软件供应链是指进入软件中的所有内容及其起源,简略地能够了解成软件的依赖项。依赖项是软件运行时所需的重要内容,能够是代码、二进制文件或其余组件,也能够是这些组件的起源,比方存储库或者包管理器之类的。包含代码的已知破绽、受反对的版本、许可证信息、作者、奉献工夫,以及在整个过程中的行为和任何时候接触到它的任何内容,比方用于编译、散发软件的基础架构组件。
CICD 流水线作为基础架构组件,承当着软件的构建、测试、散发和部署。作为供应链的一环,其也成为歹意攻打的指标。CICD 的行为信息能够作为平安审查的重要依据,比方构建打包的环境、操作流程、处理结果等等。
明天介绍的 Tekton Chains,便是这样的行为收集工具。
Tekton Chains
Chains 是一个 Kubernetes CRD 控制器,用于治理 Tekton 中的供应链平安。Chains 使 Tekton 可能在继续交付中,捕捉 PipelineRun
和 TaskRun
运行的元数据用于平安审计,实现二进制溯源和可验证的构建,成为形成保障供应链平安的基础设施的一部分。
以后 Chains(v0.9.0)提供如下性能:
- 应用用户提供的加密密钥,将 TaskRun 的后果(蕴含 TaskRun 自身和 OCI 镜像)镜像进行签名
- 反对相似 in-toto 的证实格局
- 应用多种加密密钥类型和服务(x509、KMS)进行签名
- 签名的存储反对多种实现
接下来的 Demo,咱们还是持续应用之前在 Tekton Pipeline 实战 用的 Java 我的项目 tekton-test,在代码中同样还蕴含了 Pipeline
和 Task
的定义。
为了反对 Chains,原有 task 减少了新的参数。
Demo
环境筹备
应用 k3d 疾速搭建 k3s 的集群
k3d cluster create tekton-test
装置 Teketon Pipelines 及 CLI
kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
brew install tektoncd-cli
kubectl get po -n tekton-pipelines
NAME READY STATUS RESTARTS AGE
tekton-pipelines-webhook-7f5d9fc745-cr7th 1/1 Running 0 12m
tekton-pipelines-controller-7c95d87d96-vvkgr 1/1 Running 0 12m
装置 tekton chains
kubectl apply --filename https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml
kubectl get po -n tekton-chains
NAME READY STATUS RESTARTS AGE
tekton-chains-controller-7d9fb75899-l9d4j 1/1 Running 0 9m8s
装置流水线,这里还是应用 tekton-test 中的流水线定义,具体的阐明查看 Tekton Pipelines 实战 中的阐明。
cd tekton-test/tekton
#创立 sa
kubectl apply -f serviceaccount.yaml
# 创立 docker hub 凭证 secret,这里须要命令行工具 jq
kubectl create secret docker-registry dockerhub --docker-server=https://index.docker.io/v1/ --docker-username=[USERNAME] --docker-password=[PASSWORD] --dry-run=client -o json | jq -r '.data.".dockerconfigjson"' | base64 -d > /tmp/config.json && kubectl create secret generic docker-config --from-file=/tmp/config.json -n tekton-pipelines && rm -f /tmp/config.json
#装置 git-clone task
tkn hub install task git-clone
#装置镜像构建 task
kubectl apply -f tasks/source-to-image.yaml
#装置部署 task
kubectl apply -f tasks/deploy-to-k8s.yaml
#装置 pipeline
kubectl apply -f pipeline/build-pipeline.yaml
#查看 task
tkn t list
NAME DESCRIPTION AGE
git-clone These Tasks are Git... 2 minutes ago
source-to-image 1 minute ago
deploy-to-k8s 31 seconds ago
#查看 pipeline
tkn p list
NAME AGE LAST RUN STARTED DURATION STATUS
