Install Tekton Pipelines

Before you proceed, create or select a project on Google Cloud and install the gcloud CLI on your computer.

To install Tekton Pipelines:

1. Enable the Google Kubernetes Engine (GKE) API:

   gcloud services enable container.googleapis.com
   

2. Create a cluster with Workload Identity enabled. For example:

   gcloud container clusters create tekton-cluster \
     --num-nodes=<nodes> \
     --region=<location> \
     --workload-pool=<project-id>.svc.id.goog
   

   Where:

   • <location> is the cluster location. For example, us-central1. See the documentation about regional and zonal clusters for more information.

   • <project-id> is the project ID.

   • <nodes> is the number of nodes.

   Workload Identity allows your GKE cluster to access Google Cloud services using an Identity Access Management (IAM) service account. For example, the Tekton build and push guide explains how to authenticate to Artifact Registry on a cluster with Workload Identity enabled.

   You can also enable Workload Idenitity on an existing cluster.

3. Follow the regular Kubernetes installation steps.

Private clusters

If you are running a private cluster and experience problems with GKE DNS resolution, allow the port 8443 in your firewall rules.

gcloud compute firewall-rules update <firewall_rule_name> --allow tcp:8443

See the documentation about firewall rules for private clusters for more information.

Autopilot

If you are using Autopilot mode on your GKE cluster and experience some problems, try the following:

1. Allow port 8443 in your firewall rules.

   gcloud compute firewall-rules update <firewall_rule_name> --allow tcp:8443
   

2. Disable the affinity assistant.

   kubectl patch cm feature-flags -n tekton-pipelines \
     -p '{"data":{"disable-affinity-assistant":"true"}}'
   

3. Increase the ephemeral storage.

To install Tekton Pipelines on OpenShift, you must first apply the anyuid security context constraint to the tekton-pipelines-controller service account. This is required to run the webhook Pod. See Security Context Constraints for more information.

1. Log on as a user with cluster-admin privileges. The following example uses the default system:admin user:

   oc login -u system:admin
   

2. Set up the namespace (project) and configure the service account:

   oc new-project tekton-pipelines
   oc adm policy add-scc-to-user anyuid -z tekton-pipelines-controller
   oc adm policy add-scc-to-user anyuid -z tekton-pipelines-webhook
   

3. Install Tekton Pipelines:

   Because OpenShift uses random user id (and user id range per namespace) for pods, we need to remove the securityContext.runAsUser and securityContext.runAsGroup from any container from the release.yaml. You will need to have yq installed for this to work. Another way would be to download the yaml, search and replace (here replace with nothing) in your favourite editor.

   curl https://storage.googleapis.com/tekton-releases/pipeline/latest/release.notags.yaml | yq 'del(.spec.template.spec.containers[].securityContext.runAsUser, .spec.template.spec.containers[].securityContext.runAsGroup)' | oc apply -f -
   

   See the OpenShift CLI documentation for more information on the oc command.

4. Monitor the installation using the following command until all components show a Running status:

   oc get pods --namespace tekton-pipelines --watch
   

   Note: Hit CTRL + C to stop monitoring.

Congratulations! You have successfully installed Tekton Pipelines on your OpenShift environment.

To run OpenShift 4.x on your laptop (or desktop), take a look at Red Hat CodeReady Containers.