Documentations for using tekton as agent in prowjob

[yfei1]

Expected Behavior

I'm not sure if this is a Prow or Tekton related issue. I was working on migrating a CI pipeline from Google Cloud Build to Prow. However, it seems like the native Kubernetes agent does not support running build/test sequentially in a pipelined way. I looked into api.ProwJob's source code and found there is a tekton controller defined in this file, yet it seems like we don't have documentations for using tekton-pipeline in Prow yet.

Also, I believe using tekton-pipeline as agent in a prowjob may require having tekton being deployed somewhere. Could you possibly point out some resources/examples I could look into to setup tekton along with my prow deployment? Thank!

Actual Behavior

[vdemeester]

@yfei1 I would say it might be more a prow issue but I feel we could also document it here (or at least on tekton.dev)

[yfei1]

@yfei1 I would say it might be more a prow issue but I feel we could also document it here (or at least on tekton.dev)

Thanks for your prompt reply! Could you point out some resources that I could look into for using tekton with prow?

[bobcatfish]

In the context of #922 I got Prow + Pipelines up and running for my own repo (thanks to @JoelSpeed 's notes in kubernetes/test-infra#13874 (comment) and some help from @krzyzacy + @BenTheElder !!), so I'll take this on and document how to get it to work!

[bobcatfish]

I think at this point it would make sense for this issue to live in the Prow repo only so I'll close this one. Also anyone should feel free to pickup where I left off with kubernetes/test-infra#13974 🙏

[noahkawasakigoogle]

Did any documentation on Prow + Tekton ever happen? I couldnt find anything

[masseybradley]

This is an example prow config for a tekton job:

presubmits:
  org/repo:
  - name: pr-build
    agent: tekton-pipeline
    always_run: true
    context: pr-build
    rerun_command: /test this
    trigger: (?m)^/test( all| this),?(\s+|$)
    pipeline_run_spec:
      trigger:
        type: manual
      pipelineRef:
        name: example
      resources:
      - name: source
        resourceRef:
          name: PROW_IMPLICIT_GIT_REF
      params:
      - name: args
        value:
          - "-a"
          - "-l"
          - "-F"
      workspaces:
      - name: workspace
        emptydir: {}
      - name: github-token
        secret:
          secretName: github-token

With an example tekton pipeline and task:

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: example
  namespace: test-pods
spec:
  params:
  - name: REPO_OWNER
    type: string
  - default:
    - --help
    name: args
    type: array
  resources:
  - name: source
    type: git
  tasks:
  - name: example
    params:
    - name: args
      value:
      - $(params.args)
    - name: REPO_OWNER
      value: $(params.REPO_OWNER)
    resources:
      inputs:
      - name: source
        resource: source
    taskRef:
      kind: Task
      name: example
    workspaces:
    - name: workspace
      workspace: workspace
    - name: github-token
      workspace: github-token
  workspaces:
  - name: workspace
  - name: github-token
---
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: example
  namespace: test-pods
spec:
  description: This is an example task with args.
  params:
  - default:
    - --help
    description: extra args that needs to be appended
    name: args
    type: array
  - default: ""
    name: REPO_OWNER
    type: string
  resources:
    inputs:
    - name: source
      type: git
  stepTemplate:
    env:
    - name: REPO_OWNER
      value: $(params.REPO_OWNER)
    name: ""
    resources: {}
  steps:
  - args:
    - $(params.args)
    command:
    - ls
    image: ubuntu
    name: example
    resources: {}
    workingDir: $(workspaces.workspace.path)/source
  workspaces:
  - mountPath: /workspace
    name: workspace
  - mountPath: /var/run/secrets/github
    name: github-token

... using tekton v0.36.0, prow v20220705-20e880da9b, and prow pipeline. Need to use the legacy prowjob CRD (pipeline_run_spec doesn't handle passing arrays of args to tekton using the CRD). The github secret in the test-pods namespace (installation done using a modified starter-gcs.yaml) is an annotated basic-auth secret which tekton uses to clone repos and the github-token secret contains github app credentials (can be mounted in the tekton task and used for e.g. peribolos):

apiVersion: v1
data:
  password: <bot_personal_access_token>
  username: <bot>
kind: Secret
metadata:
  annotations:
    tekton.dev/git-0: https://github.com
  name: github
  namespace: test-pods
type: kubernetes.io/basic-auth

[qaifshaikh]

@masseybradley if you attach the github ssh secret to the service account you don't have to attach the secret everywhere 😄
Also, I've tried it with v20230111-cd1b3caf9c and it works quite well since that added the v1beta1 support for tekton
kubernetes-sigs/prow#44 (comment)