Install Tekton

EPAM KubeRocketCI uses Tekton resources, such as Tasks, Pipelines, Triggers, Interceptors, and Chains for running the CI/CD pipelines.

Here are the main steps to follow for installing the Tekton resources using the Tekton release files.

Prerequisites

• Kubectl version 1.34+ is installed. Please refer to the Kubernetes official website for details.
• For Openshift/OKD, the latest version of the oc utility is required. Please refer to the OKD page on GitHub for details.

Installation on Kubernetes Cluster

To install Tekton resources, follow the steps below:

info

Please refer to the Install Tekton Pipelines and Install and set up Tekton Triggers sections for details.

1. Install Tekton pipelines v1.6.2 using the release file:

   note

   Tekton Pipeline resources are used for managing and running KubeRocketCI Tekton Pipelines and Tasks. Please refer to the KubeRocketCI Tekton Pipelines and KubeRocketCI Tekton Tasks pages for details.

   kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.6.2/release.yaml

2. Install Tekton Triggers v0.36.0 using the release file:

   note

   Tekton Trigger resources are used for managing and running KubeRocketCI Tekton EventListeners, Triggers, TriggerBindings and TriggerTemplates. Please refer to the KubeRocketCI Tekton Triggers page for details.

   kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.36.0/release.yaml

3. Install Tekton Interceptors v0.36.0 using the release file:

   note

   The Platform uses GitLab, GitHub and Cel ClusterInterceptors for processing requests from webhooks.

   kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.36.0/interceptors.yaml

4. Install Tekton Chains v0.28.1 using the release file:

   kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.28.1/release.yaml

5. Install Tekton Results v0.20.0 using the KubeRocketCI manifest:

   warning

   Unlike the components above, Tekton Results must not be installed from the plain upstream release file. The Platform customizes it, and the upstream release.yaml bundles its own PostgreSQL instance that conflicts with the Platform database. Use the results.yaml manifest from the edp-cluster-add-ons repository instead.

   kubectl apply -f https://raw.githubusercontent.com/epam/edp-cluster-add-ons/main/clusters/core/addons/tekton/results.yaml

   The manifest is based on the upstream release_base.yaml (the variant without a bundled database) and adds the following Platform customizations:

   • External database. Connection settings point to the PostgreSQL cluster defined in results-pg.yaml, which must be deployed first. See Tekton Long-Term Storage for details.
   • Summary labels. The watcher runs with -summary_labels, which records the codebase, branch, pipeline type, and CD pipeline labels on archived runs. The KubeRocketCI Portal relies on these to render the pipeline run history, so omitting the flag leaves history entries without their metadata.
   • Log storage. The Results API serves pipeline logs from a persistent volume, and a CronJob prunes entries older than 30 days.

Installation on OKD cluster

To install Tekton resources, follow the steps below:

info

Please refer to the Install Tekton Operator documentation for details.

note

Tekton Operator also deploys Pipelines as Code CI that requires OpenShift v4.11 (based on Kubernetes v1.24) or higher. This feature is optional and its deployments can be scaled to zero replicas.

Install Tekton Operator v0.67.0 using the release file:

kubectl apply -f https://github.com/tektoncd/operator/releases/download/v0.67.0/openshift-release.yaml

After the installation, the Tekton Operator will install the following components: Pipeline, Trigger, and Addons.

note

If there is the following error in the openshift-operators namespace for openshift-pipelines-operator and tekton-operator-webhook deployments:

Error: container has runAsNonRoot and image will run as root

Patch the deployments with the following commands:

kubectl -n openshift-operators patch deployment openshift-pipelines-operator -p '{"spec": {"template": {"spec": {"securityContext": {"runAsUser": 1000}}}}}'
kubectl -n openshift-operators patch deployment tekton-operator-webhook -p '{"spec": {"template": {"spec": {"securityContext": {"runAsUser": 1000}}}}}'

Grant access for Tekton Service Accounts in the openshift-pipelines namespace to the Privileged SCC:

oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-operators-proxy-webhook
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-pipelines-controller
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-pipelines-resolvers
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-pipelines-webhook
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-triggers-controller
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-triggers-core-interceptors
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:tekton-triggers-webhook
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:pipelines-as-code-controller
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:pipelines-as-code-watcher
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:pipelines-as-code-webhook
oc adm policy add-scc-to-user privileged system:serviceaccount:openshift-pipelines:default

Related Articles

• Install via Add-Ons