Tekton – Getting Started

Docs: Getting started with Tasks

Mon, 01 Jan 0001 00:00:00 +0000

This tutorial shows you how to

Create a Kubernetes cluster with minikube.
Install Tekton pipelines.
Create a Task.
Use TaskRun to instantiate and run the Task.

Prerequisites

Install minikube. You only have to complete the step 1, “Installation”.
Install kubectl.

Create a Kubernetes cluster

Create a cluster:

minikube start --kubernetes-version v1.33.1

The process takes a few seconds, you see an output similar to the following, depending on the minikube driver that you are using:

😄  minikube v1.36.0 on Darwin 15.5 (arm64)
✨  Using the qemu2 driver based on user configuration
🌐  Automatically selected the builtin network
👍  Starting "minikube" primary control-plane node in "minikube" cluster
🔥  Creating qemu2 VM (CPUs=2, Memory=6000MB, Disk=20000MB) ...
📦  Preparing Kubernetes v1.33.1 on containerd 1.7.23 ...
    ▪ Generating certificates and keys ...
    ▪ Booting up control plane ...
    ▪ Configuring RBAC rules ...
🔗  Configuring bridge CNI (Container Networking Interface) ...
🔎  Verifying Kubernetes components...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟  Enabled addons: default-storageclass, storage-provisioner
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

You can check that the cluster was successfully created with kubectl:

kubectl cluster-info

The output confirms that Kubernetes is running:

Kubernetes control plane is running at https://localhost:64858
CoreDNS is running at https://localhost:64858/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

Install Tekton Pipelines

To install the latest version of Tekton Pipelines, use kubectl:

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml

Monitor the installation:

kubectl get pods --namespace tekton-pipelines --watch

When both tekton-pipelines-controller and tekton-pipelines-webhook show 1/1 under the READY column, you are ready to continue. For example:

NAME                                          READY   STATUS    RESTARTS   AGE
tekton-events-controller-786b59d5cd-jt7d9     0/1     Running   0          2s
tekton-pipelines-controller-59b6cdbbc-2kw2w   0/1     Running   0          2s
tekton-pipelines-webhook-74b5cdfcc4-g4qj2     0/1     Running   0          2s
tekton-pipelines-controller-59b6cdbbc-2kw2w   1/1     Running   0          11s
tekton-events-controller-786b59d5cd-jt7d9     1/1     Running   0          11s
tekton-pipelines-webhook-74b5cdfcc4-g4qj2     1/1     Running   0          11s

Hit Ctrl + C to stop monitoring.

Create and run a basic Task

A Task, represented in the API as an object of kind Task, defines a series of Steps that run sequentially to perform logic that the Task requires. Every Task runs as a pod on the Kubernetes cluster, with each step running in its own container.

To create a Task, open your favorite editor and create a file named hello-world.yaml with the following content:

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: hello
spec:
  steps:
    - name: echo
      image: alpine
      script: |
        #!/bin/sh
        echo "Hello World"

Apply the changes to your cluster:
```
kubectl apply --filename hello-world.yaml
```
The output confirms that the Task was created successfully:
```
task.tekton.dev/hello created
```

A TaskRun object instantiates and executes this Task. Create another file named hello-world-run.yaml with the following content:

apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: hello-task-run
spec:
  taskRef:
    name: hello

Apply the changes to your cluster to launch the Task:
```
kubectl apply --filename hello-world-run.yaml
```
Verify that everything worked correctly:
```
kubectl get taskrun hello-task-run
```
The output of this command shows the status of the Task:
```
NAME             SUCCEEDED   REASON      STARTTIME   COMPLETIONTIME
hello-task-run   True        Succeeded   28s         3s
```
The value True under SUCCEEDED confirms that TaskRun completed with no errors.

Take a look at the logs:

kubectl logs --selector=tekton.dev/taskRun=hello-task-run

The output displays the message:

Hello World

Cleanup

To learn about Tekton Pipelines, skip this section and proceed to the next tutorial.

To delete the cluster that you created for this guide run:

minikube delete

The output confirms that the cluster was deleted:

🔥  Deleting "minikube" in qemu2 ...
💀  Removed all traces of the "minikube" cluster.

Docs: Getting Started with Pipelines

Mon, 01 Jan 0001 00:00:00 +0000

This tutorial shows you how to:

Create two Tasks.
Create a Pipeline containing your Tasks.
Use PipelineRun to instantiate and run the Pipeline containing your Tasks.

This guide uses a local cluster with minikube.

Prerequisites

Complete the Getting started with Tasks tutorial. Do not clean up your resources, skip the last section.
Install tkn, the Tekton CLI.

Create and run a second Task

You already have a “Hello World!” Task. To create a second “Goodbye!” Task:

Create a new file named goodbye-world.yaml and add the following content:

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: goodbye
spec:
  params:
  - name: username
    type: string
  steps:
    - name: goodbye
      image: ubuntu
      script: |
        #!/bin/bash
        echo "Goodbye $(params.username)!"

This Task takes one parameter, username. Whenever this Task is used a value for that parameter must be passed to the Task.

Apply the Task file:

kubectl apply --filename goodbye-world.yaml

When a Task is part of a Pipeline, Tekton creates a TaskRun object for every task in the Pipeline.

Create and run a Pipeline

A Pipeline defines an ordered series of Tasks arranged in a specific execution order as part of the CI/CD workflow.

In this section you are going to create your first Pipeline, that will include both the “Hello World!” and “Goodbye!” Tasks.

Create a new file named hello-goodbye-pipeline.yaml and add the following content:

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: hello-goodbye
spec:
  params:
  - name: username
    type: string
  tasks:
    - name: hello
      taskRef:
        name: hello
    - name: goodbye
      runAfter:
        - hello
      taskRef:
        name: goodbye
      params:
      - name: username
        value: $(params.username)

The Pipeline defines the parameter username, which is then passed to the goodbye Task.

Apply the Pipeline configuration to your cluster:

kubectl apply --filename hello-goodbye-pipeline.yaml

A PipelineRun, represented in the API as an object of kind PipelineRun, sets the value for the parameters and executes a Pipeline. To create PipelineRun, create a new file named hello-goodbye-pipeline-run.yaml with the following:
```
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: hello-goodbye-run
spec:
  pipelineRef:
    name: hello-goodbye
  params:
  - name: username
    value: "Tekton"
```
This sets the actual value for the username parameter: "Tekton".
Start the Pipeline by applying the PipelineRun configuration to your cluster:
```
kubectl apply --filename hello-goodbye-pipeline-run.yaml
```
You see the following output:
```
pipelinerun.tekton.dev/hello-goodbye-run created
```
Tekton now starts running the Pipeline.

To see the logs of the PipelineRun, use the following command:

tkn pipelinerun logs hello-goodbye-run -f -n default

The output shows both Tasks completed successfully:

[hello : echo] Hello World!

[goodbye : goodbye] Goodbye Tekton!

Cleanup

To learn about Tekton Triggers, skip this section and proceed to the next tutorial.

To delete the cluster that you created for this guide run:

minikube delete

The output confirms that the cluster was deleted:

🔥  Deleting "minikube" in qemu2 ...
💀  Removed all traces of the "minikube" cluster.

Docs: Getting Started with Triggers

Mon, 01 Jan 0001 00:00:00 +0000

This tutorial shows you how to

Install Tekton Triggers.
Create a TriggerTemplate.
Create a TriggerBind.
Create an EventListener.

This guide uses a local cluster with minikube.

Before you begin

Complete the two previous Getting Started tutorials: Tasks and Pipelines. Do not clean up your resources, skip the last section.
Install curl if it’s not already available on your system.

Overview

You can use Tekton Triggers to modify the behavior of your CI/CD Pipelines depending on external events. The basic implementation you are going to create in this guide comprises three main components:

An EventListener object that listens to the world waiting for “something” to happen.
A TriggerTemplate object, which configures a PipelineRun when this event occurs.
A TriggerBinding object, that passes the data to the PipelineRun created by the TriggerTemplate object.

An optional ClusterInterceptor object can be added to validate and process event data.

You are going to create a Tekton Trigger to run the hello-goodbye Pipeline when the EventListener detects an event.

Install Tekton Triggers

Use kubectl to install Tekton Triggers:

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml
kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml

Monitor the installation:

kubectl get pods --namespace tekton-pipelines --watch

When tekton-triggers-controller, tekton-triggers-webhook, and tekton-triggers-core-interceptors show 1/1 under the READY column, you are ready to continue. For example:

NAME                                                READY   STATUS    RESTARTS   AGE
tekton-events-controller-786b59d5cd-jt7d9           1/1     Running   0          5m43s
tekton-pipelines-controller-59b6cdbbc-2kw2w         1/1     Running   0          5m43s
tekton-pipelines-webhook-74b5cdfcc4-g4qj2           1/1     Running   0          5m43s
tekton-triggers-controller-784d896c7f-s5c7s         1/1     Running   0          85s
tekton-triggers-core-interceptors-54d9f764b-g5vbh   1/1     Running   0          84s
tekton-triggers-webhook-666c844478-4cqcv            1/1     Running   0          85s

Hit Ctrl + C to stop monitoring.

Create a TriggerTemplate

A TriggerTemplate defines what happens when an event is detected.

Create a new file named trigger-template.yaml and add the following:

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: hello-template
spec:
  params:
  - name: username
    default: "Kubernetes"
  resourcetemplates:
  - apiVersion: tekton.dev/v1
    kind: PipelineRun
    metadata:
      generateName: hello-goodbye-run-
    spec:
      pipelineRef:
        name: hello-goodbye
      params:
      - name: username
        value: $(tt.params.username)

The PipelineRun object that you created in the previous tutorial is now included in the template declaration. This trigger expects the username parameter to be available; if it’s not, it assigns a default value: “Kubernetes”.

Apply the TriggerTemplate to your cluster:
```
kubectl apply -f trigger-template.yaml
```

Create a TriggerBinding

A TriggerBinding executes the TriggerTemplate, the same way you had to create a PipelineRun to execute the Pipeline.

Create a file named trigger-binding.yaml with the following content:

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerBinding
metadata:
  name: hello-binding
spec: 
  params:
  - name: username
    value: $(body.username)

This TriggerBinding gets some information and saves it in the username variable.

Apply the TriggerBinding:
```
kubectl apply -f trigger-binding.yaml
```

Create an EventListener

The EventListener object encompasses both the TriggerTemplate and the TriggerBinding.

Create a file named event-listener.yaml and add the following:

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: hello-listener
spec:
  serviceAccountName: tekton-robot
  triggers:
    - name: hello-trigger 
      bindings:
      - ref: hello-binding
      template:
        ref: hello-template

This declares that when an event is detected, it will run the TriggerBinding and the TriggerTemplate.

The EventListener requires a service account to run. To create the service account for this example create a file named rbac.yaml and add the following:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-robot
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: triggers-example-eventlistener-binding
subjects:
- kind: ServiceAccount
  name: tekton-robot
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-roles
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: triggers-example-eventlistener-clusterbinding
subjects:
- kind: ServiceAccount
  name: tekton-robot
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-clusterroles

This service account allows the EventListener to create PipelineRuns.

Apply the file to your cluster:
```
kubectl apply -f rbac.yaml
```

Running the Trigger

You have everything you need to run this Trigger and start listening for events.

Create the EventListener:
```
kubectl apply -f event-listener.yaml
```

To communicate outside the cluster, enable port-forwarding:

kubectl port-forward service/el-hello-listener 8080

The output confirms that port-forwarding is working:

kubectl port-forward service/el-hello-listener 8080
Forwarding from 127.0.0.1:8080 -> 8080
Forwarding from [::1]:8080 -> 8080

Keep this service running, don’t close the terminal.

Monitor the Trigger

Now that the EventListener is running, you can send an event and see what happens:

Open a new terminal and submit a payload to the cluster:

curl -v \
   -H 'content-Type: application/json' \
   -d '{"username": "Tekton"}' \
   http://localhost:8080

You can change “Tekton” for any string you want. This value will be ultimately read by the goodbye-world Task.

