Skip to content
24 changes: 24 additions & 0 deletions cicd/tekton-pipelines/cluster-config/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
apiVersion: v2
name: tekton-pipeline-cluster-config
description: A Helm chart for tekton pipeline

# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application

# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.16.0"
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: tekton.dev/v1beta1
kind: ClusterTask
metadata:
name: kaniko-build
name: kaniko
labels:
app.kubernetes.io/version: "0.6"
annotations:
Expand Down
24 changes: 24 additions & 0 deletions cicd/tekton-pipelines/pipeline-template/Chart.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
apiVersion: v2
name: tekton-pipeline-namespace-config
description: A Helm chart for tekton pipeline

# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application

# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.16.0"
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
spec:
serviceAccountName: {{ $.Values.pipelineName }}
triggers:
- name: github-push-event
interceptors:
- ref:
name: "cel"
params:
- name: "filter"
value: >
(
header.match('x-github-event', 'push') && (body.ref == 'refs/heads/main' || body.ref == 'refs/heads/master')
)
- name: "overlays"
value:
- key: image_tag
expression: "\"latest\""
- key: event
expression: "\"push\""
bindings:
- name: revision
value: $(body.head_commit.id)
- name: repo-url
value: $(body.repository.clone_url)
- name: IMAGE
value: ghcr.io/$(body.repository.full_name)
- name: REPONAME
value: $(body.repository.full_name)
- ref: {{ $.Values.pipelineName }}
template:
ref: {{ $.Values.pipelineName }}

- name: tag-event-github
interceptors:
- ref:
name: "cel"
params:
- name: "filter"
value: >
(
header.match('x-github-event', 'create') && (body.ref == 'refs/heads/main' || body.ref == 'refs/heads/master' || body.ref_type == 'tag' )
)
- name: "overlays"
value:
- key: image_tag
expression: "body.ref"
- key: event
expression: "\"tag\""
bindings:
- name: revision
value: $(body.master_branch)
- name: repo-url
value: $(body.repository.clone_url)
- name: REPONAME
value: $(body.repository.full_name)
- name: IMAGE
value: ghcr.io/$(body.repository.full_name)
- ref: trigger-binding
template:
ref: {{ $.Values.pipelineName }}
- name: pull-request-github
interceptors:
- ref:
name: "cel"
params:
- name: "filter"
value: >
(
header.match('x-github-event', 'pull_request') && body.action in ['opened'] && (body.pull_request.base.ref == 'main' || body.pull_request.base.ref == 'master')
)
- name: "overlays"
value:
- key: image_tag
expression: "['pr', string(body.pull_request.number)].join('-')"
- key: event
expression: "\"pull-request\""
bindings:
- name: revision
value: $(body.pull_request.head.sha)
- name: repo-url
value: $(body.repository.clone_url)
- name: IMAGE
value: ghcr.io/$(body.repository.full_name)
- name: REPONAME
value: $(body.repository.full_name)
- ref: {{ $.Values.pipelineName }}
template:
ref: {{ $.Values.pipelineName }}
20 changes: 20 additions & 0 deletions cicd/tekton-pipelines/pipeline-template/templates/ingress.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
annotations:
traefik.ingress.kubernetes.io/rewrite-target: /
spec:
ingressClassName: traefik
rules:
- host: "tekton.{{ $.Values.ingressDomainName }}"
http:
paths:
- path: "/{{ $.Values.pipelineName }}"
pathType: Prefix
backend:
service:
name: "el-{{ $.Values.pipelineName }}"
port:
number: 8080
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
name: github-tekton-ci
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
spec:
description: |
This pipeline clones a git repo, then echoes the README file to the stout.
Expand Down Expand Up @@ -39,9 +40,6 @@ spec:
description: basic-auth
- name: docker-credentials
description: docker cred
- name: cosign
- name: dockerconfig
- name: cosign-pub
tasks:
- name: fetch-source
taskRef:
Expand All @@ -51,7 +49,6 @@ spec:
- name: output
workspace: shared-data
- name: basic-auth
# - name: ssh-directory
workspace: git-credentials
params:
- name: url
Expand All @@ -62,7 +59,7 @@ spec:
value: $(params.revision)
- name: build
taskRef:
name: kaniko-build
name: kaniko
kind: ClusterTask
runAfter:
- fetch-source
Expand All @@ -76,50 +73,6 @@ spec:
value: $(params.pathToContext)
- name: IMAGE
value: $(params.imageUrl):$(params.imageTag)

