diff --git a/task/argocd-task-connect-repo/0.2/README.md b/task/argocd-task-connect-repo/0.2/README.md new file mode 100644 index 0000000000..e4f695a2ed --- /dev/null +++ b/task/argocd-task-connect-repo/0.2/README.md @@ -0,0 +1,77 @@ +# ArgoCD + + This task connects a repository to Argo CD. To do so, it requires the address of the Argo CD server and some form of authentication either a username/password or an authentication token, as well as the desired repo. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/argocd-task-connect-repo/0.2/argocd-task-connect-repo.yaml +``` + +## Parameters + +* **repository-url:** Name of the application to sync e.g. `https://charts.bitnami.com/bitnami` + +* **repository-name:** The name you want to give to the repo, e.g. `bitnami` + +* **flags:** Flags to append after commands, e.g. `--insecure` (_default:_ `--`) + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +``` +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-env-configmap + namespace: argocd +data: + ARGOCD_SERVER: +--- +apiVersion: v1 +kind: Secret +metadata: + name: argocd-env-secret + namespace: argocd +data: + # choose one of username/password or auth token + ARGOCD_USERNAME: + ARGOCD_PASSWORD: + ARGOCD_AUTH_TOKEN: +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: argocd-pipeline-test + namespace: argocd +spec: + tasks: + - name: connect-repo + taskRef: + name: argocd-task-connect-repo + params: + - name: repository-url + value: https://charts.bitnami.com/bitnami + - name: repository-type + value: helm + - name: repository-name + value: concourse + - name: flags + value: --insecure +``` + +For the `Secret`, choose one of username/password or auth token for logging in. Either of the following are acceptable: + +```YAML +data: + ARGOCD_USERNAME: + ARGOCD_PASSWORD: +``` + +```YAML +data: + ARGOCD_AUTH_TOKEN: +``` \ No newline at end of file diff --git a/task/argocd-task-connect-repo/0.2/argocd-task-connect-repo.yaml b/task/argocd-task-connect-repo/0.2/argocd-task-connect-repo.yaml new file mode 100644 index 0000000000..07cb554f00 --- /dev/null +++ b/task/argocd-task-connect-repo/0.2/argocd-task-connect-repo.yaml @@ -0,0 +1,53 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: argocd-task-connect-repo + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: generic + tekton.dev/displayName: "argocd-repository" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task adds an http repo in Argo CD. + + To do so, it requires the address of the Argo CD server and some form of + authentication either a username/password or an authentication token, + as well as the desired repository to connect to. + params: + - name: repository-url + description: url of the repository you want to add + type: string + - name: repository-type + description: repository type (helm or git) + type: string + - name: repository-name + description: name you want to give to the repository + type: string + - name: flags + default: -- + type: string + - name: argocd-version + default: v2.3.4 + type: string + stepTemplate: + envFrom: + - configMapRef: + name: argocd-env-configmap # used for server address + - secretRef: + name: argocd-env-secret # used for authentication (username/password or auth token) + steps: + - name: connect-repo + image: quay.io/argoproj/argocd:$(params.argocd-version) + script: | + if [ -z "$ARGOCD_AUTH_TOKEN" ]; then + yes | argocd login "$ARGOCD_SERVER" --username="$ARGOCD_USERNAME" --password="$ARGOCD_PASSWORD" --insecure; + fi + if [ "$(params.repository-type)" != "helm" ]; then + argocd repo add "$(params.repository-url)" "$(params.flags)"; + else + argocd repo add "$(params.repository-url)" --type helm --name "$(params.repository-name)" "$(params.flags)"; + fi diff --git a/task/argocd-task-sync-and-wait/0.3/README.md b/task/argocd-task-sync-and-wait/0.3/README.md new file mode 100644 index 0000000000..e897429b51 --- /dev/null +++ b/task/argocd-task-sync-and-wait/0.3/README.md @@ -0,0 +1,77 @@ +# Argo CD + +This task syncs (deploys) an [Argo CD](https://argoproj.github.io/argo-cd/) application and waits for it to be healthy. To do so, it requires the address of the Argo CD server and some form of authentication - either a username/password or an authentication token. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/argocd-task-sync-and-wait/0.3/argocd-task-sync-and-wait.yaml +``` + +## Parameters + +* **application-name:** Name of the application to sync + +* **revision:** The revision to sync to (_default:_ `HEAD`) + +* **flags:** Flags to append after commands, e.g. `--insecure` (_default:_ `--`) + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +This `Pipeline` implements the typical CD flow using GitOps, as explained [here](https://argoproj.github.io/argo-cd/user-guide/ci_automation/). It runs a sample `Task` that makes and pushes a change to a Git repository, after which it runs the Argo CD `Task` to sync an application based on that repository. + +The `ConfigMap` and `Secret` give an example of how to define the Argo CD server address and give credentials for logging in. + +```YAML +apiVersion: v1 +kind: ConfigMap +metadata: + name: argocd-env-configmap +data: + ARGOCD_SERVER: +--- +apiVersion: v1 +kind: Secret +metadata: + name: argocd-env-secret +data: + # choose one of username/password or auth token + ARGOCD_USERNAME: + ARGOCD_PASSWORD: + ARGOCD_AUTH_TOKEN: +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: argocd-pipeline +spec: + tasks: + - name: push-to-git + taskRef: + name: some-git-task # pushes to the Git repository used by the application in the next task + - name: sync-application + taskRef: + name: argocd-task-sync-and-wait + params: + - name: application-name + value: some-application + - name: flags + value: --insecure # needed in this example only because the Argo CD server is locally hosted +``` + +For the `Secret`, choose one of username/password or auth token for logging in. Either of the following are acceptable: + +```YAML +data: + ARGOCD_USERNAME: + ARGOCD_PASSWORD: +``` + +```YAML +data: + ARGOCD_AUTH_TOKEN: +``` diff --git a/task/argocd-task-sync-and-wait/0.3/argocd-task-sync-and-wait.yaml b/task/argocd-task-sync-and-wait/0.3/argocd-task-sync-and-wait.yaml new file mode 100644 index 0000000000..8486ddaeb5 --- /dev/null +++ b/task/argocd-task-sync-and-wait/0.3/argocd-task-sync-and-wait.yaml @@ -0,0 +1,48 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: argocd-task-sync-and-wait + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: deploy + tekton.dev/displayName: "argocd" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task syncs (deploys) an Argo CD application and waits for it to be healthy. + + To do so, it requires the address of the Argo CD server and some form of + authentication either a username/password or an authentication token. + + params: + - name: application-name + description: name of the application to sync + type: string + - name: revision + description: the revision to sync to + default: HEAD + type: string + - name: flags + default: -- + type: string + - name: argocd-version + default: v2.2.2 + type: string + stepTemplate: + envFrom: + - configMapRef: + name: argocd-env-configmap # used for server address + - secretRef: + name: argocd-env-secret # used for authentication (username/password or auth token) + steps: + - name: login + image: quay.io/argoproj/argocd:$(params.argocd-version) + script: | + if [ -z "$ARGOCD_AUTH_TOKEN" ]; then + yes | argocd login "$ARGOCD_SERVER" --username="$ARGOCD_USERNAME" --password="$ARGOCD_PASSWORD"; + fi + argocd app sync "$(params.application-name)" --revision "$(params.revision)" "$(params.flags)" + argocd app wait "$(params.application-name)" --health "$(params.flags)" diff --git a/task/blue-green-deploy/0.3/README.md b/task/blue-green-deploy/0.3/README.md new file mode 100644 index 0000000000..543e58127e --- /dev/null +++ b/task/blue-green-deploy/0.3/README.md @@ -0,0 +1,89 @@ +# Blue Green Deploy on Kubernetes + +The following task can help you to deploy an application using the Blue-Green deployment strategy. This task gives you the flexibility to deploy a version of the application from the blue zone to the green zone without disturbing the previous version in the blue zone. It works