[Book] [OK!] GitOps Cookbook: 06. Cloud Native CI/CD: Tekton: 6.9 Update a Kubernetes Resource Using Kustomize and Push the Change to Git

$ cat << 'EOF' | kubectl apply -f -
apiVersion: tekton.dev/v1
kind: Task
metadata:
  annotations:
    tekton.dev/pipelines.minVersion: 0.12.1
    tekton.dev/tags: git
  name: git-update-deployment
  labels:
    app.kubernetes.io/version: '0.2'
    operator.tekton.dev/provider-type: community
spec:
  description: >-
    This Task can be used to update image digest in a Git repo using kustomize.
    It requires a secret with credentials for accessing the git repo.
  params:
    - name: GIT_REPOSITORY
      type: string
    - name: GIT_REF
      type: string
    - name: NEW_IMAGE
      type: string
    - name: NEW_DIGEST
      type: string
    - name: KUSTOMIZATION_PATH
      type: string
  results:
    - description: The commit SHA
      name: commit
  steps:

    - name: git-clone
      image: 'docker.io/alpine/git:v2.26.2'
      script: |
        rm -rf git-update-digest-workdir
        git clone $(params.GIT_REPOSITORY) -b $(params.GIT_REF) --depth 1 --single-branch --no-tags git-update-digest-workdir
      workingDir: $(workspaces.workspace.path)

    - name: update-digest
      image: 'quay.io/wpernath/kustomize-ubi:latest'
      script: |
        cd git-update-digest-workdir/$(params.KUSTOMIZATION_PATH)
        kustomize edit set image $(params.NEW_IMAGE)@$(params.NEW_DIGEST)
        echo "##########################"
        echo "### kustomization.yaml ###"
        echo "##########################"
        cat kustomization.yaml
      workingDir: $(workspaces.workspace.path)

    - name: git-commit
      image: 'docker.io/alpine/git:v2.26.2'
      script: |
        cd git-update-digest-workdir
        git config user.email "tektonbot@redhat.com"
        git config user.name "My Tekton Bot"
        git status
        git add $(params.KUSTOMIZATION_PATH)/kustomization.yaml
        git commit -m "[ci] Image digest updated"
        git push
        RESULT_SHA="$(git rev-parse HEAD | tr -d '\n')"
        EXIT_CODE="$?"
        if [ "$EXIT_CODE" != 0 ]
        then
        exit $EXIT_CODE
        fi
        # Make sure we don't add a trailing newline to the result!
        echo -n "$RESULT_SHA" > $(results.commit.path)
      workingDir: $(workspaces.workspace.path)

  workspaces:
  - description: The workspace consisting of maven project.
    name: workspace
EOF

$ cat << 'EOF' | kubectl create -f -
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: pacman-pipeline
spec:
  params:
    - default: https://github.com/gitops-cookbook/pacman-kikd.git
      name: GIT_REPO
      type: string
    - default: master
      name: GIT_REVISION
      type: string
    - default: webmakaka/pacman-kikd:latest
      name: DESTINATION_IMAGE
      type: string
    - default: .
      name: CONTEXT_DIR
      type: string
    - default: 'https://github.com/gitops-cookbook/pacman-kikd-manifests.git'
      name: CONFIG_GIT_REPO
      type: string
    - default: main
      name: CONFIG_GIT_REVISION
      type: string
  tasks:

    - name: fetch-repo
      params:
      - name: url
        value: $(params.GIT_REPO)
      - name: revision
        value: $(params.GIT_REVISION)
      - name: deleteExisting
        value: "true"
      taskRef:
        name: git-clone
      workspaces:
      - name: output
        workspace: app-source

    - name: build-app
      params:
      - name: GOALS
        value:
        - -DskipTests
        - clean
        - package
      - name: CONTEXT_DIR
        value: "$(params.CONTEXT_DIR)"
      runAfter:
      - fetch-repo
      taskRef:
        kind: Task
        name: maven
      workspaces:
      - name: maven-settings
        workspace: maven-settings
      - name: source
        workspace: app-source

    - name: build-push-image
      params:
      - name: IMAGE
        value: "$(params.DESTINATION_IMAGE)"
      runAfter:
      - build-app
      taskRef:
        kind: Task
        name: buildah
      workspaces:
      - name: source
        workspace: app-source

    - name: git-update-deployment
      params:
        - name: GIT_REPOSITORY
          value: $(params.CONFIG_GIT_REPO)
        - name: NEW_IMAGE
          value: $(params.DESTINATION_IMAGE)
        - name: NEW_DIGEST
          value: $(tasks.build-push-image.results.IMAGE_DIGEST)
        - name: KUSTOMIZATION_PATH
          value: env/dev
        - name: GIT_REF
          value: $(params.CONFIG_GIT_REVISION)
      runAfter:
        - build-push-image
      taskRef:
        kind: Task
        name: git-update-deployment
      workspaces:
        - name: workspace
          workspace: app-source
  workspaces:
    - name: app-source
    - name: maven-settings
EOF

$ cat << 'EOF' | kubectl create -f -
apiVersion: v1
kind: Secret
metadata:
  name: github-secret
  annotations:
    tekton.dev/git-0: https://github.com
type: kubernetes.io/basic-auth
stringData:
  username: YOUR_USERNAME
  password: YOUR_PASSWORD
EOF

$ cat << 'EOF' | kubectl create -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-bot-sa
secrets:
  - name: github-secret
EOF

$ cat << 'EOF' | kubectl create -f -
apiVersion: v1
kind: Pod
metadata:
  name: pvc-inspector
spec:
  volumes:
    - name: pvc-volume
      persistentVolumeClaim:
        claimName: app-source-pvc
  containers:
    - name: inspector
      image: alpine:latest
      command: ["sh", "-c", "sleep 3600"]
      volumeMounts:
        - name: pvc-volume
          mountPath: /mnt/pvc
EOF