diff --git a/01-rbac.yaml b/01-rbac.yaml new file mode 100644 index 0000000..14a7de3 --- /dev/null +++ b/01-rbac.yaml @@ -0,0 +1,64 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-triggers-example-sa +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tekton-triggers-example-minimal +rules: +# EventListeners need to be able to fetch all namespaced resources +- apiGroups: ["triggers.tekton.dev"] + resources: ["eventlisteners", "triggerbindings", "triggertemplates", "triggers"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] +# configmaps is needed for updating logging config + resources: ["configmaps"] + verbs: ["get", "list", "watch"] +# Permissions to create resources in associated TriggerTemplates +- apiGroups: ["tekton.dev"] + resources: ["pipelineruns", "pipelineresources", "taskruns"] + verbs: ["create"] +- apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["impersonate"] +- apiGroups: ["policy"] + resources: ["podsecuritypolicies"] + resourceNames: ["tekton-triggers"] + verbs: ["use"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-triggers-example-binding +subjects: +- kind: ServiceAccount + name: tekton-triggers-example-sa +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-triggers-example-minimal +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-triggers-example-clusterrole +rules: + # EventListeners need to be able to fetch any clustertriggerbindings +- apiGroups: ["triggers.tekton.dev"] + resources: ["clustertriggerbindings", "clusterinterceptors"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-triggers-example-clusterbinding +subjects: +- kind: ServiceAccount + name: tekton-triggers-example-sa + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-triggers-example-clusterrole diff --git a/02-pipeline.yaml b/02-pipeline.yaml new file mode 100644 index 0000000..b424687 --- /dev/null +++ b/02-pipeline.yaml @@ -0,0 +1,32 @@ +apiVersion: tekton.dev/v1beta1 +kind: Pipeline +metadata: + name: github-pr-pipeline +spec: + resources: + - name: source + type: git + tasks: + - name: test + taskRef: + name: test + resources: + inputs: + - name: source + resource: source +--- +apiVersion: tekton.dev/v1beta1 +kind: Task +metadata: + name: test +spec: + resources: + inputs: + - name: source + type: git + steps: + - name: run-test + image: golang:1.16.3-alpine3.13 + workingDir: /workspace/source + command: ["go"] + args: ["test"] diff --git a/03-eventlistener.yaml b/03-eventlistener.yaml new file mode 100644 index 0000000..2a57922 --- /dev/null +++ b/03-eventlistener.yaml @@ -0,0 +1,27 @@ +apiVersion: triggers.tekton.dev/v1alpha1 +kind: EventListener +metadata: + name: github-pr +spec: + serviceAccountName: tekton-triggers-example-sa + triggers: + - name: github-listener + interceptors: + - ref: + name: "github" + params: + - name: "secretRef" + value: + secretName: github-interceptor-secret + secretKey: secretToken + - name: "eventTypes" + value: ["pull_request"] + - ref: + name: "cel" + params: + - name: "filter" + value: "body.action in ['opened', 'synchronize', 'reopened']" + bindings: + - ref: github-pr-binding + template: + ref: github-pr-pipeline-template diff --git a/04-secret.yaml b/04-secret.yaml new file mode 100644 index 0000000..0ade794 --- /dev/null +++ b/04-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: github-interceptor-secret +type: Opaque +stringData: + secretToken: "1234567" diff --git a/05-triggerbinding.yaml b/05-triggerbinding.yaml new file mode 100644 index 0000000..d7ace49 --- /dev/null +++ b/05-triggerbinding.yaml @@ -0,0 +1,10 @@ +apiVersion: triggers.tekton.dev/v1alpha1 +kind: TriggerBinding +metadata: + name: github-pr-binding +spec: + params: + - name: gitrepositoryurl + value: $(body.repository.clone_url) + - name: gitrevision + value: $(body.pull_request.head.sha) diff --git a/06-triggertemplate.yaml b/06-triggertemplate.yaml new file mode 100644 index 0000000..57517db --- /dev/null +++ b/06-triggertemplate.yaml @@ -0,0 +1,28 @@ +apiVersion: triggers.tekton.dev/v1alpha1 +kind: TriggerTemplate +metadata: + name: github-pr-pipeline-template +spec: + params: + - name: gitrevision + description: The git revision (SHA) + default: master + - name: gitrepositoryurl + description: The git repository url ("https://github.com/foo/bar.git") + resourcetemplates: + - apiVersion: tekton.dev/v1beta1 + kind: PipelineRun + metadata: + generateName: github-pr-pipeline-run- + spec: + pipelineRef: + name: github-pr-pipeline + resources: + - name: source + resourceSpec: + type: git + params: + - name: revision + value: $(tt.params.gitrevision) + - name: url + value: $(tt.params.gitrepositoryurl) diff --git a/07-ingress.yaml b/07-ingress.yaml new file mode 100644 index 0000000..b533954 --- /dev/null +++ b/07-ingress.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ingress-resource + annotations: + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/ssl-redirect: "false" +spec: + rules: + - http: + paths: + - path: /hooks + pathType: Exact + backend: + service: + name: el-github-pr + port: + number: 8080