Add new task helm-render-manifests-from-repo

This task is designed to be used as part of an implementation of the GitOps Rendered Manifests Pattern.

It is intended to be unopinionated and as such will simply template a Helm chart and output a file to a workspace volume with an optionally specified name and location.

task/helm-render-manifests-from-repo/0.1/README.md

@@ -0,0 +1,65 @@
+# Helm Render Manifests From Repo
+
+This task is designed to be used as part of an implementation of the GitOps [Rendered Manifests Pattern](https://akuity.io/blog/the-rendered-manifests-pattern/). It is intended to be unopinionated and as such will simply template a Helm chart and output a file to a workspace volume with an optionally specified name and location.
+
+The task expects at least a Helm repository URL and Chart name. By default, the output will be a file named `manifest.yaml` in the current working directory. This can be configured to suit the needs of the user.
+
+The task runs with `--validate` enabled to ensure that the `template` command, like `install`, will populate builtins such as `Capabilities` from the target server. This may not always be desirable, so can be disabled through the `extra_args` parameter
+
+## Workspaces
+This task requires a workspace for the rendered manifest. The working directory is in the root of the workspace so any custom path will need to be set relative to the root of the workspace.
+
+* **target**: A [Workspace](https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md) volume containing the helm chart.
+
+
+
+## Parameters
+
+- **helm_repo**: The URL of the Helm repository to pull from
+- **chart_name**: The fully qualified name of the chart, e.g. `my-repo/my-chart`
+- **release_version**: The version of the release (*default: latest*)
+- **release_name**: The name of the release (*default: helm-release*)
+- **release_namespace**: The namespace in which the release is to be installed (*default: ""*)
+- **manifest_filename**: The name of the output YAML file (*default: `manifest.yaml`*)
+- **manifest_path**: The path for the generated YAML file (*default: `.`*)
+- **extra_args**: Any extra CLI arguments, space separated (*default: `--validate --skip-tests`*)
+- **overwrite_values**: The values to be overwritten (*default: ""*)
+- **helm_image**: The container image which contains the Helm binary (*default: `docker.io/lachlanevenson/k8s-helm:v3.10.2`*)
+
+## Platforms
+
+The Task can be run on `linux/amd64`, `linux/s390x`, `linux/arm64` and `linux/ppc64le` platforms.
+
+## Usage
+
+### PipelineRun
+
+An example `Pipeline` with a `PipelineRun` can be found in the subdirectory `tests`.
+
+### TaskRun
+
+This `TaskRun` runs the task to set up a Helm repository and generate a template. Validation is disabled in this example.
+
+```yaml
+# example rendered manifests from repo
+apiVersion: tekton.dev/v1
+kind: TaskRun
+metadata:
+  name: example-helm-render-manifests-from-repo
+spec:
+  taskRef:
+    name: helm-render-manifests-from-repo
+  params:
+  - name: helm_repo
+    value: https://prometheus-community.github.io/helm-charts
+  - name: chart_name
+    value: prometheus-community/prometheus
+  - name: release_version
+    value: 25.21.0
+  - name: release_name
+    value: helm-repo-sample
+  - name: extra_args
+    value: '--skip-tests'
+  - name: overwrite_values
+    value: alertmanager.enabled=false,kube-state-metrics.enabled=false,prometheus-node-exporter.enabled=false,prometheus-pushgateway.enabled=false
+```

