MACRO NEPAL
Tekton Supply Chain in Java: Comprehensive CI/CD Pipeline Implementation
awiskar acharya
December 15, 2025
1:37 pm

Tekton is a powerful Kubernetes-native framework for building CI/CD systems. This guide covers Java-based Tekton pipeline creation, custom tasks, and comprehensive supply chain automation.

Dependencies and Setup

1. Maven Dependencies
<properties> <kubernetes-client.version>6.7.2</kubernetes-client.version> <tekton-client.version>0.6.0</tekton-client.version> <jackson.version>2.15.2</jackson.version> <yaml.version>2.15.2</yaml.version> </properties> <dependencies> <!-- Tekton Client --> <dependency> <groupId>io.fabric8</groupId> <artifactId>tekton-client</artifactId> <version>${tekton-client.version}</version> </dependency> <!-- Kubernetes Client --> <dependency> <groupId>io.fabric8</groupId> <artifactId>kubernetes-client</artifactId> <version>${kubernetes-client.version}</version> </dependency> <!-- Tekton Pipeline Model --> <dependency> <groupId>io.fabric8</groupId> <artifactId>tekton-pipelines-model-v1</artifactId> <version>${tekton-client.version}</version> </dependency> <!-- YAML Processing --> <dependency> <groupId>com.fasterxml.jackson.dataformat</groupId> <artifactId>jackson-dataformat-yaml</artifactId> <version>${yaml.version}</version> </dependency> <!-- Spring Boot (Optional) --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> <version>3.1.0</version> </dependency> <!-- Validation --> <dependency> <groupId>jakarta.validation</groupId> <artifactId>jakarta.validation-api</artifactId> <version>3.0.2</version> </dependency> </dependencies>
2. Kubernetes Configuration
# tekton-config.yaml apiVersion: v1 kind: ConfigMap metadata: name: tekton-java-config data: JAVA_HOME: /usr/lib/jvm/java-17 MAVEN_HOME: /usr/share/maven MAVEN_OPTS: -Xmx2048m -XX:+UseG1GC MAVEN_ARGS: -DskipTests=false -DskipITs=false --- apiVersion: v1 kind: Secret metadata: name: tekton-secrets type: Opaque data: github-token: BASE64_ENCODED_TOKEN docker-config: BASE64_ENCODED_DOCKER_CONFIG sonar-token: BASE64_ENCODED_SONAR_TOKEN

