{"id":15516224,"url":"https://github.com/dippynark/cicd-demo","last_synced_at":"2026-02-14T12:36:56.848Z","repository":{"id":53759442,"uuid":"341677293","full_name":"dippynark/cicd-demo","owner":"dippynark","description":"CI/CD Demo","archived":false,"fork":false,"pushed_at":"2021-03-22T13:28:33.000Z","size":308,"stargazers_count":3,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-05T00:44:42.712Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dippynark.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-02-23T20:11:55.000Z","updated_at":"2021-12-26T18:14:35.000Z","dependencies_parsed_at":"2022-09-03T00:00:30.959Z","dependency_job_id":null,"html_url":"https://github.com/dippynark/cicd-demo","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/dippynark/cicd-demo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dippynark%2Fcicd-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dippynark%2Fcicd-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dippynark%2Fcicd-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dippynark%2Fcicd-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dippynark","download_url":"https://codeload.github.com/dippynark/cicd-demo/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dippynark%2Fcicd-demo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29443491,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-14T10:51:12.367Z","status":"ssl_error","status_checked_at":"2026-02-14T10:50:52.088Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-02T10:06:11.601Z","updated_at":"2026-02-14T12:36:56.818Z","avatar_url":"https://github.com/dippynark.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CI/CD Demo\n\nThis is a demo repository to complement my [Kubernetes-Native CI/CD blog\npost](https://www.jetstack.io/blog/kubernetes-native-cicd/).\n\nPrerequisites:\n\n- [gcloud](https://cloud.google.com/sdk/docs/install) configured for a GCP account with available\n  credits (using the [Free Tier](https://cloud.google.com/free) or otherwise)\n- kubectl\n- Docker\n- [Flux](https://toolkit.fluxcd.io/guides/installation/#install-the-flux-cli)\n- GitHub user account\n- GitHub bot account\n- Domain to configure hostnames:\n  - tekton\n  - lighthouse\n\n## Setup\n\nWe will perform the following steps:\n- Provision a GKE cluster suitable for running the [Kubernetes Cluster API Provider\n  Kubernetes](https://github.com/dippynark/cluster-api-provider-kubernetes)\n  - This is an experimental infrastructure provider suitable for testing\n- Install Flux to sync repository manifests\n- Create missing Secrets\n- Setup domain\n- Setup GitHub webhook\n\nCreate GKE cluster:\n\n```sh\n# We will use the Kubernetes Cluster API infrastructure provider to provision workload clusters\n# https://github.com/dippynark/cluster-api-provider-kubernetes\ngcloud container clusters create management \\\n  --image-type=UBUNTU \\\n  --machine-type=n1-standard-2\n\nCLUSTER_CIDR=`gcloud container clusters describe management --format=\"value(clusterIpv4Cidr)\"`\ngcloud compute firewall-rules create allow-management-cluster-pods-ipip \\\n  --source-ranges=$CLUSTER_CIDR \\\n  --allow=ipip\n\nkubectl apply -f https://raw.githubusercontent.com/dippynark/cluster-api-provider-kubernetes/v0.3.3/hack/forward-ipencap.yaml\n```\n\nClone this repository and set the following variables:\n\n```sh\nGITHUB_OWNER=\"dippynark\"\nGITHUB_REPOSITORY=\"cicd-demo\"\n# Personal access token for owner account with full `repo` permissions\nexport GITHUB_TOKEN=\"\"\n\nGITHUB_BOT_USERNAME=\"dippynark-bot\"\nGITHUB_BOT_EMAIL=\"lukeaddison.785@gmail.com\"\n# Personal access token for bot account with full `repo` permissions\nGITHUB_BOT_TOKEN=\"\"\n\nHMAC_TOKEN=$(openssl rand -hex 32)\n\nDOMAIN=\"dippynark.co.uk\"\n```\n\nModify the\n[clusters/management/flux-system/cluster-sync.yaml](clusters/management/flux-system/cluster-sync.yaml)\nmanagement configuration file as required (i.e. replacing `dippynark/cicd-demo`, `dippynark-bot` and\n`dippynark.co.uk` with `$GITHUB_OWNER/$GITHUB_REPOSITORY`, `$GITHUB_BOT_USERNAME` and `$DOMAIN`\nrespectively.) and update the [OWNERS file](https://www.kubernetes.dev/docs/guide/owners/):\n\n```sh\ncat \u003c\u003cEOF \u003e OWNERS\napprovers:\n- $GITHUB_OWNER\nreviewers:\n- $GITHUB_OWNER\nEOF\n```\n\nCommit the changes, push to the main branch and add the bot account as a collaborator.