task/helm-render-manifests-from-repo/0.1/helm-render-manifests-from-repo.yaml

@@ -0,0 +1,85 @@
+# This Task will do a helm upgrade based on the given helm repo and chart
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: helm-render-manifests-from-repo
+  labels:
+    app.kubernetes.io/version: "0.1"
+  annotations:
+    tekton.dev/categories: Deployment
+    tekton.dev/pipelines.minVersion: "0.50.0"
+    tekton.dev/tags: helm
+    tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64"
+spec:
+  description: >-
+    This task will render a validated helm chart into a given
+    directory to be used with a GitOps deployment
+
+  params:
+    - name: helm_repo
+      description: "Specify a specific helm repo"
+    - name: chart_name
+      description: "Specify fully qualified chart name that will be deployed, e.g. my-repo/mychart"
+    - name: release_version
+      description: The helm release version in semantic versioning format, e.g. v0.1.0
+      default: ""
+    - name: release_name
+      description: The helm release name
+      default: "helm-release"
+    - name: release_namespace
+      description: The helm release namespace
+      default: ""
+    - name: manifest_filename
+      description: The name of the generated YAML file
+      default: "manifest.yaml"
+    - name: manifest_path
+      description: The path for the generated YAML file
+      default: .
+    - name: extra_args
+      description: "Specify any extra CLI arguments, space separated, e.g.: --validate --skip-tests"
+      default: "--validate --skip-tests"
+    - name: overwrite_values
+      description: "Specify the values you want to overwrite, comma separated: autoscaling.enabled=true,replicas=1"
+      default: ""
+    - name: helm_image
+      description: "Specify a specific helm image"
+      default: "docker.io/lachlanevenson/k8s-helm@sha256:0a068ae407e21d1836c6a89a1e9e81af1e55fa56890998e33d5caabdbb51e77b"  # tag: v3.10.2
+
+  steps:
+    - name: render-manifests-from-repo
+      env:  # Avoid interpolation in script
+        - name: MANIFEST_PATH
+          value: $(params.manifest_path)
+        - name: MANIFEST_FILENAME
+          value: $(params.manifest_filename)
+        - name: CHART_NAME
+          value: $(params.chart_name)
+        - name: RELEASE_VERSION
+          value: $(params.release_version)
+        - name: RELEASE_NAME
+          value: $(params.release_name)
+        - name: RELEASE_NAMESPACE
+          value: $(params.release_namespace)
+        - name: EXTRA_ARGS
+          value: $(params.extra_args)
+        - name: OVERWRITE_VALUES
+          value: $(params.overwrite_values)
+        - name: HELM_REPO
+          value: $(params.helm_repo)
+      image: $(params.helm_image)
+      script: |
+        OUTFILE=$MANIFEST_PATH/$MANIFEST_FILENAME
+        REPO=`echo "$CHART_NAME" | cut -d "/" -f 1`
+        echo setting opts...
+        if [ -n "$RELEASE_VERSION" ]; then export OPTS="$OPTS --version=$RELEASE_VERSION"; fi
+        if [ -n "$RELEASE_NAMESPACE" ]; then export OPTS="$OPTS --namespace=$RELEASE_NAMESPACE"; fi
+        if [ -n "$EXTRA_ARGS" ]; then export OPTS="$OPTS $EXTRA_ARGS"; fi
+        if [ -n "$OVERWRITE_VALUES" ]; then export OPTS="$OPTS --set=$OVERWRITE_VALUES"; fi
+        echo adding helm repo...
+        helm repo add $REPO "$HELM_REPO"
+        helm repo update
+        echo templating helm chart...
+        helm template $RELEASE_NAME $CHART_NAME $OPTS > $OUTFILE
+      workingDir: /workspace/target
+  workspaces:
+    - name: target

task/helm-render-manifests-from-repo/0.1/samples/helm-render-manifests-from-repo-task-run.yaml.tmpl

@@ -0,0 +1,20 @@
+apiVersion: tekton.dev/v1
+kind: TaskRun
+metadata:
+  name: example-helm-render-manifests-from-repo
+spec:
+  taskRef:
+    name: helm-render-manifests-from-repo
+  params:
+  - name: helm_repo
+    value: https://prometheus-community.github.io/helm-charts
+  - name: chart_name
+    value: prometheus-community/prometheus
+  - name: release_version
+    value: 25.21.0
+  - name: release_name
+    value: helm-repo-sample
+  - name: extra_args
+    value: '--skip-tests'
+  - name: overwrite_values
+    value: alertmanager.enabled=false,kube-state-metrics.enabled=false,prometheus-node-exporter.enabled=false,prometheus-pushgateway.enabled=false

task/helm-render-manifests-from-repo/0.1/tests/pre-apply-task-hook.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# Add service account
+kubectl -n ${tns} create serviceaccount helm-pipeline-run-sa
+
+# Add edit role to service account
+kubectl -n ${tns} create rolebinding helm-pipeline-run-sa-edit --clusterrole edit --serviceaccount ${tns}:helm-pipeline-run-sa -o yaml --dry-run=client | kubectl apply -f -

task/helm-render-manifests-from-repo/0.1/tests/run.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: helm-render-manifests-test-pipeline
+spec:
+  tasks:
+    - name: helm-render-manifests-from-repo
+      taskRef:
+        name: helm-render-manifests-from-repo
+      params:
+      - name: helm_repo
+        value: https://prometheus-community.github.io/helm-charts
+      - name: chart_name
+        value: prometheus-community/prometheus
+      - name: release_version
+        value: 25.21.0
+      - name: release_name
+        value: helm-repo-sample
+      - name: extra_args
+        value: '--skip-tests'
+      - name: overwrite_values
+        value: alertmanager.enabled=false,kube-state-metrics.enabled=false,prometheus-node-exporter.enabled=false,prometheus-pushgateway.enabled=false
+      workspaces:
+        - name: target
+          workspace: target
+
+    - name: test-output
+      runAfter:
+        - helm-render-manifests-from-repo
+      taskSpec:
+        steps:
+        - image: redhat/ubi9-minimal:latest
+          script: |
+            cat << EOF >> ./test.bats
+            setup() {
+                bats_load_library bats-support
+                bats_load_library bats-file
+            }
+            @test 'assert_file_exists()' {
+              assert_file_exists ./manifest.yaml
+            }
+            @test 'assert_file_contains() {
+                assert_file_contains ./manifest.yaml "name: helm-repo-sample-prometheus-server"
+            }
+            EOF
+          workingDir: /workspace/target
+        - image: bats/bats:latest
+          args:
+          - ./test.bats
+          workingDir: /workspace/target
+      workspaces:
+        - name: target
+          workspace: target
+  workspaces:
+    - name: target
+---
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  name: helm-render-manifests-test-pipeline-run
+spec:
+  pipelineRef:
+    name: helm-render-manifests-test-pipeline
+  taskRunTemplate:
+    serviceAccountName: helm-pipeline-run-sa
+  workspaces:
+    - name: target
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 200Mi