AverageMarcus/cluster.fun
1
0
Fork 0
Code Issues 1 Pull Requests 2 Releases Activity

Updated Tekton pipelines and triggers

Browse Source
This commit is contained in:
Marcus Noble 2020-06-03 14:34:23 +01:00
parent 0d20f06cc7
commit 7741daa25a
4 changed files with 628 additions and 499 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

530
tekton/1-Install/1-pipeline.yaml
View File

@ -11,6 +11,7 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: v1
kind: Namespace
metadata:
@ -30,6 +31,7 @@ metadata:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
@ -60,24 +62,34 @@ spec:
max: 65535
---
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tekton-pipelines-admin
name: tekton-pipelines-controller-cluster-access
rules:
- apiGroups: [""]
resources: ["pods", "pods/log", "namespaces", "secrets", "events", "serviceaccounts",
"configmaps", "persistentvolumeclaims", "limitranges"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
- apiGroups: ["apps"]
resources: ["deployments/finalizers"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
# Namespace access is required because the controller timeout handling logic
# iterates over all namespaces and times out any PipelineRuns that have expired.
# Pod access is required because the taskrun controller wants to be updated when
# a Pod underlying a TaskRun changes state.
resources: ["namespaces", "pods"]
verbs: ["list", "watch"]
# Controller needs cluster access to all of the CRDs that it is responsible for
# managing.
- apiGroups: ["tekton.dev"]
resources: ["tasks", "clustertasks", "taskruns", "pipelines", "pipelineruns", "pipelineresources",
"conditions"]
@ -93,6 +105,118 @@ rules:
resources: ["podsecuritypolicies"]
resourceNames: ["tekton-pipelines"]
verbs: ["use"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
# This is the access that the controller needs on a per-namespace basis.
name: tekton-pipelines-controller-tenant-access
rules:
- apiGroups: [""]
resources: ["pods", "pods/log", "secrets", "events", "serviceaccounts", "configmaps",
"persistentvolumeclaims", "limitranges"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
# Unclear if this access is actually required. Simply a hold-over from the previous
# incarnation of the controller's ClusterRole.
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
- apiGroups: ["apps"]
resources: ["deployments/finalizers"]
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tekton-pipelines-webhook-cluster-access
rules:
- # The webhook needs to be able to list and update customresourcedefinitions,
# mainly to update the webhook certificates.
apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions", "customresourcedefinitions/status"]
verbs: ["get", "list", "update", "patch", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
# The webhook performs a reconciliation on these two resources and continuously
# updates configuration.
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
# knative starts informers on these things, which is why we need get, list and watch.
verbs: ["list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["mutatingwebhookconfigurations"]
# This mutating webhook is responsible for applying defaults to tekton objects
# as they are received.
resourceNames: ["webhook.pipeline.tekton.dev"]
# When there are changes to the configs or secrets, knative updates the mutatingwebhook config
# with the updated certificates or the refreshed set of rules.
verbs: ["get", "update"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
# validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns.
# config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure
resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"]
# When there are changes to the configs or secrets, knative updates the validatingwebhook config
# with the updated certificates or the refreshed set of rules.
verbs: ["get", "update"]
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
resourceNames: ["tekton-pipelines"]
verbs: ["use"]
---
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tekton-pipelines-controller
namespace: tekton-pipelines
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["list", "watch"]
- # The controller needs access to these configmaps for logging information and runtime configuration.
apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
resourceNames: ["config-logging", "config-observability", "config-artifact-bucket",
"config-artifact-pvc", "feature-flags", "config-leader-election"]
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["list", "watch"]
- # The webhook needs access to these configmaps for logging information.
apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
resourceNames: ["config-logging", "config-observability"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["list", "watch"]
- # The webhook daemon makes a reconciliation loop on webhook-certs. Whenever
# the secret changes it updates the webhook configurations with the certificates
# stored in the secret.
apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "update"]
resourceNames: ["webhook-certs"]
---
# Copyright 2019 The Tekton Authors
@ -113,6 +237,12 @@ kind: ServiceAccount
metadata:
name: tekton-pipelines-controller
namespace: tekton-pipelines
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2019 The Tekton Authors
@ -128,17 +258,91 @@ metadata:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: tekton-pipelines-controller-admin
name: tekton-pipelines-controller-cluster-access
subjects:
- kind: ServiceAccount
name: tekton-pipelines-controller
namespace: tekton-pipelines
roleRef:
kind: ClusterRole
name: tekton-pipelines-admin
name: tekton-pipelines-controller-cluster-access
apiGroup: rbac.authorization.k8s.io
---
# If this ClusterRoleBinding is replaced with a RoleBinding
# then the ClusterRole would be namespaced. The access described by
# the tekton-pipelines-controller-tenant-access ClusterRole would
# be scoped to individual tenant namespaces.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: tekton-pipelines-controller-tenant-access
subjects:
- kind: ServiceAccount
name: tekton-pipelines-controller
namespace: tekton-pipelines
roleRef:
kind: ClusterRole
name: tekton-pipelines-controller-tenant-access
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: tekton-pipelines-webhook-cluster-access
subjects:
- kind: ServiceAccount
name: tekton-pipelines-webhook
namespace: tekton-pipelines
roleRef:
kind: ClusterRole
name: tekton-pipelines-webhook-cluster-access
apiGroup: rbac.authorization.k8s.io
---
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: tekton-pipelines-controller
namespace: tekton-pipelines
subjects:
- kind: ServiceAccount
name: tekton-pipelines-controller
namespace: tekton-pipelines
roleRef:
kind: Role
name: tekton-pipelines-controller
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
subjects:
- kind: ServiceAccount
name: tekton-pipelines-webhook
namespace: tekton-pipelines
roleRef:
kind: Role
name: tekton-pipelines-webhook
apiGroup: rbac.authorization.k8s.io
---
@ -155,12 +359,28 @@ roleRef:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: clustertasks.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
preserveUnknownFields: false
validation:
openAPIV3Schema:
type: object
# One can use x-kubernetes-preserve-unknown-fields: true
# at the root of the schema (and inside any properties, additionalProperties)
# to get the traditional CRD behaviour that nothing is pruned, despite
# setting spec.preserveUnknownProperties: false.
#
# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/
# See issue: https://github.com/knative/serving/issues/912
x-kubernetes-preserve-unknown-fields: true
versions:
- name: v1alpha1
served: true
@ -179,7 +399,12 @@ spec:
# starts to increment
subresources:
status: {}
version: v1alpha1
conversion:
strategy: Webhook
webhookClientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2019 The Tekton Authors
@ -195,10 +420,14 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: conditions.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
names:
@ -228,6 +457,7 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
@ -264,12 +494,28 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: pipelines.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
preserveUnknownFields: false
validation:
openAPIV3Schema:
type: object
# One can use x-kubernetes-preserve-unknown-fields: true
# at the root of the schema (and inside any properties, additionalProperties)
# to get the traditional CRD behaviour that nothing is pruned, despite
# setting spec.preserveUnknownProperties: false.
#
# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/
# See issue: https://github.com/knative/serving/issues/912
x-kubernetes-preserve-unknown-fields: true
versions:
- name: v1alpha1
served: true
@ -288,7 +534,12 @@ spec:
# starts to increment
subresources:
status: {}
version: v1alpha1
conversion:
strategy: Webhook
webhookClientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2019 The Tekton Authors
@ -304,12 +555,28 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: pipelineruns.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
preserveUnknownFields: false
validation:
openAPIV3Schema:
type: object
# One can use x-kubernetes-preserve-unknown-fields: true
# at the root of the schema (and inside any properties, additionalProperties)
# to get the traditional CRD behaviour that nothing is pruned, despite
# setting spec.preserveUnknownProperties: false.
#
# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/
# See issue: https://github.com/knative/serving/issues/912
x-kubernetes-preserve-unknown-fields: true
versions:
- name: v1alpha1
served: true
@ -344,7 +611,12 @@ spec:
# starts to increment
subresources:
status: {}
version: v1alpha1
conversion:
strategy: Webhook
webhookClientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2019 The Tekton Authors
@ -360,10 +632,14 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: pipelineresources.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
names:
@ -393,12 +669,28 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: tasks.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
preserveUnknownFields: false
validation:
openAPIV3Schema:
type: object
# One can use x-kubernetes-preserve-unknown-fields: true
# at the root of the schema (and inside any properties, additionalProperties)
# to get the traditional CRD behaviour that nothing is pruned, despite
# setting spec.preserveUnknownProperties: false.
#
# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/
# See issue: https://github.com/knative/serving/issues/912
x-kubernetes-preserve-unknown-fields: true
versions:
- name: v1alpha1
served: true
@ -417,7 +709,12 @@ spec:
# starts to increment
subresources:
status: {}
version: v1alpha1
conversion:
strategy: Webhook
webhookClientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2019 The Tekton Authors
@ -433,12 +730,28 @@ spec:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: taskruns.tekton.dev
labels:
pipeline.tekton.dev/release: "devel"
version: "devel"
spec:
group: tekton.dev
preserveUnknownFields: false
validation:
openAPIV3Schema:
type: object
# One can use x-kubernetes-preserve-unknown-fields: true
# at the root of the schema (and inside any properties, additionalProperties)
# to get the traditional CRD behaviour that nothing is pruned, despite
# setting spec.preserveUnknownProperties: false.
#
# See https://kubernetes.io/blog/2019/06/20/crd-structural-schema/
# See issue: https://github.com/knative/serving/issues/912
x-kubernetes-preserve-unknown-fields: true
versions:
- name: v1alpha1
served: true
@ -473,7 +786,12 @@ spec:
# starts to increment
subresources:
status: {}
version: v1alpha1
conversion:
strategy: Webhook
webhookClientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
---
# Copyright 2020 The Tekton Authors
@ -498,20 +816,6 @@ metadata:
labels:
pipeline.tekton.dev/release: devel
# The data is populated at install time.
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
@ -529,20 +833,6 @@ webhooks:
failurePolicy: Fail
sideEffects: None
name: validation.webhook.pipeline.tekton.dev
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
@ -560,20 +850,6 @@ webhooks:
failurePolicy: Fail
sideEffects: None
name: webhook.pipeline.tekton.dev
# Copyright 2020 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
@ -597,6 +873,20 @@ webhooks:
operator: Exists
---
# Copyright 2019 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
@ -625,6 +915,20 @@ rules:
- watch
---
# Copyright 2019 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
@ -800,6 +1104,33 @@ data:
# info.
disable-working-directory-overwrite: "false"
---
# Copyright 2020 Tekton Authors LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: v1
kind: ConfigMap
metadata:
name: config-leader-election
namespace: tekton-pipelines
data:
