{"author":{"email":"alex@hayorov.me","name":"Alex Khaerov","url":"https://hayorov.me/"},"content_markdown":"> 🔧 **Tool**: Tekton Pipelines v1.3.x LTS\n> ☸️ **Platform**: Kubernetes v1.27+\n> 📦 **Scope**: CI/CD — Build, Test, Scan, Deploy\n> 🕐 **Updated**: February 2026\n\nSetting up a **CI/CD pipeline** with **Tekton** transforms how you handle continuous integration and delivery in Kubernetes environments. This guide walks you through every step - from installation to running a production-ready pipeline - using the latest Tekton practices as of early 2026, enabling you to automate builds, tests, scans, and deployments efficiently on your cluster.\n\nTekton stands out as a **cloud-native CI/CD framework** because it runs entirely within Kubernetes as custom resources, eliminating the need for external servers. You'll learn to create reusable **Tasks**, orchestrate them in **Pipelines**, and execute **PipelineRuns** with real-world examples, including security scanning and multi-environment deployments. By the end, you'll have a scalable setup that boosts developer productivity and reliability.\n\n---\n\n## 🚀 Why Choose Tekton for Your CI/CD Needs\n\n**Tekton Pipelines** excels in Kubernetes-native environments by defining workflows as declarative YAML manifests. Unlike traditional tools like Jenkins, Tekton leverages Kubernetes pods for execution, making it highly scalable and portable across clusters.\n\nKey advantages include:\n\n- **Reusability**: Share **Tasks** across pipelines via Tekton Hub or using the cluster resolver.\n- **Flexibility**: Run tasks sequentially, in parallel, or conditionally using `when` expressions.\n- **Data sharing**: Use **Workspaces** and **Results** to pass artifacts and metadata between steps without hardcoded paths.\n- **Extensibility**: Integrate with tools like Kaniko for builds, Trivy for scans, and Kubernetes for deployments.\n- **Event-driven automation**: Use Tekton Triggers with EventListeners for webhook-based pipeline execution.\n\nThe latest Tekton v1.3.1 LTS (released August 2025, supported through August 2026) emphasizes better resource management, improved performance, and stable v1 APIs. For teams managing microservices on Kubernetes, this setup reduces deployment times by up to 50% compared to agent-based systems, based on community benchmarks.\n\nVisit [hayorov.me](https://hayorov.me) for more insights into optimizing your Kubernetes workflows with modern DevOps tools.\n\n---\n\n## 📋 Prerequisites for Tekton Installation\n\nBefore diving in, ensure your environment meets these requirements:\n\n- A running **Kubernetes cluster** (v1.27+ recommended for full Tekton v1 support).\n- **kubectl** configured and working.\n- **tkn CLI** v0.43.0 or later installed.\n- Cluster-admin access for installing CRDs.\n- Persistent storage class for Workspaces (e.g., for source code sharing).\n\nInstall the latest Tekton CLI (v0.43.0+):\n\n```bash\n# macOS via Homebrew\nbrew install tektoncd-cli\n\n# Linux (x86_64)\ncurl -LO https://github.com/tektoncd/cli/releases/download/v0.43.0/tkn_0.43.0_Linux_x86_64.tar.gz\nsudo tar xvzf tkn_0.43.0_Linux_x86_64.tar.gz -C /usr/local/bin/ tkn\n\n# Verify installation\ntkn version\n```\n\n---\n\n## ⚙️ Installing Tekton Pipelines on Your Cluster\n\nTekton installation is straightforward via YAML manifests. Use the latest LTS release for production stability.\n\n1. **Install Tekton Pipelines** (latest v1.3.1 LTS):\n\n```bash\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml\n```\n\n2. **Verify installation**:\n\n```bash\ntkn version\nkubectl get pods -n tekton-pipelines\n```\n\nExpect `tekton-pipelines-controller` and `tekton-pipelines-webhook` pods running.\n\n3. **Wait for all components to be ready**:\n\n```bash\nkubectl wait --for=condition=ready pod --all -n tekton-pipelines --timeout=300s\n```\n\nFor visualization, install the **Tekton Dashboard** (latest release):\n\n```bash\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/dashboard/latest/release.yaml\n```\n\nAccess it via port-forward: `kubectl port-forward -n tekton-pipelines service/tekton-dashboard 9097:9097`, then open `http://localhost:9097` in your browser.\n\n**Pro Tip**: For production environments, pin to specific LTS versions for stability. The current LTS v1.3.1 is supported through August 2026.\n\n---\n\n## 🧩 Understanding Tekton Core Components\n\nMaster these building blocks to build flexible pipelines:\n\n- **Step**: A single container execution (e.g., `npm test`).\n- **Task**: Sequence of steps for one job (e.g., git-clone).\n- **Pipeline**: Orchestrates Tasks with parameters, workspaces, and conditions.\n- **PipelineRun**: Instantiates a Pipeline with concrete values.\n- **Workspace**: PersistentVolumeClaim or other storage for sharing files between tasks.\n- **Results**: Structured outputs passed between Tasks (e.g., image digest).