Open-Toolchain Tekton Catalog

Catalog of Tekton Tasks usable in Continuous Delivery Tekton Pipelines

Notes:

• These tasks are usable with Continuous Delivery Tekton Pipeline Worker Agent (Tekton definition with apiVersion: v1beta1). These tasks have been updated following migration path described in https://github.com/tektoncd/pipeline/blob/v0.11.2/docs/migrating-v1alpha1-to-v1beta1.md
• If you want v1alpha1 resources, you need to reference the tekton_pipeline0.10.1 tag (or tekton_pipeline0.10.1_workspace tag to have v1alpha1 resources using workspaces).
• When moving from from tag tekton_pipeline0.10.1, tekton_pipeline0.10.1 and/or branch tkn_v1beta1 to use masterbranch of this catalog, take a look at breaking changes section

Tasks

Cloud Foundry related tasks

• cf-deploy-app: This task allows to perform a deployment of a Cloud Foundry application using ibmcloud cf commands.

IBM Cloud Container Registry related tasks

• icr-containerize: This task is building and pushing an image to IBM Cloud Container Registry. This task is relying on Buildkit to perform the build of the image.

• icr-execute-in-dind: This task runs docker commands (build, inspect...) that communicate with a sidecar dind, and push the resulting image to the IBM Cloud Container Registry.

• icr-execute-in-dind-cluster: This task runs docker commands (build, inspect...) that communicate with a docker dind instance hosted in a kubernetes cluster (eventually deploying the Docker DinD if needed), and pushes the resulting image to the IBM Cloud Container Registry.

• icr-check-va-scan: This task is verifying that a Vulnerability Advisor scan has been made for the image and process the outcome of the scan.

• icr-cr-build - deprecated: The ibmcloud cr build command is deprecated. If you use the icr-cr-build Tekton task, you can migrate to one of the three above Tekton tasks to build container images. For more information about this replacement, see the IBM Cloud™ Container Registry is Deprecating Container Builds blog post.

IBM Cloud Code Risk Analyzer scanners related tasks

• cra-discovery: This task accesses various source artifacts from the repository and performs deep discovery to identify all dependencies (including transitive dependencies).
• cra-bom: This task creates a Bill-of-Material (BoM) for a given repository that captures pedigree of all the dependencies and is collected at different granularities.
• cra-cis-check: This task runs configuration checks on kubernetes deployment manifests.
• cra-vulnerability-remediation: This task finds out vulnerabilities for all application package dependencies, container base images and os packages.
• cra-comm-editor: This task creates comments on Pull Requests and opens issues regarding bill of material and discovered vunerabilities.
• cra-terraform-scan: ## This task scans ibm-terraform-provider files for compliance issues.

IBM Cloud Devops Insights related tasks

• doi-publish-buildrecord: This task publishes build record to DevOps Insights
• doi-publish-testrecord: This task publishes test record(s) to DevOps Insights
• doi-publish-deployrecord: This task publishes deploy record to DevOps Insights
• doi-evaluate-gate: This task evaluates DevOps Insights gate policy

Git related tasks

• git-clone-repo: This task fetches the credentials needed to perform a git clone of a repo specified by a Continuous Delivery toolchain and then uses them to clone the repo.
• git-set-commit-status: This task is setting a git commit status for a given git commit (revision) in a git repository repository integrated in a Continuous Delivery toolchain.

IBM Cloud Kubernetes Service related tasks

• iks-fetch-config: This task is fetching the configuration of a IBM Cloud Kubernetes Service cluster that is required to perform kubectl commands.
• iks-contextual-execution: This task is executing bash snippet/script in the context of a Kubernetes cluster configuration.
• iks-deploy-to-kubernetes: This task allows to perform scripts typically doing deployment of a Kubernetes application with ibmcloud ks cli and kubectl cli configured for a given cluster.

Linter related tasks

• linter-docker-lint: This task performs a lint on the given Dockerfile using Hadolint.

Signing - Docker Content Trust related tasks

• signing-dct-init: This task initialize Docker Content Trust GUN/repository
• signing-dct-sign: This task performs a Docker Content Trust signature on a given image
• signing-dct-enforcement-policy: This task installs Container Image Security Enforcement on a given cluster.

Slack related tasks

• slack-post-message: This task posts a message to the Slack channel(s) integrated to your Continuous Delivery toolchain.

SonarQube related tasks

• sonarqube-run-scan: This task starts a SonarQube scan for the code in a workspace using the SonarQube server integrated to your Continuous Delivery toolchain.

Tester related tasks

• tester-run-tests: This task allows to invoke a script to execute test.

Open-Toolchain related tasks

• toolchain-build: This task performs build operation(s) on the given workspace. Default build operations managed are maven build for instance.
• toolchain-extract-value: This task extracts values from the desired config map with a given jq expression.
• toolchain-publish-deployable-mapping: This task creates or updates a toolchain deployable mapping for a Continuous Delivery toolchain.

Breaking Changes

when moving from tag "tekton_pipeline0.10.1"

• These tasks are using kebab-case style for EVERY parameters names. So parameter pathToContext (in previous versions of the tasks) has been renamed as path-to-context, parameter clusterName has been renamed to cluster-name and so on...

• communication folder has been renamed to slack folder

• Some tasks has been renamed to match the following name format <category alias>-<task> where category alias is depending on the folder containing the tasks:

  Folder/Category	Category alias
  cloudfoundry	cf
  container-registry	icr
  devops-insights	doi
  git	git
  kubernetes-service	iks
  slack	slack
  toolchain	toolchain

  The task new names are listed in the following table:

  Folder	Old task name	New task name
  container-registry	containerize-task	icr-containerize
  container-registry	cr-build-task	icr-cr-build
  container-registry	execute-in-dind-task	icr-execute-in-dind
  container-registry	execute-in-dind-cluster-task	icr-execute-in-dind-cluster
  container-registry	vulnerability-advisor-task	icr-check-va-scan
  git	clone-repo-task	git-clone-repo
  git	set-commit-status	git-set-commit-status
  kubernetes-service	fetch-iks-cluster-config	iks-fetch-config
  kubernetes-service	kubernetes-contextual-execution	iks-contextual-execution
  slack	post-slack	slack-post-message

• Tasks that use workspace(s) may have changed the expected workspace name. Here is the list of the breaking changes for the expected workspace name

  Folder	Task	Old workspace name	New workspace name	Description
  container-registry	icr-containerize	workspace	source	A workspace containing the source (Dockerfile, Docker context) to create the image
  container-registry	icr-cr-build	workspace	source	A workspace containing the source (Dockerfile, Docker context) to create the image
  container-registry	icr-execute-in-dind	workspace	source	A workspace containing the source (Dockerfile, Docker context) to create the image
  container-registry	icr-execute-in-dind-cluster	workspace	source	A workspace containing the source (Dockerfile, Docker context) to create the image
  container-registry	icr-check-va-scan	workspace	artifacts	Workspace that may contain image information and will have the va report from the VA scan after this task exection
  git	git-clone-repo	workspace	output	Workspace where the git repository will be cloned into
  git	git-set-commit-status	workspace	artifacts	Workspace that may contain git repository information (ie build.properties). Should be marked as optional when Tekton will permit it
  kubernetes-service	iks-fetch-config	workspace	cluster-configuration	A workspace where the kubernetes cluster config is exported
  kubernetes-service	iks-contextual-execution	workspace	cluster-configuration	A workspace that contain the kubectl cluster config to be used

when moving from tag "tekton_pipeline0.10.1" and/or branch "tkn_v1beta1"

• Tasks that are expecting a secret to retrieve apikey and/or secret values have been updated to use the default secret secure-properties injected by Continuous Delivery Tekton Pipeline support. The updated tasks are:

  • icr-check-va-scan
  • icr-containerize
  • icr-cr-build
  • icr-execute-in-dind
  • icr-execute-in-dind-cluster
  • git-clone-repo
  • git-set-commit-status
  • iks-fetch-config

  Note: As a reminder, in previous version (before secure-properties injection by CD tekton support), the default was set to cd-secret

Criteria for Code Submission

To ensure code quality, protected branches will be enabled soon, and every PR that is to be merged to master will run CI tasks for code quality. These could (and should) be set up for local development environments as well.

Code quality checks currently enabled:

• yaml lint - using yamllint-rules.yaml as configuration file: yamllint --config-file yamllint-rules.yaml .
• tekton task lint: tekton-lint '**/*.yaml'
• Tasks definition validation: check_tasks.sh