by making the service point to the newer version of the application deployed. + +- If you are deploying the first version of the application then it will go into the blue zone and for that you need to provide deployment and service manifests via the `workspaces` and in the `params` the service name and version. Sample Kubernetes manifests for version v1 can be found [here](./samples/v1-deploy). +- For further new deployments, it will get deployed in the other zone and then the current service will now point to the new deployment. For example if we have a deployment running in the blue zone then we will deploy the next deployment in the green zone and make the service point to the green zone or vice versa. + +## Installing the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/blue-green-deploy/0.3/blue-green-deploy.yaml +``` + +## Installing the ClusterRoleBinding + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/blue-green-deploy/0.3/support/clusterrolebinding.yaml +``` + +## Optional Workspaces + +- **manifest-dir**: Manifest files can be provided via the workspaces +- **kubeconfig-dir**: If you want to deploy you application to another cluster then you can mount your `kubeconfig` file via this `workspace` + +## Parameters + +- **SERVICE_NAME**: The service name pointing to the existing deployment. (_Note_: The service name for the new deployment should be same) +- **NEW_VERSION**: The version of the deployment to be deployed in the green/blue zone +- **MANIFEST**: The deployment manifest URL file path provided in case the manifest is present on Github. (_Example_: "https://raw.githubusercontent.com/tektoncd/catalog/main/task/blue-green-deploy/0.3/samples/v1-deploy/blue-deployment.yaml") +- **NAMESPACE**: Target namespace in which operation needs to be performed +- **IMAGE**: Image which has kubectl binary present (_Default_: `quay.io/openshift/origin-cli:4.9`) + +## Platforms + +The Task can be run on `linux/amd64` platform. + +# Usage + +This TaskRun runs the Task to deploy the given Kubernetes resource in the green/blue zone and toggle the service to point to the new zone. + +## Without using ConfigMap + +TaskRun :- + +```yaml +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: blue-green-deploy-run +spec: + taskRef: + name: blue-green-deploy-k8s + params: + - name: SERVICE_NAME + value: myapp + - name: NEW_VERSION + value: v2 + - name: MANIFEST + value: "https://raw.githubusercontent.com/tektoncd/catalog/main/task/blue-green-deploy/0.3/samples/v2-deploy/green-deployment.yaml" +``` + +## Using ConfigMap + +1. Create the `ConfigMap` + +```bash +kubectl create configmap manifests --from-file="green-deployment.yaml" +``` + +2. TaskRun:- + +```yaml +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: blue-green-deploy-run +spec: + taskRef: + name: blue-green-deploy-k8s + params: + - name: SERVICE_NAME + value: myapp + - name: NEW_VERSION + value: v2 + workspaces: + - name: manifest-dir + configMap: + name: manifests +``` diff --git a/task/blue-green-deploy/0.3/blue-green-deploy.yaml b/task/blue-green-deploy/0.3/blue-green-deploy.yaml new file mode 100644 index 0000000000..5790a66fcc --- /dev/null +++ b/task/blue-green-deploy/0.3/blue-green-deploy.yaml @@ -0,0 +1,153 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: blue-green-deploy + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: deployment + tekton.dev/displayName: "blue green deployment" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task can be used to do Blue-Green deployment + workspaces: + - name: manifest-dir + description: Consisting of kubernetes manifests + optional: true + - name: kubeconfig-dir + description: Can be used in case kubeconfig file is mounted + optional: true + params: + - name: SERVICE_NAME + type: string + description: Name of the service which is pointing to existing deployment + - name: NEW_VERSION + type: string + description: The version of newer deployment which is to be patched to existing service + - name: MANIFEST + type: string + default: "." + description: The newer version of the deployment to be deployed in another zone + - name: NAMESPACE + type: string + description: Target namespace in which operation needs to be performed + - name: IMAGE + description: Image which has kubectl binary present + type: string + default: "quay.io/openshift/origin-cli:4.9" + steps: + - name: change-deployment + image: $(params.IMAGE) + script: | + #!/usr/bin/env bash + set -u -o pipefail + + [[ "$(workspaces.manifest-dir.bound)" == "true" ]] && cd $(workspaces.manifest-dir.path) + + if [[ "$(workspaces.kubeconfig-dir.bound)" == "true" ]] && [[ -f $(workspaces.kubeconfig-dir.path)/kubeconfig ]]; then + export KUBECONFIG=$(workspaces.kubeconfig-dir.path)/kubeconfig + fi + + getReasons() { + local deploy_name=$1 + kubectl -n $(params.NAMESPACE) get deploy "$deploy_name" \ + -o jsonpath='{range .status.conditions[*]}{.reason}{"\n"}{end}' + } + + # Getting the status at particular index + getStatusAtIndex() { + local deploy_name=$1 + local index=$2 + kubectl -n $(params.NAMESPACE) get deploy "$deploy_name" \ + -o jsonpath='{range .status.conditions['$index']}{.status}{"\n"}{end}' + } + + # Checking for unavailable pods in case the deployment is + # patched with a newer image + checkUnavailableReplicas() { + local deploy_name=$1 + local replicasUnavailable=$(kubectl -n $(params.NAMESPACE) get deploy "$deploy_name" -o jsonpath='{.status.unavailableReplicas}') + [[ "$replicasUnavailable" == "" ]] && return 0 || return 1 + } + + getMinimumReplicaStatus() { + local deploy_name=$1 + local INDEX=0 + for reason in $(getReasons $deploy_name); do + if [[ "$reason" == "MinimumReplicasAvailable" ]]; then + local ready=$(getStatusAtIndex $deploy_name ${INDEX}) + [[ "$ready" != "True" ]] && return 1 || return 0 + fi + ((INDEX++)) + done + return 1 + } + + checkProgressDeadline() { + local deploy_name=$1 + local INDEX=0 + for reason in $(getReasons $deploy_name); do + if [[ "$reason" == "ProgressDeadlineExceeded" ]]; then + local status=$(getStatusAtIndex $deploy_name ${INDEX}) + [[ "$status" == "True" ]] && return 0 || return 1 + fi + ((INDEX++)) + done + return 1 + } + + switchService() { + kubectl -n $(params.NAMESPACE) patch svc ${service} \ + -p "{\"spec\":{\"selector\": {\"app\": \"${service}\", \"version\": \"${version}\"}}}" + } + + main() { + local deploy_name=$(params.SERVICE_NAME)-$(params.NEW_VERSION) + local service=$(params.SERVICE_NAME) + local version=$(params.NEW_VERSION) + + kubectl -n $(params.NAMESPACE) apply -f $(params.MANIFEST) + + # Wait until the Deployment is ready by checking the + # MinimumReplicasAvailable condition. + # Also checking for the ProgressDeadlineExceeded + # condition + while true; do + getMinimumReplicaStatus ${deploy_name} + [[ $? -eq 0 ]] && break + checkProgressDeadline ${deploy_name} + [[ $? -eq 0 ]] && break + sleep 5 + done + # If ProgressDeadlineExceeded then break from the main + # and avoid checking for the next condition + checkProgressDeadline ${deploy_name} + if [[ $? -eq 0 ]]; then + echo "Failed to change the service" && break + fi + # If MinimumReplicas are available then check + # for the unavailable Pods + # Also checking for the ProgressDeadlineExceeded condition + while true; do + checkUnavailableReplicas ${deploy_name} + [[ $? -eq 0 ]] && break + checkProgressDeadline ${deploy_name} + [[ $? -eq 0 ]] && break + sleep 5 + done + + # Update the service selector with the new version + # if ProgressDeadline not exceeded + checkProgressDeadline ${deploy_name} + if [[ $? -eq 0 ]]; then + echo "Failed to change the service" + else + switchService ${service} ${version} + [[ $? -eq 0 ]] && echo "Done." || exit 1 + fi + } + + main "$@" diff --git a/task/blue-green-deploy/0.3/samples/run.yaml b/task/blue-green-deploy/0.3/samples/run.yaml new file mode 100644 index 0000000000..af9ca4aaef --- /dev/null +++ b/task/blue-green-deploy/0.3/samples/run.yaml @@ -0,0 +1,16 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: blue-green-deploy-run +spec: + taskRef: + name: blue-green-deploy + params: + - name: SERVICE_NAME + value: myapp + - name: NEW_VERSION + value: v2 + - name: MANIFEST + value: "https://raw.githubusercontent.com/vinamra28/blue-green-deployment-k8s/master/deployment%2Bservice/green-deployment.yaml" + - name: NAMESPACE + value: default diff --git a/task/blue-green-deploy/0.3/samples/v1-deploy/blue-deployment.yaml b/task/blue-green-deploy/0.3/samples/v1-deploy/blue-deployment.yaml new file mode 100644 index 0000000000..e6963ed546 --- /dev/null +++ b/task/blue-green-deploy/0.3/samples/v1-deploy/blue-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: myapp-v1 +spec: + replicas: 1 + selector: + matchLabels: + app: myapp + version: v1 + template: + metadata: + labels: + app: "myapp" + version: "v1" + spec: + containers: + - name: myapp + image: quay.io/vinamra2807/social-client:v1 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3000 + name: http diff --git a/task/blue-green-deploy/0.3/samples/v1-deploy/service.yaml b/task/blue-green-deploy/0.3/samples/v1-deploy/service.yaml new file mode 100644 index 0000000000..1b01e8cfbe --- /dev/null +++ b/task/blue-green-deploy/0.3/samples/v1-deploy/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: myapp + labels: + app: myapp +spec: + type: NodePort + ports: + - port: 3000 + name: http + selector: + app: myapp + version: v1 diff --git a/task/blue-green-deploy/0.3/samples/v2-deploy/green-deployment.yaml b/task/blue-green-deploy/0.3/samples/v2-deploy/green-deployment.yaml new file mode 100644 index 0000000000..a11cbc3602 --- /dev/null +++ b/task/blue-green-deploy/0.3/samples/v2-deploy/green-deployment.yaml @@ -0,0 +1,23 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: myapp-v2 +spec: + replicas: 1 + selector: + matchLabels: + app: myapp + version: v2 + template: + metadata: + labels: + app: "myapp" + version: "v2" + spec: + containers: + - name: myapp + image: quay.io/vinamra2807/social-client:v2 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 3000 + name: http diff --git a/task/blue-green-deploy/0.3/support/clusterrolebinding.yaml b/task/blue-green-deploy/0.3/support/clusterrolebinding.yaml new file mode 100644 index 0000000000..2d087b5074 --- /dev/null +++ b/task/blue-green-deploy/0.3/support/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: default-blue-green +subjects: + - kind: ServiceAccount + name: default + namespace: default +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io diff --git a/task/blue-green-deploy/0.3/tests/pre-apply-task-hook.sh b/task/blue-green-deploy/0.3/tests/pre-apply-task-hook.sh new file mode 100644 index 0000000000..ef87180767 --- /dev/null +++ b/task/blue-green-deploy/0.3/tests/pre-apply-task-hook.sh @@ -0,0 +1,46 @@ +#!/bin/bash +#This will create a sample deployment version v1 of the application and a service which will point to that deployment + +cat <- + This Task deploys an application to a Google Kubernetes Engine + cluster using gke-deploy + + workspaces: + - name: source + params: + - name: ARGS + type: array + description: gke-deploy CLI arguments to run + default: ["--help"] + steps: + - name: gke-deploy + image: gcr.io/cloud-builders/gke-deploy@sha256:6d18a1efabf8a7ea7f2169c93f3e01fc5b8247b12099618c496ab097aaae341f + command: ["/gke-deploy"] + workingDir: $(workspaces.source.path) + args: ["$(params.ARGS)"] diff --git a/task/gke-deploy/0.2/samples/app/Dockerfile b/task/gke-deploy/0.2/samples/app/Dockerfile new file mode 100644 index 0000000000..58aefc7666 --- /dev/null +++ b/task/gke-deploy/0.2/samples/app/Dockerfile @@ -0,0 +1,20 @@ +# Copyright 2019 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FROM python:3.7-slim +RUN pip install flask +WORKDIR /app +COPY app.py /app/app.py +ENTRYPOINT ["python"] +CMD ["/app/app.py"] diff --git a/task/gke-deploy/0.2/samples/app/app.py b/task/gke-deploy/0.2/samples/app/app.py new file mode 100644 index 0000000000..69c78d5baf --- /dev/null +++ b/task/gke-deploy/0.2/samples/app/app.py @@ -0,0 +1,25 @@ +# Copyright 2019 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Server that returns a declaration to the world.""" +from flask import Flask +app = Flask('test-app') + + +@app.route('/') +def hello(): + return 'Hello, World!\n' + +if __name__ == '__main__': + app.run(host='0.0.0.0', port=80) diff --git a/task/gke-deploy/0.2/samples/app/config/app.yaml b/task/gke-deploy/0.2/samples/app/config/app.yaml new file mode 100644 index 0000000000..9f67b8935c --- /dev/null +++ b/task/gke-deploy/0.2/samples/app/config/app.yaml @@ -0,0 +1,53 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gke-deploy-tekton-demo + labels: + app: gke-deploy-tekton-demo +spec: + replicas: 3 + selector: + matchLabels: + app: gke-deploy-tekton-demo + template: + metadata: + labels: + app: gke-deploy-tekton-demo + spec: + containers: + - name: gke-deploy-tekton-demo + image: gcr.io/@IMAGE_REGISTRY_PROJECT@/gke-deploy-tekton-demo +--- +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: gke-deploy-tekton-demo-hpa + labels: + app: gke-deploy-tekton-demo +spec: + scaleTargetRef: + kind: Deployment + name: gke-deploy-tekton-demo + apiVersion: apps/v1 + minReplicas: 1 + maxReplicas: 5 + metrics: + - type: Resource + resource: + name: cpu + targetAverageUtilization: 80 +--- +apiVersion: v1 +kind: Service +metadata: + name: gke-deploy-tekton-demo-service + labels: + app: gke-deploy-tekton-demo +spec: + selector: + app: gke-deploy-tekton-demo + ports: + - protocol: TCP + port: 80 + targetPort: 80 + type: LoadBalancer diff --git a/task/gke-deploy/0.2/samples/build-push-gke-deploy-example.md b/task/gke-deploy/0.2/samples/build-push-gke-deploy-example.md new file mode 100644 index 0000000000..cb6eab8fab --- /dev/null +++ b/task/gke-deploy/0.2/samples/build-push-gke-deploy-example.md @@ -0,0 +1,219 @@ +# Build, push, and deploy with the `build-push-gke-deploy` Pipeline Example + +This guide walks through a detailed example that demonstrates using the `build-push-gke-deploy` Pipeline to build, push, and deploy an application in a Git repository to a GKE cluster. + +## Set up your Tekton cluster, Google service account, and Kubernetes service account + +1. Follow the instructions [here](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable_workload_identity_on_a_new_cluster) to create a new GKE cluster with Workload Identity enabled, create a Google service account, and create a Kubernetes service account for your Pipeline that binds to the Google service account. + +1. Follow the instructions [here](https://github.com/tektoncd/pipeline/blob/main/docs/install.md#installing-tekton-pipelines-1) to install Tekton Pipelines onto your cluster. + + Alternatively, set the variables below and run the script to automate the above steps. + ```bash + TEKTON_CLUSTER_NAME=[NAME] + TEKTON_CLUSTER_LOCATION=[REGION/ZONE] + TEKTON_CLUSTER_PROJECT=[PROJECT_ID] + K8S_SA_NAME=[KUBERNETES_SERVICE_ACCOUNT_NAME] + GOOGLE_SA_NAME=[GOOGLE_SERVICE_ACCOUNT_NAME] + + # Create a GKE cluster with Workload Identity enabled + gcloud beta container clusters create $TEKTON_CLUSTER_NAME \ + --zone=$TEKTON_CLUSTER_LOCATION \ + --project=$TEKTON_CLUSTER_PROJECT \ + --identity-namespace=$TEKTON_CLUSTER_PROJECT.svc.id.goog + + # Configure kubectl to communicate with the cluster + gcloud container clusters get-credentials $TEKTON_CLUSTER_NAME \ + --zone=$TEKTON_CLUSTER_LOCATION \ + --project=$TEKTON_CLUSTER_PROJECT + + # Create the Kubernetes service account that your TaskRun will run as + kubectl create serviceaccount $K8S_SA_NAME + + # Create the Google service account that the Kubernetes service account will bind to + gcloud iam service-accounts create $GOOGLE_SA_NAME --project=$TEKTON_CLUSTER_PROJECT + + # Bind the Google service account and Kubernetes service account. + gcloud iam service-accounts add-iam-policy-binding \ + --role roles/iam.workloadIdentityUser \ + --project=$TEKTON_CLUSTER_PROJECT \ + --member "serviceAccount:$TEKTON_CLUSTER_PROJECT.svc.id.goog[default/$K8S_SA_NAME]" $GOOGLE_SA_NAME@$TEKTON_CLUSTER_PROJECT.iam.gserviceaccount.com + kubectl annotate serviceaccount $K8S_SA_NAME iam.gke.io/gcp-service-account=$GOOGLE_SA_NAME@$TEKTON_CLUSTER_PROJECT.iam.gserviceaccount.com + + # Install Tekton Pipelines + kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml + ``` + +## Install Tekton Pipelines CLI + +Install the Tekton Pipelines CLI to view your logs by following the instructions for your machine at https://github.com/tektoncd/cli. + +## Set up your repo + +1. Fork and clone this [GitHub repo](https://github.com/tektoncd/catalog). See [here](https://help.github.com/en/github/getting-started-with-github/fork-a-repo) for more information on forking a repo. + +2. Clone the forked repo onto your local machine and cd into the directory. + + ```bash + GITHUB_USER=[YOUR_USERNAME] + git clone https://github.com/$GITHUB_USER/catalog + # Use `git clone git@github.com:$GITHUB_USER/catalog.git` if you use two-factor authentication + cd catalog + ``` + +3. Modify the manifests in the demo app to use a project you own for its image (this may be the same project as the one with the cluster that is running Tekton Pipelines). + + ```bash + IMAGE_REGISTRY_PROJECT=[PROJECT_ID] + sed -i "s/@IMAGE_REGISTRY_PROJECT@/$IMAGE_REGISTRY_PROJECT/g" gke-deploy/example/app/config/app.yaml + ``` + +4. Commit and push your changes to a new branch. + + ```bash + git checkout -b gke-deploy-demo + git commit -a -m "Set gke-deploy demo image project name." + git push + ``` + +## Run Pipeline + +1. Create the target cluster that gke-deploy will deploy your application to. + + ```bash + DEPLOY_CLUSTER_NAME=[NAME] + DEPLOY_CLUSTER_LOCATION=[REGION/ZONE] + DEPLOY_CLUSTER_PROJECT=[PROJECT_ID] + gcloud container clusters create $DEPLOY_CLUSTER_NAME --zone=$DEPLOY_CLUSTER_LOCATION --project=$DEPLOY_CLUSTER_PROJECT + ``` + +2. Add the `roles/storage.admin` role to the Google service account set up above in the project that the image will be pushed to (this may be the same project as the one with the cluster that is running Tekton Pipelines). This will allow the Pipeline to push an image to your project, as defined [here](https://cloud.google.com/container-registry/docs/access-control). + + ```bash + IMAGE_REGISTRY_PROJECT=[PROJECT_ID] + GOOGLE_SA_NAME=[GOOGLE_SERVICE_ACCOUNT_NAME] + TEKTON_CLUSTER_PROJECT=[PROJECT_ID] + gcloud projects add-iam-policy-binding $IMAGE_REGISTRY_PROJECT --role roles/storage.admin --member "serviceAccount:$GOOGLE_SA_NAME@$TEKTON_CLUSTER_PROJECT.iam.gserviceaccount.com" --project=$IMAGE_REGISTRY_PROJECT + ``` + +3. Add the `roles/container.developer` role to the Google service account set up above in the project of the target cluster (this may be the same project as the one with the cluster that is running Tekton Pipelines). This will allow the Pipeline to deploy your application to your cluster. + + ```bash + DEPLOY_CLUSTER_PROJECT=[PROJECT_ID] + GOOGLE_SA_NAME=[GOOGLE_SERVICE_ACCOUNT_NAME] + TEKTON_CLUSTER_PROJECT=[PROJECT_ID] + gcloud projects add-iam-policy-binding $DEPLOY_CLUSTER_PROJECT --role roles/container.developer --member "serviceAccount:$GOOGLE_SA_NAME@$TEKTON_CLUSTER_PROJECT.iam.gserviceaccount.com" --project=$DEPLOY_CLUSTER_PROJECT + ``` + +4. Install the `build-push-gke-deploy` Pipeline. + + ```bash + kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/gke-deploy/ + ``` + +5. Create the `PipelineRun` config to run your Pipeline. + + ```bash + K8S_SA_NAME=[KUBERNETES_SERVICE_ACCOUNT_NAME] + GITHUB_USER=[YOUR_USERNAME] + IMAGE_REGISTRY_PROJECT=[PROJECT_ID] + DEPLOY_CLUSTER_NAME=[NAME] + DEPLOY_CLUSTER_LOCATION=[REGION/ZONE] + DEPLOY_CLUSTER_PROJECT=[PROJECT_ID] + + cat >build-push-gke-deploy-run.yaml <- + These tasks will install / upgrade a helm chart into your Kubernetes / + OpenShift Cluster using Helm + + params: + - name: helm_repo + description: "Specify a specific helm repo" + - name: chart_name + description: "Specify chart name that will be deployed" + - name: release_version + description: The helm release version in semantic versioning format + default: "v1.0.0" + - name: release_name + description: The helm release name + default: "helm-release" + - name: release_namespace + description: The helm release namespace + default: "" + - name: overwrite_values + description: "Specify the values you want to overwrite, comma separated: autoscaling.enabled=true,replicas=1" + default: "" + - name: helm_image + description: "Specify a specific helm image" + default: "docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b" # tag: v3.10.2 + steps: + - name: upgrade-from-repo + image: $(params.helm_image) + script: | + echo current installed helm releases + helm list --namespace "$(params.release_namespace)" + echo parsing helms repo name... + REPO=`echo "$(params.chart_name)" | cut -d "/" -f 1` + echo adding helm repo... + helm repo add $REPO "$(params.helm_repo)" + echo adding updating repo... + helm repo update + echo installing helm chart... + helm upgrade --wait --install --namespace "$(params.release_namespace)" $(params.release_name) $(params.chart_name) --debug --set "$(params.overwrite_values)" diff --git a/task/helm-upgrade-from-repo/0.4/samples/helm-upgrade-from-repo-task-run.yaml.tmpl b/task/helm-upgrade-from-repo/0.4/samples/helm-upgrade-from-repo-task-run.yaml.tmpl new file mode 100644 index 0000000000..babe573b5d --- /dev/null +++ b/task/helm-upgrade-from-repo/0.4/samples/helm-upgrade-from-repo-task-run.yaml.tmpl @@ -0,0 +1,18 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: example-helm-upgrade-from-repo +spec: + taskRef: + name: helm-upgrade-from-repo + params: + - name: helm_repo + value: https://charts.helm.sh/stable + - name: chart_name + value: stable/envoy + - name: release_version + value: v1.0.0 + - name: release_name + value: helm-repo-sample + - name: overwrite_values + value: autoscaling.enabled=true,autoscaling.maxReplicas=3 \ No newline at end of file diff --git a/task/helm-upgrade-from-repo/0.4/tests/pre-apply-task-hook.sh b/task/helm-upgrade-from-repo/0.4/tests/pre-apply-task-hook.sh new file mode 100755 index 0000000000..4bb7ad3104 --- /dev/null +++ b/task/helm-upgrade-from-repo/0.4/tests/pre-apply-task-hook.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Add service account +kubectl -n ${tns} create serviceaccount helm-pipeline-run-sa + +# Add edit role to service account +kubectl -n ${tns} create rolebinding helm-pipeline-run-sa-edit --clusterrole edit --serviceaccount ${tns}:helm-pipeline-run-sa -o yaml --dry-run=client | kubectl apply -f - diff --git a/task/helm-upgrade-from-repo/0.4/tests/run.yaml b/task/helm-upgrade-from-repo/0.4/tests/run.yaml new file mode 100644 index 0000000000..147efd0cfe --- /dev/null +++ b/task/helm-upgrade-from-repo/0.4/tests/run.yaml @@ -0,0 +1,31 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: helm-upgrade-test-pipeline +spec: + tasks: + - name: helm-upgrade-from-repo + taskRef: + name: helm-upgrade-from-repo + params: + - name: helm_repo + value: https://dunefro.github.io/sample-charts/ + - name: chart_name + value: sample-charts/sample-nginx + - name: release_version + value: v1.0.0 + - name: release_name + value: helm-repo-sample + - name: overwrite_values + value: autoscaling.enabled=false,autoscaling.maxReplicas=3 +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: helm-upgrade-test-pipeline-run +spec: + taskRunTemplate: + serviceAccountName: helm-pipeline-run-sa + pipelineRef: + name: helm-upgrade-test-pipeline diff --git a/task/helm-upgrade-from-source/0.5/README.md b/task/helm-upgrade-from-source/0.5/README.md new file mode 100644 index 0000000000..29330e0b05 --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/README.md @@ -0,0 +1,65 @@ +# Helm + +These tasks will install / upgrade a helm chart into your Kubernetes / OpenShift Cluster using [Helm](https://github.com/helm/helm). + +## Install the Task + +### helm install / upgrade from source code + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/helm-upgrade-from-source/0.5/helm-upgrade-from-source.yaml +``` + +#### Parameters + +- **charts_dir**: The directory in the source repository where the installable chart should be found. +- **release_version**: The version of the release (*default: v1.0.0*) +- **release_name**: The name of the release (*default: helm-release*) +- **release_namespace**: The namespace in which the release is to be installed (*default: ""*) +- **overwrite_values**: The values to be overwritten (*default: ""*) +- **values_file**: The values file to be used, + assumes the values file is in the same dir as your charts_dir (*default: "values.yaml"*) +- **helm_image**: The helm image which should be used (*default: lachlanevenson/k8s-helm:v3.3.4*) +- **upgrade_extra_params**: Extra