什么是 Tekton?

Tekton 是一个功能强大且灵活的 Kubernetes 原生开源框架，是谷歌开源的，功能强大且灵活，开源社区也正在快速的迭代和发展壮大，主要用于创建持续集成和交付(CI/CD)系统。通过抽象底层实现细节，用户可以跨多云平台和本地系统进行构建、测试和部署。另外，基于 kubernetes CRD 定义的 pipeline 流水线也是 Tekton 最重要的特征。

CRD 全称是 CustomResourceDefinition:

在 Kubernetes 中一切都可视为资源，Kubernetes 1.7 之后增加了对 CRD 自定义资源二次开发能力来扩展 Kubernetes API，通过 CRD 我们可以向 Kubernetes API 中增加新资源类型，而不需要修改 Kubernetes 源码来创建自定义的 API server，该功能大大提高了 Kubernetes 的扩展能力。当你创建一个新的 CustomResourceDefinition (CRD)时，Kubernetes API 服务器将为你指定的每个版本创建一个新的 RESTful 资源路径，我们可以根据该 api 路径来创建一些我们自己定义的类型资源。CRD 可以是命名空间的，也可以是集群范围的，由 CRD 的作用域(scpoe)字段中所指定的，与现有的内置对象一样，删除名称空间将删除该名称空间中的所有自定义对象。 customresourcedefinition 本身没有名称空间，所有名称空间都可以使用。

3.2 为什么要用 k8s 原生的 CI-CD 工具 Tekton? 持续集成是云原生应用的支柱技术之一，因此在交付基于云原生的一些支撑产品的时候，CICD 是一个无法拒绝的需求。为了满足这种需要，自然而然会想到对 Jenkins(X)或者 Gitlab 进行集成，也有创业公司出来的一些小工具比如 Argo Rollout。Tekton 是一款 k8s 原生的应用发布框架，主要用来构建 CI/CD 系统。它原本是 knative 项目里面一个叫做 build-pipeline 的子项目，用来作为 knative-build 的下一代引擎。然而，随着 k8s 社区里各种各样的需求涌入，这个子项目慢慢成长为一个通用的框架，能够提供灵活强大的能力去做基于 k8s 的构建发布。Tekton 其实只提供 Pipeline 这个一个功能，Pipeline 会被直接映射成 K8s Pod 等 API 资源。而比如应用发布过程的控制，灰度和上线策略，都是我们自己编写 K8s Controller 来实现的，也就意味着 Tekton 不会在 K8s 上盖一个”大帽子“，比如我们想看发布状态、日志等是直接通过 K8s 查看这个 Pipeline 对应的 Pod 的状态和日志，不需要再面对另外一个 API

Tekton 功能:

1.Kubernetes 原生的 Tekton 的所有配置都是使用 CRD 方式进行编写存储的，非常易于检索和使用。

2.配置和流程分离: Tekton 的 Pipeline 和配置可以分开编写，使用名称进行引用。 3.轻量级核心的 Pipeline 非常轻便:适合作为组件进行集成，另外也有周边的 Dashboard、 Trigger、CLI 等工具，能够进一步挖掘其潜力。

4.可复用、组合的 Pipeline 构建方式:非常适合在集成过程中对 Pipeline 进行定制。

3.3使用 Tekton 自动化发布应用流程

这里的流程大致是:

1、用户把需要部署的应用先按照一套标准的应用定义写成 YAML 文件(类似 Helm Chart); 2、用户把应用定义 YAML 推送到 Git 仓库里;

3、Tekton CD (一个 K8s Operator) 会监听到相应的改动，根据不同条件生成不同的 Tekton Pipelines;

Tekton CD 的操作具体分为以下几种情况:

1、如果 Git 改动里有一个应用 YAML 且该应用不存在，那么将渲染和生成 Tekton Pipelines 用来创建应用。

2、如果 Git 改动里有一个应用 YAML 且该应用存在，那么将渲染和生成 Tekton Pipelines 用来升级应用。这里我们会根据应用定义 YAML 里的策略来做升级，比如做金丝雀发布、灰度升级。

