这里写自定义目录标题

介绍

谷歌开源了一个 Kubernetes 原生 CI/CD 构建框架——Tekton
在这里插入图片描述
Tekton 是一个功能强大且灵活的 Kubernetes 原生框架，用于创建 CI/CD 系统。通过抽象出底层实现细节，允许开发者跨多云环境或本地系统进行构建、测试与部署。

特性包括：

工件管理：存储、管理和保护工件，同时 Tetkon 管道可以很好地与其它第三方工具相配合。
部署管道：部署管道旨在支持复杂的工作流程，包括跨多个环境的部署以及金丝雀部署和蓝/绿部署。
结果：作为内置结果存储 API 的一部分，通过日志可以深入了解测试与构建结果。

参考：https://cloud.google.com/tekton/

部署

修改依赖镜像

部署基于kubernetes集群。部署文件参考：https://github.com/tektoncd/pipeline/releases/download/v0.2.0/release.yaml

国内下载gcr镜像需要使用代理，为了方便我将tekton工具链中所有依赖镜像全部推送至了阿里云，修改后的release.yaml内容如下：

apiVersion: v1
kind: Namespace
metadata:
  name: tekton-pipelines

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-pipelines-admin
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - secrets
  - events
  - serviceaccounts
  - configmaps
  - persistentvolumeclaims
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - extensions
  resources:
  - deployments
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - extensions
  resources:
  - deployments/finalizers
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - tasks
  - clustertasks
  - taskruns
  - pipelines
  - pipelineruns
  - pipelineresources
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - taskruns/finalizers
  - pipelineruns/finalizers
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch
- apiGroups:
  - tekton.dev
  resources:
  - tasks/status
  - clustertasks/status
  - taskruns/status
  - pipelines/status
  - pipelineruns/status
  - pipelineresources/status
  verbs:
  - get
  - list
  - create
  - update
  - delete
  - patch
  - watch

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-pipelines-controller
  namespace: tekton-pipelines

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: tekton-pipelines-controller-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-pipelines-admin
subjects:
- kind: ServiceAccount
  name: tekton-pipelines-controller
  namespace: tekton-pipelines

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: clustertasks.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: ClusterTask
    plural: clustertasks
  scope: Cluster
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: images.caching.internal.knative.dev
spec:
  group: caching.internal.knative.dev
  names:
    categories:
    - all
    - knative-internal
    - caching
    kind: Image
    plural: images
    shortNames:
    - img
    singular: image
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: pipelines.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: Pipeline
    plural: pipelines
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: pipelineruns.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: PipelineRun
    plural: pipelineruns
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: pipelineresources.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: PipelineResource
    plural: pipelineresources
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: tasks.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: Task
    plural: tasks
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: taskruns.tekton.dev
spec:
  group: tekton.dev
  names:
    categories:
    - all
    - knative
    - tekton-pipelines
    kind: TaskRun
    plural: taskruns
  scope: Namespaced
  subresources:
    status: {}
  version: v1alpha1

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tekton-pipelines-controller
  name: tekton-pipelines-controller
  namespace: tekton-pipelines
spec:
  ports:
  - name: metrics
    port: 9090
    protocol: TCP
    targetPort: 9090
  selector:
    app: tekton-pipelines-controller

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tekton-pipelines-webhook
  name: tekton-pipelines-webhook
  namespace: tekton-pipelines
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    app: tekton-pipelines-webhook

---
apiVersion: v1
data: null
kind: ConfigMap
metadata:
  name: config-artifact-bucket
  namespace: tekton-pipelines

---
apiVersion: v1
data:
  loglevel.controller: info
  loglevel.webhook: info
  zap-logger-config: |
    {
      "level": "info",
      "development": false,
      "sampling": {
        "initial": 100,
        "thereafter": 100
      },
      "outputPaths": ["stdout"],
      "errorOutputPaths": ["stderr"],
      "encoding": "json",
      "encoderConfig": {
        "timeKey": "",
        "levelKey": "level",
        "nameKey": "logger",
        "callerKey": "caller",
        "messageKey": "msg",
        "stacktraceKey": "stacktrace",
        "lineEnding": "",
        "levelEncoder": "",
        "timeEncoder": "",
        "durationEncoder": "",
        "callerEncoder": ""
      }
    }
kind: ConfigMap
metadata:
  name: config-logging
  namespace: tekton-pipelines

