<p>We're working on the integration of GitLab and Tekton / OpenShift Pipelines via Webhooks and Tekton Triggers. We followed <a href="https://github.com/tektoncd/triggers/tree/main/examples/v1beta1/gitlab" rel="nofollow noreferrer">this example project</a> and crafted our <code>EventListener</code> that ships with the needed <code>Interceptor</code>, <code>TriggerBinding</code> and <code>TriggerTemplate</code> as <code>gitlab-push-listener.yml</code>:</p>
<pre><code>apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: gitlab-listener
spec:
  serviceAccountName: tekton-triggers-example-sa
  triggers:
    - name: gitlab-push-events-trigger
      interceptors:
        - name: &quot;verify-gitlab-payload&quot;
          ref:
            name: &quot;gitlab&quot;
            kind: ClusterInterceptor
          params:
            - name: secretRef
              value:
                secretName: &quot;gitlab-secret&quot;
                secretKey: &quot;secretToken&quot;
            - name: eventTypes
              value:
                - &quot;Push Hook&quot;
      bindings:
        - name: gitrevision
          value: $(body.checkout_sha)
        - name: gitrepositoryurl
          value: $(body.repository.git_http_url)
      template:
        spec:
          params:
            - name: gitrevision
            - name: gitrepositoryurl
            - name: message
              description: The message to print
              default: This is the default message
            - name: contenttype
              description: The Content-Type of the event
          resourcetemplates:
            - apiVersion: tekton.dev/v1beta1
              kind: PipelineRun
              metadata:
                generateName: buildpacks-test-pipeline-run-
                #name: buildpacks-test-pipeline-run
              spec:
                serviceAccountName: buildpacks-service-account-gitlab # Only needed if you set up authorization
                pipelineRef:
                  name: buildpacks-test-pipeline
                workspaces:
                  - name: source-workspace
                    subPath: source
                    persistentVolumeClaim:
                      claimName: buildpacks-source-pvc
                  - name: cache-workspace
                    subPath: cache
                    persistentVolumeClaim:
                      claimName: buildpacks-source-pvc
                params:
                  - name: IMAGE
                    value: registry.gitlab.com/jonashackt/microservice-api-spring-boot # This defines the name of output image
                  - name: SOURCE_URL
                    value: https://gitlab.com/jonashackt/microservice-api-spring-boot
                  - name: SOURCE_REVISION
                    value: main
</code></pre>
<p>As <a href="https://github.com/tektoncd/triggers/blob/main/examples/v1beta1/gitlab/rbac.yaml" rel="nofollow noreferrer">stated in the example</a> (and <a href="https://github.com/tektoncd/triggers/blob/main/docs/getting-started/README.md" rel="nofollow noreferrer">in the Tekton docs</a>) we also created and <code>kubectl apply</code>ed a <code>ServiceAccount</code> named <code>tekton-triggers-example-sa</code>, <code>RoleBinding</code> and <code>ClusterRoleBinding</code>:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-triggers-example-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: triggers-example-eventlistener-binding
subjects:
  - kind: ServiceAccount
    name: tekton-triggers-example-sa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-roles
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: triggers-example-eventlistener-clusterbinding
subjects:
  - kind: ServiceAccount
    name: tekton-triggers-example-sa
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-clusterroles
</code></pre>
<p>Now installing our EventListener via <code>kubectl apply -f gitlab-push-listener.yml</code>, no Triggering from GitLab or even a <code>curl</code> is triggering a PipelineRun as intended. Looking into the logs of the <code>el-gitlab-listener</code> Deployment and Pod, we see the following error:</p>
