Commit 2c6d94568a91

@@ -0,0 +1,590 @@
+# Best Practices Workflow
+
+Tekton best practices for security, performance, reliability, and maintainability.
+
+## When to Use
+
+- Optimizing Tekton pipelines
+- Implementing security best practices
+- Improving performance
+- Operating Tekton at scale
+- Troubleshooting common issues
+
+## Security Best Practices
+
+### Workspace-Based Authentication (2024 Recommendation)
+
+**DO: Use workspace-based authentication**
+```yaml
+workspaces:
+  - name: git-credentials
+    secret:
+      secretName: git-ssh-key
+```
+
+**DON'T: Rely only on built-in credential initialization**
+- Being phased out
+- All steps get access to all credentials
+- Credentials copied to disk
+- Security issues with different UIDs
+
+### ServiceAccount and RBAC
+
+**Create dedicated ServiceAccounts:**
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pipeline-sa
+secrets:
+  - name: docker-credentials
+  - name: git-credentials
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pipeline-role
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pipeline-binding
+subjects:
+  - kind: ServiceAccount
+    name: pipeline-sa
+roleRef:
+  kind: Role
+  name: pipeline-role
+  apiGroup: rbac.authorization.k8s.io
+```
+
+**Principle of least privilege:**
+- Create separate ServiceAccounts for CI and CD
+- Grant only necessary permissions
+- Use Role instead of ClusterRole when possible
+- Regularly audit permissions
+
+### Pod Security
+
+```yaml
+spec:
+  steps:
+    - name: secure-step
+      image: alpine
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop:
+            - ALL
+```
+
+### Secrets Management
+
+**DO:**
+- Use Kubernetes Secrets or external secret managers (Vault, AWS Secrets Manager)
+- Mount secrets as volumes, not environment variables
+- Use short-lived tokens (OAuth, OIDC)
+- Rotate secrets regularly
+- Scan secrets with tools like gitleaks, trufflehog
+
+**DON'T:**
+- Commit secrets to Git
+- Print secrets in logs
+- Use long-lived credentials
+- Share secrets across environments
+
+## Performance Best Practices
+
+### Resource Management
+
+**Always set resource requests and limits:**
+```yaml
+steps:
+  - name: build
+    image: maven:3.8
+    resources:
+      requests:
+        cpu: 1000m
+        memory: 2Gi
+      limits:
+        cpu: 2000m
+        memory: 4Gi
+```
+
+**Guidelines:**
+- Set requests based on average usage
+- Set limits 1.5-2x higher than requests
+- Monitor actual usage: `kubectl top pods`
+- Use task-level resources for simplicity
+
+### Configure Pipeline Pruner
+
+**Automatic cleanup of old resources:**
+```yaml
+apiVersion: operator.tekton.dev/v1alpha1
+kind: TektonConfig
+metadata:
+  name: config
+spec:
+  pruner:
+    disabled: false
+    schedule: "0 8 * * *"  # Daily at 8 AM
+    keep: 3  # Keep last 3 runs
+    resources:
+      - pipelinerun
+      - taskrun
+```
+
+**Manual cleanup:**
+```bash
+# Keep last 5 runs
+tkn pipelinerun delete --keep 5 -f
+
+# Delete runs older than 60 minutes
+tkn pipelinerun delete --keep-since 60 -f
+
+# Delete all failed runs
+tkn pipelinerun delete --all --failed -f
+```
+
+### Workspace Optimization
+
+**Use volumeClaimTemplate for isolation:**
+```yaml
+workspaces:
+  - name: workspace
+    volumeClaimTemplate:
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
+```
+
+**Avoid PVC sharing conflicts:**
+- ReadWriteOnce: Limited to single node
+- ReadWriteMany: Best for Tekton but less common
+- Use emptyDir for temporary data
+- Use subPaths for organization
+
+### Caching Strategies
+
+**Maven cache:**
+```yaml
+workspaces:
+  - name: maven-cache
+    persistentVolumeClaim:
+      claimName: maven-cache-pvc
+
+steps:
+  - name: build
+    image: maven:3.8
+    env:
+      - name: MAVEN_OPTS
+        value: "-Dmaven.repo.local=$(workspaces.maven-cache.path)"
+```
+
+**Kaniko cache:**
+```yaml
+args:
+  - --cache=true
+  - --cache-repo=myregistry.com/cache
+  - --cache-ttl=24h
+```
+
+**npm cache:**
+```yaml
+workspaces:
+  - name: npm-cache
+
+steps:
+  - name: install
+    image: node:18
+    script: |
+      npm config set cache $(workspaces.npm-cache.path)
+      npm install
+```
+
+## Reliability Best Practices
+
+### Error Handling
+
+**Use retries for flaky operations:**
+```yaml
+tasks:
+  - name: flaky-network-test
+    retries: 3
+    taskRef:
+      name: integration-test
+```
+
+**Use onError for optional tasks:**
+```yaml
+tasks:
+  - name: optional-scan
+    onError: continue
+    taskRef:
+      name: security-scan
+```
+
+**Implement timeout:**
+```yaml
+spec:
+  timeouts:
+    pipeline: 2h
+    tasks: 1h
+    finally: 30m
+
+tasks:
+  - name: long-running
+    timeout: 45m
+```
+
+### Finally Tasks for Cleanup
+
+```yaml
+finally:
+  - name: cleanup-workspace
+    taskRef:
+      name: cleanup
+    workspaces:
+      - name: workspace
+        workspace: shared-data
+
+  - name: send-notification
+    taskRef:
+      name: notify
+    params:
+      - name: status
+        value: $(tasks.status)
+      - name: message
+        value: "Pipeline $(context.pipelineRun.name) $(tasks.status)"
+```
+
+### Idempotent Tasks
+
+```yaml
+# BAD: Not idempotent
+script: |
+  echo "data" >> file.txt  # Appends on retry
+
+# GOOD: Idempotent
+script: |
+  echo "data" > file.txt   # Overwrites on retry
+```
+
+## Maintainability Best Practices
+
+### Task Reusability
+
+**DO: Parameterize everything**
+```yaml
+params:
+  - name: image
+  - name: dockerfile
+    default: ./Dockerfile
+  - name: context
+    default: .