3、如果 Git 改动里有一个应用 YAML 且该应用存在且标记了“被删除”，那么将渲染和生成 Tekton Pipelines 用来删除应用。确认应用被删除后，我们才从 Git 里删除这个应用的 YAML。

安装 Tekton

#把 tekton-0-12-0.tar.gz 和 busybox-1-0.tar.gz 上传到工作节点机器上，手动解压:

#编写安装 tekton 资源清单文件

kubectl apply -f release.yaml

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: Namespace

metadata:

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: policy/v1beta1

kind: PodSecurityPolicy

metadata:

spec:

privileged: false

allowPrivilegeEscalation: false

volumes:

- 'emptyDir'

- 'configMap'

- 'secret'

hostNetwork: false

hostIPC: false

hostPID: false

runAsUser:

rule: 'RunAsAny'

seLinux:

rule: 'RunAsAny'

supplementalGroups:

rule: 'MustRunAs'

ranges:

- min: 1

max: 65535

fsGroup:

rule: 'MustRunAs'

ranges:

- min: 1

max: 65535

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

rules:

- apiGroups: [""]

# Namespace access is required because the controller timeout handling logic

# iterates over all namespaces and times out any PipelineRuns that have expired.

# Pod access is required because the taskrun controller wants to be updated when

# a Pod underlying a TaskRun changes state.

resources: ["namespaces", "pods"]

verbs: ["list", "watch"]

# Controller needs cluster access to all of the CRDs that it is responsible for

# managing.

- apiGroups: ["tekton.dev"]

resources: ["tasks", "clustertasks", "taskruns", "pipelines", "pipelineruns", "pipelineresources",

"conditions"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

- apiGroups: ["tekton.dev"]

resources: ["taskruns/finalizers", "pipelineruns/finalizers"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

- apiGroups: ["tekton.dev"]

resources: ["tasks/status", "clustertasks/status", "taskruns/status", "pipelines/status",

"pipelineruns/status", "pipelineresources/status"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

- apiGroups: ["policy"]

resources: ["podsecuritypolicies"]

resourceNames: ["tekton-pipelines"]

verbs: ["use"]

---

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

# This is the access that the controller needs on a per-namespace basis.

rules:

- apiGroups: [""]

resources: ["pods", "pods/log", "secrets", "events", "serviceaccounts", "configmaps",

"persistentvolumeclaims", "limitranges"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

# Unclear if this access is actually required. Simply a hold-over from the previous

# incarnation of the controller's ClusterRole.

- apiGroups: ["apps"]

resources: ["deployments"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

- apiGroups: ["apps"]

resources: ["deployments/finalizers"]

verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]

---

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1

metadata:

rules:

- # The webhook needs to be able to list and update customresourcedefinitions,

# mainly to update the webhook certificates.

apiGroups: ["apiextensions.k8s.io"]

resources: ["customresourcedefinitions", "customresourcedefinitions/status"]

verbs: ["get", "list", "update", "patch", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]

# The webhook performs a reconciliation on these two resources and continuously

# updates configuration.

resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]

# knative starts informers on these things, which is why we need get, list and watch.

verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]

resources: ["mutatingwebhookconfigurations"]

# This mutating webhook is responsible for applying defaults to tekton objects

# as they are received.

resourceNames: ["webhook.pipeline.tekton.dev"]

# When there are changes to the configs or secrets, knative updates the mutatingwebhook config

# with the updated certificates or the refreshed set of rules.

verbs: ["get", "update"]

- apiGroups: ["admissionregistration.k8s.io"]

resources: ["validatingwebhookconfigurations"]

# validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns.

# config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure

resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"]

# When there are changes to the configs or secrets, knative updates the validatingwebhook config

# with the updated certificates or the refreshed set of rules.

verbs: ["get", "update"]

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

namespace: tekton-pipelines

rules:

- apiGroups: [""]

resources: ["configmaps"]

verbs: ["list", "watch"]

- # The controller needs access to these configmaps for logging information and runtime configuration.

apiGroups: [""]

resources: ["configmaps"]

verbs: ["get"]

resourceNames: ["config-logging", "config-observability", "config-artifact-bucket",

