Step 8 - Updating Kubernetes Manifests

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: update-manifest
  namespace: ci
spec:
  description: >-
    This task updates the manifest for the current application to point to the
    image tag created with the short commit.
  params: (1)
    - description: Used to tag the built image.
      name: image
      type: string
    - default: main
      description: Target branch to push to
      name: target-branch
      type: string
    - default: Tekton Pipeline
      description: Git user name for performing the push operation.
      name: git_user_name
      type: string
    - default: tekton@tekton.com
      description: Git user email for performing the push operation.
      name: git_user_email
      type: string
    - description: File in which the image configuration is stored.
      name: configuration_file
      type: string
    - description: Repo in which the image configuration is stored.
      name: repository
      type: string
    - default: 'registry.redhat.io/openshift-pipelines/pipelines-git-init-rhel8:v1.10.4-4'
      name: gitInit
      type: string
    - name: verbose
      description: Verbose output
      type: string
      default: "true"
  steps: (2)
    - image: $(params.gitInit)
      name: git
      env:
        - name: PARAM_VERBOSE
          value: $(params.verbose)
      resources: {}
      script: >
        #!/usr/bin/env sh

        set -eu

        if [ "${PARAM_VERBOSE}" = "true" ] ; then
          set -x
        fi

        # Setting up the git config.

        git config --global user.email "$(params.git_user_email)"

        git config --global user.name "$(params.git_user_name)"

        # Checkout target branch to avoid the detached HEAD state

        TMPDIR=$(mktemp -d)

        cd $TMPDIR

        git clone $(params.repository)

        cd securing-software-supply-chain

        git checkout $(params.target-branch)

        # Set to the short commit value passed as parameter.
        # Notice the enclosing " to keep it as a string in the resulting YAML.

        IMAGE=\"$(params.image)\"

        sed -i "s#\(.*value:\s*\).*#\1 ${IMAGE}#" $(params.configuration_file)

        git add $(params.configuration_file)

        git commit -m "Automatically updated manifest to point to image tag

        $IMAGE"

        git push origin $(params.target-branch)

spec:
  params: (1)
    - name: MANIFEST_FILE
      type: string
    - name: MANIFEST_FILE_PROD
      type: string
    - name: MANIFEST_REPO
      type: string
    - name: MANIFEST_REPO_NAME
      type: string
    - name: MANIFEST_GIT_REF
      type: string
    ...
  tasks:
  ...
    - name: update-dev-manifest
      params:
        - name: image
          value: '$(params.IMAGE_REPO):$(params.IMAGE_TAG)'
        - name: configuration_file
          value: $(params.MANIFEST_FILE)
        - name: repository
          value: $(params.MANIFEST_REPO)
        - name: git_user_name
          value: $(params.COMMIT_AUTHOR)
      runAfter: (2)
        - acs-image-check
        - acs-image-scan
        - generate-sbom
      taskRef:
        kind: Task
        name: update-manifest

    - name: manifestRepo
      value: git@github.com:tjungbauer/securing-software-supply-chain.git (1)
    - name: manifestRepoRef
      value: main
    - name: manifestFile (2)
      value: application/globex/overlays/dev/kustomization.yaml
    - name: manifestFileProd (3)
      value: application/globex/overlays/prod/kustomization.yaml
    - name: manifestRepoName
      value: tjungbauer/securing-software-supply-chain

spec:
  params:
    - description: The file to update to point to newly built image
      name: manifestFile
    - description: The file to update to point to newly built image in prod
      name: manifestFileProd
    - description: The repo to update to point to newly built image
      name: manifestRepo
    - description: The reference to the repo
      name: manifestRepoRef
    - description: The full name of the repo
      name: manifestRepoName
...
  resourcetemplates:
  ...
      spec:
        params:
          - name: MANIFEST_FILE
            value: $(tt.params.manifestFile)
          - name: MANIFEST_FILE_PROD
            value: $(tt.params.manifestFileProd)
          - name: MANIFEST_REPO
            value: $(tt.params.manifestRepo)
          - name: MANIFEST_GIT_REF
            value: $(tt.params.manifestRepoRef)
          - name: MANIFEST_REPO_NAME
            value: $(tt.params.manifestRepoName)
      ...