1510 lines
54 KiB
HCL
1510 lines
54 KiB
HCL
resource "kubectl_manifest" "Task_python-coverage" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: python-coverage
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/tags: python, coverage
|
|
tekton.dev/displayName: python coverage
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to measure code coverage of Python projects.
|
|
workspaces:
|
|
- name: source
|
|
params:
|
|
- name: PYTHON
|
|
description: The used Python version, more precisely the tag for the Python image
|
|
type: string
|
|
default: latest
|
|
- name: ARGS
|
|
description: The additional arguments to be used with pytest
|
|
type: string
|
|
default: ''
|
|
- name: SOURCE_PATH
|
|
description: The path to the source code
|
|
default: .
|
|
- name: REQUIREMENTS_FILE
|
|
description: The name of the requirements file inside the source location
|
|
default: requirements.txt
|
|
steps:
|
|
- name: code-coverage
|
|
image: docker.io/python:$(inputs.params.PYTHON)
|
|
workingDir: $(workspaces.source.path)
|
|
script: |-
|
|
export PATH=$PATH:$HOME/.local/bin
|
|
if [ -n "$(inputs.params.REQUIREMENTS_FILE)" ] && [ -e "$(inputs.params.REQUIREMENTS_FILE)" ];then
|
|
pip install -r $(inputs.params.SOURCE_PATH)/$(inputs.params.REQUIREMENTS_FILE)
|
|
pip show pytest || {
|
|
echo "###\nWarning: Pytest is missing in your requirements\n###";
|
|
pip install pytest
|
|
}
|
|
pip show coverage || {
|
|
echo "###\nWarning: Coverage is missing in your requirements\n###";
|
|
pip install coverage
|
|
}
|
|
else
|
|
pip install pytest coverage
|
|
fi
|
|
coverage run -m pytest $(inputs.params.ARGS) $(inputs.params.SOURCE_PATH)
|
|
coverage report -m
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_npm" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: npm
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/categories: Build Tools
|
|
tekton.dev/tags: build-tool
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
This task can be used to run npm goals on a project.
|
|
This task can be used to run npm goals on a project where package.json is present and has some pre-defined npm scripts.
|
|
workspaces:
|
|
- name: source
|
|
params:
|
|
- name: PATH_CONTEXT
|
|
type: string
|
|
default: .
|
|
description: The path where package.json of the project is defined.
|
|
- name: ARGS
|
|
type: array
|
|
default:
|
|
- version
|
|
description: The npm goals you want to run.
|
|
- name: IMAGE
|
|
type: string
|
|
default: docker.io/library/node:12-alpine@sha256:dfbebf17bfb014e1e7068e76325a117bccf8679c68aec6a28514184a209c8bae
|
|
description: The node image you want to use.
|
|
steps:
|
|
- name: npm-run
|
|
image: $(params.IMAGE)
|
|
command:
|
|
- npm
|
|
args:
|
|
- $(params.ARGS)
|
|
workingDir: $(workspaces.source.path)/$(params.PATH_CONTEXT)
|
|
env:
|
|
- name: CI
|
|
value: 'true'
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_pytest" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: pytest
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Testing
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/tags: python, pytest
|
|
tekton.dev/displayName: pytest
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task will run pytest on the provided input.
|
|
workspaces:
|
|
- name: source
|
|
- description: The workspace consisting of the custom pip settings.
|
|
name: pip-conf
|
|
optional: true
|
|
params:
|
|
- name: PYTHON_IMAGE
|
|
description: The used Python image
|
|
type: string
|
|
default: docker.io/python:3.11.1-bullseye
|
|
- name: ARGS
|
|
description: The additional arguments to be used with pytest
|
|
type: string
|
|
default: ''
|
|
- name: SOURCE_PATH
|
|
description: The path to the source code
|
|
default: .
|
|
- name: REQUIREMENTS_FILE
|
|
description: The name of the requirements file inside the source location, with fallback to the requirements file in the root location
|
|
default: requirements.txt
|
|
- name: PIP_CONF_FILE
|
|
description: The name of the custom pip config file.
|
|
default: pip.conf
|
|
steps:
|
|
- name: unit-test
|
|
image: $(params.PYTHON_IMAGE)
|
|
workingDir: $(workspaces.source.path)
|
|
env:
|
|
- name: PARAM_PIP_CONF_FILE
|
|
value: $(params.PIP_CONF_FILE)
|
|
- name: WORKSPACE_PIP_CONF_BOUND
|
|
value: $(workspaces.pip-conf.bound)
|
|
- name: WORKSPACE_PIP_CONF_PATH
|
|
value: $(workspaces.pip-conf.path)
|
|
script: |-
|
|
export PATH=$PATH:$HOME/.local/bin
|
|
|
|
if [ "$${WORKSPACE_PIP_CONF_BOUND}" = "true" ] ; then
|
|
export PIP_CONFIG_FILE="$${WORKSPACE_PIP_CONF_PATH}/$${PARAM_PIP_CONF_FILE}"
|
|
fi
|
|
|
|
if [ -e "$(params.SOURCE_PATH)"/"$(params.REQUIREMENTS_FILE)" ];
|
|
then
|
|
pip install -r "$(params.SOURCE_PATH)"/"$(params.REQUIREMENTS_FILE)"
|
|
pip show pytest || {
|
|
printf "###\nWarning: Pytest is missing in your test requirements file\n###";
|
|
pip install pytest
|
|
}
|
|
else
|
|
if [ -e "$(params.REQUIREMENTS_FILE)" ];
|
|
then
|
|
pip install -r "$(params.REQUIREMENTS_FILE)"
|
|
fi
|
|
pip install pytest
|
|
fi
|
|
if [ -z "$(params.ARGS)" ]; then
|
|
pytest "$(params.SOURCE_PATH)"
|
|
else
|
|
pytest "$(params.ARGS)" "$(params.SOURCE_PATH)"
|
|
fi
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_shellcheck" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: shellcheck
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: linter
|
|
tekton.dev/displayName: Shellcheck
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to perform lint check on Shell Script files
|
|
workspaces:
|
|
- name: shared-workspace
|
|
description: A workspace that contains the fetched git repository.
|
|
params:
|
|
- name: args
|
|
type: array
|
|
description: extra args needs to append
|
|
default:
|
|
- --help
|
|
steps:
|
|
- name: lint-shell
|
|
image: docker.io/koalaman/shellcheck:v0.7.1@sha256:ad95c140f7bf5cc66e50e19da7d72c398583ba24c5866ac32c882eb3ddc153ee
|
|
workingDir: $(workspaces.shared-workspace.path)
|
|
command:
|
|
- /bin/shellcheck
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_markdown-lint" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: markdown-lint
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: linter
|
|
tekton.dev/displayName: Markdown linter
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to perform lint check on Markdown files
|
|
workspaces:
|
|
- name: shared-workspace
|
|
description: A workspace that contains the fetched git repository.
|
|
params:
|
|
- name: args
|
|
type: array
|
|
description: extra args needs to append
|
|
default:
|
|
- --help
|
|
steps:
|
|
- name: lint-markdown-files
|
|
image: docker.io/markdownlint/markdownlint:0.11.0@sha256:399a199c92f89f42cf3a0a1159bd86ca5cdc293fcfd39f87c0669ddee9767724
|
|
workingDir: $(workspaces.shared-workspace.path)
|
|
command:
|
|
- mdl
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_black" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: black
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: formatter, python, black
|
|
tekton.dev/displayName: Python Black
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to format Python code
|
|
workspaces:
|
|
- name: shared-workspace
|
|
description: The workspace containing python source code which we want to format.
|
|
params:
|
|
- name: image
|
|
description: The container image to use black in
|
|
default: docker.io/cytopia/black:latest-0.2@sha256:2ec766f1c7e42e6b59c0873ce066fa0a2aa2bf8a80dbc1c40f1566bb539303e0
|
|
- name: requirements_file
|
|
description: The name of the requirements file inside the source location
|
|
default: requirements.txt
|
|
- name: args
|
|
type: array
|
|
description: extra args that needs to be appended
|
|
default:
|
|
- --help
|
|
steps:
|
|
- name: format-python-code
|
|
image: $(params.image)
|
|
workingDir: $(workspaces.shared-workspace.path)
|
|
script: |
|
|
export HOME=/tmp/python
|
|
export PATH=$PATH:/tmp/python/.local/bin
|
|
if [ -n "$(params.requirements_file)" ] && [ -e "$(params.requirements_file)" ];then
|
|
python -mpip install --user -r $(params.requirements_file)
|
|
fi
|
|
black $@
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_kube-linter" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: kube-linter
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: Kubernetes, Misconfiguration
|
|
tekton.dev/displayName: Kube-Linter
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
This task makes it possible to use kube-linter within Tekton Pipeline.
|
|
The KubeLinter tool by StackRox is an open-source command-line interface to identify misconfigurations in Kubernetes objects. KubeLinter offers the ability to integrate checks on Kubernetes YAML files and Helm charts before deployment into a Kubernetes cluster. With 31 standard built-in checks and the room to configure your own, you get immediate feedback about misconfigurations and Kubernetes security violations.
|
|
workspaces:
|
|
- name: source
|
|
description: A workspace that contains fetched git repo.
|
|
params:
|
|
- name: config_file_url
|
|
type: string
|
|
description: url from where the config file would be fetched.
|
|
default: ''
|
|
- name: config_file_path
|
|
type: string
|
|
description: path to config file.
|
|
default: ''
|
|
- name: manifest
|
|
type: string
|
|
description: path to manifest files or manifest directory to be checked.
|
|
default: .
|
|
- name: includelist
|
|
type: string
|
|
description: A string with comma separated checks to be included
|
|
default: ''
|
|
- name: excludelist
|
|
type: string
|
|
description: A string with comma separated checks to be excluded
|
|
default: ''
|
|
- name: default_option
|
|
type: string
|
|
description: 'provides two options (adding all built-in checks or disabling all default checks): add-all-built-in and/do-not-auto-add-defaults'
|
|
default: ''
|
|
- name: output_format
|
|
type: string
|
|
description: format in which report will be generated. (json|sarif|plain) (default:"json")
|
|
default: json
|
|
- name: args
|
|
type: array
|
|
description: args
|
|
default: []
|
|
steps:
|
|
- name: fetch-config-file
|
|
image: registry.access.redhat.com/ubi8/ubi-minimal:8.2
|
|
workingDir: $(workspaces.source.path)
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
if [ -n "$(params.config_file_url)" ]
|
|
then
|
|
curl "$(params.config_file_url)" --output "$(params.config_file_path)"
|
|
echo "Fetched the config file from given ($(params.config_file_url)) URL and successfully saved at $(workspaces.source.path)/$(params.config_file_path)"
|
|
else
|
|
echo "No config file url was set"
|
|
fi
|
|
- name: lint-yaml
|
|
image: docker.io/stackrox/kube-linter:0.2.2-2-g7d10a69154-alpine@sha256:e520e9d8d3a2dfa611914836536545b135845e7bda9f1df34b060e116232dbf0
|
|
workingDir: $(workspaces.source.path)
|
|
script: |
|
|
mv ../../kube-linter ../../bin;
|
|
|
|
if [ -n "$(params.config_file_path)" ]
|
|
then
|
|
kube-linter lint "$(params.manifest)" --config "$(params.config_file_path)" --format "$(params.output_format)" "$@"
|
|
else
|
|
if [ -n "$(params.default_option)" ]
|
|
then
|
|
kube-linter lint "$(params.manifest)" --"$(params.default_option)" --include "$(params.includelist)" --exclude "$(params.excludelist)" --format "$(params.output_format)" "$@"
|
|
else
|
|
kube-linter lint "$(params.manifest)" --include "$(params.includelist)" --exclude "$(params.excludelist)" --format "$(params.output_format)" "$@"
|
|
fi
|
|
fi
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_yaml-lint" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: yaml-lint
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: linter
|
|
tekton.dev/displayName: YAML linter
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to perform lint check on YAML files
|
|
workspaces:
|
|
- name: shared-workspace
|
|
description: A workspace that contains the fetched git repository.
|
|
params:
|
|
- name: args
|
|
type: array
|
|
description: extra args needs to append
|
|
default:
|
|
- --help
|
|
steps:
|
|
- name: lint-yaml-files
|
|
image: docker.io/cytopia/yamllint:1.23@sha256:e9deea51bbdc35950cacf6594dab94100d9bbf5c987540b8874167d58e6bdce2
|
|
workingDir: $(workspaces.shared-workspace.path)
|
|
command:
|
|
- yamllint
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_buildpacks-phases" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: buildpacks-phases
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Image Build, Security
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/tags: image-build
|
|
tekton.dev/displayName: Buildpacks (phases)
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: The Buildpacks-Phases task builds source into a container image and pushes it to a registry, using Cloud Native Buildpacks. This task separately calls the aspects of the Cloud Native Buildpacks lifecycle, to provide increased security via container isolation.
|
|
workspaces:
|
|
- name: source
|
|
description: Directory where application source is located.
|
|
- name: cache
|
|
description: Directory where cache is stored (when no cache image is provided).
|
|
optional: true
|
|
params:
|
|
- name: APP_IMAGE
|
|
description: The name of where to store the app image.
|
|
- name: BUILDER_IMAGE
|
|
description: The image on which builds will run (must include lifecycle and compatible buildpacks).
|
|
- name: SOURCE_SUBPATH
|
|
description: A subpath within the `source` input where the source to build is located.
|
|
default: ''
|
|
- name: ENV_VARS
|
|
type: array
|
|
description: Environment variables to set during _build-time_.
|
|
default: []
|
|
- name: PROCESS_TYPE
|
|
description: The default process type to set on the image.
|
|
default: web
|
|
- name: RUN_IMAGE
|
|
description: Reference to a run image to use.
|
|
default: ''
|
|
- name: CACHE_IMAGE
|
|
description: The name of the persistent app cache image (if no cache workspace is provided).
|
|
default: ''
|
|
- name: USER_ID
|
|
description: The user ID of the builder image user.
|
|
default: '1000'
|
|
- name: GROUP_ID
|
|
description: The group ID of the builder image user.
|
|
default: '1000'
|
|
- name: PLATFORM_DIR
|
|
description: The name of the platform directory.
|
|
default: empty-dir
|
|
- name: LIFECYCLE_IMAGE
|
|
description: The image to use when executing sensitive phases.
|
|
default: docker.io/buildpacksio/lifecycle:0.10.2@sha256:1bf8d3fc41d2fdf0ee4abdad50038ab8902ef58c74f5bcfc432c26767d889ed0
|
|
- name: USER_HOME
|
|
description: Absolute path to the user's home directory.
|
|
default: /tekton/home
|
|
results:
|
|
- name: APP_IMAGE_DIGEST
|
|
description: The digest of the built `APP_IMAGE`.
|
|
stepTemplate:
|
|
env:
|
|
- name: CNB_PLATFORM_API
|
|
value: '0.4'
|
|
- name: HOME
|
|
value: $(params.USER_HOME)
|
|
steps:
|
|
- name: prepare
|
|
image: docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6
|
|
args:
|
|
- --env-vars
|
|
- $(params.ENV_VARS[*])
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
if [[ "$(workspaces.cache.bound)" == "true" ]]; then
|
|
echo "> Setting permissions on '$(workspaces.cache.path)'..."
|
|
chown -R "$(params.USER_ID):$(params.GROUP_ID)" "$(workspaces.cache.path)"
|
|
fi
|
|
|
|
for path in "/tekton/home" "/layers" "$(workspaces.source.path)"; do
|
|
echo "> Setting permissions on '$path'..."
|
|
chown -R "$(params.USER_ID):$(params.GROUP_ID)" "$path"
|
|
done
|
|
|
|
echo "> Parsing additional configuration..."
|
|
parsing_flag=""
|
|
envs=()
|
|
for arg in "$@"; do
|
|
if [[ "$arg" == "--env-vars" ]]; then
|
|
echo "-> Parsing env variables..."
|
|
parsing_flag="env-vars"
|
|
elif [[ "$parsing_flag" == "env-vars" ]]; then
|
|
envs+=("$arg")
|
|
fi
|
|
done
|
|
|
|
echo "> Processing any environment variables..."
|
|
ENV_DIR="/platform/env"
|
|
|
|
echo "--> Creating 'env' directory: $ENV_DIR"
|
|
mkdir -p "$ENV_DIR"
|
|
|
|
for env in "$${envs[@]}"; do
|
|
IFS='=' read -r key value string <<< "$env"
|
|
if [[ "$key" != "" && "$value" != "" ]]; then
|
|
path="$${ENV_DIR}/$${key}"
|
|
echo "--> Writing $${path}..."
|
|
echo -n "$value" > "$path"
|
|
fi
|
|
done
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: $(params.PLATFORM_DIR)
|
|
mountPath: /platform
|
|
securityContext:
|
|
privileged: true
|
|
- name: copy-stack-toml
|
|
image: $(params.BUILDER_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /bin/sh
|
|
args:
|
|
- -c
|
|
- |
|
|
cp /cnb/stack.toml /layers/
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: detect
|
|
image: $(params.BUILDER_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/detector
|
|
args:
|
|
- -app=$(workspaces.source.path)/$(params.SOURCE_SUBPATH)
|
|
- -group=/layers/group.toml
|
|
- -plan=/layers/plan.toml
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: $(params.PLATFORM_DIR)
|
|
mountPath: /platform
|
|
- name: empty-dir
|
|
mountPath: /tekton/home
|
|
- name: analyze
|
|
image: $(params.LIFECYCLE_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/analyzer
|
|
args:
|
|
- -layers=/layers
|
|
- -group=/layers/group.toml
|
|
- -cache-dir=$(workspaces.cache.path)
|
|
- -cache-image=$(params.CACHE_IMAGE)
|
|
- -uid=$(params.USER_ID)
|
|
- -gid=$(params.GROUP_ID)
|
|
- $(params.APP_IMAGE)
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: restore
|
|
image: $(params.LIFECYCLE_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/restorer
|
|
args:
|
|
- -group=/layers/group.toml
|
|
- -layers=/layers
|
|
- -cache-dir=$(workspaces.cache.path)
|
|
- -cache-image=$(params.CACHE_IMAGE)
|
|
- -uid=$(params.USER_ID)
|
|
- -gid=$(params.GROUP_ID)
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: build
|
|
image: $(params.BUILDER_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/builder
|
|
args:
|
|
- -app=$(workspaces.source.path)/$(params.SOURCE_SUBPATH)
|
|
- -layers=/layers
|
|
- -group=/layers/group.toml
|
|
- -plan=/layers/plan.toml
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: $(params.PLATFORM_DIR)
|
|
mountPath: /platform
|
|
- name: empty-dir
|
|
mountPath: /tekton/home
|
|
- name: export
|
|
image: $(params.LIFECYCLE_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/exporter
|
|
args:
|
|
- -app=$(workspaces.source.path)/$(params.SOURCE_SUBPATH)
|
|
- -layers=/layers
|
|
- -group=/layers/group.toml
|
|
- -cache-dir=$(workspaces.cache.path)
|
|
- -cache-image=$(params.CACHE_IMAGE)
|
|
- -report=/layers/report.toml
|
|
- -process-type=$(params.PROCESS_TYPE)
|
|
- -uid=$(params.USER_ID)
|
|
- -gid=$(params.GROUP_ID)
|
|
- -stack=/layers/stack.toml
|
|
- -run-image=$(params.RUN_IMAGE)
|
|
- $(params.APP_IMAGE)
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: results
|
|
image: docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
cat /layers/report.toml | grep "digest" | cut -d'"' -f2 | cut -d'"' -f2 | tr -d '\n' | tee $(results.APP_IMAGE_DIGEST.path)
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
volumes:
|
|
- name: empty-dir
|
|
emptyDir: {}
|
|
- name: layers-dir
|
|
emptyDir: {}
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_sonarqube-scanner" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: sonarqube-scanner
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/deprecated: 'true'
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/categories: Security
|
|
tekton.dev/tags: security
|
|
tekton.dev/displayName: sonarqube scanner
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
The following task can be used to perform static analysis on the source code provided the SonarQube server is hosted
|
|
SonarQube is the leading tool for continuously inspecting the Code Quality and Security of your codebases, all while empowering development teams. Analyze over 25 popular programming languages including C#, VB.Net, JavaScript, TypeScript and C++. It detects bugs, vulnerabilities and code smells across project branches and pull requests.
