---
title: "CI/CD Pipelines on OpenShift"
canonical: "https://kb.uconn.edu/space/IKB/28730687510/CI%2FCD%20Pipelines%20on%20OpenShift"
format: markdown
---
Continuous Integration and Continuous Deployment (CI/CD) automates building, testing, and deploying your application every time you push code. This guide covers the CI/CD options available on UConn's OpenShift platform.

> ![app-lifecycle-cicd-20260506-020459.png](media://9f799037-a0f4-49b1-834f-0da68261d5ec)

---

## CI/CD Options on OpenShift

| Approach | Best For | Complexity |
| --- | --- | --- |
| **OpenShift BuildConfigs + Webhooks** | Simple auto-deploy on push | Low |
| **Tekton Pipelines** | Multi-step pipelines (build, test, scan, deploy) | Medium |
| **External CI (Bitbucket Pipelines, GitHub Actions, Jenkins)** | Teams already using external CI tools | Varies |

---

## Option 1: BuildConfig with Webhooks (Simplest)

If you deployed via S2I or "Import from Git," OpenShift already created a BuildConfig. You just need to add a webhook to trigger builds on every push.

### Get the Webhook URL

```shell
# List build configs
oc get buildconfig

# Get the webhook URL (generic)
oc describe buildconfig/my-app | grep -A1 "Generic"
```

Or from the web console: **Builds → BuildConfigs → my-app → Copy webhook URL** (choose Generic).

### Add the Webhook to Bitbucket

1. In your Bitbucket repository, go to **Repository Settings → Webhooks**.
2. Click **Add webhook**.
3. Paste the Generic webhook URL from OpenShift.
4. Select **Repository push** as the trigger.
5. Save.

Now every `git push` will automatically trigger a new build and deployment.

### Manually Trigger a Build

```shell
# Start a new build
oc start-build my-app

# Start a build from local source
oc start-build my-app --from-dir=.

# Watch build logs
oc logs -f buildconfig/my-app
```

---

## Option 2: Tekton Pipelines (Advanced)

Tekton is a Kubernetes-native CI/CD framework built into OpenShift. It lets you define multi-step pipelines as YAML.

### Key Concepts

| Concept | Description |
| --- | --- |
| **Task** | A single unit of work (e.g., build, test, deploy) |
| **Pipeline** | An ordered sequence of Tasks |
| **PipelineRun** | A single execution of a Pipeline |
| **Workspace** | Shared storage between tasks (e.g., source code) |
| **Trigger** | Automatically starts a PipelineRun on events (e.g., git push) |

### Example: Build-Test-Deploy Pipeline

```yaml
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: build-test-deploy
spec:
  workspaces:
  - name: shared-workspace
  params:
  - name: git-url
    type: string
  - name: git-revision
    type: string
    default: main
  tasks:
  # Step 1: Clone the repo
  - name: fetch-source
    taskRef:
      name: git-clone
      kind: ClusterTask
    workspaces:
    - name: output
      workspace: shared-workspace
    params:
    - name: url
      value: $(params.git-url)
    - name: revision
      value: $(params.git-revision)

  # Step 2: Run tests
  - name: run-tests
    taskRef:
      name: run-tests
    runAfter:
    - fetch-source
    workspaces:
    - name: source
      workspace: shared-workspace

  # Step 3: Build and push image
  - name: build-image
    taskRef:
      name: buildah
      kind: ClusterTask
    runAfter:
    - run-tests
    workspaces:
    - name: source
      workspace: shared-workspace
    params:
    - name: IMAGE
      value: image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/my-app:latest

  # Step 4: Deploy
  - name: deploy
    taskRef:
      name: openshift-client
      kind: ClusterTask
    runAfter:
    - build-image
    params:
    - name: SCRIPT
      value: |
        oc set image deployment/my-app my-app=image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/my-app:latest
        oc rollout status deployment/my-app
```

### Apply and Run the Pipeline

```shell
# Apply the pipeline
oc apply -f pipeline.yaml

# Start a pipeline run
tkn pipeline start build-test-deploy \
  --workspace name=shared-workspace,claimName=pipeline-pvc \
  --param git-url=https://bitbucket.org/your-org/your-app.git

# List pipeline runs
tkn pipelinerun list

# View logs of the latest run
tkn pipelinerun logs -f --last
```

### Using the Web Console

1. Go to **Pipelines** in the Developer perspective.
2. Click your pipeline to see the visual graph.
3. Click **Start** to trigger a run manually.
4. Click any task to view logs in real time.

---

## Option 3: External CI (Bitbucket Pipelines, GitHub Actions)

If your team already uses an external CI system, you can have it deploy to OpenShift as the final step.

### Bitbucket Pipelines Example

Add to `bitbucket-pipelines.yml`:

```yaml
pipelines:
  branches:
    main:
      - step:
          name: Deploy to OpenShift
          image: quay.io/openshift/origin-cli:latest
          script:
            - oc login --token=$OC_TOKEN --server=$OC_SERVER
            - oc project my-namespace
            - oc start-build my-app --from-dir=. --follow
```

Set `OC_TOKEN` and `OC_SERVER` as repository variables in Bitbucket Settings.

### GitHub Actions Example

```yaml
- name: Deploy to OpenShift
  uses: redhat-actions/oc-login@v1
  with:
    openshift_server_url: ${{ secrets.OC_SERVER }}
    openshift_token: ${{ secrets.OC_TOKEN }}

- name: Trigger Build
  run: |
    oc project my-namespace
    oc start-build my-app --follow
```

---

## Getting a Service Account Token for CI

For external CI tools, create a service account with limited permissions:

```shell
# Create a service account
oc create serviceaccount ci-bot

# Grant edit role (can build and deploy, but not admin)
oc policy add-role-to-user edit -z ci-bot

# Get the token
oc create token ci-bot --duration=8760h
```

> **Security Tip:** Store this token as a secret/encrypted variable in your CI system. Never commit it to your repository.

---

## Deployment Strategies

OpenShift supports multiple deployment strategies:

| Strategy | Behavior | Use When |
| --- | --- | --- |
| **Rolling** (default) | Gradually replaces old pods with new ones | Most applications — zero downtime |
| **Recreate** | Stops all old pods, then starts new ones | Database migrations or apps that can't run two versions |
| **Blue-Green** | Run both versions, switch traffic at once | Need instant rollback capability |
| **Canary** | Route small % of traffic to new version | Testing in production with limited blast radius |

```shell
# Set rolling strategy (default)
oc patch deployment/my-app -p '{"spec":{"strategy":{"type":"RollingUpdate"}}}'

# Set recreate strategy
oc patch deployment/my-app -p '{"spec":{"strategy":{"type":"Recreate"}}}'

# Roll back if something goes wrong
oc rollout undo deployment/my-app
```

---

## Quick Reference

```shell
# Webhook-based (simple)
oc describe buildconfig/my-app       # Get webhook URL
oc start-build my-app                # Manual trigger
oc logs -f buildconfig/my-app        # Watch build

# Tekton
tkn pipeline list                    # List pipelines
tkn pipeline start <name>            # Start a run
tkn pipelinerun logs -f --last       # View logs

# Rollouts
oc rollout status deployment/my-app  # Check deploy progress
oc rollout undo deployment/my-app    # Roll back
oc rollout history deployment/my-app # View history
```

---

*UConn ITS Infrastructure Services — OpenShift Knowledge Base*