CI/CD & Progressive Delivery Labs

# lab1.yaml — a Task, then a Pipeline that runs two of them in order
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: say
spec:
  params:
    - name: message
      type: string
      default: "hello from a pod"
  steps:
    - name: echo                       # every step is a container in one pod
      image: alpine:3.20
      script: |
        #!/bin/sh
        echo "$(params.message)"
        sleep 2
---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: greet
spec:
  params:
    - name: who
      type: string
  tasks:
    - name: first
      taskRef: { name: say }
      params:
        - { name: message, value: "building for $(params.who)" }
    - name: second
      runAfter: [first]                # drop runAfter and they run in parallel
      taskRef: { name: say }
      params:
        - { name: message, value: "shipped for $(params.who)" }

# lab2.yaml — one PipelineRun, one PVC, two Tasks sharing it
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: clone-and-look
spec:
  workspaces:
    - name: shared                     # declared here, bound at run time
  tasks:
    - name: write
      taskRef: { name: writer }
      workspaces:
        - { name: ws, workspace: shared }
    - name: read
      runAfter: [write]
      taskRef: { name: reader }
      workspaces:
        - { name: ws, workspace: shared }
---
apiVersion: tekton.dev/v1
kind: Task
metadata: { name: writer }
spec:
  workspaces: [{ name: ws }]
  steps:
    - name: write
      image: alpine:3.20
      script: |
        #!/bin/sh
        date > $(workspaces.ws.path)/built-at.txt
        echo "wrote $(workspaces.ws.path)/built-at.txt"
---
apiVersion: tekton.dev/v1
kind: Task
metadata: { name: reader }
spec:
  workspaces: [{ name: ws }]
  steps:
    - name: read
      image: alpine:3.20
      script: |
        #!/bin/sh
        ls -l $(workspaces.ws.path)
        cat $(workspaces.ws.path)/built-at.txt      # fails loudly if the volume didn't follow
---
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata: { generateName: clone-and-look- }
spec:
  pipelineRef: { name: clone-and-look }
  workspaces:
    - name: shared
      volumeClaimTemplate:             # a fresh PVC per run, deleted with the run
        spec:
          accessModes: [ReadWriteOnce]
          resources:
            requests:
              storage: 1Gi

# lab3.yaml — a Task that emits a result, a Task that consumes it
apiVersion: tekton.dev/v1
kind: Task
metadata: { name: make-tag }
spec:
  results:
    - name: tag
      description: the image tag this run should build
  steps:
    - name: compute
      image: alpine:3.20
      script: |
        #!/bin/sh
        # results are tiny values written to a file Tekton hands back — no trailing newline!
        # NOTE the backticks: shell $( ) inside a Tekton script collides with Tekton's
        # own $(...) substitution syntax, so use `...` for command substitution here.
        TAG="1.0.`date +%s`"
        printf '%s' "$TAG" | tee $(results.tag.path)
---
apiVersion: tekton.dev/v1
kind: Task
metadata: { name: use-tag }
spec:
  params: [{ name: tag, type: string }]
  steps:
    - name: show
      image: alpine:3.20
      script: |
        #!/bin/sh
        echo "would push registry.registry.svc.cluster.local:5000/demo:$(params.tag)"
---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata: { name: tag-flow }
spec:
  results:
    - name: chosen-tag                                  # bubble it out of the Pipeline too
      value: $(tasks.compute.results.tag)
  tasks:
    - name: compute
      taskRef: { name: make-tag }
    - name: consume
      runAfter: [compute]
      taskRef: { name: use-tag }
      params:
        - { name: tag, value: $(tasks.compute.results.tag) }

# lab4.yaml — build and push an image from inside the cluster, no Docker daemon
apiVersion: tekton.dev/v1
kind: Task
metadata: { name: kaniko-build }
spec:
  params:
    - name: image
      type: string
  workspaces: [{ name: source }]
  steps:
    - name: seed                                   # stand in for a git-clone Task
      image: alpine:3.20
      script: |
        #!/bin/sh
        cd $(workspaces.source.path)
        printf 'FROM alpine:3.20\nRUN echo built-in-cluster > /hello.txt\nCMD ["cat","/hello.txt"]\n' > Dockerfile
    - name: build-and-push
      image: gcr.io/kaniko-project/executor:latest  # userspace builder: no daemon, no socket
      env:
        - name: DOCKER_CONFIG                       # where Tekton drops ServiceAccount creds;
          value: /tekton/home/.docker               # kaniko would otherwise only read /kaniko/.docker
      args:
        - --context=$(workspaces.source.path)
        - --dockerfile=$(workspaces.source.path)/Dockerfile
        - --destination=$(params.image)
        - --insecure                                # our throwaway registry is plain HTTP
        - --skip-tls-verify
---
apiVersion: tekton.dev/v1
kind: TaskRun
metadata: { generateName: kaniko-build- }
spec:
  taskRef: { name: kaniko-build }
  params:
    - name: image
      value: registry.registry.svc.cluster.local:5000/demo:v1
  workspaces:
    - name: source
      volumeClaimTemplate:
        spec:
          accessModes: [ReadWriteOnce]
          resources:
            requests:
              storage: 1Gi

# lab5.sh — put a lock on the registry, then hand the run a key

# 1. generate an htpasswd file (no local apache tools needed)
docker run --rm httpd:2 htpasswd -Bbn ci s3cr3t > htpasswd
kubectl -n registry create secret generic registry-auth --from-file=htpasswd

# 2. mount the file FIRST, then switch auth on — do it the other way round and the
#    registry crash-loops on a missing /auth/htpasswd while you watch
kubectl -n registry patch deployment registry --type=json -p='[
  {"op":"add","path":"/spec/template/spec/volumes","value":[{"name":"auth","secret":{"secretName":"registry-auth"}}]},
  {"op":"add","path":"/spec/template/spec/containers/0/volumeMounts","value":[{"name":"auth","mountPath":"/auth"}]}]'
kubectl -n registry rollout status deployment/registry
kubectl -n registry set env deployment/registry \
  REGISTRY_AUTH=htpasswd \
  REGISTRY_AUTH_HTPASSWD_REALM=Registry \
  REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
kubectl -n registry rollout status deployment/registry

# 3. re-fire the Lab 4 TaskRun unchanged → the push now fails with UNAUTHORIZED. Good.
kubectl create -f run4.yaml
tkn taskrun logs --last -f

# 4. the fix: a credential the run can reach, attached to a ServiceAccount
kubectl -n cicd create secret docker-registry regcred \
  --docker-server=registry.registry.svc.cluster.local:5000 \
  --docker-username=ci --docker-password=s3cr3t
kubectl -n cicd create serviceaccount pipeline-pusher
kubectl -n cicd patch serviceaccount pipeline-pusher \
  -p '{"secrets":[{"name":"regcred"}]}'      # SA .secrets, NOT .imagePullSecrets

# a dockerconfigjson Secret needs no annotation — Tekton merges it straight into the
# run's docker config. The tekton.dev/docker-0 annotation is for the OTHER shape,
# a kubernetes.io/basic-auth Secret, which has no registry host of its own:
#   kubectl -n cicd create secret generic regcred-basic \
#     --type=kubernetes.io/basic-auth --from-literal=username=ci --from-literal=password=s3cr3t
#   kubectl -n cicd annotate secret regcred-basic \
#     tekton.dev/docker-0=http://registry.registry.svc.cluster.local:5000

# 5. the workspace stanza on its own, so tkn can bind it
cat > vct.yaml <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
EOF

# 6. run it AS that identity
tkn task start kaniko-build --serviceaccount pipeline-pusher \
  --param image=registry.registry.svc.cluster.local:5000/demo:v2 \
  --workspace name=source,volumeClaimTemplateFile=vct.yaml --showlog

# lab6.yaml — webhook ➜ EventListener ➜ TriggerBinding ➜ TriggerTemplate ➜ PipelineRun
apiVersion: v1
kind: ServiceAccount
metadata: { name: triggers-sa, namespace: cicd }
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: triggers-role, namespace: cicd }
rules:
  - apiGroups: ["triggers.tekton.dev"]
    resources: ["eventlisteners","triggerbindings","triggertemplates","triggers","interceptors"]
    verbs: ["get","list","watch"]
  - apiGroups: ["tekton.dev"]
    resources: ["pipelineruns","taskruns"]
    verbs: ["create","get","list","watch"]
  - apiGroups: [""]
    resources: ["configmaps","secrets","serviceaccounts"]
    verbs: ["get","list","watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create","patch"]        # the listener EMITS events; watch alone isn't enough
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: triggers-rb, namespace: cicd }
subjects: [{ kind: ServiceAccount, name: triggers-sa, namespace: cicd }]
roleRef: { kind: Role, name: triggers-role, apiGroup: rbac.authorization.k8s.io }
---
# the EventListener also reads two CLUSTER-scoped kinds at startup. Leave this out
# and the sink pod never becomes ready — the #1 cause of "my curl does nothing".
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata: { name: triggers-clusterrole }
rules:
  - apiGroups: ["triggers.tekton.dev"]
    resources: ["clustertriggerbindings","clusterinterceptors"]
    verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata: { name: triggers-crb }
subjects: [{ kind: ServiceAccount, name: triggers-sa, namespace: cicd }]
roleRef: { kind: ClusterRole, name: triggers-clusterrole, apiGroup: rbac.authorization.k8s.io }
---
apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerBinding
metadata: { name: from-push, namespace: cicd }
spec:
  params:
    - name: who
      value: $(body.repository.name)          # pull fields out of the webhook payload
---
apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata: { name: run-greet, namespace: cicd }
spec:
  params: [{ name: who }]
  resourcetemplates:
    - apiVersion: tekton.dev/v1
      kind: PipelineRun
      metadata: { generateName: greet-from-webhook- }
      spec:
        pipelineRef: { name: greet }
        params:
          - { name: who, value: $(tt.params.who) }
---
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata: { name: push-listener, namespace: cicd }
spec:
  serviceAccountName: triggers-sa
  triggers:
    - name: on-push
      bindings: [{ ref: from-push }]
      template: { ref: run-greet }

# lab7.yaml — an Argo Workflows DAG: fan out, then fan in
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata: { generateName: fan-out-in- }
spec:
  entrypoint: main
  templates:
    - name: main
      dag:
        tasks:
          - name: checkout
            template: echo
            arguments: { parameters: [{ name: msg, value: "clone" }] }
          - name: unit-tests                 # unit-tests and lint depend only on checkout
            dependencies: [checkout]         # → they run at the same time
            template: echo
            arguments: { parameters: [{ name: msg, value: "unit tests" }] }
          - name: lint
            dependencies: [checkout]
            template: echo
            arguments: { parameters: [{ name: msg, value: "lint" }] }
          - name: package                    # waits for BOTH
            dependencies: [unit-tests, lint]
            template: echo
            arguments: { parameters: [{ name: msg, value: "package image" }] }
    - name: echo
      inputs: { parameters: [{ name: msg }] }
      container:
        image: alpine:3.20
        command: [sh, -c]
        args: ["echo {{inputs.parameters.msg}}; sleep 10"]

# lab8.yaml — a Deployment, converted
apiVersion: argoproj.io/v1alpha1
kind: Rollout                          # replaces kind: Deployment, same pod template
metadata:
  name: demo
  namespace: demo
spec:
  replicas: 5
  selector:
    matchLabels: { app: demo }
  template:
    metadata:
      labels: { app: demo }
    spec:
      containers:
        - name: demo
          image: argoproj/rollouts-demo:blue     # each tag serves a different colour
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 5m, memory: 32Mi }
  strategy:
    canary:
      steps:
        - setWeight: 20                # ~20% of replicas are the new version
        - pause: { duration: 30s }     # soak
        - setWeight: 50
        - pause: {}                    # {} with no duration = pause FOREVER (manual gate)
        - setWeight: 100