+```
+
+**DON'T: Hardcode values**
+```yaml
+# Anti-pattern
+args:
+  - --destination=myregistry.com/myimage:latest
+```
+
+### Use Tekton Hub
+
+**Check Hub before creating custom tasks:**
+```bash
+tkn hub search git
+tkn hub info task git-clone
+tkn hub install task git-clone
+```
+
+**Reference Hub tasks:**
+```yaml
+taskRef:
+  resolver: hub
+  params:
+    - name: name
+      value: git-clone
+    - name: version
+      value: "0.10.0"
+```
+
+### Migration from Deprecated Features
+
+**AVOID: ClusterTasks (deprecated)**
+```yaml
+# Old
+taskRef:
+  name: git-clone
+  kind: ClusterTask
+```
+
+**USE: Resolvers**
+```yaml
+# New - Cluster resolver
+taskRef:
+  resolver: cluster
+  params:
+    - name: name
+      value: git-clone
+    - name: namespace
+      value: tekton-tasks
+
+# New - Hub resolver (preferred)
+taskRef:
+  resolver: hub
+  params:
+    - name: name
+      value: git-clone
+```
+
+**AVOID: PipelineResources (deprecated)**
+- Use Tasks with Results and Workspaces instead
+
+### Documentation
+
+**Document tasks comprehensively:**
+```yaml
+metadata:
+  name: build-app
+  labels:
+    app.kubernetes.io/version: "1.0"
+  annotations:
+    tekton.dev/pipelines.minVersion: "0.50.0"
+    tekton.dev/categories: Build Tools
+    tekton.dev/tags: build, maven
+spec:
+  description: |
+    Builds Java application using Maven.
+
+    This task compiles source code, runs tests,
+    and packages the application as a JAR file.
+
+    ## Parameters
+    - maven-goals: Maven goals to execute (default: clean package)
+    - settings-path: Path to custom settings.xml
+
+    ## Workspaces
+    - source: Source code directory
+    - maven-cache: Maven local repository cache (optional)
+
+    ## Results
+    - artifact-name: Name of the generated JAR file
+```
+
+### Versioning
+
+```yaml
+metadata:
+  labels:
+    app.kubernetes.io/version: "2.1.0"
+    version: "2.1.0"
+```
+
+## Anti-Patterns to Avoid
+
+### 1. Not Setting Resource Limits
+
+**Impact:** Poor scheduling, resource contention, cluster instability
+
+**Solution:**
+```yaml
+resources:
+  requests:
+    cpu: 500m
+    memory: 1Gi
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+```
+
+### 2. Using :latest Image Tag
+
+**Impact:** Non-deterministic builds, cache issues
+
+**Solution:**
+```yaml
+image: maven:3.8.6-openjdk-17  # Specific version
+```
+
+### 3. Monolithic Tasks
+
+**Impact:** Poor reusability, difficult debugging
+
+**Solution:** Break into focused, single-responsibility tasks
+
+### 4. Ignoring Pipeline Pruner
+
+**Impact:** etcd bloat, performance degradation
+
+**Solution:** Configure automatic pruning (see above)
+
+### 5. Sharing ReadWriteOnce PVC in Parallel
+
+**Impact:** Pod scheduling failures
+
+**Solution:**
+- Use ReadWriteMany
+- Use volumeClaimTemplate
+- Avoid parallel tasks with shared workspace
+
+### 6. Results Over 4KB
+
+**Impact:** Task failures
+
+**Solution:** Use workspaces for large data
+
+### 7. Not Using Tekton Hub
+
+**Impact:** Reinventing the wheel, maintenance burden
+
+**Solution:** Check Hub first, contribute improvements
+
+### 8. Overly Permissive RBAC
+
+**Impact:** Security risks
+
+**Solution:** Least privilege principle
+
+### 9. Secrets in Logs
+
+**Impact:** Credential exposure
+
+**Solution:** Never print sensitive data
+
+### 10. Not Testing Tasks Isolation
+
+**Impact:** Pipeline failures
+
+**Solution:** Test TaskRuns independently before using in pipelines
+
+## Operating at Scale (Red Hat Lessons)
+
+### 1. Configure Pipeline Pruner
+Delete completed pods to free volumes and improve performance
+
+### 2. Set Resource Requests/Limits
+Scheduler performs poorly without them
+
+### 3. Understand Workload Bottlenecks
+Profile and optimize based on actual constraints
+
+### 4. Avoid PVC Sharing Conflicts
+Use volumeClaimTemplate or manage access modes carefully
+
+### 5. Monitor etcd Performance
+Prune old resources, use Tekton Results for long-term storage
+
+### 6. Plan for Multi-AZ Clusters
+PVCs are tied to specific availability zones
+
+### 7. Use Tekton Resolvers
+Replace ClusterTasks with cluster/hub/git resolvers
+
+### 8. Implement Retry Strategies
+Set retries for flaky network operations
+
+### 9. Version Control Everything
+Pin task/pipeline versions for stability
+
+### 10. Test at Scale
+Load test pipelines before production deployment
+
+## Monitoring and Observability
+
+### Tekton Dashboard
+
+```bash
+# Install Tekton Dashboard
+kubectl apply -f https://storage.googleapis.com/tekton-releases/dashboard/latest/release.yaml
+
+# Access dashboard
+kubectl port-forward -n tekton-pipelines svc/tekton-dashboard 9097:9097
+```
+
+### Prometheus Metrics
+
+**Tekton exports metrics:**
+- `tekton_pipelinerun_duration_seconds`
+- `tekton_pipelinerun_count`
+- `tekton_taskrun_duration_seconds`
+- `tekton_taskrun_count`
+
+### Logging Best Practices
+
+**Structured logging in tasks:**
+```yaml
+script: |
+  echo "[INFO] Starting build"
+  echo "[ERROR] Build failed: $ERROR_MSG"
+  echo "[SUCCESS] Build completed"
+```
+
+**Aggregate logs:**
+- Use Fluentd/Fluent Bit to collect logs
+- Send to Elasticsearch, Loki, or CloudWatch
+- Create dashboards in Grafana, Kibana
+
+### Alerting
+
+**Alert on:**
+- Pipeline failure rate exceeding threshold
+- Long-running pipelines
+- Resource quota exhaustion
+- PVC capacity
+- Failed webhook deliveries
+
+## Checklist
+
+### Security Checklist
+- [ ] Use workspace-based authentication
+- [ ] Create dedicated ServiceAccounts
+- [ ] Follow least privilege RBAC
+- [ ] Run containers as non-root
+- [ ] Scan images for vulnerabilities
+- [ ] Rotate credentials regularly
+- [ ] Don't commit secrets to Git
+- [ ] Use signed commits
+
+### Performance Checklist
+- [ ] Set resource requests/limits on all steps
+- [ ] Configure pipeline pruner
+- [ ] Use caching (Kaniko, Maven, npm)
+- [ ] Use volumeClaimTemplate for isolation
+- [ ] Monitor resource usage
+- [ ] Optimize Dockerfile layer caching
+- [ ] Use specific image tags
+
+### Reliability Checklist
+- [ ] Set retries for flaky operations
+- [ ] Use onError for optional tasks
+- [ ] Implement timeouts
+- [ ] Use finally tasks for cleanup
+- [ ] Write idempotent tasks
+- [ ] Test tasks in isolation
+- [ ] Monitor pipeline success rate
+
+### Maintainability Checklist
+- [ ] Check Tekton Hub before custom tasks
+- [ ] Parameterize all tasks
+- [ ] Document parameters and workspaces
+- [ ] Use resolvers (not ClusterTasks)
+- [ ] Version tasks and pipelines
+- [ ] Use consistent naming conventions
+- [ ] Organize tasks by function

@@ -0,0 +1,445 @@
+# Build Workflow
+
+Building container images with Tekton using Kaniko and Buildah.
