GitOps K8s 自動化佈署：Tekton Triggers 雲原生CI/CD流程

apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerTemplate
metadata:
  name: tekton-greeter-triggertemplate
spec:
  params:
  - name: git-revision
  - name: git-commit-message
  - name: git-repo-url
  - name: git-repo-name
  - name: content-type
  - name: pusher-name
  resourcetemplates:
  - apiVersion: tekton.dev/v1beta1
    kind: PipelineRun
    metadata:
      labels:
        tekton.dev/pipeline: tekton-greeter-pipeline-hub
      name: tekton-greeter-pipeline-webhook-$(uid)
    spec:
      params:
      - name: GIT_REPO
        value: $(tt.params.git-repo-url)
      - name: GIT_REF
        value: $(tt.params.git-revision)
      serviceAccountName: tekton-triggers-example-sa
      pipelineRef:
        name: tekton-greeter-pipeline-hub
      workspaces:
      - name: app-source
        persistentVolumeClaim:
          claimName: app-source-pvc
      - name: maven-settings
        emptyDir: {}

apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerBinding
metadata:
  name: tekton-greeter-triggerbinding
spec:
  params:
  - name: git-repo-url
    value: $(body.repository.clone_url)
  - name: git-revision
    value: $(body.after)

apiVersion: triggers.tekton.dev/v1alpha1
kind: EventListener
metadata:
  name: tekton-greeter-eventlistener
spec:
  serviceAccountName: tekton-triggers-example-sa
  triggers:
  - bindings:
    - ref: tekton-greeter-triggerbinding
    template:
      ref: tekton-greeter-triggertemplate

kubectl create -f tekton-greeter-triggertemplate.yaml
kubectl create -f tekton-greeter-triggerbinding.yaml
kubectl create -f tekton-greeter-eventlistener.yaml

kubectl get pods

NAME                                                READY   STATUS    RESTARTS   AGE
el-tekton-greeter-eventlistener-5db7b9fcf9-6nrgx   1/1     Running   0          10s

kubectl get svc

NAME                             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)             AGE
el-tekton-greeter-eventlistener  ClusterIP   10.100.36.199   <none>        8080/TCP,9000/TCP   10s

kubectl port-forward svc/el-tekton-greeter-eventlistener 8080

curl -X POST \
  http://localhost:8080 \
  -H 'Content-Type: application/json' \
  -d '{ "after": "d9291c456db1ce29177b77ffeaa9b71ad80a50e6", "repository": { "clone_url" : "https://github.com/gitops-cookbook/tekton-tutorial-greeter.git" } }'

{
  "eventListener": "tekton-greeter-eventlistener",
  "namespace": "default",
  "eventListenerUID": "c00567eb-d798-4c4a-946d-f1732fdfc313",
  "eventID": "17dd25bb-a1fe-4f84-8422-c3abc5f10066"
}

tkn pipelinerun ls

NAME                                                           AGE              STATUS
tekton-greeter-pipeline-webhook-3244b67f-31d3-4597-af1c-3c1aa6693719   4 seconds ago   Running

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  annotations:
    tekton.dev/pipelines.minVersion: 0.12.1
    tekton.dev/tags: git
  name: git-update-deployment
  labels:
    app.kubernetes.io/version: '0.2'
    operator.tekton.dev/provider-type: community
spec:
  description: >-
    此Task用於更新Kubernetes佈署中的容器映像並將變更推播回Git儲存函式庫``



這個Task的定義開始部分包含了中繼資料和標籤，指明它與Git操作相關，並且是由社群提供的。`description`欄位簡要說明瞭任務的用途：更新Kubernetes佈署中的容器映像並將變更推播回Git儲存函式庫
在GitOps流程中，這個Task扮演著關鍵角色：它將CI流程生成的新容器映像自動更新到設定儲存函式庫從而觸發CD流程進行實際佈署。

### 結合Triggers和Kustomize的自動化佈署流程

將Tekton Triggers與Kustomize結合使用，可以實作一個完整的GitOps自動化流程：

1. 開發者提交程式碼到應用程式儲存函式庫. Git webhook觸發Tekton Pipeline
3. Pipeline構建並推播新的容器映像
4. Pipeline使用Kustomize更新Kubernetes資源清單中的映像參照
5. 更新後的資源清單被推播回Git儲存函式庫. GitOps工具（如Argo CD）檢測到設定變更並同步到叢集

這種方法實作了從程式碼提交到應用佈署的完全自動化，同時保持了GitOps的核心原則：以Git為單一事實來源。

在實際專案中，我發現這種自動化流程可以顯著減少人為錯誤，並加快從開發到佈署的週期。特別是對於微服務架構，當需要管理數十甚至上百個服務時，自動化變得尤為重要。

## 實踐心得與最佳實踐

在實施Tekton Triggers和Kustomize的過程中，我積累了一些實用的經驗和最佳實踐：

### 安全考量

EventListener暴露了一個公共端點，因此需要考慮安全性。建議：

1. 使用HTTPS並設定TLS
2. 實施webhook金鑰驗證
3. 使用Tekton Triggers的Interceptor機制進行請求驗證和過濾
4. 限制EventListener服務帳號的許可權範圍

