Tekton – How-to Guides

Docs: Clone a git repository with Tekton

Mon, 01 Jan 0001 00:00:00 +0000

This guide shows you how to:

Create a Task to clone source code from a git repository.
Create a second Task to read the source code from a shared Workspace.

If you are already familiar with Tekton and just want to see the example, you can skip to the full code samples.

Prerequisites

To follow this How-to you must have a Kubernetes cluster up and running and kubectl properly configured to issue commands to your cluster.

Install Tekton Pipelines:

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml

See the Pipelines installation documentation for other installation options.

Install the Tekton CLI, tkn, on your machine.

If this is your first time using Tekton Pipelines, we recommend that you complete the Getting Started tutorials before proceeding with this guide.

Pull source code from git

In this section you are going to create a Pipeline containing a Task to pull code from a git repository.

Create the Pipeline

One practical aspect of Tekton Tasks and Pipelines is that they are reusable. There’s a community hub with a curated list of Pipelines and Tasks that you can include in your own CI/CD workflow. You are going to reuse one of those Tasks in this guide.

Create a new Pipeline, pipeline.yaml:
```
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: clone-read
```
The name clone-read is going to be used by the PipelineRun to refer to this Pipeline. This name can also be used with the CLI, to check logs, delete the pipeline, etc.

Add the repository URL to the list of Pipeline parameters:

spec:
  description: | 
    This pipeline clones a git repo, then echoes the README file to the stdout.
  params:
  - name: repo-url
    type: string
    description: The git repo URL to clone from.

The params section contains a list of parameters to be used by the Tasks in this Pipeline. For now there is only one, repo-url.

Add a Workspace, a shared volume to store the code this task is going to download:

workspaces:
- name: shared-data
  description: | 
    This workspace contains the cloned repo files, so they can be read by the
    next task.

Create the Task that is going to use the parameter and the Workplace that you just defined:
```
tasks:
- name: fetch-source
  taskRef:
    name: git-clone
  workspaces:
  - name: output
    workspace: shared-data
  params:
  - name: url
    value: $(params.repo-url)
```
This Task, fetch-source, refers to another Task, git-clone; to be installed from the community hub. A Task has its own params and workspaces passed down from the ones defined at Pipeline level. In this case, the names for the parameter url and the Workspace output are the the ones expected by the git clone Task spec. See the git clone documentation for more parameters and options.

Check the full code samples to see how all the pieces fit together in the file.

Create the PipelineRun

Now that you have a Pipeline, to instantiate it and set the actual values, create a PipelineRun, pipelinerun.yaml:

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: clone-read-run-
spec:
  pipelineRef:
    name: clone-read
  podTemplate:
    securityContext:
      fsGroup: 65532

This PipelineRun instantiates clone-read, as specified by the pipelineRef target in the spec section.

Instantiate the Workspace:

workspaces:
- name: shared-data
  volumeClaimTemplate:
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi

This creates a Persistent Volume Claim to store the cloned files. The name shared-data matches the name used in the Pipeline.

Set the value of the repository URL parameter:
```
params:
- name: repo-url
  value: https://github.com/tektoncd/website
```
For this example you are going to clone the Tekton documentation website source code.

Check the full code samples to see full PipelineRun code.

Git authentication

For the sake of this example, we are using a public repository, which requires no authentication. If you want to clone a private repository, you must create a Kubernetes Secret with your credentials, then pass that secret to your Task as a Workspace.

Before you proceed, you have to set up SSH authentication with your git provider. The process may be slightly different in each case:

The following steps show you how to authenticate using an SSH key. For other forms of authentication check the git-clone Task documentation and the Git authentication section in the Pipelines documentation.