+
+## When to Use
+
+- Building Docker/OCI container images
+- Pushing images to registries
+- Implementing caching strategies
+- Building without Docker daemon
+
+## Kaniko
+
+**Builds Docker images inside Kubernetes without Docker daemon**
+
+### Kaniko Task from Tekton Hub
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: TaskRun
+metadata:
+  name: kaniko-build
+spec:
+  taskRef:
+    resolver: hub
+    params:
+      - name: name
+        value: kaniko
+      - name: version
+        value: "0.6.0"
+  params:
+    - name: IMAGE
+      value: myregistry.com/myapp:latest
+    - name: DOCKERFILE
+      value: ./Dockerfile
+    - name: CONTEXT
+      value: .
+    - name: EXTRA_ARGS
+      value:
+        - --cache=true
+        - --cache-ttl=24h
+  workspaces:
+    - name: source
+      persistentVolumeClaim:
+        claimName: source-pvc
+    - name: dockerconfig
+      secret:
+        secretName: docker-config
+```
+
+### Custom Kaniko Task
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: kaniko-build-push
+spec:
+  params:
+    - name: IMAGE
+      description: Image name with tag
+    - name: DOCKERFILE
+      description: Path to Dockerfile
+      default: ./Dockerfile
+    - name: CONTEXT
+      description: Build context
+      default: .
+    - name: BUILD_ARGS
+      type: array
+      description: Build arguments
+      default: []
+  workspaces:
+    - name: source
+      description: Source code
+    - name: dockerconfig
+      description: Docker credentials
+  results:
+    - name: IMAGE_DIGEST
+      description: Image digest
+  steps:
+    - name: build-and-push
+      image: gcr.io/kaniko-project/executor:latest
+      args:
+        - --dockerfile=$(params.DOCKERFILE)
+        - --context=$(workspaces.source.path)/$(params.CONTEXT)
+        - --destination=$(params.IMAGE)
+        - --digest-file=$(results.IMAGE_DIGEST.path)
+        - $(params.BUILD_ARGS[*])
+      env:
+        - name: DOCKER_CONFIG
+          value: $(workspaces.dockerconfig.path)
+      resources:
+        requests:
+          cpu: 1000m
+          memory: 1Gi
+        limits:
+          cpu: 2000m
+          memory: 4Gi
+```
+
+### Kaniko with Caching
+
+```yaml
+args:
+  - --dockerfile=./Dockerfile
+  - --context=.
+  - --destination=myregistry.com/myapp:latest
+  - --cache=true
+  - --cache-repo=myregistry.com/cache
+  - --cache-ttl=24h
+  - --compressed-caching=false
+```
+
+### Multi-Stage Dockerfile with Kaniko
+
+```dockerfile
+# Dockerfile
+FROM maven:3.8-openjdk-17 AS build
+WORKDIR /app
+COPY pom.xml .
+RUN mvn dependency:go-offline
+COPY src ./src
+RUN mvn package -DskipTests
+
+FROM eclipse-temurin:17-jre-alpine
+COPY --from=build /app/target/*.jar /app/app.jar
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]
+```
+
+## Buildah
+
+**Builds OCI images with or without Dockerfiles**
+
+### Buildah Task
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: buildah-build
+spec:
+  params:
+    - name: IMAGE
+      description: Image name with tag
+    - name: DOCKERFILE
+      description: Path to Dockerfile
+      default: ./Dockerfile
+    - name: CONTEXT
+      description: Build context
+      default: .
