阿里云Kubernetes服务上使用Tekton完成应用发布初体验

本文涉及的产品
容器镜像服务 ACR,镜像仓库100个 不限时长
简介: Tekton 是一个功能强大且灵活的 Kubernetes 原生开源框架,用于创建持续集成和交付(CI/CD)系统。通过抽象底层实现细节,用户可以跨多云平台和本地系统进行构建、测试和部署。

Tekton 是一个功能强大且灵活的 Kubernetes 原生开源框架,用于创建持续集成和交付(CI/CD)系统。通过抽象底层实现细节,用户可以跨多云平台和本地系统进行构建、测试和部署。

本文是基于阿里云Kubernetes服务部署Tekton Pipeline,并使用它完成源码拉取、应用打包、镜像推送和应用部署的实践过程。

image

Tekton Pipeline中有5类对象,核心理念是通过定义yaml定义构建过程.构建任务的状态存放在status字段中。

其中5类对象分别是:PipelineResouce、Task、TaskRun、Pipeline、PipelineRun。

Task是单个任务的构建过程,需要通过定义TaskRun任务去运行Task。

Pipeline包含多个Task,并在此基础上定义input和output,input和output以PipelineResource作为交付。

PipelineResource是可用于input和output的对象集合。

同样地,需要定义PipelineRun才会运行Pipeline。

1. 在阿里云Kubernetes集群中部署Tekton Pipeline

kubectl apply --filename https://storage.googleapis.com/tekton-releases/latest/release.yaml

查看Tekton Pipelines组件是否运行正常:

$ kubectl -n tekton-pipelines get po
NAME                                                     READY   STATUS      RESTARTS   AGE
tekton-pipelines-controller-6bcd7ff5d6-vzmrh             1/1     Running     0          25h
tekton-pipelines-webhook-6856cf9c47-l6nj6                1/1     Running     0          25h

2. 创建Git Resource, Registry Resource

编辑 git-pipeline-resource.yaml :

apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: git-pipeline-resource
spec:
  type: git
  params:
    - name: revision
      value: tekton
    - name: url
      value: https://code.aliyun.com/haoshuwei/jenkins-demo.git

git repo的分支名称为 tekton

编辑 registry-pipeline-resource.yaml :

apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: registry-pipeline-resource
spec:
  type: image
  params:
    - name: url
      value: registry.cn-hangzhou.aliyuncs.com/haoshuwei/tekton-demo

容器镜像仓库地址为 registry.cn-hangzhou.aliyuncs.com/haoshuwei/tekton-demo, 标签为 latest

创建pipeline resource:

$ kubectl -n tekton-pipelines create -f git-pipeline-resource.yaml
$ kubectl -n tekton-pipelines create -f registry-pipeline-resource.yaml

查看已创建的pipeline resource资源:

$ kubectl -n tekton-pipelines get PipelineResource
NAME                         AGE
git-pipeline-resource        2h
registry-pipeline-resource   2h

3. 创建Git Repo/Docker Registry Authentication

拉取私有git源码项目需要配置使用Git Repo Authentication;拉取和推送docker镜像需要配置Docker Registry Authentication。在Tekton Pipeline中,Git Repo/Docker Registry Authentication会被定义成ServiceAccount来使用。

编辑 secret tekton-basic-user-pass-git.yaml :

apiVersion: v1
kind: Secret
metadata:
  name: tekton-basic-user-pass-git
  annotations:
    tekton.dev/git-0: https://code.aliyun.com
type: kubernetes.io/basic-auth
stringData:
  username: <cleartext non-encoded>
  password: <cleartext non-encoded>

编辑 secret tekton-basic-user-pass-registry.yaml :

apiVersion: v1
kind: Secret
metadata:
  name: tekton-basic-user-pass-registry
  annotations:
    tekton.dev/docker-0: https://registry.cn-hangzhou.aliyuncs.com
type: kubernetes.io/basic-auth
stringData:
  username: <cleartext non-encoded>
  password: <cleartext non-encoded>

编辑 serviceaccount tekton-git-and-registry.yaml :

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-git-and-registry
secrets:
  - name: tekton-basic-user-pass-git
  - name: tekton-basic-user-pass-registry

创建serviceaccount:

$ kubectl -n tekton-pipelines create -f tekton-basic-user-pass-git.yaml
$ kubectl -n tekton-pipelines create -f tekton-basic-user-pass-registry.yaml
$ kubectl -n tekton-pipelines create -f tekton-git-and-registry.yaml

查看secret以及sa:

$ kubectl -n tekton-pipelines get secret
NAME                                      TYPE                                  DATA   AGE
default-token-pwncj                       kubernetes.io/service-account-token   3      25h
tekton-basic-user-pass-git                kubernetes.io/basic-auth              2      151m
tekton-basic-user-pass-registry           kubernetes.io/basic-auth              2      151m
tekton-git-and-registry-token-tr95m       kubernetes.io/service-account-token   3      151m
tekton-pipelines-controller-token-lc2fv   kubernetes.io/service-account-token   3      25h  
webhook-certs                             Opaque                                3      25h
$  kubectl -n tekton-pipelines get sa
NAME                          SECRETS   AGE
default                       1         25h
tekton-git-and-registry       3         152m
tekton-pipelines-controller   1         25h

4. 配置serviceaccount tekton-git-and-registry获取命名空间tekton-pipelines的管理权限用于部署应用

创建ClusterRoleBinding tekton-cluster-admin :

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tekton-cluster-admin
subjects:
  - kind: ServiceAccount
    name: tekton-git-and-registry
    namespace: tekton-pipelines
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

5. 创建一个Task

创建task build-app.yaml :

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: build-app
spec:
  inputs:
    resources:
      - name: java-demo
        type: git
    params:
      - name: pathToDockerFile
        description: The path to the dockerfile to build
        default: /workspace/java-demo/Dockerfile
      - name: pathToContext
        description: The build context used by Kaniko
        default: /workspace/java-dem
      - name: pathToYaml
        description: The path to teh manifest to apply
  outputs:
    resources:
      - name: builtImage
        type: image
  steps:
    - name: build-mvn-package
      image: registry.cn-beijing.aliyuncs.com/acs-sample/jenkins-slave-maven:3.3.9-jdk-8-alpine
      workingDir: /workspace/java-demo
      command:
        - mvn
      args:
        - package
        - -B
        - -DskipTests
    - name: build-docker-image
      image: registry.cn-beijing.aliyuncs.com/acs-sample/jenkins-slave-kaniko:0.6.0
      command:
        - kaniko
      args:
        - --dockerfile=${inputs.params.pathToDockerFile}
        - --destination=${outputs.resources.builtImage.url}
        - --context=${inputs.params.pathToContext}
    - name: deploy-app
      image: registry.cn-beijing.aliyuncs.com/acs-sample/jenkins-slave-kubectl:1.11.5
      command:
        - kubectl
      args:
        - apply
        - -f
        - ${inputs.params.pathToYaml}

6. 创建TaskRun运行任务

创建taskrun build-app-task-run.yaml :

apiVersion: tekton.dev/v1alpha1
kind: TaskRun
metadata:
  name: build-app-task-run
spec:
  serviceAccount: tekton-git-and-registry
  taskRef:
    name: build-app
  trigger:
    type: manual
  inputs:
    resources:
      - name: java-demo
        resourceRef:
          name: git-pipeline-resource
    params:
      - name: pathToDockerFile
        value: Dockerfile
      - name: pathToContext
        value: /workspace/java-demo
      - name: pathToYaml
        value: /workspace/java-demo/deployment.yaml
  outputs:
    resources:
      - name: builtImage
        resourceRef:
          name: registry-pipeline-resource

7. 查看构建状态以及日志

查看taskrun状态:

$ kubectl -n tekton-pipelines get taskrun
NAME                 SUCCEEDED   REASON    STARTTIME   COMPLETIONTIME
build-app-task-run   Unknown     Pending   4s

查看构建日志:

$ kubectl -n tekton-pipelines get po
NAME                                           READY   STATUS    RESTARTS   AGE
build-app-task-run-pod-b8f890                  3/5     Running   0          75s
tekton-pipelines-controller-6bcd7ff5d6-vzmrh   1/1     Running   0          25h
tekton-pipelines-webhook-6856cf9c47-l6nj6      1/1     Running   0          25h
$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890
Error from server (BadRequest): a container name must be specified for pod build-app-task-run-pod-b8f890, choose one of:   [build-step-git-source-git-pipeline-resource-77l5v build-step-build-mvn-package build-step-build-docker-image build-step-deploy-app nop] or one of the init containers: [build-step-credential-initializer-8dsnm build-step-place-tools]

mvn build的日志:

$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890 -c build-step-build-mvn-package
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building jenkins-demo-web 1.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] Downloading: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-resources-plugin/2.6/maven-resources-plugin-2.6.pom
[INFO] Downloaded: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-resources-plugin/2.6/maven-resources-plugin-2.6.pom (8 KB at 7.3 KB/sec)
[INFO] Downloading: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-plugins/23/maven-plugins-23.pom
[INFO] Downloaded: https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-plugins/23/maven-plugins-23.pom (9 KB at 26.7 KB/sec)
[INFO] Downloading: https://repo.maven.apache.org/maven2/org/apache/maven/maven-parent/22/maven-parent-22.pom
[INFO] Downloaded: https://repo.maven.apache.org/maven2/org/apache/maven/maven-parent/22/maven-parent-22.pom (30 KB at 61.3 KB/sec)
[INFO] Downloading: https://repo.maven.apache.org/maven2/org/apache/apache/11/apache-11.pom
[INFO] Downloaded: https://repo.maven.apache.org/maven2/org/apache/apache/11/apache-11.pom (15 KB at 45.3 KB/sec)
....

docker build的日志:

$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-b8f890 -c build-step-build-docker-image
INFO[0000] Downloading base image tomcat
2019/05/06 11:58:46 No matching credentials were found, falling back on anonymous
INFO[0003] Taking snapshot of full filesystem...
INFO[0003] Skipping paths under /builder/home, as it is a whitelisted directory
INFO[0003] Skipping paths under /builder/tools, as it is a whitelisted directory
INFO[0003] Skipping paths under /dev, as it is a whitelisted directory
INFO[0003] Skipping paths under /kaniko, as it is a whitelisted directory
INFO[0003] Skipping paths under /proc, as it is a whitelisted directory
INFO[0003] Skipping paths under /run/secrets/kubernetes.io/serviceaccount, as it is a whitelisted directory
INFO[0003] Skipping paths under /sys, as it is a whitelisted directory
INFO[0003] Skipping paths under /var/run, as it is a whitelisted directory
INFO[0003] Skipping paths under /workspace, as it is a whitelisted directory
INFO[0003] Using files from context: [/workspace/java-demo/target/demo.war]
INFO[0003] ADD target/demo.war /usr/local/tomcat/webapps/demo.war
INFO[0003] Taking snapshot of files...
...

app-deploy的日志:

$ kubectl -n tekton-pipelines logs -f build-app-task-run-pod-637855 -c build-step-deploy-app
deployment.extensions/jenkins-java-demo created
service/jenkins-java-demo created

taskrun的完成状态为True则构建部署过程完成:

$ kubectl -n tekton-pipelines get taskrun
NAME                 SUCCEEDED   REASON   STARTTIME   COMPLETIONTIME
build-app-task-run   True                 4m          2m