The response is successful:

< HTTP/1.1 202 Accepted
< Content-Type: application/json
< Date: Mon, 21 Jul 2025 22:03:34 GMT
< Content-Length: 164
<
{"eventListener":"hello-listener","namespace":"default","eventListenerUID":"c2905e72-8036-4f6a-b26e-f390e8615b76","eventID":"8747199c-b96e-488c-9c44-d43b368b877b"}
* Connection #0 to host localhost left intact

This event triggers a PipelineRun, check the PipelineRuns on your cluster :

kubectl get pipelineruns

The output confirms the pipeline is working:

NAME                      SUCCEEDED   REASON      STARTTIME   COMPLETIONTIME
hello-goodbye-run         True        Succeeded   6m24s       6m2s
hello-goodbye-run-r4qg4   True        Succeeded   44s         34s

You see two PipelineRuns, the first one created in the previous guide, the last one was created by the Trigger.

Check the PipelineRun logs. The name is auto-generated adding a suffix for every run, in this case it’s hello-goodbye-run-8hckl. Use your own PiepelineRun name in the following command to see the logs:
```
tkn pipelinerun logs --last -f
```
And you get the expected output:
```
[hello : echo] Hello World

[goodbye : goodbye] Goodbye Tekton!
```
Both Tasks completed successfuly. Congratulations!

Clean up

Press Ctrl + C in the terminal running the port-forwarding process to stop it.
Delete the cluster:
```
minikube delete
```
The output confirms that the cluster was deleted:

🔥 Deleting “minikube” in qemu2 … 💀 Removed all traces of the “minikube” cluster. ```

Docs: Getting Started Supply Chain Security

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows you how to:

Create a Pipeline to build and push a container image to a local registry.
Record and sign provenance of the image.
Read back the provenance information.
Verify the signature.

Prerequisites

Install minikube. Only complete the step 1, “Installation”.
Install kubectl.
Install tkn, the Tekton CLI.
Install jq.
Install cosign.

Start minikube with a local registry enabled

Delete any previous clusters:
```
minikube delete
```

Start up minikube with insecure registry enabled:

minikube start --insecure-registry "10.0.0.0/24"

The process takes a few seconds, you see an output similar to the following, depending on the minikube driver that you are using:

😄  minikube v1.36.0 on Darwin 15.5 (arm64)
✨  Using the qemu2 driver based on existing profile
👍  Starting "minikube" primary control-plane node in "minikube" cluster
🏃  Updating the running qemu2 "minikube" VM ...
📦  Preparing Kubernetes v1.33.1 on containerd 1.7.23 ...
🔗  Configuring bridge CNI (Container Networking Interface) ...
🔎  Verifying Kubernetes components...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟  Enabled addons: default-storageclass, storage-provisioner
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

Enable the local registry plugin:

minikube addons enable registry

The output confirms that the registry plugin is enabled:

💡  registry is an addon maintained by minikube. For any concerns contact minikube on GitHub.
You can view the list of minikube maintainers at: https://github.com/kubernetes/minikube/blob/master/OWNERS
    ▪ Using image gcr.io/k8s-minikube/kube-registry-proxy:0.0.9
    ▪ Using image docker.io/registry:3.0.0
🔎  Verifying registry addon...
🌟  The 'registry' addon is enabled

Now you can push images to a registry within your minikube cluster.

Install and configure the necessary Tekton components

Install Tekton Pipelines:

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml

Monitor the installation:

kubectl get po -n tekton-pipelines -w

When both tekton-pipelines-controller and tekton-pipelines-webhook show 1/1 under the READY column, you are ready to continue. For example:

NAME                                          READY   STATUS    RESTARTS   AGE
tekton-events-controller-786b59d5cd-jt7d9     1/1     Running   0          2m
tekton-pipelines-controller-59b6cdbbc-2kw2w   1/1     Running   0          2m
tekton-pipelines-webhook-74b5cdfcc4-g4qj2     1/1     Running   0          2m

Hit Ctrl + C to stop monitoring.