---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: tekton-pipelines-controller
  namespace: tekton-pipelines
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: tekton-pipelines-controller
    spec:
      containers:
      - args:
        - -logtostderr
        - -stderrthreshold
        - INFO
        - -kubeconfig-writer-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-kubeconfigwriter:v0.2.0
        - -creds-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-creds-init:v0.2.0
        - -git-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-git-init:v0.2.0
        - -nop-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-nop:v0.2.0
        - -bash-noop-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-bash:v0.2.0
        - -gsutil-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-gsutil:v0.2.0
        - -entrypoint-image
        - registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-entrypoint:v0.2.0
        image: registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-controller:v0.2.0
        name: tekton-pipelines-controller
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: tekton-pipelines-controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging

---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: tekton-pipelines-webhook
  namespace: tekton-pipelines
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: tekton-pipelines-webhook
    spec:
      containers:
      - image: registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-webhook:v0.2.0
        name: webhook
        volumeMounts:
        - mountPath: /etc/config-logging
          name: config-logging
      serviceAccountName: tekton-pipelines-controller
      volumes:
      - configMap:
          name: config-logging
        name: config-logging

---

安装

参考: https://github.com/tektoncd/pipeline/blob/master/docs/install.md

  1. 使用kubectl apple 命令安装Tekton Pipelines与其依赖：
kubectl apply --filename ./release.yaml
  1. 使用kubectl get 命令来监视Tekton Pipelines组件启动情况，直到所有的组件状态为Running
$ kubectl get pods --namespace tekton-pipelines --watch
NAME                                           READY     STATUS    RESTARTS   AGE
tekton-pipelines-controller-5d4ff79776-bznx8   1/1       Running   0          41s
tekton-pipelines-webhook-6b5b4f96f4-c2zz4      1/1       Running   0          41s

至此tekton pipeline已经安装完成

示例

参考: https://github.com/tektoncd/pipeline/blob/master/docs/tutorial.md

此处示例演示github官方例子Task Inputs and Outputs

任务的输入定义

apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: skaffold-git
spec:
  type: git
  params:
    - name: revision
      value: master
    - name: url
      value: https://github.com/GoogleContainerTools/skaffold

PipelineResource类型为git

任务输出定义

apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: skaffold-image-leeroy-web
spec:
  type: image
  params:
    - name: url
      value: registry.cn-hangzhou.aliyuncs.com/shenshouer/leeroy-web

PipelineResource类型为image

镜像仓库认证

当任务执行完成后，将生成镜像并推送至镜像仓库registry.cn-hangzhou.aliyuncs.com/shenshouer，而镜像仓库需要认证，认证配置参考:https://github.com/tektoncd/pipeline/blob/master/docs/auth.md

创建secret
apiVersion: v1
kind: Secret
metadata:
  name: basic-user-pass
  annotations:
    tekton.dev/docker-0: https://registry.cn-hangzhou.aliyuncs.com # Described below
type: kubernetes.io/basic-auth
stringData:
  username: [阿里云镜像仓库账号]
  password: [阿里云镜像仓库密码]

