在OpenShift上安装Tekton Triggers EventListener(适用于GitLab)会导致:错误配

Question

我们正在通过Webhooks和Tekton触发器集成GitLab和Tekton/OOpenShift Pipelines。我们遵循了这个示例项目，并制作了我们的EventListener，它与所需的Interceptor、TriggerBinding和TriggerTemplate一起作为gitlab-push-listener.yml:提供

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
name: gitlab-listener
spec:
serviceAccountName: tekton-triggers-example-sa
triggers:
- name: gitlab-push-events-trigger
interceptors:
- name: "verify-gitlab-payload"
ref:
name: "gitlab"
kind: ClusterInterceptor
params:
- name: secretRef
value:
secretName: "gitlab-secret"
secretKey: "secretToken"
- name: eventTypes
value:
- "Push Hook"
bindings:
- name: gitrevision
value: $(body.checkout_sha)
- name: gitrepositoryurl
value: $(body.repository.git_http_url)
template:
spec:
params:
- name: gitrevision
- name: gitrepositoryurl
- name: message
description: The message to print
default: This is the default message
- name: contenttype
description: The Content-Type of the event
resourcetemplates:
- apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
generateName: buildpacks-test-pipeline-run-
#name: buildpacks-test-pipeline-run
spec:
serviceAccountName: buildpacks-service-account-gitlab # Only needed if you set up authorization
pipelineRef:
name: buildpacks-test-pipeline
workspaces:
- name: source-workspace
subPath: source
persistentVolumeClaim:
claimName: buildpacks-source-pvc
- name: cache-workspace
subPath: cache
persistentVolumeClaim:
claimName: buildpacks-source-pvc
params:
- name: IMAGE
value: registry.gitlab.com/jonashackt/microservice-api-spring-boot # This defines the name of output image
- name: SOURCE_URL
value: https://gitlab.com/jonashackt/microservice-api-spring-boot
- name: SOURCE_REVISION
value: main

如示例中所述(以及在Tekton文档中(，我们还创建并kubectl apply了一个名为tekton-triggers-example-sa、RoleBinding和ClusterRoleBinding:的ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
name: tekton-triggers-example-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: triggers-example-eventlistener-binding
subjects:
- kind: ServiceAccount
name: tekton-triggers-example-sa
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: tekton-triggers-eventlistener-roles
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: triggers-example-eventlistener-clusterbinding
subjects:
- kind: ServiceAccount
name: tekton-triggers-example-sa
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: tekton-triggers-eventlistener-clusterroles

现在通过kubectl apply -f gitlab-push-listener.yml安装我们的EventListener，GitLab甚至curl的触发都不会按预期触发PipelineRun。查看el-gitlab-listener部署和Pod的日志，我们看到以下错误：

kubectl logs el-gitlab-listener-69f4c5c8f8-t4zdj
{"level":"info","ts":"2021-11-30T09:38:32.444Z","caller":"logging/config.go:116","msg":"Successfully created the logger."}
{"level":"info","ts":"2021-11-30T09:38:32.444Z","caller":"logging/config.go:117","msg":"Logging level set to: info"}
{"level":"info","ts":"2021-11-30T09:38:32.444Z","caller":"logging/config.go:79","msg":"Fetch GitHub commit ID from kodata failed","error":""KO_DATA_PATH" does not exist or is empty"}
{"level":"info","ts":"2021-11-30T09:38:32.444Z","logger":"eventlistener","caller":"logging/logging.go:46","msg":"Starting the Configuration eventlistener","knative.dev/controller":"eventlistener"}
{"level":"info","ts":"2021-11-30T09:38:32.445Z","logger":"eventlistener","caller":"profiling/server.go:64","msg":"Profiling enabled: false","knative.dev/controller":"eventlistener"}
{"level":"fatal","ts":"2021-11-30T09:38:32.451Z","logger":"eventlistener","caller":"eventlistenersink/main.go:104","msg":"Error reading ConfigMap config-observability-triggers","knative.dev/controller":"eventlistener","error":"configmaps "config-observability-triggers" is forbidden: User "system:serviceaccount:default:tekton-triggers-example-sa" cannot get resource "configmaps" in API group "" in the namespace "default": RBAC: [clusterrole.rbac.authorization.k8s.io "tekton-triggers-eventlistener-clusterroles" not found, clusterrole.rbac.authorization.k8s.io "tekton-triggers-eventlistener-roles" not found]","stacktrace":"main.mainnt/opt/app-root/src/go/src/github.com/tektoncd/triggers/cmd/eventlistenersink/main.go:104nruntime.mainnt/usr/lib/golang/src/runtime/proc.go:203"}

Answer 1

OpenShift Pipelines文档并没有直接记录它。但如果你浏览文档，特别是Triggers部分，你可能会发现没有创建任何ServiceAccount。但每个触发器组件都使用一个触发器。它被称为pipeline。只需运行kubectl get serviceaccount即可查看：

$ kubectl get serviceaccount
NAME                         SECRETS   AGE
default                      2         49d
deployer                     2         49d
pipeline                     2         48d

此pipeline服务帐户已准备好在您的Tekton触发器内使用；EventListeners。所以你的gitlab-push-listener.yml可以直接引用它：

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
name: gitlab-listener
spec:
serviceAccountName: pipeline
triggers:
- name: gitlab-push-events-trigger
interceptors:
...

您只需删除手动创建的ServiceAccounttekton-triggers-example-sa即可在OpenShift Pipelines中不需要它现在，您的Tekton触发器EventListener应该可以工作，并按照定义触发您的Texton管道。