Core Tekton Pipeline Components

1. Java Tekton Client
package com.example.tekton; import io.fabric8.kubernetes.client.Config; import io.fabric8.kubernetes.client.ConfigBuilder; import io.fabric8.kubernetes.client.DefaultKubernetesClient; import io.fabric8.kubernetes.client.KubernetesClient; import io.fabric8.tekton.client.DefaultTektonClient; import io.fabric8.tekton.client.TektonClient; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration public class TektonClientConfig { private static final Logger logger = LoggerFactory.getLogger(TektonClientConfig.class); @Value("${kubernetes.master.url:}") private String kubernetesMasterUrl; @Value("${kubernetes.namespace:default}") private String namespace; @Bean public KubernetesClient kubernetesClient() { Config config = new ConfigBuilder() .withMasterUrl(kubernetesMasterUrl) .withNamespace(namespace) .build(); return new DefaultKubernetesClient(config); } @Bean public TektonClient tektonClient(KubernetesClient kubernetesClient) { return new DefaultTektonClient(kubernetesClient); } }
2. Pipeline Model Definitions
package com.example.tekton.model; import com.fasterxml.jackson.annotation.JsonInclude; import lombok.Data; import java.util.*; @Data @JsonInclude(JsonInclude.Include.NON_NULL) public class JavaPipelineSpec { private String name; private String namespace; private String description; private String gitUrl; private String gitBranch; private String mavenVersion; private String javaVersion; private String dockerRegistry; private String dockerRepository; private List<String> stages; private Map<String, String> environment; private SecuritySettings security; private QualityGates qualityGates; private List<CustomTask> customTasks; @Data public static class SecuritySettings { private boolean vulnerabilityScan; private boolean dependencyCheck; private boolean secretDetection; private String trivyImage; private String grypeImage; } @Data public static class QualityGates { private double testCoverageThreshold; private int maxCriticalIssues; private int maxMajorIssues; private int maxTotalIssues; private boolean failOnQualityGate; } @Data public static class CustomTask { private String name; private String image; private List<String> command; private List<String> args; private Map<String, String> env; private Map<String, String> volumes; private String script; } }
3. Pipeline Builder
package com.example.tekton.builder; import io.fabric8.tekton.pipeline.v1.*; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Component; import java.util.*; @Component public class PipelineBuilder { private static final Logger logger = LoggerFactory.getLogger(PipelineBuilder.class); public Pipeline buildJavaPipeline(JavaPipelineSpec spec) { logger.info("Building Tekton pipeline for: {}", spec.getName()); Pipeline pipeline = new Pipeline(); pipeline.setMetadata(createMetadata(spec)); pipeline.setSpec(createPipelineSpec(spec)); return pipeline; } public PipelineRun buildPipelineRun(String pipelineName, Map<String, String> params, Map<String, String> workspaces) { PipelineRun pipelineRun = new PipelineRun(); pipelineRun.setMetadata(createRunMetadata(pipelineName)); pipelineRun.setSpec(createPipelineRunSpec(pipelineName, params, workspaces)); return pipelineRun; } private io.fabric8.kubernetes.api.model.ObjectMeta createMetadata(JavaPipelineSpec spec) { io.fabric8.kubernetes.api.model.ObjectMeta metadata = new io.fabric8.kubernetes.api.model.ObjectMeta(); metadata.setName(spec.getName() + "-pipeline"); metadata.setNamespace(spec.getNamespace()); metadata.setLabels(createLabels(spec)); metadata.setAnnotations(createAnnotations(spec)); return metadata; } private PipelineSpec createPipelineSpec(JavaPipelineSpec spec) { PipelineSpec pipelineSpec = new PipelineSpec(); pipelineSpec.setParams(createParams(spec)); pipelineSpec.setWorkspaces(createWorkspaces()); pipelineSpec.setTasks(createTasks(spec)); pipelineSpec.setFinally(createFinallyTasks(spec)); return pipelineSpec; } private List<ParamSpec> createParams(JavaPipelineSpec spec) { List<ParamSpec> params = new ArrayList<>(); params.add(new ParamSpecBuilder() .withName("GIT_URL") .withType("string") .withDescription("Git repository URL") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getGitUrl())) .build()); params.add(new ParamSpecBuilder() .withName("GIT_BRANCH") .withType("string") .withDescription("Git branch") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getGitBranch())) .build()); params.add(new ParamSpecBuilder() .withName("MAVEN_VERSION") .withType("string") .withDescription("Maven version") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getMavenVersion())) .build()); params.add(new ParamSpecBuilder() .withName("JAVA_VERSION") .withType("string") .withDescription("Java version") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getJavaVersion())) .build()); params.add(new ParamSpecBuilder() .withName("DOCKER_REGISTRY") .withType("string") .withDescription("Docker registry") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getDockerRegistry())) .build()); params.add(new ParamSpecBuilder() .withName("DOCKER_REPOSITORY") .withType("string") .withDescription("Docker repository") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue(spec.getDockerRepository())) .build()); return params; } private List<PipelineWorkspaceDeclaration> createWorkspaces() { List<PipelineWorkspaceDeclaration> workspaces = new ArrayList<>(); workspaces.add(new PipelineWorkspaceDeclarationBuilder() .withName("source") .withDescription("Source code workspace") .build()); workspaces.add(new PipelineWorkspaceDeclarationBuilder() .withName("maven-repo") .withDescription("Maven repository cache") .withOptional(true) .build()); workspaces.add(new PipelineWorkspaceDeclarationBuilder() .withName("docker-config") .withDescription("Docker configuration") .withOptional(true) .build()); workspaces.add(new PipelineWorkspaceDeclarationBuilder() .withName("test-reports") .withDescription("Test reports output") .build()); return workspaces; } private List<PipelineTask> createTasks(JavaPipelineSpec spec) { List<PipelineTask> tasks = new ArrayList<>(); // Clone repository tasks.add(createGitCloneTask()); // Code quality checks tasks.add(createCodeQualityTask()); // Dependency check if (spec.getSecurity() != null && spec.getSecurity().isDependencyCheck()) { tasks.add(createDependencyCheckTask()); } // Build and test tasks.add(createMavenBuildTask()); // Unit tests tasks.add(createUnitTestTask()); // Integration tests tasks.add(createIntegrationTestTask()); // Security scan if (spec.getSecurity() != null && spec.getSecurity().isVulnerabilityScan()) { tasks.add(createSecurityScanTask(spec)); } // Build container image tasks.add(createDockerBuildTask()); // Scan container image tasks.add(createContainerScanTask(spec)); // Push container image tasks.add(createDockerPushTask()); // Add custom tasks if (spec.getCustomTasks() != null) { spec.getCustomTasks().forEach(customTask -> tasks.add(createCustomTask(customTask))); } return tasks; } private List<PipelineTask> createFinallyTasks(JavaPipelineSpec spec) { List<PipelineTask> finallyTasks = new ArrayList<>(); // Cleanup tasks finallyTasks.add(createCleanupTask()); // Notification tasks finallyTasks.add(createNotificationTask()); // Report generation finallyTasks.add(createReportTask()); return finallyTasks; } private PipelineTask createGitCloneTask() { return new PipelineTaskBuilder() .withName("git-clone") .withTaskRef(new TaskRefBuilder() .withName("git-clone") .withKind("ClusterTask") .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("output") .withWorkspace("source") .build() )) .withParams(Arrays.asList( new ParamBuilder() .withName("url") .withNewValue("$(params.GIT_URL)") .build(), new ParamBuilder() .withName("revision") .withNewValue("$(params.GIT_BRANCH)") .build() )) .build(); } private PipelineTask createMavenBuildTask() { return new PipelineTaskBuilder() .withName("maven-build") .withRunAfter(Arrays.asList("git-clone", "code-quality")) .withTaskSpec(createMavenTaskSpec()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("maven-repo") .withWorkspace("maven-repo") .build() )) .withParams(Arrays.asList( new ParamBuilder() .withName("MAVEN_VERSION") .withNewValue("$(params.MAVEN_VERSION)") .build(), new ParamBuilder() .withName("JAVA_VERSION") .withNewValue("$(params.JAVA_VERSION)") .build(), new ParamBuilder() .withName("GOALS") .withNewValue("clean compile") .build() )) .build(); } private EmbeddedTask createMavenTaskSpec() { return new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("maven-build") .withImage("maven:$(params.MAVEN_VERSION)-jdk-$(params.JAVA_VERSION)-slim") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("mvn")) .withArgs(Arrays.asList("$(params.GOALS)")) .withEnv(Arrays.asList( new io.fabric8.kubernetes.api.model.EnvVarBuilder() .withName("MAVEN_OPTS") .withValue("-Dmaven.repo.local=$(workspaces.maven-repo.path)/.m2/repository") .build() )) .build() )) .endSpec() .build(); } private PipelineTask createUnitTestTask() { return new PipelineTaskBuilder() .withName("unit-tests") .withRunAfter(Arrays.asList("maven-build")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("run-tests") .withImage("maven:$(params.MAVEN_VERSION)-jdk-$(params.JAVA_VERSION)-slim") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("mvn")) .withArgs(Arrays.asList( "test", "-DskipTests=false", "-DskipITs=true" )) .build(), new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("test-report") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "mkdir -p $(workspaces.test-reports.path)/unit && " + "cp -r target/surefire-reports/* $(workspaces.test-reports.path)/unit/")) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("maven-repo") .withWorkspace("maven-repo") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("reports") .withWorkspace("test-reports") .build() )) .build(); } private