homelab/cluster/tekton/tasks/README.md

# Tekton Task Library

Reusable Tekton Tasks for common CI/CD operations across the mk-labs homelab.

---

## Overview

Tasks are the building blocks of Tekton Pipelines. Each task defines a series of steps that execute in sequence within a container.

**Key characteristics:**
- Parameterized for flexibility
- Work with workspaces for file I/O
- Can be referenced by multiple pipelines
- Deployed to `innoventions` namespace but usable across the cluster

---

## Available Tasks

### git-clone.yaml

Clone a Git repository from Gitea.

**Parameters:**
- `url` - Git repository URL (e.g., https://gitea.mk-labs.cloud/rblundon/my-app.git)
- `revision` - Branch, tag, or commit SHA (default: main)
- `subdirectory` - Clone into subdirectory (default: "")

**Workspaces:**
- `output` - Where the repository will be cloned

**Usage:**
```yaml
tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    params:
      - name: url
        value: https://gitea.mk-labs.cloud/rblundon/my-app.git
      - name: revision
        value: main
    workspaces:
      - name: output
        workspace: shared-workspace
```

---

### kaniko-build.yaml

Build and push a container image using Kaniko (rootless builds).

**Parameters:**
- `image` - Full image name including tag (e.g., the-seas.local.mk-labs.cloud/library/app:v1.0)
- `context` - Build context directory relative to workspace (default: .)
- `dockerfile` - Path to Dockerfile (default: ./Dockerfile)

**Workspaces:**
- `source` - Source code containing Dockerfile

**Secrets Required:**
- `harbor-credentials` - Docker config JSON for Harbor authentication

**Usage:**
```yaml
tasks:
  - name: build-image
    taskRef:
      name: kaniko-build
    params:
      - name: image
        value: the-seas.local.mk-labs.cloud/library/my-app:v1.0
      - name: dockerfile
        value: ./Dockerfile
    workspaces:
      - name: source
        workspace: shared-workspace
```

---

## Testing Tasks Standalone

Each task can be tested independently before integrating into pipelines.

**Example: Test git-clone**

1. Create test workspace:
```bash
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: test-workspace
  namespace: innoventions
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 500Mi
  storageClassName: nfs-emporium
EOF
```

2. Run task:
```bash
tkn task start git-clone \
  --param url=https://gitea.mk-labs.cloud/rblundon/homelab.git \
  --param revision=main \
  --workspace name=output,claimName=test-workspace \
  --showlog \
  --namespace innoventions
```

3. Inspect result:
```bash
# Create debug pod
kubectl run -it --rm debug --image=busybox --restart=Never \
  --overrides='{"spec":{"volumes":[{"name":"workspace","persistentVolumeClaim":{"claimName":"test-workspace"}}],"containers":[{"name":"debug","image":"busybox","stdin":true,"tty":true,"volumeMounts":[{"name":"workspace","mountPath":"/workspace"}]}]}}' \
  -n innoventions -- sh

# Inside pod:
ls -la /workspace
```

---

## Creating New Tasks

Follow the Tekton Task specification:

```yaml
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: my-task
  namespace: innoventions
spec:
  params:
    - name: my-param
      description: Parameter description
      default: default-value
  workspaces:
    - name: my-workspace
      description: Workspace description
  steps:
    - name: step-name
      image: container-image:tag
      script: |
        #!/bin/sh
        echo "Task logic here"
        echo "Param value: $(params.my-param)"
        ls $(workspaces.my-workspace.path)
```

**Best practices:**
- Pin container image versions (no `:latest`)
- Provide parameter defaults where sensible
- Document parameters and workspaces clearly
- Use script blocks for complex shell logic
- Test standalone before using in pipelines

---

## Task Catalog Reference

Official Tekton task catalog: https://hub.tekton.dev/

**Popular tasks to consider adding:**
- `buildpacks` - Build images without Dockerfile
- `helm-upgrade` - Deploy Helm charts
- `trivy-scanner` - Scan images for vulnerabilities
- `git-cli` - Advanced Git operations
- `pytest` - Run Python tests

**Installation from catalog:**
```bash
kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/TASK-NAME/VERSION/TASK-NAME.yaml
```

---

## Version Management

All task image references should be pinned to specific versions.

**Current image versions:**
- Git init: `gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.43.0`
- Kaniko: `gcr.io/kaniko-project/executor:v1.24.0`

**Update procedure:**
1. Check for new image releases
2. Update task YAML with new version
3. Test standalone
4. Commit and deploy via ArgoCD

---

**Location:** cluster/tekton/tasks/  
**Deployed to:** innoventions namespace  
**Owner:** Platform Team