+    - name: FORMAT
+      description: Image format (oci or docker)
+      default: oci
+    - name: TLS_VERIFY
+      description: Verify TLS certificates
+      default: "true"
+  workspaces:
+    - name: source
+    - name: dockerconfig
+  results:
+    - name: IMAGE_DIGEST
+  steps:
+    - name: build
+      image: quay.io/buildah/stable:latest
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/bash
+        buildah --storage-driver=vfs bud \
+          --format=$(params.FORMAT) \
+          --tls-verify=$(params.TLS_VERIFY) \
+          --no-cache \
+          -f $(params.DOCKERFILE) \
+          -t $(params.IMAGE) \
+          $(params.CONTEXT)
+
+        buildah --storage-driver=vfs push \
+          --tls-verify=$(params.TLS_VERIFY) \
+          --digestfile=$(results.IMAGE_DIGEST.path) \
+          $(params.IMAGE) \
+          docker://$(params.IMAGE)
+      env:
+        - name: REGISTRY_AUTH_FILE
+          value: $(workspaces.dockerconfig.path)/config.json
+      securityContext:
+        privileged: true
+      resources:
+        requests:
+          cpu: 1000m
+          memory: 1Gi
+        limits:
+          cpu: 2000m
+          memory: 4Gi
+```
+
+### Buildah without Dockerfile
+
+```yaml
+steps:
+  - name: build-from-scratch
+    image: quay.io/buildah/stable
+    script: |
+      #!/bin/bash
+      # Create container from base image
+      container=$(buildah from alpine:latest)
+
+      # Install packages
+      buildah run $container -- apk add --no-cache python3
+
+      # Copy application
+      buildah copy $container app.py /app/
+
+      # Configure
+      buildah config --entrypoint '["python3", "/app/app.py"]' $container
+      buildah config --port 8080 $container
+
+      # Commit and push
+      buildah commit $container $(params.IMAGE)
+      buildah push $(params.IMAGE)
+```
+
+## Container Registry Authentication
+
+### Docker Config Secret
+
+```bash
+# Create docker config secret
+kubectl create secret docker-registry docker-config \
+  --docker-server=myregistry.com \
+  --docker-username=myuser \
+  --docker-password=mypassword \
+  --docker-email=myemail@example.com
+```
+
+**Or from existing config:**
+```bash
+kubectl create secret generic docker-config \
+  --from-file=config.json=$HOME/.docker/config.json
+```
+
+### Using in Workspace
+
+```yaml
+workspaces:
+  - name: dockerconfig
+    secret:
+      secretName: docker-config
+```
+
+### Harbor Integration
+
+```bash
+# Create secret for Harbor
+kubectl create secret docker-registry harbor-config \
+  --docker-server=harbor.example.com \
+  --docker-username=admin \
+  --docker-password=Harbor12345
+```
+
+### AWS ECR Authentication
+
+```yaml
+# Create ECR credentials task
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: ecr-login
+spec:
+  results:
+    - name: docker-config
+  steps:
+    - name: get-credentials
+      image: amazon/aws-cli
+      script: |
+        aws ecr get-login-password --region us-east-1 > $(results.docker-config.path)
+```
+
+## Complete Build Pipeline
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: build-push-pipeline
+spec:
+  params:
+    - name: git-url
+    - name: git-revision
+      default: main
+    - name: image-name
+    - name: dockerfile
+      default: ./Dockerfile
+  workspaces:
+    - name: source-code
+    - name: docker-credentials
+  tasks:
+    # Clone repository
+    - name: clone
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: git-clone
+          - name: version
+            value: "0.10.0"
+      workspaces:
+        - name: output
+          workspace: source-code
+      params:
+        - name: url
+          value: $(params.git-url)
+        - name: revision
+          value: $(params.git-revision)
+
+    # Extract version from git
+    - name: get-version
+      runAfter:
+        - clone
+      taskRef:
+        name: git-version
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    # Build and push with Kaniko
+    - name: build-push
+      runAfter:
+        - get-version
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: kaniko
+      workspaces:
+        - name: source
+          workspace: source-code
+        - name: dockerconfig
+          workspace: docker-credentials
+      params:
+        - name: IMAGE
+          value: $(params.image-name):$(tasks.get-version.results.version)
+        - name: DOCKERFILE
+          value: $(params.dockerfile)
+        - name: EXTRA_ARGS
+          value:
+            - --cache=true
+            - --compressed-caching=false
+
+    # Scan image for vulnerabilities
+    - name: scan
+      runAfter:
+        - build-push
+      taskRef:
+        name: trivy-scanner
+      params:
+        - name: IMAGE
+          value: $(params.image-name):$(tasks.get-version.results.version)
+        - name: DIGEST
+          value: $(tasks.build-push.results.IMAGE_DIGEST)
+```
+
+## Best Practices
+
+### Image Tagging
+- Use semantic versioning: `v1.2.3`
+- Include git commit SHA: `abc123`
+- Tag with branch name for development: `main`, `develop`
+- Always tag `latest` for main branch
+- Use immutable tags in production
+
+### Build Optimization
+- Use multi-stage Dockerfiles
+- Leverage build cache (Kaniko `--cache`)
+- Order Dockerfile commands from least to most frequently changed
+- Use `.dockerignore` to exclude unnecessary files
+- Minimize layer count
+
+### Security
+- Scan images for vulnerabilities (Trivy, Grype)
+- Use minimal base images (alpine, distroless)
+- Run as non-root user
+- Don't include secrets in images
+- Sign images (Cosign)
+
+### Resource Management
+- Set appropriate CPU/memory limits
+- Use caching to reduce build time
+- Clean up intermediate images
+- Limit concurrent builds
+
+## Troubleshooting
+
+### Kaniko Build Fails
+
+```bash
+# Check workspace is populated
+kubectl exec <pod-name> -c step-build-and-push -- ls /workspace/source
+
+# Check Dockerfile path
+kubectl exec <pod-name> -c step-build-and-push -- cat /workspace/source/Dockerfile
+
+# Check registry credentials
+kubectl get secret docker-config -o yaml
+
+# View detailed logs
+tkn taskrun logs <taskrun-name> -f
+```
+
+### Authentication Errors
+
+```bash
+# Verify secret format
+kubectl get secret docker-config -o jsonpath='{.data.config\.json}' | base64 -d | jq
+
+# Test registry access
+kubectl run test-registry --rm -i --tty --image=alpine -- sh
+apk add --no-cache docker
+docker login myregistry.com
+```
+
+### Image Push Fails
+
+```bash
+# Check network connectivity
+kubectl exec <pod-name> -- ping myregistry.com
+
+# Verify registry URL
+kubectl exec <pod-name> -- nslookup myregistry.com
+
+# Check TLS verification
+# Add --insecure flag for testing (not production!)
+```
+
+### Out of Memory
+
+```bash
+# Increase memory limits
+resources:
+  limits:
+    memory: 8Gi
+
+# Use Kaniko compressed caching
+- --compressed-caching=true
+
+# Reduce concurrent builds
+```

@@ -0,0 +1,612 @@
+# GitOps Workflow
+
+Integrating Tekton with GitOps tools (ArgoCD, Flux CD) for complete CI/CD automation.
