tekton-pipelines

Tekton Pipelines — Authoring

For installing/configuring Tekton components see tekton-operator. For Git-native CI (pipelines in .tekton/) see tekton-pac.

Kubernetes-native CI/CD. Covers tekton.dev/v1 patterns.

When to Use

• Authoring PipelineRun / TaskRun YAML
• Configuring git/cluster/hub resolvers
• Setting nodeSelector/tolerations/affinity for CI pods
• Dynamic per-task node targeting via taskRunSpecs
• Matrix + param dynamic scheduling
• CEL when expressions
• Timeout hierarchy
• finally tasks

Not for: Tekton operator install/upgrade (see tekton-operator), Pipelines-as-Code / Git-triggered CI (see tekton-pac).

Core Patterns

Resolver-Based Task Refs

Prefer resolvers over embedded TaskSpecs:

tasks:
  - name: build
    taskRef:
      resolver: git
      params:
        - name: url
          value: https://github.com/org/repo
        - name: revision
          value: main
        - name: pathInRepo
          value: ci/tasks/build.yaml

Resolvers: git, cluster, hub. See TTL section below for cache config.

Git Authentication (Private Repos)

Authenticate against private Git repositories via the ServiceAccount's secrets — Tekton's creds-init init container reads kubernetes.io/basic-auth secrets automatically and configures git before any task step runs. No workspace plumbing needed.

# 1. Create the secret with annotation targeting the host
apiVersion: v1
kind: Secret
metadata:
  name: git-creds
  annotations:
    tekton.dev/git-0: https://git.example.com  # host-wide, any repo
type: kubernetes.io/basic-auth
stringData:
  username: <user-or-bot-name>
  password: <pat-or-token>

# 2. Attach to the PipelineRun's ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default  # or a dedicated pipeline SA
secrets:
  - name: git-creds

For multiple hosts, increment the annotation index:

metadata:
  annotations:
    tekton.dev/git-0: https://github.com
    tekton.dev/git-1: https://gitlab.com