PipelineTask createIntegrationTestTask() { return new PipelineTaskBuilder() .withName("integration-tests") .withRunAfter(Arrays.asList("unit-tests")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("run-integration-tests") .withImage("maven:$(params.MAVEN_VERSION)-jdk-$(params.JAVA_VERSION)-slim") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("mvn")) .withArgs(Arrays.asList( "verify", "-DskipTests=true", "-DskipITs=false" )) .build(), new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("integration-report") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "mkdir -p $(workspaces.test-reports.path)/integration && " + "cp -r target/failsafe-reports/* $(workspaces.test-reports.path)/integration/")) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("maven-repo") .withWorkspace("maven-repo") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("reports") .withWorkspace("test-reports") .build() )) .build(); } private PipelineTask createCodeQualityTask() { return new PipelineTaskBuilder() .withName("code-quality") .withRunAfter(Arrays.asList("git-clone")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("sonar-scanner") .withImage("sonarsource/sonar-scanner-cli:latest") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("sonar-scanner")) .withArgs(Arrays.asList( "-Dsonar.projectKey=$(context.pipelineRun.name)", "-Dsonar.sources=.", "-Dsonar.host.url=$(params.SONAR_URL)", "-Dsonar.login=$(params.SONAR_TOKEN)" )) .build(), new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("checkstyle") .withImage("maven:$(params.MAVEN_VERSION)-jdk-$(params.JAVA_VERSION)-slim") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("mvn")) .withArgs(Arrays.asList( "checkstyle:check", "-Dcheckstyle.config.location=google_checks.xml" )) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build() )) .build(); } private PipelineTask createDependencyCheckTask() { return new PipelineTaskBuilder() .withName("dependency-check") .withRunAfter(Arrays.asList("git-clone")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("owasp-dependency-check") .withImage("owasp/dependency-check:latest") .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("dependency-check.sh")) .withArgs(Arrays.asList( "--scan", ".", "--format", "ALL", "--out", "$(workspaces.source.path)/dependency-check-report", "--project", "$(context.pipelineRun.name)" )) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build() )) .build(); } private PipelineTask createSecurityScanTask(JavaPipelineSpec spec) { String scannerImage = spec.getSecurity().getTrivyImage() != null ? spec.getSecurity().getTrivyImage() : "aquasec/trivy:latest"; return new PipelineTaskBuilder() .withName("security-scan") .withRunAfter(Arrays.asList("maven-build")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("trivy-fs-scan") .withImage(scannerImage) .withWorkingDir("$(workspaces.source.path)") .withCommand(Arrays.asList("trivy")) .withArgs(Arrays.asList( "filesystem", "--severity", "HIGH,CRITICAL", "--format", "json", "--output", "$(workspaces.source.path)/trivy-report.json", "." )) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build() )) .build(); } private PipelineTask createDockerBuildTask() { return new PipelineTaskBuilder() .withName("docker-build") .withRunAfter(Arrays.asList("integration-tests", "security-scan")) .withTaskRef(new TaskRefBuilder() .withName("buildah") .withKind("ClusterTask") .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build() )) .withParams(Arrays.asList( new ParamBuilder() .withName("IMAGE") .withNewValue("$(params.DOCKER_REGISTRY)/$(params.DOCKER_REPOSITORY):$(context.pipelineRun.name)") .build(), new ParamBuilder() .withName("DOCKERFILE") .withNewValue("Dockerfile") .build(), new ParamBuilder() .withName("CONTEXT") .withNewValue("$(workspaces.source.path)") .build() )) .build(); } private PipelineTask createContainerScanTask(JavaPipelineSpec spec) { String scannerImage = spec.getSecurity().getGrypeImage() != null ? spec.getSecurity().getGrypeImage() : "anchore/grype:latest"; return new PipelineTaskBuilder() .withName("container-scan") .withRunAfter(Arrays.asList("docker-build")) .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("grype-scan") .withImage(scannerImage) .withCommand(Arrays.asList("grype")) .withArgs(Arrays.asList( "$(params.DOCKER_REGISTRY)/$(params.DOCKER_REPOSITORY):$(context.pipelineRun.name)", "--output", "json", "--file", "/reports/container-scan.json" )) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("reports") .withWorkspace("test-reports") .build() )) .build(); } private PipelineTask createDockerPushTask() { return new PipelineTaskBuilder() .withName("docker-push") .withRunAfter(Arrays.asList("container-scan")) .withTaskRef(new TaskRefBuilder() .withName("buildah") .withKind("ClusterTask") .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("source") .withWorkspace("source") .build(), new WorkspacePipelineTaskBindingBuilder() .withName("dockerconfig") .withWorkspace("docker-config") .build() )) .withParams(Arrays.asList( new ParamBuilder() .withName("IMAGE") .withNewValue("$(params.DOCKER_REGISTRY)/$(params.DOCKER_REPOSITORY):$(context.pipelineRun.name)") .build(), new ParamBuilder() .withName("DOCKERFILE") .withNewValue("Dockerfile") .build(), new ParamBuilder() .withName("CONTEXT") .withNewValue("$(workspaces.source.path)") .build(), new ParamBuilder() .withName("TLSVERIFY") .withNewValue("false") .build() )) .build(); } private PipelineTask createCleanupTask() { return new PipelineTaskBuilder() .withName("cleanup") .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("cleanup-resources") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "echo 'Cleaning up temporary resources' && " + "sleep 5")) .build() )) .endSpec() .build()) .build(); } private PipelineTask createNotificationTask() { return new PipelineTaskBuilder() .withName("notification") .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("send-notification") .withImage("curlimages/curl:latest") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "curl -X POST -H 'Content-Type: application/json' " + "$(params.SLACK_WEBHOOK_URL) " + "-d '{\"text\":\"Pipeline $(context.pipelineRun.name) completed with status: $(tasks.status)\"}'")) .build() )) .endSpec() .build()) .build(); } private PipelineTask createReportTask() { return new PipelineTaskBuilder() .withName("generate-report") .withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName("collect-reports") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "echo 'Generating pipeline report...' && " + "ls -la $(workspaces.test-reports.path)")) .build() )) .endSpec() .build()) .withWorkspaces(Arrays.asList( new WorkspacePipelineTaskBindingBuilder() .withName("reports") .withWorkspace("test-reports") .build() )) .build(); } private PipelineTask createCustomTask(CustomTask customTask) { PipelineTaskBuilder builder = new PipelineTaskBuilder() .withName(customTask.getName()); if (customTask.getImage() != null) { builder.withTaskSpec(new EmbeddedTaskBuilder() .withNewSpec() .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1beta1.StepBuilder() .withName(customTask.getName()) .withImage(customTask.getImage()) .withCommand(customTask.getCommand()) .withArgs(customTask.getArgs()) .withEnv(convertEnvVars(customTask.getEnv())) .build() )) .endSpec() .build()); } return builder.build(); } private List<io.fabric8.kubernetes.api.model.EnvVar> convertEnvVars(Map<String, String> env) { if (env == null) return Collections.emptyList(); List<io.fabric8.kubernetes.api.model.EnvVar> envVars = new ArrayList<>(); env.forEach((key, value) -> envVars.add(new io.fabric8.kubernetes.api.model.EnvVarBuilder() .withName(key) .withValue(value) .build())); return envVars; } private Map<String, String> createLabels(JavaPipelineSpec spec) { Map<String, String> labels = new HashMap<>(); labels.put("app", spec.getName()); labels.put("component", "pipeline"); labels.put("language", "java"); labels.put("version", "v1"); labels.put("managed-by", "tekton-java-client"); return labels; } private Map<String, String> createAnnotations(JavaPipelineSpec spec) { Map<String, String> annotations = new HashMap<>(); annotations.put("description", spec.getDescription()); annotations.put("git-url", spec.getGitUrl()); annotations.put("created-by", "java-tekton-builder"); annotations.put("timestamp", String.valueOf(System.currentTimeMillis())); return annotations; } private io.fabric8.kubernetes.api.model.ObjectMeta createRunMetadata(String pipelineName) { io.fabric8.kubernetes.api.model.ObjectMeta metadata = new io.fabric8.kubernetes.api.model.ObjectMeta(); metadata.setGenerateName(pipelineName + "-run-"); metadata.setNamespace("default"); return metadata; } private PipelineRunSpec createPipelineRunSpec(String pipelineName, Map<String, String> params, Map<String, String> workspaces) { PipelineRunSpec spec = new PipelineRunSpec(); spec.setPipelineRef(new PipelineRefBuilder() .withName(pipelineName) .build()); // Set parameters List<io.fabric8.tekton.pipeline.v1.Param> paramList = new ArrayList<>(); if (params != null) { params.forEach((key, value) -> paramList.add(new io.fabric8.tekton.pipeline.v1.ParamBuilder() .withName(key) .withValue(new io.fabric8.tekton.pipeline.v1.ParamValue(value)) .build())); } spec.setParams(paramList); // Set workspaces List<io.fabric8.tekton.pipeline.v1.WorkspaceBinding> workspaceList = new ArrayList<>(); if (workspaces != null) { workspaces.forEach((key, value) -> workspaceList.add(new io.fabric8.tekton.pipeline.v1.WorkspaceBindingBuilder() .withName(key) .withNewPersistentVolumeClaim() .withClaimName(value) .endPersistentVolumeClaim() .build())); } spec.setWorkspaces(workspaceList); return spec; } }

