riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

feat: install Tekton Pipelines via ArgoCD (vendored release) #47

Closed
poimen wants to merge 0 commits from feat/tekton-pipelines-ci into main
pull from: feat/tekton-pipelines-ci
merge into: :main
Conversation 0 Commits - Files Changed -
poimen commented 2026-09-13 06:05:56 +00:00
Member
Copy Link
Copy Source

Install Tekton Pipelines v0.68.0 via ArgoCD using vendored release manifest.

Root Cause of Previous Failure

The config/ directory in tektoncd/pipeline uses ko:// image references — these are build-time placeholders resolved by the ko tool during Tekton's own CI. ArgoCD synced these raw dev manifests, resulting in InvalidImageName on every pod.

Tekton has no official Helm chart. The only supported install method is applying the pre-built release.yaml from GitHub Releases.

Solution

Vendor the pre-built release.yaml into our repo and point ArgoCD at it:

k8s/infra/tekton/release.yaml   ← vendored from Tekton v0.68.0
k8s/argocd/apps/06-ci-cd.yaml   ← ArgoCD Application pointing at our repo

Images are real (pinned with SHA256 digests):

  • ghcr.io/tektoncd/pipeline/controller:v0.68.0@sha256:...
  • ghcr.io/tektoncd/pipeline/webhook:v0.68.0@sha256:...
  • ghcr.io/tektoncd/pipeline/events:v0.68.0@sha256:...
  • ghcr.io/tektoncd/pipeline/resolvers:v0.68.0@sha256:...

What Gets Installed

  • tekton-pipelines namespace
  • CRDs: Task, Pipeline, TaskRun, PipelineRun, StepAction, CustomRun, ResolutionRequest, VerificationPolicy
  • Controller, webhook, events controller, resolvers
  • RBAC (ClusterRoles, ServiceAccounts, RoleBindings)
  • ConfigMaps (feature flags, defaults, logging, observability)

To Upgrade Tekton

  1. Download new release from https://github.com/tektoncd/pipeline/releases
  2. Replace k8s/infra/tekton/release.yaml
  3. Commit and push — ArgoCD syncs automatically

Files

  • k8s/infra/tekton/release.yaml — Tekton Pipelines v0.68.0 (vendored)
  • k8s/argocd/apps/06-ci-cd.yaml — ArgoCD Application (Wave 06)
  • k8s/argocd/projects/homelab-project.yaml — removed unused external repo
  • Removed: k8s/argocd/tekton.yaml, k8s/infra/tekton/kustomization.yaml, k8s/infra/tekton/namespace.yaml
Install Tekton Pipelines v0.68.0 via ArgoCD using vendored release manifest. ## Root Cause of Previous Failure The `config/` directory in `tektoncd/pipeline` uses `ko://` image references — these are build-time placeholders resolved by the `ko` tool during Tekton's own CI. ArgoCD synced these raw dev manifests, resulting in `InvalidImageName` on every pod. Tekton has **no official Helm chart**. The only supported install method is applying the pre-built `release.yaml` from GitHub Releases. ## Solution Vendor the pre-built `release.yaml` into our repo and point ArgoCD at it: ``` k8s/infra/tekton/release.yaml ← vendored from Tekton v0.68.0 k8s/argocd/apps/06-ci-cd.yaml ← ArgoCD Application pointing at our repo ``` **Images are real** (pinned with SHA256 digests): - `ghcr.io/tektoncd/pipeline/controller:v0.68.0@sha256:...` - `ghcr.io/tektoncd/pipeline/webhook:v0.68.0@sha256:...` - `ghcr.io/tektoncd/pipeline/events:v0.68.0@sha256:...` - `ghcr.io/tektoncd/pipeline/resolvers:v0.68.0@sha256:...` ## What Gets Installed - `tekton-pipelines` namespace - CRDs: Task, Pipeline, TaskRun, PipelineRun, StepAction, CustomRun, ResolutionRequest, VerificationPolicy - Controller, webhook, events controller, resolvers - RBAC (ClusterRoles, ServiceAccounts, RoleBindings) - ConfigMaps (feature flags, defaults, logging, observability) ## To Upgrade Tekton 1. Download new release from https://github.com/tektoncd/pipeline/releases 2. Replace `k8s/infra/tekton/release.yaml` 3. Commit and push — ArgoCD syncs automatically ## Files - `k8s/infra/tekton/release.yaml` — Tekton Pipelines v0.68.0 (vendored) - `k8s/argocd/apps/06-ci-cd.yaml` — ArgoCD Application (Wave 06) - `k8s/argocd/projects/homelab-project.yaml` — removed unused external repo - Removed: `k8s/argocd/tekton.yaml`, `k8s/infra/tekton/kustomization.yaml`, `k8s/infra/tekton/namespace.yaml`
rock added 2 commits 2026-09-13 06:10:52 +00:00
fix: use tektoncd/operator for proper K8s-native Tekton installation b06ee310b5 
ROOT CAUSE:
- Previous Application pointed to storage bucket (not valid ArgoCD source)
- ArgoCD couldn't sync manifests from non-git/non-helm source
- tektoncd/operator is the official way to install Tekton

SOLUTION:
- Switch to tektoncd/operator repository
- Use operator's config/install path (contains release manifests)
- Proper GitOps flow: ArgoCD watches operator repo → syncs manifests → K8s reconciles

BENEFITS:
✓ Official Tekton approach
✓ Proper K8s Operator pattern
✓ ArgoCD-compatible (git source)
✓ Automatic updates from upstream
✓ Full GitOps workflow
fix: vendor Tekton release.yaml for proper ArgoCD management 7a5d0a83d5 
ROOT CAUSE:
- tektoncd/pipeline config/ dir uses ko:// image refs (build-time placeholders)
- ArgoCD synced the raw dev manifests → InvalidImageName on all pods
- tektoncd/operator requires its own CRDs and controller (too heavy)
- Tekton has no official Helm chart

FIX:
- Vendor the pre-built release.yaml (v0.68.0) into k8s/infra/tekton/
- Point ArgoCD Application at our own repo (forgejo)
- Release contains real container images (ghcr.io/tektoncd/pipeline/*)
- Remove external tektoncd repo from AppProject (not needed)

TO UPGRADE TEKTON:
  1. Download new release from github.com/tektoncd/pipeline/releases
  2. Replace k8s/infra/tekton/release.yaml
  3. Commit — ArgoCD syncs automatically
rock force-pushed feat/tekton-pipelines-ci from 95738b71bf to 7a5d0a83d5 2026-09-13 06:10:52 +00:00 Compare
rock closed this pull request 2026-09-13 14:04:23 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#47