"config-artifact-pvc", "feature-flags", "config-leader-election"]

---

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

namespace: tekton-pipelines

rules:

- apiGroups: [""]

resources: ["configmaps"]

verbs: ["list", "watch"]

- # The webhook needs access to these configmaps for logging information.

apiGroups: [""]

resources: ["configmaps"]

verbs: ["get"]

resourceNames: ["config-logging", "config-observability"]

- apiGroups: [""]

resources: ["secrets"]

verbs: ["list", "watch"]

- # The webhook daemon makes a reconciliation loop on webhook-certs. Whenever

# the secret changes it updates the webhook configurations with the certificates

# stored in the secret.

apiGroups: [""]

resources: ["secrets"]

verbs: ["get", "update"]

resourceNames: ["webhook-certs"]

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: tekton-pipelines

---

apiVersion: v1

kind: ServiceAccount

metadata:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

subjects:

- kind: ServiceAccount

namespace: tekton-pipelines

roleRef:

kind: ClusterRole

apiGroup: rbac.authorization.k8s.io

---

# If this ClusterRoleBinding is replaced with a RoleBinding

# then the ClusterRole would be namespaced. The access described by

# the tekton-pipelines-controller-tenant-access ClusterRole would

# be scoped to individual tenant namespaces.

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

subjects:

- kind: ServiceAccount

namespace: tekton-pipelines

roleRef:

kind: ClusterRole

apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: ClusterRoleBinding

metadata:

subjects:

- kind: ServiceAccount

namespace: tekton-pipelines

roleRef:

kind: ClusterRole

apiGroup: rbac.authorization.k8s.io

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: RoleBinding

metadata:

namespace: tekton-pipelines

subjects:

- kind: ServiceAccount

namespace: tekton-pipelines

roleRef:

kind: Role

apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1beta1

kind: RoleBinding

metadata:

namespace: tekton-pipelines

subjects:

- kind: ServiceAccount

namespace: tekton-pipelines

roleRef:

kind: Role

apiGroup: rbac.authorization.k8s.io

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

preserveUnknownFields: false

validation:

openAPIV3Schema:

type: object

# One can use x-kubernetes-preserve-unknown-fields: true

# at the root of the schema (and inside any properties, additionalProperties)

# to get the traditional CRD behaviour that nothing is pruned, despite

# setting spec.preserveUnknownProperties: false.

# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/

# See issue: https://github.com/knative/serving/issues/912

x-kubernetes-preserve-unknown-fields: true

versions:

- name: v1alpha1

served: true

storage: true

- name: v1beta1

served: true

storage: false

names:

kind: ClusterTask

plural: clustertasks

categories:

- tekton

- tekton-pipelines

scope: Cluster

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

conversion:

strategy: Webhook

webhookClientConfig:

service:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

names:

kind: Condition

plural: conditions

categories:

- tekton

- tekton-pipelines

scope: Namespaced

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

version: v1alpha1

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

knative.dev/crd-install: "true"

spec:

group: caching.internal.knative.dev

version: v1alpha1

names:

kind: Image

plural: images

singular: image

categories:

- knative-internal

- caching

shortNames:

- img

scope: Namespaced

subresources:

status: {}

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

preserveUnknownFields: false

validation:

openAPIV3Schema:

type: object

# One can use x-kubernetes-preserve-unknown-fields: true

# at the root of the schema (and inside any properties, additionalProperties)

# to get the traditional CRD behaviour that nothing is pruned, despite

# setting spec.preserveUnknownProperties: false.

# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/

# See issue: https://github.com/knative/serving/issues/912

x-kubernetes-preserve-unknown-fields: true

versions:

- name: v1alpha1

served: true

storage: true

- name: v1beta1

served: true

storage: false

names:

kind: Pipeline

plural: pipelines

categories:

- tekton

- tekton-pipelines

scope: Namespaced

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

conversion:

strategy: Webhook

webhookClientConfig:

service:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

preserveUnknownFields: false

validation:

openAPIV3Schema:

type: object

# One can use x-kubernetes-preserve-unknown-fields: true

# at the root of the schema (and inside any properties, additionalProperties)

# to get the traditional CRD behaviour that nothing is pruned, despite

# setting spec.preserveUnknownProperties: false.

# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/

# See issue: https://github.com/knative/serving/issues/912

x-kubernetes-preserve-unknown-fields: true

versions:

- name: v1alpha1

served: true

storage: true

- name: v1beta1

served: true

storage: false

names:

kind: PipelineRun

plural: pipelineruns

categories:

- tekton

- tekton-pipelines

shortNames:

- pr

- prs

scope: Namespaced

additionalPrinterColumns:

- name: Succeeded

type: string

JSONPath: ".status.conditions[?(@.type==\"Succeeded\")].status"

- name: Reason

type: string

JSONPath: ".status.conditions[?(@.type==\"Succeeded\")].reason"

- name: StartTime

type: date

JSONPath: .status.startTime

- name: CompletionTime

type: date

JSONPath: .status.completionTime

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

conversion:

strategy: Webhook

webhookClientConfig:

service:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

names:

kind: PipelineResource

plural: pipelineresources

categories:

- tekton

- tekton-pipelines

scope: Namespaced

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

version: v1alpha1

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

preserveUnknownFields: false

validation:

openAPIV3Schema:

type: object

# One can use x-kubernetes-preserve-unknown-fields: true

# at the root of the schema (and inside any properties, additionalProperties)

# to get the traditional CRD behaviour that nothing is pruned, despite

# setting spec.preserveUnknownProperties: false.

# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/

# See issue: https://github.com/knative/serving/issues/912

x-kubernetes-preserve-unknown-fields: true

versions:

- name: v1alpha1

served: true

storage: true

- name: v1beta1

served: true

storage: false

names:

kind: Task

plural: tasks

categories:

- tekton

- tekton-pipelines

scope: Namespaced

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

conversion:

strategy: Webhook

webhookClientConfig:

service:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

labels:

pipeline.tekton.dev/release: "devel"

version: "devel"

spec:

group: tekton.dev

preserveUnknownFields: false

validation:

openAPIV3Schema:

type: object

# One can use x-kubernetes-preserve-unknown-fields: true

# at the root of the schema (and inside any properties, additionalProperties)

# to get the traditional CRD behaviour that nothing is pruned, despite

# setting spec.preserveUnknownProperties: false.

# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/

# See issue: https://github.com/knative/serving/issues/912

x-kubernetes-preserve-unknown-fields: true

versions:

- name: v1alpha1

served: true

storage: true

- name: v1beta1

served: true

storage: false

names:

kind: TaskRun

plural: taskruns

categories:

- tekton

- tekton-pipelines

shortNames:

- tr

- trs

scope: Namespaced

additionalPrinterColumns:

- name: Succeeded

type: string

JSONPath: ".status.conditions[?(@.type==\"Succeeded\")].status"

- name: Reason

type: string

JSONPath: ".status.conditions[?(@.type==\"Succeeded\")].reason"

- name: StartTime

type: date

JSONPath: .status.startTime

- name: CompletionTime

type: date

JSONPath: .status.completionTime

# Opt into the status subresource so metadata.generation

# starts to increment

subresources:

status: {}

conversion:

strategy: Webhook

webhookClientConfig:

service:

namespace: tekton-pipelines

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: Secret

metadata:

namespace: tekton-pipelines

labels:

pipeline.tekton.dev/release: devel

# The data is populated at install time.

---

apiVersion: admissionregistration.k8s.io/v1beta1

kind: ValidatingWebhookConfiguration

metadata:

labels:

pipeline.tekton.dev/release: devel

webhooks:

- admissionReviewVersions:

- v1beta1

clientConfig:

service:

namespace: tekton-pipelines

failurePolicy: Fail

sideEffects: None

---

apiVersion: admissionregistration.k8s.io/v1beta1

kind: MutatingWebhookConfiguration

metadata:

labels:

pipeline.tekton.dev/release: devel

webhooks:

- admissionReviewVersions:

- v1beta1

clientConfig:

service:

namespace: tekton-pipelines

failurePolicy: Fail

sideEffects: None

---

apiVersion: admissionregistration.k8s.io/v1beta1

kind: ValidatingWebhookConfiguration

metadata:

labels:

pipeline.tekton.dev/release: devel

webhooks:

- admissionReviewVersions:

- v1beta1

clientConfig:

service:

namespace: tekton-pipelines

failurePolicy: Fail

sideEffects: None

namespaceSelector:

matchExpressions:

- key: pipeline.tekton.dev/release

operator: Exists

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

labels:

rbac.authorization.k8s.io/aggregate-to-edit: "true"

rbac.authorization.k8s.io/aggregate-to-admin: "true"

rules:

- apiGroups:

- tekton.dev

resources:

- tasks

- taskruns

- pipelines

- pipelineruns

- pipelineresources

- conditions

verbs:

- create

- delete

- deletecollection

- get

- list

- patch

- update

- watch

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRole

metadata:

labels:

rbac.authorization.k8s.io/aggregate-to-view: "true"

rules:

- apiGroups:

- tekton.dev

resources:

- tasks

- taskruns

- pipelines

- pipelineruns

- pipelineresources

- conditions

verbs:

- get

- list

- watch

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

# data:

# # location of the gcs bucket to be used for artifact storage

# location: "gs://bucket-name"

# # name of the secret that will contain the credentials for the service account

# # with access to the bucket

# bucket.service.account.secret.name:

# # The key in the secret with the required service account json

# bucket.service.account.secret.key:

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

# data:

# # size of the PVC volume

# size: 5Gi

# # storage class of the PVC volume

# storageClassName: storage-class-name

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

data:

_example: |-

################################

# #

# EXAMPLE CONFIGURATION #

# #

################################

# This block is not actually functional configuration,

# but serves to illustrate the available configuration

# options and document them in a way that is accessible

# to users that `kubectl edit` this config map.

# These sample configuration options may be copied out of

# this example block and unindented to be in the data block

# to actually change the configuration.

# default-timeout-minutes contains the default number of

# minutes to use for TaskRun and PipelineRun, if none is specified.

default-timeout-minutes: "60" # 60 minutes

# default-service-account contains the default service account name

# to use for TaskRun and PipelineRun, if none is specified.

default-service-account: "default"

# default-managed-by-label-value contains the default value given to the

# "app.kubernetes.io/managed-by" label applied to all Pods created for

# TaskRuns. If a user's requested TaskRun specifies another value for this

# label, the user's request supercedes.

default-managed-by-label-value: "tekton-pipelines"

# default-pod-template contains the default pod template to use

# TaskRun and PipelineRun, if none is specified. If a pod template

# is specified, the default pod template is ignored.

# default-pod-template:

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

data:

# Setting this flag to "true" will prevent Tekton overriding your

# Task container's $HOME environment variable.

# The default behaviour currently is for Tekton to override the

# $HOME environment variable but this will change in an upcoming

# release.

# See https://github.com/tektoncd/pipeline/issues/2013 for more

# info.

disable-home-env-overwrite: "false"

# Setting this flag to "true" will prevent Tekton overriding your

# Task container's working directory.

# The default behaviour currently is for Tekton to override the

# working directory if not set by the user but this will change

# in an upcoming release.

# See https://github.com/tektoncd/pipeline/issues/1836 for more

# info.

disable-working-directory-overwrite: "false"

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

data:

# An inactive but valid configuration follows; see example.

resourceLock: "leases"

leaseDuration: "15s"

renewDeadline: "10s"

retryPeriod: "2s"

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

data:

# Common configuration for all knative codebase

zap-logger-config: |

{

"level": "info",

"development": false,

"sampling": {

"initial": 100,

"thereafter": 100

"outputPaths": ["stdout"],

"errorOutputPaths": ["stderr"],

"encoding": "json",

"encoderConfig": {

"timeKey": "",

"levelKey": "level",

"nameKey": "logger",

"callerKey": "caller",

"messageKey": "msg",

"stacktraceKey": "stacktrace",

"lineEnding": "",

"levelEncoder": "",

"timeEncoder": "",

"durationEncoder": "",

"callerEncoder": ""

}

# Log level overrides

loglevel.controller: "info"

loglevel.webhook: "info"