# An inactive but valid configuration follows; see example.
resourceLock: "leases"
leaseDuration: "15s"
renewDeadline: "10s"
retryPeriod: "2s"
---
# Copyright 2019 Tekton Authors LLC
#
@ -920,6 +1251,7 @@ data:
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apps/v1
kind: Deployment
metadata:
@ -928,8 +1260,8 @@ metadata:
labels:
app.kubernetes.io/name: tekton-pipelines
app.kubernetes.io/component: controller
pipeline.tekton.dev/release: "v0.11.2"
version: "v0.11.2"
pipeline.tekton.dev/release: "v0.12.1"
version: "v0.12.1"
spec:
replicas: 1
selector:
@ -944,21 +1276,27 @@ spec:
app.kubernetes.io/name: tekton-pipelines
app.kubernetes.io/component: controller
# tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml
pipeline.tekton.dev/release: "v0.11.2"
version: "v0.11.2"
pipeline.tekton.dev/release: "v0.12.1"
version: "v0.12.1"
spec:
serviceAccountName: tekton-pipelines-controller
containers:
- name: tekton-pipelines-controller
image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/controller:v0.11.2@sha256:0791513ec1176da38c403eb81220406e987f78f3e58608bd57be1adc45bc9aac
args: ["-kubeconfig-writer-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/kubeconfigwriter:v0.11.2@sha256:d01fa1db8abcad318d05e62e35153a91c6c995949e52133520d9e4735e9a486c",
"-creds-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/creds-init:v0.11.2@sha256:ced427e48b143bc821aedd4a0936fa2caef3f208d70efe68ccba786c12b2c943",
"-git-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.11.2@sha256:bee98bfe6807e8f4e0a31b4e786fd1f7f459e653ed1a22b1a25999f33fa9134a",
"-nop-image", "tianon/true", "-shell-image", "busybox", "-gsutil-image",
"google/cloud-sdk", "-entrypoint-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/entrypoint:v0.11.2@sha256:bc5beb48ca4f87013ccb466bf739d6c99ef9f1ddf51899c73ead99f242b4e57d",
"-imagedigest-exporter-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/imagedigestexporter:v0.11.2@sha256:7a03343deaeaa6b2d779df37417f9bf76cb5f67b36dd298e5bb69a0f625a2b38",
"-pr-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/pullrequest-init:v0.11.2@sha256:3a395509e0d75786eafe96f68d22afc7c4d23a2a76ffc77218b25e8c6c81f6ba",
"-build-gcs-fetcher-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/vendor/github.com/googlecloudplatform/cloud-builders/gcs-fetcher/cmd/gcs-fetcher:v0.11.2@sha256:a020c8510b15870a5b059708197ac7c4ef0d1cbd668eb0872105ad658d509f67"]
image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/controller:v0.12.1@sha256:0ca86ec6f246f49c1ac643357fd1c8e73a474aaa216548807b1216a9ff12f7be
args: [
# These images are built on-demand by `ko resolve` and are replaced
# by image references by digest.
"-kubeconfig-writer-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/kubeconfigwriter:v0.12.1@sha256:67dcd447b0c624befa12843ce9cc0bcfc502179bdb28d59563d761a7f3968509",
"-creds-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/creds-init:v0.12.1@sha256:6266d023172dde7fa421f626074b4e7eedc7d7d5ff561c033d6d63ebfff4a2f2",
"-git-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.12.1@sha256:d82c78288699dd6ee40c852b146cb3bd89b322b42fb3bc4feec28ea54bb7b36c",
"-entrypoint-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/entrypoint:v0.12.1@sha256:7f3db925f7660673a74b0e1030e65540adea36fe361ab7f06f5b5c47cdcef47d",
"-imagedigest-exporter-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/imagedigestexporter:v0.12.1@sha256:e8f08214baad9054bbed7be2b8617c6964b9a1c5405cf59eabcc3d3267a6253f",
"-pr-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/pullrequest-init:v0.12.1@sha256:71e0226346e0d3d57af7c35b6cb907d42d3142e845b0f865ba0c86d3e248f3cb",
"-build-gcs-fetcher-image", "gcr.io/tekton-releases/github.com/tektoncd/pipeline/vendor/github.com/googlecloudplatform/cloud-builders/gcs-fetcher/cmd/gcs-fetcher:v0.12.1@sha256:ae5721bf0d883947c3c13f519ca26129792f4058d5f9dfedd50174d9e7acb2bc",
# These images are pulled from Dockerhub, by digest, as of April 15, 2020.
"-nop-image", "tianon/true@sha256:009cce421096698832595ce039aa13fa44327d96beedb84282a69d3dbcf5a81b",
"-shell-image", "busybox@sha256:a2490cec4484ee6c1068ba3a05f89934010c85242f736280b35343483b2264b6",
"-gsutil-image", "google/cloud-sdk@sha256:6e8676464c7581b2dc824956b112a61c95e4144642bec035e6db38e3384cae2e"]
volumeMounts:
- name: config-logging
mountPath: /etc/config-logging
@ -967,10 +1305,21 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: CONFIG_LOGGING_NAME
- # If you are changing these names, you will also need to update
# the controller's Role in 200-role.yaml to include the new
# values in the "configmaps" "get" rule.
name: CONFIG_LOGGING_NAME
value: config-logging
- name: CONFIG_OBSERVABILITY_NAME
value: config-observability
- name: CONFIG_ARTIFACT_BUCKET_NAME
value: config-artifact-bucket
- name: CONFIG_ARTIFACT_PVC_NAME
value: config-artifact-pvc
- name: CONFIG_FEATURE_FLAGS_NAME
value: feature-flags
- name: CONFIG_LEADERELECTION_NAME
value: config-leader-election
- name: METRICS_DOMAIN
value: tekton.dev/pipeline
volumes:
@ -983,8 +1332,8 @@ kind: Service
metadata:
labels:
app: tekton-pipelines-controller
pipeline.tekton.dev/release: "v0.11.2"
version: "v0.11.2"
pipeline.tekton.dev/release: "v0.12.1"
version: "v0.12.1"
name: tekton-pipelines-controller
namespace: tekton-pipelines
spec:
@ -1022,8 +1371,8 @@ metadata:
labels:
app.kubernetes.io/name: tekton-pipelines
app.kubernetes.io/component: webhook-controller
pipeline.tekton.dev/release: "v0.11.2"
version: "v0.11.2"
pipeline.tekton.dev/release: "v0.12.1"
version: "v0.12.1"
spec:
replicas: 1
selector:
@ -1039,26 +1388,33 @@ spec:
role: webhook
app.kubernetes.io/name: tekton-pipelines
app.kubernetes.io/component: webhook-controller
pipeline.tekton.dev/release: "v0.11.2"
version: "v0.11.2"
pipeline.tekton.dev/release: "v0.12.1"
version: "v0.12.1"
spec:
serviceAccountName: tekton-pipelines-controller
serviceAccountName: tekton-pipelines-webhook
containers:
- name: webhook
# This is the Go import path for the binary that is containerized
# and substituted here.
image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/webhook:v0.11.2@sha256:9826548f3bd8cc0c4187ca0ab5ab8114009874625828a23301c1f60be4f294fa
image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/webhook:v0.12.1@sha256:69f065d493244dbd50563b96f5474bf6590821a6308fd8c69c5ef06cf4d988b2
env:
- name: SYSTEM_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: CONFIG_LOGGING_NAME
- # If you are changing these names, you will also need to update
# the webhook's Role in 200-role.yaml to include the new
# values in the "configmaps" "get" rule.
name: CONFIG_LOGGING_NAME
value: config-logging
- name: CONFIG_OBSERVABILITY_NAME
value: config-observability
- name: CONFIG_LEADERELECTION_NAME
value: config-leader-election
- name: WEBHOOK_SERVICE_NAME
value: tekton-pipelines-webhook
- name: WEBHOOK_SECRET_NAME
value: webhook-certs
- name: METRICS_DOMAIN
value: tekton.dev/pipeline
securityContext:
@ -1077,8 +1433,8 @@ metadata:
labels:
app: tekton-pipelines-webhook
role: webhook
pipeline.tekton.dev/release: v0.11.2
version: "v0.11.2"
pipeline.tekton.dev/release: v0.12.1
version: "v0.12.1"
name: tekton-pipelines-webhook
namespace: tekton-pipelines
spec:

187
tekton/1-Install/2-triggers.yaml
View File

@ -16,6 +16,9 @@ apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: tekton-triggers
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
spec:
privileged: false
allowPrivilegeEscalation: false
@ -60,6 +63,9 @@ kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tekton-triggers-admin
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
rules:
- apiGroups: [""]
resources: ["configmaps", "secrets", "services"]
@ -103,6 +109,9 @@ kind: ServiceAccount
metadata:
name: tekton-triggers-controller
namespace: tekton-pipelines
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
---
# Copyright 2019 The Tekton Authors
@ -123,6 +132,9 @@ apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: tekton-triggers-controller-admin
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
subjects:
- kind: ServiceAccount
name: tekton-triggers-controller
@ -151,6 +163,11 @@ apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: clustertriggerbindings.triggers.tekton.dev
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: "devel"
version: "devel"
spec:
group: triggers.tekton.dev
scope: Cluster
@ -190,6 +207,11 @@ apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: eventlisteners.triggers.tekton.dev
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: "devel"
version: "devel"
spec:
group: triggers.tekton.dev
scope: Namespaced
@ -231,6 +253,11 @@ apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: triggerbindings.triggers.tekton.dev
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: "devel"
version: "devel"
spec:
group: triggers.tekton.dev
scope: Namespaced
@ -272,6 +299,11 @@ apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: triggertemplates.triggers.tekton.dev
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: "devel"
version: "devel"
spec:
group: triggers.tekton.dev
scope: Namespaced
@ -315,6 +347,9 @@ metadata:
name: triggers-webhook-certs
namespace: tekton-pipelines
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: devel
# The data is populated at install time.
---
@ -323,6 +358,9 @@ kind: ValidatingWebhookConfiguration
metadata:
name: validation.webhook.triggers.tekton.dev
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: devel
webhooks:
- admissionReviewVersions:
@ -340,6 +378,9 @@ kind: MutatingWebhookConfiguration
metadata:
name: webhook.triggers.tekton.dev
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: devel
webhooks:
- admissionReviewVersions:
@ -357,6 +398,9 @@ kind: ValidatingWebhookConfiguration
metadata:
name: config.webhook.triggers.tekton.dev
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: devel
webhooks:
- admissionReviewVersions:
@ -374,16 +418,32 @@ webhooks:
operator: Exists
---
# Copyright 2019 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: tekton-triggers-aggregate-edit
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups:
- tekton.dev
- triggers.tekton.dev
resources:
- clustertriggerbindings
- eventlisteners
@ -400,15 +460,31 @@ rules:
- watch
---
# Copyright 2019 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: tekton-triggers-aggregate-view
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
- apiGroups:
- tekton.dev
- triggers.tekton.dev
resources:
- clustertriggerbindings
- eventlisteners
@ -439,6 +515,9 @@ kind: ConfigMap
metadata:
name: config-logging-triggers
namespace: tekton-pipelines
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
data:
# Common configuration for all knative codebase
zap-logger-config: |
@ -491,6 +570,9 @@ kind: ConfigMap
metadata:
name: config-observability-triggers
namespace: tekton-pipelines
labels:
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
data:
_example: |
################################
@ -544,9 +626,14 @@ apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/name: controller
app.kubernetes.io/component: controller
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: "v0.5.0"
app: tekton-triggers-controller
version: "v0.4.0"
triggers.tekton.dev/release: "v0.4.0"
version: "v0.5.0"
name: tekton-triggers-controller
namespace: tekton-pipelines
spec:
@ -556,7 +643,10 @@ spec:
protocol: TCP
targetPort: 9090
selector:
app: tekton-triggers-controller
app.kubernetes.io/name: controller
app.kubernetes.io/component: controller
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
---
# Copyright 2019 The Tekton Authors
@ -579,30 +669,41 @@ metadata:
name: tekton-triggers-controller
namespace: tekton-pipelines
labels:
app.kubernetes.io/name: tekton-triggers
app.kubernetes.io/name: controller
app.kubernetes.io/component: controller
