6 changed files with 379 additions and 0 deletions
@ -0,0 +1,52 @@ |
|||
apiVersion: tekton.dev/v1beta1 |
|||
kind: Pipeline |
|||
metadata: |
|||
name: demo-appdev |
|||
spec: |
|||
workspaces: |
|||
- name: scratch |
|||
params: |
|||
- name: buildahPlatforms |
|||
type: array |
|||
default: |
|||
- linux/x86_64 |
|||
- linux/arm64/v8 |
|||
- name: gitRepositoryURL |
|||
type: string |
|||
- name: outputContainerImage |
|||
type: string |
|||
tasks: |
|||
# Clone the git repository |
|||
- name: git-clone |
|||
params: |
|||
- name: url |
|||
value: "$(params.gitRepositoryURL)" |
|||
- name: verbose |
|||
value: "false" |
|||
workspaces: |
|||
- name: output |
|||
workspace: scratch |
|||
subPath: src |
|||
taskRef: |
|||
name: git-clone |
|||
# Build and push the container images |
|||
- name: buildah |
|||
runAfter: |
|||
- git-clone |
|||
params: |
|||
- name: buildahVersion |
|||
value: latest |
|||
- name: outputContainerImage |
|||
value: "$(params.outputContainerImage)" |
|||
- name: buildahPlatforms |
|||
value: |
|||
- "$(params.buildahPlatforms[*])" |
|||
workspaces: |
|||
- name: src |
|||
workspace: scratch |
|||
subPath: src |
|||
- name: containers |
|||
workspace: scratch |
|||
subPath: containers |
|||
taskRef: |
|||
name: buildah |
|||
@ -0,0 +1,13 @@ |
|||
apiVersion: rbac.authorization.k8s.io/v1 |
|||
kind: Role |
|||
metadata: |
|||
name: tekton-robot |
|||
rules: |
|||
- apiGroups: |
|||
- security.openshift.io |
|||
resourceNames: |
|||
- privileged |
|||
resources: |
|||
- securitycontextconstraints |
|||
verbs: |
|||
- use |
|||
@ -0,0 +1,11 @@ |
|||
apiVersion: rbac.authorization.k8s.io/v1 |
|||
kind: RoleBinding |
|||
metadata: |
|||
name: tekton-robot |
|||
subjects: |
|||
- kind: ServiceAccount |
|||
name: tekton-robot |
|||
roleRef: |
|||
apiGroup: rbac.authorization.k8s.io |
|||
kind: Role |
|||
name: tekton-robot |
|||
@ -0,0 +1,4 @@ |
|||
apiVersion: v1 |
|||
kind: ServiceAccount |
|||
metadata: |
|||
name: tekton-robot |
|||
@ -0,0 +1,61 @@ |
|||
apiVersion: tekton.dev/v1beta1 |
|||
kind: Task |
|||
metadata: |
|||
name: buildah |
|||
spec: |
|||
params: |
|||
- name: buildahVersion |
|||
type: string |
|||
- name: outputContainerImage |
|||
type: string |
|||
workspaces: |
|||
- name: src |
|||
mountPath: /src |
|||
- name: containers |
|||
mountPath: /var/lib/containers |
|||
steps: |
|||
- name: buildah |
|||
image: quay.io/containers/buildah:$(params.buildahVersion) |
|||
workingDir: /src |
|||
env: |
|||
- name: TARGET_IMAGE |
|||
value: "$(params.outputContainerImage)" |
|||
securityContext: |
|||
capabilities: |
|||
add: |
|||
- 'SYS_ADMIN' |
|||
privileged: true |
|||
script: | |
|||
#!/bin/bash |
|||
|
|||
set -Eeuo pipefail |
|||
|
|||
function build () { |
|||
echo "=========================================================" |
|||
echo " buildah build $TARGET_IMAGE |
|||
echo "=========================================================" |
|||
echo |
|||
|
|||
extra_args="" |
|||
if [ -n "${CONTAINERFILE:-}" ]; then |
|||
extra_args="$extra_args --file $CONTAINERFILE" |
|||
fi |
|||
|
|||
buildah bud --storage-driver vfs --manifest tekton -t $TARGET_IMAGE $extra_args . |
|||
echo |