Install Tekton Chains:

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml

Monitor the installation

kubectl get po -n tekton-chains -w

When tekton-chains-controller shows 1/1 under the READY column, you are ready to continue. For example:

NAME                                        READY   STATUS    RESTARTS   AGE
tekton-chains-controller-7dccbf8fc7-9wdkl   1/1     Running   0          38s

Hit Ctrl + C to stop monitoring.

Configure Tekton Chains to store the provenance metadata locally:

kubectl patch configmap chains-config -n tekton-chains \
-p='{"data":{"artifacts.oci.storage": "", "artifacts.taskrun.format":"in-toto", "artifacts.taskrun.storage": "tekton"}}'

The output confirms that the configuration was updated successfully:

configmap/chains-config patched

Generate a key pair to sign the artifact provenance:
```
cosign generate-key-pair k8s://tekton-chains/signing-secrets
```
You are prompted to enter a password for the private key. For this guide, leave the password empty and press Enter twice. A public key, cosign.pub, is created in your current directory.

Build and push a container image

Create a file called pipeline.yaml and add the following:

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: build-push
spec:
  params:
    - name: image-reference
      type: string
  results:
    - name: image-ARTIFACT_OUTPUTS
      description: Built artifact.
      value:
        uri: $(tasks.kaniko-build.results.IMAGE_URL)
        digest: sha1:$(tasks.kaniko-build.results.IMAGE_DIGEST)
  workspaces:
    - name: shared-data
  tasks:
    - name: dockerfile
      taskRef:
        name: create-dockerfile
      workspaces:
        - name: source
          workspace: shared-data
    - name: kaniko-build
      runAfter: ["dockerfile"]
      taskRef:
        name: kaniko
      workspaces:
        - name: source
          workspace: shared-data
      params:
        - name: IMAGE
          value: $(params.image-reference)
---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: create-dockerfile
spec:
  workspaces:
    - name: source
  steps:
    - name: add-dockerfile
      workingDir: $(workspaces.source.path)
      image: docker.io/bash:5.3.0@sha256:6a3e1c2ddbdee552cd69ad8244eee84ad6cc00049c338f700ef5ef247be16f7b
      script: |
        cat <<EOF > $(workspaces.source.path)/Dockerfile
        FROM alpine:3.22
        RUN echo "hello world" > hello.log
        EOF        
---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: kaniko
  labels:
    app.kubernetes.io/version: "0.6"
  annotations:
    tekton.dev/pipelines.minVersion: "0.17.0"
    tekton.dev/categories: Image Build
    tekton.dev/tags: image-build
    tekton.dev/displayName: "Build and upload container image using Kaniko"
    tekton.dev/platforms: "linux/amd64,linux/arm64,linux/ppc64le"
spec:
  description: >-
    This Task builds a simple Dockerfile with kaniko and pushes to a registry.
    This Task stores the image name and digest as results, allowing Tekton Chains to pick up
    that an image was built & sign it.    
  params:
    - name: IMAGE
      description: Name (reference) of the image to build.
    - name: DOCKERFILE
      description: Path to the Dockerfile to build.
      default: ./Dockerfile
    - name: CONTEXT
      description: The build context used by Kaniko.
      default: ./
    - name: EXTRA_ARGS
      type: array
      default: []
    - name: BUILDER_IMAGE
      description: The image on which builds will run (default is v1.24.0)
      default: gcr.io/kaniko-project/executor:v1.24.0@sha256:4e7a52dd1f14872430652bb3b027405b8dfd17c4538751c620ac005741ef9698
  workspaces:
    - name: source
      description: Holds the context and Dockerfile
    - name: dockerconfig
      description: Includes a docker `config.json`
      optional: true
      mountPath: /kaniko/.docker
  results:
    - name: IMAGE_DIGEST
      description: Digest of the image just built.
    - name: IMAGE_URL
      description: URL of the image just built.
  steps:
    - name: build-and-push
      workingDir: $(workspaces.source.path)
      image: $(params.BUILDER_IMAGE)
      args:
        - $(params.EXTRA_ARGS)
        - --dockerfile=$(params.DOCKERFILE)
        - --context=$(workspaces.source.path)/$(params.CONTEXT) # The user does not need to care the workspace and the source.
        - --destination=$(params.IMAGE)
        - --digest-file=$(results.IMAGE_DIGEST.path)
      # kaniko assumes it is running as root, which means this example fails on platforms
      # that default to run containers as random uid (like OpenShift). Adding this securityContext
      # makes it explicit that it needs to run as root.
      securityContext:
        runAsUser: 0
    - name: write-url
      image: docker.io/bash:5.3.0@sha256:6a3e1c2ddbdee552cd69ad8244eee84ad6cc00049c338f700ef5ef247be16f7b
      script: |
        set -e
        image="$(params.IMAGE)"
        echo -n "${image}" | tee "$(results.IMAGE_URL.path)"

