-71

deploy/deployment.yaml

reviewed

··· 1 1 - apiVersion: apps/v1 2 2 - kind: Deployment 3 3 - metadata: 4 4 - name: tack 5 5 - namespace: tack 6 6 - spec: 7 7 - replicas: 1 # SQLite is single-writer; do not scale above 1 8 8 - selector: 9 9 - matchLabels: 10 10 - app: tack 11 11 - template: 12 12 - metadata: 13 13 - labels: 14 14 - app: tack 15 15 - spec: 16 16 - serviceAccountName: tack 17 17 - securityContext: 18 18 - runAsNonRoot: true 19 19 - runAsUser: 1000 20 20 - fsGroup: 1000 21 21 - seccompProfile: 22 22 - type: RuntimeDefault 23 23 - containers: 24 24 - - name: tack 25 25 - image: atcr.io/dsx.sh/tack:latest 26 26 - imagePullPolicy: IfNotPresent 27 27 - ports: 28 28 - - name: http 29 29 - containerPort: 8080 30 30 - env: 31 31 - - name: TACK_LISTEN_ADDR 32 32 - value: ":8080" 33 33 - - name: TACK_DB_PATH 34 34 - value: "/var/lib/tack/tack.db" 35 35 - - name: TACK_TEKTON_ENABLED 36 36 - value: "1" 37 37 - - name: TACK_TEKTON_NAMESPACE 38 38 - value: "tekton-pipelines" 39 39 - envFrom: 40 40 - - secretRef: 41 41 - name: tack 42 42 - volumeMounts: 43 43 - - name: db 44 44 - mountPath: /var/lib/tack 45 45 - livenessProbe: 46 46 - httpGet: 47 47 - path: / 48 48 - port: http 49 49 - initialDelaySeconds: 5 50 50 - periodSeconds: 30 51 51 - readinessProbe: 52 52 - httpGet: 53 53 - path: / 54 54 - port: http 55 55 - initialDelaySeconds: 2 56 56 - periodSeconds: 10 57 57 - resources: 58 58 - requests: 59 59 - cpu: 50m 60 60 - memory: 64Mi 61 61 - limits: 62 62 - memory: 256Mi 63 63 - securityContext: 64 64 - allowPrivilegeEscalation: false 65 65 - readOnlyRootFilesystem: true 66 66 - capabilities: 67 67 - drop: ["ALL"] 68 68 - volumes: 69 69 - - name: db 70 70 - persistentVolumeClaim: 71 71 - claimName: tack-db

-57

deploy/hello-world.yaml

reviewed

··· 1 1 - apiVersion: tekton.dev/v1 2 2 - kind: Pipeline 3 3 - metadata: 4 4 - name: hello-world 5 5 - spec: 6 6 - description: Simple Pipeline for validating Tack-created Tekton PipelineRuns. 7 7 - params: 8 8 - - name: message 9 9 - type: string 10 10 - default: Hello from Tack 11 11 - - name: name 12 12 - type: string 13 13 - default: world 14 14 - tasks: 15 15 - - name: say-hello 16 16 - taskRef: 17 17 - name: hello-world 18 18 - params: 19 19 - - name: message 20 20 - value: $(params.message) 21 21 - - name: name 22 22 - value: $(params.name) 23 23 - - name: finish 24 24 - runAfter: 25 25 - - say-hello 26 26 - taskRef: 27 27 - name: hello-world-finish 28 28 - params: 29 29 - - name: name 30 30 - value: $(params.name) 31 31 - --- 32 32 - apiVersion: tekton.dev/v1 33 33 - kind: Pipeline 34 34 - metadata: 35 35 - name: hello-world-inline 36 36 - spec: 37 37 - description: Single inline-task Pipeline for the smallest Tack smoke test. 38 38 - params: 39 39 - - name: message 40 40 - type: string 41 41 - default: Hello from Tack 42 42 - tasks: 43 43 - - name: say-hello 44 44 - taskSpec: 45 45 - params: 46 46 - - name: message 47 47 - type: string 48 48 - steps: 49 49 - - name: hello 50 50 - image: busybox:1.36 51 51 - script: | 52 52 - #!/bin/sh 53 53 - set -eu 54 54 - echo "$(params.message)" 55 55 - params: 56 56 - - name: message 57 57 - value: $(params.message)

