Tekton 面试题

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: build-image
spec:
  params:
    - name: IMAGE
      type: string
  steps:
    - name: build
      image: docker
      script: |
        docker build -t $(params.IMAGE) .        
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: build-image-run
spec:
  taskRef:
    name: build-image
  params:
    - name: IMAGE
      value: registry.example.com/app:v1

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: ci-pipeline
spec:
  workspaces:
    - name: shared-workspace
  tasks:
    - name: clone
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-workspace
    - name: test
      taskRef:
        name: unit-test
      runAfter:
        - clone
      workspaces:
        - name: source
          workspace: shared-workspace
    - name: build
      taskRef:
        name: build-image
      runAfter:
        - test
      workspaces:
        - name: source
          workspace: shared-workspace

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: get-commit
spec:
  results:
    - name: commit-sha
      type: string
    - name: branch
      type: string
  steps:
    - name: get-sha
      image: alpine
      script: |
        sha=$(git rev-parse HEAD)
        echo -n "$sha" > /tekton/results/commit-sha
        echo -n "main" > /tekton/results/branch        
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: build-image
spec:
  params:
    - name: COMMIT_SHA
      type: string
  steps:
    - name: build
      image: docker
      script: |
        docker build -t app:$(params.COMMIT_SHA) .        
# Pipeline 中传递 Result
spec:
  tasks:
    - name: get-commit
      taskRef:
        name: get-commit
    - name: build-image
      taskRef:
        name: build-image
      params:
        - name: COMMIT_SHA
          value: $(tasks.get-commit.results.commit-sha)
      runAfter:
        - get-commit

workspaces:
  - name: source
    persistentvolumeclaim:
      claimName: workspace-pvc
  - name: temp
    emptyDir: {}
  - name: configs
    configmap:
      name: build-config
  - name: ssh-keys
    secret:
      secretName: git-ssh-key

spec:
  steps:
    - name: docker-build
      image: docker
      script: |
        docker build -t app:latest .        
      volumeMounts:
        - name: docker-socket
          mountPath: /var/run/docker.sock
  sidecars:
    - name: daemon
      image: docker:dind
      securityContext:
        privileged: true
      volumeMounts:
        - name: docker-socket
          mountPath: /var/run/docker.sock

tasks:
  - name: deploy-prod
    taskRef:
      name: deploy
    when:
      - input: "$(params.branch)"
        operator: "=="
        values: ["main"]
      - input: "$(params.env)"
        operator: "in"
        values: ["prod", "staging"]
    params:
      - name: target
        value: "$(params.env)"

# 基本矩阵：三个版本各执行一次
tasks:
  - name: build-all
    taskRef:
      name: build
    matrix:
      params:
        - name: VERSION
          value:
            - "1.0"
            - "1.1"
            - "2.0"
      maxConcurrency: 2

# 组合矩阵：平台 x 架构，共 4 个 TaskRun
tasks:
  - name: build-cross
    taskRef:
      name: build
    matrix:
      params:
        - name: PLATFORM
          value:
            - "linux"
            - "windows"
        - name: ARCH
          value:
            - "amd64"
            - "arm64"

# 纳入参数：为特定组合设置额外参数
tasks:
  - name: build-with-extra
    taskRef:
      name: build
    matrix:
      params:
        - name: VERSION
          value:
            - "1.0"
            - "1.1"
      include:
        - name: extra-build
          params:
            - name: VERSION
              value: "2.0-rc"
            - name: EXTRA_FLAG
              value: "--enable-experimental"

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: maven-build
spec:
  params:
    - name: MODULE
      type: string
      default: ""
  workspaces:
    - name: source
  steps:
    - name: compile
      image: maven:3.8-openjdk-11
      workingDir: $(workspaces.source.path)
      script: |
        if [ -n "$(params.MODULE)" ]; then
          mvn compile -pl $(params.MODULE) -am
        else
          mvn compile
        fi        
    - name: test
      image: maven:3.8-openjdk-11
      workingDir: $(workspaces.source.path)
      script: |
        mvn test        