- name: cosign-sign
runAfter: ["build"]
taskRef:
name: cosign-sign
kind: ClusterTask
workspaces:
- name: source
workspace: shared-data
- name: dockerconfig
workspace: dockerconfig
- name: cosign
workspace: cosign
params:
- name: image
value: "$(params.imageUrl)@$(tasks.build.results.IMAGE_DIGEST)"
- name: eventname
value: "$(params.eventname)"
when:
- input: "$(params.eventname)"
operator: in
values: [ "push" , "tag" ,"release" ]
- name: cosign-image-verify
runAfter: ["cosign-sign"]
taskRef:
name: cosign-image-verify
kind: ClusterTask
workspaces:
- name: source
workspace: shared-data
- name: dockerconfig
workspace: dockerconfig
- name: cosign
workspace: cosign-pub
params:
- name: image
value: "$(params.imageUrl)@$(tasks.build.results.IMAGE_DIGEST)"
- name: eventname
value: "$(params.eventname)"
when:
- input: "$(params.eventname)"
operator: in
values: [ "push" , "tag" , "release" ]

finally:
- name: github-set-status-fail
when:
Expand All @@ -137,13 +90,13 @@ spec:
- name: "REPO_FULL_NAME"
value: "$(params.reponame)"
- name: "GITHUB_TOKEN_SECRET_NAME"
value: "git1"
value: "gitcred-{{ $.Values.pipelineName }}"
- name: "GITHUB_TOKEN_SECRET_KEY"
value: "token"
value: "password"
- name: "SHA"
value: "$(params.revision)"
- name: "TARGET_URL"
value: "http://localhost:8001/api/v1/namespaces/tekton-pipelines/services/tekton-dashboard:http/proxy/"
value: "http://tekton.{{ $.Values.ingressDomainName }}"
#value: "dashboard.domain.app"
- name: "CONTEXT"
value: "tekton-pipeline"
Expand All @@ -166,26 +119,15 @@ spec:
- name: "REPO_FULL_NAME"
value: "$(params.reponame)"
- name: "GITHUB_TOKEN_SECRET_NAME"
value: "git1"
value: "gitcred-{{ $.Values.pipelineName }}"
- name: "GITHUB_TOKEN_SECRET_KEY"
value: "token"
value: "password"
- name: "SHA"
value: "$(params.revision)"
- name: "TARGET_URL"
value: "http://localhost:8001/api/v1/namespaces/tekton-pipelines/services/tekton-dashboard:http/proxy/"
value: "http://tekton.{{ $.Values.ingressDomainName }}"
#value: "dashboard.domain.app"
- name: "CONTEXT"
value: "tekton-pipeline"
- name: "DESCRIPTION"
value: "Finished building your commit in Tekton"











37 changes: 37 additions & 0 deletions cicd/tekton-pipelines/pipeline-template/templates/rbac.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
secrets:
{{- with .Values.secretName }}
{{- range . }}
- name: {{ .name}}
{{- end }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ $.Values.pipelineName }}
rules:
- apiGroups: ["triggers.tekton.dev"]
resources: ["*"]
verbs: ["get", "list", "watch" , "update" , "create"]
- apiGroups: ["tekton.dev"]
resources: ["*"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
subjects:
- kind: ServiceAccount
name: {{ $.Values.pipelineName }}
namespace: {{ $.Values.namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ $.Values.pipelineName }}
Loading