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
# tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
triggers.tekton.dev/release: "v0.4.0"
triggers.tekton.dev/release: "v0.5.0"
spec:
replicas: 1
selector:
matchLabels:
app: tekton-triggers-controller
app.kubernetes.io/name: controller
app.kubernetes.io/component: controller
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
template:
metadata:
annotations:
cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
labels:
app.kubernetes.io/name: controller
app.kubernetes.io/component: controller
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
app: tekton-triggers-controller
triggers.tekton.dev/release: "v0.4.0"
triggers.tekton.dev/release: "v0.5.0"
# version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
version: "v0.4.0"
version: "v0.5.0"
spec:
serviceAccountName: tekton-triggers-controller
containers:
- name: tekton-triggers-controller
image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/controller@sha256:bf3517ddccace756e39cee0f0012bbe879c6b28d962a1c904a415e7c60ce5bc2
args: ["-logtostderr", "-stderrthreshold", "INFO", "-el-image", "gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/eventlistenersink@sha256:76c208ec1d73d9733dcaf850240e1b3990e5977709a03c2bd98ad5b20fab9867",
image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/controller@sha256:5d71b1706da0e1a1673e3bdb1e230b28534698e1cb5b8604540083024fd7d58d
args: ["-logtostderr", "-stderrthreshold", "INFO", "-el-image", "gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/eventlistenersink@sha256:ddb43420d5e51065aeb730dc06ce555822590ebfd5b820835f875e3159d99901",
"-el-port", "8080", "-period-seconds", "10", "-failure-threshold", "1"]
env:
- name: SYSTEM_NAMESPACE
@ -617,22 +718,44 @@ spec:
value: tekton.dev/triggers
---
# Copyright 2019 The Tekton Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: v1
kind: Service
metadata:
labels:
app: tekton-triggers-webhook
version: "v0.4.0"
triggers.tekton.dev/release: "v0.4.0"
name: tekton-triggers-webhook
namespace: tekton-pipelines
labels:
app.kubernetes.io/name: webhook
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
app: tekton-triggers-webhook
version: "v0.5.0"
triggers.tekton.dev/release: "v0.5.0"
spec:
ports:
- name: https-webhook
port: 443
targetPort: 8443
selector:
app: tekton-triggers-webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
---
# Copyright 2019 The Tekton Authors
@ -655,34 +778,42 @@ metadata:
name: tekton-triggers-webhook
namespace: tekton-pipelines
labels:
app.kubernetes.io/name: tekton-triggers
app.kubernetes.io/component: webhook-controller
app.kubernetes.io/name: webhook
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
# tekton.dev/release value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
triggers.tekton.dev/release: "v0.4.0"
triggers.tekton.dev/release: "v0.5.0"
spec:
replicas: 1
selector:
matchLabels:
app: tekton-triggers-webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
template:
metadata:
annotations:
cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
labels:
app.kubernetes.io/name: webhook
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/version: v0.5.0
app.kubernetes.io/part-of: tekton-triggers
app: tekton-triggers-webhook
triggers.tekton.dev/release: "v0.4.0"
triggers.tekton.dev/release: "v0.5.0"
# version value replaced with inputs.params.versionTag in triggers/tekton/publish.yaml
version: "v0.4.0"
role: webhook
app.kubernetes.io/name: tekton-triggers
app.kubernetes.io/component: webhook-controller
version: "v0.5.0"
spec:
serviceAccountName: tekton-triggers-controller
containers:
- name: webhook
# This is the Go import path for the binary that is containerized
# and substituted here.
image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/webhook@sha256:d7f1526a9294e671c500f0071b61e050262fb27fb633b54d764a556969855764
image: gcr.io/tekton-releases/github.com/tektoncd/triggers/cmd/webhook@sha256:c6986c68804ce3832bd1894249a39d37a0a46b3458a1cb29697a17b37df674ef
env:
- name: SYSTEM_NAMESPACE
valueFrom:
@ -692,6 +823,8 @@ spec:
value: config-logging-triggers
- name: WEBHOOK_SERVICE_NAME
value: tekton-triggers-webhook
- name: WEBHOOK_SECRET_NAME
value: triggers-webhook-certs
- name: METRICS_DOMAIN
value: tekton.dev/triggers
ports:

306
tekton/1-Install/3-webhooks.yaml
View File

@ -261,7 +261,7 @@ apiVersion: v1
kind: Service
metadata:
annotations:
tekton-dashboard-bundle-location: web/extension.c591f714.js
tekton-dashboard-bundle-location: web/extension.33e1ae7b.js
tekton-dashboard-display-name: Webhooks
tekton-dashboard-endpoints: webhooks.web
labels:
@ -298,7 +298,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: gcr.io/tekton-releases/github.com/tektoncd/experimental/webhooks-extension/cmd/interceptor@sha256:657d40a9116ef0b6f886f94fa7980755e3267dd34017f2fd9b713b63ddfc0d55
image: gcr.io/tekton-releases/github.com/tektoncd/experimental/webhooks-extension/cmd/interceptor@sha256:f029e6b5bbeae6efaff1ebd4db6d8bce17cfed3ed93ed8999428c6fb1e09a946
name: validate
serviceAccountName: tekton-webhooks-extension
---
@ -339,7 +339,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
image: gcr.io/tekton-releases/github.com/tektoncd/experimental/webhooks-extension/cmd/extension@sha256:e7bcffbd2db6b874dbb4b4e71fc0c089acf7ccb803df896d9592063b649ac292
image: gcr.io/tekton-releases/github.com/tektoncd/experimental/webhooks-extension/cmd/extension@sha256:b76dedeb9dae1a88fe359fab3ac6cac058d7bf9d41906b9b22a20f67e671dd7c
imagePullPolicy: Always
livenessProbe:
httpGet:
@ -354,303 +354,3 @@ spec:
port: 8080
serviceAccountName: tekton-webhooks-extension
---
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: monitor-task
namespace: tekton-pipelines
spec:
params:
- description: The statuses url
name: statusesurl
type: string
- default: Success
description: The text to use in the situation where a PipelineRun has succeeded.