注意

  • secret类型为kubernetes.io/basic-auth
  • annotations中需要指定key:tekton.dev/docker-0 value:https://registry.cn-hangzhou.aliyuncs.com；当然可以配置多个对应的registry仓库，使用同一套账号密码
  • 替换账号密码
创建serviceaccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-bot
secrets:
  - name: basic-user-pass

serviceaccount关联创建的secret

定义Task

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: build-docker-image-from-git-source
spec:
  inputs:
    resources:
      - name: docker-source
        type: git
    params:
      - name: pathToDockerFile
        description: The path to the dockerfile to build
        default: /workspace/docker-source/Dockerfile
      - name: pathToContext
        description:
          The build context used by Kaniko
          (https://github.com/GoogleContainerTools/kaniko#kaniko-build-contexts)
        default: /workspace/docker-source
  outputs:
    resources:
      - name: builtImage
        type: image
  steps:
    - name: build-and-push
      image: registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-executor
      command:
        - /kaniko/executor
      args:
        - --dockerfile=${inputs.params.pathToDockerFile}
        - --destination=${outputs.resources.builtImage.url}
        - --context=${inputs.params.pathToContext}

此任务将直接用于构建镜像并提交至指定镜像仓库，所依赖的构建工具为kaniko；镜像我已经推送至阿里云registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-executor并且在yaml文件中已经替换
具体executor【既kaniko】使用参考kaniko试用

定义TaskRun

apiVersion: tekton.dev/v1alpha1
kind: TaskRun
metadata:
  name: build-docker-image-from-git-source-task-run
spec:
  serviceAccount: build-bot
  taskRef:
    name: build-docker-image-from-git-source
  trigger:
    type: manual
  inputs:
    resources:
      - name: docker-source
        resourceRef:
          name: skaffold-git
    params:
      - name: pathToDockerFile
        value: Dockerfile
      - name: pathToContext
        value: /workspace/docker-source/examples/microservices/leeroy-web #configure: may change according to your source
  outputs:
    resources:
      - name: builtImage
        resourceRef:
          name: skaffold-image-leeroy-web

在TaskRun中需要关联以上创建的serviceaccount: serviceAccount: build-bot

完整的yaml

整合以上示例各部分，完整yaml如下pipeline_resource.yaml:

# https://github.com/tektoncd/pipeline/blob/master/docs/auth.md
apiVersion: v1
kind: Secret
metadata:
  name: basic-user-pass
  annotations:
    tekton.dev/docker-0: https://registry.cn-hangzhou.aliyuncs.com # Described below
type: kubernetes.io/basic-auth
stringData:
  username: [阿里云镜像仓库账号]
  password: [阿里云镜像仓库密码]

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-bot
secrets:
  - name: basic-user-pass

---
apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: skaffold-git
spec:
  type: git
  params:
    - name: revision
      value: master
    - name: url
      value: https://github.com/GoogleContainerTools/skaffold #configure: change if you want to build something else, perhaps from your own local GitLab

---
apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: skaffold-image-leeroy-web
spec:
  type: image
  params:
    - name: url
      value: registry.cn-hangzhou.aliyuncs.com/shenshouer/leeroy-web #configure: replace with where the image should go: perhaps your local registry or Dockerhub with a secret and configured service account

---
apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: build-docker-image-from-git-source
spec:
  inputs:
    resources:
      - name: docker-source
        type: git
    params:
      - name: pathToDockerFile
        description: The path to the dockerfile to build
        default: /workspace/docker-source/Dockerfile
      - name: pathToContext
        description:
          The build context used by Kaniko
          (https://github.com/GoogleContainerTools/kaniko#kaniko-build-contexts)
        default: /workspace/docker-source
  outputs:
    resources:
      - name: builtImage
        type: image
  steps:
    - name: build-and-push
      image: registry.cn-hangzhou.aliyuncs.com/shenshouer/tektoncd-executor
      command:
        - /kaniko/executor
      args:
        - --dockerfile=${inputs.params.pathToDockerFile}
        - --destination=${outputs.resources.builtImage.url}
        - --context=${inputs.params.pathToContext}