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-listener
spec:
  triggers:
    - name: pr-trigger
      interceptors:
        - ref:
            name: cel
          params:
            - name: filter
              value: >-
                header.match('X-GitHub-Event', 'pull_request') &&
                body.action == 'opened'                
      bindings:
        - ref: github-pr-binding
      template:
        ref: pr-template
apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: pr-template
spec:
  params:
    - name: git-revision
    - name: git-repo-url
  resourcetemplates:
    - apiVersion: tekton.dev/v1
      kind: PipelineRun
      metadata:
        generateName: pr-run-
      spec:
        pipelineRef:
          name: ci-pipeline
        params:
          - name: REVISION
            value: $(tt.params.git-revision)
          - name: REPO_URL
            value: $(tt.params.git-repo-url)

interceptors:
  - name: validate-and-extract
    ref:
      name: cel
    params:
      - name: filter
        value: >-
          body.ref.startsWith('refs/heads/') &&
          body.commits.size() > 0          
      - name: overlays
        value:
          - key: branch
            expression: "body.ref.split('/')[2]"
          - key: commit_sha
            expression: "body.head_commit.id"

interceptors:
  - ref:
      name: github
    params:
      - name: secretRef
        value:
          secretName: github-webhook-secret
          secretKey: webhook-secret
      - name: eventTypes
        value:
          - pull_request
          - push

apiVersion: chains.tekton.dev/v1alpha1
kind: ChainsConfig
metadata:
  name: chains-config
spec:
  artifacts.taskrun.format: in-toto
  artifacts.taskrun.storage: oci
  artifacts.pipelinerun.format: in-toto
  artifacts.pipelinerun.storage: oci
  transparency.enabled: "true"

# 通过 tkn hub 安装
tkn hub install task git-clone
tkn hub install task buildah

# 通过 kubectl 从 Catalog 直接安装
kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml

apiVersion: tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: all
  targetNamespace: tekton-pipelines
  pipeline:
    running-in-environment-with-injected-sidecars: false
    require-git-ssh-secret-known-hosts: false
  trigger:
    enable-api-fields: alpha
  dashboard:
    readonly: true

# 通过 Operator 部署
kubectl apply -f https://storage.googleapis.com/tekton-releases/dashboard/latest/release.yaml

# 通过 TektonConfig 启用
spec:
  dashboard:
    readonly: true
    ingress:
      enabled: true
      host: tekton.example.com

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: ci-run
spec:
  maxConcurrency: 3
  pipelineRef:
    name: ci-pipeline

apiVersion: v1
kind: ResourceQuota
metadata:
  name: tekton-quota
spec:
  hard:
    count/tekton.dev/v1.PipelineRun: "5"
    requests.cpu: "10"
    requests.memory: 20Gi

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: timeout-demo
spec:
  timeout: 30m
  pipelineSpec:
    tasks:
      - name: long-task
        taskSpec:
          steps:
            - name: long-step
              image: alpine
              script: |
                sleep 3600                
              timeout: 5m
        retries: 2

apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: resource-demo
spec:
  taskRef:
    name: build-image
  podTemplate:
    nodeSelector:
      disk-type: ssd
      workload: ci
    tolerations:
      - key: ci-only
        operator: Exists
        effect: NoSchedule
    priorityClassName: high-priority
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
  taskSpec:
    steps:
      - name: build
        image: docker
        resources:
          requests:
            cpu: "2"
            memory: 4Gi
          limits:
            cpu: "4"
            memory: 8Gi

spec:
  pipelineRef:
    name: ci-pipeline
  podTemplate:
    serviceAccountName: tekton-builder
    affinity:
      nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
                - key: pool
                  operator: In
                  values:
                    - ci-pool

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: maven-with-cache
spec:
  workspaces:
    - name: source
    - name: maven-cache
  steps:
    - name: mvn-build
      image: maven:3.8-openjdk-11
      workingDir: $(workspaces.source.path)
      script: |
        mkdir -p $(workspaces.maven-cache.path)/.m2
        ln -sf $(workspaces.maven-cache.path)/.m2 ~/.m2
        mvn clean package -DskipTests        

spec:
  steps:
    - name: kaniko-build
      image: gcr.io/kaniko-project/executor:latest
      args:
        - --context=$(workspaces.source.path)
        - --dockerfile=$(workspaces.source.path)/Dockerfile
        - --destination=registry.example.com/app:latest
        - --cache=true
        - --cache-repo=registry.example.com/cache

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: ci-pipeline
spec:
  workspaces:
    - name: shared-workspace
  tasks:
    - name: clone
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-workspace
      params:
        - name: url
          value: https://github.com/org/repo.git
        - name: revision
          value: "$(params.branch)"
        - name: depth
          value: "1"
        - name: submodules
          value: "false"
        - name: sslVerify
          value: "true"

apiVersion: v1
kind: Secret
metadata:
  name: git-ssh-key
  annotations:
    tekton.dev/git-0: github.com
type: kubernetes.io/ssh-auth
stringData:
  ssh-privatekey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...    

