Chapter 9: Securing Authentication

Once you start building pipelines to be used in your enterprise, there is a good chance that you will use them on a private Git repository as opposed to a public one. The same is most likely true for your image registry. To access those resources, you will need to authenticate to the servers hosting them. To do so, you will use secrets.

In this chapter, you will learn about how Tekton handles authentication. Then, you will see how you can clone a private repository in a task. Finally, you will learn how to use stored images on a private registry for steps in your Tekton tasks.

In this chapter, we are going to cover the following main topics:

• Introducing authentication in Tekton
• Authenticating into a Git repository
• Authenticating into a container registry

Technical requirements

For the examples in this chapter, you will need access to a private Git repository, along with the credentials to access it. GitHub can provide you with unlimited private repositories. You might need a paid tier with Docker Hub to create a private image for your image registry.

You can find all of the examples described in this chapter in the chapter-9 folder of the Git repository: https://github.com/PacktPublishing/Building-CI-CD-systems-using-Tekton.

You can also see the Code in Action videos at: https://bit.ly/3y5lTCQ

Introducing authentication in Tekton

So far, you've used publicly available Git repositories and Docker registries. It works well in theory, but you will probably need to authenticate to those servers in practice. Tekton has some built-in mechanisms in place to help you with this.

The support for authentication in Tekton is done through the Kubernetes first-class object secrets. These secrets will be used by a service account specified in the task definition.

For Tekton to use these secrets, it will need to have some specific annotations. Tekton will convert secrets with the necessary annotations in the authentication files required by either Git or Docker.

Authenticating into a Git repository

For this first hands-on example, you will start by creating a private repository in GitHub. Once this Git repository is ready, you will create a Secret object in Kubernetes. This object will contain your credentials and will be assigned to a service account. Using this specific service account in your runs, you will be able to clone a private repository.

For the following examples, you will need a private GitHub repository with a README.md file and the credentials for it.

Once you have a private repository in place, you can create the following task in a file named task.yaml. This task will use the alpine/git image to clone a repository and output the content of the README.md file:

apiVersion: tekton.dev/v1beta1 
kind: Task 
metadata: 
 name: read-file 
spec: 
 params: 
   - name: private-repo 
     type: string 
 steps: 
   - name: clone 
     image: alpine...

Authenticating in a container registry

If the image you need for a task is located in a private registry, you can use an image pull secret to add your credentials to the service account that downloads the images.

To do so, you first need to create a set of credentials in your Kubernetes cluster. You can do this with the kubectl CLI tool with the following command to create an object of kind Secret called registry-creds:

$ kubectl create secret docker-registry registry-creds --docker-server=<server> --docker-username=<username> --docker-password=<password --docker-email=<email>  

Note

Here, replace server, username, password, and email with the matching values for your registry.

Next, you will need to create a new service account for your cluster. You can do this using the following YAML. This service account, called authenticated, will use the newly created registry-creds to authenticate to the image registry. You can name this file...

Summary

In this chapter, you've learned how to authenticate to a Git repository or an image registry. Now that you know how to do so, Tekton will be allowed to download your team's source code or images.

You have seen how you can use Kubernetes secrets to authenticate to those servers. For the Git examples, you've learned that you can either use a username/password authentication or an SSH-based authentication mechanism. Those principles can also apply to image registries.

Finally, you've seen how you can use the kubectl command-line tool to build a secret to use with your Tekton pipelines to access a private registry. You then saw how the tkn CLI tool could link the service account to a task to create an authenticated task run.

You now have all the necessary knowledge to build your complete CI/CD pipelines with Tekton. The only missing piece will be to trigger your pipelines automatically. This functionality will require the help of a sister project...