OpenShift Pipelines を構築してみた

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  labels:
    app: ocp-cicd-appli-ui
  name: ocp-cicd-appli-ui
spec:
  port:
    targetPort: 8080-tcp
  to:
    kind: Service
    name: ocp-cicd-appli-ui
    weight: 100

apiVersion: v1
kind: Service
metadata:
  labels:
    app: ocp-cicd-appli-ui
  name: ocp-cicd-appli-ui
spec:
  type: NodePort
  ports:
    - name: 8080-tcp
      port: 8080
      targetPort: 8080
      protocol: TCP
  selector:
    app: ocp-cicd-appli-ui

apiVersion: v1
kind: Secret
metadata:
  name: ssh-credential
data:
  id_rsa: # cat ~/.ssh/id_rsa | base64 で表示された内容を記入（一行で記述すること）

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: update-deployment
spec:
  params:
    - name: deployment
      description: The name of the deployment patch the image
      type: string
    - name: IMAGE
      description: Location of image to be patched with
      type: string
  steps:
    - name: patch
      image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
      command: ["/bin/bash", "-c"]
      args:
        - |-
          oc patch deployment $(inputs.params.deployment) --patch='{"spec":{"template":{"spec":{
            "containers":[{
              "name": "$(inputs.params.deployment)",
              "image":"$(inputs.params.IMAGE)"
            }]
          }}}}'
          patched_at_timestamp=`date +%s`
          oc patch deployment $(inputs.params.deployment) --patch='{"spec":{"template":{"metadata":{
            "labels":{
              "patched_at": '\"$patched_at_timestamp\"'
            }
          }}}}'

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: build-and-deploy
spec:
  workspaces:
  - name: shared-workspace
  - name: ssh-creds
  params:
  - name: deployment-name
    type: string
    description: name of the deployment to be patched
  - name: git-url
    type: string
    description: url of the git repo for the code of deployment
  - name: git-revision
    type: string
    description: revision to be used from repo of the code for deployment
    default: main
  - name: IMAGE
    type: string
    description: image to be build from the code
 
  tasks:
  - name: fetch-repository
    taskRef:
      name: git-clone
      kind: ClusterTask
    workspaces:
    - name: output
      workspace: shared-workspace
    - name: ssh-directory
      workspace: ssh-creds
    params:
    - name: url
      value: $(params.git-url)
    - name: subdirectory
      value: ""
    - name: deleteExisting
      value: "true"
    - name: revision
      value: $(params.git-revision)


  - name: build-image
    taskRef:
      name: buildah
      kind: ClusterTask
    params:
    - name: IMAGE
      value: $(params.IMAGE)
    workspaces:
    - name: source
      workspace: shared-workspace
    runAfter:
    - fetch-repository


# 以下CD部分のタスクのため、続編のCD部分を実装する際は記入しないこと
  - name: apply-manifests
    taskRef:
      name: apply-manifests
    workspaces:
    - name: source
      workspace: shared-workspace
    runAfter:
    - build-image


  - name: update-deployment
    taskRef:
      name: update-deployment
    params:
    - name: deployment
      value: $(params.deployment-name)
    - name: IMAGE
      value: $(params.IMAGE)
    runAfter:
    - apply-manifests

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: source-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 500Mi

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: sample-app
spec:
  params:
  - name: git-repo-url
    description: The git repository url
  - name: git-revision
    description: The git revision
    default: main
  - name: git-repo-name
    description: The name of the deployment to be created / patched


  resourcetemplates:
  - apiVersion: tekton.dev/v1
    kind: PipelineRun
    metadata:
      generateName: build-deploy-$(tt.params.git-repo-name)
    spec:
      taskRunTemplate:
        serviceAccountName: pipeline
      pipelineRef:
        name: build-and-deploy
      params:
      - name: deployment-name
        value: $(tt.params.git-repo-name)
      - name: git-url
        value: $(tt.params.git-repo-url)
      - name: git-revision
        value: $(tt.params.git-revision)
      - name: IMAGE
        value: image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/$(tt.params.git-repo-name):$(tt.params.git-revision)
        # Pipelineで実行結果確認のCD部分を実装する場合はコミットIDを参照しないため下記に置き換える
        # value: image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/$(tt.params.git-repo-name)
      workspaces:
      - name: shared-workspace
        volumeClaimTemplate:
          spec:
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: 500Mi
      - name: ssh-creds
        secret:
          secretName: ssh-credential

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerBinding
metadata:
  name: sample-app
spec:
  params:
  - name: git-repo-url
    # privateリポジトリのためssh_urlを参照
    value: $(body.repository.ssh_url)
  - name: git-repo-name
    value: $(body.repository.name)
  - name: git-revision
    value: $(body.head_commit.id)

apiVersion: triggers.tekton.dev/v1beta1
kind: Trigger
metadata:
  # event_listenerで参照するTrigger名
  name: sample-trigger
spec:
  serviceAccountName: pipeline
  interceptors:
    - ref:
        name: "github"
      params:
        - name: "secretRef"
          value:
            secretName: github-secret
            secretKey: secretToken
        - name: "eventTypes"
          value: ["push"]
  bindings:
    - ref: sample-app
  template:
    ref: sample-app
---
apiVersion: v1
kind: Secret
metadata:
  name: github-secret
type: Opaque
stringData:
# webhookのシークレット
  secretToken: "1234567"

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: sample-app
spec:
  serviceAccountName: pipeline
  triggers:
    # webhookをインターセプトするTrigger名を参照
    - triggerRef: sample-trigger