Create a Kubernetes Secret with your credentials, for example:
```
apiVersion: v1
kind: Secret
metadata:
  name: git-credentials
data:
  id_rsa: AS0tLS...
  known_hosts: AG033S...
  config: GS0FFL...
```
The values for the fields under data are the corresponding base64-encoded files in the .ssh directory. For example, for id_rsa copy-paste the output of:
```
cat ~/.ssh/id_rsa | base64 -w0
```

Update pipeline.yaml, add a new Workspace to both the Pipeline and the Task:

workspaces:
- name: shared-data
  description: | 
    This workspace contains the cloned repo files, so they can be read by the
    next task.
- name: git-credentials
  description: My ssh credentials
tasks:
- name: fetch-source
  taskRef:
    name: git-clone
  workspaces:
  - name: output
    workspace: shared-data
  - name: ssh-directory
    workspace: git-credentials

The Workspace git-credentials is defined at Pipeline level and then passed down to the Task as ssh-directory, which is the name the Task expects.

Update pipelinerun.yaml to use the Secret as a Workspace and change the git URL from https to SSH:

workspaces:
- name: shared-data
  volumeClaimTemplate:
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
- name: git-credentials
  secret:
    secretName: git-credentials
params:
- name: repo-url
  value: git@github.com:tektoncd/website.git

The new Workspace name, git-credentials, matches the Workspace added to the Pipeline.

Use the source code in a second task

To learn how to share data between Tasks using a Workspace, you are going to create a second Task that displays the README file from the cloned git repository. You can find more useful examples in the How-to section and the examples folder in the Pipelines git repository.

Add a new entry to the tasks section of pipeline.yaml:
```
- name: show-readme
  runAfter: ["fetch-source"]
  taskRef:
    name: show-readme
  workspaces:
  - name: source
    workspace: shared-data
```
This is referencing the Task show-readme. Unlike git clone, this Task is not from the Tekton community hub, you have to create it yourself.

Create a file called show-readme.yaml and add the following:

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: show-readme
spec:
  description: Read and display README file.
  workspaces:
  - name: source
  steps:
  - name: read
    image: alpine:latest
    script: | 
      #!/usr/bin/env sh
      cat $(workspaces.source.path)/README.md

This Task uses a Workspace that was already set. You don’t have to update pipelinerun.yaml.

Run the Pipeline

Install a Task from Tekton Hub

To use the git clone Task in your pipeline, you have to install it on your cluster first. You can do this with the tkn command:

tkn hub install task git-clone

Or using kubectl:

kubectl apply -f \
https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.6/git-clone.yaml

Alternatively, you can bundle a Task or a Pipeline and let your Pipeline fetch it directly from a registry.

Apply the files

Now you are ready to test the code.

Apply the show-readme Task:
```
kubectl apply -f show-readme.yaml
```
Apply the Pipeline:
```
kubectl apply -f pipeline.yaml
```

Create the PipelineRun:

kubectl create -f pipelinerun.yaml

This creates a PipelineRun with a unique name each time:

pipelinerun.tekton.dev/clone-read-run-4kgjr created

Use the PipelineRun name from the output of the previous step to monitor the Pipeline execution:

tkn pipelinerun logs  clone-read-run-4kgjr -f

You may have to wait a few seconds. The output confirms that the respository was cloned succesfully and displays the README file at the end:

[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + CHECKOUT_DIR=/workspace/output/
[fetch-source : clone] + '[' true '=' true ]
[fetch-source : clone] + cleandir
[fetch-source : clone] + '[' -d /workspace/output/ ]
[fetch-source : clone] + rm -rf '/workspace/output//*'
[fetch-source : clone] + rm -rf '/workspace/output//.[!.]*'
[fetch-source : clone] + rm -rf '/workspace/output//..?*'
[fetch-source : clone] + test -z 
[fetch-source : clone] + test -z 
[fetch-source : clone] + test -z 
[fetch-source : clone] + /ko-app/git-init '-url=https://github.com/tektoncd/website' '-revision=' '-refspec=' '-path=/workspace/output/' '-sslVerify=true' '-submodules=true' '-depth=1' '-sparseCheckoutDirectories='
[fetch-source : clone] {"level":"info","ts":1652300245.5099113,"caller":"git/git.go:170","msg":"Successfully cloned https://github.com/tektoncd/website @ 4930334b17edeaa737e2e6d0c7f7139b0afb1896 (grafted, HEAD) in path /workspace/output/"}
[fetch-source : clone] {"level":"info","ts":1652300245.5349698,"caller":"git/git.go:208","msg":"Successfully initialized and updated submodules in path /workspace/output/"}
[fetch-source : clone] + cd /workspace/output/
[fetch-source : clone] + git rev-parse HEAD
[fetch-source : clone] + RESULT_SHA=4930334b17edeaa737e2e6d0c7f7139b0afb1896
[fetch-source : clone] + EXIT_CODE=0
[fetch-source : clone] + '[' 0 '!=' 0 ]
[fetch-source : clone] + printf '%s' 4930334b17edeaa737e2e6d0c7f7139b0afb1896
[fetch-source : clone] + printf '%s' https://github.com/tektoncd/website

