Tekton 是一个功能强大且灵活的 Kubernetes 原生开源框架，用于创建持续集成和交付（CI/CD）系统。通过抽象底层实现细节，用户可以跨多云平台和本地系统进行构建、测试和部署。
本文是基于阿里云Kubernetes服务部署Tekton Pipeline，并使用它完成源码拉取、应用打包、镜像推送和应用部署的实践过程。
Tekton Pipeline中有5类对象,核心理念是通过定义yaml定义构建过程.构建任务的状态存放在status字段中。
其中5类对象分别是：PipelineResouce、Task、TaskRun、Pipeline、PipelineRun。
Task是单个任务的构建过程,需要通过定义TaskRun任务去运行Task。
Pipeline包含多个Task,并在此基础上定义input和output,input和output以PipelineResource作为交付。
PipelineResource是可用于input和output的对象集合。
同样地,需要定义PipelineRun才会运行Pipeline。
1. 在阿里云Kubernetes集群中部署Tekton Pipeline
kubectl apply --filename /tekton-releases/latest/release.yaml
查看Tekton Pipelines组件是否运行正常：
$ kubectl -n tekton-pipelines get poNAME READY STATUSRESTARTS AGEtekton-pipelines-controller-6bcd7ff5d6-vzmrh 1/1Running025htekton-pipelines-webhook-6856cf9c47-l6nj61/1Running025h
2. 创建Git Resource， Registry Resource
编辑git-pipeline-resource.yaml:
apiVersion: tekton.dev/v1alpha1kind: PipelineResourcemetadata:name: git-pipeline-resourcespec:type: gitparams:- name: revisionvalue: tekton- name: urlvalue: /haoshuwei/jenkins-demo.git
git repo的分支名称为tekton。
编辑registry-pipeline-resource.yaml:
apiVersion: tekton.dev/v1alpha1kind: PipelineResourcemetadata:name: registry-pipeline-resourcespec:type: imageparams:- name: urlvalue: -/haoshuwei/tekton-demo
容器镜像仓库地址为-/haoshuwei/tekton-demo， 标签为latest
创建pipeline resource：
$ kubectl -n tekton-pipelines create -f git-pipeline-resource.yaml$ kubectl -n tekton-pipelines create -f registry-pipeline-resource.yaml
查看已创建的pipeline resource资源：
$ kubectl -n tekton-pipelines get PipelineResourceNAMEAGEgit-pipeline-resource 2hregistry-pipeline-resource 2h
3. 创建Git Repo/Docker Registry Authentication
拉取私有git源码项目需要配置使用Git Repo Authentication；拉取和推送docker镜像需要配置Docker Registry Authentication。在Tekton Pipeline中，Git Repo/Docker Registry Authentication会被定义成ServiceAccount来使用。
编辑 secrettekton-basic-user-pass-git.yaml:
apiVersion: v1kind: Secretmetadata:name: tekton-basic-user-pass-gitannotations:tekton.dev/git-0: type: kubernetes.io/basic-authstringData:username: <cleartext non-encoded>password: <cleartext non-encoded>
编辑 secrettekton-basic-user-pass-registry.yaml:
apiVersion: v1kind: Secretmetadata:name: tekton-basic-user-pass-registryannotations:tekton.dev/docker-0: -type: kubernetes.io/basic-authstringData:username: <cleartext non-encoded>password: <cleartext non-encoded>
编辑 serviceaccounttekton-git-and-registry.yaml:
apiVersion: v1kind: ServiceAccountmetadata:name: tekton-git-and-registrysecrets:- name: tekton-basic-user-pass-git- name: tekton-basic-user-pass-registry
创建serviceaccount：
$ kubectl -n tekton-pipelines create -f tekton-basic-user-pass-git.yaml$ kubectl -n tekton-pipelines create -f tekton-basic-user-pass-registry.yaml$ kubectl -n tekton-pipelines create -f tekton-git-and-registry.yaml
查看secret以及sa：
$ kubectl -n tekton-pipelines get secretNAME TYPE DATA AGEdefault-token-pwncj kubernetes.io/service-account-token 325htekton-basic-user-pass-gitkubernetes.io/basic-auth 2151mtekton-basic-user-pass-registry kubernetes.io/basic-auth 2151mtekton-git-and-registry-token-tr95m kubernetes.io/service-account-token 3151mtekton-pipelines-controller-token-lc2fv kubernetes.io/service-account-token 325h webhook-certs Opaque 325h
$ kubectl -n tekton-pipelines get saNAMESECRETS AGEdefault 1 25htekton-git-and-registry 3 152mtekton-pipelines-controller 1 25h
4. 配置serviceaccount tekton-git-and-registry获取命名空间tekton-pipelines的管理权限用于部署应用
创建ClusterRoleBindingtekton-cluster-admin:
apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:name: tekton-cluster-adminsubjects:- kind: ServiceAccountname: tekton-git-and-registrynamespace: tekton-pipelinesroleRef:kind: ClusterRolename: cluster-adminapiGroup: rbac.authorization.k8s.io
5. 创建一个Task
创建taskbuild-app.yaml:
apiVersion: tekton.dev/v1alpha1kind: Taskmetadata:name: build-appspec:inputs:resources:- name: java-demotype: gitparams:- name: pathToDockerFiledescription: The path to the dockerfile to builddefault: /workspace/java-demo/Dockerfile- name: pathToContextdescription: The build context used by Kanikodefault: /workspace/java-dem- name: pathToYamldescription: The path to teh manifest to applyoutputs:resources:- name: builtImagetype: imagesteps:- name: build-mvn-packageimage: -/acs-sample/jenkins-slave-maven:3.3.9-jdk-8-alpineworkingDir: /workspace/java-democommand:- mvnargs:- package- -B- -DskipTests- name: build-docker-imageimage: -/acs-sample/jenkins-slave-kaniko:0.6.0command:- kanikoargs:- --dockerfile=${inputs.params.pathToDockerFile}- --destination=${outputs.resources.builtImage.url}- --context=${inputs.params.pathToContext}- name: deploy-appimage: -/acs-sample/jenkins-slave-kubectl:1.11.5command:- kubectlargs:- apply- -f- ${inputs.params.pathToYaml}