|
|
workspaces:
|
|
- name: source
|
|
description: Workspace containing the code which needs to be scanned by SonarQube
|
|
- name: sonar-settings
|
|
description: Optional workspace where SonarQube properties can be mounted
|
|
optional: true
|
|
- name: sonar-credentials
|
|
description: |
|
|
A workspace containing a login or password for use within sonarqube.
|
|
optional: true
|
|
params:
|
|
- name: SONAR_HOST_URL
|
|
description: SonarQube server URL
|
|
default: ''
|
|
- name: SONAR_PROJECT_KEY
|
|
description: Project's unique key
|
|
default: ''
|
|
- name: PROJECT_VERSION
|
|
description: 'Version of the project. Default: 1.0'
|
|
default: '1.0'
|
|
- name: SOURCE_TO_SCAN
|
|
description: Comma-separated paths to directories containing main source files
|
|
default: .
|
|
- name: SONAR_ORGANIZATION
|
|
description: The organization in sonarqube where the project exists
|
|
default: ''
|
|
- name: SONAR_SCANNER_IMAGE
|
|
description: The sonarqube scanner CLI image which will run the scan
|
|
default: docker.io/sonarsource/sonar-scanner-cli:4.6@sha256:7a976330a8bad1beca6584c1c118e946e7a25fdc5b664d5c0a869a6577d81b4f
|
|
- name: SONAR_LOGIN_KEY
|
|
description: Name of the file of the login within the sonarqube credentials workspace
|
|
default: login
|
|
- name: SONAR_PASSWORD_KEY
|
|
description: Name of the file of the password within the sonarqube credentials workspace
|
|
default: password
|
|
steps:
|
|
- name: sonar-properties-create
|
|
image: registry.access.redhat.com/ubi8/ubi-minimal:8.2
|
|
workingDir: $(workspaces.source.path)
|
|
env:
|
|
- name: SONAR_HOST_URL
|
|
value: $(params.SONAR_HOST_URL)
|
|
- name: SONAR_PROJECT_KEY
|
|
value: $(params.SONAR_PROJECT_KEY)
|
|
- name: PROJECT_VERSION
|
|
value: $(params.PROJECT_VERSION)
|
|
- name: SOURCE_TO_SCAN
|
|
value: $(params.SOURCE_TO_SCAN)
|
|
- name: SONAR_ORGANIZATION
|
|
value: $(params.SONAR_ORGANIZATION)
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
|
|
replaceValues() {
|
|
filename=$1
|
|
thekey=$2
|
|
newvalue=$3
|
|
|
|
if ! grep -R "^[#]*\s*$${thekey}=.*" $filename >/dev/null; then
|
|
echo "APPENDING because '$${thekey}' not found"
|
|
echo "" >>$filename
|
|
echo "$thekey=$newvalue" >>$filename
|
|
else
|
|
echo "SETTING because '$${thekey}' found already"
|
|
sed -ir "s|^[#]*\s*$${thekey}=.*|$thekey=$newvalue|" $filename
|
|
fi
|
|
}
|
|
|
|
if [[ "$(workspaces.sonar-settings.bound)" == "true" ]]; then
|
|
if [[ -f $(workspaces.sonar-settings.path)/sonar-project.properties ]]; then
|
|
echo "using user provided sonar-project.properties file"
|
|
cp -RL $(workspaces.sonar-settings.path)/sonar-project.properties $(workspaces.source.path)/sonar-project.properties
|
|
fi
|
|
fi
|
|
|
|
if [[ -f $(workspaces.source.path)/sonar-project.properties ]]; then
|
|
if [[ -n "$${SONAR_HOST_URL}" ]]; then
|
|
echo "replacing sonar host URL"
|
|
replaceValues $(workspaces.source.path)/sonar-project.properties sonar.host.url "$${SONAR_HOST_URL}"
|
|
fi
|
|
if [[ -n "$${SONAR_PROJECT_KEY}" ]]; then
|
|
echo "replacing sonar project key"
|
|
replaceValues $(workspaces.source.path)/sonar-project.properties sonar.projectKey "$${SONAR_PROJECT_KEY}"
|
|
fi
|
|
echo "Values in sonar-project.properties file replaced successfully..."
|
|
else
|
|
echo "Creating sonar-project.properties file..."
