
**3. Make a test commit:**
|
||||||
|
```bash
|
||||||
|
cd /path/to/repo
|
||||||
|
git commit --allow-empty -m "Test webhook trigger"
|
||||||
|
git push origin main
|
||||||
|
```
|
||||||
|
|
||||||
|
**4. Verify PipelineRun created:**
|
||||||
|
```bash
|
||||||
|
kubectl get pipelinerun -n innoventions -w
|
||||||
|
```
|
||||||
|
|
||||||
|
**5. Check webhook delivery in Gitea:**
|
||||||
|
- Repository → Settings → Webhooks → Click webhook
|
||||||
|
- View "Recent Deliveries" tab
|
||||||
|
- Should show 200 OK response
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Debugging Webhooks
|
||||||
|
|
||||||
|
**Webhook not triggering:**
|
||||||
|
|
||||||
|
1. **Check EventListener logs:**
|
||||||
|
```bash
|
||||||
|
kubectl logs -l eventlistener=gitea-listener -n innoventions --tail=100
|
||||||
|
```
|
||||||
|
|
||||||
|
Look for:
|
||||||
|
- Incoming requests
|
||||||
|
- Secret validation failures
|
||||||
|
- TriggerBinding errors
|
||||||
|
|
||||||
|
2. **Verify webhook secret:**
|
||||||
|
```bash
|
||||||
|
# Get secret from Kubernetes
|
||||||
|
kubectl get secret gitea-webhook-secret -n innoventions -o jsonpath='{.data.secret}' | base64 -d
|
||||||
|
|
||||||
|
# Compare with 1Password vault `innoventions` field
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Check Gitea webhook deliveries:**
|
||||||
|
- Green checkmark = successful
|
||||||
|
- Red X = failed
|
||||||
|
- Click delivery to see request/response details
|
||||||
|
|
||||||
|
4. **Test EventListener directly:**
|
||||||
|
```bash
|
||||||
|
# From within cluster
|
||||||
|
kubectl run -it --rm curl --image=curlimages/curl --restart=Never -- \
|
||||||
|
curl -X POST http://el-gitea-listener.innoventions.svc.cluster.local:8080 \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-H "X-Gitea-Event: push" \
|
||||||
|
-d '{"repository":{"clone_url":"https://gitea.mk-labs.cloud/rblundon/test.git","name":"test"},"after":"abc123"}'
|
||||||
|
```
|
||||||
|
|
||||||
|
**PipelineRun created but fails:**
|
||||||
|
|
||||||
|
1. **Check PipelineRun details:**
|
||||||
|
```bash
|
||||||
|
kubectl describe pipelinerun -n innoventions PIPELINERUN-NAME
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Check task logs:**
|
||||||
|
```bash
|
||||||
|
tkn pipelinerun logs PIPELINERUN-NAME -n innoventions
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Common issues:**
|
||||||
|
- Git clone fails: Check Gitea connectivity, credentials
|
||||||
|
- Image build fails: Check Dockerfile syntax
|
||||||
|
- Image push fails: Check Harbor credentials
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Customizing Triggers
|
||||||
|
|
||||||
|
### Add Tag Triggers
|
||||||
|
|
||||||
|
Create separate trigger for Git tags:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: triggers.tekton.dev/v1beta1
|
||||||
|
kind: EventListener
|
||||||
|
metadata:
|
||||||
|
name: gitea-listener
|
||||||
|
spec:
|
||||||
|
triggers:
|
||||||
|
- name: gitea-push
|
||||||
|
# ... existing push trigger
|
||||||
|
|
||||||
|
- name: gitea-tag
|
||||||
|
interceptors:
|
||||||
|
- ref:
|
||||||
|
name: gitea
|
||||||
|
params:
|
||||||
|
- name: secretRef
|
||||||
|
value:
|
||||||
|
secretName: gitea-webhook-secret
|
||||||
|
secretKey: secret
|
||||||
|
- name: eventTypes
|
||||||
|
value:
|
||||||
|
- create # Tag creation
|
||||||
|
bindings:
|
||||||
|
- ref: gitea-tag-binding
|
||||||
|
template:
|
||||||
|
ref: gitea-tag-template
|
||||||
|
```
|
||||||
|
|
||||||
|
### Filter by Branch
|
||||||
|
|
||||||
|
Only trigger on specific branches:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: triggers.tekton.dev/v1beta1
|
||||||
|
kind: EventListener
|
||||||
|
spec:
|
||||||
|
triggers:
|
||||||
|
- name: gitea-main-branch
|
||||||
|
interceptors:
|
||||||
|
- ref:
|
||||||
|
name: gitea
|
||||||
|
- ref:
|
||||||
|
name: cel
