Tekton

Tekton#

Tekton is the Kubernetes-native CI/CD framework, a CNCF incubating project. Pipelines, tasks, and triggers are CRDs; every step runs as a container in a Pod; the cluster scheduler is the build scheduler. The right pick when the operator wants CI/CD inside the same control plane as the workloads it ships.

Architecture#

  • Step, one container in a Pod.

  • Task, an ordered list of steps. Runs as one Pod.

  • Pipeline, a DAG of Tasks with parameter and result wiring.

  • TaskRun / PipelineRun, an execution of a Task or Pipeline.

  • Trigger, the event-source side. Webhooks land at an EventListener; a Trigger filters and creates a PipelineRun.

  • Workspaces, persistent volumes shared between steps in a Task (and between Tasks in a Pipeline).

  • Tekton Hub / Catalog, reusable published Tasks (git-clone, buildah, kaniko, etc.).

Minimal pipeline#

apiVersion: tekton.dev/v1
kind: Pipeline
metadata: { name: build-and-push }
spec:
  params:
    - { name: repo-url, type: string }
    - { name: image,    type: string }
  workspaces:
    - { name: src }
  tasks:
    - name: fetch
      taskRef: { name: git-clone }
      workspaces:
        - { name: output, workspace: src }
      params:
        - { name: url, value: $(params.repo-url) }
    - name: test
      runAfter: [fetch]
      taskRef: { name: npm-test }
      workspaces:
        - { name: source, workspace: src }
    - name: build
      runAfter: [test]
      taskRef: { name: buildah }
      workspaces:
        - { name: source, workspace: src }
      params:
        - { name: IMAGE, value: $(params.image) }

Run a pipeline#

$ tkn pipeline start build-and-push \
    --param repo-url=https://github.com/myorg/api \
    --param image=ghcr.io/myorg/api:v1 \
    --workspace name=src,volumeClaimTemplateFile=workspace.yaml \
    --showlog

$ tkn pipelinerun list
$ tkn pipelinerun logs -f <name>

Triggers#

A Trigger plus EventListener turn webhooks into runs.

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata: { name: github }
spec:
  serviceAccountName: tekton-triggers
  triggers:
    - name: github-push
      interceptors:
        - ref: { name: "github" }
          params:
            - { name: secretRef,    value: { secretName: github-webhook, secretKey: secret } }
            - { name: eventTypes,   value: ["push"] }
      bindings:
        - ref: github-push-binding
      template:
        ref: build-and-push-template

Strengths#

  • Kubernetes-native; one cluster runs apps and builds.

  • DAG with parameter / result wiring; complex pipelines compose cleanly.

  • Reusable Tasks via the Tekton Catalog.

  • Extensible through Custom Tasks for non-container work.

Weaknesses#

  • Verbose YAML. The smallest pipeline is dozens of lines.

  • No first-class UI; tkn CLI plus Tekton Dashboard plus external dashboards (OpenShift Pipelines, Jenkins X) fill the gap.

  • Strong tying to Kubernetes is also the limitation. Not the right shape outside K8s estates.

When to pick Tekton#

  • Already running Kubernetes; piping CI into the same control plane simplifies operations.

  • OpenShift estates; Tekton ships as the OpenShift Pipelines operator.

  • Need DAG-shaped pipelines with shared workspaces, not the linear stages of older CI tools.

When to pick something else#

  • No Kubernetes; the cost of running one for CI is too high.

  • Small team / small pipeline; the boilerplate dominates.

References#

Contents