|||
} |
|||
|
|||
function push () { |
|||
echo "=========================================================" |
|||
echo " buildah push $1" |
|||
echo "=========================================================" |
|||
echo |
|||
buildah manifest push --storage-driver vfs --all tekton "docker://$1" |
|||
echo |
|||
} |
|||
|
|||
build |
|||
|
|||
push "$TARGET_IMAGE:latest" |
|||
|
|||
exit 0 |
|||
@ -0,0 +1,238 @@ |
|||
apiVersion: tekton.dev/v1beta1 |
|||
kind: Task |
|||
metadata: |
|||
name: git-clone |
|||
labels: |
|||
app.kubernetes.io/version: "0.8" |
|||
annotations: |
|||
tekton.dev/pipelines.minVersion: "0.29.0" |
|||
tekton.dev/categories: Git |
|||
tekton.dev/tags: git |
|||
tekton.dev/displayName: "git clone" |
|||
tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64" |
|||
spec: |
|||
description: >- |
|||
These Tasks are Git tasks to work with repositories used by other tasks |
|||
in your Pipeline. |
|||
|
|||
The git-clone Task will clone a repo from the provided url into the |
|||
output Workspace. By default the repo will be cloned into the root of |
|||
your Workspace. You can clone into a subdirectory by setting this Task's |
|||
subdirectory param. This Task also supports sparse checkouts. To perform |
|||
a sparse checkout, pass a list of comma separated directory patterns to |
|||
this Task's sparseCheckoutDirectories param. |
|||
workspaces: |
|||
- name: output |
|||
description: The git repo will be cloned onto the volume backing this Workspace. |
|||
- name: ssh-directory |
|||
optional: true |
|||
description: | |
|||
A .ssh directory with private key, known_hosts, config, etc. Copied to |
|||
the user's home before git commands are executed. Used to authenticate |
|||
with the git remote when performing the clone. Binding a Secret to this |
|||
Workspace is strongly recommended over other volume types. |
|||
- name: basic-auth |
|||
optional: true |
|||
description: | |
|||
A Workspace containing a .gitconfig and .git-credentials file. These |
|||
will be copied to the user's home before any git commands are run. Any |
|||
other files in this Workspace are ignored. It is strongly recommended |
|||
to use ssh-directory over basic-auth whenever possible and to bind a |
|||
Secret to this Workspace over other volume types. |
|||
- name: ssl-ca-directory |
|||
optional: true |
|||
description: | |
|||
A workspace containing CA certificates, this will be used by Git to |
|||
verify the peer with when fetching or pushing over HTTPS. |
|||
params: |
|||
- name: url |
|||
description: Repository URL to clone from. |
|||
type: string |
|||
- name: revision |
|||
description: Revision to checkout. (branch, tag, sha, ref, etc...) |
|||
type: string |
|||
default: "" |
|||
- name: refspec |
|||
description: Refspec to fetch before checking out revision. |
|||
default: "" |
|||
- name: submodules |
|||
description: Initialize and fetch git submodules. |
|||
type: string |
|||
default: "true" |
|||
- name: depth |
|||
description: Perform a shallow clone, fetching only the most recent N commits. |
|||
type: string |
|||
default: "1" |
|||
- name: sslVerify |
|||
description: Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote. |
|||
type: string |
|||
default: "true" |
|||
- name: crtFileName |
|||
description: file name of mounted crt using ssl-ca-directory workspace. default value is ca-bundle.crt. |
|||
type: string |
|||
default: "ca-bundle.crt" |
|||
- name: subdirectory |
|||
description: Subdirectory inside the `output` Workspace to clone the repo into. |
|||
type: string |
|||
default: "" |
|||
- name: sparseCheckoutDirectories |
|||
description: Define the directory patterns to match or exclude when performing a sparse checkout. |
|||
type: string |
|||
default: "" |
|||
- name: deleteExisting |
|||
description: Clean out the contents of the destination directory if it already exists before cloning. |
|||
type: string |
|||
default: "true" |
|||
- name: httpProxy |
|||
description: HTTP proxy server for non-SSL requests. |
|||
type: string |
|||
default: "" |
|||
- name: httpsProxy |
|||
description: HTTPS proxy server for SSL requests. |
|||
type: string |
|||
default: "" |
|||
- name: noProxy |
|||
description: Opt out of proxying HTTP/HTTPS requests. |
|||
type: string |
|||
default: "" |
|||
- name: verbose |
|||
description: Log the commands that are executed during `git-clone`'s operation. |
|||
type: string |
|||
default: "true" |
|||
- name: gitInitImage |
|||
description: The image providing the git-init binary that this Task runs. |
|||
type: string |
|||
default: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.29.0" |
|||
- name: userHome |
|||
description: | |
|||
Absolute path to the user's home directory. |
|||
type: string |
|||
default: "/tekton/home" |
|||
results: |
|||
- name: commit |
|||
description: The precise commit SHA that was fetched by this Task. |
|||
- name: url |
|||
description: The precise URL that was fetched by this Task. |
|||
steps: |
|||
- name: clone |
|||
image: "$(params.gitInitImage)" |
|||
env: |
|||
- name: HOME |
|||
value: "$(params.userHome)" |
|||
- name: PARAM_URL |
|||
value: $(params.url) |
|||
- name: PARAM_REVISION |
|||
value: $(params.revision) |
|||
- name: PARAM_REFSPEC |
|||
value: $(params.refspec) |
|||
- name: PARAM_SUBMODULES |
|||
value: $(params.submodules) |
|||
- name: PARAM_DEPTH |
|||
value: $(params.depth) |
|||
- name: PARAM_SSL_VERIFY |
|||
value: $(params.sslVerify) |
|||
- name: PARAM_CRT_FILENAME |
|||
value: $(params.crtFileName) |
|||
- name: PARAM_SUBDIRECTORY |
|||
value: $(params.subdirectory) |
|||
- name: PARAM_DELETE_EXISTING |
|||
value: $(params.deleteExisting) |
|||
- name: PARAM_HTTP_PROXY |
|||
value: $(params.httpProxy) |
|||
- name: PARAM_HTTPS_PROXY |
|||
value: $(params.httpsProxy) |
|||
- name: PARAM_NO_PROXY |
|||
value: $(params.noProxy) |
|||
- name: PARAM_VERBOSE |
|||
value: $(params.verbose) |
|||
- name: PARAM_SPARSE_CHECKOUT_DIRECTORIES |
|||
value: $(params.sparseCheckoutDirectories) |
|||
- name: PARAM_USER_HOME |
|||
value: $(params.userHome) |
|||
- name: WORKSPACE_OUTPUT_PATH |
|||
value: $(workspaces.output.path) |
|||
- name: WORKSPACE_SSH_DIRECTORY_BOUND |
|||
value: $(workspaces.ssh-directory.bound) |
|||
- name: WORKSPACE_SSH_DIRECTORY_PATH |
|||
value: $(workspaces.ssh-directory.path) |
|||
- name: WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND |
|||
value: $(workspaces.basic-auth.bound) |
|||
- name: WORKSPACE_BASIC_AUTH_DIRECTORY_PATH |
|||
value: $(workspaces.basic-auth.path) |
|||
- name: WORKSPACE_SSL_CA_DIRECTORY_BOUND |
|||
value: $(workspaces.ssl-ca-directory.bound) |
|||
- name: WORKSPACE_SSL_CA_DIRECTORY_PATH |
|||
value: $(workspaces.ssl-ca-directory.path) |
|||
securityContext: |
|||
runAsNonRoot: true |
|||
runAsUser: 65532 |
|||
script: | |
|||
#!/usr/bin/env sh |
|||
set -eu |
|||
|
|||
if [ "${PARAM_VERBOSE}" = "true" ] ; then |
|||
set -x |
|||
fi |
|||
|
|||
|
|||
if [ "${WORKSPACE_BASIC_AUTH_DIRECTORY_BOUND}" = "true" ] ; then |
|||
cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.git-credentials" "${PARAM_USER_HOME}/.git-credentials" |
|||
cp "${WORKSPACE_BASIC_AUTH_DIRECTORY_PATH}/.gitconfig" "${PARAM_USER_HOME}/.gitconfig" |
|||
chmod 400 "${PARAM_USER_HOME}/.git-credentials" |
|||
chmod 400 "${PARAM_USER_HOME}/.gitconfig" |
|||
fi |
|||
|
|||
if [ "${WORKSPACE_SSH_DIRECTORY_BOUND}" = "true" ] ; then |
|||
cp -R "${WORKSPACE_SSH_DIRECTORY_PATH}" "${PARAM_USER_HOME}"/.ssh |
|||
chmod 700 "${PARAM_USER_HOME}"/.ssh |
|||
chmod -R 400 "${PARAM_USER_HOME}"/.ssh/* |
|||
fi |
|||
|
|||
if [ "${WORKSPACE_SSL_CA_DIRECTORY_BOUND}" = "true" ] ; then |
|||
export GIT_SSL_CAPATH="${WORKSPACE_SSL_CA_DIRECTORY_PATH}" |
|||
if [ "${PARAM_CRT_FILENAME}" != "" ] ; then |
|||
export GIT_SSL_CAINFO="${WORKSPACE_SSL_CA_DIRECTORY_PATH}/${PARAM_CRT_FILENAME}" |
|||
fi |
|||
fi |
|||
CHECKOUT_DIR="${WORKSPACE_OUTPUT_PATH}/${PARAM_SUBDIRECTORY}" |
|||
|
|||
cleandir() { |
|||
# Delete any existing contents of the repo directory if it exists. |
|||
# |
|||
# We don't just "rm -rf ${CHECKOUT_DIR}" because ${CHECKOUT_DIR} might be "/" |
|||
# or the root of a mounted volume. |
|||
if [ -d "${CHECKOUT_DIR}" ] ; then |
|||
# Delete non-hidden files and directories |
|||
rm -rf "${CHECKOUT_DIR:?}"/* |
|||
# Delete files and directories starting with . but excluding .. |
|||
rm -rf "${CHECKOUT_DIR}"/.[!.]* |
|||
# Delete files and directories starting with .. plus any other character |
|||
rm -rf "${CHECKOUT_DIR}"/..?* |
|||
fi |
|||
} |
|||
|
|||
if [ "${PARAM_DELETE_EXISTING}" = "true" ] ; then |
|||
cleandir |
|||
fi |
|||
|
|||
test -z "${PARAM_HTTP_PROXY}" || export HTTP_PROXY="${PARAM_HTTP_PROXY}" |
|||
test -z "${PARAM_HTTPS_PROXY}" || export HTTPS_PROXY="${PARAM_HTTPS_PROXY}" |
|||
test -z "${PARAM_NO_PROXY}" || export NO_PROXY="${PARAM_NO_PROXY}" |
|||
|
|||
/ko-app/git-init \ |
|||
-url="${PARAM_URL}" \ |
|||
-revision="${PARAM_REVISION}" \ |
|||
-refspec="${PARAM_REFSPEC}" \ |
|||
-path="${CHECKOUT_DIR}" \ |
|||
-sslVerify="${PARAM_SSL_VERIFY}" \ |
|||
-submodules="${PARAM_SUBMODULES}" \ |
|||
-depth="${PARAM_DEPTH}" \ |
|||
-sparseCheckoutDirectories="${PARAM_SPARSE_CHECKOUT_DIRECTORIES}" |
|||
cd "${CHECKOUT_DIR}" |
|||
RESULT_SHA="$(git rev-parse HEAD)" |
|||
EXIT_CODE="$?" |
|||
if [ "${EXIT_CODE}" != 0 ] ; then |
|||
exit "${EXIT_CODE}" |
|||
fi |
|||
printf "%s" "${RESULT_SHA}" > "$(results.commit.path)" |
|||
printf "%s" "${PARAM_URL}" > "$(results.url.path)" |
|||
Loading…
Reference in new issue