Template reference for Supply Chain Choreographer

This topic describes the objects from templates that you can use with Supply Chain Choreographer.

All the objects referenced in this topic are Cartographer Templates packaged in Out of the Box Templates.

This topic describes:

• The purpose of the templates
• The one or more objects that the templates create
• The supply chains that include the templates
• The parameters that the templates use

source-template

Purpose

Creates an object to fetch source code and make that code available to other objects in the supply chain. See Building from Source.

Used by

• Source-to-URL in the source-provider step.
• Source-Test-to-URL in the source-provider step.
• Source-Test-Scan-to-URL in the source-provider step.
• Source-to-URL-Package (experimental) in the source-provider step.

Creates

The source-template creates one of three objects, either:

• GitRepository. Created if the workload has .spec.source.git defined.
• MavenArtifact. Created if the template is provided a value for the parameter maven.
• ImageRepository. Created if the workload has .spec.source.image defined.

GitRepository

GitRepository makes source code from a particular commit available as a tarball in the cluster. Other resources in the supply chain can then access that code.

Parameters

      - name: gitImplementation
        value: go-git`
      

      - name: source_credentials_secret
        value: git-credentials
      

      - name: gitops_ssh_secret
        value: git-credentials
      

More information

For an example using the Tanzu CLI to create a Workload using GitHub as the provider of source code, see Create a workload from GitHub repository.

For information about GitRepository objects, see GitRepository.

ImageRepository

ImageRepository makes the contents of a container image available as a tarball on the cluster.

Parameters

      - name: serviceAccount
        value: default
      

Note

When using the Tanzu CLI to configure this serviceAccount parameter, use --param serviceAccount=.... The similarly named --service-account flag sets a different value: the spec.serviceAccountName key in the Workload object.

More information

For information about the ImageRepository resource, see the ImageRepository reference documentation.

For information about how to use the Tanzu CLI to create a workload leveraging ImageRepository, see Create a workload from local source code.

MavenArtifact

MavenArtifact makes a pre-built Java artifact available to as a tarball on the cluster.

While the source-template leverages the workload’s .spec.source field when creating a GitRepository or ImageRepository object, the creation of the MavenArtifact relies only on parameters in the Workload.

Parameters

      - name: maven
        value:
          artifactId: springboot-initial
          groupId: com.example
          version: RELEASE
          classifier: sources         # optional
          type: jar                   # optional
          artifactRetryTimeout: 1m0s  # optional
      

      - name: maven_repository_url
        value: https://repo1.maven.org/maven2/
      

      - name: maven_repository_secret_name
        value: auth-secret
      

More information

For information about the custom resource, see MavenArtifact reference docs.

For information about how to use the custom resource with the Tanzu Apps CLI plug-in, see Create a workload from a Maven repository artifact.

testing-pipeline

Purpose

Tests the source code provided in the supply chain. Testing depends on a user provided Tekton Pipeline. Parameters for this template allow for selection of the proper Pipeline and for specification of additional values to pass to the Pipeline.

Used by

• Source-Test-to-URL in the source-tester step.
• Source-Test-Scan-to-URL in the source-tester step.

These are used as the source-tester resource.

Creates

testing-pipelinecreates a Runnable object. This Runnable provides inputs to the ClusterRunTemplate named tekton-source-pipelinerun.

Parameters

      - name: testing_pipeline_matching_labels
        value:
          apps.tanzu.vmware.com/pipeline: test
          my.company/language: golang
      

      - name: testing_pipeline_params
        value:
        - name: verbose
          value: true
        - name: foo
          value: bar
      

More information

For information about the ClusterRunTemplate that pairs with the Runnable, read tekton-source-pipelinerun

For information about the Tekton Pipeline that the user must create, read the OOTB Supply Chain Testing documentation of the Pipeline

source-scanner-template

Purpose

Scans the source code for vulnerabilities.

Used by

• Source-Test-Scan-to-URL in the source-scanner step.

