Quantcast
Channel: Active questions tagged tekton - Stack Overflow
Viewing all articles
Browse latest Browse all 54

User "system:serviceaccount:fetebird-common:gcp-service-account" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" i

$
0
0

I have the below event listener, which holds the service account as gcp-service-account

apiVersion: triggers.tekton.dev/v1beta1kind: EventListenermetadata:  name: bitbucket-listener  namespace: fetebird-commonspec:  serviceAccountName: gcp-service-account  triggers:    - name: bitbucket-triggers      interceptors:        - ref:            name: "bitbucket"          params:            - name: secretRef              value:                secretName: git-ssh-key-secret                secretKey: ssh-privatekey            - name: eventTypes              value:                - repo:refs_changed      bindings:        - ref: bitbucket-trigger-binding      template:        ref: bitbucket-trigger-template

To allow access to the GCP kubernetes I have created the below RBAC

apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  namespace: fetebird-common  name: bitbucket-rolerules:  # Permissions for every EventListener deployment to function  - apiGroups: ["triggers.tekton.dev"]    resources: ["eventlisteners", "triggerbindings", "triggertemplates"]    verbs: ["*"]  - apiGroups: [""]    # secrets are only needed for Github/Gitlab interceptors, serviceaccounts only for per trigger authorization    resources: ["configmaps", "secrets", "serviceaccounts"]    verbs: ["*"]  # Permissions to create resources in associated TriggerTemplates  - apiGroups: ["tekton.dev"]    resources: ["pipelineruns", "pipelineresources", "taskruns"]    verbs: ["*"]

Role binding

apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  name: bitbucket-role-binding  namespace: fetebird-commonsubjects:  - kind: ServiceAccount    name: gcp-service-account # "name" is case sensitive    namespace: fetebird-commonroleRef:  kind: Role #this must be Role or ClusterRole  name: bitbucket-role  apiGroup: rbac.authorization.k8s.io

When I push something to the bitcket facing the below exception

W1001 10:00:17.426414       1 reflector.go:424] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:169: failed to list *v1alpha1.Interceptor: interceptors.triggers.tekton.dev is forbidden: User "system:serviceaccount:fetebird-common:gcp-service-account" cannot list resource "interceptors" in API group "triggers.tekton.dev" in the namespace "fetebird-common"E1001 10:00:17.426766       1 reflector.go:140] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:169: Failed to watch *v1alpha1.Interceptor: failed to list *v1alpha1.Interceptor: interceptors.triggers.tekton.dev is forbidden: User "system:serviceaccount:fetebird-common:gcp-service-account" cannot list resource "interceptors" in API group "triggers.tekton.dev" in the namespace "fetebird-common"W1001 10:00:17.480233       1 reflector.go:424] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:169: failed to list *v1beta1.EventListener: eventlisteners.triggers.tekton.dev is forbidden: User "system:serviceaccount:fetebird-common:gcp-service-account" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" in the namespace "fetebird-common"E1001 10:00:17.480559       1 reflector.go:140] k8s.io/client-go@v0.27.1/tools/cache/reflector.go:169: Failed to watch *v1beta1.EventListener: failed to list *v1beta1.EventListener: eventlisteners.triggers.tekton.dev is forbidden: User "system:serviceaccount:fetebird-common:gcp-service-account" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" in the namespace "fetebird-common"

[![enter image description here][1]][1]

This gcp-service-account is the service account from GOOGLE CLOUD


Viewing all articles
Browse latest Browse all 54

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>