在 Tekton 中如何实现审批功能

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

- name: test-app
  taskRef:
    name: make-test
  resources:
    inputs:
      - name: workspace
        resource: my-repo
- name: build-app
  taskRef:
    name: kaniko-build
  runAfter:
    - test-app
  resources:
    inputs:
      - name: workspace
        resource: my-repo

 1
2
3
4
5
6
7
8
9
10
11
12
13

apiVersion: tekton.dev/v1alpha1
kind: Condition
metadata:
  name: file-exists
spec:
  params:
    - name: "path"
  resources:
    - name: workspace
      type: git
  check:
    image: alpine
    script: 'test -f $(resources.workspace.path)/$(params.path)'

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: conditional-pipeline
spec:
  resources:
    - name: source-repo
      type: git
  params:
    - name: "path"
      default: "README.md"
  tasks:
    - name: if-condition-then-run
      conditions:
        - conditionRef: "file-exists"
          params:
            - name: "path"
              value: "$(params.path)"
          resources:
            - name: workspace
              resource: source-repo
      taskRef:
        name: my-task

kubectl get pipelineruns.tekton.dev

NAME                                     SUCCEEDED   REASON               STARTTIME   COMPLETIONTIME
cancel-pipelinerun-r-67qsr               Unknown     Running              51m

kubectl patch PipelineRun cancel-pipelinerun-r-67qsr --type=merge -p '{"spec":{"status":"PipelineRunCancelled"}}'

kubectl get pipelineruns.tekton.dev

NAME                                     SUCCEEDED   REASON                 STARTTIME   COMPLETIONTIME
cancel-pipelinerun-r-67qsr               False       PipelineRunCancelled   52m         3s

---
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: pending-pipelinerun
spec:
  params:
  - name: pl-param-x
    value: "100"
  - name: pl-param-y
    value: "500"
  pipelineRef:
    name: pending-pipeline
  status: "PipelineRunPending"

kubectl get pipelineruns.tekton.dev

NAME                                     SUCCEEDED   REASON                 STARTTIME   COMPLETIONTIME
pending-pipelinerun                      Unknown     PipelineRunPending

kubectl patch PipelineRun pending-pipelinerun --type=merge -p '{"spec":{"status":""}}'

kubectl get pipelineruns.tekton.dev

NAME                                     SUCCEEDED   REASON                 STARTTIME   COMPLETIONTIME
pending-pipelinerun                      Unknown     Running                4s

kubectl get pipelineruns.tekton.dev

NAME                                     SUCCEEDED   REASON               STARTTIME   COMPLETIONTIME
cancel-pipelinerun                       Unknown     Running              9s

kubectl patch PipelineRun cancel-pipelinerun --type=merge -p '{"spec":{"status":"PipelineRunPending"}}'

Error from server (BadRequest): admission webhook "validation.webhook.pipeline.tekton.dev" denied the request: validation failed: invalid value: PipelineRun cannot be Pending after it is started: spec.status

apiVersion: v1
kind: ConfigMap
metadata:
  name: approve-cm
data:
  status: init

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: approve-task
spec:
  workspaces:
  - name: data
  params:
  - name: timeout
    description: The max seconds to approve
    type: string
    default: "86400"
  steps:
  - name: sleep-a-while
    image: bash:latest
    script: |
      #!/usr/bin/env bash

      end=$((SECONDS+$(params.timeout)))
      while [ $SECONDS -lt $end ]; do
        name=$(cat "$(workspaces.data.path)"/status)
        if [ "$name" = "success" ]
        then
          echo "approved!"
          exit 0
        elif [ "$name" = "refused" ]
        then
          echo "refused!"
          exit 1
        fi
        sleep 2
        echo "waiting"
      done
      echo "too long not to approve"
      exit 1      

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: something
  annotations:
    description: |
            A simple task that do something
spec:
  steps:
  - name: do-something
    image: bash:latest
    script: |
      #!/usr/bin/env bash
      uname -a      
---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: approve-pipeline
spec:
  workspaces:
  - name: workspace
  tasks:
  - name: wait-for-approve
    workspaces:
    - name: data
      workspace: workspace
    taskRef:
      name: approve-task
  - name: do-something
    taskRef:
      name: something
    runAfter:
      - wait-for-approve
---
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: approve-pipelinerun
spec:
  workspaces:
  - name: workspace
    configmap:
      name: approve-cm
  pipelineRef:
    name: approve-pipeline

kubectl patch ConfigMap approve-cm --type=merge -p '{"data":{"status":"success"}}'