mirror of https://github.com/tektoncd/catalog.git synced 2024-11-26 06:23:37 +00:00

History

Chmouel Boudjnah bddd282012 Centralize all the git-clone apply task to a common function Centralize all the the git-clone apply commands we had around the pre-apply-task-hook to a central common function. This will make easier to have the same git-clone task version used everywhere. Add some documentation about the helper functions along the way. Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>		2020-07-24 15:00:01 +01:00
..
tests	Centralize all the git-clone apply task to a common function	2020-07-24 15:00:01 +01:00
Dockerfile	Modifies s2i task according to the new reorg proposal	2020-07-10 22:06:57 +01:00
README.md	Remove word "volume" from "Workspace volume" in READMEs	2020-07-13 22:07:58 +01:00
s2i.yaml	Modifies s2i task according to the new reorg proposal	2020-07-10 22:06:57 +01:00

README.md

Source-to-Image

Source-to-Image (S2I) is a toolkit and workflow for building reproducible container images from source code. S2I produces images by injecting source code into a base S2I container image and letting the container prepare that source code for execution. The base S2I container images contains the language runtime and build tools needed for building and running the source code.

Install the Task

kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/master/task/s2i/0.1/s2i.yaml

Parameters

BUILDER_IMAGE: The location of the s2i builder image.
PATH_CONTEXT: Source path from where s2i command need to be run (default: .).
TLSVERIFY: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry) (default: true)

Workspaces

source: A Workspace containing the source to build.

Resources

Outputs

image: An image-type PipelineResource specify the image that should be built.

ServiceAccount

S2I builds an image and pushes it to the destination registry which is defined as a parameter. In order to properly authenticate to the remote container registry, it needs to have the proper credentials. The credentials can be provided through a service account. See Authentication for further details.

If you are running on OpenShift, you also need to allow the service account to run privileged containers because OpenShift does not allow containers run as privileged containers by default unless explicitly configured, due to security considerations.

Run the following in order to create a service account named pipeline on OpenShift and allow it to run privileged containers:

oc create serviceaccount pipeline
oc adm policy add-scc-to-user privileged -z pipeline
oc adm policy add-role-to-user edit -z pipeline

Usage

This TaskRun runs the Task to fetch a Git repo, and build and push a container image using s2i and a nodejs builder image.

apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  name: s2i-nodejs-taskrun
spec:
  # Use service account with git and image repo credentials
  serviceAccountName: pipeline
  taskRef:
    name: s2i
  params:
  - name: BUILDER_IMAGE
    value: docker.io/centos/nodejs-8-centos7
  workspaces:
  - name: source
    persistentVolumeClaim:
      claimName: my-source
  resources:
    outputs:
    - name: image
      resourceSpec:
        type: image
        params:
        - name: url
          value: gcr.io/my-repo/nodejs-s2i-ex

Here is a non-exhaustive list of well maintained s2i builder image (from sclorg):

Note: all those images above are also available with RHEL as base instead, just replace centos7 by rhel7 or rhel8