build-pipeline 35 seconds ago --- --- --- ---
配置
1. 增加认证凭证
Chains controller 须要应用进行:
- 在镜像签名实现后,向 OCI 镜像仓库发送签名
- 在应用密钥签名时,应用 Fulcio 获取签名证书
这里咱们须要配置用于拜访 Docker 镜像仓库的凭证,Chains controller 应用执行 PipelineRun
的 service account 将镜像签名推送到镜像仓库。
这里间接应用后面装置 pipeline 时创立的 secret,并受权 service account 拜访 secret。
kubectl patch serviceaccount tekton-build \
-p "{\"imagePullSecrets\": [{\"name\": \"docker-config\"}]}" -n tekton-pipelines
2. 签名密钥
为 Chains 生成并配置用于签名的签名密钥,反对上面的任何一种形式:
- x509
- Cosign
- KMS
- EXPERIMENTAL: Keyless signing
咱们应用 cosign(装置非常简单,在 macOS 上执行 brew install cosign
)创立 secret,输出明码时间接回车,不设置明码。
cosign generate-key-pair k8s://tekton-chains/signing-secrets
Enter password for private key:
Enter password for private key again:
Successfully created secret signing-secrets in namespace tekton-chains
Public key written to cosign.pub
上面就是创立的蕴含了密钥的 secret。
3. 配置 Chains
artifacts.taskrun.format=in-toto
artifacts.taskrun.storage=tekton
artifacts.taskrun.signer=x509
kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.taskrun.format":"in-toto"}}'
kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.taskrun.storage":"tekton"}}'
kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.taskrun.signer":"x509"}}'
验证
创立 PipelineRun
开始执行 Pipeline
。
#tekton-test 根目录
kubectl apply -f ./tekton/run/run.yaml
pipelinerun.tekton.dev/generic-pipeline-run created
执行实现后,查看 TaskRun
的运行后果。
tkn tr list
NAME STARTED DURATION STATUS
generic-pipeline-run-source-to-image 1 minute ago 1 minute Succeeded
generic-pipeline-run-fetch-from-git 1 minute ago 11 seconds Succeeded
kubectl get tr generic-pipeline-run-source-to-image -o json | jq -r .metadata.annotations
{
"chains.tekton.dev/cert-taskrun-5bf67bed-af59-4744-a6a7-487de359cbae": "","chains.tekton.dev/chain-taskrun-5bf67bed-af59-4744-a6a7-487de359cbae":"",
"chains.tekton.dev/payload-taskrun-5bf67bed-af59-4744-a6a7-487de359cbae": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMiIsInN1YmplY3QiOlt7Im5hbWUiOiJpbmRleC5kb2NrZXIuaW8vYWRkb3poYW5nL3Rla3Rvbi10ZXN0IiwiZGlnZXN0Ijp7InNoYTI1NiI6ImFjYmQ5OWY4YmUwMDNlOGI3ZTc3NjY1ZWUwZTMzMmU5NmRhMmNiNTRiMzI3MTk4YWJiNDY3MWM4ZGIxZTk5OGEifX1dLCJwcmVkaWNhdGUiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vdGVrdG9uLmRldi9jaGFpbnMvdjIifSwiYnVpbGRUeXBlIjoiaHR0cHM6Ly90ZWt0b24uZGV2L2F0dGVzdGF0aW9ucy9