Created
June 11, 2024 12:07
-
-
Save lcarva/f04ab77ad1e6685c61feb1d1da3eb6d8 to your computer and use it in GitHub Desktop.
Tekton Chains on a Kind cluster
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
set -euo pipefail | |
# Start from a clean slate | |
kind delete cluster | |
# Start a new kind cluster | |
# kind create cluster --image kindest/node:v1.24.13 | |
kind create cluster | |
# Install Tekton | |
kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml | |
# kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.41.3/release.yaml | |
# Enable Useful Tekton Features | |
kubectl -n tekton-pipelines patch cm feature-flags -p '{"data":{ | |
"enable-tekton-oci-bundles": "true", | |
"enable-api-fields": "alpha" | |
}}' | |
# Install Chains | |
# kubectl apply --filename https://storage.googleapis.com/tekton-releases/chains/previous/v0.14.0/release.yaml | |
kubectl apply --filename https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml | |
# Configure Chains | |
kubectl -n tekton-chains patch cm chains-config -p '{"data": { | |
"artifacts.oci.storage": "oci", | |
"artifacts.pipelinerun.format": "in-toto", | |
"artifacts.pipelinerun.storage": "oci", | |
"artifacts.taskrun.format": "in-toto", | |
"artifacts.taskrun.storage": "oci" | |
}}' | |
# Generate Signing Secret | |
COSIGN_PASSWORD=password cosign generate-key-pair k8s://tekton-chains/signing-secrets | |
## Namespace Setup | |
# Upload image registry secret and link to default service account. | |
kubectl -n default create secret docker-registry $USER \ | |
--from-file=.dockerconfigjson=$HOME/.docker/config.json | |
# Wait for default ServiceAccount | |
while true; do | |
output="$(oc -n default get ServiceAccount default --ignore-not-found)" | |
if [ -n "$output" ]; then | |
break | |
fi | |
done | |
# Link secret to service account | |
kubectl -n default patch serviceaccount default -p '{"imagePullSecrets": [{"name": "'$USER'"}]}' | |
kubectl -n default patch serviceaccount default -p '{"secrets": [{"name": "'$USER'"}]}' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment