Add new infra architecture 3

infrastructure/cicd/tekton-helm/templates/NOTES.txt

@@ -0,0 +1,22 @@
+Thank you for installing {{ .Chart.Name }}.
+
+This chart deploys the Tekton CI/CD infrastructure for Bakery-IA.
+
+IMPORTANT: Tekton Pipelines must be installed separately before deploying this chart.
+
+To install Tekton Pipelines, run:
+  kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
+
+To verify Tekton is running:
+  kubectl get pods -n tekton-pipelines
+
+After Tekton is installed, this chart will deploy:
+- ConfigMaps with pipeline configuration
+- RBAC resources for triggers and pipelines
+- Secrets for registry and Git credentials
+- Tasks, Pipelines, and Triggers for CI/CD
+
+To check the status of deployed resources:
+  kubectl get all -n {{ .Values.namespace }}
+
+For more information about Tekton, visit: https://tekton.dev/

infrastructure/cicd/tekton-helm/templates/clusterroles.yaml

@@ -0,0 +1,76 @@
+# ClusterRole for Tekton Triggers to create PipelineRuns
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: tekton-triggers-role
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+rules:
+  # Ability to create PipelineRuns from triggers
+  - apiGroups: ["tekton.dev"]
+    resources: ["pipelineruns", "taskruns"]
+    verbs: ["create", "get", "list", "watch"]
+  # Ability to read pipelines and tasks
+  - apiGroups: ["tekton.dev"]
+    resources: ["pipelines", "tasks", "clustertasks"]
+    verbs: ["get", "list", "watch"]
+  # Ability to manage PVCs for workspaces
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  # Ability to read secrets for credentials
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  # Ability to read configmaps
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch"]
+  # Ability to manage events for logging
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+---
+# ClusterRole for Pipeline execution (needed for git operations and deployments)
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: tekton-pipeline-role
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: pipeline
+rules:
+  # Ability to read/update deployments for GitOps
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "patch", "update"]
+  # Ability to read secrets for credentials
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  # Ability to read configmaps
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch"]
+  # Ability to manage pods for build operations
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list", "watch"]
+---
+# Role for EventListener to access triggers resources
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tekton-triggers-eventlistener-role
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+rules:
+  - apiGroups: ["triggers.tekton.dev"]
+    resources: ["eventlisteners", "triggerbindings", "triggertemplates", "triggers", "interceptors"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps", "secrets"]
+    verbs: ["get", "list", "watch"]

infrastructure/cicd/tekton-helm/templates/configmap.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pipeline-config
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: config
+data:
+  # Container Registry Configuration
+  REGISTRY_URL: "{{ .Values.global.registry.url }}"
+
+  # Git Configuration
+  GIT_BRANCH: "{{ .Values.global.git.branch }}"
+  GIT_USER_NAME: "{{ .Values.global.git.userName }}"
+  GIT_USER_EMAIL: "{{ .Values.global.git.userEmail }}"
+
+  # Build Configuration
+  BUILD_CACHE_TTL: "{{ .Values.pipeline.build.cacheTTL }}"
+  BUILD_VERBOSITY: "{{ .Values.pipeline.build.verbosity }}"
+
+  # Test Configuration
+  SKIP_TESTS: "{{ .Values.pipeline.test.skipTests }}"
+  SKIP_LINT: "{{ .Values.pipeline.test.skipLint }}"
+
+  # Deployment Configuration
+  DEPLOY_NAMESPACE: "{{ .Values.pipeline.deployment.namespace }}"
+  FLUX_NAMESPACE: "{{ .Values.pipeline.deployment.fluxNamespace }}"
+
+  # Workspace Configuration
+  WORKSPACE_SIZE: "{{ .Values.pipeline.workspace.size }}"
+  WORKSPACE_STORAGE_CLASS: "{{ .Values.pipeline.workspace.storageClass }}"

infrastructure/cicd/tekton-helm/templates/event-listener.yaml

@@ -0,0 +1,33 @@
+# Tekton EventListener for Bakery-IA CI/CD
+# This listener receives webhook events and triggers pipelines
+
+apiVersion: triggers.tekton.dev/v1beta1
+kind: EventListener
+metadata:
+  name: bakery-ia-event-listener
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+spec:
+  serviceAccountName: {{ .Values.serviceAccounts.triggers.name }}
+  triggers:
+    - name: bakery-ia-gitea-trigger
+      interceptors:
+        - ref:
+            name: "cel"
+          params:
+            - name: "filter"
+              value: "has(body.repository) && body.ref.contains('main')"
+        - ref:
+            name: "bitbucket"
+          params:
+            - name: "secretRef"
+              value:
+                secretName: gitea-webhook-secret
+                secretKey: secretToken
+      bindings:
+        - ref: bakery-ia-trigger-binding
+      template:
+        ref: bakery-ia-trigger-template
+  replicas: 1

infrastructure/cicd/tekton-helm/templates/namespace.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.namespace }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: {{ .Values.labels.app.component }}
+{{- end }}

infrastructure/cicd/tekton-helm/templates/pipeline-ci.yaml

@@ -0,0 +1,149 @@
+# Main CI Pipeline for Bakery-IA
+# This pipeline orchestrates the build, test, and deploy process
+# Includes: fetch -> detect changes -> test -> build -> update gitops
+
+apiVersion: tekton.dev/v1beta1
+kind: Pipeline
+metadata:
+  name: bakery-ia-ci
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: pipeline
+spec:
+  workspaces:
+    - name: shared-workspace
+      description: Shared workspace for source code
+    - name: docker-credentials
+      description: Docker registry credentials
+    - name: git-credentials
+      description: Git credentials for pushing GitOps updates
+      optional: true
+  params:
+    - name: git-url
+      type: string
+      description: Repository URL
+    - name: git-revision
+      type: string
+      description: Git revision/commit hash
+    - name: registry
+      type: string
+      description: Container registry URL
+    - name: git-branch
+      type: string
+      description: Target branch for GitOps updates
+      default: "main"
+    - name: skip-tests
+      type: string
+      description: Skip tests if "true"
+      default: "false"
+    - name: dry-run
+      type: string
+      description: Dry run mode - don't push changes
+      default: "false"
+
+  tasks:
+    # Stage 1: Fetch source code
+    - name: fetch-source
+      taskRef:
+        name: git-clone
+      workspaces:
+        - name: output
+          workspace: shared-workspace
+      params:
+        - name: url
+          value: $(params.git-url)
+        - name: revision
+          value: $(params.git-revision)
+
+    # Stage 2: Detect which services changed
+    - name: detect-changes
+      runAfter: [fetch-source]
+      taskRef:
+        name: detect-changed-services
+      workspaces:
+        - name: source
+          workspace: shared-workspace
+
+    # Stage 3: Run tests on changed services
+    - name: run-tests
+      runAfter: [detect-changes]
+      taskRef:
+        name: run-tests
+      when:
+        - input: "$(tasks.detect-changes.results.changed-services)"
+          operator: notin
+          values: ["none", "infrastructure"]
+        - input: "$(params.skip-tests)"
+          operator: notin
+          values: ["true"]
+      workspaces:
+        - name: source
+          workspace: shared-workspace
+      params:
+        - name: services
+          value: $(tasks.detect-changes.results.changed-services)
+        - name: skip-tests
+          value: $(params.skip-tests)
+
+    # Stage 4: Build and push container images
+    - name: build-and-push
+      runAfter: [run-tests]
+      taskRef:
+        name: kaniko-build
+      when:
+        - input: "$(tasks.detect-changes.results.changed-services)"
+          operator: notin
+          values: ["none", "infrastructure"]
+      workspaces:
+        - name: source
+          workspace: shared-workspace
+        - name: docker-credentials
+          workspace: docker-credentials
+      params:
+        - name: services
+          value: $(tasks.detect-changes.results.changed-services)
+        - name: registry
+          value: $(params.registry)
+        - name: git-revision
+          value: $(params.git-revision)
+
+    # Stage 5: Update GitOps manifests
+    - name: update-gitops-manifests
+      runAfter: [build-and-push]
+      taskRef:
+        name: update-gitops
+      when:
+        - input: "$(tasks.detect-changes.results.changed-services)"
+          operator: notin
+          values: ["none", "infrastructure"]
+        - input: "$(tasks.build-and-push.results.build-status)"
+          operator: in
+          values: ["success", "partial"]
+      workspaces:
+        - name: source
+          workspace: shared-workspace
+        - name: git-credentials
+          workspace: git-credentials
+      params:
+        - name: services
+          value: $(tasks.detect-changes.results.changed-services)
+        - name: registry
+          value: $(params.registry)
+        - name: git-revision
+          value: $(params.git-revision)
+        - name: git-branch
+          value: $(params.git-branch)
+        - name: dry-run
+          value: $(params.dry-run)
+
+  # Final tasks that run regardless of pipeline success/failure
+  finally:
+    - name: pipeline-summary
+      taskRef:
+        name: pipeline-summary
+      params:
+        - name: changed-services
+          value: $(tasks.detect-changes.results.changed-services)
+        - name: git-revision
+          value: $(params.git-revision)

infrastructure/cicd/tekton-helm/templates/rolebindings.yaml

@@ -0,0 +1,51 @@
+# ClusterRoleBinding for Tekton Triggers
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: tekton-triggers-binding
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccounts.triggers.name }}
+    namespace: {{ .Values.namespace }}
+roleRef:
+  kind: ClusterRole
+  name: tekton-triggers-role
+  apiGroup: rbac.authorization.k8s.io
+---
+# ClusterRoleBinding for Pipeline execution
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: tekton-pipeline-binding
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: pipeline
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccounts.pipeline.name }}
+    namespace: {{ .Values.namespace }}
+roleRef:
+  kind: ClusterRole
+  name: tekton-pipeline-role
+  apiGroup: rbac.authorization.k8s.io
+---
+# RoleBinding for EventListener
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tekton-triggers-eventlistener-binding
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccounts.triggers.name }}
+    namespace: {{ .Values.namespace }}
+roleRef:
+  kind: Role
+  name: tekton-triggers-eventlistener-role
+  apiGroup: rbac.authorization.k8s.io

infrastructure/cicd/tekton-helm/templates/secrets.yaml

@@ -0,0 +1,72 @@
+# Secret for Gitea webhook validation
+# Used by EventListener to validate incoming webhooks
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-webhook-secret
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+  annotations:
+    note: "Webhook secret for validating incoming webhooks"
+type: Opaque
+stringData:
+  secretToken: {{ .Values.secrets.webhook.token | quote }}
+---
+# Secret for Gitea container registry credentials
+# Used by Kaniko to push images to Gitea registry
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-registry-credentials
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: build
+  annotations:
+    note: "Registry credentials for pushing images"
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: |
+    {
+      "auths": {
+        {{ .Values.secrets.registry.registryUrl | quote }}: {
+          "username": {{ .Values.secrets.registry.username | quote }},
+          "password": {{ .Values.secrets.registry.password | quote }}
+        }
+      }
+    }
+---
+# Secret for Git credentials (used by pipeline to push GitOps updates)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-git-credentials
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: gitops
+  annotations:
+    note: "Git credentials for GitOps updates"
+type: Opaque
+stringData:
+  username: {{ .Values.secrets.git.username | quote }}
+  password: {{ .Values.secrets.git.password | quote }}
+---
+# Secret for Flux GitRepository access
+# Used by Flux to pull from Gitea repository
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-credentials
+  namespace: {{ .Values.pipeline.deployment.fluxNamespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: flux
+  annotations:
+    note: "Credentials for Flux GitRepository access"
+type: Opaque
+stringData:
+  username: {{ .Values.secrets.git.username | quote }}
+  password: {{ .Values.secrets.git.password | quote }}

infrastructure/cicd/tekton-helm/templates/serviceaccounts.yaml

@@ -0,0 +1,19 @@
+# ServiceAccount for Tekton Triggers EventListener
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccounts.triggers.name }}
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+---
+# ServiceAccount for Pipeline execution
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccounts.pipeline.name }}
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: pipeline