This is used as the source-scanner resource.

Creates

SourceScan

Parameters

      - name: scanning_source_template
        value: private-source-scan-template
      

      - name: scanning_source_policy
        value: allowlist-policy
      

More information

For information about how to set up the Workload namespace with the ScanPolicy and ScanTemplate required for this resource, see Out of the Box Supply Chain with Testing and Scanning.

For information about the SourceScan custom resource, see SourceScan reference.

For information about how the artifacts found during scanning are catalogued, see Supply Chain Security Tools for Tanzu – Store.

image-provider-template

Purpose

Fetches a container image of a prebuilt application, specified in the workload’s .spec.image field. This makes the content-addressable name, (e.g. the image name containing the digest) available to other resources in the supply chain.

Used by

• Basic-Image-to-URL in the image-provider step.
• Testing-Image-to-URL in the image-provider step.
• Scanning-Image-Scan-to-URL in the image-provider step.
• Basic-Image-to-URL-Package (experimental) in the image-provider step.

These are used as the image-provider resource.

Creates

ImageRepository.source.apps.tanzu.vmware.com

Parameters

      - name: serviceAccount
        value: default
      

Note

When using the Tanzu CLI to configure this serviceAccount parameter, use --param serviceAccount=.... The similarly named --service-account flag sets a different value: the spec.serviceAccountName key in the Workload object.

More information

For information about the ImageRepository resource, see ImageRepository reference docs.

For information about prebuilt images, see Using a prebuilt image.

kpack-template

Purpose

Builds an container image from source code using cloud native buildpacks.

Used by

• Source-to-URL in the image-provider step.
• Source-Test-to-URL in the image-provider step.
• Source-Test-Scan-to-URL in the image-provider step.
• Source-to-URL-Package (experimental) in the image-provider step.

These are used as the image-provider resource when the workload parameter dockerfile is not defined.

Creates

Image.kpack.io

Parameters

      - name: serviceAccount
        value: default
      

      - name: clusterBuilder
        value: nodejs-cluster-builder
      

      - name: buildServiceBindings
        value:
          - name: settings-xml
            kind: Secret
            apiVersion: v1
      

      - name: live-update
        value: "true"
      

Note

When using the Tanzu CLI to configure this serviceAccount parameter, use --param serviceAccount=.... The similarly named --service-account flag sets a different value: the spec.serviceAccountName key in the Workload object.

More information

For information about the integration with Tanzu Build Service, see Tanzu Build Service Integration.

For information about live-update, see Developer Conventions and Overview of Tanzu Developer Tools for IntelliJ.

For information about using Kpack builders with clusterBuilder, see Builders.

For information about buildServiceBindings, see Service Bindings.

kaniko-template

Purpose

Build an image for source code that includes a Dockerfile.

Used by

• Source-to-URL in the image-provider step.
• Source-Test-to-URL in the image-provider step.
• Source-Test-Scan-to-URL in the image-provider step.
• Source-to-URL-Package (experimental) in the image-provider step.

These are used as the image-provider resource when the workload parameter dockerfile is defined.

Creates

A taskrun.tekton.dev provides configuration to the Tekton Task kaniko-build which builds an image with kaniko.

This template uses the lifecycle: tekton flag to create new immutable objects rather than updating the previous object.

Parameters

./Dockerfile

.

- --build-arg=FOO=BAR

      - name: serviceAccount
        value: default
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
      

More information

For information about how to use Dockerfile-based builds and limits associated with the function, see Dockerfile-based builds.

For information about lifecycle:tekton, read Cartographer Lifecycle.

image-scanner-template

Purpose

Scans the container image for vulnerabilities, persists the results in a store, and prevents the image from moving forward if CVEs are found which are not compliant with its referenced ScanPolicy.

Used by

• Source-Test-Scan-to-URL in the image-scanner step.
• Scanning-Image-Scan-to-URL in the image-scanner step.