Supply Chain Orchestration

1. Supply Chain Service
package com.example.tekton.service; import com.example.tekton.builder.PipelineBuilder; import com.example.tekton.model.JavaPipelineSpec; import io.fabric8.tekton.client.TektonClient; import io.fabric8.tekton.pipeline.v1.*; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Service; import java.util.*; @Service public class SupplyChainService { private static final Logger logger = LoggerFactory.getLogger(SupplyChainService.class); private final TektonClient tektonClient; private final PipelineBuilder pipelineBuilder; public SupplyChainService(TektonClient tektonClient, PipelineBuilder pipelineBuilder) { this.tektonClient = tektonClient; this.pipelineBuilder = pipelineBuilder; } public Pipeline createPipeline(JavaPipelineSpec spec) { try { Pipeline pipeline = pipelineBuilder.buildJavaPipeline(spec); Pipeline created = tektonClient.v1().pipelines().create(pipeline); logger.info("Created pipeline: {}", created.getMetadata().getName()); return created; } catch (Exception e) { logger.error("Failed to create pipeline: {}", spec.getName(), e); throw new SupplyChainException("Failed to create pipeline", e); } } public PipelineRun triggerPipeline(String pipelineName, Map<String, String> params, Map<String, String> workspaces) { try { PipelineRun pipelineRun = pipelineBuilder.buildPipelineRun(pipelineName, params, workspaces); PipelineRun created = tektonClient.v1().pipelineRuns().create(pipelineRun); logger.info("Triggered pipeline run: {}", created.getMetadata().getName()); return created; } catch (Exception e) { logger.error("Failed to trigger pipeline: {}", pipelineName, e); throw new SupplyChainException("Failed to trigger pipeline", e); } } public PipelineRunStatus getPipelineRunStatus(String runName) { try { PipelineRun pipelineRun = tektonClient.v1().pipelineRuns().withName(runName).get(); return pipelineRun != null ? pipelineRun.getStatus() : null; } catch (Exception e) { logger.error("Failed to get pipeline run status: {}", runName, e); throw new SupplyChainException("Failed to get pipeline run status", e); } } public List<PipelineRun> listPipelineRuns(String pipelineName) { try { return tektonClient.v1().pipelineRuns() .withLabel("tekton.dev/pipeline", pipelineName) .list() .getItems(); } catch (Exception e) { logger.error("Failed to list pipeline runs for: {}", pipelineName, e); throw new SupplyChainException("Failed to list pipeline runs", e); } } public void deletePipeline(String pipelineName) { try { boolean deleted = tektonClient.v1().pipelines().withName(pipelineName).delete(); logger.info("Deleted pipeline: {} - {}", pipelineName, deleted); } catch (Exception e) { logger.error("Failed to delete pipeline: {}", pipelineName, e); throw new SupplyChainException("Failed to delete pipeline", e); } } public void cleanupOldRuns(String pipelineName, int keepLast) { try { List<PipelineRun> runs = listPipelineRuns(pipelineName); runs.sort(Comparator.comparing(run -> run.getMetadata().getCreationTimestamp())); // Keep only the last N runs if (runs.size() > keepLast) { for (int i = 0; i < runs.size() - keepLast; i++) { String runName = runs.get(i).getMetadata().getName(); tektonClient.v1().pipelineRuns().withName(runName).delete(); logger.debug("Deleted old pipeline run: {}", runName); } } } catch (Exception e) { logger.error("Failed to cleanup old runs for: {}", pipelineName, e); throw new SupplyChainException("Failed to cleanup old runs", e); } } public PipelineMetrics getPipelineMetrics(String pipelineName) { try { List<PipelineRun> runs = listPipelineRuns(pipelineName); long totalRuns = runs.size(); long successfulRuns = runs.stream() .filter(run -> run.getStatus() != null && "Succeeded".equals(run.getStatus().getConditions().get(0).getStatus())) .count(); long failedRuns = runs.stream() .filter(run -> run.getStatus() != null && "Failed".equals(run.getStatus().getConditions().get(0).getStatus())) .count(); long runningRuns = totalRuns - successfulRuns - failedRuns; double successRate = totalRuns > 0 ? (double) successfulRuns / totalRuns * 100 : 0; // Calculate average duration long totalDuration = runs.stream() .filter(run -> run.getStatus() != null && run.getStatus().getCompletionTime() != null && run.getStatus().getStartTime() != null) .mapToLong(run -> run.getStatus().getCompletionTime().getTime() - run.getStatus().getStartTime().getTime()) .sum(); long avgDuration = successfulRuns > 0 ? totalDuration / successfulRuns : 0; return new PipelineMetrics( pipelineName, totalRuns, successfulRuns, failedRuns, runningRuns, successRate, avgDuration ); } catch (Exception e) { logger.error("Failed to get metrics for pipeline: {}", pipelineName, e); throw new SupplyChainException("Failed to get pipeline metrics", e); } } } package com.example.tekton.service; public class PipelineMetrics { private final String pipelineName; private final long totalRuns; private final long successfulRuns; private final long failedRuns; private final long runningRuns; private final double successRate; private final long averageDurationMs; public PipelineMetrics(String pipelineName, long totalRuns, long successfulRuns, long failedRuns, long runningRuns, double successRate, long averageDurationMs) { this.pipelineName = pipelineName; this.totalRuns = totalRuns; this.successfulRuns = successfulRuns; this.failedRuns = failedRuns; this.runningRuns = runningRuns; this.successRate = successRate; this.averageDurationMs = averageDurationMs; } // Getters public String getPipelineName() { return pipelineName; } public long getTotalRuns() { return totalRuns; } public long getSuccessfulRuns() { return successfulRuns; } public long getFailedRuns() { return failedRuns; } public long getRunningRuns() { return runningRuns; } public double getSuccessRate() { return successRate; } public long getAverageDurationMs() { return averageDurationMs; } } package com.example.tekton.service; public class SupplyChainException extends RuntimeException { public SupplyChainException(String message) { super(message); } public SupplyChainException(String message, Throwable cause) { super(message, cause); } }
2. Custom Task Controller
package com.example.tekton.controller; import com.example.tekton.service.SupplyChainService; import io.fabric8.tekton.pipeline.v1.Task; import io.fabric8.tekton.pipeline.v1.TaskBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.web.bind.annotation.*; import java.util.Arrays; @RestController @RequestMapping("/api/tekton/tasks") public class TaskController { private static final Logger logger = LoggerFactory.getLogger(TaskController.class); private final SupplyChainService supplyChainService; public TaskController(SupplyChainService supplyChainService) { this.supplyChainService = supplyChainService; } @PostMapping("/java-quality-check") public Task createJavaQualityCheckTask() { Task task = new TaskBuilder() .withNewMetadata() .withName("java-quality-check") .withNamespace("default") .endMetadata() .withNewSpec() .withParams(Arrays.asList( new io.fabric8.tekton.pipeline.v1.ParamSpecBuilder() .withName("SOURCE_DIR") .withType("string") .withDescription("Source directory") .build(), new io.fabric8.tekton.pipeline.v1.ParamSpecBuilder() .withName("QUALITY_THRESHOLD") .withType("string") .withDescription("Quality gate threshold") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue("80")) .build() )) .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("checkstyle") .withImage("checkstyle/checkstyle:latest") .withCommand(Arrays.asList("java")) .withArgs(Arrays.asList( "-jar", "/checkstyle.jar", "-c", "/google_checks.xml", "$(params.SOURCE_DIR)" )) .build(), new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("pmd") .withImage("pmd/pmd:latest") .withCommand(Arrays.asList("java")) .withArgs(Arrays.asList( "-jar", "/pmd.jar", "check", "-d", "$(params.SOURCE_DIR)", "-R", "rulesets/java/quickstart.xml" )) .build(), new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("quality-gate") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "echo 'Quality check completed' && " + "if [ $(cat /reports/quality-score.txt) -lt $(params.QUALITY_THRESHOLD) ]; then " + " echo 'Quality gate failed'; exit 1; " + "else " + " echo 'Quality gate passed'; fi" )) .build() )) .withWorkspaces(Arrays.asList( new io.fabric8.tekton.pipeline.v1.WorkspaceDeclarationBuilder() .withName("source") .withDescription("Source code") .build(), new io.fabric8.tekton.pipeline.v1.WorkspaceDeclarationBuilder() .withName("reports") .withDescription("Quality reports") .build() )) .endSpec() .build(); logger.info("Created Java quality check task"); return task; } @PostMapping("/security-scan") public Task createSecurityScanTask() { Task task = new TaskBuilder() .withNewMetadata() .withName("java-security-scan") .withNamespace("default") .endMetadata() .withNewSpec() .withParams(Arrays.asList( new io.fabric8.tekton.pipeline.v1.ParamSpecBuilder() .withName("SCAN_TYPE") .withType("string") .withDescription("Type of security scan") .withDefault(new io.fabric8.tekton.pipeline.v1.ParamValue("all")) .build() )) .withSteps(Arrays.asList( new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("dependency-check") .withImage("owasp/dependency-check:latest") .withCommand(Arrays.asList("dependency-check.sh")) .withArgs(Arrays.asList( "--scan", ".", "--format", "HTML", "--out", "/reports", "--project", "$(context.taskRun.name)" )) .build(), new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("secret-scan") .withImage("zricethezav/gitleaks:latest") .withCommand(Arrays.asList("gitleaks")) .withArgs(Arrays.asList( "detect", "--source", ".", "--report-path", "/reports/gitleaks.json" )) .build(), new io.fabric8.tekton.pipeline.v1.StepBuilder() .withName("generate-report") .withImage("alpine:3.16") .withCommand(Arrays.asList("sh")) .withArgs(Arrays.asList("-c", "echo 'Security scan completed' && " + "echo 'Vulnerabilities found: $(cat /reports/vulnerabilities.txt)'" )) .build() )) .withWorkspaces(Arrays.asList( new io.fabric8.tekton.pipeline.v1.WorkspaceDeclarationBuilder() .withName("source") .withDescription("Source code") .build(), new io.fabric8.tekton.pipeline.v1.WorkspaceDeclarationBuilder() .withName("reports") .withDescription("Security reports") .build() )) .endSpec() .build(); logger.info("Created Java security scan task"); return task; } }