Get your cluster IPs:

kubectl get service --namespace kube-system

This shows the IPs of the services on your cluster:

NAME       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE
kube-dns   ClusterIP   10.96.0.10      <none>        53/UDP,53/TCP,9153/TCP   48m
registry   ClusterIP   10.101.134.48   <none>        80/TCP,443/TCP           47m

Save your registry IP, in this case 10.101.134.48, for the next step.

Create a file called pipelinerun.yaml and add the following:

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  generateName: build-push-run-
spec: 
  pipelineRef:
    name: build-push
  params:
  - name: image-reference
    value: <registry-ip>/tekton-test
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi

Replace <registry-ip> with the value from the previous step.

Apply the Pipeline to your cluster:

kubectl apply -f pipeline.yaml

You see the following output:

pipeline.tekton.dev/build-push created
task.tekton.dev/create-dockerfile created
task.tekton.dev/kaniko created

Run the Pipeline:

kubectl create -f pipelinerun.yaml

A new PipelineRun with a unique name is created:

pipelinerun.tekton.dev/build-push-run-q22b5 created

Monitor the execution:

tkn pr logs --last -f

The output shows the Pipeline completed successfully:

[kaniko-build : build-and-push] 2025/07/21 22:19:13 ERROR failed to get CPU variant os=linux error="getCPUVariant for OS linux: not implemented"
[kaniko-build : build-and-push] INFO[0000] Retrieving image manifest alpine:3.22
[kaniko-build : build-and-push] INFO[0000] Retrieving image alpine:3.22 from registry index.docker.io
[kaniko-build : build-and-push] INFO[0002] Built cross stage deps: map[]
[kaniko-build : build-and-push] INFO[0002] Retrieving image manifest alpine:3.22
[kaniko-build : build-and-push] INFO[0002] Returning cached image manifest
[kaniko-build : build-and-push] INFO[0002] Executing 0 build triggers
[kaniko-build : build-and-push] INFO[0002] Building stage 'alpine:3.22' [idx: '0', base-idx: '-1']
[kaniko-build : build-and-push] INFO[0002] Unpacking rootfs as cmd RUN echo "hello world" > hello.log requires it.
[kaniko-build : build-and-push] INFO[0005] RUN echo "hello world" > hello.log
[kaniko-build : build-and-push] INFO[0005] Initializing snapshotter ...
[kaniko-build : build-and-push] INFO[0005] Taking snapshot of full filesystem...
[kaniko-build : build-and-push] INFO[0005] Cmd: /bin/sh
[kaniko-build : build-and-push] INFO[0005] Args: [-c echo "hello world" > hello.log]
[kaniko-build : build-and-push] INFO[0005] Running: [/bin/sh -c echo "hello world" > hello.log]
[kaniko-build : build-and-push] INFO[0005] Taking snapshot of full filesystem...
[kaniko-build : build-and-push] INFO[0005] Pushing image to 10.99.166.178/tekton-test
[kaniko-build : build-and-push] INFO[0007] Pushed 10.99.166.178/tekton-test@sha256:3254d61ef67ceb4dd7906b14bb070c00fa039d70ccebb116f08d4f22127f1cf7

[kaniko-build : write-url] 10.99.166.178/tekton-test

Retrieve and verify the artifact provenance

Tekton Chains silently monitored the execution of the PipelineRun. It recorded and signed the provenance metadata, information about the container that the PipelineRun built and pushed.