name: commentsuccess
type: string
- default: Failed
description: The text to use in the situation where a PipelineRun has failed.
name: commentfailure
type: string
- default: Unknown
description: The text to use in the situation where a PipelineRun has timed out.
name: commenttimeout
type: string
- default: Missing
description: The text to use in the situation where a PipelineRun cannot be found.
name: commentmissing
type: string
- default: http://localhost:9097/
description: The URL to the PipelineRuns page of the dashboard
name: dashboard-url
type: string
- default: github
description: The Git provider ("github" or "gitlab")
name: provider
type: string
- description: The Git API URL for the repository
name: apiurl
type: string
- default: "false"
description: Whether or not to verify SSL Certificates from the git server ("true"
or "false")
name: insecure-skip-tls-verify
type: string
- description: The secret containing the access token to access the git server
name: secret
type: string
resources:
inputs:
- name: pull-request
type: pullRequest
outputs:
- name: pull-request
type: pullRequest
steps:
- args:
- -ce
- "set -e\ncat <<EOF | python\nimport time, os, json, requests, pprint, shutil,
distutils.util\nfrom kubernetes import client, config\ndef diff(li1, li2): \n
\ li_dif = [i for i in li1 + li2 if i not in li1 or i not in li2] \n return
li_dif\nconfig.load_incluster_config()\napi_instance = client.CustomObjectsApi(client.ApiClient(client.Configuration()))\ngitPRcontext
= \"Tekton\"\ngitPRurl = \"\" \nif not \"$URL\".startswith(\"http\"):\n pipelineRunURLPrefix
= \"http://\" + \"$URL\"\nelse:\n pipelineRunURLPrefix = \"$URL\" \nverifySSL
= not bool(distutils.util.strtobool(\"$SKIPSSLVERIFY\"))\nif \"$GITPROVIDER\"
== \"github\":\n statusurl = \"$STATUSES_URL\"\n pendingData = {\n \"state\":
\"pending\",\n \"description\": \"pipelines in progress\",\n \"target_url\":
pipelineRunURLPrefix + \"/#/pipelineruns\",\n \"context\": \"Tekton\"\n }\n
\ resp = requests.post(statusurl, json.dumps(pendingData), headers = {'Content-Type':
'application/json', 'Authorization': \"Token $GITTOKEN\"}, verify=verifySSL)\n
\ print(resp)\nif \"$GITPROVIDER\" == \"gitlab\":\n statusurl = \"$GITAPIURL\"
+ \"/\" + \"$STATUSES_URL\" + \"?state=pending&name=Tekton&target_url=\" + pipelineRunURLPrefix
+ \"/#/pipelineruns\"\n resp = requests.post(statusurl, headers = {'Authorization':
\"Bearer $GITTOKEN\"}, verify=verifySSL)\n print(resp)\nlabelToCheck = \"triggers.tekton.dev/triggers-eventid=$EVENTID\"\nrunsPassed
= []\nrunsFailed = []\nrunsIncomplete = []\nrunsMissing = []\nfailed = 0\ni
= range(180)\ninitial_runs = api_instance.list_cluster_custom_object(\"tekton.dev\",
\"v1beta1\", \"pipelineruns\", label_selector=labelToCheck)[\"items\"]\nfor
x in i:\n time.sleep( 10 )\n runsPassed = []\n runsFailed = []\n runsIncomplete
= []\n # To test this we need a webhook that will kick off two Pipelines\n
\ # We will then delete one PipelineRun and observe it is correctly picked
up as missing\n # This is easiest done by reopening an existing PullRequest\n
\ # It's important to delete the PipelineRun only after the monitor task is
already running because \n # the first thing it's going to do is figure out
the PipelineRuns to watch over\n failed = 0\n \n found_runs = api_instance.list_cluster_custom_object(\"tekton.dev\",
\"v1beta1\", \"pipelineruns\", label_selector=labelToCheck)[\"items\"]\n missingRuns
= diff(initial_runs, found_runs)\n if len(missingRuns) > 0:\n for missingRun
in missingRuns:\n pr = missingRun[\"metadata\"][\"name\"]\n namespace
= missingRun[\"metadata\"][\"namespace\"]\n pipeline = missingRun[\"spec\"][\"pipelineRef\"][\"name\"]\n
\ link = pipelineRunURLPrefix + \"/#/namespaces/\" + namespace + \"/pipelineruns/\"\n
\ data = \"[**$COMMENT_MISSING**](\" + link + \") | \" + pipeline + \"
| \" + pr + \" | \" + namespace\n if data not in runsMissing:\n #
Don't add duplicates. Fear not, once this run is found it'll be removed\n runsMissing.append(data)\n
\ if len(found_runs) > 0:\n for entry in found_runs:\n pr = entry[\"metadata\"][\"name\"]\n
\ namespace = entry[\"metadata\"][\"namespace\"]\n pipeline = entry[\"spec\"][\"pipelineRef\"][\"name\"]\n
\ link = pipelineRunURLPrefix + \"/#/namespaces/\" + namespace + \"/pipelineruns/\"
+ pr\n missingLink = pipelineRunURLPrefix + \"/#/namespaces/\" + namespace
+ \"/pipelineruns/\"\n missingDataEntry = \"[**$COMMENT_MISSING**](\"
+ missingLink + \") | \" + pipeline + \" | \" + pr + \" | \" + namespace\n if
missingDataEntry in runsMissing:\n runsMissing.remove(missingDataEntry)\n
\ print(\"Checking PipelineRun \" + pr + \" in namespace \" + namespace)\n
\ if entry[\"status\"][\"conditions\"][0][\"status\"] == u'True' and entry[\"status\"][\"conditions\"][0][\"type\"]
== u'Succeeded':\n print(\"Success - pipelinerun \" + pr + \" in namespace
\" + namespace)\n runsPassed.append(\"[**$COMMENT_SUCCESS**](\" + link
+ \") | \" + pipeline + \" | \" + pr + \" | \" + namespace)\n continue\n
