diff --git a/task/ansible-tower-cli/0.2/Dockerfile b/task/ansible-tower-cli/0.2/Dockerfile new file mode 100644 index 0000000000..12dedcffbd --- /dev/null +++ b/task/ansible-tower-cli/0.2/Dockerfile @@ -0,0 +1,16 @@ +FROM registry.access.redhat.com/ubi7/ubi + +RUN curl -O https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm && \ + yum install ./epel-release-latest-*.noarch.rpm -y && \ + yum update -y && \ + yum install python-pip -y && \ + pip install --upgrade pip && \ + pip install ansible-tower-cli --no-cache-dir && \ + yum clean all && \ + rm -rf /var/cache/yum && \ + rm -rf ~/.cache/pip + +USER 1001 + +ENTRYPOINT ["/usr/bin/tower-cli/"] + diff --git a/task/ansible-tower-cli/0.2/README.md b/task/ansible-tower-cli/0.2/README.md new file mode 100644 index 0000000000..4bf7fd48b6 --- /dev/null +++ b/task/ansible-tower-cli/0.2/README.md @@ -0,0 +1,86 @@ + +## Ansible Tower CLI Task + +[Ansible Tower](https://ansible.com/tower) (formerly ‘AWX’) is a web-based solution that makes Ansible even more easy to use for IT teams of all kinds, It provides the `tower-cli`([Tower-CLI](https://docs.ansible.com/ansible-tower/latest/html/towerapi/tower_cli.html)) command line tool that simplifies the tasks of starting jobs, workflow jobs, manage users, projects etc. + +## Install the Task + +Install `tower-cli` task: +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/ansible-tower-cli/0.2/ansible-tower-cli.yaml +``` + +## Parameters + +* **ARGS:** args to execute which are appended to `tower-cli` e.g. `user-list` (_default_: `--help`) +* **SSLVERIFY:** args to disable Tower SSL verification (_default_: `false`) +* **HOST:** The Ansible Tower HOST +* **tower-secret:** the name of the secret containing the user and password for authentication on the ansible tower host (_default_: `tower-creds`) + +## Tower-Secret + +This is a [secret]([https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/)) example with USER and PASS information that are going to be used by the task + +```yaml +kind: Secret +apiVersion: v1 +metadata: + name: tower-creds + namespace: ansible-tower-pipelines-test + selfLink: /api/v1/namespaces/ansible-tower-pipelines-test/secrets/tower-creds + uid: 024681c0-f4e8-11e9-81e2-52fdfc072182 + resourceVersion: '721636' + creationTimestamp: '2019-10-22T16:21:31Z' +data: + PASS: YWRtaW50b3dlcg== + USER: YWRtaW4= +type: Opaque +``` + + +To create a secret you can use the following command + +``` +kubectl create secret generic tower-creds --from-literal=username=TOWER_USER --from-literal=password=TOWER_USER_PASSWORD +``` + +## ServiceAccount + +If you don't specify a service account to be used for running the `TaskRun` or `PipelineRun`, the `default` [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server). OpenShift by default does not allow the default service account to modify objects in the namespace. Therefore you should either explicitly grant permission to the default service account (by creating rolebindings) or [create a new service account with sufficient privileges](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions) and specify it on the [`TaskRun`](https://github.com/tektoncd/pipeline/blob/main/docs/taskruns.md#service-account) or [`PipelineRun`](https://github.com/tektoncd/pipeline/blob/main/docs/pipelineruns.md#service-account). + +You can do the former via `oc` and running the following command, replacing `` with your target namespace: +``` +oc policy add-role-to-user edit -z default -n +``` + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +This is a pipeline example passing the required credentials, and a list of arguments to the ARGS array variable. + +```yaml +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: tower-cli-example +spec: + tasks: + - name: tower + taskRef: + name: ansible-tower-cli + params: + - name: SSLVERIFY + value: "false" + - name: HOST + value: "10.8.109.202" + - name: tower-secret + value: "tower-creds" + - name: ARGS + value: + - user + - list + +``` diff --git a/task/ansible-tower-cli/0.2/ansible-tower-cli.yaml b/task/ansible-tower-cli/0.2/ansible-tower-cli.yaml new file mode 100644 index 0000000000..8f7837f060 --- /dev/null +++ b/task/ansible-tower-cli/0.2/ansible-tower-cli.yaml @@ -0,0 +1,70 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: ansible-tower-cli + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: ansible, cli + tekton.dev/displayName: "ansible tower cli" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + Ansible-tower-cli task simplifies starting jobs, workflow jobs, + manage users, projects etc. + + Ansible Tower (formerly ‘AWX’) is a web-based solution that makes Ansible + even more easy to use for IT teams of all kinds, It provides the + tower-cli(Tower-CLI) command line tool that simplifies the tasks of + starting jobs, workflow jobs, manage users, projects etc. + + params: + - name: SSLVERIFY + description: Disable tower ssl verification + default: "false" + type: string + - name: ARGS + description: The tower-cli commands to tun + type: array + default: + - "--help" + - name: HOST + description: The Ansible Tower host + type: string + default: "" + - name: tower-secret + description: The Ansible Tower secret with credentials + type: string + default: "tower-creds" + steps: + - name: config + image: quay.io/rcmendes/ansible-tower-cli@sha256:3a61778f410526db8d6e02e87715d58ee770c4a4faf57ac408cb5ec1a025ef2c #tag: latest + command: + - '/bin/sh' + - '-c' + args: + - |- + echo -e "verify_ssl = $(params.SSLVERIFY)\nverbose = true\nhost = $(params.HOST)\nusername = $USER\npassword = $PASS" > ~/.tower_cli.cfg + chmod 600 ~/.tower_cli.cfg + echo "Generated tower_cli.cfg file" + echo "-----------------------------" + ls -lah ~/ | grep tower_cli + echo "-----------------------------" + env: + - name: USER + valueFrom: + secretKeyRef: + name: $(params.tower-secret) + key: USER + - name: PASS + valueFrom: + secretKeyRef: + name: $(params.tower-secret) + key: PASS + - name: tower-cli + image: quay.io/rcmendes/ansible-tower-cli@sha256:3a61778f410526db8d6e02e87715d58ee770c4a4faf57ac408cb5ec1a025ef2c #tag: latest + command: ["/usr/bin/tower-cli"] + args: + - "$(params.ARGS)" diff --git a/task/aws-cli/0.3/README.md b/task/aws-cli/0.3/README.md new file mode 100644 index 0000000000..3b1eacb365 --- /dev/null +++ b/task/aws-cli/0.3/README.md @@ -0,0 +1,75 @@ +# aws + +This task performs operations on Amazon Web Services resources using `aws`. + +All aws cli commands can be found [here](https://docs.aws.amazon.com/cli/latest/reference/). + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/aws-cli/0.3/aws-cli.yaml +``` + +## Parameters + +- **SCRIPT**: The script of aws commands to execute e.g. `aws $1 $2` This will take + the first value and second value of ARGS as `s3` and `ls` (default: `aws $@`) +- **ARGS**: The arguments to pass to `aws` CLI, which are appended + to `aws` e.g. `s3 ls` ( default: `["help"]` ). + + +## Workspaces + +- **source**: To mount file which is to be uploaded to the aws resources, + this should be mounted using any volume supported in workspace. +- **secrets**: A workspace that consists of credentials required by `aws` which will be mounted to $HOME/.aws. + This workspace can be omitted when using instance-profile credentials. + + +## Secret + +AWS `credentials` and `config` both should be provided in the form of `secret`. + +[This](../0.2/samples/secret.yaml) example can be referred to create `aws-credentials`. + +Refer [this](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html) guide for setting up AWS Credentials and Region. + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +After creating the task, you should now be able to execute `aws` commands by +specifying the command you would like to run as the `ARGS` or `SCRIPT` param. + +The `ARGS` param takes an array of aws subcommands that will be executed as +part of this task and the `SCRIPT` param takes the multiple commands that you would like to run on aws CLI. + +This [samples](../0.2/samples/secret.yaml), can be referred to create secret file for aws credentials. + +In the [samples](../0.2/samples/run.yaml), ConfigMap as the volume is used. In place of ConfigMap, any volume supported in workspace can be used. + +Following `command` can be used to create `ConfigMap` from the `file`. +``` +kubectl create configmap upload-file --from-file=demo.zip +``` +Here `upload-file` is the name of the `ConfigMap`, this can be changed based on the requirements. + +See [here](../0.2/samples/run.yaml) for example of `aws s3` command. + + +### Note + + +- Either `SCRIPT` or `ARGS` must be provided in the `params` of the task. + +- To support multiple `aws` commands to run on a single task, SCRIPT can be used as follows: + + ```yaml + - name: SCRIPT + value: | + aws s3 mb s3://test-bucket + aws s3api put-object --bucket test-bucket --key test/ + aws s3 cp $(workspaces.source.path)/demo.zip s3://test-bucket/test/demo.zip + ``` diff --git a/task/aws-cli/0.3/aws-cli.yaml b/task/aws-cli/0.3/aws-cli.yaml new file mode 100644 index 0000000000..e4de3426a1 --- /dev/null +++ b/task/aws-cli/0.3/aws-cli.yaml @@ -0,0 +1,41 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: aws-cli + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: cli + tekton.dev/displayName: "aws cli" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task performs operations on Amazon Web Services resources using aws. + + workspaces: + - name: source + optional: true + - name: secrets + optional: true + mountPath: /tekton/home/.aws + params: + - name: SCRIPT + description: The AWS script to run + type: string + default: "aws $@" + - name: ARGS + description: AWS cli arguments to be passed + type: array + default: ["help"] + stepTemplate: + env: + - name: "HOME" + value: "/tekton/home" + steps: + - name: awscli + image: docker.io/amazon/aws-cli:2.0.52@sha256:1506cec98a7101c935176d440a14302ea528b8f92fcaf4a6f1ea2d7ecef7edc4 #tag: 2.0.52 + script: eval "$(params.SCRIPT)" + args: + - "$(params.ARGS)" \ No newline at end of file diff --git a/task/aws-cli/0.3/samples/run.yaml b/task/aws-cli/0.3/samples/run.yaml new file mode 100644 index 0000000000..2d1de05616 --- /dev/null +++ b/task/aws-cli/0.3/samples/run.yaml @@ -0,0 +1,24 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + generateName: aws-run- +spec: + taskRef: + name: aws-cli + params: + - name: SCRIPT + value: | + aws $1 mb s3://$2 + aws s3api put-object --bucket $2 --key test/ + aws $1 cp $(workspaces.source.path)/demo.zip s3://$2/test/demo.zip + - name: ARGS + value: + - s3 + - diagrawa-test + workspaces: + - name: secrets + secret: + secretName: aws-credentials + - name: source + configMap: + name: upload-file \ No newline at end of file diff --git a/task/aws-cli/0.3/samples/secret.yaml b/task/aws-cli/0.3/samples/secret.yaml new file mode 100644 index 0000000000..d940c24bf9 --- /dev/null +++ b/task/aws-cli/0.3/samples/secret.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Secret +metadata: + name: aws-credentials +type: Opaque +stringData: + credentials: |- + [$(profile-name)] + aws_access_key_id = $(aws_access_key_id) + aws_secret_access_key = $(aws_secret_access_key) + + [default] + aws_access_key_id = $(aws_access_key_id) + aws_secret_access_key = $(aws_secret_access_key) + config: |- + [profile $(profile-name)] + region = us-east-1 + output = text + [default] + region = us-east-2 \ No newline at end of file diff --git a/task/az/0.2/README.md b/task/az/0.2/README.md new file mode 100644 index 0000000000..2062324b8b --- /dev/null +++ b/task/az/0.2/README.md @@ -0,0 +1,43 @@ +# `az` + +This task performs operations on Microsoft Azure resources using `az`. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/az/0.2/az.yaml +``` + +## Parameters + +* **az-image**: `az` CLI container image to run this task. + + _default_: `mcr.microsoft.com/azure-cli:2.0.77` + + You can use a specific version of the `az` CLI by specifying the `az-image` param with the `mcr.microsoft.com/azure-cli` image tagged with the specific version of the CLI you would like to use (i.e. version 2.0.70 = `mcr.microsoft.com/azure-cli:2.0.70`). A full list of available version tags can be found under the [Full Tag Listing](https://hub.docker.com/_/microsoft-azure-cli) section of the `az` Docker Hub. + +* **ARGS**: The arguments to pass to `az` CLI. This parameter is required to run this task. + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +### Running the Task + +After creating the task, you should now be able to execute `az` commands by specifying the command you would like to run as the `ARGS` param. The `ARGS` param takes an array of `az` subcommands that will be executed as part of this task. + +### Examples + +Run `az ad --help` using `az`. Start the task using the Tekton CLI (`tkn`): + +```shell +tkn task start az -p ARGS=ad,--help +``` + +Specify a different `az-image` to use with the `az` task: + +```shell +tkn task start az -p az-image=mcr.microsoft.com/azure-cli:2.0.70 +``` diff --git a/task/az/0.2/az.yaml b/task/az/0.2/az.yaml new file mode 100644 index 0000000000..118306e737 --- /dev/null +++ b/task/az/0.2/az.yaml @@ -0,0 +1,33 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: az + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: cli + tekton.dev/displayName: "azure cli" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task performs operations on Microsoft Azure resources using az. + + After creating the task, you should now be able to execute az commands by + specifying the command you would like to run as the ARGS param. The ARGS + param takes an array of az subcommands that will be executed as part of + this task. + + params: + - name: az-image + description: Azure CLI container image to run this task + default: mcr.microsoft.com/azure-cli:2.0.78 + - name: ARGS + type: array + description: Azure CLI arguments to run + steps: + - name: az + image: "$(params.az-image)" + command: ["az"] + args: ["$(params.ARGS)"] diff --git a/task/curl/0.2/README.md b/task/curl/0.2/README.md new file mode 100644 index 0000000000..0a7e6c92b1 --- /dev/null +++ b/task/curl/0.2/README.md @@ -0,0 +1,94 @@ + +# `curl` + +This task performs curl operation to transfer data from internet . + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/curl/0.2/curl.yaml +``` + +## Parameters + +* **options**: The arguments to pass to `curl` CLI. _default_: `[""]` +* **url**: The url we want to download file from, required field. +* **curl-image**: The curl docker image to be used. Defaults to `curlimages/curl`. + +## Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms. + +## Usage + +### Running the Task + +#### Viewing request headers and connection details + +You can invoke `curl -i url` to get request header from specified url: + +Create a file, `curl-header-run.yaml`: + +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: curl-header-run +spec: + params: + - name: url + value: "www.google.com" + - name: options + value: + - "-i" + taskRef: + name: curl +``` + +Run it with `kubectl apply -f curl-header-run.yaml` + +When this runs, it will print logs containing only headers of the response + +#### View full response from request to specified url +You can invoke `curl url` to get a full response from specified url: + +Create a file, `curl-reponse-run.yaml`: +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: curl-response-run +spec: + params: + - name: url + value: "www.google.com" + taskRef: + name: curl +``` +Run it with `kubectl apply -f curl-response-run.yaml` + +When this runs, it will print logs containing full response fields of the request + +#### Use a different version of curl image +You can invoke `curl url` to get a full response from specified url while specifying a different image in taskrun: + +Create a file, `curl-diffimage-run.yaml`: +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: curl-diffimage-run +spec: + params: + - name: url + value: "www.google.com" + - name: curl-image + value: "appropriate/curl" + taskRef: + name: curl +``` +Run it with `kubectl apply -f curl-diffimage-run.yaml` + +When this runs, it will print logs containing full response fields of the request as in the last example, but now uses a different version of image + + diff --git a/task/curl/0.2/curl.yaml b/task/curl/0.2/curl.yaml new file mode 100644 index 0000000000..954b505578 --- /dev/null +++ b/task/curl/0.2/curl.yaml @@ -0,0 +1,32 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: curl + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: search + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + This task performs curl operation to transfer data from internet. + + params: + - name: url + description: URL to curl'ed + type: string + - name: options + description: options of url + type: array + default: [] + - name: curl-image + description: option of curl image + type: string + default: "docker.io/curlimages/curl:7.72.0@sha256:bd5bbd35f89b867c1dccbc84b8be52f3f74dea20b46c5fe0db3780e040afcb6f" #tag: 7.72.0 + steps: + - name: curl + image: "$(params.curl-image)" + command: [curl] + args: ["$(params.options[*])", "$(params.url)"] diff --git a/task/curl/0.2/tests/run.yaml b/task/curl/0.2/tests/run.yaml new file mode 100644 index 0000000000..a73546289b --- /dev/null +++ b/task/curl/0.2/tests/run.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: curl-header-run +spec: + params: + - name: url + value: "www.google.com" + - name: options + value: + - "-i" + taskRef: + name: curl +--- +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: curl-response-run +spec: + params: + - name: url + value: "www.google.com" + taskRef: + name: curl diff --git a/task/gogit/0.2/README.md b/task/gogit/0.2/README.md new file mode 100644 index 0000000000..6fb127a645 --- /dev/null +++ b/task/gogit/0.2/README.md @@ -0,0 +1,41 @@ +# Gogit + +GitHub and Gitlab have their own continuous integration (CI) systems, it's easy to see the status of pipelines. +But when users decide to use an alternative CI tool instead of the build in, they will need extra steps to send the status back. +Similar to [gitea-set-status](../gitea-set-status/0.1/README.md), [gitlab-set-status](../gitlab-set-status/0.1/README.md), and [github-set-status](../github-set-status/0.1/README.md), this task could send build status to GitHub/Gitlab. + +See more details from https://github.com/linuxsuren/gogit + +## Install the task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/gogit/0.2/gogit.yaml +``` + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +This TaskRun runs the Task to send build status from +[`tektoncd/pipeline`](https://github.com/tektoncd/pipeline). + +```yaml +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: send-build-status +spec: + taskRef: + name: gogit + params: + - name: repo + value: test + - name: username + value: linuxsuren + - name: token + value: my-token + - name: pull_request_number + value: my-pull-request-number +``` diff --git a/task/gogit/0.2/gogit.yaml b/task/gogit/0.2/gogit.yaml new file mode 100644 index 0000000000..8b4b1bcac5 --- /dev/null +++ b/task/gogit/0.2/gogit.yaml @@ -0,0 +1,49 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: gogit + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: search + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + Send a build status to Gitlab/GitHub. + params: + - name: provider + description: provider name of git + type: string + default: github + - name: repo + description: git repository name + type: string + - name: username + description: username of git provider + type: string + - name: token + description: personal access token of git provider + type: string + - name: pull_request_number + description: pull request number + type: string + - name: gogit-image + description: option of gogit image + type: string + default: "ghcr.io/linuxsuren/gogit:v0.0.1@sha256:33e06228b645dd46102c0870c11d420a213cdab84b7a0700dcb6da6ce8b530d6" + steps: + - name: gogit + image: "$(params.gogit-image)" + args: + - --provider + - $(params.provider) + - --repo + - $(params.repo) + - --username + - $(params.username) + - --token + - $(params.token) + - --pr + - $(params.pull_request_number) diff --git a/task/kn/0.3/README.md b/task/kn/0.3/README.md new file mode 100644 index 0000000000..19937864af --- /dev/null +++ b/task/kn/0.3/README.md @@ -0,0 +1,130 @@ +# Knative with `kn` + +This Task performs operations on Knative resources (services, revisions, routes) using +[`kn`](https://github.com/knative/client) CLI. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.3/kn.yaml +``` + +## Parameters + +* **kn-image**: `kn` CLI container image to run this task. + + _default_: `gcr.io/knative-releases/knative.dev/client/cmd/kn:latest` + + You can use nightly build of the `kn` CLI using + `gcr.io/knative-nightly/knative.dev/client/cmd/kn`. + + +* **ARGS**: The arguments to pass to `kn` CLI. _default_: `["help"]` + +## Resources + +### Inputs + +* **image**: An `image`-type `PipelineResource` specifying the location of the + container image to deploy for Knative Service. + + User provides the `image`-type resource to kn CLI in parameter `ARGS` as an + element of the array, for e.g. `"--image=$(inputs.resources.image.url)"`. + +## Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms. + +## Usage + +### Authorizing the Deployment + +In order to create Knative services, you must first define a `ServiceAccount` +with permission to manage Knative resources. + +To create a `ServiceAccount` with these permissions, you can run: + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.3/support/kn-deployer.yaml +``` + +### Running the Task + +Let's take examples of creating and updating a Knative Service using `kn` task. + +1. Following TaskRun runs the Task to create a Knative Service using given image. + +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + generateName: kn-create- +spec: + serviceAccountName: kn-deployer-account # <-- run as the authorized SA + taskRef: + name: kn + resources: + inputs: + - name: image + resourceSpec: + type: image + params: + - name: url + value: gcr.io/knative-samples/helloworld-go + params: + - name: ARGS + value: + - "service" + - "create" + - "hello" + - "--force" + - "--image=$(inputs.resources.image.url)" +``` + +Run this with: + +``` +kubectl create -f kn-create-taskrun.yaml +``` + +2. Following TaskRun runs the Task to update a Knative Service using given image or parameters. + +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + generateName: kn-update- +spec: + serviceAccountName: kn-deployer-account # <-- run as the authorized SA + taskRef: + name: kn + resources: + inputs: + - name: image + resourceSpec: + type: image + params: + - name: url + value: gcr.io/knative-samples/helloworld-go + params: + - name: ARGS + value: + - "service" + - "update" + - "hello" + - "--image=$(inputs.resources.image.url)" + - "--env=TARGET=Tekton" +``` + +Run this with: + +``` +kubectl create -f kn-update-taskrun.yaml +``` + +In these examples, the `image` resource can be built before hand, most +likely using a previous task. + +## Pipeline +Checkout the sample Pipelines for building your git source and deploying +as Knative Service [here](./knative-dockerfile-deploy/README.md). diff --git a/task/kn/0.3/kn.yaml b/task/kn/0.3/kn.yaml new file mode 100644 index 0000000000..1ceec2c506 --- /dev/null +++ b/task/kn/0.3/kn.yaml @@ -0,0 +1,37 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: kn + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/displayName: "kn" + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: cli + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + This Task performs operations on Knative resources + (services, revisions, routes) using kn CLI + + params: + - name: kn-image + description: kn CLI container image to run this task + default: gcr.io/knative-releases/knative.dev/client/cmd/kn:latest + - name: ARGS + type: array + description: kn CLI arguments to run + default: + - "help" + steps: + - name: kn + env: + - name: HOME + value: /tekton/home + image: "$(params.kn-image)" + command: ["/ko-app/kn"] + args: ["$(params.ARGS)"] + securityContext: + runAsNonRoot: true + runAsUser: 65532 diff --git a/task/kn/0.3/knative-dockerfile-deploy/README.md b/task/kn/0.3/knative-dockerfile-deploy/README.md new file mode 100644 index 0000000000..0f6250537c --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/README.md @@ -0,0 +1,103 @@ +# Git Source with Dockerfile to Knative Service + +This documents the example Pipeline to build the source code with a Dockerfile in +the git repo and deploy it as Knative Service. +It uses [buildah task](../../buildah/README.md) for building the source code and +[kn task](../README.md) to create or update a Knative Service. + +## Prerequisites: + +1. Latest Tekton Pipelines [install](https://github.com/tektoncd/pipeline/blob/main/docs/install.md)ed. +2. `kubectl` CLI [install](https://kubernetes.io/docs/tasks/tools/install-kubectl/)ed. +3. `tkn` CLI [install](https://github.com/tektoncd/cli#installing-tkn)ed. +4. User account exists at a container registry (e.g. [quay.io](https://quay.io)) +5. A ServiceAccount to enable access to perform the required operations in the Pipeline, + we'll configure one in following section. + +### One time setup: + +1 - Create a sample namespace `tkn-kn`, we'll reference this namespace in the subsequent operations. +```bash +kubectl create namespace tkn-kn +``` + +2 - Create a `docker-registry` type secrets for pushing/pulling the built container images. +```bash +kubectl create secret docker-registry container-registry --docker-server= --docker-username= --docker-password= --docker-email= +``` +More about secrets for [`interacting with a private registry`](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). + +#### Note: +- For using `docker.io`: Please [create a new](https://hub.docker.com/repository/create) empty public repository and refer it in subsequent steps. +- For using `quay.io`: No need to create a repository beforehand. + +3 - Create a ServiceAccount `kn-deployer-account` and + - link `container-registry` secret created above in step 2 + - create cluster role `kn-deployer` to access the Knative resources + - binds the ServiceAccount with cluster role `kn-deployer` in namespace `tkn-kn` + - Save following YAML in e.g. `kn_deployer.yaml` and apply using `kubectl apply -f kn_deployer.yaml`. + +```yaml +# Define a ServiceAccount named kn-deployer-account that has permission to +# manage Knative services. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kn-deployer-account + namespace: tkn-kn +# Link the container registry secrets +secrets: + - name: container-registry +# To be able to pull the (private) image from the container registry +imagePullSecrets: + - name: container-registry +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kn-deployer +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["services"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kn-deployer-binding +subjects: +- kind: ServiceAccount + name: kn-deployer-account + namespace: tkn-kn +roleRef: + kind: ClusterRole + name: kn-deployer + apiGroup: rbac.authorization.k8s.io +``` + + - If you've used the same names for namespace and secrets as mentioned above, you can configure the ServiceAccount with the YAML file in this repo using: +```bash +kubectl create -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/kn_deployer.yaml +``` + +4 - Install buildah task from tektoncd/catalog +```bash +https://raw.githubusercontent.com/tektoncd/catalog/main/task/buildah/0.4/buildah.yaml +``` + +5 - Install the kn task from the tektoncd/catalog +```bash +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/kn.yaml +``` + +5 - Install the git-clone task from the tektoncd/catalog +```bash +https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.8/git-clone.yaml +``` + +## Pipelines: + +Let's create some Pipelines using `git-clone`, `buildah` and `kn` tasks: +1. Create an image from git source and deploy to the Knative Service [pipeline](./build_deploy/README.md) +2. Deploy a new Revision to the Knative Service [pipeline](./service_update/README.md) +3. Perform traffic operations on the Knative Service [pipeline](./service_traffic/README.md) diff --git a/task/kn/0.3/knative-dockerfile-deploy/build_deploy/README.md b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/README.md new file mode 100644 index 0000000000..7807c4a3c4 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/README.md @@ -0,0 +1,163 @@ +# Build and Deploy Pipeline + +Let's create a container image from a git source having a Dockerfile and deploy it to a Knative Service. +This Pipeline clones source code using `git-clone` builds and push the git source using `buildah` and deploys the container as Knative Service using `kn`. + +## Pipeline: + +The following Pipeline definition refers: +- `git-clone` to clone the source code +- `buildah` and `kn` tasks (we've installed these tasks in One time Setup section) +- PersistentVolumeClaim for shared workspace +- Save the following YAML in a file e.g.: `build_deploy_pipeline.yaml` and create the Pipeline using + `kubectl create -f build_deploy_pipeline.yaml` + +```yaml +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: buildah-build-kn-create +spec: + workspaces: + - name: source + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + - name: GIT_URL + type: string + description: Git url to clone + - name: IMAGE + type: string + description: The application image built by Buildah and used by kn task. + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: source + params: + - name: url + value: $(params.GIT_URL) + - name: subdirectory + value: "" + - name: deleteExisting + value: "true" + - name: buildah-build + taskRef: + name: buildah + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: source + params: + - name: IMAGE + value: "$(params.IMAGE)" + - name: kn-service-create + taskRef: + name: kn + runAfter: + - buildah-build + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" +``` + + - You can also create this Pipeline using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/build_deploy/build_deploy_pipeline.yaml +``` +## Shared Workspace + +Let's create PersistentVolumeClaim for the workspace shared by individual tasks. The PVC is referenced in the PipelineRun below. + +### Note: + - Make sure the git repository has a Dockerfile at root of the repo. + - Make sure the container repository URL is correct, and you have push access to. + - If you are using docker.io container registry, please [create a new](https://hub.docker.com/repository/create) empty repository in advance. + +Save the following YAML for resources in a file e.g.: `resources.yaml`. +Create the resource as `kubectl create -f resources.yaml`. + +```yaml +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: clone-source-pvc +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 500Mi +``` + +## PipelineRun: + +- Let's trigger the Pipeline we've created above referencing the resources via PipelineRun. +- Note that we've referenced ServiceAccount `kn-deployer-account` in `kn` CLI arguments, + it tells `kn` which ServiceAccount to use while pulling the image from (private) container registry. +- Also note that, we're creating a service named `hello` and asking to create Revision + `hello-v1`, we'll use this Revision name in subsequent Pipeline operations. + +Save the following YAML in a file e.g.: `pipeline_run.yaml` and create PipelineRun as +`kubectl create -f pipeline_run.yaml`. + +```yaml +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: buildah-build-kn-create- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: buildah-build-kn-create + workspaces: + - name: source + persistentvolumeclaim: + claimName: clone-source-pvc + params: + - name: GIT_URL + value: "https://github.com/navidshaikh/helloworld-go" + - name: IMAGE + value: "quay.io/navidshaikh/helloworld-go" + - name: ARGS + value: + - "service" + - "create" + - "hello" + - "--revision-name=hello-v1" + - "--image=quay.io/navidshaikh/helloworld-go" + - "--env=TARGET=Tekton" + - "--service-account=kn-deployer-account" +``` + + - You can also create this PipelineRun using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/build_deploy/pipeline_run.yaml +``` + +- We can monitor the logs of this PipelineRun using `tkn` CLI +```bash +tkn pr list +tkn pr logs logs -f +``` + +- After the successful PipelineRun, we should have the source built, pushed to the repo and deployed as Knative Service. Let's check it: + +```bash +kubectl get ksvc hello +``` + +## What's Next: +- We've built a container image from git source, pushed it to a container registry, deployed a Knative Service using the image. +- You can use other available `kn` options to configure the Service, just add them to `params.ARGS` field in above `pipeline_run.yaml`. Check the list of supported options in `kn` [here](https://github.com/knative/client/blob/master/docs/cmd/kn.md). +- We've further Pipeline examples showing [service update](../service_update/README.md) and [service traffic](../service_traffic/README.md) operations. diff --git a/task/kn/0.3/knative-dockerfile-deploy/build_deploy/build_deploy_pipeline.yaml b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/build_deploy_pipeline.yaml new file mode 100644 index 0000000000..85a55a38cf --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/build_deploy_pipeline.yaml @@ -0,0 +1,55 @@ +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: buildah-build-kn-create +spec: + workspaces: + - name: source + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + - name: GIT_URL + type: string + description: Git url to clone + - name: IMAGE + type: string + description: The application image to be built by Buildah and deployed by kn task. + tasks: + - name: fetch-repository + taskRef: + name: git-clone + workspaces: + - name: output + workspace: source + params: + - name: url + value: $(params.GIT_URL) + - name: subdirectory + value: "" + - name: deleteExisting + value: "true" + - name: buildah-build + taskRef: + name: buildah + runAfter: + - fetch-repository + workspaces: + - name: source + workspace: source + params: + - name: IMAGE + value: "$(params.IMAGE)" + - name: kn-service-create + taskRef: + name: kn + runAfter: + - buildah-build + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" diff --git a/task/kn/0.3/knative-dockerfile-deploy/build_deploy/pipeline_run.yaml b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/pipeline_run.yaml new file mode 100644 index 0000000000..822071f10c --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/pipeline_run.yaml @@ -0,0 +1,26 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: buildah-build-kn-create- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: buildah-build-kn-create + workspaces: + - name: source + persistentVolumeClaim: + claimName: clone-source-pvc + params: + - name: GIT_URL + value: "https://github.com/navidshaikh/helloworld-go" + - name: IMAGE + value: "quay.io/navidshaikh/helloworld-go" + - name: ARGS + value: + - "service" + - "create" + - "hello" + - "--revision-name=hello-v1" + - "--image=quay.io/navidshaikh/helloworld-go" + - "--env=TARGET=Tekton" + - "--service-account=kn-deployer-account" diff --git a/task/kn/0.3/knative-dockerfile-deploy/build_deploy/resources.yaml b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/resources.yaml new file mode 100644 index 0000000000..86aa150f96 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/build_deploy/resources.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: clone-source-pvc +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 500Mi diff --git a/task/kn/0.3/knative-dockerfile-deploy/kn_deployer.yaml b/task/kn/0.3/knative-dockerfile-deploy/kn_deployer.yaml new file mode 100644 index 0000000000..7fc7ad9276 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/kn_deployer.yaml @@ -0,0 +1,35 @@ +# Define a ServiceAccount named kn-deployer-account that has permission to +# manage Knative services. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kn-deployer-account + namespace: tkn-kn +# Link the container registry secrets +secrets: + - name: container-registry +# To be able to pull the (private) image from the container registry +imagePullSecrets: + - name: container-registry +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kn-deployer +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["services"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kn-deployer-binding +subjects: +- kind: ServiceAccount + name: kn-deployer-account + namespace: tkn-kn +roleRef: + kind: ClusterRole + name: kn-deployer + apiGroup: rbac.authorization.k8s.io diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_traffic/README.md b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/README.md new file mode 100644 index 0000000000..1b722e8af6 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/README.md @@ -0,0 +1,85 @@ +# Set Traffic for Knative Service + +Let's perform traffic splitting on the Knative Service using Pipeline. +If you followed the earlier two Pipeline examples, you already have a couple of Revisions available, that we'll reference in PipelineRun to +configure the Service to route 50-50% traffic to each Revision. + +## Pipeline: + +- The following Pipeline is focused only on performing traffic operations + on Service. It does not define/require any Pipeline resources. +- Save the following YAML in a file say e.g.: `kn_service_traffic_pipeline.yaml` and create using + `kubectl create -f kn_service_traffic_pipeline.yaml`. + +```yaml +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kn-service-traffic-splitting +spec: + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + tasks: + - name: kn-service-traffic-splitting + taskRef: + name: kn + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" +``` + + - You can also create this Pipeline using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/service_traffic/kn_service_traffic_splitting_pipeline.yaml +``` + +## PipelineRun: + +- Create the PipelineRun to trigger the Pipeline and provide the kn CLI arguments to perform the traffic splitting. +- Note that, we're referencing Revisions `hello-v1` and `hello-v2` here, which we've created in earlier Pipeline examples. +- Save the following YAML in a file e.g: `pipeline_run.yaml` and create using + `kubectl create -f pipeline_run.yaml`. + +```yaml +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: kn-service-traffic-splitting- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: kn-service-traffic-splitting + params: + - name: ARGS + value: + - "service" + - "update" + - "hello" + - "--tag=hello-v1=v1" + - "--tag=hello-v2=v2" + - "--traffic=v1=50" + - "--traffic=v2=50" +``` +- You can also create this PipelineRun using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/service_traffic/pipeline_run.yaml +``` + +- Let's monitor the logs of the Pipeline run using `tkn` +```bash +tkn pr list +tkn pr logs logs -f +``` + +- After the successful run of the Pipeline, we should have the Knative Service updated with mentioned traffic settings +```bash +kubectl get ksvc hello +kubectl describe ksvc hello +``` diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_traffic/kn_service_traffic_splitting_pipeline.yaml b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/kn_service_traffic_splitting_pipeline.yaml