[show-readme : read] # TektonCD Website
[show-readme : read] 
[show-readme : read] This repo contains the code behind [the Tekton org's](https://github.com/tektoncd)
[show-readme : read] website at [tekton.dev](https://tekton.dev).
[show-readme : read] 
[show-readme : read] For more information on the Tekton Project, see
[show-readme : read] [the community repo](https://github.com/tektoncd/community).
[show-readme : read] 
[show-readme : read] For more information on contributing to the website see:
[show-readme : read] 
[show-readme : read] * [CONTRIBUTING.md](CONTRIBUTING.md)
[show-readme : read] * [DEVELOPMENT.md](DEVELOPMENT.md)

Full code samples

The Pipeline:

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: clone-read
spec:
  description: | 
    This pipeline clones a git repo, then echoes the README file to the stout.
  params:
  - name: repo-url
    type: string
    description: The git repo URL to clone from.
  workspaces:
  - name: shared-data
    description: | 
      This workspace contains the cloned repo files, so they can be read by the
      next task.
  - name: git-credentials
    description: My ssh credentials
  tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    workspaces:
    - name: output
      workspace: shared-data
    - name: ssh-directory
      workspace: git-credentials
    params:
    - name: url
      value: $(params.repo-url)
  - name: show-readme
    runAfter: ["fetch-source"]
    taskRef:
      name: show-readme
    workspaces:
    - name: source
      workspace: shared-data

The PipelineRun:

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: clone-read-run-
spec:
  pipelineRef:
    name: clone-read
  podTemplate:
    securityContext:
      fsGroup: 65532
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
  - name: git-credentials
    secret:
      secretName: git-credentials
  params:
  - name: repo-url
    value: git@github.com:tektoncd/website.git

The show-readme Task:

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: show-readme
spec:
  description: Read and display README file.
  workspaces:
  - name: source
  steps:
  - name: read
    image: alpine:latest
    script: | 
      #!/usr/bin/env sh
      cat $(workspaces.source.path)/README.md

The Kubernetes Secret. These values are not real, check the section about git authentication to figure out how to encode your credentials.

apiVersion: v1
kind: Secret
metadata:
  name: git-credentials
data:
  id_rsa: AS0tLS...
  known_hosts: AG033S...

Docs: Build and push an image with Tekton

Mon, 01 Jan 0001 00:00:00 +0000

This page includes content about running Tekton with specific platforms and cloud providers. The accuracy and freshness of this vendor documentation varies by vendor.

If you want to contribute with platform-specific documentation, follow the vendor contributions guidelines.

This guide shows you how to:

Create a Task to clone source code from a git repository.
Create a second Task to use the cloned code to build a Docker image and push it to a registry.

If you are already familiar with Tekton and just want to see the example, you can skip to the full code samples.

Prerequisites

To follow this How-to you must have a Kubernetes cluster up and running and kubectl properly configured to issue commands to your cluster.
Install Tekton Pipelines:
```
kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
```
See the Pipelines installation documentation for other installation options and vendor specific instructions.
Install the Tekton CLI, tkn, on your machine.

If this is your first time using Tekton Pipelines, we recommend that you complete the Getting Started tutorials before proceeding with this guide.

