Use Listers to fetch data in the Sink #821

yaoxiaoqi · 2020-11-02T16:25:35Z

Changes

This PR uses Listers to fetch data from EventListeners, Triggers, TriggerBindings, TriggerTemplates, and
ClusterTriggerBindings, rather than directly making calls to the API server. Currently, multiple informers need to be
specified when creating a Sink object.
All Triggers in examples/ work under this change.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

Includes tests (if functionality changed/added)
Includes docs (if user facing)
Commit messages follow commit message best practices
Release notes block has been filled in or deleted (only if no user facing changes)

See the contribution guide for more details.

Release Notes

Use Listers to fetch data in the Sink.

EventListener ServiceAccounts now need to have "list" and "watch" verbs in addition to "get" for all triggers resources. See examples at https://github.com/tektoncd/triggers/blob/master/examples/role-resources/triggerbinding-roles/role.yaml and https://github.com/tektoncd/triggers/blob/master/examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml

dibyom · 2020-11-02T21:05:42Z

This is great! Thank you!

For the build tests, it looks like the issue is:

cmd/triggerrun/cmd/root.go:215:63: Error return value of `(github.com/tektoncd/triggers/pkg/client/clientset/versioned/typed/triggers/v1alpha1.TriggerBindingInterface).List` is not checked (errcheck)
	client.TriggersV1alpha1().TriggerBindings(tri.Namespace).List(context.Background(), metav1.ListOptions{})

So, we should handle the error value instead of ignoring it.

For the integration test failure, looks like the issue has something to do with the serviceAccountName permissions:

        E1102 17:03:24.710120       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.ClusterTriggerBinding: clustertriggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "clustertriggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:24.711159       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerBinding: triggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:24.711196       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.Trigger: triggers.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggers" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:24.711256       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerTemplate: triggertemplates.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggertemplates" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:24.711529       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.EventListener: eventlisteners.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:25.855718       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerTemplate: triggertemplates.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggertemplates" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:25.865745       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.Trigger: triggers.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggers" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:26.046225       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerBinding: triggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:26.066630       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.EventListener: eventlisteners.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:26.264850       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.ClusterTriggerBinding: clustertriggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "clustertriggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:27.569723       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerTemplate: triggertemplates.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggertemplates" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:27.720523       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.Trigger: triggers.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggers" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:27.803859       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.TriggerBinding: triggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:28.150695       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.EventListener: eventlisteners.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "eventlisteners" in API group "triggers.tekton.dev" at the cluster scope
        E1102 17:03:28.692199       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.ClusterTriggerBinding: clustertriggerbindings.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "clustertriggerbindings" in API group "triggers.tekton.dev" at the cluster scope
        {"level":"error","ts":"2020-11-02T17:03:31.391Z","logger":"eventlistener","caller":"sink/sink.go:80","msg":"Error getting EventListener my-eventlistener in Namespace arrakis-mlqsq: eventlistener.triggers.tekton.dev \"my-eventlistener\" not found","knative.dev/controller":"eventlistener","stacktrace":"github.com/tektoncd/triggers/pkg/sink.Sink.HandleEvent\n\tgithub.com/tektoncd/triggers/pkg/sink/sink.go:80\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2012\nnet/http.(*ServeMux).ServeHTTP\n\tnet/http/server.go:2387\nnet/http.serverHandler.ServeHTTP\n\tnet/http/server.go:2807\nnet/http.(*conn).serve\n\tnet/http/server.go:1895"}
        E1102 17:03:31.608643       1 reflector.go:178] k8s.io/[email protected]+incompatible/tools/cache/reflector.go:125: Failed to list *v1alpha1.Trigger: triggers.triggers.tekton.dev is forbidden: User "system:serviceaccount:arrakis-mlqsq:my-serviceaccount" cannot list resource "triggers" in API group "triggers.tekton.dev" at the cluster scope

The e2e test creates its own ServiceAccount and Roles and uses that in the EventListener that the test creates. Currently, that role only has access to "get" triggers, bindings etc. With this change, it also needs access to "list" these resources: https://github.com/tektoncd/triggers/blob/master/test/eventlistener_test.go#L244

examples/bitbucket/role.yaml

cmd/triggerrun/cmd/root.go

yaoxiaoqi · 2020-11-05T14:56:10Z

/test pull-tekton-triggers-integration-tests

yaoxiaoqi · 2020-11-05T15:10:20Z

/hold cancel

dibyom

Looking good. Just a couple of minor comments.
/lgtm

examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml

dibyom · 2020-11-05T17:05:59Z

test/eventlistener_scale_test.go

@@ -138,4 +138,35 @@ func createServiceAccount(t *testing.T, c *clients, namespace, name string) {
 		t.Fatalf("Error creating RoleBinding: %s", err)
 	}

+	_, err = c.KubeClient.RbacV1().ClusterRoles().Create(context.Background(),
+		&rbacv1.ClusterRole{


Since we are creating cluster-scoped resources, we should also delete them in a cleanup function. (By default we delete the namespace which deletes all the namespaced resources but not the cluster ones).