\n\nBootstrap the management cluster:\n\n```sh\n# This command may fail the first time due to missing CRDs; this is expected\nflux bootstrap github \\\n  --owner=$GITHUB_OWNER \\\n  --repository=$GITHUB_REPOSITORY \\\n  --path=clusters/management \\\n  --personal\n```\n\nOnce Flux has performed its initial sync, create the Git secret for bootstrapping workload clusters:\n\n```sh\nkubectl apply -f - \u003c\u003cEOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: git-auth\n  namespace: infrastructure\nstringData:\n  GITHUB_TOKEN: $GITHUB_TOKEN\n  GITHUB_OWNER: $GITHUB_OWNER\n  GITHUB_REPOSITORY: $GITHUB_REPOSITORY\nEOF\n```\n\nEventually the workload clusters should be provisioned and bootstrapped:\n\n```sh\nkubectl get kubernetesclusters,kubernetesmachines -n infrastructure\n```\n\nOnce the manifests have synced, create the Lighthouse secrets:\n\n```sh\nkubectl apply -f - \u003c\u003cEOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: lighthouse-helm-release\n  namespace: lighthouse\nstringData:\n  values.yaml: |\n    oauthToken: $GITHUB_BOT_TOKEN\n    hmacToken: $HMAC_TOKEN\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: tekton-git\n  namespace: lighthouse\n  annotations:\n    tekton.dev/git-0: https://github.com\ntype: kubernetes.io/basic-auth\nstringData:\n  username: $GITHUB_BOT_USERNAME\n  password: $GITHUB_BOT_TOKEN\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: tekton-git-identity\n  namespace: lighthouse\nstringData:\n  GIT_AUTHOR_NAME: $GITHUB_BOT_USERNAME\n  GIT_AUTHOR_EMAIL: $GITHUB_BOT_EMAIL\n  GIT_COMMITTER_NAME: $GITHUB_BOT_USERNAME\n  GIT_COMMITTER_EMAIL: $GITHUB_BOT_EMAIL\nEOF\n```\n\nCurrently, [cert-manager](https://github.com/jetstack/cert-manager) should be trying to provision a\ncertificate for your Lighthouse webhook and Tekton dashboard but it cannot since we haven't\nconfigured DNS yet; we will configure this now.\n\nYou should have a LoadBalancer Service for Nginx ingress:\n\n```sh\nkubectl get svc -n ingress-nginx ingress-nginx-controller\n```\n\nPoint the Lighthouse webhook domain (`lighthouse.$DOMAIN`) and the Tekton Dashboard domain\n(`tekton.$DOMAIN`) at the Nginx ingress external IP. Eventually the certificates should be\nprovisioned:\n\n```sh\nkubectl get certificate -n lighthouse lighthouse-hook-tls\nkubectl get certificate -n tekton-pipelines tekton-dashboard-tls\n```\n\nFinally, we create a webhook in the GitHub repository pointing at the Lighthouse webhook with the\nfollowing non-default options:\n\n- Payload URL: `https://lighthouse.$DOMAIN/hook`\n- Content type: `application/json`\n- Secret: `$HMAC_TOKEN`\n- Which events would you like to trigger this webhook?: `Send me everything.`\n\n## Usage\n\nGenerate [bases](config/bases):\n\n```sh\nmake docker_generate\n```\n\nAccess workload cluster:\n\n```sh\nCLUSTER_NAME=\"development\"\nmake get_kubeconfig_$CLUSTER_NAME\nexport KUBECONFIG=kubeconfig\nkubectl get nodes\n```\n\nPromote cluster:\n\n```sh\nmake docker_promote SOURCE=development DESTINATION=staging\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdippynark%2Fcicd-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdippynark%2Fcicd-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdippynark%2Fcicd-demo/lists"}