Clone the repository

Create a new Pipeline, pipeline.yaml, that uses the git clone Task to clone the source code from a git repository:

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: clone-build-push
spec:
  description: | 
    This pipeline clones a git repo, builds a Docker image with Kaniko and
    pushes it to a registry
  params:
  - name: repo-url
    type: string
  workspaces:
  - name: shared-data
  tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    workspaces:
    - name: output
      workspace: shared-data
    params:
    - name: url
      value: $(params.repo-url)

Then create the corresponding pipelinerun.yaml file:

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: clone-build-push-run-
spec:
  pipelineRef:
    name: clone-build-push
  podTemplate:
    securityContext:
      fsGroup: 65532
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
  params:
  - name: repo-url
    value: https://github.com/google/docsy-example.git

For this how-to we are using a public repository as an example. You can also use git clone with private repositories, using SSH authentication.

Build the container image with Kaniko

To build the image use the Kaniko Task from the community hub.

Add the image reference to the params section in pipeline.yaml:
```
params: 
- name: image-reference
  type: string
```
This parameter is used to add the tag corresponding the container registry where you are going to push the image.
Create the new build-push Task in the same pipeline.yaml file:
```
tasks:
...
  - name: build-push
    runAfter: ["fetch-source"]
    taskRef:
      name: kaniko
    workspaces:
    - name: source
      workspace: shared-data
    params:
    - name: IMAGE
      value: $(params.image-reference)
```
This new Task refers to kaniko, which is going to be installed from the community hub. A Task has its own set of workspaces and params passed down from the parameters and Workspaces defined at Pipeline level. In this case, the Workspace source and the value of IMAGE. Check the kaniko Task documentation to see all the available options.
Instantiate the build-push Task. Add the value of image-reference to the params section in pipelinerun.yaml:
```
params:
- name: image-reference
  value: container.registry.com/sublocation/my_app:version
```
Replace container.registry.com/sublocation/my_app:version with the actual tag for your registry. You can set up a local registry for testing purposes.

Check the full code samples to see how all the pieces fit together.

Container registry authentication

In most cases, to push the image to a container registry you must provide authentication credentials first.

Set up authentication with the Docker credential helper and generate the Docker configuration file, $HOME/.docker/config.json, for your registry. This step is different depending on your registry.
Check your cloud provider documentation to complete this step.
Create a Kubernetes Secret, docker-credentials.yaml with your credentials:
```
apiVersion: v1
kind: Secret
metadata:
  name: docker-credentials
data:
  config.json: efuJAmF1...
```
The value of config.json is the base64-encoded ~/.docker/config.json file. You can get this data with the following command:
```
cat ~/.docker/config.json | base64 -w0
```
Update pipeline.yaml and add a Workspace to mount the credentials directory:

At the Pipeline level:
```
workspaces:
- name: docker-credentials
```
And under the build-push Task:
```
workspaces:
- name: dockerconfig
  workspace: docker-credentials
```
Instantiate the new docker-credentials Workspace in your pipelinerun.yaml file by adding a new entry under workspaces:
```
- name: docker-credentials
  secret:
    secretName: docker-credentials
```

GKE Workload Identity

If you are running your Pipelines on Google Kubernetes Engine (GKE), create a cluster with Workload Identity enabled or enable Workload Identity on an existing cluster. This allows you to to run your pipeline and push images to Artifact Registry without authentication credentials. If you are using Workload Identity, skip step 2 when you run your pipeline.

Set up an Artifact Registry repository:

Enable the Artifact Registry API:

gcloud services enable artifactregistry.googleapis.com

Create a Docker repository to push the image to:
```
gcloud artifacts repositories create <repository-name> \
  --repository-format=docker \
  --location=us-central1 --description="Docker repository"
```
Replace:
- <repository-name> with the name of your repository.
- <location> with the name of your preferred location. For example, us-central1.