new file mode 100644 index 0000000000..8f058b91a7 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/kn_service_traffic_splitting_pipeline.yaml @@ -0,0 +1,21 @@ +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kn-service-traffic-splitting +spec: + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + tasks: + - name: kn-service-traffic-splitting + taskRef: + name: kn + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_traffic/pipeline_run.yaml b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/pipeline_run.yaml new file mode 100644 index 0000000000..4edda38d92 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_traffic/pipeline_run.yaml @@ -0,0 +1,18 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: kn-service-traffic-splitting- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: kn-service-traffic-splitting + params: + - name: ARGS + value: + - "service" + - "update" + - "hello" + - "--tag=hello-v1=v1" + - "--tag=hello-v2=v2" + - "--traffic=v1=50" + - "--traffic=v2=50" diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_update/README.md b/task/kn/0.3/knative-dockerfile-deploy/service_update/README.md new file mode 100644 index 0000000000..76289053bf --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_update/README.md @@ -0,0 +1,86 @@ +# Deploy new revision to a Knative Service + +Let's create a Pipeline which deploys a new Revision to the deployed Knative Service. +A new Revision is created if you update the Configuration of the Service. + +## Pipeline: +- The following Pipeline is generic `kn` Pipeline, which can update (or even create a new) Knative Service based to the parameters you provide. +- Save the following YAML in a file say e.g.: `kn_service_update_pipeline.yaml` and create using `kubectl create -f kn_service_update_pipeline.yaml`. + +```yaml +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kn-service-update +spec: + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + tasks: + - name: kn-service-update + taskRef: + name: kn + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" +``` + + - You can also create this Pipeline using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/service_update/kn_service_update_pipeline.yaml +``` + +## PipelineRun + +- Create the PipelineRun to trigger the Pipeline and input the kn CLI parameters to +deploy a new Revision to `hello` Service. Note that in the below example, we're referencing a +different image, other than the one we created earlier using buildah. + +- Save the following YAML in a file e.g.: `pipeline_run.yaml` and create using `kubectl create -f pipeline_run.yaml` + +```yaml +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: kn-service-update- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: kn-service-update + params: + - name: ARGS + value: + - "service" + - "update" + - "hello" + - "--revision-name=hello-v2" + - "--image=gcr.io/knative-samples/helloworld-go" + - "--env=TARGET=v2" + - "--service-account=kn-deployer-account" +``` + +- You can also create this PipelineRun using the YAML file present in this repo using +``` +https://raw.githubusercontent.com/tektoncd/catalog/main/task/kn/0.2/knative-dockerfile-deploy/service_update/pipeline_run.yaml +``` + +Let's monitor the logs of the Pipeline run using `tkn` +```bash +tkn pr list +tkn pr logs logs -f +``` + +After the successful run of the Pipeline, we should have the Service updated, let's check +```bash +kubectl get ksvc hello +``` + +## What's Next: +- We've updated the Knative Service and now we've two Revisions present, we can use this state to also perform + some traffic splitting operation on the Service, check out the [next Pipeline example](../service_traffic/README.md). diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_update/kn_service_update_pipeline.yaml b/task/kn/0.3/knative-dockerfile-deploy/service_update/kn_service_update_pipeline.yaml new file mode 100644 index 0000000000..d63e52f575 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_update/kn_service_update_pipeline.yaml @@ -0,0 +1,21 @@ +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: kn-service-update +spec: + params: + - name: ARGS + type: array + description: Arguments to pass to kn CLI + default: + - "help" + tasks: + - name: kn-service-update + taskRef: + name: kn + params: + - name: kn-image + value: "gcr.io/knative-nightly/knative.dev/client/cmd/kn" + - name: ARGS + value: + - "$(params.ARGS)" diff --git a/task/kn/0.3/knative-dockerfile-deploy/service_update/pipeline_run.yaml b/task/kn/0.3/knative-dockerfile-deploy/service_update/pipeline_run.yaml new file mode 100644 index 0000000000..2a28784970 --- /dev/null +++ b/task/kn/0.3/knative-dockerfile-deploy/service_update/pipeline_run.yaml @@ -0,0 +1,18 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + generateName: kn-service-update- +spec: + serviceAccountName: kn-deployer-account + pipelineRef: + name: kn-service-update + params: + - name: ARGS + value: + - "service" + - "update" + - "hello" + - "--revision-name=hello-v2" + - "--image=gcr.io/knative-samples/helloworld-go" + - "--env=TARGET=v2" + - "--service-account=kn-deployer-account" diff --git a/task/kn/0.3/support/kn-deployer.yaml b/task/kn/0.3/support/kn-deployer.yaml new file mode 100644 index 0000000000..c5ac258a89 --- /dev/null +++ b/task/kn/0.3/support/kn-deployer.yaml @@ -0,0 +1,31 @@ +# Define a ServiceAccount named kn-deployer-account that has permission to +# manage Knative services. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kn-deployer-account + namespace: default +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kn-deployer +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["services", "revisions", "routes"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kn-deployer-binding +subjects: +- kind: ServiceAccount + name: kn-deployer-account + namespace: default +roleRef: + kind: ClusterRole + name: kn-deployer + apiGroup: rbac.authorization.k8s.io diff --git a/task/powershell/0.2/README.md b/task/powershell/0.2/README.md new file mode 100644 index 0000000000..9619396ce0 --- /dev/null +++ b/task/powershell/0.2/README.md @@ -0,0 +1,40 @@ +# PWSH - Running Powershell Scripts + +The following task helps you to run powershell commands. + +### Install powershell + +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/powershell/0.2/powershell.yaml +``` + +## Parameters + +- **tag**: the tag used for the `mcr.microsoft.com/powershell` image (_default_: `latest`) +- **command**: Powershell command +- **verbose**: Verbosity level for command (_default_: `SilentlyContinue`) + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +This `TaskRun` runs `Write-Output 'Hello World'` command using `latest` powershell image and verbose logs enabled. + +```yaml +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: example-powershell +spec: + taskRef: + name: powershell + params: + - name: command + value: "Write-Output 'Hello World'; `$random = get-random -Minimum 0 -Maximum 100; write-output 'Created this number for you' `$random" + - name: tag + value: latest + - name: verbose + value: Continue +``` diff --git a/task/powershell/0.2/powershell.yaml b/task/powershell/0.2/powershell.yaml new file mode 100644 index 0000000000..f4253519b4 --- /dev/null +++ b/task/powershell/0.2/powershell.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: powershell + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/categories: CLI + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/tags: powershell, pwsh + tekton.dev/displayName: powershell + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + This task will run powershell commands + params: + - name: tag + description: The tag for the Powershell image + type: string + default: "latest" + - name: command + description: The Powershell command + type: string + default: "Write-Output 'Please use command parameter to enter'" + - name: verbose + description: Verbosity level for command + type: string + default: "SilentlyContinue" + steps: + - name: invoke-script + image: mcr.microsoft.com/powershell:$(params.tag) + script: | + #!/usr/bin/env pwsh + $VerbosePreference = "$(params.verbose)" + $command = "$(params.command)" + Write-Verbose -Message "Received command:`n$command" + Invoke-Expression -Command $command \ No newline at end of file diff --git a/task/powershell/0.2/tests/run.yaml b/task/powershell/0.2/tests/run.yaml new file mode 100644 index 0000000000..4447f26d36 --- /dev/null +++ b/task/powershell/0.2/tests/run.