# creazione secret, SA, Role e Rolebinding all'interno del namespace applicativo

kubectl create secret docker-registry harbor-regcred \
  -n poc \
  --docker-server=harbor.pigreco66.it \
  --docker-username=robot$tekton \
  --docker-password=p2oZtqcUJafMAlX0eUzgHax9fv0ML8te \
  --docker-email=alessandro.barucci66@gmail.com

kubectl create secret generic harbor-push-secret  -n poc   --from-file=config.json=config.json


cat <<EOF | kubectl  apply -f  -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-deployer
  namespace: poc
imagePullSecrets:
  - name: harbor-regcred  
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tekton-deployer
  namespace: poc
rules:
- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tekton-deployer
  namespace: poc
subjects:
- kind: ServiceAccount
  name: tekton-deployer
  namespace: poc
roleRef:
  kind: Role
  name: tekton-deployer
  apiGroup: rbac.authorization.k8s.io
EOF



#Pipeline che refernzia task remoti --> apply -f su namespace centralizzato tekton-pipelines
#kubectl apply -f  pipedep.yaml -n tekton-pipelines
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: deploy-infrastructure
spec:
  description: |
    This pipeline clones a git repo, builds a Docker image with Kaniko and
    pushes it to a registry
  params:
  - name: repo-url
    type: string
  - name: image-reference
    type: string
  - name: dockerfile
    type: string
  - name: namespace
    type: string
  workspaces:
  - name: shared-data
  - name: docker-credentials
  tasks:
  - name: fetch-source
    taskRef:
      resolver: cluster
      params:
      - name: name
        value: git-clone
      - name: namespace
        value: tekton-pipelines
      - name: kind
        value: task      
    workspaces:
    - name: output
      workspace: shared-data
    params:
    - name: url
      value: $(params.repo-url)
  - name: build-push
    runAfter: ["fetch-source"]
    taskRef:
      resolver: cluster
      params:
      - name: name
        value: kaniko
      - name: namespace
        value: tekton-pipelines
      - name: kind
        value: task
    workspaces:
    - name: source
      workspace: shared-data
    - name: dockerconfig
      workspace: docker-credentials
    params:
    - name: IMAGE
      value: $(params.image-reference)
    - name: DOCKERFILE
      value: $(params.dockerfile)
  - name: deploy
    runAfter: [build-push]
    taskRef:
      resolver: cluster
      params:
      - name: name
        value: kubectl-apply
      - name: namespace
        value: tekton-pipelines
      - name: kind
        value: task      
    params:
    - name: namespace
      value: $(params.namespace)
    workspaces:
    - name: source
      workspace: shared-data
	  
	  
#PipelineRun creato su namespace applicativo che refenzia pipeline remote
#kubectl create -f pipedeprun2.yaml -n poc	  
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: clone-build-push-run-
spec:
  serviceAccountName: tekton-deployer
  pipelineRef:
    resolver: cluster
    params:
     - name: namespace
       value: tekton-pipelines
     - name: name 
       value: deploy-infrastructure
     - name: kind
       value: pipeline
  podTemplate:
    securityContext:
      fsGroup: 65532
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        storageClassName: longhorn
        resources:
          requests:
            storage: 1Gi
  - name: docker-credentials
    secret:
      secretName: harbor-push-secret
  params:
  - name: repo-url
    value: https://gitea.pigreco66.it/pigreco/poc.git
  - name: image-reference
    value: harbor.pigreco66.it/library/nginx:1.30
  - name: dockerfile
    value: ./container/nginx/dockerfile   
  - name: namespace
    value: poc