\n- **Resolvers**: Fetch Tasks from external sources (Hub, Git, Bundles, Cluster).\n\n**Important Note**: ClusterTasks are deprecated in favor of the **cluster resolver**. Use `resolver: cluster` in taskRef to reference cluster-scoped tasks.\n\n---\n\n## ✏️ Creating Your First Simple Task\n\nStart with a basic **git-clone Task** using the Tekton Hub resolver - the modern way to reference tasks.\n\nInstall the git-clone task from Tekton Hub:\n\n```bash\ntkn hub install task git-clone\n```\n\nTest with a standalone **TaskRun**:\n\n```yaml\napiVersion: tekton.dev/v1\nkind: TaskRun\nmetadata:\n  name: test-git-clone\nspec:\n  taskRef:\n    resolver: hub\n    params:\n    - name: catalog\n      value: tekton\n    - name: type\n      value: task\n    - name: name\n      value: git-clone\n    - name: version\n      value: \"0.9\"\n  params:\n  - name: url\n    value: https://github.com/tektoncd/pipeline\n  - name: revision\n    value: main\n  workspaces:\n  - name: output\n    persistentVolumeClaim:\n      claimName: source-pvc  # Create this PVC first\n```\n\nApply: `kubectl apply -f taskrun.yaml`, then check logs: `tkn taskrun logs test-git-clone -f`.\n\nThis clones the repo into a Workspace, foundational for pipelines.\n\n---\n\n## 🔨 Building a Basic Pipeline: Clone, Build, and Push\n\nCombine Tasks into a **Pipeline** for a classic flow: clone → build → push.\n\nInstall required tasks from Tekton Hub:\n\n```bash\ntkn hub install task git-clone\ntkn hub install task kaniko\n```\n\nCreate `basic-pipeline.yaml` using v1 API:\n\n```yaml\napiVersion: tekton.dev/v1\nkind: Pipeline\nmetadata:\n  name: build-and-push\nspec:\n  params:\n  - name: git-url\n    type: string\n  - name: image\n    type: string\n  - name: revision\n    type: string\n    default: \"main\"\n  workspaces:\n  - name: source\n  - name: dockerconfig\n  tasks:\n  - name: fetch-repo\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: git-clone\n      - name: version\n        value: \"0.9\"\n    params:\n    - name: url\n      value: $(params.git-url)\n    - name: revision\n      value: $(params.revision)\n    workspaces:\n    - name: output\n      workspace: source\n  - name: build-push\n    runAfter: [fetch-repo]\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: kaniko\n      - name: version\n        value: \"0.6\"\n    workspaces:\n    - name: source\n      workspace: source\n    - name: dockerconfig\n      workspace: dockerconfig\n    params:\n    - name: IMAGE\n      value: $(params.image)\n```\n\nApply: `kubectl apply -f basic-pipeline.yaml`.\n\n---\n\n## ▶️ Executing Your First PipelineRun\n\nCreate a PVC for Workspace:\n\n```yaml\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n  name: source-pvc\nspec:\n  accessModes:\n    - ReadWriteOnce\n  resources:\n    requests:\n      storage: 5Gi\n```\n\nCreate a Docker config secret for pushing images:\n\n```bash\nkubectl create secret docker-registry docker-credentials \\\n  --docker-server=docker.io \\\n  --docker-username=YOUR_USERNAME \\\n  --docker-password=YOUR_PASSWORD \\\n  --docker-email=YOUR_EMAIL\n```\n\nRun the Pipeline:\n\n```yaml\napiVersion: tekton.dev/v1\nkind: PipelineRun\nmetadata:\n  generateName: basic-run-\nspec:\n  pipelineRef:\n    name: build-and-push\n  params:\n  - name: git-url\n    value: https://github.com/your-org/sample-app\n  - name: image\n    value: docker.io/yourusername/sample-app:latest\n  - name: revision\n    value: main\n  workspaces:\n  - name: source\n    persistentVolumeClaim:\n      claimName: source-pvc\n  - name: dockerconfig\n    secret:\n      secretName: docker-credentials\n  timeouts:\n    pipeline: \"30m\"\n```\n\nApply with: `kubectl create -f pipelinerun.yaml` (note: use create for generateName), then monitor: `tkn pipelinerun logs -f -L`.\n\nSuccess! Your code is cloned, built with Kaniko (no Docker daemon needed), and pushed.\n\n---\n\n## 🏗️ Advanced Pipeline: Full CI/CD with Tests, Scans, and Deployments\n\nScale to production with testing, security scanning, and multi-stage deploys.\n\nInstall additional tasks:\n\n```bash\ntkn hub install task git-clone\ntkn hub install task kaniko\ntkn hub install task trivy-scanner\ntkn hub install task kubernetes-actions\n```\n\nCreate `advanced-pipeline.yaml` with modern v1 API and hub resolver:\n\n```yaml\napiVersion: tekton.dev/v1\nkind: Pipeline\nmetadata:\n  name: app-cicd-pipeline\nspec:\n  params:\n  - name: git-url\n    type: string\n  - name: git-revision\n    type: string\n    default: \"main\"\n  - name: image-registry\n    type: string\n    default: \"docker.io\"\n  - name: image-name\n    type: string\n  - name: deploy-env\n    type: string\n    default: \"staging\"\n  workspaces:\n  - name: source-code\n  - name: docker-config\n  - name: kubeconfig\n  results:\n  - name: image-digest\n    value: $(tasks.build-image.results.IMAGE_DIGEST)\n  tasks:\n  # Clone repository\n  - name: fetch-source\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: git-clone\n      - name: version\n        value: \"0.9\"\n    params:\n    - name: url\n      value: $(params.git-url)\n    - name: revision\n      value: $(params.git-revision)\n    workspaces:\n    - name: output\n      workspace: source-code\n\n  # Parallel: Tests and Security Scan\n  - name: run-unit-tests\n    taskRef:\n      name: run-tests  # Custom Task: npm test, pytest, etc.