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: powershell-pipeline +spec: + tasks: + - name: invoke-script + taskRef: + name: powershell + params: + - name: command + value: "Write-Output 'Hello World'" +--- +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: powershell-pipeline-run +spec: + pipelineRef: + name: powershell-pipeline +--- +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: example-powershell +spec: + taskRef: + name: powershell + params: + - name: command + value: "Write-Output 'Hello World'; `$random = get-random -Minimum 0 -Maximum 100; write-output 'Created this number for you $random'" + - name: tag + value: latest + - name: verbose + value: Continue \ No newline at end of file diff --git a/task/rsync/0.2/Dockerfile b/task/rsync/0.2/Dockerfile new file mode 100644 index 0000000000..852785ecf2 --- /dev/null +++ b/task/rsync/0.2/Dockerfile @@ -0,0 +1,12 @@ +FROM alpine + +RUN apk update \ + && apk upgrade \ + && apk add --no-cache \ + rsync \ + openssh-client \ + openssh \ + sshpass \ + ca-certificates \ + && update-ca-certificates \ + && rm -rf /var/cache/apk/* \ No newline at end of file diff --git a/task/rsync/0.2/README.md b/task/rsync/0.2/README.md new file mode 100644 index 0000000000..2f9c29f4af --- /dev/null +++ b/task/rsync/0.2/README.md @@ -0,0 +1,133 @@ +# Rsync + +This task provides synchronization of files between container and remote host. It relies on rsync and sshpass commands to implement. + +## Install the Task + +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/rsync/0.2/rsync.yaml +``` + +## Workspaces + +- source: A workspace for this Task to sync files. + +- ssh-directory: An workspace to provide SSH credentials. + +## Parameters + +- **direction**: "local-to-remote" means synchronization from the container to the remote host, and "remote-to-local" means synchronization from the remote host to the container. (_default:_ "local-to-remote") +- **local-path**: The directory in the container that you want to synchronize (_default:_ "./") +- **remote-path**: The directory in the remote host that you want to synchronize (_default:_ "~/") +- **remote-ip**: IP of the remote host (_default:_ "0.0.0.0"). +- **remote-username**: Username of the remote host. (_default:_ "root") + +## Usage + +- Install rsync and sshpass in remote host + +```bash +yum install -y rsync sshpass +``` + +- Create SSH credentials + +```bash +kubectl create secret generic rsync-ssh-credentials \ + --from-file=id_rsa=/root/.ssh/id_rsa +``` + +- Create the `PipelineRun` + +```yaml +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: rsync-remote-to-local-by-ssh +spec: + pipelineSpec: + workspaces: + - name: workspace + - name: ssh-creds + tasks: + - name: rsync-files + taskRef: + name: rsync + params: + - name: direction + value: "remote-to-local" + - name: local-path + value: "." + - name: remote-ip + value: "chenshaowen.com" + - name: remote-username + value: "shaowenchen" + - name: remote-path + value: "/Users/shaowenchen/Downloads/rsync/" + workspaces: + - name: source + workspace: workspace + - name: ssh-directory + workspace: ssh-creds + - name: verify + taskSpec: + workspaces: + - name: source + steps: + - name: shell + image: alpine + workingDir: $(workspaces.source.path) + script: | + #!/bin/sh + pwd + ls -al + workspaces: + - name: source + workspace: workspace + runAfter: + - rsync-files + workspaces: + - name: workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100M + - name: ssh-creds + secret: + secretName: rsync-ssh-credentials +``` + +- Output + +```bash +$ tkn pipelinerun logs + +? Select pipelinerun: rsync-remote-to-local-by-ssh started 20 minutes ago +[rsync-files : rsync] + '[' true '=' true ] +[rsync-files : rsync] + cp -R /workspace/ssh-directory /tekton/home/.ssh +[rsync-files : rsync] + chmod 700 /tekton/home/.ssh +[rsync-files : rsync] + chmod -R 400 /tekton/home/.ssh/id_rsa +[rsync-files : rsync] remote to local +[rsync-files : rsync] + '[' remote-to-local '=' remote-to-local ] +[rsync-files : rsync] + echo 'remote to local' +[rsync-files : rsync] + '[' true '=' true ] +[rsync-files : rsync] + rsync -ratlzv -e 'ssh -o StrictHostKeyChecking=no -i /tekton/home/.ssh/id_rsa' shaowenchen@chenshaowen.com:/Users/shaowenchen/Downloads/rsync/ . +[rsync-files : rsync] Warning: Permanently added 'chenshaowen.com,0.0.0.0' (ECDSA) to the list of known hosts. +[rsync-files : rsync] receiving file list ... done +[rsync-files : rsync] ./ +[rsync-files : rsync] ISSUE_TEMPLATE.en.md +[rsync-files : rsync] PULL_REQUEST_TEMPLATE.en.md +[rsync-files : rsync] +[rsync-files : rsync] sent 186 bytes received 1,125,429 bytes 750,410.00 bytes/sec +[rsync-files : rsync] total size is 1,130,767 speedup is 1.00 + +[verify : shell] /workspace/source +[verify : shell] total 1116 +[verify : shell] drwxrwxrwx 3 501 dialout 199 Jun 18 02:49 . +[verify : shell] drwxrwxrwx 3 root root 20 Jun 18 02:56 .. +[verify : shell] drwxr-xr-x 2 501 dialout 95 Jun 18 02:42 ISSUE_TEMPLATE.en.md +[verify : shell] -rw-r--r-- 1 501 dialout 124 Jun 18 02:42 PULL_REQUEST_TEMPLATE.en.md +``` diff --git a/task/rsync/0.2/rsync.yaml b/task/rsync/0.2/rsync.yaml new file mode 100644 index 0000000000..0a2211c93d --- /dev/null +++ b/task/rsync/0.2/rsync.yaml @@ -0,0 +1,57 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: rsync + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/tags: rsync, files sync + tekton.dev/categories: CLI + tekton.dev/displayName: "rsync" + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + This task can be used to synchronize local and remote files. + workspaces: + - name: source + description: The directory you want to sync. + - name: ssh-directory + optional: true + description: ssh directory with private key, known_hosts, config. + params: + - name: direction + type: string + default: "local-to-remote" + - name: local-path + type: string + default: "./" + - name: remote-path + type: string + default: "~/" + - name: remote-ip + type: string + default: "0.0.0.0" + - name: remote-username + type: string + default: "root" + steps: + - name: rsync + image: docker.io/shaowenchen/rsync-sshpass:v1@sha256:934985f9a955f416c7378e22d847ac1320fcae1495ee70ad53c9f9fc08b99323 + env: + - name: SSH_DIRECTORY_PATH + value: $(workspaces.ssh-directory.path) + workingDir: $(workspaces.source.path) + script: | + cp -R "${SSH_DIRECTORY_PATH}" "$HOME"/.ssh + chmod 700 "$HOME"/.ssh + chmod -R 400 "$HOME"/.ssh/* + + if [ "$(params.direction)" = "remote-to-local" ] ; then + echo "remote to local" + rsync -ratlzv -e "ssh -o StrictHostKeyChecking=no -i $HOME/.ssh/id_rsa" "$(params.remote-username)"@"$(params.remote-ip)":"$(params.remote-path)"/ "$(params.local-path)" + else + echo "local to remote" + rsync -ratlzv -e "ssh -o StrictHostKeyChecking=no -i $HOME/.ssh/id_rsa" "$(params.local-path)" "$(params.remote-username)"@"$(params.remote-ip)":"$(params.remote-path)"/ + fi diff --git a/task/rsync/0.2/samples/rsync-local-to-remote.yaml b/task/rsync/0.2/samples/rsync-local-to-remote.yaml new file mode 100644 index 0000000000..5788a48251 --- /dev/null +++ b/task/rsync/0.2/samples/rsync-local-to-remote.yaml @@ -0,0 +1,52 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: rsync-local-to-remote-by-ssh +spec: + pipelineSpec: + workspaces: + - name: workspace + - name: ssh-creds + tasks: + - name: git + taskRef: + name: git-clone + params: + - name: url + value: https://github.com/shaowenchen/catalog + workspaces: + - name: output + workspace: workspace + - name: rsync-files + taskRef: + name: rsync + params: + - name: direction + value: "local-to-remote" + - name: local-path + value: "." + - name: remote-ip + value: "0.0.0.0" + - name: remote-username + value: "root" + - name: remote-path + value: "/root" + workspaces: + - name: source + workspace: workspace + - name: ssh-directory + workspace: ssh-creds + runAfter: + - git + workspaces: + - name: workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100M + - name: ssh-creds + secret: + secretName: rsync-ssh-credentials diff --git a/task/rsync/0.2/samples/rsync-remote-to-local.yaml b/task/rsync/0.2/samples/rsync-remote-to-local.yaml new file mode 100644 index 0000000000..8594ffc43e --- /dev/null +++ b/task/rsync/0.2/samples/rsync-remote-to-local.yaml @@ -0,0 +1,58 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: rsync-remote-to-local-by-ssh +spec: + pipelineSpec: + workspaces: + - name: workspace + - name: ssh-creds + tasks: + - name: rsync-files + taskRef: + name: rsync + params: + - name: direction + value: "remote-to-local" + - name: local-path + value: "." + - name: remote-ip + value: "0.0.0.0" + - name: remote-username + value: "root" + - name: remote-path + value: "/root" + workspaces: + - name: source + workspace: workspace + - name: ssh-directory + workspace: ssh-creds + - name: verify + taskSpec: + workspaces: + - name: source + steps: + - name: shell + image: alpine + workingDir: $(workspaces.source.path) + script: | + #!/bin/sh + pwd + ls -al + workspaces: + - name: source + workspace: workspace + runAfter: + - rsync-files + workspaces: + - name: workspace + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100M + - name: ssh-creds + secret: + secretName: rsync-ssh-credentials \ No newline at end of file diff --git a/task/rsync/0.2/samples/secret-ssh.yaml b/task/rsync/0.2/samples/secret-ssh.yaml new file mode 100644 index 0000000000..9d98ebdfde --- /dev/null +++ b/task/rsync/0.2/samples/secret-ssh.yaml @@ -0,0 +1,6 @@ +kind: Secret +apiVersion: v1 +metadata: + name: rsync-ssh-credentials +data: + id_rsa: dGhpcyBpcyBpZF9yc2EgYmFzZTY0IHN0cmluZwoK # ... base64-encoded private key ... \ No newline at end of file diff --git a/task/skopeo-copy/0.5/README.md b/task/skopeo-copy/0.5/README.md new file mode 100644 index 0000000000..edd8c56a3a --- /dev/null +++ b/task/skopeo-copy/0.5/README.md @@ -0,0 +1,110 @@ +# Skopeo + + +[Skopeo](https://github.com/containers/skopeo) is a command line tool for working with remote image registries. Skopeo doesn’t require a daemon to be running while performing its operations. In particular, the handy skopeo command called `copy` will ease the whole image copy operation. Without further ado, you can copy an image from a registry to another simply by running: +``` +skopeo copy docker://internal.registry/myimage:latest / +docker://production.registry/myimage:v1.0 +``` +The copy command will take care of copying the image from `internal.registry` to `production.registry` + +If your production registry requires credentials to login in order to push the image, skopeo can handle that as well. + +``` +skopeo copy --dest-creds prod_user:prod_pass docker://internal.registry/myimage:latest / +docker://production.registry/myimage:v1.0 +``` + +The same goes for credentials for the source registry (internal.registry) by using the `--src-creds` flag. + +It is also useful for copying images between two remote docker registries, such as the registries of two different OpenShift clusters, as shown +``` +skopeo copy docker://busybox:latest oci:busybox_ocilayout:latest +``` +Skopeo copy isn’t limited to remote containers registries. The image prefix `docker://` from the above command define