Skip to content

Commit b952526

Browse files
eromanova97eromanova97
committed
RHDEVDOCS-3785: Configuring Pipelines Operator using the TektonConfig CRD
1 parent 16cd3a0 commit b952526

16 files changed

+374
-45
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,12 +1876,12 @@ Topics:
18761876
File: using-pipelines-as-code
18771877
- Name: Working with OpenShift Pipelines using the Developer perspective
18781878
File: working-with-pipelines-using-the-developer-perspective
1879+
- Name: Customizing configurations in the TektonConfig custom resource
1880+
File: customizing-configurations-in-the-tektonconfig-cr
18791881
- Name: Reducing resource consumption of OpenShift Pipelines
18801882
File: reducing-pipelines-resource-consumption
18811883
- Name: Setting compute resource quota for OpenShift Pipelines
18821884
File: setting-compute-resource-quota-for-openshift-pipelines
1883-
- Name: Automatic pruning of task run and pipeline run
1884-
File: automatic-pruning-taskrun-pipelinerun
18851885
- Name: Using pods in a privileged security context
18861886
File: using-pods-in-a-privileged-security-context
18871887
- Name: Securing webhooks with event listeners

‎cicd/pipelines/automatic-pruning-taskrun-pipelinerun.adoc‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎cicd/pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
:_content-type: ASSEMBLY
2+
[id="customizing-configurations-in-the-tektonconfig-cr"]
3+
= Customizing configurations in the TektonConfig custom resource
4+
include::_attributes/common-attributes.adoc[]
5+
:context: customizing-configurations-in-the-tektonconfig-cr
6+
7+
toc::[]
8+
9+
In {pipelines-title}, you can customize the following configurations by using the `TektonConfig` custom resource (CR):
10+
11+
* Configuring the {pipelines-title} control plane
12+
* Changing the default service account
13+
* Disabling the service monitor
14+
* Configuring pipeline resolvers
15+
* Disabling cluster tasks and pipeline templates
16+
* Disabling the integration of {tekton-hub}
17+
* Disabling the automatic creation of RBAC resources
18+
* Pruning of task runs and pipeline runs
19+
20+
[id="prerequisites_customizing-configurations-in-the-tektonconfig-cr"]
21+
== Prerequisites
22+
23+
* You have installed the {pipelines-title} Operator.
24+
25+
include::modules/op-configuring-pipelines-control-plane.adoc[leveloffset=+1]
26+
27+
include::modules/op-modifiable-fields-with-default-values.adoc[leveloffset=+2]
28+
29+
include::modules/op-optional-configuration-fields.adoc[leveloffset=+2]
30+
31+
include::modules/op-changing-default-service-account.adoc[leveloffset=+1]
32+
33+
include::modules/op-disabling-the-service-monitor.adoc[leveloffset=+1]
34+
35+
include::modules/op-configuring-pipeline-resolvers.adoc[leveloffset=+1]
36+
37+
include::modules/op-disabling-cluster-tasks-and-pipeline-templates.adoc[leveloffset=+1]
38+
39+
include::modules/op-disabling-the-integretion-of-tekton-hub.adoc[leveloffset=+1]
40+
41+
include::modules/op-disabling-automatic-creation-of-rbac-resources.adoc[leveloffset=+1]
42+
43+
include::modules/op-automatic-pruning-taskrun-pipelinerun.adoc[leveloffset=+1]
44+
45+
include::modules/op-default-pruner-configuration.adoc[leveloffset=+2]
46+
47+
include::modules/op-annotations-for-automatic-pruning-taskruns-pipelineruns.adoc[leveloffset=+2]
48+
49+
[role="_additional-resources"]
50+
[id="additional-resources_customizing-configurations-in-the-tektonconfig-cr"]
51+
== Additional resources
52+
53+
* xref:../../cicd/pipelines/authenticating-pipelines-using-git-secret.adoc#op-configuring-ssh-authentication-for-git_authenticating-pipelines-using-git-secret[Configuring SSH authentication for Git]
54+
* xref:managing-nonversioned-and-versioned-cluster-tasks.adoc#managing-nonversioned-and-versioned-cluster-tasks[Managing non-versioned and versioned cluster tasks]
55+
* xref:../../cicd/pipelines/working-with-pipelines-using-the-developer-perspective.adoc#using-custom-pipeline-template-for-git-import_working-with-pipelines-using-the-developer-perspective[Using a custom pipeline template for creating and deploying an application from a Git repository]
56+
* xref:../../applications/pruning-objects.adoc#pruning-objects[Pruning objects to reclaim resources]