Supply Chain Automation

1. Automated Pipeline Manager
package com.example.tekton.automation; import com.example.tekton.model.JavaPipelineSpec; import com.example.tekton.service.SupplyChainService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.scheduling.annotation.Scheduled; import org.springframework.stereotype.Component; import java.util.*; @Component public class PipelineAutomationManager { private static final Logger logger = LoggerFactory.getLogger(PipelineAutomationManager.class); private final SupplyChainService supplyChainService; private final Map<String, PipelineConfiguration> pipelineConfigurations; public PipelineAutomationManager(SupplyChainService supplyChainService) { this.supplyChainService = supplyChainService; this.pipelineConfigurations = new HashMap<>(); } public void registerPipeline(PipelineConfiguration config) { pipelineConfigurations.put(config.getPipelineName(), config); logger.info("Registered pipeline configuration: {}", config.getPipelineName()); } @Scheduled(cron = "0 */5 * * * *") // Every 5 minutes public void monitorAndTriggerPipelines() { for (PipelineConfiguration config : pipelineConfigurations.values()) { if (shouldTriggerPipeline(config)) { triggerPipeline(config); } } } @Scheduled(cron = "0 0 */6 * * *") // Every 6 hours public void cleanupOldPipelineRuns() { for (PipelineConfiguration config : pipelineConfigurations.values()) { try { supplyChainService.cleanupOldRuns( config.getPipelineName(), config.getKeepLastRuns() ); logger.debug("Cleaned up old runs for pipeline: {}", config.getPipelineName()); } catch (Exception e) { logger.error("Failed to cleanup old runs for: {}", config.getPipelineName(), e); } } } @Scheduled(cron = "0 */30 * * * *") // Every 30 minutes public void monitorPipelineHealth() { for (PipelineConfiguration config : pipelineConfigurations.values()) { try { var metrics = supplyChainService.getPipelineMetrics(config.getPipelineName()); if (metrics.getSuccessRate() < config.getMinimumSuccessRate()) { logger.warn("Pipeline health check failed for {}: success rate {}% < {}%", config.getPipelineName(), metrics.getSuccessRate(), config.getMinimumSuccessRate()); // Trigger alert } } catch (Exception e) { logger.error("Failed to monitor pipeline health for: {}", config.getPipelineName(), e); } } } private boolean shouldTriggerPipeline(PipelineConfiguration config) { if (!config.isAutoTriggerEnabled()) { return false; } // Check schedule if (config.getSchedule() != null && !config.getSchedule().isEmpty()) { // Implement cron schedule checking // For simplicity, we'll assume scheduled triggering is handled elsewhere return false; } // For webhook-based triggering, this would check for new commits // This is a simplified version return checkForNewCommits(config); } private boolean checkForNewCommits(PipelineConfiguration config) { // This would integrate with Git provider APIs // For now, return false return false; } private void triggerPipeline(PipelineConfiguration config) { try { Map<String, String> params = new HashMap<>(); params.put("GIT_URL", config.getGitUrl()); params.put("GIT_BRANCH", config.getGitBranch()); params.put("MAVEN_VERSION", config.getMavenVersion()); params.put("JAVA_VERSION", config.getJavaVersion()); params.put("DOCKER_REGISTRY", config.getDockerRegistry()); params.put("DOCKER_REPOSITORY", config.getDockerRepository()); Map<String, String> workspaces = new HashMap<>(); workspaces.put("source", config.getWorkspacePvc()); workspaces.put("maven-repo", "maven-repo-pvc"); workspaces.put("test-reports", "test-reports-pvc"); supplyChainService.triggerPipeline(config.getPipelineName(), params, workspaces); logger.info("Auto-triggered pipeline: {}", config.getPipelineName()); } catch (Exception e) { logger.error("Failed to auto-trigger pipeline: {}", config.getPipelineName(), e); } } } package com.example.tekton.automation; public class PipelineConfiguration { private String pipelineName; private String gitUrl; private String gitBranch; private String mavenVersion; private String javaVersion; private String dockerRegistry; private String dockerRepository; private String workspacePvc; private boolean autoTriggerEnabled; private String schedule; // Cron expression private int keepLastRuns; private double minimumSuccessRate; private Map<String, String> environment; // Getters and setters public String getPipelineName() { return pipelineName; } public void setPipelineName(String pipelineName) { this.pipelineName = pipelineName; } public String getGitUrl() { return gitUrl; } public void setGitUrl(String gitUrl) { this.gitUrl = gitUrl; } public String getGitBranch() { return gitBranch; } public void setGitBranch(String gitBranch) { this.gitBranch = gitBranch; } public String getMavenVersion() { return mavenVersion; } public void setMavenVersion(String mavenVersion) { this.mavenVersion = mavenVersion; } public String getJavaVersion() { return javaVersion; } public void setJavaVersion(String javaVersion) { this.javaVersion = javaVersion; } public String getDockerRegistry() { return dockerRegistry; } public void setDockerRegistry(String dockerRegistry) { this.dockerRegistry = dockerRegistry; } public String getDockerRepository() { return dockerRepository; } public void setDockerRepository(String dockerRepository) { this.dockerRepository = dockerRepository; } public String getWorkspacePvc() { return workspacePvc; } public void setWorkspacePvc(String workspacePvc) { this.workspacePvc = workspacePvc; } public boolean isAutoTriggerEnabled() { return autoTriggerEnabled; } public void setAutoTriggerEnabled(boolean autoTriggerEnabled) { this.autoTriggerEnabled = autoTriggerEnabled; } public String getSchedule() { return schedule; } public void setSchedule(String schedule) { this.schedule = schedule; } public int getKeepLastRuns() { return keepLastRuns; } public void setKeepLastRuns(int keepLastRuns) { this.keepLastRuns = keepLastRuns; } public double getMinimumSuccessRate() { return minimumSuccessRate; } public void setMinimumSuccessRate(double minimumSuccessRate) { this.minimumSuccessRate = minimumSuccessRate; } public Map<String, String> getEnvironment() { return environment; } public void setEnvironment(Map<String, String> environment) { this.environment = environment; } }
2. Git Webhook Handler
