Tekton
Tekton runs CI/CD work as Kubernetes resources. Use it when Kubernetes-native execution fits your platform and you can operate the controllers, workloads, credentials, and storage boundaries together. Begin with a task whose inputs and outputs are visible before wiring external events into a privileged release process.
A successful build step does not establish a trustworthy artifact. The event source, task definition, container image, workspace contents, and permissions all help determine what actually ran.
TL;DR
- Distinguish reusable Task/Pipeline definitions from TaskRun/PipelineRun executions.
- Declare parameters, results, and filesystem workspaces explicitly.
- Treat repository content and trigger parameters as untrusted inputs.
- Give runs only the identities and credentials their actions require.
- Verify retries, cleanup, storage, and isolation in an authorized cluster.
Quick Example
This two-document example requires installed Tekton Pipelines CRDs, an existing isolated ci-demo namespace, and an approved task-runner ServiceAccount. It writes one fictional greeting into a run-local workspace. The BusyBox tag is illustrative; review and pin an approved image digest for a real pipeline. No cluster apply or image pull was performed here.
After an authorized test run, inspect completion and the intended output while the workspace remains available; emptyDir is temporary, not an artifact archive. The parameter enters a quoted environment variable rather than being interpolated as shell code. YAML parsing alone does not validate CRD admission, image availability, permissions, or execution.
Core Concepts
Definitions and executions are separate
A Task describes ordered steps; a TaskRun binds inputs and runs them. Pipelines compose Tasks with dependencies, while PipelineRuns supply an execution's bindings. The Task reference describes the resource model and step behavior. Keep the definition revision and image identity with the artifact so a later investigation can establish provenance.
Workspaces are storage contracts
Tasks declare filesystem requirements and runs choose their bindings. The workspace guide covers temporary storage, persistent volumes, ConfigMaps, and Secrets. An emptyDir in one Task's Pod does not become a shared persistent filesystem across every Task in a Pipeline. Choose the binding and lifecycle required by the actual data handoff.
Events introduce another boundary
Tekton Triggers uses resources such as EventListeners, bindings, templates, and interceptors to turn events into runs. The Triggers overview describes that composition. Authenticate the event and constrain the resulting parameters and resource selection before allowing it to reach a release capability.
Review the Pipeline as an Execution Chain
This is a proposed review route. Separate untrusted pull-request builds from credentialed release work, with a controlled promotion boundary. Passing a token through a workspace can expose it to code that was never meant to receive it. Review mounts, logs, environment variables, and persistent volume reuse as potential credential and data paths.
Make dependencies explicit. A shared filesystem does not itself specify task order, and task order does not establish file integrity. Use declared dependencies and suitable result or artifact handoffs, then test what happens when an upstream task fails or a run is retried.
Operate the underlying Kubernetes path as well: scheduling, image pulls, resource limits, controller availability, and cleanup affect CI completion. A pending Pod can consume the delivery deadline without executing a single command. Observe queue-to-finish time and failure classification rather than reporting only step duration.
Best Practices
Keep parameter handling out of shell syntax
Prefer quoted environment variables or structured arguments for untrusted strings. Test spaces and shell metacharacters in an isolated task. The teaching example illustrates one boundary; it is not a complete policy for every interpreter or build tool.
Scope credentials to the action
Build, test, signing, publishing, and deployment need different capabilities. Avoid handing a broad release identity to arbitrary repository scripts. Review the selected ServiceAccount and mounted credentials before running a privileged task.
Verify cleanup and retries
Check temporary and persistent storage after completion, cancellation, and failure. Decide which artifacts must survive and which contents must not leak into another run. Retry behavior must preserve operation identity when an external side effect may already have occurred.
Common Mistakes
Bad: Assume a workspace is an immutable artifact.
Correct: Protect and verify the handoff according to its trust and integrity requirements.
Bad: Interpolate a webhook field directly into shell code.
Correct: Pass constrained data through a suitable quoted or structured input boundary.
Bad: Use one privileged ServiceAccount for every branch.
Correct: Separate untrusted execution and release capabilities with reviewed identities and promotion rules.
FAQ
Does Tekton replace Kubernetes operations?
It adds pipeline abstractions on Kubernetes. Scheduling, storage, identity, controller health, and workload isolation still need owners.
Can emptyDir share data across all Pipeline Tasks?
It belongs to a Pod lifecycle. Select a supported cross-Task storage or artifact mechanism and test the actual binding.
Does this example publish anything?
No. It only describes a greeting-writing task; no cluster mutation or external release ran.
What should be checked before adoption?
Exercise a real build, failed step, cancellation, retry, storage cleanup, and denied credential action in an authorized test cluster.
Related Topics
- CI/CD Pipelines — Place Tasks in a delivery workflow.
- Kubernetes — Understand execution and identity boundaries.
- Software Supply Chain Security — Review artifact provenance and privileged actions.