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: v1

kind: ConfigMap

metadata:

namespace: tekton-pipelines

data:

_example: |

################################

# #

# EXAMPLE CONFIGURATION #

# #

################################

# This block is not actually functional configuration,

# but serves to illustrate the available configuration

# options and document them in a way that is accessible

# to users that `kubectl edit` this config map.

# These sample configuration options may be copied out of

# this example block and unindented to be in the data block

# to actually change the configuration.

# metrics.backend-destination field specifies the system metrics destination.

# It supports either prometheus (the default) or stackdriver.

# Note: Using Stackdriver will incur additional charges.

metrics.backend-destination: prometheus

# metrics.stackdriver-project-id field specifies the Stackdriver project ID. This

# field is optional. When running on GCE, application default credentials will be

# used and metrics will be sent to the cluster's project if this field is

# not provided.

metrics.stackdriver-project-id: ""

# metrics.allow-stackdriver-custom-metrics indicates whether it is allowed

# to send metrics to Stackdriver using "global" resource type and custom

# metric type. Setting this flag to "true" could cause extra Stackdriver

# charge. If metrics.backend-destination is not Stackdriver, this is

# ignored.

metrics.allow-stackdriver-custom-metrics: "false"

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apps/v1

kind: Deployment

metadata:

namespace: tekton-pipelines

labels:

app.kubernetes.io/name: tekton-pipelines

app.kubernetes.io/component: controller

pipeline.tekton.dev/release: "v0.12.0"

version: "v0.12.0"

spec:

replicas: 1

selector:

matchLabels:

app: tekton-pipelines-controller

template:

metadata:

annotations:

cluster-autoscaler.kubernetes.io/safe-to-evict: "false"

labels:

app: tekton-pipelines-controller

app.kubernetes.io/name: tekton-pipelines

app.kubernetes.io/component: controller

# tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml

pipeline.tekton.dev/release: "v0.12.0"

version: "v0.12.0"

spec:

serviceAccountName: tekton-pipelines-controller

containers:

- name: tekton-pipelines-controller

image: god/tekton-controller:v0.12.0

args: [

# These images are built on-demand by `ko resolve` and are replaced

# by image references by digest.

"-kubeconfig-writer-image", "god/tekton-kubeconfigwriter:v0.12.0",

"-creds-image", "god/tekton-creds-init:v0.12.0",

"-git-image", "god/tekton-git-init:v0.12.0",

"-entrypoint-image", "god/tekton-entrypoint:v0.12.0",

"-imagedigest-exporter-image", "god/tekton-imagedigestexporter:v0.12.0",

"-pr-image", "god/tekton-pullrequest-init:v0.12.0",

"-build-gcs-fetcher-image", "god/tekton-gcs-fetcher:v0.12.0",

# These images are pulled from Dockerhub, by digest, as of April 15, 2020.

"-nop-image", "god/tianon:v1.0",

"-shell-image", "god/busybox:v1.0",

"-gsutil-image", "google/cloud-sdk"]

volumeMounts:

- name: config-logging

mountPath: /etc/config-logging

env:

- name: SYSTEM_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

- # If you are changing these names, you will also need to update

# the controller's Role in 200-role.yaml to include the new

# values in the "configmaps" "get" rule.

value: config-logging

- name: CONFIG_OBSERVABILITY_NAME

value: config-observability

- name: CONFIG_ARTIFACT_BUCKET_NAME

value: config-artifact-bucket

- name: CONFIG_ARTIFACT_PVC_NAME

value: config-artifact-pvc

- name: CONFIG_FEATURE_FLAGS_NAME

value: feature-flags

- name: CONFIG_LEADERELECTION_NAME

value: config-leader-election

- name: METRICS_DOMAIN

value: tekton.dev/pipeline

volumes:

- name: config-logging

configMap:

---

apiVersion: v1

kind: Service

metadata:

labels:

app: tekton-pipelines-controller

pipeline.tekton.dev/release: "v0.12.0"

version: "v0.12.0"

namespace: tekton-pipelines

spec:

ports:

- name: http-metrics

port: 9090

protocol: TCP

targetPort: 9090

selector:

app: tekton-pipelines-controller

---

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

apiVersion: apps/v1

kind: Deployment

metadata:

# Note: the Deployment name must be the same as the Service name specified in

# config/400-webhook-service.yaml. If you change this name, you must also

# change the value of WEBHOOK_SERVICE_NAME below.

namespace: tekton-pipelines

labels:

app.kubernetes.io/name: tekton-pipelines

app.kubernetes.io/component: webhook-controller

pipeline.tekton.dev/release: "v0.12.0"

version: "v0.12.0"

spec:

replicas: 1

selector:

matchLabels:

app: tekton-pipelines-webhook

role: webhook

template:

metadata:

annotations:

cluster-autoscaler.kubernetes.io/safe-to-evict: "false"

labels:

app: tekton-pipelines-webhook

role: webhook

app.kubernetes.io/name: tekton-pipelines

app.kubernetes.io/component: webhook-controller

pipeline.tekton.dev/release: "v0.12.0"

version: "v0.12.0"

spec:

serviceAccountName: tekton-pipelines-webhook

containers:

- name: webhook

# This is the Go import path for the binary that is containerized

# and substituted here.

image: god/tekton-webhook:v0.12.0

env:

- name: SYSTEM_NAMESPACE

valueFrom:

fieldRef:

fieldPath: metadata.namespace

- # If you are changing these names, you will also need to update

# the webhook's Role in 200-role.yaml to include the new

# values in the "configmaps" "get" rule.

value: config-logging

- name: CONFIG_OBSERVABILITY_NAME

value: config-observability

- name: CONFIG_LEADERELECTION_NAME

value: config-leader-election

- name: WEBHOOK_SERVICE_NAME

value: tekton-pipelines-webhook

- name: WEBHOOK_SECRET_NAME

value: webhook-certs

- name: METRICS_DOMAIN

value: tekton.dev/pipeline

securityContext:

allowPrivilegeEscalation: false

ports:

- name: metrics

containerPort: 9090

- name: profiling

containerPort: 8008

- name: https-webhook

containerPort: 8443

---

apiVersion: v1

kind: Service

metadata:

labels:

app: tekton-pipelines-webhook

role: webhook

pipeline.tekton.dev/release: v0.12.0

version: "v0.12.0"

namespace: tekton-pipelines

spec:

ports:

- # Define metrics and profiling for them to be accessible within service meshes.

port: 9090

targetPort: 9090

- name: http-profiling

port: 8008

targetPort: 8008

- name: https-webhook

port: 443

targetPort: 8443

selector:

app: tekton-pipelines-webhook

role: webhook

---

更新资源文件。 kubectl apply -f release.yaml

#验证 pod 是否创建成功

kubectl get pods -n tekton-pipelines

NAME READY STATUS RESTARTS AGE

tekton-pipelines-controller-df779b44b-7lvsx 1/1 Running 0 20s

tekton-pipelines-webhook-6bb6b45fd4-6scgl 1/1 Running 0 20s

Tekton 概念

Tekton 为 Kubernetes 提供了多种 CRD 资源对象，可用于定义我们的流水线，主要有以下几个 CRD 资源对象:

1)Task:表示执行命令的一系列步骤，task 里可以定义一系列的 steps，例如编译代码、构建镜像、推送镜像等，每个 step 实际由一个 Pod 里的容器执行。

2)TaskRun:task 只是定义了一个模版，taskRun 才真正代表了一次实际的运行，当然你也可以自己手动创建一个 taskRun，taskRun 创建出来之后，就会自动触发 task 描述的构建任务。

3)Pipeline:一组任务，表示一个或多个 task、PipelineResource 以及各种定义参数的集合。

4)PipelineRun:类似 task 和 taskRun 的关系，pipelineRun 也表示某一次实际运行的 pipeline，下发一个 pipelineRun CRD 实例到 Kubernetes 后，同样也会触发一次 pipeline 的构建。

5)PipelineResource:表示 pipeline 输入资源，比如 github 上的源码，或者 pipeline 输出资源，例如一个容器镜像或者构建生成的 jar 包等。