+
+## When to Use
+
+- Implementing GitOps workflows
+- Integrating Tekton with ArgoCD or Flux
+- Automating deployments via Git
+- Separating CI and CD concerns
+- Managing multi-environment deployments
+
+## GitOps Architecture
+
+### Tekton + ArgoCD Pattern
+
+```
+┌──────────┐    ┌────────────┐    ┌──────────────┐    ┌─────────────┐
+│  GitHub  │───▶│   Tekton   │───▶│  GitOps Repo │───▶│   ArgoCD    │
+│  (Code)  │    │    (CI)    │    │  (Manifests) │    │    (CD)     │
+└──────────┘    └────────────┘    └──────────────┘    └─────────────┘
+                     │                                        │
+                     │ Build & Push                           │ Sync
+                     ▼                                        ▼
+               ┌────────────┐                          ┌─────────────┐
+               │  Registry  │                          │  Kubernetes │
+               └────────────┘                          └─────────────┘
+```
+
+**Responsibilities:**
+- **Tekton (CI)**: Build, test, create container images
+- **ArgoCD (CD)**: Deploy manifests to Kubernetes
+
+**Benefits:**
+- Separation of concerns
+- Git as single source of truth
+- Declarative deployments
+- Automated rollback capabilities
+- Audit trail via Git history
+
+## Tekton CI Pipeline for GitOps
+
+### Complete CI Pipeline
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: gitops-ci-pipeline
+spec:
+  params:
+    - name: git-url
+      description: Application source repository
+    - name: git-revision
+      description: Git commit/branch
+      default: main
+    - name: image-name
+      description: Container image name
+    - name: gitops-repo-url
+      description: GitOps repository URL
+    - name: gitops-branch
+      description: GitOps repository branch
+      default: main
+    - name: deployment-file
+      description: Path to deployment file
+      default: k8s/deployment.yaml
+
+  workspaces:
+    - name: source-code
+    - name: gitops-repo
+    - name: docker-credentials
+    - name: git-credentials
+
+  tasks:
+    # 1. Clone application source
+    - name: clone-source
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: git-clone
+      workspaces:
+        - name: output
+          workspace: source-code
+        - name: ssh-directory
+          workspace: git-credentials
+      params:
+        - name: url
+          value: $(params.git-url)
+        - name: revision
+          value: $(params.git-revision)
+
+    # 2. Extract version from commit
+    - name: get-version
+      runAfter: [clone-source]
+      taskRef:
+        name: git-version
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    # 3. Run tests
+    - name: test
+      runAfter: [clone-source]
+      taskRef:
+        name: run-tests
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    # 4. Build and push image
+    - name: build-push
+      runAfter: [test, get-version]
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: kaniko
+      workspaces:
+        - name: source
+          workspace: source-code
+        - name: dockerconfig
+          workspace: docker-credentials
+      params:
+        - name: IMAGE
+          value: $(params.image-name):$(tasks.get-version.results.version)
+        - name: EXTRA_ARGS
+          value:
+            - --cache=true
+
+    # 5. Clone GitOps repository
+    - name: clone-gitops
+      runAfter: [build-push]
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: git-clone
+      workspaces:
+        - name: output
+          workspace: gitops-repo
+        - name: ssh-directory
+          workspace: git-credentials
+      params:
+        - name: url
+          value: $(params.gitops-repo-url)
+        - name: revision
+          value: $(params.gitops-branch)
+
+    # 6. Update image tag in GitOps repo
+    - name: update-manifest
+      runAfter: [clone-gitops]
+      taskRef:
+        name: yq-update
+      workspaces:
+        - name: source
+          workspace: gitops-repo
+      params:
+        - name: file
+          value: $(params.deployment-file)
+        - name: expression
+          value: .spec.template.spec.containers[0].image = "$(params.image-name):$(tasks.get-version.results.version)"
+
+    # 7. Commit and push changes
+    - name: commit-push
+      runAfter: [update-manifest]
+      taskRef:
+        name: git-cli
+      workspaces:
+        - name: source
+          workspace: gitops-repo
+        - name: ssh-directory
+          workspace: git-credentials
+      params:
+        - name: GIT_USER_NAME
+          value: "Tekton Pipeline"
+        - name: GIT_USER_EMAIL
+          value: "tekton@example.com"
+        - name: GIT_SCRIPT
+          value: |
+            git add $(params.deployment-file)
+            git commit -m "Update image to $(params.image-name):$(tasks.get-version.results.version)"
+            git push origin $(params.gitops-branch)
+```
+
+### Update Manifest Task
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: yq-update
+spec:
+  params:
+    - name: file
+      description: YAML file to update
+    - name: expression
+      description: yq expression
+  workspaces:
+    - name: source
+  steps:
+    - name: update
+      image: mikefarah/yq:latest
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/sh
+        yq eval -i '$(params.expression)' $(params.file)
+```
+
+### Git Commit Task
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: git-commit-push
+spec:
+  params:
+    - name: commit-message
+    - name: file-path
+  workspaces:
+    - name: source
+    - name: ssh-directory
+  steps:
+    - name: commit-push
+      image: alpine/git:latest
+      workingDir: $(workspaces.source.path)
+      env:
+        - name: GIT_SSH_COMMAND
+          value: ssh -i $(workspaces.ssh-directory.path)/id_rsa -o StrictHostKeyChecking=no
+      script: |
+        #!/bin/sh
+        set -e
+
+        git config user.name "Tekton Pipeline"
+        git config user.email "tekton@example.com"
+
+        git add $(params.file-path)
+        git commit -m "$(params.commit-message)"
+        git push origin HEAD
+```
+
+## ArgoCD Integration
+
+### ArgoCD Application
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/org/gitops-repo
+    targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: production
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+```
+
+### Trigger ArgoCD Sync from Tekton
+
+```yaml
+# Task to trigger ArgoCD sync
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: argocd-sync
+spec:
+  params:
+    - name: app-name
+      description: ArgoCD application name
+    - name: argocd-server
+      description: ArgoCD server URL
+      default: argocd-server.argocd.svc:443