Creates

ImageScan.scanning.apps.tanzu.vmware.com

Parameters

      - name: scanning_image_template
        value: private-image-scan-template
      

      - name: scanning_image_policy
        value: allowlist-policy
      

More information

For information about the ImageScan custom resource, see ImageScan reference.

For information about how the artifacts found during scanning are catalogued, see Supply Chain Security Tools for Tanzu – Store.

convention-template

Purpose

Create the PodTemplateSpec for the Kubernetes configuration (e.g. the knative service or kubernetes deployment) which are applied to the cluster.

Used by

• Source-to-URL in the config-provider step.
• Basic-Image-to-URL in the config-provider step.
• Source-Test-to-URL in the config-provider step.
• Testing-Image-to-URL in the config-provider step.
• Source-Test-Scan-to-URL in the config-provider step.
• Scanning-Image-Scan-to-URL in the config-provider step.
• Source-to-URL-Package (experimental) in the config-provider step.
• Basic-Image-to-URL-Package (experimental) in the config-provider step.

Creates

Creates a PodIntent object. The PodIntent leverages conventions installed on the cluster. The PodIntent object is responsible for generating a PodTemplateSpec. The PodTemplateSpec is used in app configs, such as knative services and deployments, to represent the shape of the pods to run the application in containers.

Parameters

      - name: serviceAccount
        value: default
      

      - name: annotations
        value:
          name: my-application
          version: v1.2.3
          team: store
      

      - name: debug
        value: "true"
      

      - name: live-update
        value: "true"
      

Note

When using the Tanzu CLI to configure this serviceAccount parameter, use --param serviceAccount=.... The similarly named --service-account flag sets a different value: the spec.serviceAccountName key in the Workload object.

More information

For information about PodTemplateSpec, see PodTemplateSpec in the Kubernetes documentation.

For information about conventions, see Cartographer Conventions.

For information about the two convention servers enabled by default in Tanzu Application Platform installations, see Developer Conventions and Spring Boot conventions.

config-template

Purpose

For workloads with the label apps.tanzu.vmware.com/workload-type: web, define a knative service.

Used by

• Source-to-URL in the app-config step.
• Basic-Image-to-URL in the app-config step.
• Source-Test-to-URL in the app-config step.
• Testing-Image-to-URL in the app-config step.
• Source-Test-Scan-to-URL in the app-config step.
• Scanning-Image-Scan-to-URL in the app-config step.

Creates

A ConfigMap, in which the data field has a key delivery.yaml whose value is the definition of a knative service.

Parameters

None

More information

See workload types for more details about the three different types of workloads.

worker-template

Purpose

For workloads with the label apps.tanzu.vmware.com/workload-type: worker, define a Kubernetes Deployment.

Used by

• Source-to-URL in the app-config step.
• Basic-Image-to-URL in the app-config step.
• Source-Test-to-URL in the app-config step.
• Testing-Image-to-URL in the app-config step.
• Source-Test-Scan-to-URL in the app-config step.
• Scanning-Image-Scan-to-URL in the app-config step.

Creates

A ConfigMap, in which the data field has a key delivery.yaml whose value is the definition of a Kubernetes Deployment.

Parameters

None

More information

For information about the three different types of workloads, see workload types.

server-template

Purpose

For workloads with the label apps.tanzu.vmware.com/workload-type: server, define a Kubernetes Deployment and a Kubernetes Service.

Used by

• Source-to-URL in the app-config step.
• Basic-Image-to-URL in the app-config step.
• Source-Test-to-URL in the app-config step.
• Testing-Image-to-URL in the app-config step.
• Source-Test-Scan-to-URL in the app-config step.
• Scanning-Image-Scan-to-URL in the app-config step.
• Source-to-URL-Package (experimental) in the app-config step.
• Basic-Image-to-URL-Package (experimental) in the app-config step.

Creates

A ConfigMap, in which the data field has a key delivery.yaml whose value is the definitions of a Kubernetes Deployment and a Kubernetes Service to expose the pods.

