170 lines
3.9 KiB
Bash
170 lines
3.9 KiB
Bash
# creazione secret, SA, Role e Rolebinding all'interno del namespace applicativo
|
|
|
|
kubectl create secret docker-registry harbor-regcred \
|
|
-n poc \
|
|
--docker-server=harbor.pigreco66.it \
|
|
--docker-username=robot$tekton \
|
|
--docker-password=p2oZtqcUJafMAlX0eUzgHax9fv0ML8te \
|
|
--docker-email=alessandro.barucci66@gmail.com
|
|
|
|
kubectl create secret generic harbor-push-secret -n poc --from-file=config.json=config.json
|
|
|
|
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: tekton-deployer
|
|
namespace: poc
|
|
imagePullSecrets:
|
|
- name: harbor-regcred
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: tekton-deployer
|
|
namespace: poc
|
|
rules:
|
|
- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: tekton-deployer
|
|
namespace: poc
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: tekton-deployer
|
|
namespace: poc
|
|
roleRef:
|
|
kind: Role
|
|
name: tekton-deployer
|
|
apiGroup: rbac.authorization.k8s.io
|
|
EOF
|
|
|
|
|
|
|
|
#Pipeline che refernzia task remoti --> apply -f su namespace centralizzato tekton-pipelines
|
|
#kubectl apply -f pipedep.yaml -n tekton-pipelines
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Pipeline
|
|
metadata:
|
|
name: deploy-infrastructure
|
|
spec:
|
|
description: |
|
|
This pipeline clones a git repo, builds a Docker image with Kaniko and
|
|
pushes it to a registry
|
|
params:
|
|
- name: repo-url
|
|
type: string
|
|
- name: image-reference
|
|
type: string
|
|
- name: dockerfile
|
|
type: string
|
|
- name: namespace
|
|
type: string
|
|
workspaces:
|
|
- name: shared-data
|
|
- name: docker-credentials
|
|
tasks:
|
|
- name: fetch-source
|
|
taskRef:
|
|
resolver: cluster
|
|
params:
|
|
- name: name
|
|
value: git-clone
|
|
- name: namespace
|
|
value: tekton-pipelines
|
|
- name: kind
|
|
value: task
|
|
workspaces:
|
|
- name: output
|
|
workspace: shared-data
|
|
params:
|
|
- name: url
|
|
value: $(params.repo-url)
|
|
- name: build-push
|
|
runAfter: ["fetch-source"]
|
|
taskRef:
|
|
resolver: cluster
|
|
params:
|
|
- name: name
|
|
value: kaniko
|
|
- name: namespace
|
|
value: tekton-pipelines
|
|
- name: kind
|
|
value: task
|
|
workspaces:
|
|
- name: source
|
|
workspace: shared-data
|
|
- name: dockerconfig
|
|
workspace: docker-credentials
|
|
params:
|
|
- name: IMAGE
|
|
value: $(params.image-reference)
|
|
- name: DOCKERFILE
|
|
value: $(params.dockerfile)
|
|
- name: deploy
|
|
runAfter: [build-push]
|
|
taskRef:
|
|
resolver: cluster
|
|
params:
|
|
- name: name
|
|
value: kubectl-apply
|
|
- name: namespace
|
|
value: tekton-pipelines
|
|
- name: kind
|
|
value: task
|
|
params:
|
|
- name: namespace
|
|
value: $(params.namespace)
|
|
workspaces:
|
|
- name: source
|
|
workspace: shared-data
|
|
|
|
|
|
#PipelineRun creato su namespace applicativo che refenzia pipeline remote
|
|
#kubectl create -f pipedeprun2.yaml -n poc
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: PipelineRun
|
|
metadata:
|
|
generateName: clone-build-push-run-
|
|
spec:
|
|
serviceAccountName: tekton-deployer
|
|
pipelineRef:
|
|
resolver: cluster
|
|
params:
|
|
- name: namespace
|
|
value: tekton-pipelines
|
|
- name: name
|
|
value: deploy-infrastructure
|
|
- name: kind
|
|
value: pipeline
|
|
podTemplate:
|
|
securityContext:
|
|
fsGroup: 65532
|
|
workspaces:
|
|
- name: shared-data
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
- name: docker-credentials
|
|
secret:
|
|
secretName: harbor-push-secret
|
|
params:
|
|
- name: repo-url
|
|
value: https://gitea.pigreco66.it/pigreco/poc.git
|
|
- name: image-reference
|
|
value: harbor.pigreco66.it/library/nginx:1.30
|
|
- name: dockerfile
|
|
value: ./container/nginx/dockerfile
|
|
- name: namespace
|
|
value: poc
|