Tekton Pipelines is an open source project that you can use to configure and run Continuous Integration and Continuous Delivery pipelines within a Kubernetes cluster. Tekton pipelines are defined in yaml files, which are typically stored in a Git repository (repo).

Tekton provides a set of Custom Resources extensions to Kubernetes to define pipelines. The following basic Tekton Pipeline resources are included in these extensions:

Resource	Description
Task	Defines a set of build steps such as compiling code, running tests, and building and deploying images.
TaskRun	Instantiates a Task for execution with specific inputs, outputs, and execution parameters. Can be invoked on its own or as part of a Pipeline.
Pipeline	Defines the set of tasks that compose a pipeline.
PipelineRun	Instantiates a Pipeline for execution with specific inputs, outputs, and execution parameters.
PipelineResource	Defines an object that is an input (such as a Git repository) or an output (such as a Docker image) of the pipeline. This resource was not promoted to Beta along with the other Tekton Pipeline custom resources.

There are several advantages to using Tekton Pipelines:

The Tekton Pipelines project is a beta release. You must update your pipeline with each new version of Tekton. For more information about the latest version of Tekton, see https://github.com/tektoncd/pipeline/releases.

IBM Cloud Continuous Delivery provides two types of delivery pipelines that you can use to build, test, and deploy your applications.

When you use IBM-managed workers, only one Tekton pipeline can run per pipeline at a time. When you use private workers, multiple Tekton pipelines can run concurrently.

Both types of pipelines isolate jobs or steps from one another by running in separate containers, and by using an image that you choose. Classic and Tekton pipelines both exist in a toolchain and depend on that toolchain to add more tool integrations that are used in the build, test, and deployment process.




Prerequisites

Before you add and run a Tekton pipeline, make sure that you've the following resources in place:

• A toolchain that contains the following tool integrations:

  • A repo tool integration (such as the GitHub tool integration) that contains your Tekton pipeline code, including a Tekton yaml file. Find sample pipeline and task definitions on github. For more information about getting started with Tekton pipelines, see Tekton Pipelines or take the Develop a Kubernetes app by using Tekton delivery pipelines tutorial.
  • Optional. If you are not using the default shared Pipeline Worker, you can use a Delivery Pipeline Private Worker tool integration that references your Kubernetes cluster. For more information about private workers, see Installing Delivery Pipeline Private Workers.

• IBM Cloud CLI installed locally.

• kubectl installed locally.
• A Kubernetes cluster (version 1.15 or higher) such as an IBM Cloud Kubernetes Service cluster.

The toolchain and the Delivery Pipeline Private Worker tool integration must be in the same region.




Creating a Delivery Pipeline for Tekton

When you configure a Delivery Pipeline tool integration, you can select the type of pipeline that you want to create.

1. If you don't have a toolchain, select a template to create a toolchain. Depending on the template that you use, different fields might be available. Review the default field values and if needed, change those settings.
2. If you've a toolchain and are adding this tool integration to it, from the IBM Cloud console, click the menu icon and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous delivery card, click View toolchain. Then, click Overview.

3. Add the Delivery Pipeline integration to your toolchain:

   a. Click Add tool.

   b. In the Tool Integrations section, click Delivery Pipeline.

4. Specify a name for your new pipeline.

5. Select Tekton to create a Tekton Delivery Pipeline. This type of pipeline provides a dashboard that you can use to view the output of Tekton pipeline runs on a defined Kubernetes cluster, with support for configuring the pipeline definitions repos, the pipeline triggers, where the pipeline runs, and simple secrets.
6. If you plan to use your pipeline to deploy a user interface, select the Show apps in the View app menu checkbox. All of the apps that your pipeline creates are shown in the View App list on the toolchain's Overview page.
7. Click Create Integration to add the Delivery Pipeline to your toolchain.




Configuring a Delivery Pipeline for Tekton

1. Click the Delivery Pipeline card to open the Tekton Delivery Pipeline dashboard.

2. In the Definitions section, complete the following tasks:

   a. Specify the Git repo and URL that contains the Tekton pipeline definition and related artifacts. If your repo is not available, return to the toolchain Overview page and add your repo.

   b. Select the branch within your Git repo that you want to use, or type a tag.

   c. Specify the path to your pipeline definition within the Git repo. We can reference a specific definition within the same repo. We can also add multiple definition repos, if they are integrated with the toolchain.

   d. Save your changes.

   The pipeline definition is updated automatically.

3. In the Worker section, select the IBM Managed shared worker or the private worker that you want to use to run your Tekton pipeline. For more information about private workers, see Working with Delivery Pipeline Private Workers.

   The private worker must be defined in the same toolchain as your Tekton pipeline.