|
|
touch sonar-project.properties
|
|
[[ -n "$${SONAR_PROJECT_KEY}" ]] && {
|
|
echo "sonar.projectKey=$${SONAR_PROJECT_KEY}" >> sonar-project.properties
|
|
} || {
|
|
echo "missing property SONAR_PROJECT_KEY"
|
|
exit 1
|
|
}
|
|
|
|
[[ -n "$${SONAR_HOST_URL}" ]] && {
|
|
echo "sonar.host.url=$${SONAR_HOST_URL}" >> sonar-project.properties
|
|
} || {
|
|
echo "missing property SONAR_HOST_URL"
|
|
exit 1
|
|
}
|
|
|
|
[[ -n "$${PROJECT_VERSION}" ]] && {
|
|
echo "sonar.projectVersion=$${PROJECT_VERSION}" >> sonar-project.properties
|
|
} || {
|
|
echo "missing property PROJECT_VERSION"
|
|
exit 1
|
|
}
|
|
|
|
[[ -n "$${SONAR_ORGANIZATION}" ]] && {
|
|
echo "sonar.organization=$${SONAR_ORGANIZATION}" >> sonar-project.properties
|
|
} || {
|
|
echo "missing property SONAR_ORGANIZATION"
|
|
exit 1
|
|
}
|
|
echo "sonar.sources=$${SOURCE_TO_SCAN}" >> sonar-project.properties
|
|
echo "---------------------------"
|
|
cat $(workspaces.source.path)/sonar-project.properties
|
|
fi
|
|
|
|
if [[ "$(workspaces.sonar-credentials.bound)" == "true" ]]; then
|
|
if [[ -f $(workspaces.sonar-credentials.path)/$(params.SONAR_PASSWORD_KEY) ]]; then
|
|
SONAR_PASSWORD=`cat $(workspaces.sonar-credentials.path)/$(params.SONAR_PASSWORD_KEY)`
|
|
replaceValues $(workspaces.source.path)/sonar-project.properties sonar.password "$${SONAR_PASSWORD}"
|
|
fi
|
|
if [[ -f $(workspaces.sonar-credentials.path)/$(params.SONAR_LOGIN_KEY) ]]; then
|
|
SONAR_LOGIN=`cat $(workspaces.sonar-credentials.path)/$(params.SONAR_LOGIN_KEY)`
|
|
replaceValues $(workspaces.source.path)/sonar-project.properties sonar.login "$${SONAR_LOGIN}"
|
|
fi
|
|
fi
|
|
- name: sonar-scan
|
|
image: $(params.SONAR_SCANNER_IMAGE)
|
|
workingDir: $(workspaces.source.path)
|
|
command:
|
|
- sonar-scanner
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_check-make" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: check-make
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/tags: linter
|
|
tekton.dev/displayName: Makefile linter
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task can be used to perform lint check on Makefiles
|
|
workspaces:
|
|
- name: shared-workspace
|
|
description: A workspace that contains the fetched git repository.
|
|
params:
|
|
- name: args
|
|
type: array
|
|
description: extra args needs to append
|
|
default:
|
|
- --help
|
|
steps:
|
|
- name: lint-makefile
|
|
image: docker.io/cytopia/checkmake:0.1.0@sha256:50957311f1ae25fd5925e1a45798d323cf00b3654cd1eede8db7814c72cec41d
|
|
workingDir: $(workspaces.shared-workspace.path)
|
|
command:
|
|
- checkmake
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_gitea-set-status" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: gitea-set-status
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Git
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/tags: gitea
|
|
tekton.dev/displayName: set gitea status
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
This task will set the status of the CI job to the specified value along with a link to the specified target URL where developers can follow the progress of the CI job.
|
|
The `gitea-set-status` task allows external services to mark Gitea commits with an `error`, `failure`, `pending`, or `success` state, which is then reflected in pull requests involving those commits. Statuses include as well a `description` and a `target_url`, to give the user informations about the CI statuses or a direct link to the full log.
|
|
params:
|
|
- name: GITEA_HOST_URL
|
|
description: |
|
|
The Gitea host, e.g: git.yourcompany.com. Can include port.
|
|
type: string
|
|
- name: GITEA_HTTPS_OR_HTTP
|
|
description: |
|
|
If we should connect with HTTP or HTTPS. Use "http" or "https" here.
|
|
type: string
|
|
default: https
|
|
- name: API_PATH_PREFIX
|
|
description: |
|
|
The API path prefix of Gitea, default: /api/v1
|
|
default: /api/v1
|
|
type: string
|
|
- name: REPO_FULL_NAME
|
|
description: |
|
|
The Gitea repository full name, e.g.: tektoncd/catalog
|
|
type: string
|
|
- name: GITEA_TOKEN_SECRET_NAME
|
|
description: |
|
|
The name of the kubernetes secret that contains the Gitea token, default: gitea
|
|
type: string
|
|
default: gitea
|
|
- name: GITEA_TOKEN_SECRET_KEY
|
|
description: |
|
|
The key within the kubernetes secret that contains the Gitea token, default: token
|
|
type: string
|
|
default: token
|
|
- name: SHA
|
|
description: |
|
|
Commit SHA to set the status for.
|
|
type: string
|
|
- name: TARGET_URL
|
|
description: |
|
|
The target URL to associate with this status. This URL will be linked
|
|
from the Gitea UI to allow users to easily see the source of the
|
|
status.
|
|
type: string
|
|
- name: DESCRIPTION
|
|
description: |
|
|
A short description of the status.
|
|
type: string
|
|
- name: CONTEXT
|
|
description: |
|
|
The Gitea context, A string label to differentiate this status from
|
|
the status of other systems. ie: "continuous-integration/tekton"
|
|
default: continuous-integration/tekton
|
|
type: string
|
|
- name: STATE
|
|
description: |
|
|
The state of the status. Can be one of the following `error`,
|
|
`failure`, `pending`, `warning` or `success`.
|
|
type: string
|
|
- name: IMAGE
|
|
description: |
|
|
Image providing the python binary which this task uses.
|
|
type: string
|
|
default: python:3.10.1-alpine3.15@sha256:affe0faa14e7553fc570beec3864e74b5e36f8c19b2bb49ae8ba79c0e9e7236e
|
|
- name: SHEBANG
|
|
description: |
|
|
Python path. Depends on the image.
|
|
type: string
|
|
default: /usr/bin/env python
|
|
volumes:
|
|
- name: giteatoken
|
|
secret:
|
|
secretName: $(params.GITEA_TOKEN_SECRET_NAME)
|
|
steps:
|
|
- name: set-status
|
|
volumeMounts:
|
|
- name: giteatoken
|
|
mountPath: /etc/gitea-set-status
|
|
image: $(params.IMAGE)
|
|
script: |-
|
|
#!$(params.SHEBANG)
|
|
|
|
"""This script will set the CI status on a Gitea commit"""
|
|
|
|
import json
|
|
import sys
|
|
import http.client
|
|
|
|
gitea_token = open("/etc/gitea-set-status/$(params.GITEA_TOKEN_SECRET_KEY)", "r").read()
|
|
|
|
status_url = "$(params.API_PATH_PREFIX)" + "/repos/$(params.REPO_FULL_NAME)/" + \
|
|
"statuses/$(params.SHA)"
|
|
|
|
data = {
|
|
"state": "$(params.STATE)",
|
|
"target_url": "$(params.TARGET_URL)",
|
|
"description": "$(params.DESCRIPTION)",
|
|
"context": "$(params.CONTEXT)"
|
|
}
|
|
print("Sending this data to Gitea: ")
|
|
print(data)
|
|
|
|
authHeader = "token " + gitea_token
|
|
|
|
if "$(params.GITEA_HTTPS_OR_HTTP)" == "https":
|
|
conn = http.client.HTTPSConnection("$(params.GITEA_HOST_URL)")
|
|
else:
|
|
conn = http.client.HTTPConnection("$(params.GITEA_HOST_URL)")
|
|
|
|
conn.request(
|
|
"POST",
|
|
status_url,
|
|
body=json.dumps(data),
|
|
headers={
|
|
"User-Agent": "TektonCD, the peaceful cat",
|
|
"Authorization": authHeader,
|
|
"Accept": "application/json",
|
|
"Content-Type": "application/json",
|
|
})
|
|
resp = conn.getresponse()
|
|
if not str(resp.status).startswith("2"):
|
|
print("Error: %d" % (resp.status))
|
|
print(resp.read())
|
|
sys.exit(1)
|
|
else:
|
|
print("Gitea status '$(params.STATE)' has been set on "
|
|
"$(params.REPO_FULL_NAME)#$(params.SHA) ")
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_hadolint" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
annotations:
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/displayName: Hadolint
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/platforms: linux/amd64
|
|
tekton.dev/tags: Kubernetes, Misconfiguration
|
|
name: hadolint
|
|
labels: ${jsonencode(local.common_labels)}
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
This task makes it possible to use Hadolint within Tekton Pipeline.