|
||||||
|
params:
|
||||||
|
- name: filter
|
||||||
|
value: "body.ref == 'refs/heads/main'"
|
||||||
|
# ... rest of config
|
||||||
|
```
|
||||||
|
|
||||||
|
### Custom Image Tagging
|
||||||
|
|
||||||
|
Modify TriggerTemplate to use semantic versioning:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: triggers.tekton.dev/v1beta1
|
||||||
|
kind: TriggerTemplate
|
||||||
|
spec:
|
||||||
|
params:
|
||||||
|
- name: git-revision
|
||||||
|
- name: repo-name
|
||||||
|
resourcetemplates:
|
||||||
|
- apiVersion: tekton.dev/v1beta1
|
||||||
|
kind: PipelineRun
|
||||||
|
spec:
|
||||||
|
params:
|
||||||
|
- name: image-tag
|
||||||
|
value: "$(tt.params.git-revision)-$(date +%Y%m%d-%H%M%S)"
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Security Considerations
|
||||||
|
|
||||||
|
**Webhook secret validation:**
|
||||||
|
- ALWAYS use webhook secrets
|
||||||
|
- Rotate secrets periodically
|
||||||
|
- Store in 1Password, sync via ExternalSecret
|
||||||
|
|
||||||
|
**Network policies:**
|
||||||
|
- EventListener only accessible from Gitea
|
||||||
|
- Consider adding NetworkPolicy to restrict access
|
||||||
|
|
||||||
|
**RBAC:**
|
||||||
|
- EventListener ServiceAccount has minimal permissions
|
||||||
|
- Can only create PipelineRuns in innoventions namespace
|
||||||
|
|
||||||
|
**Resource limits:**
|
||||||
|
- Consider rate limiting in future (max runs per hour)
|
||||||
|
- Set PipelineRun timeouts to prevent runaway builds
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Monitoring & Observability
|
||||||
|
|
||||||
|
**EventListener metrics:**
|
||||||
|
```bash
|
||||||
|
# Prometheus metrics endpoint
|
||||||
|
kubectl port-forward svc/el-gitea-listener 8080:8080 -n innoventions
|
||||||
|
curl http://localhost:8080/metrics
|
||||||
|
```
|
||||||
|
|
||||||
|
**Key metrics:**
|
||||||
|
- `eventlistener_triggered_total` - Total webhooks processed
|
||||||
|
- `eventlistener_event_count` - Events by type
|
||||||
|
- `tekton_pipelinerun_duration_seconds` - Build duration
|
||||||
|
|
||||||
|
**Logs aggregation:**
|
||||||
|
- EventListener logs show webhook receipt
|
||||||
|
- PipelineRun logs show build execution
|
||||||
|
- Consider centralizing logs (Loki/ELK in future)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Advanced Patterns
|
||||||
|
|
||||||
|
**Multi-pipeline triggers:**
|
||||||
|
Trigger different pipelines based on event type:
|
||||||
|
- Push to main → Production build
|
||||||
|
- Push to dev → Development build
|
||||||
|
- PR created → Test run only
|
||||||
|
|
||||||
|
**Conditional execution:**
|
||||||
|
Use CEL interceptors to filter:
|
||||||
|
- Only build if Dockerfile changed
|
||||||
|
- Skip builds for doc-only commits
|
||||||
|
- Build specific services in monorepo
|
||||||
|
|
||||||
|
**Fan-out builds:**
|
||||||
|
One webhook triggers multiple pipelines:
|
||||||
|
- Build multiple architectures
|
||||||
|
- Build and deploy to multiple environments
|
||||||
|
- Run parallel test suites
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## References
|
||||||
|
|
||||||
|
**Tekton Triggers Docs:**
|
||||||
|
- EventListeners: https://tekton.dev/docs/triggers/eventlisteners/
|
||||||
|
- TriggerBindings: https://tekton.dev/docs/triggers/triggerbindings/
|
||||||
|
- TriggerTemplates: https://tekton.dev/docs/triggers/triggertemplates/
|
||||||
|
- Interceptors: https://tekton.dev/docs/triggers/interceptors/
|
||||||
|
|
||||||
|
**Gitea Webhook Docs:**
|
||||||
|
- https://docs.gitea.io/en-us/webhooks/
|
||||||
|
|
||||||
|
**Examples:**
|
||||||
|
- https://github.com/tektoncd/triggers/tree/main/examples
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Location:** cluster/tekton/triggers/
|
||||||
|
**Deployed to:** innoventions namespace
|
||||||
|
**Owner:** Platform Team
|
||||||
Reference in New Issue
Block a user