+  steps:
+    - name: sync
+      image: argoproj/argocd:latest
+      script: |
+        #!/bin/sh
+        argocd app sync $(params.app-name) \
+          --server $(params.argocd-server) \
+          --auth-token $ARGOCD_TOKEN
+      env:
+        - name: ARGOCD_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: argocd-token
+              key: token
+```
+
+## Flux CD Integration
+
+### Flux ImageUpdateAutomation
+
+**Flux automatically updates images:**
+
+```yaml
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImageRepository
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  image: myregistry.com/myapp
+  interval: 1m
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImagePolicy
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: myapp
+  policy:
+    semver:
+      range: 1.x.x
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImageUpdateAutomation
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: gitops-repo
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        email: flux@example.com
+        name: Flux
+      messageTemplate: "Update image to {{range .Updated.Images}}{{println .}}{{end}}"
+    push:
+      branch: main
+  update:
+    path: ./k8s
+    strategy: Setters
+```
+
+### Tekton with Flux
+
+**Simpler Tekton pipeline:**
+```yaml
+# Tekton only builds and pushes
+# Flux automatically detects new image and updates manifests
+spec:
+  tasks:
+    - name: clone
+    - name: test
+    - name: build-push
+  # No manifest update needed - Flux handles it
+```
+
+## Multi-Environment GitOps
+
+### Directory Structure
+
+```
+gitops-repo/
+├── base/
+│   ├── deployment.yaml
+│   ├── service.yaml
+│   └── kustomization.yaml
+├── overlays/
+│   ├── dev/
+│   │   ├── kustomization.yaml
+│   │   └── patches/
+│   ├── staging/
+│   │   ├── kustomization.yaml
+│   │   └── patches/
+│   └── production/
+│       ├── kustomization.yaml
+│       └── patches/
+```
+
+### Kustomize Update Task
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: kustomize-set-image
+spec:
+  params:
+    - name: image
+    - name: overlay
+      default: dev
+  workspaces:
+    - name: source
+  steps:
+    - name: set-image
+      image: k8s.gcr.io/kustomize/kustomize:v5.0.0
+      workingDir: $(workspaces.source.path)/overlays/$(params.overlay)
+      script: |
+        kustomize edit set image app=$(params.image)
+```
+
+### Environment-Specific Pipelines
+
+```yaml
+# Dev pipeline - auto-deploy
+- name: update-dev
+  when:
+    - input: $(params.git-branch)
+      operator: in
+      values: [develop]
+  taskRef:
+    name: update-gitops
+  params:
+    - name: overlay
+      value: dev
+
+# Staging pipeline - auto-deploy
+- name: update-staging
+  when:
+    - input: $(params.git-branch)
+      operator: in
+      values: [main]
+  taskRef:
+    name: update-gitops
+  params:
+    - name: overlay
+      value: staging
+
+# Production - manual approval required
+- name: update-production
+  when:
+    - input: $(params.deploy-to-prod)
+      operator: in
+      values: ["true"]
+  taskRef:
+    name: update-gitops
+  params:
+    - name: overlay
+      value: production
+```
+
+## Git Credentials Management
+
+### SSH Key Secret
+
+```bash
+# Generate SSH key
+ssh-keygen -t ed25519 -C "tekton@example.com" -f tekton_key -N ""
+
+# Create secret
+kubectl create secret generic git-ssh-credentials \
+  --from-file=id_rsa=tekton_key \
+  --from-file=id_rsa.pub=tekton_key.pub \
+  --from-file=known_hosts=~/.ssh/known_hosts
+
+# Add public key to GitHub/GitLab as deploy key with write access
+```
+
+### Using SSH Credentials
+
+```yaml
+workspaces:
+  - name: ssh-directory
+    secret:
+      secretName: git-ssh-credentials
+      items:
+        - key: id_rsa
+          path: id_rsa
+          mode: 0600
+        - key: known_hosts
+          path: known_hosts
+```
+
+## Best Practices
+
+### Repository Structure
+- Separate application and GitOps repositories
+- Use Kustomize or Helm for multi-environment management
+- Version GitOps manifests
+- Protect main branch with pull requests
+
+### CI Pipeline
+- Build and test in Tekton
+- Push images with semantic versioning
+- Update GitOps repo via automation
+- Sign commits for traceability
+
+### CD with ArgoCD/Flux
+- Enable auto-sync for development
+- Require manual approval for production
+- Configure sync windows for production
+- Set up health checks and rollback
+
+### Security
+- Use SSH keys with write-only access to GitOps repo
+- Rotate credentials regularly
+- Scan container images before pushing
+- Use signed commits
+
+### Monitoring
+- Monitor ArgoCD sync status
+- Alert on sync failures
+- Track deployment frequency
+- Measure lead time for changes
+
+## Complete GitOps Example
+
+```yaml
+# PipelineRun with all parameters
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  generateName: gitops-ci-run-
+spec:
+  pipelineRef:
+    name: gitops-ci-pipeline
+  params:
+    - name: git-url
+      value: https://github.com/org/myapp
+    - name: git-revision
+      value: main
+    - name: image-name
+      value: myregistry.com/myapp
+    - name: gitops-repo-url
+      value: git@github.com:org/gitops-repo.git
+    - name: gitops-branch
+      value: main
+    - name: deployment-file
+      value: overlays/production/kustomization.yaml
+  workspaces:
+    - name: source-code
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 1Gi
+    - name: gitops-repo
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 500Mi
+    - name: docker-credentials
+      secret:
+        secretName: docker-config
+    - name: git-credentials
+      secret:
+        secretName: git-ssh-credentials
+  serviceAccountName: gitops-pipeline-sa
+```
+
+## Troubleshooting
+
+### Manifest Update Fails
+
+```bash
+# Check workspace contents
+kubectl exec <pod-name> -- ls /workspace/gitops-repo
+
+# Verify yq/kustomize syntax
+kubectl logs <pod-name> -c step-update
+```
+
+### Git Push Fails
+
+```bash
+# Check SSH credentials
+kubectl get secret git-ssh-credentials -o yaml
+
+# Test SSH connection
+kubectl run test-git --rm -i --tty --image=alpine/git -- sh
+apk add openssh-client
+ssh -T git@github.com
+```
+
+### ArgoCD Not Syncing
+
+```bash
+# Check ArgoCD application
+kubectl get application myapp -n argocd
+
+# View sync status
+argocd app get myapp
+
+# Manual sync
+argocd app sync myapp
+```
+
+### Wrong Image Tag
+
+```bash
+# Check task results
+kubectl get pipelinerun <name> -o jsonpath='{.status.taskRuns}'
+
+# Verify manifest update
+kubectl logs <pod-name> -c step-update
+```

@@ -0,0 +1,621 @@
+# Pipelines Workflow
+
+Creating and managing Tekton Pipelines to orchestrate multiple Tasks into complete CI/CD workflows.