\ if entry[\"status\"][\"conditions\"][0][\"status\"] == u'False' and
entry[\"status\"][\"conditions\"][0][\"type\"] == u'Succeeded':\n failed
=+ 1\n print(\"Failed - PipelineRun \" + pr + \" in namespace \" +
namespace)\n runsFailed.append(\"[**$COMMENT_FAILURE**](\" + link +
\") | \" + pipeline + \" | \" + pr + \" | \" + namespace)\n continue\n
\ link = pipelineRunURLPrefix + \"/#/namespaces/\" + namespace + \"/pipelineruns/\"
+ pr\n runsIncomplete.append(\"[**$COMMENT_TIMEOUT**](\" + link + \")
| \" + pipeline + \" | \" + pr + \" | \" + namespace)\n if len(runsIncomplete)
== 0:\n break\n else:\n break\ngitPRdescription = \"All pipelines
succeeded!\"\ngitPRcode = \"success\"\nif failed > 0:\n gitPRdescription =
str(failed) + \" pipeline(s) failed!\"\n gitPRcode = \"failure\"\nif len(runsMissing)
> 0:\n gitPRdescription = \"Pipeline(s) missing!\"\n gitPRcode = \"failure\"\nif
len(runsIncomplete) > 0:\n print(\"Some PipelineRuns had not completed when
the monitor reached its timeout\")\n gitPRdescription = \"timed out monitoring
PipelineRuns\"\n gitPRcode = \"error\"\n\nresults = runsPassed + runsFailed
+ runsIncomplete + runsMissing\n\nif (results == []):\n gitPRdescription =
\"No PipelineRuns were ever found for my PullRequest!\"\n gitPRcode = \"error\"\n
\ data = \"**$COMMENT_MISSING** | N/A | No PipelineRuns were ever detected,
failing the build | N/A\"\n runsMissing.append(data) \n \n results
= runsMissing\n\ncomment = (\"## Tekton Status Report \\n\\n\"\n \"Status
| Pipeline | PipelineRun | Namespace\\n\"\n \":----- | :------- |
:--------------- | :--------\\n\"\n ) + \"\\n\".join(results)\n\nshutil.copyfile(\"/workspace/pull-request/pr.json\",\"/workspace/output/pull-request/pr.json\")\n#
Preserve existing comments\nshutil.copytree(\"/workspace/pull-request/comments\",\"/workspace/output/pull-request/comments\")\nhandle
= open(\"/workspace/output/pull-request/comments/newcomment.json\", 'w')\nhandle.write(comment)\nhandle.close()\nif
not \"$URL\".startswith(\"http\"):\n detailsURL = \"http://\" + \"$URL\" +
\"/#/pipelineruns\"\nelse:\n detailsURL = \"$URL\" + \"/#/pipelineruns\"\nprint(\"Set
details url to \" + detailsURL)\nstatus = json.dumps(dict(Label=gitPRcontext,state=gitPRcode,Desc=gitPRdescription,Target=detailsURL))\nprint(\"Setting
status to \" + status)\nif not os.path.exists(\"/workspace/output/pull-request/status\"):\n
\ os.makedirs(\"/workspace/output/pull-request/status\")\nhandle = open(\"/workspace/output/pull-request/status/Tekton.json\",
'w')\nhandle.write(status)\nhandle.close()\nif not os.path.exists(\"/workspace/output/pull-request/labels\"):\n
\ shutil.copytree(\"/workspace/pull-request/labels\",\"/workspace/output/pull-request/labels\")\nshutil.copyfile(\"/workspace/pull-request/base.json\",\"/workspace/output/pull-request/base.json\")
\nshutil.copyfile(\"/workspace/pull-request/head.json\",\"/workspace/output/pull-request/head.json\")\nEOF\n"
command:
- /bin/bash
env:
- name: EVENTID
valueFrom:
fieldRef:
fieldPath: metadata.labels['triggers.tekton.dev/triggers-eventid']
- name: COMMENT_SUCCESS
value: $(inputs.params.commentsuccess)
- name: COMMENT_FAILURE
value: $(inputs.params.commentfailure)
- name: COMMENT_TIMEOUT
value: $(inputs.params.commenttimeout)
- name: COMMENT_MISSING
value: $(inputs.params.commentmissing)
- name: URL
value: $(inputs.params.dashboard-url)
- name: STATUSES_URL
value: $(inputs.params.statusesurl)
- name: GITPROVIDER
value: $(inputs.params.provider)
- name: GITAPIURL
value: $(inputs.params.apiurl)
- name: SKIPSSLVERIFY
value: $(inputs.params.insecure-skip-tls-verify)
- name: GITTOKEN
valueFrom:
secretKeyRef:
key: accessToken
name: $(inputs.params.secret)
image: maiwj/kubernetes-python-client@sha256:74a868a0dff5c8ada64472db3efd09d205d4f877d14d2d3226511adbb25cfea3
name: check
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerBinding
metadata:
name: monitor-task-github-binding
namespace: tekton-pipelines
spec:
params:
- name: pullrequesturl
value: $(body.pull_request.html_url)
- name: statusesurl
value: $(body.pull_request.statuses_url)
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerBinding
metadata:
name: monitor-task-gitlab-binding
namespace: tekton-pipelines
spec:
params:
- name: pullrequesturl
value: $(body.object_attributes.url)
- name: statusesurl
value: projects/$(body.project.id)/statuses/$(body.object_attributes.last_commit.id)
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerTemplate
metadata:
name: monitor-task-template
namespace: tekton-pipelines
spec:
params:
- description: The pull request url
name: pullrequesturl
type: string
- description: The statuses url
name: statusesurl
type: string
- default: github-secrets
description: The git secret name
name: gitsecretname
type: string
- default: token
description: The git secret key name
name: gitsecretkeyname
type: string
- default: Success
description: The text of the success comment
name: commentsuccess
type: string
- default: Failed
description: The text of the failure comment
name: commentfailure
type: string
- default: Unknown
