Build and Deploy CI/CD Pipelines with Tekton

This skill designs Tekton Pipelines - the Kubernetes-native CI/CD framework - covering Tasks, Pipelines, Triggers, and associated resources, with attention to security, performance, and maintainability. Tasks are designed atomic and reusable, each focused on a single responsibility, with typed and enum-validated parameters, defined resource requests and limits, workspaces for sharing data between steps and tasks, and lightweight results for passing data between tasks. Pipeline orchestration uses runAfter for explicit dependencies, relies on implicit parallelism for independent tasks, implements fan-out/fan-in patterns for complex workflows, and gates steps with when expressions for conditional execution - for example, fetching source, then running tests and a security scan in parallel, building the image only once both pass, and deploying only to dev or staging environments based on a pipeline parameter.

Use it when building a Kubernetes-native CI/CD pipeline that needs security hardening, parallel task orchestration, and event-driven triggers - not a simple shell script wrapped in a container. It is not meant to skip validation: pipeline definitions should be checked with tkn pipeline start --dry-run and covered by unit tests for individual tasks plus integration tests for complete pipelines before relying on them.

Given a build and deploy requirement, it produces workspace configurations matched to the data's lifetime (a PVC for data persisting across pipeline runs, EmptyDir for temporary data within a single run, ConfigMap or Secret for configuration and credentials, and a dynamically-provisioned VolumeClaimTemplate), least-privilege RBAC (a dedicated ServiceAccount, a Role scoped to specific verbs on pods, secrets, configmaps, and deployments, and a RoleBinding tying them together), and event-driven trigger configuration (an EventListener with a GitHub interceptor validating a webhook secret and filtering by event type, chained with a CEL interceptor filtering pushes to the main branch only).

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: comprehensive-ci-cd
spec:
  params:
  - name: git-repo-url
    type: string
  - name: image-registry
    type: string
  - name: environment
    type: string
    enum: ["dev", "staging", "prod"]
  workspaces:
  - name: shared-workspace
  - name: registry-credentials
  tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    params:
    - name: url
      value: $(params.git-repo-url)
    workspaces:
    - name: output
      workspace: shared-workspace
  
  - name: run-tests
    runAfter: ["fetch-source"]
    taskRef:
      name: golang-test
    workspaces:
    - name: source
      workspace: shared-workspace
  
  - name: security-scan
    runAfter: ["fetch-source"]
    taskRef:
      name: trivy-scan
    workspaces:
    - name: source
      workspace: shared-workspace
  
  - name: build-image
    runAfter: ["run-tests", "security-scan"]
    taskRef:
      name: build-and-push
    params:
    - name: image-url
      value: "$(params.image-registry)/app:$(tasks.fetch-source.results.commit)"
    workspaces:
    - name: source
      workspace: shared-workspace
    - name: dockerconfig
      workspace: registry-credentials
  
  - name: deploy
    runAfter: ["build-image"]
    when:
    - input: "$(params.environment)"
      operator: in
      values: ["dev", "staging"]
    taskRef:
      name: kubectl-deploy
    params:
    - name: image-digest
      value: "$(tasks.build-image.results.image-digest)"

Performance and observability layer on top: CPU and memory requests and limits, node affinity for workload placement, cleanup policies, and pipeline-level caching, alongside structured logging, Prometheus metrics collection, distributed tracing for complex pipelines, and alerting on pipeline failures. Debugging relies on the tkn CLI for pipeline inspection and logs, debug sleep steps for live investigation, verbose task logging, and kubectl describe for resource status, with named common pitfalls to check first - workspace mounting issues from the wrong volume type, parameter type-mismatch validation failures, OOMKilled containers from tight resource limits, RBAC permission blocks, and registry authentication failures on image pull.

Platform engineers building Kubernetes-native CI/CD who need the full Tekton pattern set - task design, workspace lifetime management, RBAC scoping, event-driven triggers, and observability - not just a single pipeline definition copied from a tutorial.