Get the PipelineRun UID:

export PR_UID=$(tkn pr describe --last -o  jsonpath='{.metadata.uid}')

Fetch the metadata and store it in a JSON file:

tkn pr describe --last \
-o jsonpath="{.metadata.annotations.chains\.tekton\.dev/signature-pipelinerun-$PR_UID}" \
| base64 -d > metadata.json

View the provenance:

cat metadata.json | jq -r '.payload' | base64 -d | jq .

The output contains a detailed description of the build:

{
  "_type": "https://in-toto.io/Statement/v0.1",
  "predicateType": "https://slsa.dev/provenance/v0.2",
  "predicate": {
    "buildConfig": {
      "tasks": [
        {
          "finishedOn": "2025-07-21T22:19:09Z",
          "invocation": {
            "configSource": {},
            "environment": {
              "annotations": {
                "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-d220f05d1d",
                "pipeline.tekton.dev/release": "18736c3"
              },
              "labels": {
                "app.kubernetes.io/managed-by": "tekton-pipelines",
                "tekton.dev/memberOf": "tasks",
                "tekton.dev/pipeline": "build-push",
                "tekton.dev/pipelineRun": "build-push-run-qpfnf",
                "tekton.dev/pipelineRunUID": "32553c89-e8a8-4c28-81fd-2425433064c8",
                "tekton.dev/pipelineTask": "dockerfile",
                "tekton.dev/task": "create-dockerfile"
              }
            },
            "parameters": {}
          },
          "name": "dockerfile",
          "ref": {
            "kind": "Task",
            "name": "create-dockerfile"
          },
          "serviceAccountName": "default",
          "startedOn": "2025-07-21T22:19:02Z",
          "status": "Succeeded",
          "steps": [
            {
              "annotations": null,
              "arguments": null,
              "entryPoint": "cat <<EOF > /workspace/source/Dockerfile\nFROM alpine:3.22\nRUN echo \"hello world\" > hello.log\nEOF\n",
              "environment": {
                "container": "add-dockerfile",
                "image": "oci://docker.io/library/bash@sha256:6a3e1c2ddbdee552cd69ad8244eee84ad6cc00049c338f700ef5ef247be16f7b"
              }
            }
          ]
        },
        {
          "after": [
            "dockerfile"
          ],
          "finishedOn": "2025-07-21T22:19:24Z",
          "invocation": {
            "configSource": {},
            "environment": {
              "annotations": {
                "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-d220f05d1d",
                "pipeline.tekton.dev/release": "18736c3",
                "tekton.dev/categories": "Image Build",
                "tekton.dev/displayName": "Build and upload container image using Kaniko",
                "tekton.dev/pipelines.minVersion": "0.17.0",
                "tekton.dev/platforms": "linux/amd64,linux/arm64,linux/ppc64le",
                "tekton.dev/tags": "image-build"
              },
              "labels": {
                "app.kubernetes.io/managed-by": "tekton-pipelines",
                "app.kubernetes.io/version": "0.6",
                "tekton.dev/memberOf": "tasks",
                "tekton.dev/pipeline": "build-push",
                "tekton.dev/pipelineRun": "build-push-run-qpfnf",
                "tekton.dev/pipelineRunUID": "32553c89-e8a8-4c28-81fd-2425433064c8",
                "tekton.dev/pipelineTask": "kaniko-build",
                "tekton.dev/task": "kaniko"
              }
            },
            "parameters": {
              "BUILDER_IMAGE": "gcr.io/kaniko-project/executor:v1.24.0@sha256:4e7a52dd1f14872430652bb3b027405b8dfd17c4538751c620ac005741ef9698",
              "CONTEXT": "./",
              "DOCKERFILE": "./Dockerfile",
              "EXTRA_ARGS": [],
              "IMAGE": "10.99.166.178/tekton-test"
            }
          },
          "name": "kaniko-build",
          "ref": {
            "kind": "Task",
            "name": "kaniko"