|
|
A smarter Dockerfile linter that helps you build best practice Docker images. The linter parses the Dockerfile into an AST and performs rules on top of the AST
|
|
params:
|
|
- default: ''
|
|
description: ignore rules.
|
|
name: ignore-rules
|
|
type: string
|
|
- default: ./Dockerfile
|
|
description: Dockerfile path.
|
|
name: dockerfile-path
|
|
type: string
|
|
- default: tty
|
|
description: The output format for the results [tty | json | checkstyle | codeclimate | gitlab_codeclimate | codacy] (default tty).
|
|
name: output-format
|
|
type: string
|
|
steps:
|
|
- image: ghcr.io/hadolint/hadolint:v2.8.0-debian@sha256:50b0e60aa2b4aba5a26eeb4ad08c96ed7a828fca996632e29114aabea18345f4
|
|
name: lint-dockerfile
|
|
script: |
|
|
#!/bin/bash
|
|
set -e
|
|
if [ -n "$RULES" ]
|
|
then
|
|
IFS="," read -a RULES <<< "$RULES"
|
|
for rule in $${RULES[@]}; do ignore_rules="--ignore $rule $ignore_rules"; done
|
|
command_to_run="hadolint $${ignore_rules}"
|
|
else
|
|
command_to_run="hadolint"
|
|
fi
|
|
$command_to_run "$DOCKERFILE" -f "$OFORMAT"
|
|
env:
|
|
- name: RULES
|
|
value: $(params.ignore-rules)
|
|
- name: DOCKERFILE
|
|
value: $(params.dockerfile-path)
|
|
- name: OFORMAT
|
|
value: $(params.output-format)
|
|
workingDir: $(workspaces.source.path)
|
|
workspaces:
|
|
- description: A workspace that contains fetched git repo.
|
|
name: source
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_hugo" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1
|
|
kind: Task
|
|
metadata:
|
|
name: hugo
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Build Tools, Cloud
|
|
tekton.dev/tags: buildtools, cloud
|
|
tekton.dev/displayName: Hugo
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
A Task that builds a Hugo site.
|
|
This task uses the Hugo static site generator to build a static site from the content in the specified directory.
|
|
workspaces:
|
|
- name: work-dir
|
|
params:
|
|
- name: content-dir
|
|
type: string
|
|
description: The directory where the content is located
|
|
default: ''
|
|
- name: minify
|
|
type: string
|
|
description: Minify the output e.g. HTML, CSS, JS, XML
|
|
default: 'false'
|
|
- name: base-url
|
|
type: string
|
|
description: The base URL for the Hugo site. By default reads from the hugo.toml or hugo.yaml
|
|
default: ''
|
|
- name: verbose
|
|
type: string
|
|
description: Verbose output
|
|
default: 'false'
|
|
results:
|
|
- name: output
|
|
description: generated static site
|
|
steps:
|
|
- name: build
|
|
env:
|
|
- name: HUGO_MINIFY
|
|
value: $(params.minify)
|
|
- name: HUGO_BASEURL
|
|
value: $(params.base-url)
|
|
- name: HUGO_VERBOSE
|
|
value: $(params.verbose)
|
|
- name: HUGO_CONTENT_DIR
|
|
value: $(params.content-dir)
|
|
image: docker.io/hugomods/hugo:0.122.0@sha256:e90f2e6786969463f3475c7d5e7f031cb5dbf75a8394687d52f99d6c9d0eda0d
|
|
script: |-
|
|
export HUGOCMD="hugo"
|
|
|
|
|
|
if [ "$HUGO_MINIFY" = 'true' ]; then
|
|
export HUGOCMD="$${HUGOCMD} --minify"
|
|
fi
|
|
|
|
if [ "$HUGO_BASEURL" != '' ]; then
|
|
export HUGOCMD="$${HUGOCMD} --baseURL $HUGO_BASEURL"
|
|
fi
|
|
|
|
if [ "$HUGO_VERBOSE" = 'true' ]; then
|
|
export HUGOCMD="$${HUGOCMD} --verbose"
|
|
fi
|
|
|
|
if [ "$HUGO_CONTENT_DIR" != '' ]; then
|
|
export HUGOCMD="$${HUGOCMD} --contentDir $${HUGO_CONTENT_DIR}"
|
|
fi
|
|
|
|
cd "$(workspaces.work-dir.path)" || exit
|
|
$HUGOCMD
|
|
|
|
printf "%s/public" "$(workspaces.work-dir.path)" | tee /tekton/results/output
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_buildah" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: buildah
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Image Build
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/tags: image-build
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64
|
|
tekton.dev/displayName: buildah
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
Buildah task builds source into a container image and then pushes it to a container registry.
|
|
Buildah Task builds source into a container image using Project Atomic's Buildah build tool.It uses Buildah's support for building from Dockerfiles, using its buildah bud command.This command executes the directives in the Dockerfile to assemble a container image, then pushes that image to a container registry.
|
|
params:
|
|
- name: IMAGE
|
|
description: Reference of the image buildah will produce.
|
|
- name: BUILDER_IMAGE
|
|
description: The location of the buildah builder image.
|
|
default: quay.io/buildah/stable:v1
|
|
- name: STORAGE_DRIVER
|
|
description: Set buildah storage driver
|
|
default: overlay
|
|
- name: DOCKERFILE
|
|
description: Path to the Dockerfile to build.
|
|
default: ./Dockerfile
|
|
- name: CONTEXT
|
|
description: Path to the directory to use as context.
|
|
default: .