parameters passed for the helm upgrade command (*default: ""*) + +#### Workspaces + +* **source**: A [Workspace](https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md) containing the helm chart. + +#### Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms. + +## Usage + +### PipelineRun + +An example `Pipeline` with a `PipelineRun` can be found in the subdirectory `tests`. + +### TaskRun + +This `TaskRun` runs the task to retrieve a Git repo and then installs/updates the helm chart that is in the Git repo. + +```yaml +# example upgrade from source +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: example-helm-upgrade-from-source +spec: + taskRef: + name: helm-upgrade-from-source + params: + - name: charts_dir + value: helm-sample-chart + - name: releases_version + value: v1.0.0 + - name: release_name + value: helm-source-sample + - name: overwrite_values + value: "autoscaling.enabled=true,autoscaling.maxReplicas=3" + workspaces: + - name: source + persistentVolumeClaim: + claimName: my-source +``` \ No newline at end of file diff --git a/task/helm-upgrade-from-source/0.5/helm-upgrade-from-source.yaml b/task/helm-upgrade-from-source/0.5/helm-upgrade-from-source.yaml new file mode 100644 index 0000000000..d4778acd2a --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/helm-upgrade-from-source.yaml @@ -0,0 +1,52 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: helm-upgrade-from-source + labels: + app.kubernetes.io/version: "0.5" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: helm + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + These tasks will install / upgrade a helm chart into your Kubernetes / + OpenShift Cluster using Helm + + params: + - name: charts_dir + description: The directory in source that contains the helm chart + - name: release_version + description: The helm release version in semantic versioning format + default: "v1.0.0" + - name: release_name + description: The helm release name + default: "helm-release" + - name: release_namespace + description: The helm release namespace + default: "" + - name: overwrite_values + description: "Specify the values you want to overwrite, comma separated: autoscaling.enabled=true,replicas=1" + default: "" + - name: values_file + description: "The values file to be used" + default: "values.yaml" + - name: helm_image + description: "helm image to be used" + default: "docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b" # tag: v3.10.2 + - name: upgrade_extra_params + description: "Extra parameters passed for the helm upgrade command" + default: "" + workspaces: + - name: source + steps: + - name: upgrade + image: $(params.helm_image) + workingDir: /workspace/source + script: | + echo current installed helm releases + helm list --namespace "$(params.release_namespace)" + + echo installing helm chart... + helm upgrade --install --wait --values "$(params.charts_dir)/$(params.values_file)" --namespace "$(params.release_namespace)" --version "$(params.release_version)" "$(params.release_name)" "$(params.charts_dir)" --debug --set "$(params.overwrite_values)" $(params.upgrade_extra_params) diff --git a/task/helm-upgrade-from-source/0.5/samples/helm-upgrade-from-source-task-run.yaml.tmpl b/task/helm-upgrade-from-source/0.5/samples/helm-upgrade-from-source-task-run.yaml.tmpl new file mode 100644 index 0000000000..62fa4a7539 --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/samples/helm-upgrade-from-source-task-run.yaml.tmpl @@ -0,0 +1,20 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: example-helm-upgrade-from-source +spec: + taskRef: + name: helm-upgrade-from-source + params: + - name: charts_dir + value: helm-sample-chart + - name: releases_version + value: v1.0.0 + - name: release_name + value: helm-source-sample + - name: overwrite_values + value: "autoscaling.enabled=true,autoscaling.maxReplicas=3" + workspaces: + - name: source + persistentVolumeClaim: + claimName: my-source \ No newline at end of file diff --git a/task/helm-upgrade-from-source/0.5/tests/pre-apply-task-hook.sh b/task/helm-upgrade-from-source/0.5/tests/pre-apply-task-hook.sh new file mode 100755 index 0000000000..69b7af1548 --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/tests/pre-apply-task-hook.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# Add git-clone +add_task git-clone latest + +# Add service account +kubectl -n ${tns} create serviceaccount helm-pipeline-run-sa + +# Add edit role to service account +kubectl -n ${tns} create rolebinding helm-pipeline-run-sa-edit --clusterrole edit --serviceaccount ${tns}:helm-pipeline-run-sa -o yaml --dry-run=client | kubectl apply -f - diff --git a/task/helm-upgrade-from-source/0.5/tests/resources.yaml b/task/helm-upgrade-from-source/0.5/tests/resources.yaml new file mode 100644 index 0000000000..5610684da6 --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/tests/resources.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: helm-source-pvc +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 200Mi diff --git a/task/helm-upgrade-from-source/0.5/tests/run.yaml b/task/helm-upgrade-from-source/0.5/tests/run.yaml new file mode 100644 index 0000000000..b7b5f541e5 --- /dev/null +++ b/task/helm-upgrade-from-source/0.5/tests/run.yaml @@ -0,0 +1,55 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: helm-upgrade-test-pipeline +spec: + workspaces: + - name: shared-workspace + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: shared-workspace + params: + - name: url + value: https://github.com/helm/examples + - name: subdirectory + value: "" + - name: deleteExisting + value: "true" + - name: helm-upgrade-from-source + taskRef: + name: helm-upgrade-from-source + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: shared-workspace + params: + - name: charts_dir + value: charts/hello-world + - name: release_version + value: v1.0.0 + - name: release_name + value: helm-source-sample + - name: overwrite_values + value: "autoscaling.enabled=true,autoscaling.maxReplicas=3" + - name: upgrade_extra_params + value: "--force" +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: helm-upgrade-test-pipeline-run +spec: + taskRunTemplate: + serviceAccountName: helm-pipeline-run-sa + pipelineRef: + name: helm-upgrade-test-pipeline + workspaces: + - name: shared-workspace + persistentVolumeClaim: + claimName: helm-source-pvc \ No newline at end of file diff --git a/task/istio-canary-release/0.2/README.md b/task/istio-canary-release/0.2/README.md new file mode 100644 index 0000000000..61d8b73fe2 --- /dev/null +++ b/task/istio-canary-release/0.2/README.md @@ -0,0 +1,64 @@ +# Canary Release using Istio + +The following task can be used to do canary deployment by doing a canary traffic routing to the deployed versions. + +When the new version of application is deployed, you can start routing a few selected users to it. As you gain more confidence in the new version, you can start releasing it to more servers in your infrastructure and routing more users to it. + +For more details about canary release please refer [here](https://martinfowler.com/bliki/CanaryRelease.html) + +### **PRE-REQUISITE**: Istio should already be installed in the same cluster. + +## Installing the tasks + +1. For Application Manifests deployment we can use the existing `kubenetes-actions` task from the catalog + +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kubernetes-actions/0.1/kubernetes-actions.yaml +``` + +2. For Istio Services + +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/istio-canary-release/0.2/istio-canary-release.yaml +``` + +## Installing the ClusterRoleBinding + +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/istio-canary-release/0.2/support/clusterrolebinding.yaml +``` + +## Workspaces + +- **deployment-manifest-dir**: The workspace in which `ConfigMap` containing all the deployment manifests will be mounted. +- **istio-manifest-dir**: The workspace in which `ConfigMap` containing the istio related manifests will be mounted. + +## Params for Canary-Istio-Deploy + +- **VS_NAME**: The name of the `VirtualService` +- **V1_WEIGHT**: The traffic weight to be diverted to existing version v1 +- **V2_WEIGHT**: The traffic weight to be diverted to new version v2 + +**Note**: The above