the transport to be used when handling the image. + +There are others also similar to that: + +- atomic +- containers-storage +- dir +- docker +- docker-daemon +- docker-tar +- oci +- ostree + +This `task` can be used to copy one or more than one images to-and fro various storage mechanisms. + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/skopeo-copy/0.5/skopeo-copy.yaml +``` + +## Parameters + +- **srcImageURL**: The URL of the image to be copied to the `destination` registry. +- **destImageURL**: The URL of the image where the image from `source` should be copied to. +- **srcTLSverify**: Verify the TLS on the src registry endpoint +- **destTLSverify**: Verify the TLS on the dest registry endpoint +- **multiArch**: How to handle multi-architecture images (system, all, or index-only) + +## Workspace + +- **images-url**: To mount file containing multiple source and destination images registries URL, which is mounted as configMap. + + +## Secrets and ConfigMap +* `Secret` to provide the credentials of the source and destination registry where the image needs to be copied from and to. +* `ConfigMap` to provide support for copying multiple images, this contains file `url.txt` which stores images registry URL's. + + [This](../0.4/samples/quay-secret.yaml) example can help to use secrets for providing credentials of image registries. + +## Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms. + +## Usage + +This task will use the `Service Account` with access to the secrets containing source and destination image registry credentials, this will authorize it to the respective image registries. + +In case of multiple source and destination image registries that needs to be copied to and from a file named `url.txt` should be created containing all the source and destination image registries `URL` seperated by a space and each set of images should be written in the new line, as shown below. + +``` +docker://quay.io/temp/kubeconfigwriter:v1 docker://quay.io/skopeotest/kube:v1 +docker://quay.io/temp/kubeconfigwriter:v2 docker://quay.io/skopeotest/kube:v2 +``` + +`ConfigMap` should be created using this file. Following `command` can be used to create configMap from the `file`. +``` +kubectl create configmap image-configmap --from-file=url.txt +``` +In case there is only one source and destination image that needs to be copied then, Source and destination image URL needs to be provided in the input params of the task. + +This will result in the image getting copied from the source registry to the destination registry. + + +[This](../0.4/samples/serviceaccount.yaml) will guide the user to use service account for authorization to image registries. + +See [here](../0.4/samples/run.yaml) for example of `TaskRun`. +### Note + +- `Source credentials` are only required, if the source image registry needs authentication to pull the image, whereas `Destination credentials` are always required. + +- In case of multiple source and destination images, `secret` containing `credentials` of all the image registries must be added to the `service account` and configMap containing `url.txt` should be mounted into the workspace, as shown + ``` + workspaces: + - name: images-url + configmap: + name: image-configmap + ``` + + +- If there is only one source and destination image registry URL, then `emptyDir` needs to be mounted in the `workspace` as shown below: + + ``` + workspaces: + - name: images-url + emptyDir: {} + ``` diff --git a/task/skopeo-copy/0.5/samples/docker-secret.yaml b/task/skopeo-copy/0.5/samples/docker-secret.yaml new file mode 100644 index 0000000000..94c48661af --- /dev/null +++ b/task/skopeo-copy/0.5/samples/docker-secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Secret +metadata: + name: docker-creds + annotations: + tekton.dev/docker-0: https://docker.io +type: kubernetes.io/basic-auth +stringData: + username: test + password: test@1 diff --git a/task/skopeo-copy/0.5/samples/quay-secret.yaml b/task/skopeo-copy/0.5/samples/quay-secret.yaml new file mode 100644 index 0000000000..4482f8572f --- /dev/null +++ b/task/skopeo-copy/0.5/samples/quay-secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Secret +metadata: + name: quay-creds + annotations: + tekton.dev/docker-0: https://quay.io +type: kubernetes.io/basic-auth +stringData: + username: skopeotest + password: Skopeo@1 diff --git a/task/skopeo-copy/0.5/samples/run.yaml b/task/skopeo-copy/0.5/samples/run.yaml new file mode 100644 index 0000000000..876ff469ea --- /dev/null +++ b/task/skopeo-copy/0.5/samples/run.yaml @@ -0,0 +1,12 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: skopeo-run +spec: + serviceAccountName: secret-service-account + taskRef: + name: skopeo-copy + workspaces: + - name: images-url + configMap: + name: image-configmap diff --git a/task/skopeo-copy/0.5/samples/serviceaccount.yaml b/task/skopeo-copy/0.5/samples/serviceaccount.yaml new file mode 100644 index 0000000000..7dcb46907d --- /dev/null +++ b/task/skopeo-copy/0.5/samples/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: secret-service-account +secrets: + - name: docker-creds + - name: quay-creds diff --git a/task/skopeo-copy/0.5/skopeo-copy.yaml b/task/skopeo-copy/0.5/skopeo-copy.yaml new file mode 100644 index 0000000000..1dae31ac02 --- /dev/null +++ b/task/skopeo-copy/0.5/skopeo-copy.yaml @@ -0,0 +1,92 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: skopeo-copy + labels: + app.kubernetes.io/version: "0.5" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: cli + tekton.dev/displayName: "skopeo copy" + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" +spec: + description: >- + Skopeo is a command line tool for working with remote image registries. + + Skopeo doesn’t require a daemon to be running while performing its operations. + In particular, the handy skopeo command called copy will ease the whole image + copy operation. The copy command will take care of copying the image from + internal.registry to production.registry. If your production registry requires + credentials to login in order to push the image, skopeo can handle that as well. + + workspaces: + - name: images-url + params: + - name: srcImageURL + description: URL of the image to be copied to the destination registry + type: string + default: "" + - name: destImageURL + description: URL of the image where the image from source should be copied to + type: string + default: "" + - name: srcTLSverify + description: Verify the TLS on the src registry endpoint + type: string + default: "true" + - name: destTLSverify + description: Verify the TLS on the dest registry endpoint + type: string + default: "true" + - name: multiArch + description: How to handle multi-architecture images (system, all, or index-only) + type: string + default: "system" + steps: + - name: skopeo-copy + env: + - name: HOME + value: /tekton/home + image: quay.io/skopeo/stable:v1@sha256:2b7d76dde38c5924e1945348840c58786fc192201f2fd545832e58b53d26f7b8 + script: | + # Function to copy multiple images. + # + copyimages() { + filename="$(workspaces.images-url.path)/url.txt" + while IFS= read -r line || [ -n "$line" ] + do + cmd="" + for url in $line + do + # echo $url + cmd="$cmd \ + $url" + done + read -ra sourceDest <<<"${cmd}" + skopeo copy --multi-arch="$(params.multiArch)" "${sourceDest[@]}" --src-tls-verify="$(params.srcTLSverify)" --dest-tls-verify="$(params.destTLSverify)" + echo "$cmd" + done < "$filename" + } + # Check that the multiArch parm is one of the supported methods + # + case "$(params.multiArch)" in all|system|index-only) + ;; + *) + echo "Unrecognized multiArch choice: $(params.multiArch)" + exit 1;; + esac + # + # If single image is to be copied then, it can be passed through + # params in the taskrun. + # + if [ "$(params.srcImageURL)" != "" ] && [ "$(params.destImageURL)" != "" ] ; then + skopeo copy --multi-arch="$(params.multiArch)" "$(params.srcImageURL)" "$(params.destImageURL)" --src-tls-verify="$(params.srcTLSverify)" --dest-tls-verify="$(params.destTLSverify)" + else + # If file is provided as a configmap in the workspace then multiple images can be copied. + # + copyimages + fi + securityContext: + runAsNonRoot: true + runAsUser: 65532 diff --git a/task/skopeo-copy/0.5/tests/pre-apply-task-hook.sh b/task/skopeo-copy/0.5/tests/pre-apply-task-hook.sh new file mode 100755 index 0000000000..08b496c826 --- /dev/null +++ b/task/skopeo-copy/0.5/tests/pre-apply-task-hook.