+
+## When to Use
+
+- Orchestrating multiple tasks
+- Defining task dependencies and execution order
+- Creating complete CI/CD workflows
+- Managing data flow between tasks
+- Building complex pipelines
+
+## Pipeline Structure
+
+### Basic Pipeline
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: build-and-deploy
+spec:
+  params:
+    - name: git-url
+      type: string
+    - name: image-name
+      type: string
+  workspaces:
+    - name: shared-data
+  tasks:
+    - name: fetch-source
+      taskRef:
+        name: git-clone
+      workspaces:
+        - name: output
+          workspace: shared-data
+      params:
+        - name: url
+          value: $(params.git-url)
+
+    - name: build-image
+      taskRef:
+        name: kaniko
+      runAfter:
+        - fetch-source
+      workspaces:
+        - name: source
+          workspace: shared-data
+      params:
+        - name: IMAGE
+          value: $(params.image-name)
+```
+
+## Task Execution Control
+
+### Sequential Execution
+
+```yaml
+tasks:
+  - name: test
+    taskRef:
+      name: run-tests
+
+  - name: build
+    taskRef:
+      name: build-image
+    runAfter:
+      - test  # Waits for test to complete
+```
+
+### Parallel Execution
+
+```yaml
+tasks:
+  - name: lint
+    taskRef:
+      name: lint-code
+    # No runAfter - starts immediately
+
+  - name: test
+    taskRef:
+      name: run-tests
+    # No runAfter - starts in parallel with lint
+
+  - name: security-scan
+    taskRef:
+      name: trivy-scan
+    # No runAfter - starts in parallel
+
+  - name: build
+    taskRef:
+      name: build-image
+    runAfter:
+      - lint
+      - test
+      - security-scan  # Waits for all three
+```
+
+### Conditional Execution
+
+```yaml
+tasks:
+  - name: deploy-staging
+    when:
+      - input: "$(params.environment)"
+        operator: in
+        values: ["staging", "production"]
+    taskRef:
+      name: deploy
+
+  - name: deploy-prod
+    when:
+      - input: "$(params.environment)"
+        operator: in
+        values: ["production"]
+      - input: "$(tasks.test.results.status)"
+        operator: in
+        values: ["passed"]
+    runAfter:
+      - deploy-staging
+    taskRef:
+      name: deploy-production
+```
+
+**When Expression Operators:**
+- `in`: Value is in list
+- `notin`: Value is not in list
+
+## Passing Data Between Tasks
+
+### Using Results
+
+```yaml
+tasks:
+  - name: get-version
+    taskRef:
+      name: calculate-version
+    # Task emits result: version
+
+  - name: build-image
+    taskRef:
+      name: kaniko
+    runAfter:
+      - get-version
+    params:
+      - name: IMAGE
+        value: $(params.image-name):$(tasks.get-version.results.version)
+```
+
+### Using Workspaces
+
+```yaml
+workspaces:
+  - name: source-code
+
+tasks:
+  - name: clone
+    taskRef:
+      name: git-clone
+    workspaces:
+      - name: output
+        workspace: source-code
+
+  - name: test
+    taskRef:
+      name: run-tests
+    runAfter:
+      - clone
+    workspaces:
+      - name: source
+        workspace: source-code  # Shares data with clone task
+```
+
+## Finally Tasks
+
+**Finally tasks run after all pipeline tasks complete, regardless of success or failure.**
+
+```yaml
+finally:
+  - name: cleanup-workspace
+    taskRef:
+      name: cleanup
+    workspaces:
+      - name: workspace
+        workspace: shared-data
+
+  - name: send-notification
+    taskRef:
+      name: send-slack-message
+    params:
+      - name: status
+        value: $(tasks.status)  # SUCCESS or FAILURE
+      - name: message
+        value: "Pipeline $(context.pipelineRun.name) completed"
+```
+
+## Complete Pipeline Example
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: nodejs-ci-cd
+spec:
+  params:
+    - name: git-url
+      description: Git repository URL
+    - name: git-revision
+      description: Git revision
+      default: main
+    - name: image-name
+      description: Container image name
+    - name: deploy-namespace
+      description: Kubernetes namespace
+      default: default
+
+  workspaces:
+    - name: source-code
+    - name: docker-credentials
+
+  tasks:
+    # Fetch source code
+    - name: clone
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: git-clone
+          - name: version
+            value: "0.10.0"
+      workspaces:
+        - name: output
+          workspace: source-code
+      params:
+        - name: url
+          value: $(params.git-url)
+        - name: revision
+          value: $(params.git-revision)
+
+    # Parallel: Lint and test
+    - name: lint
+      taskRef:
+        name: npm-lint
+      runAfter:
+        - clone
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    - name: test
+      taskRef:
+        name: npm-test
+      runAfter:
+        - clone
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    # Security scan
+    - name: security-scan
+      taskRef:
+        name: trivy-scan
+      runAfter:
+        - clone
+      workspaces:
+        - name: source
+          workspace: source-code
+
+    # Build and push image
+    - name: build-push
+      taskRef:
+        resolver: hub
+        params:
+          - name: name
+            value: kaniko
+          - name: version
+            value: "0.6.0"
+      runAfter:
+        - lint
+        - test
+        - security-scan
+      workspaces:
+        - name: source
+          workspace: source-code
+        - name: dockerconfig
+          workspace: docker-credentials
+      params:
+        - name: IMAGE
+          value: $(params.image-name):$(tasks.clone.results.commit)
+
+    # Deploy to Kubernetes
+    - name: deploy
+      taskRef:
+        name: kubernetes-deploy
+      runAfter:
+        - build-push
+      params:
+        - name: image
+          value: $(params.image-name):$(tasks.clone.results.commit)
+        - name: namespace
+          value: $(params.deploy-namespace)
+
+  finally:
+    - name: cleanup
+      taskRef:
+        name: cleanup-workspace
+      workspaces:
+        - name: workspace
+          workspace: source-code
+
+    - name: notify
+      taskRef:
+        name: send-notification
+      params:
+        - name: pipeline-status
+          value: $(tasks.status)
+```
+
+## PipelineRun
+
+### Creating PipelineRun