测试 Tekton 构建 CI/CD 流水线

测试一个简单的 golang 程序。应用程序代码，测试及 dockerfile 文件可在如下地址获取: https://github.com/cadrcadr/tekton-demo

1、clone 应用程序代码进行测试，创建一个 task 任务

cat task-test.yaml

apiVersion: tekton.dev/v1beta1

kind: Task

metadata:

spec:

resources:

inputs:

- name: repo

type: git

steps:

- name: run-test

image: golang:1.14-alpine

workingDir: /workspace/repo

command: ["go"]

args: ["test"]

kubectl apply -f task-test.yaml

#查看 Task 资源

kubectl get Task

NAME AGE

test 23s

#上面内容解释说明:

resources 定义了我们的任务中定义的步骤中需要输入的内容，这里我们的步骤需要 Clone 一个 Git 仓库作为 go test 命令的输入。Tekton 内置了一种 git 资源类型，它会自动将代码仓库 Clone 到 /workspace/$input_name 目录中，由于我们这里输入被命名成 repo，所以代码会被 Clone 到 /workspace/repo 目录下面。然后下面的 steps 就是来定义执行运行测试命令的步骤，这里我们直接在代码的根目录中运行 go test 命令即可，需要注意的是命令和参数需要分别定义。

2、创建 pipelineresource 资源对象

通过上面步骤我们定义了一个

Task 任务，但是该任务并不会立即执行，我们必须创建一个 TaskRun 引用它并提供所有必需输入的数据才行。这里我们就需要将 git 代码库作为输入，我们必须先创建一个 PipelineResource 对象来定义输入信息，创建一个名

为

pipelineresource.yaml 的资源清单文件，内容如下所示:

# cat pipelineresource.yaml

apiVersion: tekton.dev/v1alpha1

kind: PipelineResource

metadata:

spec:

type: git

params:

- name: url

value: https://github.com/cadrcadr/tekton-demo

- name: revision

value: master

kubectl apply -f pipelineresource.yaml

3、创建 taskrun 任务

cat taskrun.yaml

apiVersion: tekton.dev/v1beta1

kind: TaskRun

metadata:

spec:

taskRef:

resources:

inputs:

- name: repo

resourceRef:

]# kubectl apply -f taskrun.yaml

#上面资源清单文件解释说明

这里通过

taskRef 引用上面定义的 Task 和 git 仓库作为输入，resourceRef 也是引用上面定义的 PipelineResource 资源对象。

#创建后，我们可以通过查看 TaskRun 资源对象的状态来查看构建状态

# kubectl get taskrun

NAME SUCCEEDED REASON STARTTIME

testrun Unknown Running 6s

# kubectl get pods

NAME READY STATUS RESTARTS AGE

testrun-pod-x9rkn 2/2 Running 0 9s

当任务执行完成后， Pod 就会变成 Completed 状态了:

kubectl get pods

NAME READY STATUS RESTARTS AGE

testrun-pod-x9rkn 0/2 Completed 0 72s

我们可以通过 kubectl describe 命令来查看任务运行的过程，首先就是通过 initContainer 中的一个 busybox 镜像将代码 Clone 下来，然后使用任务中定义的镜像来执行命令。当任务执行完成后， Pod 就会变成 Completed 状态了，我们可以查看容器的日志信息来了解任务的执行结果信息:

# kubectl logs testrun-pod-x9rkn --all-containers {"level":"info","ts":1617616592.58145,"caller":"git/git.go:136","msg":"Successfully cloned https://github.com/luckylucky421/tekton-demo @ c6c2a85091d538a13c44f85bcee9e861c362b0d3 (grafted, HEAD, origin/master) in path /workspace/repo"} {"level":"info","ts":1617616592.6319332,"caller":"git/git.go:177","msg":"Successfully initialized and updated submodules in path /workspace/repo"}

PASS

ok _/workspace/repo 0.003s

#通过上面可以看到我们的测试已经通过了。

总结:我们已经在 Kubernetes 集群上成功安装了 Tekton，定义了一个 Task，并通过 YAML 清单和创建 TaskRun 对其进行了测试。

CI-CD 工具 Tekton

什么是 Tekton?

你可能感兴趣的:(CI-CD 工具 Tekton)