<p>We have a Tekton pipeline and want to replace the <code>image</code> tags contents of our <code>deployment.yml</code>:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: microservice-api-spring-boot
spec:
  replicas: 3
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: microservice-api-spring-boot
  template:
    metadata:
      labels:
        app: microservice-api-spring-boot
    spec:
      containers:
        - image: registry.gitlab.com/jonashackt/microservice-api-spring-boot@sha256:5d8a03755d3c45a3d79d32ab22987ef571a65517d0edbcb8e828a4e6952f9bcd
          name: microservice-api-spring-boot
          ports:
            - containerPort: 8098
      imagePullSecrets:
        - name: gitlab-container-registry
</code></pre>
<p>Our Tekton pipeline uses the <a href="https://hub.tekton.dev/tekton/task/yq" rel="nofollow noreferrer">yq Task from Tekton Hub</a> to replace the <code>.spec.template.spec.containers[0].image</code> with the <code>&quot;$(params.IMAGE):$(params.SOURCE_REVISION)&quot;</code> name like this:</p>
<pre><code>- name: substitute-config-image-name
  taskRef:
    name: yq
  runAfter:
    - fetch-config-repository
  workspaces:
    - name: source
      workspace: config-workspace
  params:
    - name: files
      value:
      - &quot;./deployment/deployment.yml&quot;
    - name: expression
      value: .spec.template.spec.containers[0].image = \&quot;$(params.IMAGE)\&quot;:\&quot;$(params.SOURCE_REVISION)\&quot;
</code></pre>
<p>Sadly the yq Task doesn't seem to work, it produces a green
<code>Step completed successfully</code>, but shows the following errors:</p>
<pre><code>16:50:43 safelyRenameFile [ERRO] Failed copying from /tmp/temp3555913516 to /workspace/source/deployment/deployment.yml
16:50:43 safelyRenameFile [ERRO] open /workspace/source/deployment/deployment.yml: permission denied
</code></pre>
<p>Here's also a screenshot from our Tekton Dashboard:</p>
<p><a href="https://i.stack.imgur.com/OZcRV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OZcRV.png" alt="enter image description here" /></a></p>
<p>Any idea on how to solve the error?</p>

jonashackt
<p>The problem seems to be related to the way how the <a href="https://github.com/mikefarah/yq/blob/master/Dockerfile" rel="nofollow noreferrer">Dockerfile</a> of <a href="https://github.com/mikefarah/yq" rel="nofollow noreferrer">https://github.com/mikefarah/yq</a> now handles file permissions (for example <a href="https://github.com/mikefarah/yq/commit/adb61446061d8d376c2c2c50436db7d5e054d94d#diff-dd2c0eb6ea5cfc6c4bd4eac30934e2d5746747af48fef6da689e85b752f39557" rel="nofollow noreferrer">this fix</a> among others). The <code>0.3</code> version of the Tekton yq Task uses the image <a href="https://hub.docker.com/layers/mikefarah/yq/4.16.2/images/sha256-c6ef1bc27dd9cee57fa635d9306ce43ca6805edcdab41b047905f7835c174005" rel="nofollow noreferrer">https://hub.docker.com/layers/mikefarah/yq/4.16.2/images/sha256-c6ef1bc27dd9cee57fa635d9306ce43ca6805edcdab41b047905f7835c174005</a> which produces the error.</p>
<p>One work-around to the problem could be the usage of the yq Task version <code>0.2</code> which you can apply via:</p>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/yq/0.2/yq.yaml
</code></pre>
<p>This one uses the older <code>docker.io/mikefarah/yq:4@sha256:34f1d11ad51dc4639fc6d8dd5ade019fe57cf6084bb6a99a2f11ea522906033b</code> and works without the error.</p>
<p>Alternatively you can simply create your own yq based Task that won't have the problem like this:</p>
<pre><code>apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: replace-image-name-with-yq
spec:
  workspaces:
    - name: source
      description: A workspace that contains the file which need to be dumped.
  params:
    - name: IMAGE_NAME
      description: The image name to substitute
    - name: FILE_PATH
      description: The file path relative to the workspace dir.
    - name: YQ_VERSION
      description: Version of https://github.com/mikefarah/yq
      default: v4.2.0
  steps:
    - name: substitute-with-yq
      image: alpine
      workingDir: $(workspaces.source.path)
      command:
        - /bin/sh
      args:
        - '-c'
        - |
          set -ex
          echo &quot;--- Download yq &amp; add to path&quot;
          wget https://github.com/mikefarah/yq/releases/download/$(params.YQ_VERSION)/yq_linux_amd64 -O /usr/bin/yq &amp;&amp;\
              chmod +x /usr/bin/yq
          echo &quot;--- Run yq expression&quot;
          yq e &quot;.spec.template.spec.containers[0].image = \&quot;$(params.IMAGE_NAME)\&quot;&quot; -i $(params.FILE_PATH)
          echo &quot;--- Show file with replacement&quot;
          cat $(params.FILE_PATH)
      resources: {}
</code></pre>
<p>This custom Task simple uses the <code>alpine</code> image as base and <a href="https://github.com/mikefarah/yq#install" rel="nofollow noreferrer">installs yq</a> using the <code>Plain binary wget</code> download. Also it uses <code>yq</code> exactly as you would do on the command line locally, which makes development of your expression so much easier!</p>
<p>As a bonus it outputs the file contents so you can check the replacement results right in the Tekton pipeline!</p>
<p>You need to apply it with</p>
<pre><code>kubectl apply -f tekton-ci-config/replace-image-name-with-yq.yml
</code></pre>
<p>And should now be able to use it like this:</p>
<pre><code>- name: replace-config-image-name
  taskRef:
    name: replace-image-name-with-yq
  runAfter:
    - dump-contents
  workspaces:
    - name: source
      workspace: config-workspace
  params:
    - name: IMAGE_NAME
      value: &quot;$(params.IMAGE):$(params.SOURCE_REVISION)&quot;
    - name: FILE_PATH
      value: &quot;./deployment/deployment.yml&quot;
</code></pre>
<p>Inside the Tekton dashboard it will look somehow like this and output the processed file:</p>
<p><a href="https://i.stack.imgur.com/QMqSv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QMqSv.png" alt="enter image description here" /></a></p>