package com.example.tekton.automation; import com.example.tekton.service.SupplyChainService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.web.bind.annotation.*; import java.util.HashMap; import java.util.Map; @RestController @RequestMapping("/api/webhook") public class GitWebhookHandler { private static final Logger logger = LoggerFactory.getLogger(GitWebhookHandler.class); private final SupplyChainService supplyChainService; private final Map<String, PipelineConfiguration> pipelineRegistry; public GitWebhookHandler(SupplyChainService supplyChainService) { this.supplyChainService = supplyChainService; this.pipelineRegistry = new HashMap<>(); } @PostMapping("/github") public void handleGitHubWebhook(@RequestBody GitHubWebhookPayload payload, @RequestHeader("X-GitHub-Event") String eventType) { logger.info("Received GitHub webhook event: {}", eventType); if ("push".equals(eventType)) { handlePushEvent(payload); } else if ("pull_request".equals(eventType)) { handlePullRequestEvent(payload); } } @PostMapping("/gitlab") public void handleGitLabWebhook(@RequestBody GitLabWebhookPayload payload, @RequestHeader("X-Gitlab-Event") String eventType) { logger.info("Received GitLab webhook event: {}", eventType); if ("Push Hook".equals(eventType)) { handlePushEvent(payload); } else if ("Merge Request Hook".equals(eventType)) { handleMergeRequestEvent(payload); } } private void handlePushEvent(Object payload) { String repositoryUrl = extractRepositoryUrl(payload); String branch = extractBranch(payload); // Find pipelines configured for this repository and branch pipelineRegistry.values().stream() .filter(config -> matchesRepository(config, repositoryUrl, branch)) .forEach(config -> triggerPipelineForPush(config, payload)); } private void handlePullRequestEvent(GitHubWebhookPayload payload) { String repositoryUrl = payload.getRepository().getHtmlUrl(); String branch = payload.getPullRequest().getHead().getRef(); String targetBranch = payload.getPullRequest().getBase().getRef(); // Trigger PR validation pipeline Map<String, String> params = new HashMap<>(); params.put("GIT_URL", repositoryUrl); params.put("GIT_BRANCH", branch); params.put("TARGET_BRANCH", targetBranch); params.put("PULL_REQUEST_ID", String.valueOf(payload.getPullRequest().getNumber())); // Find and trigger PR validation pipeline pipelineRegistry.values().stream() .filter(config -> config.getPipelineName().contains("pr-validation")) .findFirst() .ifPresent(config -> supplyChainService.triggerPipeline(config.getPipelineName(), params, new HashMap<>())); } private boolean matchesRepository(PipelineConfiguration config, String repositoryUrl, String branch) { return config.getGitUrl().equals(repositoryUrl) && config.getGitBranch().equals(branch); } private void triggerPipelineForPush(PipelineConfiguration config, Object payload) { Map<String, String> params = new HashMap<>(); params.put("GIT_URL", config.getGitUrl()); params.put("GIT_BRANCH", config.getGitBranch()); params.put("COMMIT_SHA", extractCommitSha(payload)); params.put("COMMIT_AUTHOR", extractCommitAuthor(payload)); params.put("COMMIT_MESSAGE", extractCommitMessage(payload)); Map<String, String> workspaces = new HashMap<>(); workspaces.put("source", config.getWorkspacePvc()); supplyChainService.triggerPipeline(config.getPipelineName(), params, workspaces); logger.info("Triggered pipeline {} for push to {}", config.getPipelineName(), config.getGitBranch()); } private String extractRepositoryUrl(Object payload) { // Extract repository URL from webhook payload // Implementation depends on Git provider if (payload instanceof GitHubWebhookPayload) { return ((GitHubWebhookPayload) payload).getRepository().getHtmlUrl(); } return ""; } private String extractBranch(Object payload) { // Extract branch from webhook payload if (payload instanceof GitHubWebhookPayload) { String ref = ((GitHubWebhookPayload) payload).getRef(); return ref.replace("refs/heads/", ""); } return ""; } private String extractCommitSha(Object payload) { if (payload instanceof GitHubWebhookPayload) { return ((GitHubWebhookPayload) payload).getAfter(); } return ""; } private String extractCommitAuthor(Object payload) { if (payload instanceof GitHubWebhookPayload) { return ((GitHubWebhookPayload) payload).getPusher().getName(); } return ""; } private String extractCommitMessage(Object payload) { if (payload instanceof GitHubWebhookPayload) { return ((GitHubWebhookPayload) payload).getHeadCommit().getMessage(); } return ""; } } // Webhook payload models class GitHubWebhookPayload { private String ref; private String after; private Repository repository; private Pusher pusher; private HeadCommit headCommit; private PullRequest pullRequest; // Getters and setters public String getRef() { return ref; } public void setRef(String ref) { this.ref = ref; } public String getAfter() { return after; } public void setAfter(String after) { this.after = after; } public Repository getRepository() { return repository; } public void setRepository(Repository repository) { this.repository = repository; } public Pusher getPusher() { return pusher; } public void setPusher(Pusher pusher) { this.pusher = pusher; } public HeadCommit getHeadCommit() { return headCommit; } public void setHeadCommit(HeadCommit headCommit) { this.headCommit = headCommit; } public PullRequest getPullRequest() { return pullRequest; } public void setPullRequest(PullRequest pullRequest) { this.pullRequest = pullRequest; } static class Repository { private String htmlUrl; public String getHtmlUrl() { return htmlUrl; } public void setHtmlUrl(String htmlUrl) { this.htmlUrl = htmlUrl; } } static class Pusher { private String name; public String getName() { return name; } public void setName(String name) { this.name = name; } } static class HeadCommit { private String message; public String getMessage() { return message; } public void setMessage(String message) { this.message = message; } } static class PullRequest { private int number; private Head head; private Base base; public int getNumber() { return number; } public void setNumber(int number) { this.number = number; } public Head getHead() { return head; } public void setHead(Head head) { this.head = head; } public Base getBase() { return base; } public void setBase(Base base) { this.base = base; } } static class Head { private String ref; public String getRef() { return ref; } public void setRef(String ref) { this.ref = ref; } } static class Base { private String ref; public String getRef() { return ref; } public void setRef(String ref) { this.ref = ref; } } } class GitLabWebhookPayload { // GitLab webhook payload structure // Simplified for example private String ref; private String after; private Project project; // Getters and setters public String getRef() { return ref; } public void setRef(String ref) { this.ref = ref; } public String getAfter() { return after; } public void setAfter(String after) { this.after = after; } public Project getProject() { return project; } public void setProject(Project project) { this.project = project; } static class Project { private String webUrl; public String getWebUrl() { return webUrl; } public void setWebUrl(String webUrl) { this.webUrl = webUrl; } } }