Configure the GKE cluster to allow the Pipeline to push images to Artifact Registry:

Create a Kubernetes Service Account:
```
kubectl create serviceaccount <sa-name>
```
Where <sa-name> is the name of the service account. For example, tekton-sa.
Create a Google Service Account with the same name:
```
gcloud iam service-accounts create <sa-name>
```

Grant the Google Service Account permissions to push to the Artifact Registry container repository:

gcloud artifacts repositories add-iam-policy-binding <ar-repository> \
  --location <location> \
  --member=serviceAccount:build-robot@<project_id>.iam.gserviceaccount.com \
  --role=roles/artifactregistry.reader \
  --role=roles/artifactregistry.writer

Where

<ar-repository> is the name of the repository.
<location> is the repository repository location.
<project_id> is the project id.

Set up the Workload Identity mappings on the Kubernetes cluster:

kubectl annotate serviceaccount \
<sa-name> \
iam.gke.io/gcp-service-account=build-robot@<project_id>.iam.gserviceaccount.com

Set up Workload Identity mappings for the Google Service Account:

gcloud iam service-accounts add-iam-policy-binding \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:<project_id>.svc.id.goog[default/<sa-name>]" \
  build-robot@<project_id>.iam.gserviceaccount.com

This creates two service accounts, an IAM service account and a Kubernetes service account, and “links” them. Workload Identity allows workloads in your GKE cluster to impersonate IAM service accounts to access Google Cloud services.

Use Docker authentication

If you prefer to use Docker authentication to push your image to Artifact Registry, there are two options:

In both cases your credentials are saved to a Docker configuration file in your user home directory: $HOME/.docker/config.json. Use this file to follow the “General Authentication” instructions.

See the complete files in the full code samples section.

Run your Pipeline

You are ready to install the Tasks and run the pipeline.

Install the git-clone and kaniko Tasks:

tkn hub install task git-clone
tkn hub install task kaniko

Apply the Secret with your Docker credentials.
```
kubectl apply -f docker-credentials.yaml
```
Apply the Pipeline:
```
kubectl apply -f pipeline.yaml
```

Create the PipelineRun:

kubectl create -f pipelinerun.yaml

This creates a PipelineRun with a unique name each time:

pipelinerun.tekton.dev/clone-build-push-run-4kgjr created

Use the PipelineRun name from the output of the previous step to monitor the Pipeline execution:

tkn pipelinerun logs  clone-build-push-run-4kgjr -f

After a few seconds, the output confirms that the image was built and pushed successfully:

[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + '[' false '=' true ]
[fetch-source : clone] + CHECKOUT_DIR=/workspace/output/
[fetch-source : clone] + '[' true '=' true ]
[fetch-source : clone] + cleandir
[fetch-source : clone] + '[' -d /workspace/output/ ]
[fetch-source : clone] + rm -rf '/workspace/output//*'
[fetch-source : clone] + rm -rf '/workspace/output//.[!.]*'
[fetch-source : clone] + rm -rf '/workspace/output//..?*'
[fetch-source : clone] + test -z 
[fetch-source : clone] + test -z 
[fetch-source : clone] + test -z 
[fetch-source : clone] + /ko-app/git-init '-url=https://github.com/google/docsy-example.git' '-revision=' '-refspec=' '-path=/workspace/output/' '-sslVerify=true' '-submodules=true' '-depth=1' '-sparseCheckoutDirectories='
[fetch-source : clone] {"level":"info","ts":1654637310.4419358,"caller":"git/git.go:170","msg":"Successfully cloned https://github.com/google/docsy-example.git @ 1c7f7e300c90cd690ca5be66b43fe58713bb21c9 (grafted, HEAD) in path /workspace/output/"}
[fetch-source : clone] {"level":"info","ts":1654637320.384655,"caller":"git/git.go:208","msg":"Successfully initialized and updated submodules in path /workspace/output/"}
[fetch-source : clone] + cd /workspace/output/
[fetch-source : clone] + git rev-parse HEAD
[fetch-source : clone] + RESULT_SHA=1c7f7e300c90cd690ca5be66b43fe58713bb21c9
[fetch-source : clone] + EXIT_CODE=0
[fetch-source : clone] + '[' 0 '!=' 0 ]
[fetch-source : clone] + printf '%s' 1c7f7e300c90cd690ca5be66b43fe58713bb21c9
[fetch-source : clone] + printf '%s' https://github.com/google/docsy-example.git