---
apiVersion: tekton.dev/v1alpha1
kind: TaskRun
metadata:
  name: build-docker-image-from-git-source-task-run
spec:
  serviceAccount: build-bot
  taskRef:
    name: build-docker-image-from-git-source
  trigger:
    type: manual
  inputs:
    resources:
      - name: docker-source
        resourceRef:
          name: skaffold-git
    params:
      - name: pathToDockerFile
        value: Dockerfile
      - name: pathToContext
        value: /workspace/docker-source/examples/microservices/leeroy-web #configure: may change according to your source
  outputs:
    resources:
      - name: builtImage
        resourceRef:
          name: skaffold-image-leeroy-web

执行示例

使用kubectl create

$ # 创建一个用于运行示例的namespace

$ kubectl create ns tekton-test  
$ kubectl -n tekton-test create -f pipeline_resource.yaml
secret/basic-user-pass created
serviceaccount/build-bot created
pipelineresource.tekton.dev/skaffold-git created
pipelineresource.tekton.dev/skaffold-image-leeroy-web created
task.tekton.dev/build-docker-image-from-git-source created
taskrun.tekton.dev/build-docker-image-from-git-source-task-run created

查看状态:

查看tekton-pipelines

$ kubectl -n tekton-test get tekton-pipelines
NAME                                 AGE
build-docker-image-from-git-source   13s

NAME                                          AGE
build-docker-image-from-git-source-task-run   13s

NAME                        AGE
skaffold-git                13s
skaffold-image-leeroy-web   13s

查看POD状态

$ kubectl -n tekton-test get po -o wide --watch
NAME                                                     READY     STATUS            RESTARTS   AGE       IP             NODE
build-docker-image-from-git-source-task-run-pod-75b73f   0/3       PodInitializing   0          4s        10.220.0.164   prod-l27-4-91
build-docker-image-from-git-source-task-run-pod-75b73f   2/3       Running   0         5s        10.220.0.164   prod-l27-4-91
build-docker-image-from-git-source-task-run-pod-75b73f   1/3       Running   0         22s       10.220.0.164   prod-l27-4-91
build-docker-image-from-git-source-task-run-pod-75b73f   0/3       Completed   0         1m        10.220.0.164   prod-l27-4-91

当Pod状态为Completed表示当前任务已经完成，查看阿里云镜像是否推送成功

在这里插入图片描述

Logo
Cloudpods

开源、云原生的融合云平台

更多推荐

面向未来的 IT 基础设施管理架构——融合云（Unified IaaS）

随着数字化时代的到来，IT系统已成为人类社会正常运转不可或缺的组成部分。不远的未来，智能制造，5G和人工智能等技术将成为推动生产力发展的重要引擎，人类社会将面临前所未有的全面彻底的数字化浪潮。IT基础设施作为IT系统运行的平台和载体，是实现数字化的基石。在这场数字化浪潮中，企业必须积极拥抱云计算技术，采用符合技术发展趋势、面向未来的IT基础构架，才能在未来的竞争中赢得先机。 一、云计算历经十余年

avatar Cloudpods

使用Linux vfio将Nvidia GPU透传给QEMU虚拟机

Linux 上虚拟机 GPU 透传需要使用 vfio 的方式。主要是因为在 vfio 方式下对虚拟设备的权限和 DMA 隔离上做的更好。但是这么做也有个缺点，这个物理设备在主机和其他虚拟机都不能使用了。 qemu 直接使用物理设备本身命令行是很简单的，关键在于事先在主机上对系统、内核和物理设备的一些配置。 单纯从 qemu 的命令行来看，其实和普通虚拟机启动就差了最后那个-device的选项。这

avatar Cloudpods

Cloudpods负载均衡的功能介绍

作者:周有松 今天的内容会从以下几个方面展开： 负载均衡产品简介。主要介绍负载均衡作为一个云上产品，它的功能模型是怎样的，日常使用中会遇到的业务词汇负载均衡的功能与典型应用场景。这部分主要结合业务词汇，对负载均衡服务中常见的一些功能选项进行介绍，并举例介绍一些典型的应用场景最后，我们做一下总结，讨论一下负载均衡产品相比传统方式的优点 一、产品简介​ 1. 以NGINX为例​ 提到负载均衡，我们以

avatar Cloudpods