# Pipeline 任务：生成部署清单并推送到 GitOps 仓库
tasks:
  - name: update-manifest
    taskRef:
      name: git-cli
    params:
      - name: GIT_USER_NAME
        value: tekton-bot
      - name: GIT_USER_EMAIL
        value: [email protected]
      - name: GIT_SCRIPT
        value: |
          cd $(workspaces.source.path)/config
          sed -i "s|image: .*|image: registry.example.com/app:$(params.TAG)|" deployment.yaml
          git add deployment.yaml
          git commit -m "Update image tag to $(params.TAG)"
          git push origin main          
    workspaces:
      - name: source
        workspace: gitops-repo

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
spec:
  source:
    repoURL: https://github.com/org/gitops-repo
    path: config
    targetRevision: main
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

# 预览 TaskRun 创建后的 Pod YAML
tkn taskrun start my-task --dry-run -o yaml > taskrun-preview.yaml

# 实时跟踪日志
tkn pipelinerun logs -f --last

# 查看指定 Task 的日志
tkn taskrun logs taskrun-name -s step-build

# 查看 Pod 状态和事件
kubectl describe pod $(tkn taskrun list -o name | head -1)

# 进入运行中的构建容器
kubectl exec -it $(kubectl get pod -l tekton.dev/taskRun=my-taskrun -o name) -c step-build -- sh

# 查看 PipelineRun 详情
tkn pipelinerun describe pipelinerun-name

# 列出所有 PipelineRun 及其状态
tkn pipelinerun list --all-namespaces

steps:
  - name: check
    onError: continue  # 即使失败也继续执行后续 Step
    script: |
      exit 1      
  - name: cleanup
    script: |
      echo "Cleanup runs regardless of previous step failure"      

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: kaniko-build
spec:
  params:
    - name: IMAGE
      type: string
    - name: CONTEXT
      type: string
      default: .
  workspaces:
    - name: source
  results:
    - name: image-digest
      type: string
  steps:
    - name: build-and-push
      image: gcr.io/kaniko-project/executor:v1.9.0
      args:
        - --context=$(workspaces.source.path)/$(params.CONTEXT)
        - --dockerfile=$(workspaces.source.path)/$(params.CONTEXT)/Dockerfile
        - --destination=$(params.IMAGE)
        - --cache=true
        - --cache-repo=$(params.IMAGE)-cache
        - --skip-tls-verify=false
        - --verbosity=info
      env:
        - name: DOCKER_CONFIG
          value: /tekton/home/.docker

apiVersion: tekton.dev/v1
kind: PipelineRun
spec:
  pipelineSpec:
    tasks:
      - name: approval
        taskRef:
          apiVersion: approval.example.com/v1
          kind: ApprovalTask
          name: manual-approve
        params:
          - name: approver
            value: team-lead
      - name: deploy
        taskRef:
          name: deploy-app
        runAfter:
          - approval

apiVersion: v1
kind: Secret
metadata:
  name: docker-registry-cred
  annotations:
    tekton.dev/docker-0: https://registry.example.com
type: kubernetes.io/basic-auth
stringData:
  username: robot-user
  password: token-xxx
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-builder
secrets:
  - name: docker-registry-cred
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: push-image
spec:
  taskRef:
    name: kaniko-build
  serviceAccountName: tekton-builder
  podTemplate:
    imagePullSecrets:
      - name: regcred

tasks:
  - name: unit-test
    taskRef:
      name: test
  - name: deploy-dev
    taskRef:
      name: deploy
    params:
      - name: env
        value: dev
    runAfter:
      - unit-test
    when:
      - input: "$(params.branch)"
        operator: "!="
        values: ["main"]
  - name: deploy-prod
    taskRef:
      name: deploy
    params:
      - name: env
        value: prod
    runAfter:
      - unit-test
    when:
      - input: "$(params.branch)"
        operator: "=="
        values: ["main"]

steps:
  - name: process-services
    image: alpine
    script: |
      services='["api", "web", "worker"]'
      for service in $(echo $services | jq -r '.[]'); do
        echo "Processing $service"
        # 循环执行构建或部署
        build-service "$service"
      done      