jaGFpbnNAdjIiLCJpbnZvY2F0aW9uIjp7ImNvbmZpZ1NvdXJjZSI6e30sInBhcmFtZXRlcnMiOnsiQ0hBSU5TLUdJVF9DT01NSVQiOiJ7c3RyaW5nIDQ2OTMxZmJjZjAzMDMyMGMzOTlmZjljMzA1MGQ2YjczMTI1OWFiZmMgW119IiwiQ0hBSU5TLUdJVF9VUkwiOiJ7c3RyaW5nIGh0dHBzOi8vZ2l0aHViLmNvbS9hZGRvemhhbmcvdGVrdG9uLXRlc3QuZ2l0IFtdfSIsIklNQUdFIjoie3N0cmluZyBhZGRvemhhbmcvdGVrdG9uLXRlc3QgW119IiwiaW1hZ2VUYWciOiJsYXRlc3QiLCJpbWFnZVVybCI6IntzdHJpbmcgYWRkb3poYW5nL3Rla3Rvbi10ZXN0IFtdfSIsInBhdGhUb0RvY2tlckZpbGUiOiJEb2NrZXJmaWxlIn19LCJidWlsZENvbmZpZyI6eyJzdGVwcyI6W3siZW50cnlQb2ludCI6Im12biIsImFyZ3VtZW50cyI6WyJjbGVhbiIsImluc3RhbGwiLCItRHNraXBUZXN0cyJdLCJlbnZpcm9ubWVudCI6eyJjb250YWluZXIiOiJtYXZlbiIsImltYWdlIjoiZG9ja2VyLmlvL2xpYnJhcnkvbWF2ZW5Ac2hhMjU2OjcyOTIyYWJjOTVkMzhlMDJmNzUwYjM0ODAwMjM5ZGMwZTJjMjk4ZTc0YmZkZDk3MDAxODM2N2YwZDkyODFkNWMifSwiYW5ub3RhdGlvbnMiOm51bGx9LHsiZW50cnlQb2ludCI6Ii9rYW5pa28vZXhlY3V0b3IiLCJhcmd1bWVudHMiOlsiLS1kb2NrZXJmaWxlPSQocGFyYW1zLnBhdGhUb0RvY2tlckZpbGUpIiwiLS1kZXN0aW5hdGlvbj0kKHBhcmFtcy5pbWFnZVVybCk6JChwYXJhbXMuaW1hZ2VUYWcpIiwiLS1jb250ZXh0PSQod29ya3NwYWNlcy5zb3VyY2UucGF0aCkiLCItLWRpZ2VzdC1maWxlPSQocmVzdWx0cy5JTUFHRV9ESUdFU1QucGF0aCkiXSwiZW52aXJvbm1lbnQiOnsiY29udGFpbmVyIjoiYnVpbGQtYW5kLXB1c2giLCJpbWFnZSI6Imdjci5pby9rYW5pa28tcHJvamVjdC9leGVjdXRvckBzaGEyNTY6ZmNjY2QyYWI5ZjM4OTJlMzNmYzdmMmU5NTBjOGU0ZmM2NjVlN2E0YzY2ZjZhOWQ3MGIzMDBkN2EyMTAzNTkyZiJ9LCJhbm5vdGF0aW9ucyI6bnVsbH0seyJlbnRyeVBvaW50Ijoic2V0IC1lXG5lY2hvICQocGFyYW1zLklNQUdFKSB8IHRlZSAkKHJlc3VsdHMuSU1BR0VfVVJMLnBhdGgpICAgICAgICBcbiIsImFyZ3VtZW50cyI6bnVsbCwiZW52aXJvbm1lbnQiOnsiY29udGFpbmVyIjoid3JpdGUtdXJsIiwiaW1hZ2UiOiJkb2NrZXIuaW8vbGlicmFyeS9iYXNoQHNoYTI1NjpiM2FiZTQyNTU3MDY2MThjNTUwZThkYjVlYzA4NzUzMjgzMzNhMTRkYmY2NjNlNmYxZTJiNjg3NWY0NTUyMWU1In0sImFubm90YXRpb25zIjpudWxsfV19LCJtZXRhZGF0YSI6eyJidWlsZFN0YXJ0ZWRPbiI6IjIwMjItMDUtMTRUMDU6NDI6MTFaIiwiYnVpbGRGaW5pc2hlZE9uIjoiMjAyMi0wNS0xNFQwNTo0Mjo0MloiLCJjb21wbGV0ZW5lc3MiOnsicGFyYW1ldGVycyI6ZmFsc2UsImVudmlyb25tZW50IjpmYWxzZSwibWF0ZXJpYWxzIjpmYWxzZX0sInJlcHJvZHVjaWJsZSI6ZmFsc2V9LCJtYXRlcmlhbHMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vYWRkb3poYW5nL3Rla3Rvbi10ZXN0LmdpdC5naXQiLCJkaWdlc3QiOnsic2hhMSI6IjQ2OTMxZmJjZjAzMDMyMGMzOTlmZjljMzA1MGQ2YjczMTI1OWFiZmMifX1dfX0=",
"chains.tekton.dev/retries": "0",