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +# Add an internal registry as sidecar to the task so we can upload it directly +# from our tests without having to go to an external registry. +add_sidecar_registry ${TMPF} diff --git a/task/skopeo-copy/0.5/tests/run.yaml b/task/skopeo-copy/0.5/tests/run.yaml new file mode 100644 index 0000000000..8ef2280d9b --- /dev/null +++ b/task/skopeo-copy/0.5/tests/run.yaml @@ -0,0 +1,19 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: skopeo-run +spec: + params: + - name: srcImageURL + value: docker://quay.io/temp/kubeconfigwriter:v1 + - name: destImageURL + value: docker://localhost:5000/kube:latest + - name: destTLSverify + value: "false" + - name: multiArch + value: "system" + taskRef: + name: skopeo-copy + workspaces: + - name: images-url + emptyDir: {} diff --git a/task/terraform-cli/0.3/README.md b/task/terraform-cli/0.3/README.md new file mode 100644 index 0000000000..fe93526989 --- /dev/null +++ b/task/terraform-cli/0.3/README.md @@ -0,0 +1,103 @@ + + +## Terraform CLI Task + +[Terraform](https://www.terraform.io/) is an open-source infrastructure as codesoftware tool created by [HashiCorp](https://en.wikipedia.org/wiki/HashiCorp "HashiCorp"). It enables users to define and provision a datacenter infrastructure using a high-level configuration language known as Hashicorp Configuration Language (HCL), or optionally JSON + +This Task will do a terraform init before it executes the actual configured ARGS from parameter. + +## Install the Task + +Install `terraform-cli` task: +```bash +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/master/task/terraform-cli/0.3/terraform-cli.yaml +``` + +## Parameters + +* **ARGS:** args to execute which are appended to `terraform` e.g. `apply` (_default_: `--help`) +* **terraform-secret:** the name of the secret containing the authentication information for the chosen provider (_default_: `terraform-creds`) +* **image:** the image used where the Terraform CLI binary is (_default_: `docker.io/hashicorp/terraform:light`) +* **httpProxy**: HTTP proxy server for non-SSL requests (_default_: "") +* **httpsProxy**: HTTPS proxy server for SSL requests (_default_: "") +* **noProxy**: no proxy - opt out of proxying HTTP/HTTPS requests (_default_: "") + +## Workspaces + +* **source**: A [Workspace](https://github.com/tektoncd/pipeline/blob/master/docs/workspaces.md) containing the terraform HCL or JSON files. + + +## Terraform-Secret + +This is a [secret]([https://kubernetes.io/docs/concepts/configuration/secret/](https://kubernetes.io/docs/concepts/configuration/secret/)) example with Credentials information [for the openstack provider](https://www.terraform.io/docs/providers/openstack/index.html) for information on how to configure authentication on different providers please refer to this [documentation](https://www.terraform.io/docs/providers/index.html) all providers have exclusive names for the environment variables for authentication, you can create a secret that will be mounted as environment variables for the provider, or you can provide that on your provider.tf file. + +```yaml +kind: Secret +apiVersion: v1 +metadata: + name: terraform-secret + namespace: terraform-cli-test + selfLink: /api/v1/namespaces/terraform-cli-test/secrets/terraform-secret + uid: a015225d-0f8a-11ea-8536-52fdfc072182 + resourceVersion: '626903' + creationTimestamp: '2019-11-25T13:51:05Z' +data: + OS_AUTH_URL: aHR0cDovL3lvdXItY2xvdWQtcHJvZGl2ZGVyLmNvbQ== + OS_INSECURE: dHJ1ZQ== + OS_PASSWORD: c2VjcmV0 + OS_TENANT_NAME: bXlfdGVuYW50X25hbWU= + OS_USERNAME: bXlfdXNlcl9uYW1l +type: Opaque +``` + + +To create a secret you can use the following command + +```bash +kubectl create secret generic terraform-secret --from-literal=TF_VAR_OS_USERNAME=my-username --from-literal=TF_VAR_OS_AUTH_URL=https://my_auth_url --from-literal=TF_VAR_OS_TENANT_NAME=my_tenant --from-literal=TF_VAR_OS_PASSWORD=my_password --from-literal=TF_VAR_OS_INSECURE=true + +``` + +Be aware that Terraform Environment Variables have to be defined with `TF_VAR_` prefix. + + +## ServiceAccount + +If you don't specify a service account to be used for running the `TaskRun` or `PipelineRun`, the `default` [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server). OpenShift by default does not allow the default service account to modify objects in the namespace. Therefore you should either explicitly grant permission to the default service account (by creating rolebindings) or [create a new service account with sufficient privileges](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions) and specify it on the [`TaskRun`](https://github.com/tektoncd/pipeline/blob/master/docs/taskruns.md#service-account) or [`PipelineRun`](https://github.com/tektoncd/pipeline/blob/master/docs/pipelineruns.md#service-account). + +You can do the former via `oc` and running the following command, replacing `` with your target namespace: +```bash +oc policy add-role-to-user edit -z default -n +``` + +## Platforms + +The Task can be run on `linux/amd64` platform. + +## Usage + +This is a pipeline example passing the required credentials, and a list of arguments to the ARGS array variable. + +```yaml +apiVersion: tekton.dev/v1 +kind: Pipeline +metadata: + name: terraform-cli-example +spec: + workspaces: + - name: source + tasks: + - name: terraform + taskRef: + name: terraform-cli + workspaces: + - name: source + workspace: source + params: + - name: terraform-secret + value: "terraform-secret" + - name: ARGS + value: + - apply + - "-auto-approve" +``` diff --git a/task/terraform-cli/0.3/terraform-cli.yaml b/task/terraform-cli/0.3/terraform-cli.yaml new file mode 100644 index 0000000000..5ef69d5fa7 --- /dev/null +++ b/task/terraform-cli/0.3/terraform-cli.yaml @@ -0,0 +1,79 @@ +--- +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: terraform-cli + labels: + app.kubernetes.io/version: "0.3" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: cli + tekton.dev/displayName: "terraform cli" + tekton.dev/platforms: "linux/amd64" +spec: + description: >- + Terraform is an open-source infrastructure as code software tool created by HashiCorp. + + It enables users to define and provision a datacenter infrastructure using a high-level + configuration language known as Hashicorp Configuration Language (HCL), or optionally JSON + + This Task will do a terraform init before it executes the actual configured ARGS from parameter. + workspaces: + - name: source + params: + - name: ARGS + description: The terraform cli commands to tun + type: array + default: + - "--help" + - name: terraform-secret + description: The terraform secret with credentials + type: string + default: "terraform-creds" + - name: image + description: the terraform image to use + type: string + default: docker.io/hashicorp/terraform:light + - name: httpProxy + description: HTTP proxy server for non-SSL requests + type: string + default: "" + - name: httpsProxy + description: HTTPS proxy server for SSL requests + type: string + default: "" + - name: noProxy + description: no proxy - opt out of proxying HTTP/HTTPS requests + type: string + default: "" + steps: + - name: init + image: $(params.image) + workingDir: $(workspaces.source.path) + command: ["terraform"] + env: + - name: "HTTP_PROXY" + value: $(params.httpProxy) + - name: "HTTPS_PROXY" + value: $(params.httpsProxy) + - name: "HTTP_PROXY" + value: $(params.httpProxy) + args: + - "init" + - name: terraform-cli + image: $(params.image) + workingDir: /workspace/source + command: ["terraform"] + args: + - "$(params.ARGS)" + env: + - name: "HTTP_PROXY" + value: $(params.httpProxy) + - name: "HTTPS_PROXY" + value: $(params.httpsProxy) + - name: "HTTP_PROXY" + value: $(params.httpProxy) + envFrom: + - secretRef: + name: $(params.terraform-secret) diff --git a/task/wget/0.2/README.md b/task/wget/0.2/README.md new file mode 100644 index 0000000000..7013188357 --- /dev/null +++ b/task/wget/0.2/README.md @@ -0,0 +1,55 @@ + +# `wget` + +This task uses wget to download files from the internet to a workspace . + +## Install the Task + +``` +kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/wget/0.2/wget.yaml +``` + +## Parameters + +* **options**: The arguments to pass to `wget` CLI. _default_: `[""]` +* **diroptions**: The directory path we want to save file to. _default_: `[""]` +* **url**: The url we want to download file from. _default_: `""` +* **filename**: The filename we want to change our file to. _default_: `""` +* ****: The wget docker image to be used. Defaults to `mwendler/wget` + +## Platforms + +The Task can be run on `linux/amd64`, `linux/s390x`, and `linux/ppc64le` platforms. + +## Usage + +### Running the Task + +#### Download file to the workspace + +You can invoke `wget url -P workspace` to check if file is downloaded to workspace: + +Create a file, `wget-run.yaml`: + +``` +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: wget-run +spec: + params: + - name: url + value: "www.google.com" + - name: diroptions + value: + - "-P" + taskRef: + name: wget + workspaces: + - name: wget-workspace + emptyDir: {} +``` + +Run it with `kubectl apply -f wget-run.yaml` + +When this runs, it will print logs indicating connecting to the website indicated in url, http request sent and saving a `index.html` to the workspace directory diff --git a/task/wget/0.2/tests/run.yaml b/task/wget/0.2/tests/run.yaml new file mode 100644 index 0000000000..b4516053bf --- /dev/null +++ b/task/wget/0.2/tests/run.yaml @@ -0,0 +1,16 @@ +apiVersion: tekton.dev/v1 +kind: TaskRun +metadata: + name: wget-run +spec: + params: + - name: url + value: "www.google.com" + - name: diroptions + value: + - "-P" + taskRef: + name: wget + workspaces: + - name: wget-workspace + emptyDir: {} diff --git a/task/wget/0.2/wget.yaml b/task/wget/0.2/wget.yaml new file mode 100644 index 0000000000..a20872d6c9 --- /dev/null +++ b/task/wget/0.2/wget.yaml @@ -0,0 +1,44 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: wget + labels: + app.kubernetes.io/version: "0.2" + annotations: + tekton.dev/pipelines.minVersion: "0.50.0" + tekton.dev/categories: CLI + tekton.dev/tags: download + tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le" +spec: + description: >- + This task uses wget to download files from the internet to a workspace. + + params: + - name: url + description: The url we want to download file from + type: string + default: "" + - name: diroptions + description: The directory path we want to save file to + type: array + default: [] + - name: options + description: The arguments to pass to wget + type: array + default: [] + - name: filename + description: The filename we want to change our file to + type: string + default: "" + - name: wget-option + description: The wget docker image to be used + type: string + default: "docker.io/library/buildpack-deps:stable-curl@sha256:3d5e59c47d5f82a769ad3f372cc9f86321e2e2905141bba974b75d3c08a53e8e" #tag: stable-curl + workspaces: + - name: wget-workspace + description: The folder where we write the wget'ed file to + steps: + - name: wget + image: "$(params.wget-option)" + command: [wget] + args: ["$(params.options[*])", "$(params.url)", "$(params.diroptions[*])", "$(workspaces.wget-workspace.path)/$(params.filename)"]