‎cicd/pipelines/installing-pipelines.adoc‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,6 @@ include::modules/op-installing-pipelines-operator-using-the-cli.adoc[leveloffset
3737

3838
include::modules/op-pipelines-operator-in-restricted-environment.adoc[leveloffset=+1]
3939

40-
// Disabling automatic creation of RBAC resources
41-
42-
include::modules/op-disabling-automatic-creation-of-rbac-resources.adoc[leveloffset=+1]
43-
44-
4540
[role="_additional-resources"]
4641
== Additional resources
4742

‎modules/op-automatic-pruning-taskrun-pipelinerun.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// This module is included in the following assembly:
2+
//
3+
// *openshift_pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="op-automatic-pruning-taskrun-pipelinerun_{context}"]
7+
= Automatic pruning of task runs and pipeline runs
8+
9+
Stale `TaskRun` and `PipelineRun` objects and their executed instances occupy physical resources that can be used for active runs. For optimal utilization of these resources, {pipelines-title} provides annotations that cluster administrators can use to automatically prune the unused objects and their instances in various namespaces.
10+
11+
[NOTE]
12+
====
13+
Configuring automatic pruning by specifying annotations affects the entire namespace. You cannot selectively auto-prune an individual task run or pipeline run in a namespace.
14+
====
15+

‎modules/op-changing-default-service-account.adoc‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// This module is included in the following assembly:
2+
//
3+
// *openshift_pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="op-changing-default-service-account_{context}"]
7+
= Changing the default service account for {pipelines-shortname}
8+
9+
You can change the default service account for {pipelines-shortname} by editing the `default-service-account` field in the `.spec.pipeline` and `.spec.trigger` specifications. The default service account name is `pipeline`.
10+
11+
.Example
12+
[source,yaml]
13+
----
14+
apiVersion: operator.tekton.dev/v1alpha1
15+
kind: TektonConfig
16+
metadata:
17+
name: config
18+
spec:
19+
pipeline:
20+
default-service-account: pipeline
21+
trigger:
22+
default-service-account: pipeline
23+
enable-api-fields: stable
24+
----

‎modules/op-configuring-pipeline-resolvers.adoc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// This module is included in the following assembly:
2+
//
3+
// *openshift_pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="op-configuring-pipeline-resolvers_{context}"]
7+
= Configuring pipeline resolvers
8+
9+
:FeatureName: resolvers
10+
include::snippets/technology-preview.adoc[]
11+
12+
You can configure pipeline resolvers in the `TektonConfig` custom resource (CR). You can enable or disable these pipeline resolvers:
13+
14+
* `enable-bundles-resolver`
15+
* `enable-cluster-resolver`
16+
* `enable-git-resolver`
17+
* `enable-hub-resolver`
18+
19+
.Example
20+
[source,yaml]
21+
----
22+
apiVersion: operator.tekton.dev/v1alpha1
23+
kind: TektonConfig
24+
metadata:
25+
name: config
26+
spec:
27+
pipeline:
28+
enable-bundles-resolver: true
29+
enable-cluster-resolver: true
30+
enable-git-resolver: true
31+
enable-hub-resolver: true
32+
----
33+
34+
You can also provide resolver specific configurations in the `TektonConfig` CR. For example, define the following fields in the `map[string]string` format to set configurations for each pipeline resolver:
35+
36+
.Example
37+
[source,yaml]
38+
----
39+
apiVersion: operator.tekton.dev/v1alpha1
40+
kind: TektonConfig
41+
metadata:
42+
name: config
43+
spec:
44+
pipeline:
45+
bundles-resolver-config:
46+
default-service-account: pipelines
47+
cluster-resolver-config:
48+
default-namespace: test
49+
git-resolver-config:
50+
server-url: localhost.com
51+
hub-resolver-config:
52+
default-tekton-hub-catalog: tekton
53+
----