# lab9.yaml — let the canary judge itself against Prometheus
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: no-restarts
  namespace: demo
spec:
  args:
    - name: ns
  metrics:
    - name: canary-restarts
      interval: 30s
      count: 6                                  # six measurements, then the step passes
      failureLimit: 1                           # a SECOND bad measurement aborts the rollout
                                                # (kube-state-metrics scrapes every 30s — give
                                                #  the restart counter time to actually move)
      successCondition: result[0] < 1
      provider:
        prometheus:
          address: http://kube-prom-stack-kube-prome-prometheus.monitoring:9090
          query: |
            sum(increase(kube_pod_container_status_restarts_total{namespace="{{args.ns}}"}[2m])) or vector(0)
---
# patch the Lab 8 strategy so step 2 is an analysis instead of a blind soak
#   strategy:
#     canary:
#       steps:
#         - setWeight: 20
#         - analysis:
#             templates:
#               - templateName: no-restarts
#             args:
#               - { name: ns, value: demo }
#         - setWeight: 50
#         - pause: { duration: 30s }
#         - setWeight: 100

# lab10.yaml — blue/green: two Services, one manual flip
apiVersion: v1
kind: Service
metadata: { name: demo-active, namespace: demo }
spec:
  selector: { app: demo-bg }
  ports: [{ port: 80, targetPort: 8080 }]
---
apiVersion: v1
kind: Service
metadata: { name: demo-preview, namespace: demo }
spec:
  selector: { app: demo-bg }
  ports: [{ port: 80, targetPort: 8080 }]
---
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata: { name: demo-bg, namespace: demo }
spec:
  replicas: 3
  selector:
    matchLabels: { app: demo-bg }
  template:
    metadata:
      labels: { app: demo-bg }
    spec:
      containers:
        - name: demo
          image: argoproj/rollouts-demo:blue
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 5m, memory: 32Mi }
  strategy:
    blueGreen:
      activeService: demo-active           # what users hit
      previewService: demo-preview         # what only you hit
      autoPromotionEnabled: false          # the flip is a human decision
      scaleDownDelaySeconds: 30            # keep the old set warm for a fast undo

# lab11.yaml — the same canary, expressed as Flagger's Canary CR
apiVersion: flagger.app/v1beta1
kind: Canary
metadata: { name: podinfo, namespace: test }
spec:
  targetRef:                                # your ORDINARY Deployment, untouched
    apiVersion: apps/v1
    kind: Deployment
    name: podinfo
  progressDeadlineSeconds: 60
  service:
    port: 80
    targetPort: 9898
  analysis:
    interval: 15s
    threshold: 5                            # 5 failed checks → roll back
    maxWeight: 50
    stepWeight: 10                          # 10, 20, 30, 40, 50, then promote
    metrics:
      - name: request-success-rate          # built in when a mesh reports it
        thresholdRange: { min: 99 }
        interval: 1m
    webhooks:
      - name: load-test                     # generate traffic, or there's nothing to measure
        url: http://flagger-loadtester.test/
        timeout: 5s
        metadata:
          cmd: "hey -z 1m -q 10 -c 2 http://podinfo-canary.test/"

# lab12.yaml — flagd: the release switch lives outside the image
apiVersion: v1
kind: ConfigMap
metadata: { name: flags, namespace: demo }
data:
  flags.json: |
    {
      "flags": {
        "new-checkout": {
          "state": "ENABLED",
          "variants": { "on": true, "off": false },
          "defaultVariant": "off"
        }
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata: { name: flagd, namespace: demo }
spec:
  replicas: 1
  selector: { matchLabels: { app: flagd } }
  template:
    metadata: { labels: { app: flagd } }
    spec:
      containers:
        - name: flagd
          image: ghcr.io/open-feature/flagd:latest
          args: ["start", "--uri", "file:/etc/flagd/flags.json"]   # watches the file
          ports: [{ containerPort: 8013 }]
          volumeMounts:
            - { name: flags, mountPath: /etc/flagd }
      volumes:
        - name: flags
          configMap: { name: flags }