Backend interview prep

Start Learning

OpenShift Pipelines (Tekton) Overview

Learn OpenShift Pipelines powered by Tekton. Understand Tasks, Pipelines, PipelineRuns, Workspaces, Triggers, Spring Boot CI/CD implementation, and enterprise DevSecOps best practices.

Introduction

Modern cloud-native applications require fast, repeatable, and automated software delivery.

While Jenkins has been the industry standard for years, Kubernetes introduced a more cloud-native approach called Tekton.

OpenShift Pipelines is Red Hat's enterprise implementation of Tekton, designed specifically for Kubernetes and OpenShift.

Instead of running builds on Jenkins agents, Tekton executes every pipeline step as a container inside a Kubernetes Pod, making pipelines scalable, portable, and cloud-native.

Today, many enterprise organizations use OpenShift Pipelines for:

  • Spring Boot CI/CD
  • Microservices Deployment
  • Container Image Builds
  • Security Scanning
  • GitOps Workflows
  • Multi-Cloud Deployments

Learning Objectives

By the end of this article, you will understand:

  • What is Tekton?
  • OpenShift Pipelines Architecture
  • Tasks
  • Pipelines
  • PipelineRuns
  • Workspaces
  • Triggers
  • Spring Boot CI/CD
  • Enterprise DevSecOps

What is Tekton?

Tekton is an open-source Kubernetes-native CI/CD framework.

Instead of a traditional CI server, Tekton runs every build step inside Kubernetes Pods.

Benefits:

  • Cloud Native
  • Kubernetes Native
  • Container Based
  • Highly Scalable
  • Portable
  • Declarative YAML

Jenkins vs Tekton

Jenkins Tekton
Master-Agent Architecture Kubernetes Native
Uses Jenkinsfile Uses Kubernetes YAML
Static Agents Ephemeral Pods
Plugin Based Kubernetes CRDs
Server Centric Container Native

OpenShift Pipelines Architecture

flowchart LR
    A[Developer]
    B[Git Repository]
    C[Tekton Trigger]
    D[Pipeline]
    E[Task]
    F[Container Registry]
    G[OpenShift Cluster]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G

CI/CD Workflow

sequenceDiagram
    participant Dev as Developer
    participant Git
    participant Trigger
    participant Pipeline
    participant OpenShift

    Dev->>Git: Push Code
    Git->>Trigger: Webhook
    Trigger->>Pipeline: Start PipelineRun
    Pipeline->>Pipeline: Execute Tasks
    Pipeline->>OpenShift: Deploy Application

Tekton Components

Component Purpose
Task Single Build Step
Pipeline Collection of Tasks
PipelineRun Executes Pipeline
TaskRun Executes Task
Workspace Shared Storage
Trigger Starts Pipeline
EventListener Receives Webhooks

Tekton Architecture

flowchart TD
    A[Git Push]
    B[Trigger]
    C[Pipeline]
    D[Task 1]
    E[Task 2]
    F[Task 3]
    G[Deploy]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G

What is a Task?

A Task is the smallest execution unit.

Examples:

  • Clone Git Repository
  • Build Maven Project
  • Run Unit Tests
  • Build Docker Image
  • Push Image
  • Deploy Application

Task Example

apiVersion: tekton.dev/v1

kind: Task

metadata:
  name: maven-build

spec:

  steps:

  - name: package

    image: maven:3.9

    script: |
      mvn clean package

Task Execution

flowchart LR
    A[Task]
    B[Pod]
    C[Maven Build]

    A --> B
    B --> C

Each Task executes inside its own Pod.

What is a Pipeline?

A Pipeline connects multiple Tasks together.

Example:

flowchart LR
    A[Clone]
    B[Build]
    C[Test]
    D[Docker Build]
    E[Image Scan]
    F[Deploy]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

Pipeline Example

apiVersion: tekton.dev/v1

kind: Pipeline

metadata:

  name: payment-pipeline

spec:

  tasks:

  - name: build

    taskRef:

      name: maven-build

PipelineRun

A Pipeline only defines the workflow.

A PipelineRun actually executes it.

flowchart LR
    A[Pipeline]
    B[PipelineRun]
    C[Running Pods]

    A --> B
    B --> C

Workspace

Tasks often need to share files.

