Install Tanzu Build Service

This topic describes how to install Tanzu Build Service from the Tanzu Application Platform (commonly known as TAP) package repository by using the Tanzu CLI.

Before you begin

Use this topic if you do not want to use a Tanzu Application Platform profile that includes Tanzu Build Service. The Full, Iterate, and Build profiles include Tanzu Build Service. For more information about profiles, see Components and installation profiles.

The following procedure might not include some configurations required for your environment. For advanced information about installing Tanzu Build Service, see the Tanzu Build Service documentation.

Prerequisites

Before installing Tanzu Build Service:

• Complete all prerequisites to install Tanzu Application Platform. For more information, see Prerequisites.

• You must have access to a Docker registry that Tanzu Build Service can use to create builder images. Approximately 10 GB of registry space is required when using the full dependencies.

• Your Docker registry must be accessible with user name and password credentials.

Deprecated Features

• The Cloud Native Buildpack Bill of Materials (CNB BOM) format: For more information, see Deactivate the CNB BOM format.

Install the Tanzu Build Service package

To install Tanzu Build Service by using the Tanzu CLI:

1. Get the latest version of the Tanzu Build Service package by running:

   tanzu package available list buildservice.tanzu.vmware.com --namespace tap-install
   

2. Gather the values schema by running:

   tanzu package available get buildservice.tanzu.vmware.com/VERSION --values-schema --namespace tap-install
   

   Where VERSION is the version of the Tanzu Build Service package you retrieved in the previous step.

3. Create the secret for the kp-default-repository credentials using the tanzu cli:

   tanzu secret registry add kp-default-repository-creds \
     --server "${REGISTRY_HOSTNAME}" \
     --username "${REGISTRY_USERNAME}" \
     --password "${REGISTRY_PASSWORD}" \
     --namespace tap-install
   

   Where: - REGISTRY_HOST is the hostname for the registry that will contain your kp_default_repository. Examples: - Harbor has the form server: "my-harbor.io". - Docker Hub has the form server: "index.docker.io". - Google Cloud Registry has the form server: "gcr.io". - REGISTRY_USERNAME and REGISTRY_PASSWORD are the username and password for the user that can write to the repo used in the following step. For Google Cloud Registry, use _json_key as the username and the contents of the service account JSON file for the password.

4. Create a tbs-values.yaml file using the following template. If shared.image_registry.project_path and shared.image_registry.secret are configured in the tap-values.yaml file, Tanzu Build Service inherits all three values in that section. This can be disabled by setting any of the following three values.

   ---
   kp_default_repository: "REPO-NAME"
   kp_default_repository_secret:
     name: kp-default-repository-creds
     namespace: tap-install
   

   Where:

   REPO-NAME is a writable repository in your registry. Tanzu Build Service dependencies are written to this location. Examples:

   • Harbor has the form "my-harbor.io/my-project/build-service".
   • Docker Hub has the form "my-dockerhub-user/build-service" or "index.docker.io/my-user/build-service".
   • Google Cloud Registry has the form "gcr.io/my-project/build-service".

5. If you are running on Openshift, add kubernetes_distribution: openshift to your tbs-values.yaml file.

6. (Optional) Under the ca_cert_data key in the tbs-values.yaml file, provide a PEM-encoded CA certificate for Tanzu Build Service. This certificate is used for accessing the container image registry and is also provided to the build process.

   Note

   If shared.ca_cert_data is configured in the tap-values.yaml file, Tanzu Build Service inherits that value.

   Configuring ca_cert_data key in the tbs-values.yaml file adds the CA certificates at build time. To add CA certificates to the built image, see Configure custom CA certificates for a single workload using service bindings.

   For example:

   ---
   kp_default_repository: "REPO-NAME"
   kp_default_repository_secret:
     name: kp-default-repository-creds
     namespace: tap-install
   ca_cert_data: |
     -----BEGIN CERTIFICATE-----
     ...
     -----END CERTIFICATE-----
   

7. (Optional) Tanzu Build Service is bootstrapped with the lite set of dependencies. To configure full dependencies, add the key-value pair exclude_dependencies: true to your tbs-values.yaml file. This is to exclude the default lite dependencies from the installation. For example:

   ---
   kp_default_repository: "REPO-NAME"
   kp_default_repository_secret:
     name: kp-default-repository-creds
     namespace: tap-install
   exclude_dependencies: true
   

   For more information about the differences between full and lite dependencies, see About lite and full dependencies.

8. Install the Tanzu Build Service package by running:

   tanzu package install tbs -p buildservice.tanzu.vmware.com -v VERSION -n tap-install -f tbs-values.yaml
   

   Where VERSION is the version of the Tanzu Build Service package you retrieved earlier.

