|
3 | 3 | // *cicd/pipelines/using-tekton-hub-with-openshift-pipelines.adoc |
4 | 4 |
|
5 | 5 | :_content-type: PROCEDURE |
6 | | -[id="op-installing-and-deploying-tekton-hub-on-an-openshift-cluster_{context}"] |
| 6 | +[id="installing-and-deploying-tekton-hub-on-an-openshift-cluster_{context}"] |
7 | 7 | = Installing and deploying {tekton-hub} on a {product-title} cluster |
8 | 8 |
|
9 | 9 | [role="_abstract"] |
10 | 10 | {tekton-hub} is an optional component; cluster administrators cannot install it using the `TektonConfig` custom resource (CR). To install and manage {tekton-hub}, use the `TektonHub` CR. |
11 | 11 |
|
12 | | -[NOTE] |
13 | | -==== |
14 | | -If you are using Github Enterprise or Gitlab Enterprise, install and deploy {tekton-hub} in the same network as the enterprise server. For example, if the enterprise server is running behind a VPN, deploy {tekton-hub} on a cluster that is also behind the VPN. |
15 | | -==== |
16 | | - |
17 | | -[discrete] |
18 | | -.Prerequisites |
19 | | -* Ensure that the {pipelines-title} Operator is installed in the default `openshift-pipelines` namespace on the cluster. |
20 | | -
|
21 | | -[discrete] |
22 | | -.Procedure |
23 | | - |
24 | | -. Create a fork of the link:https://github.com/tektoncd/hub[Tekton Hub] repository. |
| 12 | +You can install {tekton-hub} on your cluster using two modes: |
25 | 13 |
|
26 | | -. Clone the forked repository. |
| 14 | +* _Without_ login authorization and ratings for {tekton-hub} artifacts |
| 15 | +* _with_ login autorization and ratings for {tekton-hub} artifacts |
27 | 16 |
|
28 | | -. Update the `config.yaml` file to include at least one user with the following scopes: |
29 | | -* A user with `agent:create` scope who can set up a cron job that refreshes the {tekton-hub} database after an interval, if there are any changes in the catalog. |
30 | | -* A user with the `catalog:refresh` scope who can refresh the catalog and all resources in the database of the {tekton-hub}. |
31 | | -* A user with the `config:refresh` scope who can get additional scopes. |
32 | | -+ |
33 | | -[source,yaml] |
34 | | ----- |
35 | | -... |
36 | | -scopes: |
37 | | -- name: agent:create |
38 | | - users: <username_registered_with_the_Git_repository_hosting_service_provider> |
39 | | -- name: catalog:refresh |
40 | | - users: <username_registered_with_the_Git_repository_hosting_service_provider> |
41 | | -- name: config:refresh |
42 | | - users: <username_registered_with_the_Git_repository_hosting_service_provider> |
43 | | -... |
44 | | ----- |
45 | | -+ |
46 | | -The supported service providers are GitHub, GitLab, and BitBucket. |
47 | | - |
48 | | -. Create an OAuth application with your Git repository hosting provider, and note the Client ID and Client Secret. |
49 | | -* For a GitHub OAuth application, set the `Homepage URL` and the `Authorization callback URL` as `<auth-route>`. |
50 | | -* For a GitLab OAuth application, set the `REDIRECT_URI` as `<auth-route>/auth/gitlab/callback`. |
51 | | -* For a BitBucket OAuth application, set the `Callback URL` as `<auth-route>`. |
52 | | - |
53 | | -. Edit the following fields in the `<tekton_hub_repository>/config/02-api/20-api-secret.yaml` file for the {tekton-hub} API secret: |
54 | | -* `GH_CLIENT_ID`: The Client ID from the OAuth application created with the Git repository hosting service provider. |
55 | | -* `GH_CLIENT_SECRET`: The Client Secret from the OAuth application created with the Git repository hosting service provider. |
56 | | -* `GHE_URL`: GitHub Enterprise URL, if you are authenticating using GitHub Enterprise. Do not provide the URL to the catalog as a value for this field. |
57 | | -* `GL_CLIENT_ID`: The Client ID from the GitLab OAuth application. |
58 | | -* `GL_CLIENT_SECRET`: The Client Secret from the GitLab OAuth application. |
59 | | -* `GLE_URL`: GitLab Enterprise URL, if you are authenticating using GitLab Enterprise. Do not provide the URL to the catalog as a value for this field. |
60 | | -* `BB_CLIENT_ID`: The Client ID from the BitBucket OAuth application. |
61 | | -* `BB_CLIENT_SECRET`: The Client Secret from the BitBucket OAuth application. |
62 | | -* `JWT_SIGNING_KEY`: A long, random string used to sign the JSON Web Token (JWT) created for users. |
63 | | -* `ACCESS_JWT_EXPIRES_IN`: Add the time limit after which the access token expires. For example, `1m`, where `m` denotes minutes. The supported units of time are seconds (`s`), minutes (`m`), hours (`h`), days (`d`), and weeks (`w`). |
64 | | -* `REFRESH_JWT_EXPIRES_IN`: Add the time limit after which the refresh token expires. For example, `1m`, where `m` denotes minutes. The supported units of time are seconds (`s`), minutes (`m`), hours (`h`), days (`d`), and weeks (`w`). Ensure that the expiry time set for token refresh is greater than the expiry time set for token access. |
65 | | -* `AUTH_BASE_URL`: Route URL for the OAuth application. |
66 | | -+ |
67 | 17 | [NOTE] |
68 | 18 | ==== |
69 | | -* Use the fields related to Client ID and Client Secret for any one of the supported Git repository hosting service providers. |
70 | | -* The account credentials registered with the Git repository hosting service provider enables the users with `catalog: refresh` scope to authenticate and load all catalog resources to the database. |
71 | | -==== |
72 | | -
|
73 | | -. Commit and push the changes to your forked repository. |
74 | | - |
75 | | -. Ensure that the `TektonHub` CR is similar to the following example: |
76 | | -+ |
77 | | -[source,yaml] |
78 | | ----- |
79 | | -apiVersion: operator.tekton.dev/v1alpha1 |
80 | | -kind: TektonHub |
81 | | -metadata: |
82 | | - name: hub |
83 | | -spec: |
84 | | - targetNamespace: openshift-pipelines <1> |
85 | | - api: |
86 | | - hubConfigUrl: https://raw.githubusercontent.com/tektoncd/hub/main/config.yaml <2> |
87 | | ----- |
88 | | -<1> The namespace in which Tekton Hub must be installed; default is `openshift-pipelines`. |
89 | | -<2> Substitute with the URL of the `config.yaml` file of your forked repository. |
90 | | - |
91 | | -. Install the {tekton-hub}. |
92 | | -+ |
93 | | -[source,terminal] |
94 | | ----- |
95 | | -$ oc apply -f TektonHub.yaml <1> |
96 | | ----- |
97 | | -<1> The file name or path of the `TektonConfig` CR. |
98 | | - |
99 | | -. Check the status of the installation. |
100 | | -+ |
101 | | -[source,terminal] |
102 | | ----- |
103 | | -$ oc get tektonhub.operator.tekton.dev |
104 | | -NAME VERSION READY REASON APIURL UIURL |
105 | | -hub v1.7.2 True https://api.route.url/ https://ui.route.url/ |
106 | | ----- |
| 19 | +If you are using Github Enterprise or Gitlab Enterprise, install and deploy {tekton-hub} in the same network as the enterprise server. For example, if the enterprise server is running behind a VPN, deploy {tekton-hub} on a cluster that is also behind the VPN. |
| 20 | +==== |
0 commit comments