f8e137b67b
- Added config.json key to harbor-credentials ExternalSecret This ensures kaniko can find the Docker auth config at /kaniko/.docker/config.json (previously only .dockerconfigjson was present) - Created test-app-build PipelineRun manifest for validation testing - Successfully validated end-to-end pipeline: ✅ git-clone Task deployed and working ✅ kaniko-build Task deployed and working ✅ container-build Pipeline deployed and working ✅ Harbor authentication working with robot account ✅ Test image built and pushed: the-seas.local.mk-labs.cloud/library/test-app:v1.0.0 ✅ Image digest: sha256:aa143f4a01795a1d307b711108ca0c89f36e00ea38fddb9d7b2febd5fffc46d7 Pipeline test results: - PipelineRun: test-app-build-005 - SUCCEEDED - fetch-repository TaskRun - SUCCEEDED - build-and-push TaskRun - SUCCEEDED Tekton CI/CD platform is now operational and ready for production workloads.
70 lines
2.5 KiB
YAML
70 lines
2.5 KiB
YAML
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: kaniko-build
|
|
namespace: innoventions
|
|
labels:
|
|
app.kubernetes.io/version: "0.1"
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: "0.29.0"
|
|
tekton.dev/categories: Image Build
|
|
tekton.dev/tags: image-build, kaniko
|
|
tekton.dev/displayName: "kaniko build"
|
|
tekton.dev/platforms: "linux/amd64,linux/arm64"
|
|
spec:
|
|
description: >-
|
|
This Task builds source into a container image using Google's Kaniko tool.
|
|
|
|
Kaniko doesn't depend on a Docker daemon and executes each command within a Dockerfile
|
|
completely in userspace. This enables building container images in environments that
|
|
can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster.
|
|
|
|
params:
|
|
- name: IMAGE
|
|
description: Name (reference) of the image to build.
|
|
- name: DOCKERFILE
|
|
description: Path to the Dockerfile to build.
|
|
default: ./Dockerfile
|
|
- name: CONTEXT
|
|
description: The build context used by Kaniko.
|
|
default: ./
|
|
- name: EXTRA_ARGS
|
|
type: array
|
|
default: []
|
|
- name: BUILDER_IMAGE
|
|
description: The image on which builds will run (default is v1.23.2)
|
|
default: gcr.io/kaniko-project/executor:v1.23.2
|
|
workspaces:
|
|
- name: source
|
|
description: Holds the context and Dockerfile
|
|
- name: dockerconfig
|
|
description: Includes a docker `config.json`
|
|
optional: true
|
|
mountPath: /kaniko/.docker
|
|
results:
|
|
- name: IMAGE_DIGEST
|
|
description: Digest of the image just built.
|
|
- name: IMAGE_URL
|
|
description: URL of the image just built.
|
|
steps:
|
|
- name: build-and-push
|
|
workingDir: $(workspaces.source.path)
|
|
image: $(params.BUILDER_IMAGE)
|
|
args:
|
|
- $(params.EXTRA_ARGS)
|
|
- --dockerfile=$(params.DOCKERFILE)
|
|
- --context=$(workspaces.source.path)/$(params.CONTEXT)
|
|
- --destination=$(params.IMAGE)
|
|
- --digest-file=$(results.IMAGE_DIGEST.path)
|
|
# kaniko assumes it is running as root, which means this example fails on platforms
|
|
# that default to run containers as random uid (like OpenShift). Adding this securityContext
|
|
# makes it explicit that it needs to run as root.
|
|
securityContext:
|
|
runAsUser: 0
|
|
- name: write-url
|
|
image: docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9
|
|
script: |
|
|
set -e
|
|
image="$(params.IMAGE)"
|
|
echo -n "${image}" | tee "$(results.IMAGE_URL.path)"
|