‎modules/op-configuring-pipelines-control-plane.adoc‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// This module is included in the following assembly:
2+
//
3+
// *openshift_pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="op-configuring-pipelines-control-plane_{context}"]
7+
= Configuring the {pipelines-title} control plane
8+
9+
You can customize the {pipelines-shortname} control plane by editing the configuration fields in the `TektonConfig` custom resource (CR). The {pipelines-title} Operator automatically adds the configuration fields with their default values so that you can use the {pipelines-shortname} control plane.
10+
11+
.Procedure
12+
13+
. In the *Administrator* perspective of the web console, navigate to *Administration* → *CustomResourceDefinitions*.
14+
15+
. Use the *Search by name* box to search for the `tektonconfigs.operator.tekton.dev` custom resource definition (CRD). Click *TektonConfig* to see the CRD details page.
16+
17+
. Click the *Instances* tab.
18+
19+
. Click the *config* instance to see the `TektonConfig` CR details.
20+
21+
. Click the *YAML* tab.
22+
23+
. Edit the `TektonConfig` YAML file based on your requirements.
24+
+
25+
.Example of `TektonConfig` CR with default values
26+
[source,yaml]
27+
----
28+
apiVersion: operator.tekton.dev/v1alpha1
29+
kind: TektonConfig
30+
metadata:
31+
name: config
32+
spec:
33+
pipeline:
34+
running-in-environment-with-injected-sidecars: true
35+
metrics.taskrun.duration-type: histogram
36+
metrics.pipelinerun.duration-type: histogram
37+
await-sidecar-readiness: true
38+
params:
39+
- name: enableMetrics
40+
value: 'true'
41+
default-service-account: pipeline
42+
require-git-ssh-secret-known-hosts: false
43+
enable-tekton-oci-bundles: false
44+
metrics.taskrun.level: task
45+
metrics.pipelinerun.level: pipeline
46+
embedded-status: both
47+
enable-api-fields: stable
48+
enable-provenance-in-status: false
49+
enable-custom-tasks: true
50+
disable-creds-init: false
51+
disable-affinity-assistant: true
52+
----

‎modules/op-default-pruner-configuration.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
The default configuration for periodic pruning of resources associated with pipeline runs is as follows:
1010

11+
.Example of the default configuration
1112
[source,yaml]
1213
----
1314
apiVersion: operator.tekton.dev/v1alpha1

‎modules/op-disabling-automatic-creation-of-rbac-resources.adoc‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
// Module included in the following assemblies:
1+
// This module is included in the following assembly:
22
//
3-
// */openshift_pipelines/installing-pipelines.adoc
3+
// *openshift_pipelines/customizing-configurations-in-the-tektonconfig-cr.adoc
4+
45
:_content-type: CONCEPT
56
[id="op-disabling-automatic-creation-of-rbac-resources_{context}"]
67
= Disabling the automatic creation of RBAC resources
78

8-
[role="_abstract"]
99
The default installation of the {pipelines-title} Operator creates multiple role-based access control (RBAC) resources for all namespaces in the cluster, except the namespaces matching the `^(openshift|kube)-*` regular expression pattern. Among these RBAC resources, the `pipelines-scc-rolebinding` security context constraint (SCC) role binding resource is a potential security issue, because the associated `pipelines-scc` SCC has the `RunAsAny` privilege.
1010

1111
To disable the automatic creation of cluster-wide RBAC resources after the {pipelines-title} Operator is installed, cluster administrators can set the `createRbacResource` parameter to `false` in the cluster-level `TektonConfig` custom resource (CR).
@@ -21,14 +21,6 @@ spec:
2121
params:
2222
- name: createRbacResource
2323
value: "false"
24-
profile: all
25-
targetNamespace: openshift-pipelines
26-
addon:
27-
params:
28-
- name: clusterTasks
29-
value: "true"
30-
- name: pipelineTemplates
31-
value: "true"
3224
...
3325
----
3426

0 commit comments

Comments
 (0)