   For example:

   $ tanzu package install tbs -p buildservice.tanzu.vmware.com -v VERSION -n tap-install -f tbs-values.yaml
   
   | Installing package 'buildservice.tanzu.vmware.com'
   | Getting namespace 'tap-install'
   | Getting package metadata for 'buildservice.tanzu.vmware.com'
   | Creating service account 'tbs-tap-install-sa'
   | Creating cluster admin role 'tbs-tap-install-cluster-role'
   | Creating cluster role binding 'tbs-tap-install-cluster-rolebinding'
   | Creating secret 'tbs-tap-install-values'
   - Creating package resource
   - Package install status: Reconciling
   
    Added installed package 'tbs' in namespace 'tap-install'
   

9. (Optional) Verify the cluster builders that the Tanzu Build Service installation created by running:

   tanzu package installed get tbs -n tap-install
   

10. If you configured full dependencies in your tbs-values.yaml file, install the full dependencies by following the procedure in Install full dependencies.

Use AWS IAM authentication for registry credentials

Tanzu Build Service supports using AWS IAM roles to authenticate with Amazon Elastic Container Registry (ECR) on Amazon Elastic Kubernetes Service (EKS) clusters.

To use AWS IAM authentication:

1. Configure an AWS IAM role that has read and write access to the repository in the container image registry used when installing Tanzu Application Platform.

2. Use the following alternative configuration for tbs-values.yaml:

   Note

   if you are installing Tanzu Build Service as part of a Tanzu Application Platform profile, you configure this in your tap-values.yaml file under the buildservice section.

   ---
     kp_default_repository: "REPO-NAME"
     kp_default_repository_aws_iam_role_arn: "IAM-ROLE-ARN"
   

   Where:

   • REPO-NAME is a writable repository in your registry. Tanzu Build Service dependencies are written to this location.
   • IAM-ROLE-ARN is the AWS IAM role Amazon Resource Name (ARN) for the role configured in the previous step. For example, arn:aws:iam::xyz:role/my-install-role.

3. The developer namespace requires configuration for Tanzu Application Platform to use AWS IAM authentication for ECR. Configure an AWS IAM role that has read and write access to the registry for storing workload images.

4. Using the supply chain service account, add an annotation including the role ARN configured earlier by running:

   kubectl annotate serviceaccount -n DEVELOPER-NAMESPACE SERVICE-ACCOUNT-NAME \
     eks.amazonaws.com/role-arn=IAM-ROLE-ARN
   

   Where:

   • DEVELOPER-NAMESPACE is the namespace where workloads are created.
   • SERVICE-ACCOUNT-NAME is the supply chain service account. This is default if unset.
   • IAM-ROLE-ARN is the AWS IAM role ARN for the role configured earlier. For example, arn:aws:iam::xyz:role/my-developer-role.

5. Apply this configuration by continuing the steps in Install the Tanzu Build Service package.

Install full dependencies

If you configured full dependencies in your tbs-values.yaml file, you must install the full dependencies package.

For a more information about lite and full dependencies, see About lite and full dependencies.

To install full Tanzu Build Service dependencies:

1. If you have not done so already, add the key-value pair exclude_dependencies: true to your tbs-values.yaml file. For example:

   Note

   if you are installing Tanzu Build Service as part of a Tanzu Application Platform profile, you configure this in your tap-values.yaml file under the buildservice section.

   ---
     kp_default_repository: "REPO-NAME"
     kp_default_repository_secret:
       name: kp-default-repository-creds
       namespace: tap-install
     exclude_dependencies: true
   

2. Get the latest version of the Tanzu Build Service package by running:

   tanzu package available list buildservice.tanzu.vmware.com --namespace tap-install
   

3. Relocate the Tanzu Build Service full dependencies package repository by running:

   imgpkg copy -b registry.tanzu.vmware.com/tanzu-application-platform/full-tbs-deps-package-repo:VERSION \
   --to-repo INSTALL-REGISTRY-HOSTNAME/TARGET-REPOSITORY/tbs-full-deps
   

   Where:

   • VERSION is the version of the Tanzu Build Service package you retrieved in the previous step.
   • INSTALL-REGISTRY-HOSTNAME is your container image registry.
   • TARGET-REPOSITORY is your target repository.

4. Add the Tanzu Build Service full dependencies package repository by running:

   tanzu package repository add tbs-full-deps-repository \
     --url INSTALL-REGISTRY-HOSTNAME/TARGET-REPOSITORY/tbs-full-deps:VERSION \
     --namespace tap-install
   

   Where:

   • VERSION is the version of the Tanzu Build Service package you retrieved earlier.
   • INSTALL-REGISTRY-HOSTNAME is your container image registry.
   • TARGET-REPOSITORY is your target repository.

5. Install the full dependencies package by running:

   tanzu package install full-tbs-deps -p full-tbs-deps.tanzu.vmware.com -v VERSION -n tap-install
   

   Where VERSION is the version of the Tanzu Build Service package you retrieved earlier.

(Optional) Deactivate the CNB BOM format

The legacy CNB BOM format is deprecated, but is enabled by default in Tanzu Application Platform.

To manually deactivate the format, add include_legacy_bom=false to either the tbs-values.yaml file, or to the tap-values.yaml file under the buildservice section.