Parameters

      - name: ports
        value:
          - containerPort: 2025
            name: smtp
            port: 25
      

More information

For information about the three different types of workloads, see workload types.

For information about the ports parameter, see server-specific Workload parameters.

service-bindings

Purpose

Adds ServiceBindings to the set of Kubernetes configuration files.

Used by

• Source-to-URL in the service-bindings step.
• Basic-Image-to-URL in the service-bindings step.
• Source-Test-to-URL in the service-bindings step.
• Testing-Image-to-URL in the service-bindings step.
• Source-Test-Scan-to-URL in the service-bindings step.
• Scanning-Image-Scan-to-URL in the service-bindings step.
• Source-to-URL-Package (experimental) in the service-bindings step.
• Basic-Image-to-URL-Package (experimental) in the service-bindings step.

Creates

A ConfigMap. This template consumes input of multiple deployment YAML files and enriches the input with ResourceClaims and ServiceBindings if the workload contains serviceClaims.

Parameters

      - name: annotations
        value:
          name: my-application
          version: v1.2.3
          team: store
      

More information

For an example of using --service-ref, see the Tanzu CLI Command Reference documentation.

For an overview of the function, see Consume services on Tanzu Application Platform.

api-descriptors

Purpose

The api-descriptor resource takes care of adding an APIDescriptor to the set of Kubernetes objects to deploy such that API auto registration takes place.

Used by

• Source-to-URL in the api-descriptors step.
• Basic-Image-to-URL in the api-descriptors step.
• Source-Test-to-URL in the api-descriptors step.
• Testing-Image-to-URL in the api-descriptors step.
• Source-Test-Scan-to-URL in the api-descriptors step.
• Scanning-Image-Scan-to-URL in the api-descriptors step.
• Source-to-URL-Package (experimental) in the api-descriptors step.
• Basic-Image-to-URL-Package (experimental) in the api-descriptors step.

Creates

A ConfigMap. This template consumes input of multiple YAML files and enriches the input with an APIDescriptor if the workload has a label apis.apps.tanzu.vmware.com/register-api == to true.

Parameters

      - name: annotations
        value:
          name: my-application
          version: v1.2.3
          team: store
      

      - name: api_descriptor
        value:
          type: openapi
          location:
            baseURL: http://petclinic-hard-coded.my-apps.tapdemo.vmware.com/
            path: "/v3/api
          owner: team-petclinic
          system: pet-clinics
          description: "example"
      

More information

For information about API auto registration, see Use API Auto Registration.

config-writer-template

Purpose

Persist in an external system, such as a registry or git repository, the Kubernetes configuration passed to the template.

Used by

• Source-to-URL in the config-writer step.
• Basic-Image-to-URL in the config-writer step.
• Source-Test-to-URL in the config-writer step.
• Testing-Image-to-URL in the config-writer step.
• Source-Test-Scan-to-URL in the config-writer step.
• Scanning-Image-Scan-to-URL in the config-writer step.

Creates

A runnable which creates a Tekton TaskRun that refers either to the Tekton Task git-writer or the Tekton Task image-writer.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_branch
        value: main
      

      - name: gitops_user_name
        value: "Alice Lee"
      

      - name: gitops_user_email
        value: alice@example.com
      

      - name: gitops_commit_message
        value: "ci bump"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/cartographer"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
          ca_cert_data:
            -----BEGIN CERTIFICATE-----
            MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
            -----END CERTIFICATE-----
      

More information

For information about operating this template, see Gitops vs RegistryOps and the config-writer-and-pull-requester-template.

config-writer-and-pull-requester-template

Purpose

Persist the passed in Kubernetes configuration to a branch in a repository and open a pull request to another branch. This process allows for manual review of configuration before deployment to a cluster.

Used by

• Source-to-URL in the config-writer step.
• Basic-Image-to-URL in the config-writer step.
• Source-Test-to-URL in the config-writer step.
• Testing-Image-to-URL in the config-writer step.
• Source-Test-Scan-to-URL in the config-writer step.
• Scanning-Image-Scan-to-URL in the config-writer step.