infrastructure/cicd/tekton-helm/templates/task-git-clone.yaml

@@ -0,0 +1,95 @@
+# Tekton Git Clone Task for Bakery-IA CI/CD
+# This task clones the source code repository
+
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: git-clone
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: source
+spec:
+  workspaces:
+    - name: output
+      description: Workspace to clone the repository into
+  params:
+    - name: url
+      type: string
+      description: Repository URL to clone
+    - name: revision
+      type: string
+      description: Git revision to checkout
+      default: "main"
+    - name: depth
+      type: string
+      description: Git clone depth (0 for full history)
+      default: "1"
+  results:
+    - name: commit-sha
+      description: The commit SHA that was checked out
+    - name: commit-message
+      description: The commit message
+  steps:
+    - name: clone
+      image: alpine/git:2.43.0
+      script: |
+        #!/bin/sh
+        set -e
+
+        URL="$(params.url)"
+        REVISION="$(params.revision)"
+        DEPTH="$(params.depth)"
+        OUTPUT_PATH="$(workspaces.output.path)"
+
+        echo "============================================"
+        echo "Git Clone Task"
+        echo "============================================"
+        echo "URL: $URL"
+        echo "Revision: $REVISION"
+        echo "Depth: $DEPTH"
+        echo "============================================"
+
+        # Clone with depth for faster checkout
+        if [ "$DEPTH" = "0" ]; then
+          echo "Cloning full repository..."
+          git clone "$URL" "$OUTPUT_PATH"
+        else
+          echo "Cloning with depth $DEPTH..."
+          git clone --depth "$DEPTH" "$URL" "$OUTPUT_PATH"
+        fi
+
+        cd "$OUTPUT_PATH"
+
+        # Fetch the specific revision if needed
+        if [ "$REVISION" != "main" ] && [ "$REVISION" != "master" ]; then
+          echo "Fetching revision: $REVISION"
+          git fetch --depth 1 origin "$REVISION" 2>/dev/null || true
+        fi
+
+        # Checkout the revision
+        echo "Checking out: $REVISION"
+        git checkout "$REVISION" 2>/dev/null || git checkout "origin/$REVISION"
+
+        # Get commit info
+        COMMIT_SHA=$(git rev-parse HEAD)
+        COMMIT_MSG=$(git log -1 --pretty=format:"%s")
+
+        echo ""
+        echo "============================================"
+        echo "Clone Complete"
+        echo "============================================"
+        echo "Commit: $COMMIT_SHA"
+        echo "Message: $COMMIT_MSG"
+        echo "============================================"
+
+        # Write results
+        echo -n "$COMMIT_SHA" > $(results.commit-sha.path)
+        echo -n "$COMMIT_MSG" > $(results.commit-message.path)
+      resources:
+        limits:
+          cpu: 500m
+          memory: 512Mi
+        requests:
+          cpu: 100m
+          memory: 128Mi

infrastructure/cicd/tekton-helm/templates/task-kaniko-build.yaml

@@ -0,0 +1,51 @@
+# Tekton Kaniko Build Task for Bakery-IA CI/CD
+# This task builds and pushes container images using Kaniko
+
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: kaniko-build
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: build
+spec:
+  workspaces:
+    - name: source
+      description: Workspace containing the source code
+    - name: docker-credentials
+      description: Docker registry credentials
+  params:
+    - name: services
+      type: string
+      description: Comma-separated list of services to build
+    - name: registry
+      type: string
+      description: Container registry URL
+    - name: git-revision
+      type: string
+      description: Git revision to tag images with
+  results:
+    - name: build-status
+      description: Status of the build operation
+  steps:
+    - name: build-and-push
+      image: gcr.io/kaniko-project/executor:v1.15.0
+      env:
+        - name: DOCKER_CONFIG
+          value: /tekton/home/.docker
+      command:
+        - /kaniko/executor
+      args:
+        - --dockerfile=$(workspaces.source.path)/Dockerfile
+        - --destination=$(params.registry)/$(params.service):$(params.git-revision)
+        - --context=$(workspaces.source.path)
+        - --cache=true
+        - --cache-repo=$(params.registry)/cache
+      resources:
+        limits:
+          cpu: 2000m
+          memory: 4Gi
+        requests:
+          cpu: 500m
+          memory: 1Gi