8. 小结

Tekton Pipeline中任务模板可以拿来复用,而不需要重复定义,另外通过CRD重新定义CI/CD是一大亮点,初学者可能会觉得有些绕。

持续实验持续更新中。

相关实践学习
日志服务之使用Nginx模式采集日志
本文介绍如何通过日志服务控制台创建Nginx模式的Logtail配置快速采集Nginx日志并进行多维度分析。
目录
相关文章
|
3天前
|
Prometheus Kubernetes 监控
OpenAI故障复盘 - 阿里云容器服务与可观测产品如何保障大规模K8s集群稳定性
聚焦近日OpenAI的大规模K8s集群故障,介绍阿里云容器服务与可观测团队在大规模K8s场景下我们的建设与沉淀。以及分享对类似故障问题的应对方案:包括在K8s和Prometheus的高可用架构设计方面、事前事后的稳定性保障体系方面。
|
18天前
|
Kubernetes 算法 调度
阿里云 ACK FinOps成本优化最佳实践
本文源自2024云栖大会梁成昊演讲,讨论了成本优化策略的选择与实施。文章首先介绍了成本优化的基本思路,包括优化购买方式、调整资源配置等基础策略,以及使用弹性、资源混部等高级策略。接着,文章详细探讨了集群优化和应用优化的具体方法,如使用抢占式实例降低成本、通过资源画像识别并优化资源配置,以及利用智能应用弹性策略提高资源利用效率。
|
18天前
|
弹性计算 调度 数据中心
阿里云 ACK One 注册集群云上弹性:扩展业务新利器
随着企业数字化转型深入,传统IDC数据中心因物理容量限制,难以实现动态扩容,缺乏弹性能力。阿里云ACK One注册集群凭借其高度灵活性和丰富资源选择,成为解决此问题的最佳方案。通过与阿里云资源的整合,ACK One不仅实现了计算资源的按需扩展,提高了资源利用率,还通过按需付费模式降低了成本,使企业能够更高效地应对业务增长和高峰需求。
|
18天前
|
运维 Kubernetes Serverless
阿里云Argo X K8s玩转工作流引擎,实现大规模并行计算
本文基于2024云栖大会田双坤的演讲,介绍了Kubernetes作为云原生操作系统的角色及其在各类任务中的应用,重点探讨了Argo Workflows在Kubernetes上编排并行任务的能力。面对自建Argo Workflows的挑战,如稳定性、成本和安全性等问题,阿里巴巴云推出了全托管的Serverless Argo工作流,提供全托管、免运维、可观测和易集成的特点,显著提升了任务编排的效率和稳定性。适用于数据处理、科学计算、自动驾驶仿真等多个领域。
|
18天前
|
Kubernetes 容灾 调度
阿里云 ACK 高可用稳定性最佳实践
本文整理自2024云栖大会刘佳旭的演讲,主题为《ACK高可用稳定性最佳实践》。文章探讨了云原生高可用架构的重要性,通过Kubernetes的高可用案例分析,介绍了ACK在单集群高可用架构设计、产品能力和最佳实践方面的方法,包括控制面和数据面的高可用策略、工作负载高可用配置、企业版容器镜像服务高可用配置等内容,旨在帮助企业构建更加可靠和高效的应用运行环境。
|
18天前
|
存储 Kubernetes 关系型数据库
阿里云ACK备份中心,K8s集群业务应用数据的一站式灾备方案
本文源自2024云栖大会苏雅诗的演讲,探讨了K8s集群业务为何需要灾备及其重要性。文中强调了集群与业务高可用配置对稳定性的重要性,并指出人为误操作等风险,建议实施周期性和特定情况下的灾备措施。针对容器化业务,提出了灾备的新特性与需求,包括工作负载为核心、云资源信息的备份,以及有状态应用的数据保护。介绍了ACK推出的备份中心解决方案,支持命名空间、标签、资源类型等维度的备份,并具备存储卷数据保护功能,能够满足GitOps流程企业的特定需求。此外,还详细描述了备份中心的使用流程、控制台展示、灾备难点及解决方案等内容,展示了备份中心如何有效应对K8s集群资源和存储卷数据的灾备挑战。
|
6天前
|
Kubernetes 网络协议 应用服务中间件
Kubernetes Ingress:灵活的集群外部网络访问的利器
《Kubernetes Ingress:集群外部访问的利器-打造灵活的集群网络》介绍了如何通过Ingress实现Kubernetes集群的外部访问。前提条件是已拥有Kubernetes集群并安装了kubectl工具。文章详细讲解了Ingress的基本组成(Ingress Controller和资源对象),选择合适的版本,以及具体的安装步骤,如下载配置文件、部署Nginx Ingress Controller等。此外,还提供了常见问题的解决方案,例如镜像下载失败的应对措施。最后,通过部署示例应用展示了Ingress的实际使用方法。
21 2
|
1月前
|
Kubernetes 监控 Cloud Native
Kubernetes集群的高可用性与伸缩性实践
Kubernetes集群的高可用性与伸缩性实践
75 1
|
2月前
|
JSON Kubernetes 容灾
ACK One应用分发上线:高效管理多集群应用
ACK One应用分发上线,主要介绍了新能力的使用场景
|
2月前
|
Kubernetes 持续交付 开发工具
ACK One GitOps:ApplicationSet UI简化多集群GitOps应用管理
ACK One GitOps新发布了多集群应用控制台,支持管理Argo CD ApplicationSet,提升大规模应用和集群的多集群GitOps应用分发管理体验。

相关产品

  • 容器服务Kubernetes版