Creates

A Tekton TaskRun refers to the Tekton Task commit-and-pr.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_commit_branch
        value: feature
      

      - name: gitops_branch
        value: main
      

      - name: gitops_user_name
        value: "Alice Lee"
      

      - name: gitops_user_email
        value: alice@example.com
      

      - name: gitops_commit_message
        value: "ci bump"
      

      - name: gitops_pull_request_title
        value: "ready for review"
      

      - name: gitops_pull_request_body
        value: "generated by supply chain"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: gitops_server_kind
        value: gitlab
      

      - name: ca_cert_data
        value:
          -----BEGIN CERTIFICATE-----
          MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
          -----END CERTIFICATE-----
      

More information

For information about the operation of this template, see Gitops vs RegistryOps and the config-writer-template.

deliverable-template

Purpose

Create a deliverable which pairs with a Delivery to deploy Kubernetes configuration on the cluster.

Used by

• Source-to-URL in the deliverable step.
• Basic-Image-to-URL in the deliverable step.
• Source-Test-to-URL in the deliverable step.
• Testing-Image-to-URL in the deliverable step.
• Source-Test-Scan-to-URL in the deliverable step.
• Scanning-Image-Scan-to-URL in the deliverable step.

Creates

A Deliverable preconfigured with reference to a repository or registry from which to fetch Kubernetes configuration.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_credentials_secret
        value: git-secret
      

      - name: gitops_ssh_secret
        value: git-secret
      

      - name: gitops_branch
        value: main
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/cartographer"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
          ca_cert_data:
            -----BEGIN CERTIFICATE-----
            MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
            -----END CERTIFICATE-----
      

Note

When using the Tanzu CLI to configure this serviceAccount parameter, use --param serviceAccount=.... The similarly named --service-account flag sets a different value: the spec.serviceAccountName key in the Workload object.

More information

For information about the ClusterDelivery shipped with ootb-delivery-basic, see Out of the Box Delivery Basic.

external-deliverable-template

Purpose

Create a definition of a deliverable which a user can manually applied to an external kubernetes cluster. When a properly configured Delivery is installed on that external cluster, the Deliverable will pair with the Delivery to deploy Kubernetes configuration on the cluster. For example, the OOTB Delivery.

Used by

• Source-to-URL in the deliverable step.
• Basic-Image-to-URL in the deliverable step.
• Source-Test-to-URL in the deliverable step.
• Testing-Image-to-URL in the deliverable step.
• Source-Test-Scan-to-URL in the deliverable step.
• Scanning-Image-Scan-to-URL in the deliverable step.

Creates

A configmap in which the .data field has a key deliverable for which the value is the YAML definition of a Deliverable.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_ssh_secret
        value: ssh-secret
      

      - name: gitops_branch
        value: main
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/cartographer"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
          ca_cert_data:
            -----BEGIN CERTIFICATE-----
            MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
            -----END CERTIFICATE-----
      

More information

For information about the ClusterDelivery shipped with ootb-delivery-basic, see Out of the Box Delivery Basic.

For information about using the Deliverable object in a multicluster environment, see Getting started with multicluster Tanzu Application Platform.

delivery-source-template

Purpose

Continuously fetches Kubernetes configuration files from a Git repository or container image registry and makes them available on the cluster.

Used by

• Delivery-Basic

Creates

The source-template creates one of three objects, either: - GitRepository. Created if the deliverable has .spec.source.git defined. - ImageRepository. Created if the deliverable has .spec.source.image defined.

GitRepository

GitRepository makes source code from a particular commit available as a tarball in the cluster. Other resources in the supply chain can then access that code.

Parameters

      - name: gitImplementation
        value: go-git
      

      - name: source_credentials_secret
        value: git-credentials
      

More information

For an example using the Tanzu CLI to create a Workload using GitHub as the provider of source code, see Create a workload from GitHub repository.