# v1 版本推荐格式
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: example
spec:
  params:
    - name: version
      type: string
  steps:
    - name: run
      image: alpine
      script: |
        echo $(params.version)        

tasks:
  - name: build-all-arch
    matrix:
      params:
        - name: ARCH
          value:
            - amd64
            - arm64
            - arm/v7
      maxConcurrency: 3
    taskRef:
      name: kaniko-build
    params:
      - name: IMAGE_TAG
        value: "app:$(params.ARCH)"
  - name: create-manifest
    taskRef:
      name: manifest-tool
    params:
      - name: IMAGE_NAME
        value: app
      - name: TAG
        value: latest
      - name: ARCH_LIST
        value: "amd64,arm64,arm/v7"
    runAfter:
      - build-all-arch

steps:
  - name: buildx-multi-arch
    image: docker:latest
    script: |
      docker buildx create --use
      docker buildx build \
        --platform linux/amd64,linux/arm64,linux/arm/v7 \
        --tag registry.example.com/app:latest \
        --push \
        .      
    env:
      - name: DOCKER_BUILDKIT
        value: "1"

steps:
  - name: idempotent-build
    image: docker
    script: |
      # 使用 commit SHA 作为 tag，确保幂等
      TAG=$(params.COMMIT_SHA)
      IMAGE="registry.example.com/app:${TAG}"

      # 检查镜像是否已存在，避免重复构建
      if docker manifest inspect "${IMAGE}" > /dev/null 2>&1; then
        echo "Image already exists, skipping build"
        exit 0
      fi

      docker build -t "${IMAGE}" .
      docker push "${IMAGE}"

      # 输出 digest
      echo -n "${TAG}" > /tekton/results/image-tag      

# 优雅取消 PipelineRun
tkn pipelinerun cancel my-pipelinerun

# 强制取消并删除
kubectl delete pipelinerun my-pipelinerun

# 通过 API 取消
kubectl patch pipelinerun my-pipelinerun \
  --type=merge \
  -p '{"spec":{"status":"Cancelled"}}'

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: multi-service
spec:
  workspaces:
    - name: shared
  tasks:
    - name: build-api
      taskRef:
        name: build-service
      workspaces:
        - name: source
          workspace: shared
          subPath: services/api
    - name: build-web
      taskRef:
        name: build-service
      workspaces:
        - name: source
          workspace: shared
          subPath: services/web

spec:
  workspaces:
    - name: source
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 10Gi
          storageClassName: fast-ssd

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tekton-developer
rules:
  - apiGroups: ["tekton.dev"]
    resources: ["tasks", "pipelines"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["taskruns", "pipelineruns"]
    verbs: ["create", "get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tekton-admin
rules:
  - apiGroups: ["tekton.dev"]
    resources: ["*"]
    verbs: ["*"]
  - apiGroups: ["triggers.tekton.dev"]
    resources: ["*"]
    verbs: ["*"]
  - apiGroups: [""]
    resources: ["secrets", "configmaps", "serviceaccounts"]
    verbs: ["create", "update", "delete"]

apiVersion: v1
kind: ServiceAccount
metadata:
  name: ci-runner
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-runner-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tekton-developer
subjects:
  - kind: ServiceAccount
    name: ci-runner
    namespace: default
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: example
spec:
  serviceAccountName: ci-runner
  pipelineRef:
    name: example-pipeline

apiVersion: tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  profile: basic
  targetNamespace: tekton-pipelines
  pipeline:
    metrics.pipelinerun.duration-type: histogram
    metrics.taskrun.duration-type: histogram
    metrics.count: enabled
    default-service-account: tekton-worker
    running-in-environment-with-injected-sidecars: false

# Prometheus 指标采集
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: tekton-metrics
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: tekton-pipelines-controller
  endpoints:
    - port: metrics
      interval: 15s