3.3. Using Pipelines as Code with GitLab

Procedure

1. Configure the webhook and create a Repository custom resource (CR).

   • To configure a webhook and create a Repository CR automatically using the tkn pac CLI tool, use the following command:

     $ tkn pac create repo

     Sample interactive output

     ? Enter the Git repository url (default: https://gitlab.com/owner/repo):
     ? Please enter the namespace where the pipeline should run (default: repo-pipelines):
     ! Namespace repo-pipelines is not found
     ? Would you like me to create the namespace repo-pipelines? Yes
     ✓ Repository repositories-project has been created in repo-pipelines namespace
     ✓ Setting up GitLab Webhook for Repository https://gitlab.com/owner/repo
     ? Please enter the project ID for the repository you want to be configured,
       project ID refers to an unique ID (e.g. 34405323) shown at the top of your GitLab project : 17103
     👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com
     ? Do you want me to use it? Yes
     ? Please enter the secret to configure the webhook for payload validation (default: lFjHIEcaGFlF):  lFjHIEcaGFlF
     ℹ ️You now need to create a GitLab personal access token with `api` scope
     ℹ ️Go to this URL to generate one https://gitlab.com/-/profile/personal_access_tokens, see https://is.gd/rOEo9B for documentation
     ? Please enter the GitLab access token:  **************************
     ? Please enter your GitLab API URL::  https://gitlab.com
     ✓ Webhook has been created on your repository
     🔑 Webhook Secret repositories-project has been created in the repo-pipelines namespace.
     🔑 Repository CR repositories-project has been updated with webhook secret in the repo-pipelines namespace
     ℹ Directory .tekton has been created.
     ✓ A basic template has been created in /home/Go/src/gitlab.com/repositories/project/.tekton/pipelinerun.yaml, feel free to customize it.

   • To configure a webhook and create a Repository CR manually, perform the following steps:

     1. On your OpenShift cluster, extract the public URL of the Pipelines as Code controller.

        $ echo https://$(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')

     2. On your GitLab project, perform the following steps:

        1. Use the left sidebar to go to Settings –> Webhooks.
        2. Set the URL to the Pipelines as Code controller public URL.

        3. Add a webhook secret and note it in an alternate location. With openssl installed on your local machine, generate a random secret.

           $ openssl rand -hex 20

        4. Click Let me select individual events and select these events: Commit comments, Issue comments, Pull request, and Pushes.
        5. Click Save changes.

     3. On your OpenShift cluster, create a Secret object with the personal access token and webhook secret.

        $ oc -n target-namespace create secret generic gitlab-webhook-config \
          --from-literal provider.token="<GITLAB_PERSONAL_ACCESS_TOKEN>" \
          --from-literal webhook.secret="<WEBHOOK_SECRET>"

     4. Create a Repository CR.

        Example: Repository CR

        apiVersion: "pipelinesascode.tekton.dev/v1alpha1"
        kind: Repository
        metadata:
          name: my-repo
          namespace: target-namespace
        spec:
          url: "https://gitlab.com/owner/repo" # The repository URL
          git_provider:
            #url: "https://gitlab.example.com/" 

        1

        
            secret:
              name: "gitlab-webhook-config"
              key: "provider.token" # Set this if you have a different key in your secret
            webhook_secret:
              name: "gitlab-webhook-config"
              key: "webhook.secret" # Set this if you have a different key for your secret

        1

        If you are using a private instance of GitLab and not GitLab.com, uncomment this field and set it to the URL of your GitLab API. The GitLab API is the same host as the repository. For example, if the repository is https://gitlab.example.com/owner/repo, the API URL is https://gitlab.example.com/.

   注記
   • Pipelines as Code assumes that the OpenShift Secret object and the Repository CR are in the same namespace.

2. Optional: For an existing Repository CR, add multiple GitLab Webhook secrets or provide a substitute for a deleted secret.

   1. Add a webhook using the tkn pac CLI tool.

      Example: Adding additional webhook using the tkn pac CLI

      $ tkn pac webhook add -n repo-pipelines

      Sample interactive output

      ✓ Setting up GitLab Webhook for Repository https://gitlab.com/owner/repo
      👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com
      ? Do you want me to use it? Yes
      ? Please enter the secret to configure the webhook for payload validation (default: AeHdHTJVfAeH):  AeHdHTJVfAeH
      ✓ Webhook has been created on repository owner/repo
      🔑 Secret owner-repo has been updated with webhook secert in the repo-pipelines namespace.

   2. Update the webhook.secret key in the existing OpenShift Secret object.

3. Optional: For an existing Repository CR, update the personal access token.

   • Update the personal access token using the tkn pac CLI tool.

     Example: Updating personal access token using the tkn pac CLI

     $ tkn pac webhook update-token -n repo-pipelines

     Sample interactive output

     ? Please enter your personal access token:  ****************************************
     🔑 Secret owner-repo has been updated with new personal access token in the repo-pipelines namespace.

   • Alternatively, update the personal access token by modifying the Repository CR.

     1. Find the name of the secret in the Repository CR.

        ...
        spec:
          git_provider:
            secret:
              name: "gitlab-webhook-config"
        ...

     2. Use the oc patch command to update the values of the $NEW_TOKEN in the $target_namespace namespace.

        $ oc -n $target_namespace patch secret gitlab-webhook-config -p "{\"data\": {\"provider.token\": \"$(echo -n $NEW_TOKEN|base64 -w0)\"}}"