For information about GitRepository objects, see GitRepository.

ImageRepository

ImageRepository makes the contents of a container image available as a tarball on the cluster.

Parameters

      - name: serviceAccount
        value: default
      

More information

For information about the ImageRepository resource, see ImageRepository reference docs.

app-deploy

Purpose

Applies Kubernetes configuration to the cluster.

Used by

• Delivery-Basic

Creates

A kapp App.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_sub_path
        value: ./config
      

Note

The gitops_sub_path parameter is deprecated. Use deliverable.spec.source.subPath instead.

More information

For details about RBAC and how kapp-controller makes use of the ServiceAccount provided through the Deliverable’s serviceAccount parameter, see kapp-controller’s Security Model.

carvel-package (experimental)

Purpose

Bundles Kubernetes configuration into a Carvel Package.

Used by

• Source-to-URL-Package (experimental) in the carvel-package step.
• Basic-Image-to-URL-Package (experimental) in the carvel-package step.

Creates

A taskrun.tekton.dev which provides configuration to the carvel-package Tekton Task which bundles Kubernetes configuration into a Carvel Package.

This template uses the lifecycle: tekton flag to create new immutable objects rather than updating the previous object.

Parameters

      - name: serviceAccount
        value: default
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
      

      - name: carvel_package_gitops_subpath
        value: path/to/my/dir
      

      - name: carvel_package_name_suffix
        value: vmware.com
      

      - name: carvel_package_parameters
        value: |
        - selector:
            matchLabels:
              apps.tanzu.vmware.com/workload-type: server
          schema: |
            #@data/values-schema
            ---
            #@schema/title "Workload name"
            #@schema/example "tanzu-java-web-app"
            #@schema/validation min_len=1
            workload_name: ""

            #@schema/title "Replicas"
            replicas: 1

            #@schema/title "Port"
            port: 8080

            #@schema/title "Hostname"
            #@schema/example "app.tanzu.vmware.com"
            hostname: ""

            #@schema/title "Cluster Issuer"
            cluster_issuer: "tap-ingress-selfsigned"

            #@schema/nullable
            http_route:
                #@schema/default [{"protocol": "https", "name": "default-gateway"}]
                gateways:
                - protocol: ""
                  name: ""
          overlays: |
            #@ load("@ytt:overlay", "overlay")
            #@ load("@ytt:data", "data")

            #@overlay/match by=overlay.subset({"apiVersion":"apps/v1", "kind": "Deployment"})
            ---
            spec:
              #@overlay/match missing_ok=True
              replicas: #@ data.values.replicas

            #@ if data.values.http_route != None:
            ---
            apiVersion: gateway.networking.k8s.io/v1beta1
            kind: HTTPRoute
            metadata:
              name: #@ data.values.workload_name + "-route"
            spec:
              parentRefs:
              #@ for/end gateway in data.values.http_route.gateways:
              - group: gateway.networking.k8s.io
                kind: Gateway
                name: #@ gateway.name
                sectionName: #@ gateway.protocol + "-" + data.values.workload_name
              rules:
              - backendRefs:
                - name: #@ data.values.workload_name
                  port: #@ data.values.port
            #@ elif data.values.hostname != "":
            ---
            apiVersion: networking.k8s.io/v1
            kind: Ingress
            metadata:
              name: #@ data.values.workload_name
              annotations:
                cert-manager.io/cluster-issuer:  #@ data.values.cluster_issuer
                ingress.kubernetes.io/force-ssl-redirect: "true"
                kubernetes.io/ingress.class: contour
                kapp.k14s.io/change-rule: "upsert after upserting Services"
              labels:
                app.kubernetes.io/component: "run"
                carto.run/workload-name:  #@ data.values.workload_name
            spec:
              tls:
                - secretName: #@ data.values.workload_name
                  hosts:
                  - #@ data.values.hostname
              rules:
              - host: #@ data.values.hostname
                http:
                  paths:
                  - pathType: Prefix
                    path: /
                    backend:
                      service:
                        name: #@ data.values.workload_name
                        port:
                          number: #@ data.values.port
            #@ end
        - selector:
            matchLabels:
              apps.tanzu.vmware.com/workload-type: web
          schema: |
            #@data/values-schema
            ---
            #@schema/validation min_len=1
            workload_name: ""
          overlays: ""
        - selector:
            matchLabels:
              apps.tanzu.vmware.com/workload-type: worker
          schema: |
            #@data/values-schema
            ---
            #@schema/validation min_len=1
            workload_name: ""
            replicas: 1
          overlays: |
            #@ load("@ytt:overlay", "overlay")
            #@ load("@ytt:data", "data")
            #@overlay/match by=overlay.subset({"apiVersion":"apps/v1", "kind": "Deployment"})
            ---
            spec:
              #@overlay/match missing_ok=True
              replicas: #@ data.values.replicas
      