|
|
- name: TLSVERIFY
|
|
description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)
|
|
default: 'true'
|
|
- name: FORMAT
|
|
description: The format of the built container, oci or docker
|
|
default: oci
|
|
- name: BUILD_EXTRA_ARGS
|
|
description: Extra parameters passed for the build command when building images.
|
|
default: ''
|
|
- name: PUSH_EXTRA_ARGS
|
|
description: Extra parameters passed for the push command when pushing images.
|
|
type: string
|
|
default: ''
|
|
- name: SKIP_PUSH
|
|
description: Skip pushing the built image
|
|
default: 'false'
|
|
workspaces:
|
|
- name: source
|
|
- name: sslcertdir
|
|
optional: true
|
|
- name: dockerconfig
|
|
description: An optional workspace that allows providing a .docker/config.json file for Buildah to access the container registry. The file should be placed at the root of the Workspace with name config.json.
|
|
optional: true
|
|
results:
|
|
- name: IMAGE_DIGEST
|
|
description: Digest of the image just built.
|
|
- name: IMAGE_URL
|
|
description: Image repository where the built image would be pushed to
|
|
steps:
|
|
- name: build-and-push
|
|
image: $(params.BUILDER_IMAGE)
|
|
workingDir: $(workspaces.source.path)
|
|
script: |
|
|
[ "$(workspaces.sslcertdir.bound)" = "true" ] && CERT_DIR_FLAG="--cert-dir=$(workspaces.sslcertdir.path)"
|
|
[ "$(workspaces.dockerconfig.bound)" = "true" ] && DOCKER_CONFIG="$(workspaces.dockerconfig.path)" && export DOCKER_CONFIG
|
|
# build the image (CERT_DIR_FLAG should be omitted if empty and BUILD_EXTRA_ARGS can contain multiple args)
|
|
# shellcheck disable=SC2046,SC2086
|
|
buildah $${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" bud $(params.BUILD_EXTRA_ARGS) \
|
|
"--format=$(params.FORMAT)" "--tls-verify=$(params.TLSVERIFY)" \
|
|
-f "$(params.DOCKERFILE)" -t "$(params.IMAGE)" "$(params.CONTEXT)"
|
|
[ "$(params.SKIP_PUSH)" = "true" ] && echo "Push skipped" && exit 0
|
|
# push the image (CERT_DIR_FLAG should be omitted if empty and PUSH_EXTRA_ARGS can contain multiple args)
|
|
# shellcheck disable=SC2046,SC2086
|
|
buildah $${CERT_DIR_FLAG} "--storage-driver=$(params.STORAGE_DRIVER)" push $(params.PUSH_EXTRA_ARGS) \
|
|
"--tls-verify=$(params.TLSVERIFY)" --digestfile /tmp/image-digest "$(params.IMAGE)" \
|
|
"docker://$(params.IMAGE)"
|
|
tee "$(results.IMAGE_DIGEST.path)" < /tmp/image-digest
|
|
printf '%s' "$(params.IMAGE)" | tee "$(results.IMAGE_URL.path)"
|
|
volumeMounts:
|
|
- name: varlibcontainers
|
|
mountPath: /var/lib/containers
|
|
securityContext:
|
|
privileged: true
|
|
volumes:
|
|
- name: varlibcontainers
|
|
emptyDir: {}
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_buildpacks" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: buildpacks
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Image Build
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/tags: image-build
|
|
tekton.dev/displayName: Buildpacks
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: The Buildpacks task builds source into a container image and pushes it to a registry, using Cloud Native Buildpacks.
|
|
workspaces:
|
|
- name: source
|
|
description: Directory where application source is located.
|
|
- name: cache
|
|
description: Directory where cache is stored (when no cache image is provided).
|
|
optional: true
|
|
- name: dockerconfig
|
|
description: An optional workspace that allows providing a .docker/config.json file for Buildpacks lifecycle binary to access the container registry. The file should be placed at the root of the Workspace with name config.json.
|
|
optional: true
|
|
params:
|
|
- name: APP_IMAGE
|
|
description: The name of where to store the app image.
|
|
- name: BUILDER_IMAGE
|
|
description: The image on which builds will run (must include lifecycle and compatible buildpacks).
|
|
- name: SOURCE_SUBPATH
|
|
description: A subpath within the `source` input where the source to build is located.
|
|
default: ''
|
|
- name: ENV_VARS
|
|
type: array
|
|
description: Environment variables to set during _build-time_.
|
|
default: []
|
|
- name: PROCESS_TYPE
|
|
description: The default process type to set on the image.
|
|
default: web
|
|
- name: RUN_IMAGE
|
|
description: Reference to a run image to use.
|
|
default: ''
|
|
- name: CACHE_IMAGE
|
|
description: The name of the persistent app cache image (if no cache workspace is provided).
|
|
default: ''
|
|
- name: SKIP_RESTORE
|
|
description: Do not write layer metadata or restore cached layers.
|
|
default: 'false'
|
|
- name: USER_ID
|
|
description: The user ID of the builder image user.
|
|
default: '1000'
|
|
- name: GROUP_ID
|
|
description: The group ID of the builder image user.
|
|
default: '1000'
|
|
- name: PLATFORM_DIR
|
|
description: The name of the platform directory.
|
|
default: empty-dir
|
|
results:
|
|
- name: APP_IMAGE_DIGEST
|
|
description: The digest of the built `APP_IMAGE`.
|
|
- name: APP_IMAGE_URL
|
|
description: The URL of the built `APP_IMAGE`.
|
|
stepTemplate:
|
|
env:
|
|
- name: CNB_PLATFORM_API
|
|
value: '0.9'
|
|
steps:
|
|
- name: prepare
|
|
image: docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6
|
|
args:
|
|
- --env-vars
|
|
- $(params.ENV_VARS[*])
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
if [[ "$(workspaces.cache.bound)" == "true" ]]; then
|
|
echo "> Setting permissions on '$(workspaces.cache.path)'..."
|
|
chown -R "$(params.USER_ID):$(params.GROUP_ID)" "$(workspaces.cache.path)"
|
|
fi
|
|
|
|
for path in "/tekton/home" "/layers" "$(workspaces.source.path)"; do
|
|
echo "> Setting permissions on '$path'..."
|
|
chown -R "$(params.USER_ID):$(params.GROUP_ID)" "$path"
|
|
|
|
if [[ "$path" == "$(workspaces.source.path)" ]]; then
|
|
chmod 775 "$(workspaces.source.path)"
|
|
fi
|
|
done
|
|
|
|
echo "> Parsing additional configuration..."
|
|
parsing_flag=""
|
|
envs=()
|
|
for arg in "$@"; do
|
|
if [[ "$arg" == "--env-vars" ]]; then
|
|
echo "-> Parsing env variables..."