description: The text of the timeout comment
name: commenttimeout
type: string
- default: Missing
description: The text of the missing comment
name: commentmissing
type: string
- default: http://localhost:9097/
description: The URL to the pipelineruns page of the dashboard
name: dashboardurl
type: string
- default: github
description: The git provider, "github" or "gitlab"
name: provider
type: string
- default: ""
description: The git api URL for the repository
name: apiurl
type: string
- default: "false"
description: Whether or not to skip SSL validation of certificates ("true" or
"false")
name: insecure-skip-tls-verify
type: string
resourcetemplates:
- apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
name: pull-request-$(uid)
namespace: tekton-pipelines
spec:
params:
- name: url
value: $(params.pullrequesturl)
- name: insecure-skip-tls-verify
value: $(params.insecure-skip-tls-verify)
secrets:
- fieldName: authToken
secretKey: $(params.gitsecretkeyname)
secretName: $(params.gitsecretname)
type: pullRequest
- apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
generateName: monitor-taskrun-
namespace: tekton-pipelines
spec:
params:
- name: commentsuccess
value: $(params.commentsuccess)
- name: commentfailure
value: $(params.commentfailure)
- name: commenttimeout
value: $(params.commenttimeout)
- name: dashboard-url
value: $(params.dashboardurl)
- name: secret
value: $(params.gitsecretname)
- name: statusesurl
value: $(params.statusesurl)
- name: provider
value: $(params.provider)
- name: apiurl
value: $(params.apiurl)
- name: insecure-skip-tls-verify
value: $(params.insecure-skip-tls-verify)
resources:
inputs:
- name: pull-request
resourceRef:
name: pull-request-$(uid)
outputs:
- name: pull-request
resourceRef:
name: pull-request-$(uid)
serviceAccountName: tekton-webhooks-extension
taskRef:
name: monitor-task
---

104
tekton/1-Install/4-dashboard.yaml
View File

@ -49,7 +49,6 @@ rules:
- apiGroups:
- ""
resources:
- secrets
- configmaps
verbs:
- create
@ -125,6 +124,17 @@ rules:
- delete
- patch
- add
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- apiextensions.k8s.io
resources:
@ -184,7 +194,6 @@ rules:
- apiGroups:
- ""
resources:
- secrets
- configmaps
verbs:
- get
@ -272,8 +281,8 @@ kind: Service
metadata:
labels:
app: tekton-dashboard
dashboard.tekton.dev/release: v0.6.1
version: v0.6.1
dashboard.tekton.dev/release: v0.6.1.5
version: v0.6.1.5
name: tekton-dashboard
namespace: tekton-pipelines
spec:
@ -290,8 +299,8 @@ kind: Deployment
metadata:
labels:
app: tekton-dashboard
dashboard.tekton.dev/release: v0.6.1
version: v0.6.1
dashboard.tekton.dev/release: v0.6.1.5
version: v0.6.1.5
name: tekton-dashboard
namespace: tekton-pipelines
spec:
@ -313,13 +322,17 @@ spec:
value: "false"
- name: WEB_RESOURCES_DIR
value: /var/run/ko/web
- name: PIPELINE_RUN_SERVICE_ACCOUNT
value: ""
- name: CSRF_SECURE_COOKIE
value: "false"
- name: TRIGGERS_NAMESPACE
value: tekton-pipelines
- name: PIPELINE_NAMESPACE
value: tekton-pipelines
- name: INSTALLED_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:de969ff4ced12c94701bd039137edf5fc66bbc5ccd19f09324c1d7fcfc47e5f1
image: gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:ca22f87e8bec86cf91833aa3996cf9d316313628870eb74c1ea9a73bea77c83d
livenessProbe:
httpGet:
path: /health
@ -332,78 +345,5 @@ spec:
path: /readiness
port: 9097
serviceAccountName: tekton-dashboard
---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
name: pipeline0
namespace: tekton-pipelines
spec:
params:
- default: /workspace/git-source
description: The path to the resource files to apply
name: pathToResourceFiles
type: string
- default: .
description: The directory from which resources are to be applied
name: apply-directory
type: string
- default: tekton-pipelines
description: The namespace in which to create the resources being imported
name: target-namespace
type: string
resources:
- name: git-source
type: git
tasks:
- name: pipeline0-task
params:
- name: pathToResourceFiles
value: $(params.pathToResourceFiles)
- name: apply-directory
value: $(params.apply-directory)
- name: target-namespace
value: $(params.target-namespace)
resources:
inputs:
- name: git-source
resource: git-source
taskRef:
name: pipeline0-task
---
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: pipeline0-task
namespace: tekton-pipelines
spec:
params:
- default: /workspace/git-source
description: The path to the resource files to apply
name: pathToResourceFiles
type: string
- default: .
description: The directory from which resources are to be applied
name: apply-directory
type: string
- default: tekton-pipelines
description: The namespace where created resources will go
name: target-namespace
type: string
resources:
inputs:
- name: git-source
type: git
steps:
- args:
- apply
- -f
- $(inputs.params.pathToResourceFiles)/$(inputs.params.apply-directory)
- -n
- $(inputs.params.target-namespace)
command:
- kubectl
image: lachlanevenson/k8s-kubectl@sha256:9713d6c1c6d83bdd4b3744d295fd0efce8f6cc149eb3083e86ae0911aa52ee73
name: kubectl-apply
---