<pre><code>kubectl logs el-gitlab-listener-69f4c5c8f8-t4zdj
{&quot;level&quot;:&quot;info&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.444Z&quot;,&quot;caller&quot;:&quot;logging/config.go:116&quot;,&quot;msg&quot;:&quot;Successfully created the logger.&quot;}
{&quot;level&quot;:&quot;info&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.444Z&quot;,&quot;caller&quot;:&quot;logging/config.go:117&quot;,&quot;msg&quot;:&quot;Logging level set to: info&quot;}
{&quot;level&quot;:&quot;info&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.444Z&quot;,&quot;caller&quot;:&quot;logging/config.go:79&quot;,&quot;msg&quot;:&quot;Fetch GitHub commit ID from kodata failed&quot;,&quot;error&quot;:&quot;\&quot;KO_DATA_PATH\&quot; does not exist or is empty&quot;}
{&quot;level&quot;:&quot;info&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.444Z&quot;,&quot;logger&quot;:&quot;eventlistener&quot;,&quot;caller&quot;:&quot;logging/logging.go:46&quot;,&quot;msg&quot;:&quot;Starting the Configuration eventlistener&quot;,&quot;knative.dev/controller&quot;:&quot;eventlistener&quot;}
{&quot;level&quot;:&quot;info&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.445Z&quot;,&quot;logger&quot;:&quot;eventlistener&quot;,&quot;caller&quot;:&quot;profiling/server.go:64&quot;,&quot;msg&quot;:&quot;Profiling enabled: false&quot;,&quot;knative.dev/controller&quot;:&quot;eventlistener&quot;}
{&quot;level&quot;:&quot;fatal&quot;,&quot;ts&quot;:&quot;2021-11-30T09:38:32.451Z&quot;,&quot;logger&quot;:&quot;eventlistener&quot;,&quot;caller&quot;:&quot;eventlistenersink/main.go:104&quot;,&quot;msg&quot;:&quot;Error reading ConfigMap config-observability-triggers&quot;,&quot;knative.dev/controller&quot;:&quot;eventlistener&quot;,&quot;error&quot;:&quot;configmaps \&quot;config-observability-triggers\&quot; is forbidden: User \&quot;system:serviceaccount:default:tekton-triggers-example-sa\&quot; cannot get resource \&quot;configmaps\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;: RBAC: [clusterrole.rbac.authorization.k8s.io \&quot;tekton-triggers-eventlistener-clusterroles\&quot; not found, clusterrole.rbac.authorization.k8s.io \&quot;tekton-triggers-eventlistener-roles\&quot; not found]&quot;,&quot;stacktrace&quot;:&quot;main.main\n\t/opt/app-root/src/go/src/github.com/tektoncd/triggers/cmd/eventlistenersink/main.go:104\nruntime.main\n\t/usr/lib/golang/src/runtime/proc.go:203&quot;}
</code></pre>

jonashackt
<p>The OpenShift Pipelines documentation does not directly document it. But if you skim <a href="https://docs.openshift.com/container-platform/4.8/cicd/pipelines/understanding-openshift-pipelines.html#about-triggers_understanding-openshift-pipelines" rel="nofollow noreferrer">the docs especially in the <code>Triggers</code> section</a>, you might recognize that there is no <code>ServiceAccount</code> created whatsoever. But one is used by every Trigger component. It's called <code>pipeline</code>. Simply run <code>kubectl get serviceaccount</code> to see it:</p>
<pre><code>$ kubectl get serviceaccount
NAME                         SECRETS   AGE
default                      2         49d
deployer                     2         49d
pipeline                     2         48d
</code></pre>
<p>This <code>pipeline</code> ServiceAccount is ready to use inside your Tekton Triggers &amp; EventListeners. So your <code>gitlab-push-listener.yml</code> can directly reference it:</p>
<pre><code>apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: gitlab-listener
spec:
  serviceAccountName: pipeline
  triggers:
    - name: gitlab-push-events-trigger
      interceptors:
      ...
</code></pre>
<p>You can simply delete your manually created ServiceAccount <code>tekton-triggers-example-sa</code>. <strong>It's not needed in OpenShift Pipelines!</strong> Now your Tekton Triggers EventListener should work and trigger your Tekton Pipelines as defined.</p>