(e.g. we have a cleanup https://github.com/tektoncd/triggers/blob/master/test/eventlistener_test.go#L608 that is then called in the test: https://github.com/tektoncd/triggers/blob/master/test/eventlistener_test.go#L127)

Got it. Besides, I'm curious about https://github.com/tektoncd/triggers/blob/master/test/eventlistener_test.go#L608. I would like to know why we need to delete eventlistener after the whole namespace is already deleted. It seems that the eventlistener lives along with the namespace.

hmm, that's a good question 🤔

We probably should just delete the EL first and then the namespace? Or just the namespace.

So, if TEST_KEEP_NAMESPACES env var is set, we will not delete the namespace but will delete the EL and the servcie . I wonder if this is intentional behavior.

Thanks for the explanation. It makes sense. Should I also delete the eventlistener in test/eventlistener_scale_test.go after tear down the namespace? I can open another PR.

Actually, maybe we can just remove the lines that delete the EventListener and instead rely on the cleanup that already deletes the namespace to clean it up (in TestEventListenerCreate)?

This commit closes tektoncd#797. This PR uses Listers to get resources in the Eventlistener Sink, rather than directly making calls to the API server. Currently, multiple informers need to be setup when creating a Sink object. But the Sink in the cmd/triggerrun still makes the direct API calls because it only makes the call once when executed, which means Lister cache is not useful in this case. All examples work under this change.

dibyom · 2020-11-09T21:42:11Z

/approve
/lgtm

tekton-robot · 2020-11-09T21:42:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dibyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dibyom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Nov 2, 2020

tekton-robot requested review from dibyom and vtereso November 2, 2020 16:25

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/feature Categorizes issue or PR as related to a new feature. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Nov 2, 2020

dibyom reviewed Nov 2, 2020

View reviewed changes

examples/bitbucket/role.yaml Show resolved Hide resolved

dibyom reviewed Nov 2, 2020

View reviewed changes

cmd/triggerrun/cmd/root.go Outdated Show resolved Hide resolved

tekton-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Nov 4, 2020

yaoxiaoqi force-pushed the use-listers branch 2 times, most recently from 2d6f74b to 9c80de4 Compare November 5, 2020 14:35

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 5, 2020

yaoxiaoqi force-pushed the use-listers branch from 9c80de4 to f938963 Compare November 5, 2020 16:00

dibyom reviewed Nov 5, 2020

View reviewed changes

tekton-robot assigned dibyom Nov 5, 2020

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Nov 5, 2020

yaoxiaoqi force-pushed the use-listers branch from f938963 to f7dcb09 Compare November 6, 2020 07:02

tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label Nov 6, 2020

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Nov 9, 2020

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 9, 2020

tekton-robot merged commit 1ad55aa into tektoncd:master Nov 9, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use Listers to fetch data in the Sink #821

Use Listers to fetch data in the Sink #821

yaoxiaoqi commented Nov 2, 2020 •

edited by dibyom

Loading

dibyom commented Nov 2, 2020 •

edited

Loading

yaoxiaoqi commented Nov 5, 2020

yaoxiaoqi commented Nov 5, 2020

dibyom left a comment

dibyom Nov 5, 2020

yaoxiaoqi Nov 6, 2020

dibyom Nov 9, 2020

dibyom Nov 9, 2020

yaoxiaoqi Nov 10, 2020

dibyom Nov 11, 2020 •

edited

Loading

dibyom commented Nov 9, 2020

tekton-robot commented Nov 9, 2020

Use Listers to fetch data in the Sink #821

Use Listers to fetch data in the Sink #821

Conversation

yaoxiaoqi commented Nov 2, 2020 • edited by dibyom Loading

Changes

Submitter Checklist

Release Notes

dibyom commented Nov 2, 2020 • edited Loading

yaoxiaoqi commented Nov 5, 2020

yaoxiaoqi commented Nov 5, 2020

dibyom left a comment

Choose a reason for hiding this comment

dibyom Nov 5, 2020

Choose a reason for hiding this comment

yaoxiaoqi Nov 6, 2020

Choose a reason for hiding this comment

dibyom Nov 9, 2020

Choose a reason for hiding this comment

dibyom Nov 9, 2020

Choose a reason for hiding this comment

yaoxiaoqi Nov 10, 2020

Choose a reason for hiding this comment

dibyom Nov 11, 2020 • edited Loading

Choose a reason for hiding this comment

dibyom commented Nov 9, 2020

tekton-robot commented Nov 9, 2020

yaoxiaoqi commented Nov 2, 2020 •

edited by dibyom

Loading

dibyom commented Nov 2, 2020 •

edited

Loading

dibyom Nov 11, 2020 •

edited

Loading