parameters are used in case we need to do traffic splitting using virtual service and for creating a `VirtualService` then use the `ConfigMap` as shown below. + +## Platforms + +The Task can be run on `linux/amd64` platform. + +# Usage + +1. Create `ConfigMap` for `Istio` manifests + +```bash +kubectl create configmap istio --from-file="./samples/application/app-gateway.yaml" +``` + +2. Create `ConfigMap` for `Deployment` manifests + +```bash +kubectl create configmap deployment --from-file="isto-canary-release/samples/application/myapp.yaml" +``` + +In case of app deployment and configuring Istio follow [this](./samples/run.yaml) example. + +In case of just re-configuring the Istio follow [this](./samples/taskrun.yaml) example. diff --git a/task/istio-canary-release/0.2/istio-canary-release.yaml b/task/istio-canary-release/0.2/istio-canary-release.yaml new file mode 100644 index 0000000000..588e38d03e --- /dev/null +++ b/task/istio-canary-release/0.2/istio-canary-release.yaml @@ -0,0 +1,74 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: istio-canary-release + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: canary deployment, istio + tekton.dev/displayName: "istio canary release" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task can be used to perform deployment of an application + using canary release strategy. + + Using this task we can route the traffic to the deployments + with the help of virtual service by specifying the weights to + individual deployment. + + workspaces: + - name: istio-manifest-dir + description: >- + The workspace consisting of Istio manifests such as Gateway, + DestinationRule and VirtualService in case applying for the + first time. + params: + - name: VS_NAME + description: The virtual service name to be patched + type: string + default: "" + - name: V1_WEIGHT + description: The traffic percentage to be sent to version v1 + type: string + default: "" + - name: V2_WEIGHT + description: The traffic percentage to be sent to version v2 + type: string + default: "" + steps: + - name: canary-deploy + image: quay.io/openshift/origin-cli:4.6@sha256:6722d5041b472ac61a294647f7fa02fb432a948835bb780cc73cd221a9291a2c + workingDir: $(workspaces.istio-manifest-dir.path) + script: | + #!/usr/bin/env bash + + cat </tmp/patch.yaml + apiVersion: networking.istio.io/v1alpha3 + kind: VirtualService + metadata: + name: $(params.VS_NAME) + spec: + hosts: + - "*" + gateways: + - app-gateway + http: + - route: + - destination: + host: myapp + subset: v1 + weight: $(params.V1_WEIGHT) + - destination: + host: myapp + subset: v2 + weight: $(params.V2_WEIGHT) + EOF + + if [ -n "$(params.V1_WEIGHT)" -a -n "$(params.V2_WEIGHT)" ]; then + kubectl replace -f /tmp/patch.yaml + else + kubectl apply -f ./ + fi diff --git a/task/istio-canary-release/0.2/samples/application/app-gateway.yaml b/task/istio-canary-release/0.2/samples/application/app-gateway.yaml new file mode 100644 index 0000000000..496cfd2469 --- /dev/null +++ b/task/istio-canary-release/0.2/samples/application/app-gateway.yaml @@ -0,0 +1,48 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: app-gateway +spec: + selector: + istio: ingressgateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: myapp +spec: + host: myapp + subsets: + - name: v1 + labels: + version: v1 + - name: v2 + labels: + version: v2 +--- +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: myapp +spec: + hosts: + - "*" + gateways: + - app-gateway + http: + - route: + - destination: + host: myapp + subset: v1 + weight: 20 + - destination: + host: myapp + subset: v2 + weight: 80 diff --git a/task/istio-canary-release/0.2/samples/application/myapp.yaml b/task/istio-canary-release/0.2/samples/application/myapp.yaml new file mode 100644 index 0000000000..860c85842c --- /dev/null +++ b/task/istio-canary-release/0.2/samples/application/myapp.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: Service +metadata: + name: myapp + labels: + app: myapp +spec: + type: ClusterIP + ports: + - port: 80 + name: http + selector: + app: myapp +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: myapp-v1 +spec: + replicas: 1 + selector: + matchLabels: + app: myapp + version: v1 + template: + metadata: + labels: + app: myapp + version: v1 + spec: + containers: + - name: myapp + image: janakiramm/myapp:v1 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 80 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: myapp-v2 +spec: + replicas: 1 + selector: + matchLabels: + app: myapp + version: v2 + template: + metadata: + labels: + app: myapp + version: v2 + spec: + containers: + - name: myapp + image: janakiramm/myapp:v2 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 80 diff --git a/task/istio-canary-release/0.2/samples/run.yaml b/task/istio-canary-release/0.2/samples/run.yaml new file mode 100644 index 0000000000..6b847b4e1e --- /dev/null +++ b/task/istio-canary-release/0.2/samples/run.yaml @@ -0,0 +1,49 @@ +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: canary-deployment +spec: + workspaces: + - name: deployment-manifest-dir + - name: istio-manifest-dir + - name: kubeconfig-dir + tasks: + - name: app-deploy + taskRef: + name: kubernetes-actions + params: + - name: args + value: + - apply + - -f + - "." + workspaces: + - name: manifest-dir + workspace: deployment-manifest-dir + - name: kubeconfig-dir + workspace: kubeconfig-dir + - name: deploy-istio-service + taskRef: + name: istio-canary-release + runAfter: + - app-deploy + workspaces: + - name: istio-manifest-dir + workspace: istio-manifest-dir +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: canary-deployment-run +spec: + pipelineRef: + name: canary-deployment + workspaces: + - name: deployment-manifest-dir + configMap: + name: deployment + - name: istio-manifest-dir + configMap: + name: istio + - name: kubeconfig-dir + emptyDir: {} diff --git a/task/istio-canary-release/0.2/samples/taskrun.yaml b/task/istio-canary-release/0.2/samples/taskrun.yaml new file mode 100644 index 0000000000..f39f57313b --- /dev/null +++ b/task/istio-canary-release/0.2/samples/taskrun.yaml @@ -0,0 +1,17 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: istio-run +spec: + taskRef: + name: istio-canary-release + params: + - name: VS_NAME + value: myapp + - name: V1_WEIGHT + value: "50" + - name: V2_WEIGHT + value: "50" + workspaces: + - name: istio-manifest-dir + configMap: + name: istio diff --git a/task/istio-canary-release/0.2/support/clusterrolebinding.yaml b/task/istio-canary-release/0.2/support/clusterrolebinding.yaml new file mode 100644 index 0000000000..e82b23ce3b --- /dev/null +++ b/task/istio-canary-release/0.2/support/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: default-canary +subjects: + - kind: ServiceAccount + name: default + namespace: default +roleRef: + kind: ClusterRole + name: cluster-admin + apiGroup: rbac.authorization.k8s.io diff --git a/task/kamel-run/0.2/README.md b/task/kamel-run/0.2/README.md new file mode 100644 index 0000000000..f7fc71ccd5 --- /dev/null +++ b/task/kamel-run/0.2/README.md @@ -0,0 +1,52 @@ +# Kamel run + +This Task creates and run a [Camel K](https://github.com/apache/camel-k) Integration. + +If you have installed Camel K operator, you can configure the `kamel-run` task the step to create the Integration that will be operated by Camel K. You can configure the parameter to delegate the build of your application to Camel K or do it as a part of previous pipelines steps. + +## Install the Task + +```shell +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kamel-run/0.2/kamel-run.yaml +``` + +## Parameters + +- **camel-k-image**: The name of the image containing the Kamel CLI (_default:_ docker.io/apache/camel-k:1.12.0). +- **filename**: the file containing the Integration source. +- **namespace**: the namespace where to run the Integration (_default:_ the task execution namespace). +- **container-image**: the container image to use for this Integration. Useful when you want to build your own container for the Integration (_default:_ empty, will trigger an Integration build). +- **wait**: wait for the Integration to run before finishing the task. Useful when you want to get the **integration-phase** result (_default:_ "false"). + +## Workspaces + +* **source**: A [Workspace](https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md) containing the Integration source to run. + +## Results + +- **integration-name**: the Integration name which was created/updated. +- **integration-phase**: the status of the Integration, tipycally used with **wait: true** input parameter. + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +The Task can be used in several ways to accomodate the different build and deployment strategy you may have. + +### Create the Service Account + +As we will do delegate the task, the creation of an Integration, we need to provide a `ServiceAccount` with the privileges required by the tasks: + +```shell +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kamel-run/0.2/support/camel-k-tekton.yaml +``` + +### Delegate build to operator + +Use the [Tekton Camel K operator builder sample](../0.2/samples/run-operator-build.yaml) in order to fetch a Git repository and run a Camel K Integration delegating the build to the Camel K operator. + +### Full pipeline with custom build + +Use the [Tekton Camel K external builder sample](../0.2/samples/run-external-build.yaml) as a reference for a full pipeline where you define your own process of building the Camel application and using the `kamel-run` Task as last step in order to deploy the Integration and let Camel K operator managing it. \ No newline at end of file diff --git a/task/kamel-run/0.2/kamel-run.yaml b/task/kamel-run/0.2/kamel-run.yaml new file mode 100644 index 0000000000..5ff09909de --- /dev/null +++ b/task/kamel-run/0.2/kamel-run.yaml @@ -0,0 +1,58 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: kamel-run + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/categories: Deployment + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/tags: cli + tekton.dev/platforms: "linux/amd64" + tekton.dev/displayName: "kamel run" +spec: + description: >- + Run a Camel Integration + + Kamel-run task creates a Camel K Integration which will be taken and operated by Camel K operator. You can either use this task to + run a build from source or build the application in previous tasks and use this last task to deploy and let Camel K operates it. + params: + - name: camel-k-image + description: The location of Camel K CLI image. + default: docker.io/apache/camel-k:2.0.0 + - name: filename + description: the Integration source we want to run + - name: namespace + description: the namespace where to run the integration + default: "" + - name: container-image + description: the custom container image to use (if the build was performed as part of previous tasks) + default: "" + - name: wait + description: wait for the Integration to run before exiting the task + default: "false" + results: + - name: integration-name + description: The name of the integration created + - name: integration-phase + description: The phase of the integration created (when used with input `wait` parameter) + workspaces: + - name: source + steps: + - name: execute + image: $(params.camel-k-image) + workingDir: $(workspaces.source.path) + script: | + #!/usr/bin/env bash + + KAMEL_RUN_ARGS=() + + KAMEL_RUN_ARGS+=("$(params.filename)") + [[ ! "$(params.namespace)" == "" ]] && KAMEL_RUN_ARGS+=(-n "$(params.namespace)") + [[ ! "$(params.container-image)" == "" ]] && KAMEL_RUN_ARGS+=(-t "container.image=$(params.container-image)") + [[ "$(params.wait)" == "true" ]] && KAMEL_RUN_ARGS+=(--wait) + kamel_output=$(kamel run "${KAMEL_RUN_ARGS[@]}") + echo "$kamel_output" + # Let's use the output produced to scrape the integration name and phase + echo "$kamel_output" | grep -oP 'Integration ".*?" (updated|created|unchanged)' | awk -F ' ' '{print $2}' | sed "s/\"//g" | tr -d '\n' | tee "$(results.integration-name.path)" + kamel get "$(cat "$(results.integration-name.path)")" 2>/dev/null | tail -n +2 | awk -F ' ' '{print $2}' | tr -d '\n' | tee "$(results.integration-phase.path)" \ No newline at end of file diff --git a/task/kamel-run/0.2/samples/run-external-build.yaml b/task/kamel-run/0.2/samples/run-external-build.yaml new file mode 100644 index 0000000000..110ace3341 --- /dev/null +++ b/task/kamel-run/0.2/samples/run-external-build.yaml @@ -0,0 +1,106 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: external-build +spec: + workspaces: + - name: shared-workspace + - name: maven-settings + tasks: + # Fetch git repo + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: shared-workspace + params: + - name: url + value: https://github.com/apache/camel-k-runtime + # Build the application + - name: maven-build + taskRef: + name: maven + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: shared-workspace + - name: maven-settings + workspace: maven-settings + params: + - name: CONTEXT_DIR + value: "examples/yaml" + - name: GOALS + value: + - clean + - package + # Create the dockerfile (could be already in the git project, in such case, just skip this task) + - name: create-dockerfile + runAfter: + - maven-build + workspaces: + - name: source + workspace: shared-workspace + taskSpec: + steps: + - name: bash + image: ubuntu + script: | + echo "FROM docker.io/eclipse-temurin:17-jdk" > $(workspaces.source.path)/examples/yaml/Dockerfile + echo "COPY target/quarkus-app/ /deployments/dependencies/" >> $(workspaces.source.path)/examples/yaml/Dockerfile + # Build and push the container with the Camel application + - name: docker-build + taskRef: + name: buildah + runAfter: + - create-dockerfile + workspaces: + - name: source + workspace: shared-workspace + params: + - name: IMAGE + # Provide your container registry configuration accordingly! + value: 10.110.149.72/camel-k/my-camel-image + - name: TLSVERIFY + value: "false" + - name: CONTEXT + value: $(workspaces.source.path)/examples/yaml + # Run the Camel Integration, using the container image built previously + - name: kamel-run + taskRef: + name: kamel-run + runAfter: + - docker-build + workspaces: + - name: source + workspace: shared-workspace + params: + - name: filename + value: examples/yaml/data/routes.yaml + - name: container-image + value: $(tasks.docker-build.results.IMAGE_URL) + +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: external-build-run +spec: + pipelineRef: + name: external-build + taskRunSpecs: + - pipelineTaskName: kamel-run + taskServiceAccountName: camel-k-tekton + workspaces: + - name: shared-workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + - name: maven-settings + emptyDir: {} diff --git a/task/kamel-run/0.2/samples/run-operator-build.yaml b/task/kamel-run/0.2/samples/run-operator-build.yaml new file mode 100644 index 0000000000..1574f965f2 --- /dev/null +++ b/task/kamel-run/0.2/samples/run-operator-build.yaml @@ -0,0 +1,50 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: operator-build +spec: + workspaces: + - name: shared-workspace + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: shared-workspace + params: + - name: url + value: https://github.com/apache/camel-k-examples/ + - name: kamel-run + taskRef: + name: kamel-run + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: shared-workspace + params: + - name: filename + value: generic-examples/languages/routes.yaml + +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: operator-build-run +spec: + pipelineRef: + name: operator-build + taskRunSpecs: + - pipelineTaskName: kamel-run + taskServiceAccountName: camel-k-tekton + workspaces: + - name: shared-workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/task/kamel-run/0.2/support/camel-k-tekton.yaml b/task/kamel-run/0.2/support/camel-k-tekton.yaml new file mode 100644 index 0000000000..ca98efdab6 --- /dev/null +++ b/task/kamel-run/0.2/support/camel-k-tekton.yaml @@ -0,0 +1,40 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: camel-k-tekton +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: camel-k-integrations +rules: +- apiGroups: + - camel.apache.org + resources: + - integrations + verbs: + - create + - get + - list + - patch + - update + - watch +- apiGroups: + - camel.apache.org + resources: + - camelcatalogs + verbs: + - list +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: camel-k-tekton-integrations +subjects: +- kind: ServiceAccount + name: camel-k-tekton +roleRef: + kind: Role + name: camel-k-integrations + apiGroup: rbac.authorization.k8s.io diff --git a/task/kamel-run/0.2/tests/pre-apply-task-hook.sh b/task/kamel-run/0.2/tests/pre-apply-task-hook.sh new file mode 100755 index 0000000000..ecadfb1930 --- /dev/null +++ b/task/kamel-run/0.2/tests/pre-apply-task-hook.