\n    runAfter: [fetch-source]\n    workspaces:\n    - name: source\n      workspace: source-code\n\n  - name: security-scan\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: trivy-scanner\n      - name: version\n        value: \"0.2\"\n    runAfter: [fetch-source]\n    params:\n    - name: ARGS\n      value: [\"fs\", \"--severity\", \"CRITICAL,HIGH\", \".\"]\n    - name: IMAGE_PATH\n      value: \".\"\n    workspaces:\n    - name: manifest-dir\n      workspace: source-code\n\n  # Build after tests pass\n  - name: build-image\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: kaniko\n      - name: version\n        value: \"0.6\"\n    runAfter:\n    - run-unit-tests\n    - security-scan\n    params:\n    - name: IMAGE\n      value: \"$(params.image-registry)/$(params.image-name):$(params.git-revision)\"\n    workspaces:\n    - name: source\n      workspace: source-code\n    - name: dockerconfig\n      workspace: docker-config\n\n  # Conditional Deploy to Staging\n  - name: deploy-staging\n    taskRef:\n      resolver: hub\n      params:\n      - name: catalog\n        value: tekton\n      - name: type\n        value: task\n      - name: name\n        value: kubernetes-actions\n      - name: version\n        value: \"0.2\"\n    runAfter: [build-image]\n    when:\n    - input: $(params.deploy-env)\n      operator: in\n      values: [\"staging\"]\n    params:\n    - name: script\n      value: |\n        kubectl set image deployment/myapp myapp=$(params.image-registry)/$(params.image-name):$(params.git-revision) -n staging\n        kubectl rollout status deployment/myapp -n staging\n    workspaces:\n    - name: kubeconfig-dir\n      workspace: kubeconfig\n\n  finally:\n  - name: cleanup\n    taskRef:\n      name: cleanup-workspace\n    workspaces:\n    - name: source\n      workspace: source-code\n```\n\nKey enhancements:\n\n- **Hub resolver**: Modern way to reference tasks from Tekton Hub (no more ClusterTasks).\n- **Parallel execution**: Tests and security scans run simultaneously for faster feedback.\n- **When conditions**: Environment-specific deploys based on parameters.\n- **Finally block**: Ensures cleanup/notifications always run, even on failure.\n- **Pipeline-level Results**: Capture deployable artifacts like image digests.\n- **Timeouts**: Prevent resource hogs with task and pipeline-level timeouts.\n\n---\n\n## 🔐 Service Accounts, Secrets, and Security Best Practices\n\nSecure your pipeline with proper RBAC and secret management:\n\n1. **Create ServiceAccount with proper permissions**:\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: pipeline-sa\n  namespace: default\nsecrets:\n- name: docker-credentials\n- name: kubeconfig-secret\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n  name: pipeline-deployer\n  namespace: staging\nrules:\n- apiGroups: [\"apps\"]\n  resources: [\"deployments\"]\n  verbs: [\"get\", \"list\", \"patch\", \"update\"]\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: pipeline-sa-deployer\n  namespace: staging\nsubjects:\n- kind: ServiceAccount\n  name: pipeline-sa\n  namespace: default\nroleRef:\n  kind: Role\n  name: pipeline-deployer\n  apiGroup: rbac.authorization.k8s.io\n```\n\n2. **Registry Secret** (already created in previous section):\n\n```bash\nkubectl create secret docker-registry docker-credentials \\\n  --docker-server=docker.io \\\n  --docker-username=youruser \\\n  --docker-password=yourtoken \\\n  --docker-email=you@example.com\n```\n\n3. **Kubeconfig for Deployments**: Create a service account in your target cluster with deploy permissions, extract the token, and create a kubeconfig secret.\n\n4. **Resource Limits and Timeouts**:\n\n```yaml\n# Add to individual tasks\ntimeout: 10m\ncomputeResources:\n  requests:\n    cpu: 500m\n    memory: 512Mi\n  limits:\n    cpu: 1000m\n    memory: 1Gi\n```\n\n**2026 Security Best Practices**:\n\n- Use **Workload Identity** or **IRSA** (IAM Roles for Service Accounts) instead of static credentials where possible.\n- Parameterize all sensitive inputs; never hardcode secrets in YAML.\n- Use **immutable image tags** (git commit SHA) instead of `latest`.\n- Implement **Trivy scanning** with severity thresholds (CRITICAL, HIGH).\n- Enable **SBOM generation** for supply chain security.\n- Use **signed bundles** with Tekton Chains for task provenance.\n- Implement **network policies** to restrict pod-to-pod communication.\n- Version pipelines in Git alongside application code (GitOps approach).\n- Use **OPA Gatekeeper** or Kyverno for policy enforcement.\n\n---\n\n## ⚡ Event-Driven Automation with Tekton Triggers\n\nAutomate pipeline execution using webhooks with Tekton Triggers and EventListeners.\n\nInstall Tekton Triggers:\n\n```bash\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml\n```\n\nCreate an EventListener for GitHub webhooks:\n\n```yaml\napiVersion: triggers.tekton.dev/v1beta1\nkind: EventListener\nmetadata:\n  name: github-listener\nspec:\n  serviceAccountName: pipeline-sa\n  triggers:\n  - name: github-push\n    interceptors:\n    - ref:\n        name: github\n      params:\n      - name: eventTypes\n        value: [\"push\"]\n    bindings:\n    - ref: github-binding\n    template:\n      ref: pipeline-template\n---\napiVersion: triggers.tekton.dev/v1beta1\nkind: TriggerBinding\nmetadata:\n  name: github-binding\nspec:\n  params:\n  - name: gitrevision\n    value: $(body.head_commit.id)\n  - name: gitrepositoryurl\n    value: $(body.repository.clone_url)\n---\napiVersion: triggers.tekton.dev/v1beta1\nkind: TriggerTemplate\nmetadata:\n  name: pipeline-template\nspec:\n  params:\n  - name: gitrevision\n  - name: gitrepositoryurl\n  resourcetemplates:\n  - apiVersion: tekton.dev/v1\n    kind: PipelineRun\n    metadata:\n      generateName: github-run-\n    spec:\n      pipelineRef:\n        name: app-cicd-pipeline\n      params:\n      - name: git-url\n        value: $(tt.params.gitrepositoryurl)\n      - name: git-revision\n        value: $(tt.params.gitrevision)\n      - name: image-name\n        value: myapp\n      workspaces:\n      - name: source-code\n        volumeClaimTemplate:\n          spec:\n            accessModes:\n            - ReadWriteOnce\n            resources:\n              requests:\n                storage: 1Gi\n      - name: docker-config\n        secret:\n          secretName: docker-credentials\n```\n\nExpose the EventListener:\n\n```bash\nkubectl port-forward service/el-github-listener 8080:8080\n```\n\nConfigure your GitHub repository webhook to point to the EventListener URL (use ngrok or Ingress for external access).\n\n---\n\n## 📊 Monitoring, Troubleshooting, and Optimization\n\n- **Logs**:\n\n```bash\ntkn pipelinerun logs <name> -f\ntkn pipelinerun list\ntkn taskrun list\n```\n\n- **Dashboard**: Visualize pipeline graphs, execution status, and logs at `http://localhost:9097`.\n\n- **Events**:\n\n```bash\nkubectl get events --sort-by='.lastTimestamp' -n default\nkubectl describe pipelinerun <name>\n```\n\n- **Prometheus Metrics**: Enable monitoring with Prometheus Operator:\n\n```bash\nkubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/latest/release-metrics.yaml\n```\n\n- **Common Issues and Fixes**:\n\n| Issue | Fix |\n|-------|-----|\n| PVC not bound | Check storage class exists and has provisioner |\n| Permission denied | Verify ServiceAccount RBAC roles and bindings |\n| Task timeout | Increase timeout or optimize task steps |\n| Image push fail | Verify registry credentials and network access |\n| Resolver error | Check Hub connectivity or use specific versions |\n| Workspace error | Ensure PVC/secret exists and is accessible |\n\n---\n\n## 🏢 Scaling Tekton for Enterprise Workloads\n\nFor large teams and production environments:\n\n- **EventListeners with Triggers**: Auto-run pipelines on Git events (push, PR, tag).\n- **Multi-tenancy**: Use namespaces and ResourceQuotas to isolate teams.\n- **Multi-cluster deployments**: Deploy to multiple clusters using different kubeconfigs.\n- **Metrics and Observability**:\n  - Enable Prometheus integration for metrics collection\n  - Use Grafana dashboards for visualization\n  - Integrate with OpenTelemetry for distributed tracing\n- **Cost Optimization**:\n  - Use ephemeral workspaces with emptyDir for non-persistent data\n  - Implement autoscaling for EventListener pods\n  - Set aggressive resource limits on Tasks\n  - Use spot instances for build workloads\n- **GitOps Integration**: Combine with ArgoCD or Flux for complete CI/CD:\n  - Tekton builds and pushes images\n  - ArgoCD/Flux handles deployment and sync\n  - Maintain separation of concerns\n- **Supply Chain Security**:\n  - Use Tekton Chains for artifact signing and provenance\n  - Generate SBOMs (Software Bill of Materials)\n  - Implement policy enforcement with OPA/Kyverno\n\n---\n\n## 🆕 What's New in Tekton 2026\n\nRecent advancements in Tekton v1.3.x (2026) include:\n\n- **Stable v1 API**: Migration from v1beta1 complete; use `tekton.dev/v1` for all resources.\n- **Improved Resolvers**: Hub, Git, Bundle, and Cluster resolvers are production-ready.\n- **Pipeline-level Results**: Aggregate results from multiple tasks.\n- **Better Resource Management**: Enhanced scheduling and resource allocation.\n- **Enhanced Security**: Non-root container execution by default.\n- **Performance Improvements**: Faster webhook processing and controller responsiveness.\n- **Tekton Chains Integration**: Built-in support for artifact signing and SLSA provenance.\n\n---\n\n## 🎯 Conclusion\n\nMastering Tekton unlocks Kubernetes-native CI/CD that grows with your applications. This guide covered installation, basic and advanced pipelines, security best practices, event-driven automation, and enterprise scaling patterns using the latest Tekton v1 APIs and tooling available in 2026.\n\nStart with the basic clone-build-push example, iterate to advanced flows with testing and security scanning, then add event-driven automation with Triggers. Integrate with ArgoCD for GitOps-based deployments and implement supply chain security with Tekton Chains.\n\nExplore more DevOps automation patterns and Kubernetes best practices at [hayorov.me](https://hayorov.me) to continue elevating your cloud-native journey.\n\n---\n\n## 📚 Additional Resources\n\n- [Official Tekton Documentation](https://tekton.dev/docs/)\n- [Tekton Hub](https://hub.tekton.dev/) - Reusable Tasks and Pipelines\n- [Tekton Pipelines GitHub](https://github.com/tektoncd/pipeline)\n- [Tekton Triggers GitHub](https://github.com/tektoncd/triggers)\n- [Tekton Chains Documentation](https://tekton.dev/docs/chains/)","content_text":"🔧 Tool: Tekton Pipelines v1.3.x LTS ☸️ Platform: Kubernetes v1.27+ 📦 Scope: CI/CD — Build, Test, Scan, Deploy 🕐 Updated: February 2026\nSetting up a CI/CD pipeline with Tekton transforms how you handle continuous integration and delivery in Kubernetes environments. This guide walks you through every step - from installation to running a production-ready pipeline - using the latest Tekton practices as of early 2026, enabling you to automate builds, tests, scans, and deployments efficiently on your cluster.\nTekton stands out as a cloud-native CI/CD framework because it runs entirely within Kubernetes as custom resources, eliminating the need for external servers. You’ll learn to create reusable Tasks, orchestrate them in Pipelines, and execute PipelineRuns with real-world examples, including security scanning and multi-environment deployments. By the end, you’ll have a scalable setup that boosts developer productivity and reliability.\n🚀 Why Choose Tekton for Your CI/CD Needs # Tekton Pipelines excels in Kubernetes-native environments by defining workflows as declarative YAML manifests. Unlike traditional tools like Jenkins, Tekton leverages Kubernetes pods for execution, making it highly scalable and portable across clusters.\nKey advantages include:\nReusability: Share Tasks across pipelines via Tekton Hub or using the cluster resolver. Flexibility: Run tasks sequentially, in parallel, or conditionally using when expressions. Data sharing: Use Workspaces and Results to pass artifacts and metadata between steps without hardcoded paths. Extensibility: Integrate with tools like Kaniko for builds, Trivy for scans, and Kubernetes for deployments. Event-driven automation: Use Tekton Triggers with EventListeners for webhook-based pipeline execution. The latest Tekton v1.3.1 LTS (released August 2025, supported through August 2026) emphasizes better resource management, improved performance, and stable v1 APIs. For teams managing microservices on Kubernetes, this setup reduces deployment times by up to 50% compared to agent-based systems, based on community benchmarks.\nVisit hayorov.me for more insights into optimizing your Kubernetes workflows with modern DevOps tools.\n📋 Prerequisites for Tekton Installation # Before diving in, ensure your environment meets these requirements:\nA running Kubernetes cluster (v1.27+ recommended for full Tekton v1 support). kubectl configured and working. tkn CLI v0.43.0 or later installed. Cluster-admin access for installing CRDs. Persistent storage class for Workspaces (e.g., for source code sharing). Install the latest Tekton CLI (v0.43.0+):\n# macOS via Homebrew brew install tektoncd-cli # Linux (x86_64) curl -LO https://github.com/tektoncd/cli/releases/download/v0.43.0/tkn_0.43.0_Linux_x86_64.tar.gz sudo tar xvzf tkn_0.43.0_Linux_x86_64.tar.gz -C /usr/local/bin/ tkn # Verify installation tkn version ⚙️ Installing Tekton Pipelines on Your Cluster # Tekton installation is straightforward via YAML manifests. Use the latest LTS release for production stability.\nInstall Tekton Pipelines (latest v1.3.1 LTS): kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml Verify installation: tkn version kubectl get pods -n tekton-pipelines Expect tekton-pipelines-controller and tekton-pipelines-webhook pods running.\nWait for all components to be ready: kubectl wait --for=condition=ready pod --all -n tekton-pipelines --timeout=300s For visualization, install the Tekton Dashboard (latest release):\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/dashboard/latest/release.yaml Access it via port-forward: kubectl port-forward -n tekton-pipelines service/tekton-dashboard 9097:9097, then open http://localhost:9097 in your browser.\nPro Tip: For production environments, pin to specific LTS versions for stability. The current LTS v1.3.1 is supported through August 2026.\n🧩 Understanding Tekton Core Components # Master these building blocks to build flexible pipelines:\nStep: A single container execution (e.g., npm test). Task: Sequence of steps for one job (e.g., git-clone). Pipeline: Orchestrates Tasks with parameters, workspaces, and conditions. PipelineRun: Instantiates a Pipeline with concrete values. Workspace: PersistentVolumeClaim or other storage for sharing files between tasks. Results: Structured outputs passed between Tasks (e.g., image digest). Resolvers: Fetch Tasks from external sources (Hub, Git, Bundles, Cluster). Important Note: ClusterTasks are deprecated in favor of the cluster resolver. Use resolver: cluster in taskRef to reference cluster-scoped tasks.\n✏️ Creating Your First Simple Task # Start with a basic git-clone Task using the Tekton Hub resolver - the modern way to reference tasks.\nInstall the git-clone task from Tekton Hub:\ntkn hub install task git-clone Test with a standalone TaskRun:\napiVersion: tekton.dev/v1 kind: TaskRun metadata: name: test-git-clone spec: taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: git-clone - name: version value: \"0.9\" params: - name: url value: https://github.com/tektoncd/pipeline - name: revision value: main workspaces: - name: output persistentVolumeClaim: claimName: source-pvc # Create this PVC first Apply: kubectl apply -f taskrun.yaml, then check logs: tkn taskrun logs test-git-clone -f.\nThis clones the repo into a Workspace, foundational for pipelines.\n🔨 Building a Basic Pipeline: Clone, Build, and Push # Combine Tasks into a Pipeline for a classic flow: clone → build → push.\nInstall required tasks from Tekton Hub:\ntkn hub install task git-clone tkn hub install task kaniko Create basic-pipeline.yaml using v1 API:\napiVersion: tekton.dev/v1 kind: Pipeline metadata: name: build-and-push spec: params: - name: git-url type: string - name: image type: string - name: revision type: string default: \"main\" workspaces: - name: source - name: dockerconfig tasks: - name: fetch-repo taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: git-clone - name: version value: \"0.9\" params: - name: url value: $(params.git-url) - name: revision value: $(params.revision) workspaces: - name: output workspace: source - name: build-push runAfter: [fetch-repo] taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: kaniko - name: version value: \"0.6\" workspaces: - name: source workspace: source - name: dockerconfig workspace: dockerconfig params: - name: IMAGE value: $(params.image) Apply: kubectl apply -f basic-pipeline.yaml.\n▶️ Executing Your First PipelineRun # Create a PVC for Workspace:\napiVersion: v1 kind: PersistentVolumeClaim metadata: name: source-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 5Gi Create a Docker config secret for pushing images:\nkubectl create secret docker-registry docker-credentials \\ --docker-server=docker.io \\ --docker-username=YOUR_USERNAME \\ --docker-password=YOUR_PASSWORD \\ --docker-email=YOUR_EMAIL Run the Pipeline:\napiVersion: tekton.dev/v1 kind: PipelineRun metadata: generateName: basic-run- spec: pipelineRef: name: build-and-push params: - name: git-url value: https://github.com/your-org/sample-app - name: image value: docker.io/yourusername/sample-app:latest - name: revision value: main workspaces: - name: source persistentVolumeClaim: claimName: source-pvc - name: dockerconfig secret: secretName: docker-credentials timeouts: pipeline: \"30m\" Apply with: kubectl create -f pipelinerun.yaml (note: use create for generateName), then monitor: tkn pipelinerun logs -f -L.\nSuccess! Your code is cloned, built with Kaniko (no Docker daemon needed), and pushed.\n🏗️ Advanced Pipeline: Full CI/CD with Tests, Scans, and Deployments # Scale to production with testing, security scanning, and multi-stage deploys.\nInstall additional tasks:\ntkn hub install task git-clone tkn hub install task kaniko tkn hub install task trivy-scanner tkn hub install task kubernetes-actions Create advanced-pipeline.yaml with modern v1 API and hub resolver:\napiVersion: tekton.dev/v1 kind: Pipeline metadata: name: app-cicd-pipeline spec: params: - name: git-url type: string - name: git-revision type: string default: \"main\" - name: image-registry type: string default: \"docker.io\" - name: image-name type: string - name: deploy-env type: string default: \"staging\" workspaces: - name: source-code - name: docker-config - name: kubeconfig results: - name: image-digest value: $(tasks.build-image.results.IMAGE_DIGEST) tasks: # Clone repository - name: fetch-source taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: git-clone - name: version value: \"0.9\" params: - name: url value: $(params.git-url) - name: revision value: $(params.git-revision) workspaces: - name: output workspace: source-code # Parallel: Tests and Security Scan - name: run-unit-tests taskRef: name: run-tests # Custom Task: npm test, pytest, etc. runAfter: [fetch-source] workspaces: - name: source workspace: source-code - name: security-scan taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: trivy-scanner - name: version value: \"0.2\" runAfter: [fetch-source] params: - name: ARGS value: [\"fs\", \"--severity\", \"CRITICAL,HIGH\", \".\"] - name: IMAGE_PATH value: \".\" workspaces: - name: manifest-dir workspace: source-code # Build after tests pass - name: build-image taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: kaniko - name: version value: \"0.6\" runAfter: - run-unit-tests - security-scan params: - name: IMAGE value: \"$(params.image-registry)/$(params.image-name):$(params.git-revision)\" workspaces: - name: source workspace: source-code - name: dockerconfig workspace: docker-config # Conditional Deploy to Staging - name: deploy-staging taskRef: resolver: hub params: - name: catalog value: tekton - name: type value: task - name: name value: kubernetes-actions - name: version value: \"0.2\" runAfter: [build-image] when: - input: $(params.deploy-env) operator: in values: [\"staging\"] params: - name: script value: | kubectl set image deployment/myapp myapp=$(params.image-registry)/$(params.image-name):$(params.git-revision) -n staging kubectl rollout status deployment/myapp -n staging workspaces: - name: kubeconfig-dir workspace: kubeconfig finally: - name: cleanup taskRef: name: cleanup-workspace workspaces: - name: source workspace: source-code Key enhancements:\nHub resolver: Modern way to reference tasks from Tekton Hub (no more ClusterTasks). Parallel execution: Tests and security scans run simultaneously for faster feedback. When conditions: Environment-specific deploys based on parameters. Finally block: Ensures cleanup/notifications always run, even on failure. Pipeline-level Results: Capture deployable artifacts like image digests. Timeouts: Prevent resource hogs with task and pipeline-level timeouts. 🔐 Service Accounts, Secrets, and Security Best Practices # Secure your pipeline with proper RBAC and secret management:\nCreate ServiceAccount with proper permissions: apiVersion: v1 kind: ServiceAccount metadata: name: pipeline-sa namespace: default secrets: - name: docker-credentials - name: kubeconfig-secret --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: pipeline-deployer namespace: staging rules: - apiGroups: [\"apps\"] resources: [\"deployments\"] verbs: [\"get\", \"list\", \"patch\", \"update\"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: pipeline-sa-deployer namespace: staging subjects: - kind: ServiceAccount name: pipeline-sa namespace: default roleRef: kind: Role name: pipeline-deployer apiGroup: rbac.authorization.k8s.io Registry Secret (already created in previous section): kubectl create secret docker-registry docker-credentials \\ --docker-server=docker.io \\ --docker-username=youruser \\ --docker-password=yourtoken \\ --docker-email=you@example.com Kubeconfig for Deployments: Create a service account in your target cluster with deploy permissions, extract the token, and create a kubeconfig secret.\nResource Limits and Timeouts:\n# Add to individual tasks timeout: 10m computeResources: requests: cpu: 500m memory: 512Mi limits: cpu: 1000m memory: 1Gi 2026 Security Best Practices:\nUse Workload Identity or IRSA (IAM Roles for Service Accounts) instead of static credentials where possible. Parameterize all sensitive inputs; never hardcode secrets in YAML. Use immutable image tags (git commit SHA) instead of latest. Implement Trivy scanning with severity thresholds (CRITICAL, HIGH). Enable SBOM generation for supply chain security. Use signed bundles with Tekton Chains for task provenance. Implement network policies to restrict pod-to-pod communication. Version pipelines in Git alongside application code (GitOps approach). Use OPA Gatekeeper or Kyverno for policy enforcement. ⚡ Event-Driven Automation with Tekton Triggers # Automate pipeline execution using webhooks with Tekton Triggers and EventListeners.