      - name: carvel_package_openapiv3_enabled
        value: true
      

More information

To read more about lifecycle:tekton, read Cartographer Lifecycle.

package-config-writer-template (experimental)

Purpose

Persist in an external git repository the Carvel Package Kubernetes configuration passed to the template.

Used by

• Source-to-URL-Package (experimental) in the config-writer step.
• Basic-Image-to-URL-Package (experimental) in the config-writer step.

Creates

A runnable which creates a Tekton TaskRun that refers either to the Tekton Task git-writer.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_branch
        value: main
      

      - name: gitops_user_name
        value: "Alice Lee"
      

      - name: gitops_user_email
        value: alice@example.com
      

      - name: gitops_commit_message
        value: "ci bump"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/cartographer"
      

      - name: gitops_repository
        value: "https://github.com/vmware-tanzu/"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: registry
        value:
          server: index.docker.io
          repository: web-team
          ca_cert_data:
            -----BEGIN CERTIFICATE-----
            MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
            -----END CERTIFICATE-----
      

      - name: carvel_package_gitops_subpath
        value: path/to/my/dir
      

      - name: carvel_package_name_suffix
        value: vmware.com
      

More information

See Gitops vs RegistryOps for more information about the operation of this template and of the package-config-writer-and-pull-requester-template (experimental).

package-config-writer-and-pull-requester-template (experimental)

Purpose

Persist the passed in Carvel Package Kubernetes configuration to a branch in a repository and open a pull request to another branch. (This process allows for manual review of configuration before deployment to a cluster)

Used by

• Source-to-URL-Package (experimental) in the config-writer step.
• Basic-Image-to-URL-Package (experimental) in the config-writer step.

Creates

A Tekton TaskRun which refers to the Tekton Task commit-and-pr.

Parameters

      - name: serviceAccount
        value: default
      

      - name: gitops_commit_branch
        value: feature
      

      - name: gitops_branch
        value: main
      

      - name: gitops_user_name
        value: "Alice Lee"
      

      - name: gitops_user_email
        value: alice@example.com
      

      - name: gitops_commit_message
        value: "ci bump"
      

      - name: gitops_pull_request_title
        value: "ready for review"
      

      - name: gitops_pull_request_body
        value: "generated by supply chain"
      

      - name: gitops_server_address
        value: "https://github.com/"
      

      - name: gitops_repository_owner
        value: vmware-tanzu
      

      - name: gitops_repository_name
        value: cartographer
      

      - name: gitops_server_kind
        value: gitlab
      

      - name: carvel_package_gitops_subpath
        value: path/to/my/dir
      

      - name: carvel_package_name_suffix
        value: vmware.com
      

      - name: ca_cert_data
        value:
          -----BEGIN CERTIFICATE-----
          MIIFXzCCA0egAwIBAgIJAJYm37SFocjlMA0GCSqGSIb3DQEBDQUAMEY...
          -----END CERTIFICATE-----
      

More information

See Gitops vs RegistryOps for more information about the operation of this template and of the package-config-writer-template (experimental).