Kubernetes 原生 CI/CD 构建框架 Tekton 详解

apiVersion: tekton.dev/v1beta1kind: Taskmetadata:  name: task-examplespec:  steps:  - name: ls    image: ubuntu    command: ["ls"]

apiVersion: tekton.dev/v1beta1kind: Pipelinemetadata:  name: pipeline-examplespec:  tasks:  - name: task-example    taskRef:      name: task-example

apiVersion: tekton.dev/v1beta1kind: PipelineRunmetadata:  name: pipelinerun-example    # 或者可以直接使用 generateName，让 kubernetes 自动在名字后生成随机字符串  # generateName: pipelinerun-example-spec:  pipelineRef:    name: pipeline-example

apiVersion: tekton.dev/v1alpha1kind: PipelineResourcemetadata:  name: git-inputspec:  type: git  params:  # revision 指定版本号  - name: revision    value: v0.32.0  # 代码仓库地址，若为私有仓库，还需要配置 service account 以及 secret  - name: url      value: https://github.com/GoogleContainerTools/skaffold

apiVersion: tekton.dev/v1alpha1kind: PipelineResourcemetadata:  name: image-outputspec:  type: image  params:    # 镜像仓库地址，若为私有仓库，还需要配置 service account 以及 secret    - name: url      value: gcr.io/<use your project>/leeroy-web

apiVersion: tekton.dev/v1beta1kind: Taskmetadata:  name: build-docker-image-from-git-sourcespec:  params:    # 参数用于找到 Dockerfile 用于构建镜像    - name: pathToDockerFile      type: string      description: The path to the dockerfile to build    # 此处为 Tekton 的变量替换格式 $(xxx)，    # 该变量会去找到 resources 中名为 docker-source 的 inputs 的目录    # 在这个场景下，即为 Dockefile 所在的目录      default: $(resources.inputs.docker-source.path)/Dockerfile    - name: pathToContext      type: string      description: |        The build context used by Kaniko        (https://github.com/GoogleContainerTools/kaniko#kaniko-build-contexts)     # 同上，context 的地址与 Dockerfile 地址一致      default: $(resources.inputs.docker-source.path)  # 申明了两个 resource，一个 input 一个 output  resources:    inputs:      - name: docker-source        type: git    outputs:      - name: builtImage        type: image  steps:    - name: build-and-push      image: gcr.io/kaniko-project/executor:v0.16.0      # 需要指定 DOCKER_CONFIG 来允许 kaniko 检测 docker credential      env:        - name: "DOCKER_CONFIG"          value: "/tekton/home/.docker/"      command:        - /kaniko/executor      args:      # 使用了变量替换，第一个和第三个从 params 中取值      # 第二个为 resource 中名为 builtImage 的 outputs 的 url      # 即镜像仓库地址        - --dockerfile=$(params.pathToDockerFile)        - --destination=$(resources.outputs.builtImage.url)        - --context=$(params.pathToContext)

apiVersion: tekton.dev/v1beta1kind: TaskRunmetadata:  name: build-docker-image-from-git-source-task-runspec:  serviceAccountName: tutorial-service  taskRef:    name: build-docker-image-from-git-source  params:    # 传递参数进入 Task    - name: pathToDockerFile      value: Dockerfile    - name: pathToContext      value: $(resources.inputs.docker-source.path)/examples/microservices/leeroy-web #configure: may change according to your source  resources:    inputs:      - name: docker-source        resourceRef:          name: git-input    outputs:      - name: builtImage        resourceRef:          name: image-output

- name: lint-repo  taskRef:    name: pylint  resources:    inputs:      - name: workspace        resource: my-repo- name: test-app  taskRef:    name: make-test  resources:    inputs:      - name: workspace        resource: my-repo- name: build-app  taskRef:    name: kaniko-build-app  runAfter:    - test-app  resources:    inputs:      - name: workspace        resource: my-repo    outputs:      - name: image        resource: my-app-image- name: build-frontend  taskRef:    name: kaniko-build-frontend  runAfter:    - test-app  resources:    inputs:      - name: workspace        resource: my-repo    outputs:      - name: image        resource: my-frontend-image- name: deploy-all  taskRef:    name: deploy-kubectl  resources:    inputs:      - name: my-app-image        resource: my-app-image        from:          - build-app      - name: my-frontend-image        resource: my-frontend-image        from:          - build-frontend