infrastructure/cicd/tekton-helm/templates/task-run-tests.yaml

@@ -0,0 +1,86 @@
+# Tekton Run Tests Task for Bakery-IA CI/CD
+# This task runs tests on the source code
+
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: run-tests
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: test
+spec:
+  workspaces:
+    - name: source
+      description: Workspace containing the source code
+  params:
+    - name: services
+      type: string
+      description: Comma-separated list of services to test
+    - name: skip-tests
+      type: string
+      description: Skip tests if "true"
+      default: "false"
+  steps:
+    - name: run-unit-tests
+      image: python:3.11-slim
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/bash
+        set -e
+        
+        echo "============================================"
+        echo "Running Unit Tests"
+        echo "Services: $(params.services)"
+        echo "Skip tests: $(params.skip-tests)"
+        echo "============================================"
+        
+        if [ "$(params.skip-tests)" = "true" ]; then
+          echo "Skipping tests as requested"
+          exit 0
+        fi
+        
+        # Install dependencies if requirements file exists
+        if [ -f "requirements.txt" ]; then
+          pip install --no-cache-dir -r requirements.txt
+        fi
+        
+        # Run unit tests
+        python -m pytest tests/unit/ -v
+        
+        echo "Unit tests completed successfully"
+      resources:
+        limits:
+          cpu: 1000m
+          memory: 2Gi
+        requests:
+          cpu: 200m
+          memory: 512Mi
+    - name: run-integration-tests
+      image: python:3.11-slim
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/bash
+        set -e
+        
+        echo "============================================"
+        echo "Running Integration Tests"
+        echo "Services: $(params.services)"
+        echo "============================================"
+        
+        if [ "$(params.skip-tests)" = "true" ]; then
+          echo "Skipping integration tests as requested"
+          exit 0
+        fi
+        
+        # Run integration tests
+        python -m pytest tests/integration/ -v
+        
+        echo "Integration tests completed successfully"
+      resources:
+        limits:
+          cpu: 1000m
+          memory: 2Gi
+        requests:
+          cpu: 200m
+          memory: 512Mi

infrastructure/cicd/tekton-helm/templates/task-update-gitops.yaml

@@ -0,0 +1,104 @@
+# Tekton Update GitOps Task for Bakery-IA CI/CD
+# This task updates GitOps manifests with new image tags
+
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: update-gitops
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: gitops
+spec:
+  workspaces:
+    - name: source
+      description: Workspace containing the source code
+    - name: git-credentials
+      description: Git credentials for pushing changes
+  params:
+    - name: services
+      type: string
+      description: Comma-separated list of services to update
+    - name: registry
+      type: string
+      description: Container registry URL
+    - name: git-revision
+      type: string
+      description: Git revision to tag images with
+    - name: git-branch
+      type: string
+      description: Git branch to push changes to
+    - name: dry-run
+      type: string
+      description: Dry run mode - don't push changes
+      default: "false"
+  steps:
+    - name: update-manifests
+      image: alpine/git:2.43.0
+      workingDir: $(workspaces.source.path)
+      env:
+        - name: GIT_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: gitea-git-credentials
+              key: username
+        - name: GIT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: gitea-git-credentials
+              key: password
+      script: |
+        #!/bin/bash
+        set -e
+        
+        echo "============================================"
+        echo "Updating GitOps Manifests"
+        echo "Services: $(params.services)"
+        echo "Registry: $(params.registry)"
+        echo "Revision: $(params.git-revision)"
+        echo "Branch: $(params.git-branch)"
+        echo "Dry run: $(params.dry-run)"
+        echo "============================================"
+        
+        # Configure git
+        git config --global user.email "ci@bakery-ia.local"
+        git config --global user.name "bakery-ia-ci"
+        
+        # Clone the GitOps repository
+        REPO_URL="https://${GIT_USERNAME}:${GIT_PASSWORD}@gitea.bakery-ia.local/bakery/bakery-ia-gitops.git"
+        git clone "$REPO_URL" /tmp/gitops
+        
+        cd /tmp/gitops
+        
+        # Switch to target branch
+        git checkout "$(params.git-branch)" || git checkout -b "$(params.git-branch)"
+        
+        # Update image tags in Kubernetes manifests
+        for service in $(echo "$(params.services)" | tr ',' '\n'); do
+          echo "Updating manifest for service: $service"
+          
+          # Find and update the image tag in the deployment YAML
+          if [ -f "deployments/${service}-deployment.yaml" ]; then
+            sed -i "s|image: bakery/${service}:.*|image: $(params.registry)/bakery/${service}:$(params.git-revision)|g" "deployments/${service}-deployment.yaml"
+          fi
+        done
+        
+        # Commit and push changes (unless dry-run)
+        if [ "$(params.dry-run)" != "true" ]; then
+          git add .
+          git commit -m "Update images for services: $(params.services) [skip ci]"
+          git push origin "$(params.git-branch)"
+          
+          echo "GitOps manifests updated successfully"
+        else
+          echo "Dry run mode - changes not pushed"
+          git status
+          git diff
+        fi
+      resources:
+        limits:
+          cpu: 500m
+          memory: 512Mi
+        requests:
+          cpu: 100m
+          memory: 128Mi

infrastructure/cicd/tekton-helm/templates/trigger-binding.yaml

@@ -0,0 +1,23 @@
+# Tekton TriggerBinding for Bakery-IA CI/CD
+# This binding extracts parameters from incoming webhook payloads
+
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerBinding
+metadata:
+  name: bakery-ia-trigger-binding
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+spec:
+  params:
+    - name: git-repo-url
+      value: "{{"{{ .payload.repository.clone_url }}"}}"
+    - name: git-revision
+      value: "{{"{{ .payload.after }}"}}"
+    - name: git-branch
+      value: "{{"{{ .payload.ref }}" | replace "refs/heads/" "" | replace "refs/tags/" "" }}"
+    - name: git-repo-name
+      value: "{{"{{ .payload.repository.name }}"}}"
+    - name: git-repo-full-name
+      value: "{{"{{ .payload.repository.full_name }}"}}"

infrastructure/cicd/tekton-helm/templates/trigger-template.yaml

@@ -0,0 +1,79 @@
+# Tekton TriggerTemplate for Bakery-IA CI/CD
+# This template defines how PipelineRuns are created when triggers fire
+
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerTemplate
+metadata:
+  name: bakery-ia-trigger-template
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.labels.app.name }}
+    app.kubernetes.io/component: triggers
+spec:
+  params:
+    - name: git-repo-url
+      description: The git repository URL
+    - name: git-revision
+      description: The git revision/commit hash
+    - name: git-branch
+      description: The git branch name
+      default: "main"
+    - name: git-repo-name
+      description: The git repository name
+      default: "bakery-ia"
+    - name: git-repo-full-name
+      description: The full repository name (org/repo)
+      default: "bakery/bakery-ia"
+    # Registry URL - keep in sync with pipeline-config ConfigMap
+    - name: registry-url
+      description: Container registry URL
+      default: {{ .Values.global.registry.url | quote }}
+  resourcetemplates:
+    - apiVersion: tekton.dev/v1beta1
+      kind: PipelineRun
+      metadata:
+        generateName: bakery-ia-ci-run-
+        labels:
+          app.kubernetes.io/name: {{ .Values.labels.app.name }}
+          tekton.dev/pipeline: bakery-ia-ci
+          triggers.tekton.dev/trigger: bakery-ia-gitea-trigger
+        annotations:
+          # Track the source commit
+          bakery-ia.io/git-revision: $(tt.params.git-revision)
+          bakery-ia.io/git-branch: $(tt.params.git-branch)
+      spec:
+        pipelineRef:
+          name: bakery-ia-ci
+        serviceAccountName: {{ .Values.serviceAccounts.pipeline.name }}
+        workspaces:
+          - name: shared-workspace
+            volumeClaimTemplate:
+              spec:
+                accessModes: ["ReadWriteOnce"]
+                resources:
+                  requests:
+                    storage: {{ .Values.pipeline.workspace.size }}
+          - name: docker-credentials
+            secret:
+              secretName: gitea-registry-credentials
+          - name: git-credentials
+            secret:
+              secretName: gitea-git-credentials
+        params:
+          - name: git-url
+            value: $(tt.params.git-repo-url)
+          - name: git-revision
+            value: $(tt.params.git-revision)
+          - name: git-branch
+            value: $(tt.params.git-branch)
+          # Use template parameter for registry URL
+          - name: registry
+            value: $(tt.params.registry-url)
+          - name: skip-tests
+            value: "false"
+          - name: dry-run
+            value: "false"
+        # Timeout for the entire pipeline run
+        timeouts:
+          pipeline: "1h0m0s"
+          tasks: "45m0s"