"chains.tekton.dev/signature-taskrun-5bf67bed-af59-4744-a6a7-487de359cbae": "eyJwYXlsb2FkVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLCJwYXlsb2FkIjoiZXlKZmRIbHdaU0k2SW1oMGRIQnpPaTh2YVc0dGRHOTBieTVwYnk5VGRHRjBaVzFsYm5RdmRqQXVNU0lzSW5CeVpXUnBZMkYwWlZSNWNHVWlPaUpvZEhSd2N6b3ZMM05zYzJFdVpHVjJMM0J5YjNabGJtRnVZMlV2ZGpBdU1pSXNJbk4xWW1wbFkzUWlPbHQ3SW01aGJXVWlPaUpwYm1SbGVDNWtiMk5yWlhJdWFXOHZZV1JrYjNwb1lXNW5MM1JsYTNSdmJpMTBaWE4wSWl3aVpHbG5aWE4wSWpwN0luTm9ZVEkxTmlJNkltRmpZbVE1T1dZNFltVXdNRE5sT0dJM1pUYzNOalkxWldVd1pUTXpNbVU1Tm1SaE1tTmlOVFJpTXpJM01UazRZV0ppTkRZM01XTTRaR0l4WlRrNU9HRWlmWDFkTENKd2NtVmthV05oZEdVaU9uc2lZblZwYkdSbGNpSTZleUpwWkNJNkltaDBkSEJ6T2k4dmRHVnJkRzl1TG1SbGRpOWphR0ZwYm5NdmRqSWlmU3dpWW5WcGJHUlVlWEJsSWpvaWFIUjBjSE02THk5MFpXdDBiMjR1WkdWMkwyRjBkR1Z6ZEdGMGFXOXVjeTlqYUdGcGJuTkFkaklpTENKcGJuWnZZMkYwYVc5dUlqcDdJbU52Ym1acFoxTnZkWEpqWlNJNmUzMHNJbkJoY21GdFpYUmxjbk1pT25zaVEwaEJTVTVUTFVkSlZGOURUMDFOU1ZRaU9pSjdjM1J5YVc1bklEUTJPVE14Wm1KalpqQXpNRE15TUdNek9UbG1aamxqTXpBMU1HUTJZamN6TVRJMU9XRmlabU1nVzExOUlpd2lRMGhCU1U1VExVZEpWRjlWVWt3aU9pSjdjM1J5YVc1bklHaDBkSEJ6T2k4dloybDBhSFZpTG1OdmJTOWhaR1J2ZW1oaGJtY3ZkR1ZyZEc5dUxYUmxjM1F1WjJsMElGdGRmU0lzSWtsTlFVZEZJam9pZTNOMGNtbHVaeUJoWkdSdmVtaGhibWN2ZEdWcmRHOXVMWFJsYzNRZ1cxMTlJaXdpYVcxaFoyVlVZV2NpT2lKc1lYUmxjM1FpTENKcGJXRm5aVlZ5YkNJNkludHpkSEpwYm1jZ1lXUmtiM3BvWVc1bkwzUmxhM1J2YmkxMFpYTjBJRnRkZlNJc0luQmhkR2hVYjBSdlkydGxja1pwYkdVaU9pSkViMk5yWlhKbWFXeGxJbjE5TENKaWRXbHNaRU52Ym1acFp5STZleUp6ZEdWd2N5STZXM3NpWlc1MGNubFFiMmx1ZENJNkltMTJiaUlzSW1GeVozVnRaVzUwY3lJNld5SmpiR1ZoYmlJc0ltbHVjM1JoYkd3aUxDSXRSSE5yYVhCVVpYTjBjeUpkTENKbGJuWnBjbTl1YldWdWRDSTZleUpqYjI1MFlXbHVaWElpT2lKdFlYWmxiaUlzSW1sdFlXZGxJam9pWkc5amEyVnlMbWx2TDJ4cFluSmhjbmt2YldGMlpXNUFjMmhoTWpVMk9qY3lPVEl5WVdKak9UVmtNemhsTURKbU56VXdZak0wT0RBd01qTTVaR013WlRKak1qazRaVGMwWW1aa1pEazNNREF4T0RNMk4yWXdaRGt5T0RGa05XTWlmU3dpWVc1dWIzUmhkR2x2Ym5NaU9tNTFiR3g5TEhzaVpXNTBjbmxRYjJsdWRDSTZJaTlyWVc1cGEyOHZaWGhsWTNWMGIzSWlMQ0poY21kMWJXVnVkSE1pT2xzaUxTMWtiMk5yWlhKbWFXeGxQU1FvY0dGeVlXMXpMbkJoZEdoVWIwUnZZMnRsY2tacGJHVXBJaXdpTFMxa1pYTjBhVzVoZEdsdmJqMGtLSEJoY21GdGN5NXBiV0ZuWlZWeWJDazZKQ2h3WVhKaGJYTXVhVzFoWjJWVVlXY3BJaXdpTFMxamIyNTBaWGgwUFNRb2QyOXlhM053WVdObGN5NXpiM1Z5WTJVdWNHRjBhQ2tpTENJdExXUnBaMlZ6ZEMxbWFXeGxQU1FvY21WemRXeDBjeTVKVFVGSFJWOUVTVWRGVTFRdWNHRjBhQ2tpWFN3aVpXNTJhWEp2Ym0xbGJuUWlPbnNpWTI5dWRHRnBibVZ5SWpvaVluVnBiR1F0WVc1a0xYQjFjMmdpTENKcGJXRm5aU0k2SW1kamNpNXBieTlyWVc1cGEyOHRjSEp2YW1WamRDOWxlR1ZqZFhSdmNrQnphR0V5TlRZNlptTmpZMlF5WVdJNVpqTTRPVEpsTXpObVl6ZG1NbVU1TlRCak9HVTBabU0yTmpWbE4yRTBZelkyWmpaaE9XUTNNR0l6TURCa04yRXlNVEF6TlRreVppSjlMQ0poYm01dmRHRjBhVzl1Y3lJNmJuVnNiSDBzZXlKbGJuUnllVkJ2YVc1MElqb2ljMlYwSUMxbFhHNWxZMmh2SUNRb2NHRnlZVzF6TGtsTlFVZEZLU0I4SUhSbFpTQWtLSEpsYzNWc2RITXVTVTFCUjBWZlZWSk1MbkJoZEdncElDQWdJQ0FnSUNCY2JpSXNJbUZ5WjNWdFpXNTBjeUk2Ym5Wc2JDd2laVzUyYVhKdmJtMWxiblFpT25zaVkyOXVkR0ZwYm1WeUlqb2lkM0pwZEdVdGRYSnNJaXdpYVcxaFoyVWlPaUprYjJOclpYSXVhVzh2YkdsaWNtRnllUzlpWVhOb1FITm9ZVEkxTmpwaU0yRmlaVFF5TlRVM01EWTJNVGhqTlRVd1pUaGtZalZsWXpBNE56VXpNamd6TXpOaE1UUmtZbVkyTmpObE5tWXhaVEppTmpnM05XWTBOVFV5TVdVMUluMHNJbUZ1Ym05MFlYUnBiMjV6SWpwdWRXeHNmVjE5TENKdFpYUmhaR0YwWVNJNmV5SmlkV2xzWkZOMFlYSjBaV1JQYmlJNklqSXdNakl0TURVdE1UUlVNRFU2TkRJNk1URmFJaXdpWW5WcGJHUkdhVzVwYzJobFpFOXVJam9pTWpBeU1pMHdOUzB4TkZRd05UbzBNam8wTWxvaUxDSmpiMjF3YkdWMFpXNWxjM01pT25zaWNHRnlZVzFsZEdWeWN5STZabUZzYzJVc0ltVnVkbWx5YjI1dFpXNTBJanBtWVd4elpTd2liV0YwWlhKcFlXeHpJanBtWVd4elpYMHNJbkpsY0hKdlpIVmphV0pzWlNJNlptRnNjMlY5TENKdFlYUmxjbWxoYkhNaU9sdDdJblZ5YVNJNkltZHBkQ3RvZEhSd2N6b3ZMMmRwZEdoMVlpNWpiMjB2WVdSa2IzcG9ZVzVuTDNSbGEzUnZiaTEwWlhOMExtZHBkQzVuYVhRaUxDSmthV2RsYzNRaU9uc2ljMmhoTVNJNklqUTJPVE14Wm1KalpqQXpNRE15TUdNek9UbG1aamxqTXpBMU1HUTJZamN6TVRJMU9XRmlabU1pZlgxZGZYMD0iLCJzaWduYXR1cmVzIjpbeyJrZXlpZCI6IlNIQTI1NjppRlk2RVhnWWt5enlabzgxU29MS1FPRy9CdjZyZnorZFYrMkZxNXFjY2NBIiwic2lnIjoiTUVVQ0lRREZ4bzE0bzVldDFRVkJKUklQK3liSlhmQ2VFTjJaK3ZFNWROQlpMQmhvSWdJZ0hwL3B4VDF0SDZleHF0d2x2UStML0prazhXVFMzbTJhL1BWN3AzeEdrTkE9In1dfQ==",
"kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"tekton.dev/v1beta1\",\"kind\":\"PipelineRun\",\"metadata\":{\"annotations\":{},\"generateName\":\"generic-pr-\",\"name\":\"generic-pipeline-run\",\"namespace\":\"tekton-pipelines\"},\"spec\":{\"params\":[{\"name\":\"git-revision\",\"value\":\"main\"},{\"name\":\"git-url\",\"value\":\"https://github.com/addozhang/tekton-test.git\"},{\"name\":\"imageUrl\",\"value\":\"addozhang/tekton-test\"},{\"name\":\"imageTag\",\"value\":\"latest\"}],\"pipelineRef\":{\"name\":\"build-pipeline\"},\"serviceAccountName\":\"tekton-build\",\"workspaces\":[{\"name\":\"git-source\",\"volumeClaimTemplate\":{\"spec\":{\"accessModes\":[\"ReadWriteOnce\"],\"resources\":{\"requests\":{\"storage\":\"1Gi\"}}}}},{\"name\":\"docker-config\",\"secret\":{\"secretName\":\"docker-config\"}}]}}\n",
"pipeline.tekton.dev/affinity-assistant": "affinity-assistant-876633b0fe",
"pipeline.tekton.dev/release": "422a468"
}
将 payload 的内容解码能够看到 TaskRun 的输出、输入以及 Task 自身应用的镜像等信息。
{
"_type": "https://in-toto.io/Statement/v0.1",
"predicateType": "https://slsa.dev/provenance/v0.2",
"subject": [
{
"name": "index.docker.io/addozhang/tekton-test",
"digest": {"sha256": "acbd99f8be003e8b7e77665ee0e332e96da2cb54b327198abb4671c8db1e998a"}
}
],
"predicate": {
"builder": {"id": "https://tekton.dev/chains/v2"},
"buildType": "https://tekton.dev/attestations/chains@v2",
"invocation": {"configSource": {},
"parameters": {"CHAINS-GIT_COMMIT": "{string 46931fbcf030320c399ff9c3050d6b731259abfc []}",
"CHAINS-GIT_URL": "{string https://github.com/addozhang/tekton-test.git []}",
"IMAGE": "{string addozhang/tekton-test []}",
"imageTag": "latest",
"imageUrl": "{string addozhang/tekton-test []}",
"pathToDockerFile": "Dockerfile"
}
},
"buildConfig": {
"steps": [
{
"entryPoint": "mvn",
"arguments": [
"clean",
"install",
"-DskipTests"
],
"environment": {
"container": "maven",
"image": "docker.io/library/maven@sha256:72922abc95d38e02f750b34800239dc0e2c298e74bfdd970018367f0d9281d5c"
},
"annotations": null
},
{
"entryPoint": "/kaniko/executor",
"arguments": ["--dockerfile=$(params.pathToDockerFile)",
"--destination=$(params.imageUrl):$(params.imageTag)",
"--context=$(workspaces.source.path)",
"--digest-file=$(results.IMAGE_DIGEST.path)"
],
"environment": {
"container": "build-and-push",
"image": "gcr.io/kaniko-project/executor@sha256:fcccd2ab9f3892e33fc7f2e950c8e4fc665e7a4c66f6a9d70b300d7a2103592f"
},
"annotations": null
},
{"entryPoint": "set -e\necho $(params.IMAGE) | tee $(results.IMAGE_URL.path) \n",
"arguments": null,
"environment": {
"container": "write-url",
"image": "docker.io/library/bash@sha256:b3abe4255706618c550e8db5ec0875328333a14dbf663e6f1e2b6875f45521e5"
},
"annotations": null
}
]
},
"metadata": {
"buildStartedOn": "2022-05-14T05:42:11Z",
"buildFinishedOn": "2022-05-14T05:42:42Z",
"completeness": {
"parameters": false,
"environment": false,
"materials": false
},
"reproducible": false
},
"materials": [
{
"uri": "git+https://github.com/addozhang/tekton-test.git.git",
"digest": {"sha1": "46931fbcf030320c399ff9c3050d6b731259abfc"}
}
]
}
}
文章对立公布在公众号
云原生指北