Example:

flowchart LR
    A[Clone Task]
    B[Workspace]
    C[Build Task]
    D[Test Task]

    A --> B
    B --> C
    B --> D

The Workspace stores:

  • Source Code
  • Maven Repository
  • Build Artifacts

Trigger

Pipelines usually start automatically.

Events:

  • Git Push
  • Pull Request
  • Manual Trigger
  • Schedule
flowchart LR
    A[GitHub]
    B[Webhook]
    C[Trigger]
    D[PipelineRun]

    A --> B
    B --> C
    C --> D

Spring Boot Pipeline

flowchart LR
    A[Git Repository]
    B[Clone]
    C[Maven Build]
    D[JUnit Tests]
    E[Docker Build]
    F[Push Image]
    G[Deploy OpenShift]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G

Build Task

mvn clean package

Produces

target/payment-service.jar

Docker Build Task

buildah bud \
-t payment-service .

Buildah is commonly used instead of Docker inside OpenShift.

Push Image

buildah push \
payment-service \
quay.io/company/payment-service

Deploy Task

oc apply -f deployment.yaml

Update Image

oc set image deployment/payment-service \
payment-service=quay.io/company/payment-service:1.0

Enterprise Pipeline

flowchart LR
    A[Git Push]
    B[Clone]
    C[Compile]
    D[Test]
    E[SonarQube]
    F[Buildah Build]
    G[Trivy Scan]
    H[Push Image]
    I[Deploy]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

Banking Architecture

flowchart TD
    A[Developer]
    B[GitHub Enterprise]
    C[Tekton Trigger]
    D[Pipeline]
    E[Quay Registry]
    F[OpenShift Dev]
    G[OpenShift QA]
    H[OpenShift Production]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

Tekton Dashboard

The OpenShift Developer Console provides a graphical Pipeline view showing:

  • Running Tasks
  • Successful Tasks
  • Failed Tasks
  • Logs
  • Duration
  • Pipeline History

Useful Commands

List Pipelines

oc get pipelines

List PipelineRuns

oc get pipelineruns

Describe Pipeline

oc describe pipeline payment-pipeline

View Logs

tkn pipelinerun logs payment-run

Delete PipelineRun

oc delete pipelinerun payment-run

Common Problems

Pipeline Failed

Possible causes:

  • Maven Build Error
  • Missing Dependencies
  • Failed Tests

Task Failed

Check

tkn taskrun logs

Image Push Failed

Verify:

  • Registry credentials
  • Image name
  • Repository permissions

Deployment Failed

Check

oc describe pod

Review:

  • Events
  • Image Pull
  • Secrets
  • ConfigMaps

Production Best Practices

  • Use reusable Tasks.
  • Store credentials in Secrets.
  • Use Buildah instead of Docker.
  • Scan every container image.
  • Integrate SonarQube.
  • Use immutable image tags.
  • Separate Dev, QA, and Production pipelines.
  • Implement manual approvals before production.
  • Monitor PipelineRuns.
  • Keep Tekton Tasks version controlled.

Common Mistakes

❌ Creating one huge Task instead of reusable Tasks.

❌ Hardcoding credentials.

❌ Skipping image scanning.

❌ Using the latest tag.

❌ Running pipelines with excessive permissions.

❌ Ignoring failed PipelineRuns.

Advantages

  • Kubernetes Native
  • Cloud Native
  • Scalable
  • Portable
  • Container Based
  • Secure
  • GitOps Friendly
  • Enterprise Ready

Summary

OpenShift Pipelines, powered by Tekton, provide a cloud-native CI/CD platform designed specifically for Kubernetes.

Key takeaways:

  • Tekton executes CI/CD workflows as Kubernetes resources.
  • Tasks are the building blocks of Pipelines.
  • PipelineRuns execute complete workflows.
  • Workspaces allow Tasks to share artifacts.
  • Buildah, SonarQube, and Trivy integrate seamlessly with Tekton.
  • OpenShift Pipelines enable scalable, secure, and enterprise-ready DevSecOps workflows.

Interview Questions

  1. What is Tekton?
  2. How is Tekton different from Jenkins?
  3. What is a Task in Tekton?
  4. What is the purpose of a PipelineRun?
  5. How do Workspaces work in Tekton?
  6. Why does OpenShift use Buildah instead of Docker?
  7. How do Triggers start a Pipeline?
  8. How do you deploy a Spring Boot application using Tekton?
  9. What are the benefits of Kubernetes-native CI/CD?
  10. What are the best practices for OpenShift Pipelines?