### 擴充套件性設計

對於大型專案，可能需要處理多種不同的事件和多個儲存函式庫了保持可維護性：

1. 為不同類別的應用或環境建立專用的TriggerTemplate
2. 使用標籤和註解保持資源的可發現性
3. 實施結構化的命名約定
4. 考慮使用Tekton的Condition資源進行條件執行

## Tekton 與 Kubernetes 的自動化設定更新

在現代的 DevOps 實踐中，自動化應用佈署和設定更新是提高效率的關鍵。透過 CI/CD 管道自動更新 Kubernetes 設定不僅可以減少手動錯誤，還能確保應用的快速佈署和一致性。在這篇文章中，我將分享如何使用 Tekton 任務來自動更新 Kubernetes 設定以及如何透過 Helm 自動佈署應用。

### 使用 Tekton 任務更新 Git 儲存函式庫設定

當談到 GitOps 工作流程時，我們通常會將應用程式碼和設定分開存放。應用程式碼產生容器映像，而設定則定義了這些映像在 Kubernetes 上的佈署方式。讓我們來看如何使用 Tekton 任務自動更新這些設定。

## Git 更新佈署任務解析

以下是一個用於更新 Git 儲存函式庫Kubernetes 設定的 Tekton 任務：

```yaml
params:
- name: GIT_REPOSITORY
  type: string
- name: GIT_REF
  type: string
- name: NEW_IMAGE
  type: string
- name: NEW_DIGEST
  type: string
- name: KUSTOMIZATION_PATH
  type: string
results:
- description: The commit SHA
  name: commit
steps:
- image: 'docker.io/alpine/git:v2.26.2'
  name: git-clone
  resources: {}
  script: >
    rm -rf git-update-digest-workdir
    git clone $(params.GIT_REPOSITORY) -b $(params.GIT_REF)
    git-update-digest-workdir
  workingDir: $(workspaces.workspace.path)
- image: 'quay.io/wpernath/kustomize-ubi:latest'
  name: update-digest
  resources: {}
  script: >
    cd git-update-digest-workdir/$(params.KUSTOMIZATION_PATH)
    kustomize edit set image $(params.NEW_IMAGE)@$(params.NEW_DIGEST)
    echo "##########################"
    echo "### kustomization.yaml ###"
    echo "##########################"
    cat kustomization.yaml
  workingDir: $(workspaces.workspace.path)
- image: 'docker.io/alpine/git:v2.26.2'
  name: git-commit
  resources: {}
  script: |
    cd git-update-digest-workdir
    git config user.email "tektonbot@redhat.com"
    git config user.name "My Tekton Bot"
    
    git status
    git add $(params.KUSTOMIZATION_PATH)/kustomization.yaml
    git commit -m "[ci] Image digest updated"
    git push
    RESULT_SHA="$(git rev-parse HEAD | tr -d '\n')"
    EXIT_CODE="$?"
    if [ "$EXIT_CODE" != 0 ]
    then
      exit $EXIT_CODE
    fi
    # Make sure we don't add a trailing newline to the result!
    echo -n "$RESULT_SHA" > $(results.commit.path)
  workingDir: $(workspaces.workspace.path)
workspaces:
- description: The workspace consisting of maven project.
  name: workspace

kubectl create -f git-update-deployment-task.yaml

task.tekton.dev/git-update-deployment created

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: pacman-pipeline
spec:
  params:
  - default: https://github.com/gitops-cookbook/pacman-kikd.git
    name: GIT_REPO
    type: string
  - default: master
    name: GIT_REVISION
    type: string
  - default: quay.io/gitops-cookbook/pacman-kikd
    name: DESTINATION_IMAGE
    type: string
  - default: .
    name: CONTEXT_DIR
    type: string
  - default: 'https://github.com/gitops-cookbook/pacman-kikd-manifests.git'
    name: CONFIG_GIT_REPO
    type: string
  - default: main
    name: CONFIG_GIT_REVISION
    type: string
  tasks:
  - name: fetch-repo
    params:
    - name: url
      value: $(params.GIT_REPO)
    - name: revision
      value: $(params.GIT_REVISION)
    - name: deleteExisting
      value: "true"
    taskRef:
      name: git-clone
    workspaces:
    - name: output
      workspace: app-source
  - name: build-app
    taskRef:
      name: maven
    params:
    - name: GOALS
      value:
      - -DskipTests
      - clean
      - package
    - name: CONTEXT_DIR
      value: "$(params.CONTEXT_DIR)"
    workspaces:
    - name: maven-settings
      workspace: maven-settings
    - name: source
      workspace: app-source
    runAfter:
    - fetch-repo
  - name: build-push-image
    taskRef:
      name: buildah
    params:
    - name: IMAGE
      value: "$(params.DESTINATION_IMAGE)"
    workspaces:
    - name: source
      workspace: app-source
    runAfter:
    - build-app
  - name: git-update-deployment
    params:
    - name: GIT_REPOSITORY
      value: $(params.CONFIG_GIT_REPO)
    - name: NEW_IMAGE
      value: $(params.DESTINATION_IMAGE)
    - name: NEW_DIGEST
      value: $(tasks.build-push-image.results.IMAGE_DIGEST)
    - name: KUSTOMIZATION_PATH
      value: env/dev
    - name: GIT_REF
      value: $(params.CONFIG_GIT_REVISION)
    runAfter:
    - build-push-image
    taskRef:
      kind: Task
      name: git-update-deployment
    workspaces:
    - name: workspace
      workspace: app-source
  workspaces:
  - name: app-source
  - name: maven-settings

kubectl create -f pacman-pipeline.yaml

kubectl patch serviceaccount tekton-bot-sa -p '{"secrets": [{"name": "git-secret"}]}'
kubectl patch serviceaccount tekton-bot-sa -p '{"secrets": [{"name": "containerregistry-secret"}]}'

tkn pipeline start pacman-pipeline \
  --serviceaccount='tekton-bot-sa' \
  --param GIT_REPO='https://github.com/gitops-cookbook/pacman-kikd.git' \
  --param GIT_REVISION='main' \
  --param DESTINATION_IMAGE='quay.io/gitops-cookbook/pacman-kikd:latest' \
  --param CONFIG_GIT_REPO='https://github.com/gitops-cookbook/pacman-kikd-manifests.git' \
  --param CONFIG_GIT_REVISION='main' \
  --workspace name=app-source,claimName=app-source-pvc \
  --workspace name=maven-settings,emptyDir="" \
  --use-param-defaults \
  --showlog

tkn hub install task helm-upgrade-from-repo

helm repo add gitops-cookbook https://gitops-cookbook.github.io/helm-charts/

"gitops-cookbook" has been added to your repositories

helm install pacman gitops-cookbook/pacman

NAME: pacman
LAST DEPLOYED: Mon Aug 15 17:02:21 2022
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
USER-SUPPLIED VALUES:
{}

kubectl get pods -l=app.kubernetes.io/name=pacman

NAME                     READY   STATUS    RESTARTS   AGE
pacman-6798d65d84-9mt8p   1/1     Running   0          30s

apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  generateName: helm-pacman-run-
spec:
  serviceAccountName: tekton-deployer-sa
  taskRef:
    name: helm-upgrade-from-repo
  params:
  - name: helm_repo
    value: https://gitops-cookbook.github.io/helm-charts/
  - name: chart_name
    value: gitops-cookbook/pacman
  - name: release_version
    value: 0.1.0
  - name: release_name
    value: pacman
  - name: overwrite_values
    value: replicaCount=2

kubectl create -f helm-pacman-taskrun.yaml

taskrun.tekton.dev/helm-pacman-run-qghx8 created

tkn taskrun logs -f

[upgrade-from-repo] current installed helm releases
[upgrade-from-repo] NAME     NAMESPACE  REVISION  UPDATED                                 STATUS    CHART         APP VERSION
[upgrade-from-repo] pacman   default    1         2022-08-15 17:02:21.633934129 +0200 +0200 deployed  pacman-0.1.0  1.0.0

[upgrade-from-repo] Release "pacman" has been upgraded. Happy Helming!
[upgrade-from-repo] NAME: pacman
[upgrade-from-repo] LAST DEPLOYED: Mon Aug 15 15:23:31 2022
[upgrade-from-repo] NAMESPACE: default
[upgrade-from-repo] STATUS: deployed
[upgrade-from-repo] REVISION: 2

kind: pipeline
type: docker
name: java-pipeline
platform:
  os: linux
  arch: arm64
trigger:
  branch:
    - main
clone:
  disable: true
steps:
  - name: clone sources
    image: alpine/git
    pull: if-not-exists
    commands:
      - git clone https://github.com/gitops-cookbook/pacman-kikd.git .
      - git checkout $DRONE_COMMIT
  - name: maven-build
    image: maven:3-jdk-11
    commands:
      - mvn install -DskipTests=true -B
      - mvn test -B
  - name: publish
    image: plugins/docker:20.13
    pull: if-not-exists
    settings:
      tags: "latest"
      dockerfile: Dockerfile
      insecure: true
      mtu: 1400
      username:
        from_secret: image_registry_user
      password:
        from_secret: image_registry_password
      registry:
        from_secret: image_registry
      repo:
        from_secret: destination_image

drone exec --pipeline=java-pipeline

name: pacman-ci-action
env:
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ github.token }}
  APP_NAME: pacman
  IMAGE_TAGS: 1.0.0 ${{ github.sha }}

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK 11
        uses: actions/setup-java@v3
        with:
          java-version: '11'
          distribution: 'adopt'
          cache: maven
      - name: Build with Maven
        run: mvn --batch-mode package
      - name: Buildah Action
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_REGISTRY }}/${{ env.APP_NAME }}
          tags: ${{ env.IMAGE_TAGS }}
          containerfiles: |
            ./Dockerfile
      - name: Push to Registry
        id: push-to-registry
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ env.REGISTRY_USER }}
          password: ${{ env.REGISTRY_PASSWORD }}