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +add_sidecar_registry ${TMPF} + +# Install Camel K operator +wget https://github.com/apache/camel-k/releases/download/v2.0.0/camel-k-client-2.0.0-linux-amd64.tar.gz +tar -xvf camel-k-client-2.0.0-linux-amd64.tar.gz +./kamel install --registry localhost:5000 --registry-insecure --wait + +# Add git-clone +add_task git-clone latest +add_task buildah latest +add_task maven latest \ No newline at end of file diff --git a/task/kamel-run/0.2/tests/resources.yaml b/task/kamel-run/0.2/tests/resources.yaml new file mode 100644 index 0000000000..ca98efdab6 --- /dev/null +++ b/task/kamel-run/0.2/tests/resources.yaml @@ -0,0 +1,40 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: camel-k-tekton +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: camel-k-integrations +rules: +- apiGroups: + - camel.apache.org + resources: + - integrations + verbs: + - create + - get + - list + - patch + - update + - watch +- apiGroups: + - camel.apache.org + resources: + - camelcatalogs + verbs: + - list +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: camel-k-tekton-integrations +subjects: +- kind: ServiceAccount + name: camel-k-tekton +roleRef: + kind: Role + name: camel-k-integrations + apiGroup: rbac.authorization.k8s.io diff --git a/task/kamel-run/0.2/tests/run.yaml b/task/kamel-run/0.2/tests/run.yaml new file mode 100644 index 0000000000..0aff732d9f --- /dev/null +++ b/task/kamel-run/0.2/tests/run.yaml @@ -0,0 +1,149 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kamel-run-basic-test +spec: + workspaces: + - name: shared-workspace + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: shared-workspace + params: + - name: url + value: https://github.com/apache/camel-k-examples/ + - name: kamel-run + taskRef: + name: kamel-run + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: shared-workspace + params: + - name: filename + value: generic-examples/languages/routes.yaml + - name: wait + value: "false" + - name: verify-it-phase + runAfter: + - kamel-run + params: + - name: it-name + value: "$(tasks.kamel-run.results.integration-name)" + taskSpec: + params: + - name: it-name + steps: + - name: bash + image: ubuntu + script: | + #!/usr/bin/env bash + set -e + + if [ "$(params.it-name)" != "routes" ]; then + echo "Expected integration name routes (was $(params.it-name))" + exit 1 + fi + exit 0 + +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: kamel-run-basic-test-run +spec: + pipelineRef: + name: kamel-run-basic-test + taskRunSpecs: + - pipelineTaskName: kamel-run + taskServiceAccountName: camel-k-tekton + workspaces: + - name: shared-workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kamel-run-image-test +spec: + workspaces: + - name: shared-workspace + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: shared-workspace + params: + - name: url + value: https://github.com/apache/camel-k-examples/ + - name: kamel-run + taskRef: + name: kamel-run + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: shared-workspace + params: + - name: filename + value: generic-examples/languages/routes.yaml + - name: wait + value: "false" + - name: container-image + value: docker.io/apache/camel-k:2.0.0 + - name: verify-it-phase + runAfter: + - kamel-run + params: + - name: it-name + value: "$(tasks.kamel-run.results.integration-name)" + taskSpec: + params: + - name: it-name + steps: + - name: bash + image: ubuntu + script: | + #!/usr/bin/env bash + set -e + + if [ "$(params.it-name)" != "routes" ]; then + echo "Expected integration name routes (was $(params.it-name))" + exit 1 + fi + exit 0 + +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: kamel-run-image-test-run +spec: + pipelineRef: + name: kamel-run-image-test + taskRunSpecs: + - pipelineTaskName: kamel-run + taskServiceAccountName: camel-k-tekton + workspaces: + - name: shared-workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi \ No newline at end of file diff --git a/task/kn-apply/0.3/README.md b/task/kn-apply/0.3/README.md new file mode 100644 index 0000000000..39ed3738d9 --- /dev/null +++ b/task/kn-apply/0.3/README.md @@ -0,0 +1,73 @@ +# Knative with `kn` + +This task deploys a given image to a Knative Service using +[`kn`](https://github.com/knative/client) command line interface. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn-apply/0.3/kn-apply.yaml +``` + +## Parameters + +* **KN_IMAGE**: `kn` CLI container image to run this task. + + _default_: `gcr.io/knative-releases/knative.dev/client/cmd/kn:latest` + + You can use nightly build of the `kn` CLI using + `gcr.io/knative-nightly/knative.dev/client/cmd/kn`. + +* **SERVICE**: Name of the Knative Service to deploy the given image to. + The service will be created or updated if it exists. + +* **IMAGE**: Container image to run. + +## Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms. + +## Usage + +### Authorizing the Deployment + +In order to create Knative services, you must first define a `ServiceAccount` +with permission to manage Knative resources. + +To create a `ServiceAccount` with these permissions, you can run: + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn-apply/0.3/support/kn-deployer.yaml +``` + +The service account is being created for 'default' namespace, please edit the +file before applying if you are operating in different namespace. + +### Running the Task + +- Following TaskRun deploys a Knative Service using given image. + +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + generateName: kn-apply- +spec: + serviceAccountName: kn-deployer-account # <-- run as the authorized SA + taskRef: + name: kn-apply + params: + - name: SERVICE + value: "hello" + - name: IMAGE + value: "gcr.io/knative-samples/helloworld-go:latest" +``` + +Run this with: + +``` +kubectl create -f kn-apply-taskrun.yaml +``` + +For the first run, this will create the service 'hello' and any subsequent +runs will update the 'hello' service based on your image updates. diff --git a/task/kn-apply/0.3/kn-apply.yaml b/task/kn-apply/0.3/kn-apply.yaml new file mode 100644 index 0000000000..b58894dbb5 --- /dev/null +++ b/task/kn-apply/0.3/kn-apply.yaml @@ -0,0 +1,36 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: kn-apply + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/displayName: "kn apply" + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: Deployment + tekton.dev/tags: cli + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + This task deploys a given image to a Knative Service. + + It uses `kn service apply` to create or update given knative service. + params: + - name: KN_IMAGE + description: kn CLI container image to run this task + default: gcr.io/knative-releases/knative.dev/client/cmd/kn:latest + - name: SERVICE + description: Knative service name + - name: IMAGE + description: Image to deploy + steps: + - name: kn + image: "$(params.KN_IMAGE)" + command: ["/ko-app/kn"] + args: ["service", "apply", "$(params.SERVICE)", "--image", "$(params.IMAGE)"] + securityContext: + runAsNonRoot: true + runAsUser: 65532 + env: + - name: HOME + value: /tekton/home diff --git a/task/kn-apply/0.3/support/kn-deployer.yaml b/task/kn-apply/0.3/support/kn-deployer.yaml new file mode 100644 index 0000000000..c07f1d4d92 --- /dev/null +++ b/task/kn-apply/0.3/support/kn-deployer.yaml @@ -0,0 +1,31 @@ +# Define a ServiceAccount named kn-deployer-account that has permission to +# manage Knative services. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kn-deployer-account + namespace: default +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kn-deployer +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["services", "revisions", "routes"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- + +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: kn-deployer-binding +subjects: +- kind: ServiceAccount + name: kn-deployer-account + namespace: default +roleRef: + kind: ClusterRole + name: kn-deployer + apiGroup: rbac.authorization.k8s.io