[build-push : build-and-push] WARN
[build-push : build-and-push] User provided docker configuration exists at /kaniko/.docker/config.json 
[build-push : build-and-push] INFO Retrieving image manifest klakegg/hugo:ext-alpine 
[build-push : build-and-push] INFO Retrieving image klakegg/hugo:ext-alpine from registry index.docker.io 
[build-push : build-and-push] INFO Built cross stage deps: map[]                
[build-push : build-and-push] INFO Retrieving image manifest klakegg/hugo:ext-alpine 
[build-push : build-and-push] INFO Returning cached image manifest              
[build-push : build-and-push] INFO Executing 0 build triggers                   
[build-push : build-and-push] INFO Unpacking rootfs as cmd RUN apk add git requires it. 
[build-push : build-and-push] INFO RUN apk add git                              
[build-push : build-and-push] INFO Taking snapshot of full filesystem...        
[build-push : build-and-push] INFO cmd: /bin/sh                                 
[build-push : build-and-push] INFO args: [-c apk add git]                       
[build-push : build-and-push] INFO Running: [/bin/sh -c apk add git]            
[build-push : build-and-push] fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/main/x86_64/APKINDEX.tar.gz
[build-push : build-and-push] fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/community/x86_64/APKINDEX.tar.gz
[build-push : build-and-push] OK: 76 MiB in 41 packages
[build-push : build-and-push] INFO[0012] Taking snapshot of full filesystem...        
[build-push : build-and-push] INFO[0013] Pushing image to us-east1-docker.pkg.dev/tekton-tests/tektonstuff/docsy:v1 
[build-push : build-and-push] INFO[0029] Pushed image to 1 destinations               

[build-push : write-url] us-east1-docker.pkg.dev/my-tekton-tests/tekton-samples/docsy:v1

Full code samples

The Pipeline:

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: clone-build-push
spec:
  description: |
    This pipeline clones a git repo, builds a Docker image with Kaniko and
    pushes it to a registry    
  params:
  - name: repo-url
    type: string
  - name: image-reference
    type: string
  workspaces:
  - name: shared-data
  - name: docker-credentials
  tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    workspaces:
    - name: output
      workspace: shared-data
    params:
    - name: url
      value: $(params.repo-url)
  - name: build-push
    runAfter: ["fetch-source"]
    taskRef:
      name: kaniko
    workspaces:
    - name: source
      workspace: shared-data
    - name: dockerconfig
      workspace: docker-credentials
    params:
    - name: IMAGE
      value: $(params.image-reference)

The PipelineRun:

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: clone-build-push-run-
spec:
  pipelineRef:
    name: clone-build-push
  podTemplate:
    securityContext:
      fsGroup: 65532
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
  - name: docker-credentials
    secret:
      secretName: docker-credentials
  params:
  - name: repo-url
    value: https://github.com/google/docsy-example.git
  - name: image-reference
    value: container.registry.com/sublocation/my_app:version

The Docker credentials Kubernetes Secret:

apiVersion: v1
kind: Secret
metadata:
  name: docker-credentials
data:
  config.json: efuJAmF1...

Use your credentials as the value of the data field. Check the registry authentication section for more information.

Tekton – How-to Guides

Docs: Clone a git repository with Tekton

Prerequisites

Pull source code from git

Create the Pipeline

Create the PipelineRun

Git authentication

Use the source code in a second task

Run the Pipeline

Install a Task from Tekton Hub

Apply the files

Full code samples

Further reading

Docs: Build and push an image with Tekton

Prerequisites

Clone the repository

Build the container image with Kaniko

Container registry authentication

Run your Pipeline

Full code samples

Further reading