Introducing tekton-dag — stack-aware Tekton CI for local and multi-team PoCs

Most local Kubernetes CI demos stop at “build one service.” Real stacks are graphs: shared libraries, polyglot apps, intercept routing for pull requests, and teams that need isolation without forking the platform.

tekton-dag is a standalone Tekton pipeline system for local development and proof-of-concept work. It models your apps as a DAG, runs stack-aware Bootstrap / PR / Merge pipelines, and can route PR traffic through Telepresence or mirrord while the rest of the stack stays on normal paths.

Three pipelines, one stack: bootstrap once, test on PRs, release on merge.

What it is

Pipeline	Purpose
Bootstrap	Deploy the full stack once — prerequisite for PR runs
PR (stack-pr-test)	Build the changed app with a snapshot tag, deploy intercepts, validate, test, comment on the PR — no version bump
Merge (stack-merge-release)	Promote RC → release, tag images, push the next dev-cycle version

Around those pipelines sits an in-cluster orchestration service (webhooks → stack resolution → PipelineRuns), Helm packaging for multi-team namespaces, baggage middleware across Spring / Node / Flask / PHP, and a testing ecosystem (Newman, Playwright, Artillery) with optional Neo4j-backed blast-radius selection.

PR traffic can follow intercept headers; everyone else keeps the default path.

# Kind + Tekton + stack tasks (local)
./scripts/kind-with-registry.sh
./scripts/install-tekton.sh
./scripts/publish-build-images.sh
kubectl apply -f tasks/ -f pipeline/

What we shipped recently

1. Dual intercept backends (M7)

PR flows can use Telepresence (default) or mirrord, selected with the pipeline param intercept-backend. Both paths are E2E-verified, so teams can pick the tool that fits their local debugging story without changing the DAG model.

2. Multi-team orchestration + Helm (M10)

An in-cluster Flask orchestrator receives GitHub webhooks, maps repos to stacks, and creates PipelineRuns. Helm charts plus ArgoCD ApplicationSet patterns cover team isolation, namespace scoping, and batched builds — so “one Kind cluster” can still look like several teams.

Management GUI: team switcher, DAG view, runs, triggers, and tests.

3. Management GUI (M11)

Vue 3 + Flask replaces the older reporting UI: multi-team / multi-cluster views, DAG visualization, runs and triggers, test status, and a Git browser. Covered by a solid pytest + Playwright suite so GUI changes stay reviewable.

4. Architecture customization (M12)

Shared Python packaging, Helm ConfigMap/PVC templates, parameterized pipelines (no hardcoded localhost), build-image variants (Java / Node / Python / PHP ranges), and custom pre/post hook tasks. Stack JSON schema + onboarding docs make “add a team” a configuration problem instead of a fork.

5. Narrated demos on GitHub Pages (M8 / docgen)

Eighteen Manim + TTS segments walk architecture, quick start, bootstrap dataflow, PR flow, intercept routing, local debug, merge/release, orchestrator API, Helm, baggage, testing, the test-trace graph, Results DB, customization, regression, the GUI, and what’s next. Watch them at jmjava.github.io/tekton-dag.

What’s next

Milestone 13 — production hardening is planned: retries on transient build/deploy failures, precise build-image sizing, multi-cluster promotion, timeouts and cleanup, Prometheus-oriented observability, secrets injection (ESO / Sealed Secrets), and per-app config per environment.

Try it

1. Clone jmjava/tekton-dag
2. Follow the README quick start (Kind + Tekton + publish build images)
3. Bootstrap a stack, then run a PR pipeline against a changed app
4. Skim the demo videos if you want the architecture before you touch YAML

If you need stack-aware Tekton locally — with real intercept behavior and a path toward multi-team Helm — start with bootstrap, then let a PR run prove the DAG.

— John · github.com/jmjava/tekton-dag