Backend interview prep

Start Learning

Build and Deploy Spring Boot with Tekton

Learn how to build, test, containerize, and deploy a Spring Boot application using OpenShift Pipelines (Tekton). Understand Tasks, PipelineRuns, Workspaces, Buildah, Trivy, and enterprise CI/CD implementation.

Introduction

Building a Spring Boot application manually is simple during development.

However, in enterprise environments, every code change should automatically:

  • Clone the source code
  • Build the application
  • Execute unit tests
  • Create a container image
  • Scan the image
  • Push the image to a registry
  • Deploy the application to OpenShift
  • Verify the deployment

This entire process should happen without manual intervention.

OpenShift Pipelines (Tekton) makes this possible using cloud-native Kubernetes resources.

In this article, we'll build a complete CI/CD pipeline for a Spring Boot application.

Learning Objectives

By the end of this article, you will understand:

  • Spring Boot CI/CD Architecture
  • Tekton Tasks
  • Tekton Pipeline
  • Workspaces
  • Buildah Integration
  • Image Registry
  • OpenShift Deployment
  • PipelineRun
  • Enterprise DevSecOps

End-to-End Architecture

flowchart LR
    A[Developer]
    B[Git Repository]
    C[Tekton Trigger]
    D[Pipeline]
    E[Maven Build]
    F[Buildah Image Build]
    G[Trivy Scan]
    H[Quay Registry]
    I[OpenShift Deployment]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

CI/CD Workflow

sequenceDiagram
    participant Dev as Developer
    participant Git
    participant Tekton
    participant Registry
    participant OpenShift

    Dev->>Git: Push Code
    Git->>Tekton: Trigger Pipeline
    Tekton->>Tekton: Build & Test
    Tekton->>Registry: Push Image
    Registry->>OpenShift: Deploy
    OpenShift-->>Dev: Application Ready

Project Structure

payment-service/

├── src/
├── pom.xml
├── Dockerfile
├── deployment.yaml
├── service.yaml
├── route.yaml

└── tekton/
    ├── task-build.yaml
    ├── task-buildah.yaml
    ├── task-deploy.yaml
    ├── pipeline.yaml
    └── pipelinerun.yaml

Pipeline Flow

flowchart LR
    A[Clone Repository]
    B[Maven Build]
    C[Unit Tests]
    D[Build Image]
    E[Image Scan]
    F[Push Image]
    G[Deploy]
    H[Health Check]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

Task 1 - Maven Build

apiVersion: tekton.dev/v1

kind: Task

metadata:
  name: maven-build

spec:

  steps:

  - name: build

    image: maven:3.9-eclipse-temurin-21

    script: |
      mvn clean package

Build Task Architecture

flowchart LR
    A[Source Code]
    B[Maven Task]
    C[JAR File]

    A --> B
    B --> C

Generated Artifact

target/

payment-service.jar

Task 2 - Unit Tests

steps:

- name: test

  image: maven:3.9

  script: |
    mvn test

Never continue if tests fail.

Task 3 - Build Container Image

Use Buildah.

steps:

- name: build-image

  image: quay.io/buildah/stable

  script: |
    buildah bud \
      -t quay.io/company/payment:1.0 .

Buildah Workflow

flowchart LR
    A[JAR]
    B[Dockerfile]
    C[Buildah]
    D[Container Image]

    A --> C
    B --> C
    C --> D

Task 4 - Scan Image

steps:

- name: trivy

  image: aquasec/trivy

  script: |
    trivy image \
      quay.io/company/payment:1.0

Pipeline should stop if Critical vulnerabilities exist.

Task 5 - Push Image

steps:

- name: push

  image: quay.io/buildah/stable

  script: |
    buildah push \
      quay.io/company/payment:1.0

Registry Flow

flowchart LR
    A[Buildah]
    B[Container Image]
    C[Quay Registry]

    A --> B
    B --> C

Task 6 - Deploy

steps:

- name: deploy

  image: registry.redhat.io/openshift4/ose-cli

  script: |
    oc apply -f deployment.yaml

    oc apply -f service.yaml

    oc apply -f route.yaml

Deployment Flow

flowchart LR
    A[Pipeline]
    B[Deployment]
    C[ReplicaSet]
    D[Pods]

    A --> B
    B --> C
    C --> D

Pipeline Definition

apiVersion: tekton.dev/v1

kind: Pipeline

metadata:
  name: payment-pipeline

spec:

  tasks:

  - name: build

    taskRef:
      name: maven-build

  - name: image

    runAfter:
      - build

    taskRef:
      name: buildah-build

  - name: deploy

    runAfter:
      - image

    taskRef:
      name: deploy

Pipeline Architecture

flowchart LR
    A[Build]
    B[Image Build]
    C[Deploy]

    A --> B
    B --> C

PipelineRun

apiVersion: tekton.dev/v1

kind: PipelineRun

metadata:
  name: payment-run

spec:

  pipelineRef:

    name: payment-pipeline

PipelineRun Execution

flowchart LR
    A[Pipeline]
    B[PipelineRun]
    C[Running Pods]

    A --> B
    B --> C

Workspaces

Tasks share artifacts using Workspaces.

flowchart LR
    A[Clone]
    B[Workspace]
    C[Build]
    D[Deploy]

    A --> B
    B --> C
    B --> D

Shared files include:

  • Source Code
  • Maven Repository
  • JAR File
  • Dockerfile

Trigger Pipeline

Git Push automatically starts the pipeline.

flowchart LR
    A[GitHub]
    B[Webhook]
    C[Tekton Trigger]
    D[PipelineRun]

    A --> B
    B --> C
    C --> D

Enterprise Banking Pipeline

flowchart LR
    A[Developer]
    B[GitHub Enterprise]
    C[Tekton Trigger]
    D[Maven Build]
    E[JUnit]
    F[SonarQube]
    G[Buildah]
    H[Trivy]
    I[Quay Registry]
    J[OpenShift]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I
    I --> J

Verify Deployment

oc get pods

oc get deployment

oc get route

Check rollout

oc rollout status deployment/payment-service

Verify Health

curl https://payment.company.com/actuator/health

Expected

{
  "status":"UP"
}

Useful Commands

Create Pipeline

oc apply -f pipeline.yaml

Create Tasks

oc apply -f task-build.yaml

Run Pipeline

oc apply -f pipelinerun.yaml

View Pipelines

oc get pipelines

View PipelineRuns

oc get pipelineruns

View Logs

tkn pipelinerun logs payment-run

Delete PipelineRun

oc delete pipelinerun payment-run

Common Problems

Build Failed

Check

tkn pipelinerun logs

Review:

  • Maven compilation
  • Missing dependencies
  • Test failures

Image Build Failed

Verify:

  • Dockerfile
  • Buildah permissions
  • Registry login

Image Push Failed

Check:

  • Registry credentials
  • Repository permissions

Deployment Failed

Verify

oc describe pod

Review:

  • Events
  • ImagePullBackOff
  • ConfigMaps
  • Secrets

Health Check Failed

Verify:

  • Spring Boot started successfully
  • Readiness Probe
  • Route accessibility

Production Best Practices

  • Use reusable Tasks.
  • Store credentials in OpenShift Secrets.
  • Use Buildah instead of Docker.
  • Run SonarQube analysis.
  • Scan every image using Trivy.
  • Use immutable image tags.
  • Enable automatic rollback.
  • Separate Dev, QA, and Production pipelines.
  • Monitor PipelineRuns.
  • Version control all Tekton YAML files.

Common Mistakes

❌ Combining every step into one Task.

❌ Hardcoding registry credentials.

❌ Skipping unit tests.

❌ Ignoring image vulnerabilities.

❌ Deploying directly to Production.

❌ Using the latest image tag.

Advantages

  • Kubernetes Native
  • Cloud Native
  • Fully Automated CI/CD
  • Secure DevSecOps Pipeline
  • Scalable Execution
  • Reusable Tasks
  • Faster Deployments
  • Enterprise Ready

Summary

OpenShift Pipelines powered by Tekton provide a modern Kubernetes-native approach to building and deploying Spring Boot applications.

Key takeaways:

  • Tekton Tasks execute each CI/CD stage inside isolated Pods.
  • Buildah builds container images without requiring a Docker daemon.
  • Workspaces enable artifact sharing across Tasks.
  • PipelineRuns execute complete deployment workflows.
  • Integrating SonarQube, Trivy, and Quay creates a secure DevSecOps pipeline.
  • Tekton enables scalable, repeatable, and enterprise-grade Spring Boot deployments on OpenShift.

Interview Questions

  1. What is Tekton?
  2. How does Tekton differ from Jenkins?
  3. What is a Task in Tekton?
  4. What is the purpose of a PipelineRun?
  5. Why is Buildah preferred over Docker in OpenShift?
  6. What are Workspaces used for?
  7. How do Tekton Triggers start a pipeline?
  8. How do you deploy a Spring Boot application with Tekton?
  9. How do you share artifacts between Tasks?
  10. What are the best practices for building enterprise CI/CD pipelines with Tekton?