REST API Controller

package com.example.tekton.controller; import com.example.tekton.automation.PipelineConfiguration; import com.example.tekton.model.JavaPipelineSpec; import com.example.tekton.service.PipelineMetrics; import com.example.tekton.service.SupplyChainService; import io.fabric8.tekton.pipeline.v1.Pipeline; import io.fabric8.tekton.pipeline.v1.PipelineRun; import org.springframework.web.bind.annotation.*; import java.util.List; import java.util.Map; @RestController @RequestMapping("/api/pipelines") public class PipelineController { private final SupplyChainService supplyChainService; public PipelineController(SupplyChainService supplyChainService) { this.supplyChainService = supplyChainService; } @PostMapping public Pipeline createPipeline(@RequestBody JavaPipelineSpec spec) { return supplyChainService.createPipeline(spec); } @PostMapping("/{pipelineName}/trigger") public PipelineRun triggerPipeline(@PathVariable String pipelineName, @RequestBody Map<String, String> triggerRequest) { Map<String, String> params = triggerRequest.get("params") != null ? (Map<String, String>) triggerRequest.get("params") : Map.of(); Map<String, String> workspaces = triggerRequest.get("workspaces") != null ? (Map<String, String>) triggerRequest.get("workspaces") : Map.of(); return supplyChainService.triggerPipeline(pipelineName, params, workspaces); } @GetMapping("/{pipelineName}/runs") public List<PipelineRun> listPipelineRuns(@PathVariable String pipelineName) { return supplyChainService.listPipelineRuns(pipelineName); } @GetMapping("/{pipelineName}/runs/{runName}/status") public PipelineRunStatus getPipelineRunStatus(@PathVariable String pipelineName, @PathVariable String runName) { return supplyChainService.getPipelineRunStatus(runName); } @GetMapping("/{pipelineName}/metrics") public PipelineMetrics getPipelineMetrics(@PathVariable String pipelineName) { return supplyChainService.getPipelineMetrics(pipelineName); } @DeleteMapping("/{pipelineName}") public void deletePipeline(@PathVariable String pipelineName) { supplyChainService.deletePipeline(pipelineName); } @PostMapping("/{pipelineName}/cleanup") public void cleanupPipelineRuns(@PathVariable String pipelineName, @RequestParam(defaultValue = "10") int keepLast) { supplyChainService.cleanupOldRuns(pipelineName, keepLast); } } // Response wrapper class ApiResponse<T> { private boolean success; private String message; private T data; public ApiResponse(boolean success, String message, T data) { this.success = success; this.message = message; this.data = data; } public static <T> ApiResponse<T> success(T data) { return new ApiResponse<>(true, "Success", data); } public static <T> ApiResponse<T> error(String message) { return new ApiResponse<>(false, message, null); } // Getters public boolean isSuccess() { return success; } public String getMessage() { return message; } public T getData() { return data; } }