4. In the Triggers section, click Add trigger to create a new trigger, and then associate that trigger with an event listener. The list of available event listeners is populated with the listeners that are defined in the pipeline code repo.

   Triggers are based on Tekton trigger definitions. Git respository triggers use the event listener that they are mapped to to extract information from the incoming event payload and create Kubernetes resources. These resources are applied to a Tekton PipelineRun resource.

   Manual triggers run when you click the Run pipeline button and select the trigger.

   Git repository triggers run when the specified Git event type occurs for the specified Git repo and branch.

   We can access the webhook payload that is delivered to a Git trigger from your Tekton pipeline resources. Although the exact fields are repo-specific, the general syntax for the webhook payload is $(event.payloadFieldName).

   Timed triggers run at a scheduled time that is defined by the CRON value. The CRON expression for timed triggers is based on the UNIX crontab syntax and is a sequence of five time and date fields: minute, hour, day of the month, month, and day of the week. These fields are separated by spaces in the format X X X X X. The following examples show strings that use various timed frequencies.

   • * * * * * - The trigger runs every minute.
   • 0 * * * * - The trigger runs at the start of every hour.
   • 0 9 * 1 MON-FRI - The trigger runs at 9:00 AM every weekday in January.
   • 0 * * NOV,DEC 1 - The trigger runs every hour on Mondays during November and December.

   Generic webhook triggers run when a POST request that is configured with the secret setting goes to the generic webhook URL. Generic webhook triggers provide a unique webhook URL for POST requests. We can secure generic webhook triggers to work with Git, a Slack outgoing webhook, an Artifactory webhook, and more by using any of the following methods:

   • Token matches to compare the saved token and the token that is passed within the POST request. Supported token sources include a header, query, or payload. Token matches are used by GitLab webhooks and Slack outgoing webhooks.
   • Payload digest matches to compare the signature and the hash that are generated from the digested payload by using HMAC hex digest with a saved token. Supported signature sources might include a header, query, or payload. Users must specify a digest algorithm. Payload digest matches are used by GitHub webhooks.
   • Tekton task validation requires users to validate the webhook request within their Tekton tasks.

   Specify the following values to use generic webhook triggers with GitHub webhooks:

   • Securing: Payload Digest Matches
   • Signature Source: Header
   • Header Key Name: X-Hub-Signature
   • Digest Algorithm: sha1.

   Specify the following values to use generic webhook triggers with GitLab webhooks:

   • Securing: Token Matches
   • Token Source: Header
   • Header Key Name: X-Gitlab-Token

   Specify the following values to use generic webhook triggers with Slack outgoing webhooks:

   • Securing: Token Matches
   • Token Source: Payload
   • JSON Property Name / Form Key: token

   The following example shows how to use the curl command with a generic webhook that is secured with a Token Matches rule:

   

   
   curl -X POST \
   https://devops-api.us-south.devops.cloud.ibm.com/v1/tekton-webhook/588236be-749b-4c67-ae57-a561abbbc9a8/run/7e82880e-4223-4c98-8ca9-ef6df36bb6dc \
   -H 'Content-Type: application/json' \
   -H 'token: 48a0f92c0932890048596906a22ae189c48c5619fbcf9600' \
   -d '{
    "somekey": "somevalue"
   }'
   

   To obtain payload values in the pipeline definition, specify a Triggerbinding parameter with a value that is derived from the event:

   
   apiVersion: tekton.dev/v1beta1
   kind: TriggerBinding
   metadata:
    name: binding
   spec:
    params:
      - name: somekey
        value: $(event.somekey)
   

Save your changes.

1. In the Environment properties section, click Add property and define your own environment property. For example, you can define an API_KEY property that passes an API key that is used by all of the scripts in the pipeline to access IBM Cloud resources. We can add the following types of properties:

   We can access these properties in your Tekton pipeline resources. For more information about these properties, see Tekton Pipelines environment and resources.

   • Click Save.




Viewing the Delivery Pipeline for Tekton dashboard

In the PipelineRuns section, the Tekton Delivery Pipeline dashboard displays an empty table until at least one Tekton pipeline runs. After Tekton pipeline runs occur (either manually or as the result of external events), the table lists those runs and related information such as status and run trigger, and the last updated time of the run definition.

Pipeline runs can be in any of the following states:



For detailed information about a selected run, click any row in the table. You view the Task definition and the steps in each PipelineRun definition. We can also view the status, logs, and details of each Task definition and step, and the overall status of the PipelineRun definition.






Learn more about Tekton pipelines

To learn more about Tekton pipelines, see the Tekton: A Modern Approach to Continuous Delivery article or take this tutorial:

• Develop a Kubernetes app by using Tekton delivery pipelines tutorial.