What you will need:

• Full administrator access
• Enough RAM and CPU on a cluster node to run all the pods of a single Pipelinerun on a single node. Multiple nodes increase the number of parallel PipelineRun instances. Currently one PipelineRun instance is capable of saturating a 8vCPU - 16GB RAM worker node.

1. Install latest stable Tekton Pipeline release

   kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml

2. Install Tekton Dashboard Full (the normal is read only, and doesn't allow for example to re-run).

   kubectl apply --filename https://storage.googleapis.com/tekton-releases/dashboard/latest/release-full.yaml

3. Access the dashboard

kubectl proxy

Once the proxy is active, navigate your browser to the dashboard url

   kubectl apply --filename task.yaml && kubectl apply --filename pipeline.yaml

Navigate your browser to the pipelineruns section of the dashboard

1. Click Create
2. Select the Namespace (where the Pipeline resource is created by default it is default)
3. Select the Pipeline created in the pipeline.yaml right now it is python-tracer-ci-pipeline
4. Fill in Params. The revision should be main for the main branch
5. Select the ServiceAccount set to default
6. Optionally, enter a PipelineRun name for example my-main-test-pipeline, but if you don't then the Dashboard will generate a unique one for you.
7. As long as the known issue with Tekton Dashboard Workspace binding, is not resolved. You have to go to YAML Mode and insert the workspace definition at the end of the file, with the exact same indentation:

  workspaces:
  - name: python-tracer-ci-pipeline-pvc-$(params.revision)
    volumeClaimTemplate:
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 100Mi

7. Click Create at the bottom of the page

As an alternative to using the Dashboard, you can manually edit pipelinerun.yaml and create it with:

   kubectl apply --filename pipelinerun.yaml

PipelineRuns and workspace PersistentVolume resources by default are kept indefinitely, and repeated runs might exhaust the available resources, therefore they need to be cleaned up either automatically or manually.

Navigate to PipelineRuns and check the checkbox next to the pipelinerun and then click Delete in the upper right corner.

You can use either kubectl

kubectl get pipelinerun
kubectl delete pipelinerun <selected-pipelinerun-here>

or tkn cli

tkn pipelinerun list
tkn pipelinerun delete <selected-pipelinerun-here>

Install and configure resources from https://github.com/3scale-ops/tekton-pipelinerun-cleaner

Maintain, and install the list of used images in the python-tracer-prepuller.yaml:

   kubectl apply --filename python-tracer-prepuller.yaml

The GitHub integration requires further Tekton Triggers and Interceptors to be installed

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml
kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml

Our future GitHub PR Event listener needs a service account, tekton-triggers-eventlistener-serviceaccount which authorizes it to perform operations specified in eventlistener Role and ClusteRole. Create the service account with the needed role bindings:

   kubectl apply --filename tekton-triggers-eventlistener-serviceaccount.yaml

In order to authorize the incoming webhooks into our cluster, we need to share a secret between our webhook listener, and the GitHub repo. This resource can be shared across multiple tekton Tri Generate a long, strong and random generated token, put it into github-interceptor-secret.yaml. Create the secret resource:

   kubectl apply --filename github-interceptor-secret.yaml

The GitHub PR specific Tekton pipeline will want to send data to report the PR Check Status. That GitHub API requires authentication, and therefore we need a token. The user which generates the token has to have Write access in the target repo, as part of the organisation. Check the repo access for this repo under https://github.com/instana/python-sensor/settings/access.

With the proper user:

1. Navigate to https://github.com/settings/tokens
2. Click on Generate new token dropdown Generate new token (classic).
3. Fill in Note with for example Tekton commit status,
4. Make sure if you set an expiration, than you remember to renew the token after expiry.
5. Under Select scopes find repo and below that only select the checkbox next to repo:status - Access commit status. click Generate token
6. Create the kubernetes secret with the token:

   kubectl create secret generic githubtoken --from-literal token="MY_TOKEN"

And we also make an HTTP POST with the status update data to GitHub. This is done in a Task called github-set-status, create it as such:

   kubectl apply -f github-set-status-task.yaml

Create the new pipeline, which executes the previously created python-tracer-ci-pipeline, wrapped around with GitHub Check status reporting tasks. As long as Pipelines in Pipelines, remains an unimplemented alpha feature in Tekton, we will need the yq (at least 4.0) to pull the tasks from our previous python-tracer-ci-pipeline into the new pipeline github-pr-python-tracer-ci-pipeline.

   (cat github-pr-pipeline.yaml.part && yq '{"a": {"b": .spec.tasks}}' pipeline.yaml| tail --lines=+3) | kubectl apply -f -

Once the new GitHub specific pipeline is created, we need a listener which starts a new PipelineRun based on GitHub events.

   kubectl apply --filename github-pr-eventlistener.yaml

After this ensure that there is a pod and a service created:

   kubectl get pod | grep -i el-github-pr-python-eventlistener
   kubectl get svc | grep -i el-github-pr-python-eventlistener

Do not continue if any of these missing.

You will need an ingress controller for this. On IKS you might want to read these resources:

• managed ingress
• Or unmanaged ingress controller howto.

1. Check the available ingressclass resources on your cluster

   kubectl get ingressclass

• On IKS it will be public-iks-k8s-nginx.
• On EKS with the ALB ingress controller, it might be just alb
• On self hosted nginx controller this might just be nginx.

Edit and save the value of ingressClassName: in github-webhook-ingress.yaml.

2. Find out your Ingress domain or subdomain name.

• On IKS, go to Clusters select your cluster and then click Overview. The domain name is listed under Ingress subdomain.

and create the resource:

   kubectl apply --filename github-webhook-ingress.yaml

Make sure that you can use the ingress with the /hooks path via https:

   curl https://<INGRESS_DOMAIN_NAME>/hooks

At this point this should respond this:

  {
   "eventListener":"github-pr-eventlistener",
   "namespace":"default",
   "eventListenerUID":"",
   "errorMessage":"Invalid event body format : unexpected end of JSON input"
   }

In the GitHub repo go to Settings -> Webhooks and click Add Webhook. The fields we need to set are:

• Payload URL: https://<INGRESS_DOMAIN_NAME>/hooks
• Content type: application/json
• Secret: XXXXXXX (the secret token from github-interceptor-secret.yaml)

Under SSL verification select the radio button for Enable SSL verification. Under Which events would you like to trigger this webhook? select the radio button for Let me select individual events. and thick the checkbox next to Pull requests and ensure that the rest are unthicked.

Click Add webhook.

If the webhook has been set up correctly, then GitHub sends a ping message. Ensure that the ping is received from GitHub, and that it is filtered out so a simple ping event does not trigger any PipelineRun unnecessarily.

eventlistener_pod=$(kubectl get pods -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | grep el-github-pr-python-eventlistener-)
kubectl logs -f "${eventlistener_pod}" | grep 'event type ping is not allowed'

PipelineRuns can be scheduled with a Kubernetes CronJob resource, which calls a Tekton EventListener, that triggers an appropriate PipelineRun. The needed resources can be created with the following command:

   kubectl apply --filename scheduled-eventlistener.yaml

The current schedule is "5 0 * * Mon-Fri, whic means every weekday 00:05 in the pod's timezone. This can be adjusted by editing the schedule attribute. Currently this triggers the github-pr-python-tracer-ci-pipeline on the head of the main branch. These can also be changed on demand.