primo

add-on/pipeline_segregata.sh

@@ -0,0 +1,169 @@
+# creazione secret, SA, Role e Rolebinding all'interno del namespace applicativo
+
+kubectl create secret docker-registry harbor-regcred \
+  -n poc \
+  --docker-server=harbor.pigreco66.it \
+  --docker-username=robot$tekton \
+  --docker-password=p2oZtqcUJafMAlX0eUzgHax9fv0ML8te \
+  --docker-email=alessandro.barucci66@gmail.com
+
+kubectl create secret generic harbor-push-secret  -n poc   --from-file=config.json=config.json
+
+
+cat <<EOF | kubectl  apply -f  -
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tekton-deployer
+  namespace: poc
+imagePullSecrets:
+  - name: harbor-regcred  
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tekton-deployer
+  namespace: poc
+rules:
+- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
+  resources: ["*"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tekton-deployer
+  namespace: poc
+subjects:
+- kind: ServiceAccount
+  name: tekton-deployer
+  namespace: poc
+roleRef:
+  kind: Role
+  name: tekton-deployer
+  apiGroup: rbac.authorization.k8s.io
+EOF
+
+
+
+#Pipeline che refernzia task remoti --> apply -f su namespace centralizzato tekton-pipelines
+#kubectl apply -f  pipedep.yaml -n tekton-pipelines
+apiVersion: tekton.dev/v1beta1
+kind: Pipeline
+metadata:
+  name: deploy-infrastructure
+spec:
+  description: |
+    This pipeline clones a git repo, builds a Docker image with Kaniko and
+    pushes it to a registry
+  params:
+  - name: repo-url
+    type: string
+  - name: image-reference
+    type: string
+  - name: dockerfile
+    type: string
+  - name: namespace
+    type: string
+  workspaces:
+  - name: shared-data
+  - name: docker-credentials
+  tasks:
+  - name: fetch-source
+    taskRef:
+      resolver: cluster
+      params:
+      - name: name
+        value: git-clone
+      - name: namespace
+        value: tekton-pipelines
+      - name: kind
+        value: task      
+    workspaces:
+    - name: output
+      workspace: shared-data
+    params:
+    - name: url
+      value: $(params.repo-url)
+  - name: build-push
+    runAfter: ["fetch-source"]
+    taskRef:
+      resolver: cluster
+      params:
+      - name: name
+        value: kaniko
+      - name: namespace
+        value: tekton-pipelines
+      - name: kind
+        value: task
+    workspaces:
+    - name: source
+      workspace: shared-data
+    - name: dockerconfig
+      workspace: docker-credentials
+    params:
+    - name: IMAGE
+      value: $(params.image-reference)
+    - name: DOCKERFILE
+      value: $(params.dockerfile)
+  - name: deploy
+    runAfter: [build-push]
+    taskRef:
+      resolver: cluster
+      params:
+      - name: name
+        value: kubectl-apply
+      - name: namespace
+        value: tekton-pipelines
+      - name: kind
+        value: task      
+    params:
+    - name: namespace
+      value: $(params.namespace)
+    workspaces:
+    - name: source
+      workspace: shared-data
+	  
+	  
+#PipelineRun creato su namespace applicativo che refenzia pipeline remote
+#kubectl create -f pipedeprun2.yaml -n poc	  
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  generateName: clone-build-push-run-
+spec:
+  serviceAccountName: tekton-deployer
+  pipelineRef:
+    resolver: cluster
+    params:
+     - name: namespace
+       value: tekton-pipelines
+     - name: name 
+       value: deploy-infrastructure
+     - name: kind
+       value: pipeline
+  podTemplate:
+    securityContext:
+      fsGroup: 65532
+  workspaces:
+  - name: shared-data
+    volumeClaimTemplate:
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        storageClassName: longhorn
+        resources:
+          requests:
+            storage: 1Gi
+  - name: docker-credentials
+    secret:
+      secretName: harbor-push-secret
+  params:
+  - name: repo-url
+    value: https://gitea.pigreco66.it/pigreco/poc.git
+  - name: image-reference
+    value: harbor.pigreco66.it/library/nginx:1.30
+  - name: dockerfile
+    value: ./container/nginx/dockerfile   
+  - name: namespace
+    value: poc