\nInstall Tekton Triggers:\nkubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml Create an EventListener for GitHub webhooks:\napiVersion: triggers.tekton.dev/v1beta1 kind: EventListener metadata: name: github-listener spec: serviceAccountName: pipeline-sa triggers: - name: github-push interceptors: - ref: name: github params: - name: eventTypes value: [\"push\"] bindings: - ref: github-binding template: ref: pipeline-template --- apiVersion: triggers.tekton.dev/v1beta1 kind: TriggerBinding metadata: name: github-binding spec: params: - name: gitrevision value: $(body.head_commit.id) - name: gitrepositoryurl value: $(body.repository.clone_url) --- apiVersion: triggers.tekton.dev/v1beta1 kind: TriggerTemplate metadata: name: pipeline-template spec: params: - name: gitrevision - name: gitrepositoryurl resourcetemplates: - apiVersion: tekton.dev/v1 kind: PipelineRun metadata: generateName: github-run- spec: pipelineRef: name: app-cicd-pipeline params: - name: git-url value: $(tt.params.gitrepositoryurl) - name: git-revision value: $(tt.params.gitrevision) - name: image-name value: myapp workspaces: - name: source-code volumeClaimTemplate: spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi - name: docker-config secret: secretName: docker-credentials Expose the EventListener:\nkubectl port-forward service/el-github-listener 8080:8080 Configure your GitHub repository webhook to point to the EventListener URL (use ngrok or Ingress for external access).\n📊 Monitoring, Troubleshooting, and Optimization # Logs: tkn pipelinerun logs <name> -f tkn pipelinerun list tkn taskrun list Dashboard: Visualize pipeline graphs, execution status, and logs at http://localhost:9097.\nEvents:\nkubectl get events --sort-by='.lastTimestamp' -n default kubectl describe pipelinerun <name> Prometheus Metrics: Enable monitoring with Prometheus Operator: kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/latest/release-metrics.yaml Common Issues and Fixes: Issue Fix PVC not bound Check storage class exists and has provisioner Permission denied Verify ServiceAccount RBAC roles and bindings Task timeout Increase timeout or optimize task steps Image push fail Verify registry credentials and network access Resolver error Check Hub connectivity or use specific versions Workspace error Ensure PVC/secret exists and is accessible 🏢 Scaling Tekton for Enterprise Workloads # For large teams and production environments:\nEventListeners with Triggers: Auto-run pipelines on Git events (push, PR, tag). Multi-tenancy: Use namespaces and ResourceQuotas to isolate teams. Multi-cluster deployments: Deploy to multiple clusters using different kubeconfigs. Metrics and Observability: Enable Prometheus integration for metrics collection Use Grafana dashboards for visualization Integrate with OpenTelemetry for distributed tracing Cost Optimization: Use ephemeral workspaces with emptyDir for non-persistent data Implement autoscaling for EventListener pods Set aggressive resource limits on Tasks Use spot instances for build workloads GitOps Integration: Combine with ArgoCD or Flux for complete CI/CD: Tekton builds and pushes images ArgoCD/Flux handles deployment and sync Maintain separation of concerns Supply Chain Security: Use Tekton Chains for artifact signing and provenance Generate SBOMs (Software Bill of Materials) Implement policy enforcement with OPA/Kyverno 🆕 What’s New in Tekton 2026 # Recent advancements in Tekton v1.3.x (2026) include:\nStable v1 API: Migration from v1beta1 complete; use tekton.dev/v1 for all resources. Improved Resolvers: Hub, Git, Bundle, and Cluster resolvers are production-ready. Pipeline-level Results: Aggregate results from multiple tasks. Better Resource Management: Enhanced scheduling and resource allocation. Enhanced Security: Non-root container execution by default. Performance Improvements: Faster webhook processing and controller responsiveness. Tekton Chains Integration: Built-in support for artifact signing and SLSA provenance. 🎯 Conclusion # Mastering Tekton unlocks Kubernetes-native CI/CD that grows with your applications. This guide covered installation, basic and advanced pipelines, security best practices, event-driven automation, and enterprise scaling patterns using the latest Tekton v1 APIs and tooling available in 2026.\nStart with the basic clone-build-push example, iterate to advanced flows with testing and security scanning, then add event-driven automation with Triggers. Integrate with ArgoCD for GitOps-based deployments and implement supply chain security with Tekton Chains.\nExplore more DevOps automation patterns and Kubernetes best practices at hayorov.me to continue elevating your cloud-native journey.\n📚 Additional Resources # Official Tekton Documentation Tekton Hub - Reusable Tasks and Pipelines Tekton Pipelines GitHub Tekton Triggers GitHub Tekton Chains Documentation ","date":"2026-02-05T00:00:00Z","description":"Step-by-step guide to setting up CI/CD pipelines with Tekton on Kubernetes, covering Tasks, Pipelines, and security scanning.","json_url":"https://hayorov.me/posts/tekton-cicd-pipeline-guide/index.json","language":"en","lastmod":"2026-04-14T01:12:05+08:00","markdown_url":"https://hayorov.me/posts/tekton-cicd-pipeline-guide/index.md","reading_time_minutes":11,"section":"posts","tags":["tekton","kubernetes","cicd","devops"],"title":"Step-by-Step: Setting Up a CI/CD Pipeline Using Tekton","type":"article","url":"https://hayorov.me/posts/tekton-cicd-pipeline-guide/","word_count":2286}