6. 创建TaskRun运行任务
创建taskrunbuild-app-task-run.yaml:
apiVersion: tekton.dev/v1alpha1kind: TaskRunmetadata:name: build-app-task-runspec:serviceAccount: tekton-git-and-registrytaskRef:name: build-apptrigger:type: manualinputs:resources:- name: java-demoresourceRef:name: git-pipeline-resourceparams:- name: pathToDockerFilevalue: Dockerfile- name: pathToContextvalue: /workspace/java-demo- name: pathToYamlvalue: /workspace/java-demo/deployment.yamloutputs:resources:- name: builtImageresourceRef:name: registry-pipeline-resource
7. 查看构建状态以及日志
查看taskrun状态：
$ kubectl -n tekton-pipelines get taskrunNAME SUCCEEDED REASON STARTTIME COMPLETIONTIMEbuild-app-task-run UnknownPending 4s
查看构建日志：
$ kubectl -n tekton-pipelines get poNAME READY STATUS RESTARTS AGEbuild-app-task-run-pod-b8f890 3/5Running 075stekton-pipelines-controller-6bcd7ff5d6-vzmrh 1/1Running 025htekton-pipelines-webhook-6856cf9c47-l6nj61/1Running 025h
$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890Error from server (BadRequest): a container name must be specified for pod build-app-task-run-pod-b8f890, choose one of: [build-step-git-source-git-pipeline-resource-77l5v build-step-build-mvn-package build-step-build-docker-image build-step-deploy-app nop] or one of the init containers: [build-step-credential-initializer-8dsnm build-step-place-tools]
mvn build的日志:
$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890 -c build-step-build-mvn-package[INFO] Scanning for projects...[INFO][INFO] ------------------------------------------------------------------------[INFO] Building jenkins-demo-web 1.0.0-SNAPSHOT[INFO] ------------------------------------------------------------------------[INFO] Downloading: https://repo./maven2/org/apache/maven/plugins/maven-resources-plugin/2.6/maven-resources-plugin-2.6.pom[INFO] Downloaded: https://repo./maven2/org/apache/maven/plugins/maven-resources-plugin/2.6/maven-resources-plugin-2.6.pom (8 KB at 7.3 KB/sec)[INFO] Downloading: https://repo./maven2/org/apache/maven/plugins/maven-plugins/23/maven-plugins-23.pom[INFO] Downloaded: https://repo./maven2/org/apache/maven/plugins/maven-plugins/23/maven-plugins-23.pom (9 KB at 26.7 KB/sec)[INFO] Downloading: https://repo./maven2/org/apache/maven/maven-parent/22/maven-parent-22.pom[INFO] Downloaded: https://repo./maven2/org/apache/maven/maven-parent/22/maven-parent-22.pom (30 KB at 61.3 KB/sec)[INFO] Downloading: https://repo./maven2/org/apache/apache/11/apache-11.pom[INFO] Downloaded: https://repo./maven2/org/apache/apache/11/apache-11.pom (15 KB at 45.3 KB/sec)....
docker build的日志：
$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890 -c build-step-build-docker-imageINFO[0000] Downloading base image tomcat/05/06 11:58:46 No matching credentials were found, falling back on anonymousINFO[0003] Taking snapshot of full filesystem...INFO[0003] Skipping paths under /builder/home, as it is a whitelisted directoryINFO[0003] Skipping paths under /builder/tools, as it is a whitelisted directoryINFO[0003] Skipping paths under /dev, as it is a whitelisted directoryINFO[0003] Skipping paths under /kaniko, as it is a whitelisted directoryINFO[0003] Skipping paths under /proc, as it is a whitelisted directoryINFO[0003] Skipping paths under /run/secrets/kubernetes.io/serviceaccount, as it is a whitelisted directoryINFO[0003] Skipping paths under /sys, as it is a whitelisted directoryINFO[0003] Skipping paths under /var/run, as it is a whitelisted directoryINFO[0003] Skipping paths under /workspace, as it is a whitelisted directoryINFO[0003] Using files from context: [/workspace/java-demo/target/demo.war]INFO[0003] ADD target/demo.war /usr/local/tomcat/webapps/demo.warINFO[0003] Taking snapshot of files......
app-deploy的日志：
$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-637855 -c build-step-deploy-appdeployment.extensions/jenkins-java-demo createdservice/jenkins-java-demo created
taskrun的完成状态为True则构建部署过程完成：
$ kubectl -n tekton-pipelines get taskrunNAME SUCCEEDED REASON STARTTIME COMPLETIONTIMEbuild-app-task-run True 4m2m
8. 小结
Tekton Pipeline中任务模板可以拿来复用，而不需要重复定义，另外通过CRD重新定义CI/CD是一大亮点,初学者可能会觉得有些绕。
持续实验持续更新中。
原文链接
本文为云栖社区原创内容，未经允许。