+
+**Using tkn CLI:**
+```bash
+tkn pipeline start nodejs-ci-cd \
+  -p git-url=https://github.com/myorg/myapp \
+  -p git-revision=main \
+  -p image-name=myregistry.com/myapp \
+  -p deploy-namespace=production \
+  -w name=source-code,volumeClaimTemplateFile=pvc-template.yaml \
+  -w name=docker-credentials,secret=docker-config \
+  --serviceaccount=pipeline-sa \
+  --showlog
+```
+
+**Declarative YAML:**
+```yaml
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  generateName: nodejs-ci-cd-run-
+spec:
+  pipelineRef:
+    name: nodejs-ci-cd
+  params:
+    - name: git-url
+      value: https://github.com/myorg/myapp
+    - name: git-revision
+      value: main
+    - name: image-name
+      value: myregistry.com/myapp
+    - name: deploy-namespace
+      value: production
+  workspaces:
+    - name: source-code
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 1Gi
+    - name: docker-credentials
+      secret:
+        secretName: docker-config
+  serviceAccountName: pipeline-sa
+  timeout: 1h
+```
+
+## Advanced Patterns
+
+### Matrix Execution (Beta)
+
+**Run task with multiple parameter combinations:**
+```yaml
+tasks:
+  - name: test-platforms
+    taskRef:
+      name: run-tests
+    matrix:
+      params:
+        - name: platform
+          value:
+            - linux/amd64
+            - linux/arm64
+        - name: version
+          value:
+            - "18"
+            - "20"
+    # Creates 4 TaskRuns: all combinations of platform x version
+```
+
+### Custom Task References
+
+```yaml
+tasks:
+  - name: custom-action
+    taskRef:
+      apiVersion: custom.dev/v1
+      kind: CustomTask
+      name: my-custom-task
+```
+
+### Retries
+
+```yaml
+tasks:
+  - name: flaky-test
+    retries: 3
+    taskRef:
+      name: integration-tests
+```
+
+### Timeouts
+
+```yaml
+# Pipeline-level timeout
+spec:
+  timeouts:
+    pipeline: 2h
+    tasks: 1h
+    finally: 30m
+
+# Task-level timeout
+tasks:
+  - name: long-running
+    timeout: 45m
+    taskRef:
+      name: build-task
+```
+
+### OnError Behavior
+
+```yaml
+tasks:
+  - name: optional-scan
+    onError: continue  # Continue even if this task fails
+    taskRef:
+      name: security-scan
+```
+
+## Common Pipeline Patterns
+
+### Build-Test-Deploy
+
+```yaml
+spec:
+  tasks:
+    - name: fetch-repo
+    - name: run-tests
+      runAfter: [fetch-repo]
+    - name: build-image
+      runAfter: [run-tests]
+    - name: deploy
+      runAfter: [build-image]
+```
+
+### Fan-Out, Fan-In
+
+```yaml
+spec:
+  tasks:
+    - name: clone
+
+    # Fan out (parallel)
+    - name: unit-test
+      runAfter: [clone]
+    - name: integration-test
+      runAfter: [clone]
+    - name: e2e-test
+      runAfter: [clone]
+
+    # Fan in (wait for all)
+    - name: build
+      runAfter: [unit-test, integration-test, e2e-test]
+```
+
+### Multi-Environment Deploy
+
+```yaml
+spec:
+  params:
+    - name: environment
+  tasks:
+    - name: build
+
+    - name: deploy-dev
+      when:
+        - input: $(params.environment)
+          operator: in
+          values: [dev, staging, production]
+      runAfter: [build]
+
+    - name: deploy-staging
+      when:
+        - input: $(params.environment)
+          operator: in
+          values: [staging, production]
+      runAfter: [deploy-dev]
+
+    - name: deploy-production
+      when:
+        - input: $(params.environment)
+          operator: in
+          values: [production]
+      runAfter: [deploy-staging]
+```
+
+## Monitoring and Debugging
+
+### View Pipeline Status
+
+```bash
+# List pipelineruns
+tkn pipelinerun list
+
+# Describe pipelinerun
+tkn pipelinerun describe my-run
+
+# View logs
+tkn pipelinerun logs my-run -f
+
+# Check task status
+kubectl get pipelinerun my-run -o jsonpath='{.status.taskRuns}'
+```
+
+### Pipeline Metrics
+
+```bash
+# Get pipeline duration
+kubectl get pipelinerun my-run -o jsonpath='{.status.startTime}'
+kubectl get pipelinerun my-run -o jsonpath='{.status.completionTime}'
+
+# Get task durations
+kubectl get pipelinerun my-run -o json | \
+  jq '.status.taskRuns[] | {name: .pipelineTaskName, duration: (.status.completionTime - .status.startTime)}'
+```
+
+## Best Practices
+
+### Pipeline Design
+- Keep pipelines focused on single workflow (CI or CD, not both)
+- Use descriptive task names
+- Group related tasks with proper dependencies
+- Use finally tasks for cleanup and notifications
+- Set appropriate timeouts
+
+### Data Flow
+- Use Results for small data (<4KB): commits, versions, flags
+- Use Workspaces for larger data: source code, build artifacts
+- Use PVC with volumeClaimTemplate for isolation
+- Be aware of PVC access mode limitations for parallel tasks
+
+### Error Handling
+- Set retries for flaky network operations
+- Use onError: continue for optional tasks
+- Use finally tasks for cleanup
+- Implement proper logging in tasks
+
+### Performance
+- Run independent tasks in parallel
+- Use caching workspaces (Maven, npm, Go modules)
+- Set resource limits to prevent resource contention
+- Use pipeline pruner to clean old runs
+
+### Security
+- Use dedicated ServiceAccounts
+- Follow least privilege for RBAC
+- Use Secrets for credentials
+- Never hardcode sensitive data in pipelines
+
+## Troubleshooting
+
+### Pipeline Won't Start
+
+```bash
+# Check pipeline exists
+kubectl get pipeline my-pipeline
+
+# Check pipelinerun
+kubectl describe pipelinerun my-run
+
+# Check service account
+kubectl get serviceaccount pipeline-sa
+
+# Check RBAC
+kubectl auth can-i create pipelineruns
+```
+
+### Task Dependencies Not Working
+
+```bash
+# Check runAfter is correct
+kubectl get pipeline my-pipeline -o yaml | grep -A 5 runAfter
+
+# Check when expressions
+kubectl get pipelinerun my-run -o jsonpath='{.status.skippedTasks}'
+```
+
+### Workspace Issues
+
+```bash
+# Check workspace bindings
+kubectl get pipelinerun my-run -o jsonpath='{.spec.workspaces}'
+
+# Check PVC exists
+kubectl get pvc
+
+# Check PVC is bound
+kubectl get pvc my-pvc -o jsonpath='{.status.phase}'
+```
+
+### Finally Tasks Not Running
+
+```bash
+# Check pipeline status
+kubectl get pipelinerun my-run -o jsonpath='{.status.conditions}'
+
+# View finally task status
+kubectl get pipelinerun my-run -o jsonpath='{.status.finallyStatus}'
+```