|
|
parsing_flag="env-vars"
|
|
elif [[ "$parsing_flag" == "env-vars" ]]; then
|
|
envs+=("$arg")
|
|
fi
|
|
done
|
|
|
|
echo "> Processing any environment variables..."
|
|
ENV_DIR="/platform/env"
|
|
|
|
echo "--> Creating 'env' directory: $ENV_DIR"
|
|
mkdir -p "$ENV_DIR"
|
|
|
|
for env in "$${envs[@]}"; do
|
|
IFS='=' read -r key value <<< "$env"
|
|
if [[ "$key" != "" && "$value" != "" ]]; then
|
|
path="$${ENV_DIR}/$${key}"
|
|
echo "--> Writing $${path}..."
|
|
echo -n "$value" > "$path"
|
|
fi
|
|
done
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: $(params.PLATFORM_DIR)
|
|
mountPath: /platform
|
|
- name: create
|
|
image: $(params.BUILDER_IMAGE)
|
|
imagePullPolicy: Always
|
|
command:
|
|
- /cnb/lifecycle/creator
|
|
env:
|
|
- name: DOCKER_CONFIG
|
|
value: $(workspaces.dockerconfig.path)
|
|
args:
|
|
- -app=$(workspaces.source.path)/$(params.SOURCE_SUBPATH)
|
|
- -cache-dir=$(workspaces.cache.path)
|
|
- -cache-image=$(params.CACHE_IMAGE)
|
|
- -uid=$(params.USER_ID)
|
|
- -gid=$(params.GROUP_ID)
|
|
- -layers=/layers
|
|
- -platform=/platform
|
|
- -report=/layers/report.toml
|
|
- -process-type=$(params.PROCESS_TYPE)
|
|
- -skip-restore=$(params.SKIP_RESTORE)
|
|
- -previous-image=$(params.APP_IMAGE)
|
|
- -run-image=$(params.RUN_IMAGE)
|
|
- $(params.APP_IMAGE)
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
- name: $(params.PLATFORM_DIR)
|
|
mountPath: /platform
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
- name: results
|
|
image: docker.io/library/bash:5.1.4@sha256:b208215a4655538be652b2769d82e576bc4d0a2bb132144c060efc5be8c3f5d6
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
grep "digest" /layers/report.toml | cut -d'"' -f2 | cut -d'"' -f2 | tr -d '\n' | tee "$(results.APP_IMAGE_DIGEST.path)"
|
|
echo -n "$(params.APP_IMAGE)" | tee "$(results.APP_IMAGE_URL.path)"
|
|
volumeMounts:
|
|
- name: layers-dir
|
|
mountPath: /layers
|
|
volumes:
|
|
- name: empty-dir
|
|
emptyDir: {}
|
|
- name: layers-dir
|
|
emptyDir: {}
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_kubeval" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: kubeval
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/pipelines.minVersion: 0.12.1
|
|
tekton.dev/categories: Code Quality, Kubernetes
|
|
tekton.dev/tags: test
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: |-
|
|
This task makes it possible to use Kubeval within your Tekton pipelines.
|
|
Kubeval is a tool used for validating Kubernetes configuration files. By default the task will recursively scan the provided repository for YAML files and validate them against the Kubernetes schemas.
|
|
workspaces:
|
|
- name: source
|
|
params:
|
|
- name: files
|
|
default: .
|
|
- name: output
|
|
default: stdout
|
|
- name: args
|
|
type: array
|
|
default: []
|
|
steps:
|
|
- name: kubeval
|
|
workingDir: $(workspaces.source.path)
|
|
image: docker.io/garethr/kubeval:0.15.0@sha256:6962d8ecbb7839637667f66e6703e6ebaae0c29dfe93a31d9968fba4324c7b8d
|
|
command:
|
|
- kubeval
|
|
- -d
|
|
- $(params.files)
|
|
- -o
|
|
- $(params.output)
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "Task_pylint" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: tekton.dev/v1beta1
|
|
kind: Task
|
|
metadata:
|
|
name: pylint
|
|
labels: ${jsonencode(local.common_labels)}
|
|
annotations:
|
|
tekton.dev/categories: Code Quality
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
tekton.dev/tags: python, pylint
|
|
tekton.dev/displayName: pylint
|
|
tekton.dev/platforms: linux/amd64
|
|
namespace: ${var.namespace}
|
|
spec:
|
|
description: This task will run pylint on the provided input.
|
|
workspaces:
|
|
- name: source
|
|
- description: The workspace consisting of the custom pip settings.
|
|
name: pip-conf
|
|
optional: true
|
|
params:
|
|
- name: image
|
|
description: The container image with pylint
|
|
default: registry.gitlab.com/pipeline-components/pylint:0.12.0@sha256:051b701936dfab6fa27bd1ebd50ef56b19577565661bc0227e50dd1cf94a3d6e
|
|
- name: path
|
|
description: The path to the module which should be analysed by pylint
|
|
default: .
|
|
type: string
|
|
- name: requirements_file
|
|
description: The name of the requirements file inside the source location
|
|
default: requirements.txt
|
|
- name: args
|
|
description: The arguments to pass to the pylint CLI.
|
|
type: array
|
|
default: []
|
|
- name: pip_conf_file
|
|
description: The name of the custom pip config file.
|
|
default: pip.conf
|
|
steps:
|
|
- name: pylint
|
|
image: $(params.image)
|
|
workingDir: $(workspaces.source.path)
|
|
env:
|
|
- name: HOME
|
|
value: /tmp/python
|
|
- name: PARAM_PIP_CONF_FILE
|
|
value: $(params.pip_conf_file)
|
|
- name: WORKSPACE_PIP_CONF_BOUND
|
|
value: $(workspaces.pip-conf.bound)
|
|
- name: WORKSPACE_PIP_CONF_PATH
|
|
value: $(workspaces.pip-conf.path)
|
|
script: |
|
|
export PATH=$PATH:$HOME/.local/bin
|
|
|
|
if [ "$${WORKSPACE_PIP_CONF_BOUND}" = "true" ] ; then
|
|
export PIP_CONFIG_FILE="$${WORKSPACE_PIP_CONF_PATH}/$${PARAM_PIP_CONF_FILE}"
|
|
fi
|
|
|
|
if [ -n "$(params.requirements_file)" ] && [ -e "$(params.requirements_file)" ];then
|
|
python -mpip install --user -r "$(params.requirements_file)"
|
|
fi
|
|
pylint $@ "$(params.path)"
|
|
args:
|
|
- $(params.args)
|
|
EOF
|
|
}
|
|
|