Configuration

1. Application Properties
# application.yml kubernetes: master: url: ${KUBERNETES_MASTER:https://kubernetes.default.svc} namespace: ${KUBERNETES_NAMESPACE:default} tekton: pipeline: default-maven-version: 3.8.8 default-java-version: 17 timeout: 3600 retention: runs: 10 days: 7 github: webhook: secret: ${GITHUB_WEBHOOK_SECRET:} enabled: true gitlab: webhook: secret: ${GITLAB_WEBHOOK_SECRET:} enabled: false security: scanning: enabled: true trivy-image: aquasec/trivy:latest grype-image: anchore/grype:latest quality: gates: test-coverage: 80 max-critical-issues: 0 max-major-issues: 10 logging: level: com.example.tekton: INFO
2. Kubernetes Resources
# tekton-resources.yaml apiVersion: v1 kind: PersistentVolumeClaim metadata: name: tekton-workspace-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 10Gi --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: maven-repo-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 5Gi --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-reports-pvc spec: accessModes: - ReadWriteOnce resources: requests: storage: 2Gi --- apiVersion: v1 kind: ServiceAccount metadata: name: tekton-java-serviceaccount secrets: - name: tekton-secrets --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: tekton-java-clusterrole rules: - apiGroups: ["tekton.dev"] resources: ["pipelines", "pipelineruns", "tasks", "taskruns"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: tekton-java-clusterrolebinding subjects: - kind: ServiceAccount name: tekton-java-serviceaccount namespace: default roleRef: kind: ClusterRole name: tekton-java-clusterrole apiGroup: rbac.authorization.k8s.io

Testing

1. Unit Tests
package com.example.tekton; import com.example.tekton.builder.PipelineBuilder; import com.example.tekton.model.JavaPipelineSpec; import io.fabric8.tekton.pipeline.v1.Pipeline; import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.*; class PipelineBuilderTest { @Test void testBuildJavaPipeline() { PipelineBuilder builder = new PipelineBuilder(); JavaPipelineSpec spec = new JavaPipelineSpec(); spec.setName("test-app"); spec.setNamespace("default"); spec.setGitUrl("https://github.com/test/test-app.git"); spec.setGitBranch("main"); spec.setMavenVersion("3.8.8"); spec.setJavaVersion("17"); spec.setDockerRegistry("docker.io"); spec.setDockerRepository("test/test-app"); Pipeline pipeline = builder.buildJavaPipeline(spec); assertNotNull(pipeline); assertEquals("test-app-pipeline", pipeline.getMetadata().getName()); assertNotNull(pipeline.getSpec()); assertFalse(pipeline.getSpec().getTasks().isEmpty()); } }

Best Practices

  1. Idempotent Pipelines: Ensure pipelines can be rerun safely
  2. Resource Management: Set appropriate resource limits for tasks
  3. Security: Use Kubernetes secrets for sensitive data
  4. Monitoring: Implement comprehensive logging and monitoring
  5. Testing: Include pipeline validation and testing
  6. Versioning: Version pipeline definitions alongside application code
// Example of pipeline validation public class PipelineValidator { public boolean validate(Pipeline pipeline) { // Check for required fields // Validate task dependencies // Check resource requirements return true; } }

Conclusion

Tekton Supply Chain in Java provides:

  • Kubernetes-native CI/CD pipelines with Java integration
  • Comprehensive pipeline definitions for Java applications
  • Security scanning and quality gates integration
  • Automated triggering via webhooks
  • Custom task development for specific requirements
  • Monitoring and metrics collection

By implementing this Tekton-based supply chain, you can achieve a fully automated, secure, and scalable CI/CD pipeline for Java applications with comprehensive security scanning, quality gates, and deployment automation.

Advanced Java Supply Chain Security, Kubernetes Hardening & Runtime Threat Detection

Sigstore Rekor in Java – https://macronepal.com/blog/sigstore-rekor-in-java/
Explains integrating Sigstore Rekor into Java systems to create a transparent, tamper-proof log of software signatures and metadata for verifying supply chain integrity.

Securing Java Applications with Chainguard Wolfi – https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide/
Explains using Chainguard Wolfi minimal container images to reduce vulnerabilities and secure Java applications with hardened, lightweight runtime environments.

Cosign Image Signing in Java Complete Guide – https://macronepal.com/blog/cosign-image-signing-in-java-complete-guide/
Explains how to digitally sign container images using Cosign in Java-based workflows to ensure authenticity and prevent unauthorized modifications.

Secure Supply Chain Enforcement Kyverno Image Verification for Java Containers – https://macronepal.com/blog/secure-supply-chain-enforcement-kyverno-image-verification-for-java-containers/
Explains enforcing Kubernetes policies with Kyverno to verify container image signatures and ensure only trusted Java container images are deployed.

Pod Security Admission in Java Securing Kubernetes Deployments for JVM Applications – https://macronepal.com/blog/pod-security-admission-in-java-securing-kubernetes-deployments-for-jvm-applications/
Explains Kubernetes Pod Security Admission policies that enforce security rules like restricted privileges and safe configurations for Java workloads.

Securing Java Applications at Runtime Kubernetes Security Context – https://macronepal.com/blog/securing-java-applications-at-runtime-a-guide-to-kubernetes-security-context/
Explains how Kubernetes security contexts control runtime permissions, user IDs, and access rights for Java containers to improve isolation.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring-2/
Explains detecting abnormal runtime behavior in Java applications to identify potential security threats using process monitoring techniques.

Achieving Security Excellence CIS Benchmark Compliance for Java Applications – https://macronepal.com/blog/achieving-security-excellence-implementing-cis-benchmark-compliance-for-java-applications/
Explains applying CIS security benchmarks to Java environments to standardize hardening and improve overall system security posture.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring/
Explains behavioral monitoring of Java processes to detect anomalies and improve runtime security through continuous observation and analysis.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper