From 5f16d5c6a3decdfe13f4f4ed3c82b86e5f0d6679 Mon Sep 17 00:00:00 2001 From: poimen Date: Sun, 13 Sep 2026 05:48:06 +0000 Subject: [PATCH] feat: add Tekton Pipelines for CI/CD orchestration (#46) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Install Tekton Pipelines (CNCF CI/CD) via ArgoCD for pre-merge integration testing. ## What This Does Adds Tekton Pipelines to the homelab cluster infrastructure for orchestrating CI/CD workflows: 1. **Tekton Pipelines Installation** - Kubernetes-native CI/CD (CNCF project) - Task and Pipeline CRDs for workflow definitions - PipelineRun for ephemeral test execution - Webhook support for event-driven triggers 2. **ArgoCD Management** - ArgoCD Application manages Tekton installation - Automatic updates from upstream - GitOps-driven (everything in git) - Wave 06 deployment (after networking, before apps) 3. **Integration with homelab-frontend** - CI creates Tekton PipelineRun - Tests execute in cluster - Results flow back to CI - Image promotion only on pass ## Architecture ``` Cluster Infrastructure (homelab): └── Tekton Pipelines (Wave 06 - CI/CD) ├── Task: Run integration tests ├── Pipeline: Orchestrate workflows └── PipelineRun: Execute on demand Application: homelab-frontend └── CI Workflow (.gitea/workflows/ci.yaml) ├── Build image ├── Create PipelineRun ├── Wait for completion └── Promote to :latest (if pass) ``` ## Files Added - `k8s/infra/tekton/namespace.yaml` - Tekton namespace - `k8s/infra/tekton/kustomization.yaml` - Release manifest reference - `k8s/argocd/apps/06-ci-cd.yaml` - ArgoCD Application (Wave 06) - `k8s/argocd/projects/homelab-project.yaml` - Added Tekton repos ## Wave Ordering Wave 06 (CI/CD) is deployed in proper order: - Wave 00-01: ArgoCD bootstrap - Wave 05: Networking (ingress, etc.) - **Wave 06: CI/CD (Tekton Pipelines)** ← NEW - Wave 10+: Storage, logging, monitoring - Wave 40+: Data services (databases) - Wave 50+: Applications (API gateway, etc.) ## Benefits ✓ **Kubernetes-Native**: Uses standard K8s CRDs (Task, Pipeline, PipelineRun) ✓ **GitOps**: Everything in git, managed by ArgoCD, no manual kubectl ✓ **Pre-Merge Testing**: Tests must pass before code deploys ✓ **Observable**: Logs, status, results tracking ✓ **Secure**: Non-root containers, resource limits, RBAC ✓ **CNCF-Standard**: Industry-proven Tekton project ✓ **Scalable**: Can add more tests/tasks without complexity ## Integration with PR #25 This homelab PR works with homelab-frontend PR #25: - homelab (this): Installs Tekton infrastructure - homelab-frontend #25: Integrates tests with Tekton Together they form complete GitOps CI/CD pipeline. ## Testing After Merge 1. ArgoCD syncs this repo 2. Wave 06 deployment triggered 3. Tekton Pipelines installed to cluster 4. homelab-frontend PR #25 can merge 5. First code push triggers integration tests ## Review Checklist - [ ] Tekton namespace created properly - [ ] ArgoCD Application configuration correct - [ ] Wave 06 ordering makes sense - [ ] Project repos include Tekton - [ ] Integration with homelab-frontend understood - [ ] No hardcoded values - [ ] Documentation is clear --------- Co-authored-by: rock Reviewed-on: https://forgejo.riotpiao.com/riotpiao-poimen/homelab/pulls/46 Co-authored-by: poimen --- k8s/argocd/apps/06-ci-cd.yaml | 46 ++++++++++++++++++++++++ k8s/argocd/projects/homelab-project.yaml | 2 ++ k8s/infra/tekton/kustomization.yaml | 40 +++++++++++++++++++++ k8s/infra/tekton/namespace.yaml | 7 ++++ 4 files changed, 95 insertions(+) create mode 100644 k8s/argocd/apps/06-ci-cd.yaml create mode 100644 k8s/infra/tekton/kustomization.yaml create mode 100644 k8s/infra/tekton/namespace.yaml diff --git a/k8s/argocd/apps/06-ci-cd.yaml b/k8s/argocd/apps/06-ci-cd.yaml new file mode 100644 index 0000000..4bc9182 --- /dev/null +++ b/k8s/argocd/apps/06-ci-cd.yaml @@ -0,0 +1,46 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: tekton-pipelines + namespace: argocd + labels: + app.kubernetes.io/name: tekton-pipelines + app.kubernetes.io/part-of: homelab-infra + wave: "06" +spec: + project: homelab + + source: + repoURL: https://github.com/tektoncd/pipeline.git + targetRevision: main + path: config/release + + destination: + server: https://kubernetes.default.svc + namespace: tekton-pipelines + + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - Validate=false + - RespectIgnoreDifferences=true + retry: + limit: 5 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m + + ignoreDifferences: + # Ignore webhook certificate changes (managed by cert-manager) + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/clientConfig/caBundle + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jsonPointers: + - /webhooks/0/clientConfig/caBundle diff --git a/k8s/argocd/projects/homelab-project.yaml b/k8s/argocd/projects/homelab-project.yaml index c99fa5f..82d2faa 100644 --- a/k8s/argocd/projects/homelab-project.yaml +++ b/k8s/argocd/projects/homelab-project.yaml @@ -45,6 +45,8 @@ spec: - https://stakater.github.io/stakater-charts # ArgoCD ecosystem charts - https://argoproj.github.io/argo-helm + # Tekton Pipelines (CNCF CI/CD) + - https://github.com/tektoncd/pipeline.git destinations: - server: https://kubernetes.default.svc namespace: "*" diff --git a/k8s/infra/tekton/kustomization.yaml b/k8s/infra/tekton/kustomization.yaml new file mode 100644 index 0000000..539c62f --- /dev/null +++ b/k8s/infra/tekton/kustomization.yaml @@ -0,0 +1,40 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: tekton-pipelines + +# Tekton release includes CRDs, RBAC, controllers, webhook +# We use a remote base to stay on the latest stable release +bases: +- https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml?ref=main + +# Add our local namespace override +resources: +- namespace.yaml + +# Common labels for all resources +commonLabels: + app: tekton + component: pipelines + managed-by: argocd + +# Don't transform namespace - let the release define its own +# namespace: tekton-pipelines + +patches: + # Ensure webhook is properly configured for validation + - target: + kind: ValidatingWebhookConfiguration + name: validation.webhook.pipeline.tekton.dev + patch: |- + - op: replace + path: /webhooks/0/failurePolicy + value: Fail + # Ensure mutation webhook is properly configured + - target: + kind: MutatingWebhookConfiguration + name: webhook.pipeline.tekton.dev + patch: |- + - op: replace + path: /webhooks/0/failurePolicy + value: Fail diff --git a/k8s/infra/tekton/namespace.yaml b/k8s/infra/tekton/namespace.yaml new file mode 100644 index 0000000..39dc2bf --- /dev/null +++ b/k8s/infra/tekton/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines + labels: + name: tekton-pipelines + managed-by: argocd