        |            |        v            v     test-app    lint-repo    /        \   v          vbuild-app  build-frontend   \          /    v        v    deploy-all

d, err := dag.Build(v1beta1.PipelineTaskList(pipelineSpec.Tasks))
...
// Build returns a valid pipeline Graph. Returns error if the pipeline is invalidfunc Build(tasks Tasks) (*Graph, error) {    d := newGraph()
    deps := map[string][]string{}    // Add all Tasks mentioned in the `PipelineSpec`    for _, pt := range tasks.Items() {        if _, err := d.addPipelineTask(pt); err != nil {            return nil, fmt.Errorf("task %s is already present in Graph, can't add it again: %w", pt.HashKey(), err)        }        deps[pt.HashKey()] = pt.Deps()    }    // Process all from and runAfter constraints to add task dependency    for pt, taskDeps := range deps {        for _, previousTask := range taskDeps {            if err := addLink(pt, previousTask, d.Nodes); err != nil {                return nil, fmt.Errorf("couldn't add link between %s and %s: %w", pt, previousTask, err)            }        }    }    return d, nil}
...
// Node represents a Task in a pipeline.type Node struct {    // Task represent the PipelineTask in Pipeline    Task Task    // Prev represent all the Previous task Nodes for the current Task    Prev []*Node    // Next represent all the Next task Nodes for the current Task    Next []*Node}
// Graph represents the Pipeline Graphtype Graph struct {    //Nodes represent map of PipelineTask name to Node in Pipeline Graph    Nodes map[string]*Node}

initContainers:  - command:    - cp    - /ko-app/entrypoint    - /tekton/tools/entrypoint    image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/entrypoint    imagePullPolicy: IfNotPresent    name: place-tools    resources: {}    terminationMessagePath: /dev/termination-log    terminationMessagePolicy: File    volumeMounts:    - mountPath: /tekton/tools      name: tekton-internal-tools    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount      name: default-token-t2mbw      readOnly: true

- args:    - -wait_file    - /tekton/downward/ready    - -wait_file_content    - -post_file    - /tekton/tools/0    - -termination_path    - /tekton/termination    # 下面为用户原本的执行命令    - ...    - ...    command:    - /tekton/tools/entrypoint

func resolveResourceRequests(containers []corev1.Container, limitRangeMin corev1.ResourceList) []corev1.Container {    max := allZeroQty()    resourceNames := []corev1.ResourceName{corev1.ResourceCPU, corev1.ResourceMemory, corev1.ResourceEphemeralStorage}    maxIndicesByResource := make(map[corev1.ResourceName]int, len(resourceNames))    for _, resourceName := range resourceNames {        maxIndicesByResource[resourceName] = -1    }
    // Find max resource requests and associated list indices for    // containers for CPU, memory, and ephemeral storage resources    for i, c := range containers {        for k, v := range c.Resources.Requests {            if v.Cmp(max[k]) > 0 {                maxIndicesByResource[k] = i                max[k] = v            }        }    }
    // Use zeroQty if request value is not set for min    ...
    // Set all non max resource requests to 0. Leave max request at index    // originally defined to account for limit of step.    for i := range containers {        if containers[i].Resources.Requests == nil {            containers[i].Resources.Requests = limitRangeMin            continue        }        for _, resourceName := range resourceNames {            if maxIndicesByResource[resourceName] != i {                containers[i].Resources.Requests[resourceName] = limitRangeMin[resourceName]            }        }    }
    return containers}

apiVersion: tekton.dev/v1alpha1kind: Taskmetadata:  name: print-date  annotations:    description:       A simple task that prints the date to make sure your cluster / Tekton is working properly.spec:  results:    - name: "current-date"      description: "The current date"  steps:    - name: print-date      image: bash:latest      args:        - "-c"        -           date > /tekton/results/current-date

tasks:  - name: first-create-file    when:      - input: "$(params.path)"        operator: in        values: ["README.md"]    taskRef:      name: first-create-file

tasks:  - name: build-the-image    retries: 3    taskRef:      name: build-push

spec:  tasks:    - name: tests      taskRef:        Name: integration-test  finally:    - name: cleanup-test      taskRef:        Name: cleanup

apiVersion: tekton.dev/v1beta1kind: PipelineRunmetadata:  name: go-example-gitspec:  # […]  status: "PipelineRunCancelled"