<p>I was going through the official <a href="https://github.com/tektoncd/pipeline/blob/master/docs/tutorial.md" rel="nofollow noreferrer">Tekton documentation</a> where it deploys an image to Kubernetes using <code>kubectl</code> standard deployment object <a href="https://github.com/GoogleContainerTools/skaffold/blob/master/examples/microservices/leeroy-web/kubernetes/deployment.yaml" rel="nofollow noreferrer">manifest</a> . However I am trying use Tekton pipeline as CI/CD to deploy in a knative service which should either use <code>knctl</code> or <code>kubectl</code> with a knative service yaml instead of Deployment yaml of <a href="https://github.com/knative/serving/blob/master/docs/spec/spec.md" rel="nofollow noreferrer">knative serving spec</a></p>

<p>Something like </p>

<pre><code>apiVersion: serving.knative.dev/v1 # Current version of Knative
kind: Service
metadata:
  name: helloworld-go # The name of the app
  namespace: default # The namespace the app will use
spec:
  template:
    spec:
      containers:
        - image: gcr.io/knative-samples/helloworld-go # The URL to the image of the app
          env:
            - name: TARGET # The environment variable printed out by the sample app
              value: "Go Sample v1"
</code></pre>

<p>How do I take advantage of Tekton in this case. If I were to install images to any random Kubenetes cluster, I could any other CI/CD tool along with Deployment manifest. I believe Tekton is supposed replace Knative build to make it easy.</p>

Neil
<p>There is no one way you could approach deploying a Knative Service with Tekton, but a couple key things to consider are as follows. These instructions assume proper installation of both Tekton/Knative Serving on a Kubernetes cluster.</p>
<h3>ServiceAccount permissions to create a Knative Service</h3>
<p>Tekton allows the use of Kubernetes ServiceAccounts to assign permissions (e.g. creating a Knative service) so that a TaskRun or PipelineRun (i.e. the execution of a Tekton CI/CD process) is able to create and update certain resources. In this case, the creation of a Knative Service.</p>
<p>In order to create a ServiceAccount with permissions to create and update a Knative Service, you would need to create a role that is similar to what is shown below:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: create-knative-service
  namespace: default
rules:
  # Create and update Knative Service
  - apiGroups: [&quot;serving.knative.dev&quot;]
    resources: [&quot;services&quot;]
    verbs: [&quot;get&quot;, &quot;create&quot;, &quot;update&quot;]
</code></pre>
<p>The Role above allows for the creation and updating of Knative Services.</p>
<p>The Role can be associated with a ServiceAccount via a RoleBinding, which assumes the creation of a ServiceAccount:</p>
<pre class="lang-yaml prettyprint-override"><code>---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: tekton-sa
  namespace: default
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: create-knative-service-binding
subjects:
  - kind: ServiceAccount
    name: tekton-sa
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: create-knative-service
</code></pre>
<p>Once the Role, RoleBinding, and ServiceAccount are available, you can use this ServiceAccount during a TaskRun or PipelineRun depending on how you are deploying a Knative Service. The ServiceAccount to use can be specified via the <a href="https://github.com/tektoncd/pipeline/blob/master/docs/pipelineruns.md#configuring-a-pipelinerun" rel="nofollow noreferrer">ServiceAccountName property</a> of a TaskRun or PipelineRun.</p>
<p>If you are using the Tekton cli (<code>tkn</code>), you can use <code>-s</code> flag to specify what ServiceAccount to use when starting a PipelineRun or TaskRun:</p>
<pre><code>tkn pipeline start knative-service-deploy -s tekton-sa 
</code></pre>
<p><strong>NOTE:</strong> The Role and RoleBinding examples are for a specific case that only allows deployment of the Knative Service to the same namespace where the TaskRun/PipelineRun is executing.</p>
<h3>What step image to use to deploy the Knative Service</h3>
<p>To deploy the Knative Service via a TaskRun or PipelineRun, you will need to create a Task with a Step that deploys the Knative Service. There is no one tool that you could use in this case as you mention as far as using <code>kubectl</code>, <code>kn</code>, or any other tool to deploy to Kubernetes.</p>
<p>The important things for Tekton to know is the Task definition, the image used by the Step, and the command to run to deploy the Knative Service. An example using <code>kn</code> is shown below:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy-knative-service
spec:
  # Step to create Knative Service from built image using kn. Replaces service if it already exists.
  steps: 
    - name: kn
      image: &quot;gcr.io/knative-releases/knative.dev/client/cmd/kn:latest&quot;
      command: [&quot;/ko-app/kn&quot;]
      args: [&quot;service&quot;, 
        &quot;create&quot;, &quot;knative-service&quot;, 
        &quot;--image&quot;, &quot;gcr.io/knative-samples/helloworld-go:latest&quot;, 
        &quot;--force&quot;]
</code></pre>
<p>In the example above, a Task is defined with one Step called <code>kn</code>. The Step uses the official <code>kn</code> image; specifies to run the <code>kn</code> root command; and then passes arguments to the <code>kn</code> command to create a Knative Service named <code>knative-service</code>, use an image for the Knative Service named <code>gcr.io/knative-samples/helloworld-go</code>, and the <code>--force</code> flag that updates the Knative Service if it already exists.</p>
<p><strong>EDIT: Adding kubectl Example</strong></p>
<p>The question asks about using <code>kubectl</code>, so I am adding in an example of using <code>kubectl</code> in a Tekton Task to deploy a Knative Service from a YAML file:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy-knative-service
spec:
  # Step to create Knative Service from YAML file using kubectl.
  steps:
    - name: kubectl
      image: &quot;bitnami/kubectl&quot;
      command: [&quot;kubectl&quot;]
      args: [&quot;apply&quot;, &quot;-f&quot;, &quot;https://raw.githubusercontent.com/danielhelfand/lab-knative-serving/master/knative/service.yaml&quot;]
</code></pre>
<h3>Summary</h3>
<p>There is no exact way to answer this question, but hopefully the examples and main points help with considerations around permissions for a PipelineRun or TaskRun as well as how to use certain tools with Tekton.</p>