          },
          "results": [
            {
              "name": "IMAGE_DIGEST",
              "type": "string",
              "value": "sha256:3254d61ef67ceb4dd7906b14bb070c00fa039d70ccebb116f08d4f22127f1cf7"
            },
            {
              "name": "IMAGE_URL",
              "type": "string",
              "value": "10.99.166.178/tekton-test"
            }
          ],
          "serviceAccountName": "default",
          "startedOn": "2025-07-21T22:19:09Z",
          "status": "Succeeded",
          "steps": [
            {
              "annotations": null,
              "arguments": [
                "--dockerfile=./Dockerfile",
                "--context=/workspace/source/./",
                "--destination=10.99.166.178/tekton-test",
                "--digest-file=/tekton/results/IMAGE_DIGEST"
              ],
              "entryPoint": "",
              "environment": {
                "container": "build-and-push",
                "image": "oci://gcr.io/kaniko-project/executor@sha256:4e7a52dd1f14872430652bb3b027405b8dfd17c4538751c620ac005741ef9698"
              }
            },
            {
              "annotations": null,
              "arguments": null,
              "entryPoint": "set -e\nimage=\"10.99.166.178/tekton-test\"\necho -n \"${image}\" | tee \"/tekton/results/IMAGE_URL\"\n",
              "environment": {
                "container": "write-url",
                "image": "oci://docker.io/library/bash@sha256:6a3e1c2ddbdee552cd69ad8244eee84ad6cc00049c338f700ef5ef247be16f7b"
              }
            }
          ]
        }
      ]
    },
    "buildType": "tekton.dev/v1beta1/PipelineRun",
    "builder": {
      "id": "https://tekton.dev/chains/v2"
    },
    "invocation": {
      "configSource": {},
      "environment": {
        "labels": {
          "tekton.dev/pipeline": "build-push"
        }
      },
      "parameters": {
        "image-reference": "10.99.166.178/tekton-test"
      }
    },
    "materials": [
      {
        "digest": {
          "sha256": "6a3e1c2ddbdee552cd69ad8244eee84ad6cc00049c338f700ef5ef247be16f7b"
        },
        "uri": "oci://docker.io/library/bash"
      },
      {
        "digest": {
          "sha256": "4e7a52dd1f14872430652bb3b027405b8dfd17c4538751c620ac005741ef9698"
        },
        "uri": "oci://gcr.io/kaniko-project/executor"
      }
    ],
    "metadata": {
      "buildFinishedOn": "2025-07-21T22:19:24Z",
      "buildStartedOn": "2025-07-21T22:19:02Z",
      "completeness": {
        "environment": false,
        "materials": false,
        "parameters": false
      },
      "reproducible": false
    }
  }
}

To verify that the metadata hasn’t been tampered with, check the signature with cosign:

cosign verify-blob-attestation --insecure-ignore-tlog \
--key k8s://tekton-chains/signing-secrets --signature metadata.json \
--type slsaprovenance --check-claims=false /dev/null

The output confirms that the signature is valid:

Verified OK

Docs: Getting Started with Pipelines-as-Code

Mon, 01 Jan 0001 00:00:00 +0000

Tekton – Getting Started

Docs: Getting started with Tasks

Prerequisites

Create a Kubernetes cluster

Install Tekton Pipelines

Create and run a basic Task

Cleanup

Further Reading:

Docs: Getting Started with Pipelines

Prerequisites

Create and run a second Task

Create and run a Pipeline

Cleanup

Further reading

Docs: Getting Started with Triggers

Before you begin

Overview

Install Tekton Triggers

Create a TriggerTemplate

Create a TriggerBinding

Create an EventListener

Running the Trigger

Monitor the Trigger

Clean up

Further reading

Docs: Getting Started Supply Chain Security

Prerequisites

Start minikube with a local registry enabled

Install and configure the necessary Tekton components

Build and push a container image

Retrieve and verify the artifact provenance

Further reading

Docs: Getting Started with Pipelines-as-Code