-11

deploy/kustomization.yaml

reviewed

··· 1 1 - apiVersion: kustomize.config.k8s.io/v1beta1 2 2 - kind: Kustomization 3 3 - namespace: tack 4 4 - resources: 5 5 - - namespace.yaml 6 6 - - serviceaccount.yaml 7 7 - - rbac.yaml 8 8 - - pvc.yaml 9 9 - - secret.yaml 10 10 - - deployment.yaml 11 11 - - service.yaml

-6

deploy/namespace.yaml

reviewed

··· 1 1 - apiVersion: v1 2 2 - kind: Namespace 3 3 - metadata: 4 4 - name: tack 5 5 - labels: 6 6 - atcr.io-image: "true"

-11

deploy/pvc.yaml

reviewed

··· 1 1 - apiVersion: v1 2 2 - kind: PersistentVolumeClaim 3 3 - metadata: 4 4 - name: tack-db 5 5 - namespace: tack 6 6 - spec: 7 7 - accessModes: 8 8 - - ReadWriteMany 9 9 - resources: 10 10 - requests: 11 11 - storage: 1Gi

-34

deploy/rbac.yaml

reviewed

··· 1 1 - # Role in tekton-pipelines so tack can manage PipelineRuns and read pod logs there. 2 2 - # The RoleBinding references tack's ServiceAccount cross-namespace. 3 3 - apiVersion: rbac.authorization.k8s.io/v1 4 4 - kind: Role 5 5 - metadata: 6 6 - name: tack 7 7 - namespace: tekton-pipelines 8 8 - rules: 9 9 - - apiGroups: ["tekton.dev"] 10 10 - resources: ["pipelineruns"] 11 11 - verbs: ["create", "get", "list", "watch"] 12 12 - - apiGroups: ["tekton.dev"] 13 13 - resources: ["taskruns"] 14 14 - verbs: ["list"] 15 15 - - apiGroups: [""] 16 16 - resources: ["pods"] 17 17 - verbs: ["get", "list"] 18 18 - - apiGroups: [""] 19 19 - resources: ["pods/log"] 20 20 - verbs: ["get"] 21 21 - --- 22 22 - apiVersion: rbac.authorization.k8s.io/v1 23 23 - kind: RoleBinding 24 24 - metadata: 25 25 - name: tack 26 26 - namespace: tekton-pipelines 27 27 - subjects: 28 28 - - kind: ServiceAccount 29 29 - name: tack 30 30 - namespace: tack 31 31 - roleRef: 32 32 - kind: Role 33 33 - name: tack 34 34 - apiGroup: rbac.authorization.k8s.io

-15

deploy/secret.yaml

reviewed

··· 1 1 - # Rename to secret.yaml and fill in real values before applying. 2 2 - # Do not commit populated secrets to version control. 3 3 - apiVersion: v1 4 4 - kind: Secret 5 5 - metadata: 6 6 - name: tack 7 7 - namespace: tack 8 8 - type: Opaque 9 9 - stringData: 10 10 - TACK_HOSTNAME: "tack.example.com" 11 11 - TACK_OWNER_DID: "did:plc:1234" 12 12 - # Uncomment to enable Buildkite provider: 13 13 - # TACK_BUILDKITE_TOKEN: "" 14 14 - # TACK_BUILDKITE_ORG: "" 15 15 - # TACK_BUILDKITE_WEBHOOK_SECRET: ""

-12

deploy/service.yaml

reviewed

··· 1 1 - apiVersion: v1 2 2 - kind: Service 3 3 - metadata: 4 4 - name: tack 5 5 - namespace: tack 6 6 - spec: 7 7 - selector: 8 8 - app: tack 9 9 - ports: 10 10 - - name: http 11 11 - port: 80 12 12 - targetPort: http

-5

deploy/serviceaccount.yaml

reviewed

··· 1 1 - apiVersion: v1 2 2 - kind: ServiceAccount 3 3 - metadata: 4 4 - name: tack 5 5 - namespace: tack