kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-pipelines
  name: config-artifact-pvc
  namespace: tekton-pipelines
data:
  storageClassName: "openebs-hostpath"
  size: "10GiB"

kubectl apply --filename \
https://storage.googleapis.com/tekton-releases/dashboard/latest/tekton-dashboard-release.yaml

brew install tektoncd-cli

ssh-keygen -t ed25519 -C "[[email protected]]"
# save current directory
kubectl create secret generic [secret_name] --from-file=ssh-privatekey=./id_ed25519.tekton.dev --type=kubernetes.io/ssh-auth
kubectl annotate secret [secret_name] tekton.dev/git-0=github.com

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-deptno
secrets:
  - name: [secret_name]

Name:         ssh-github-deptno
Namespace:    project-things
Labels:       <none>
Annotations:  tekton.dev/git-0: github.com

Type:  kubernetes.io/ssh-auth

Data
====
ssh-privatekey:  411 bytes

apiVersion: v1 
kind: ServiceAccount
metadata:
  name: tt-sa
secrets:
  - name: ssh-github # `sh-privatekey` 를 데이터로 갖는다
---
apiVersion: rbac.authorization.k8s.io/v1 
kind: RoleBinding
metadata:
  name: tt-rb
  namespace: project-things
subjects:
- kind: ServiceAccount
  name: tt-sa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-roles
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tt-crb
subjects:
- kind: ServiceAccount
  name: tt-sa
  namespace: project-things
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-clusterroles
---
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: tt-ev
spec:
  serviceAccountName: tt-sa
  triggers:
  - triggerRef: tt-tr
  resources:
    kubernetesResource:
      serviceType: ClusterIP
      servicePort: 80
---
apiVersion: triggers.tekton.dev/v1beta1
kind: Trigger
metadata:
  name: tt-tr
spec:
  bindings:
  - ref: tt-tb
  template:
    ref: tt-tt
---
apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerBinding
metadata:
  name: tt-tb
spec:
  params:
  - name: url
    value: $(body.url)
---
apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: tt-tt
spec:
  params:
  - name: url
  resourceTemplates:
  - apiVersion: tekton.dev/v1beta1
    kind: PipelineRun
    metadata:
      generateName: tt-tt-pr
    spec:
      serviceAccountName: tt-sa
      pipelineRef:
        name: tt-pl
      params:
      - name: repo-url
        value: $(tt.params.url)
      workspaces:
      - name: shared-data
        emptyDir: {}
---
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: tt-pl
  namespace: project-things
spec:
  description: clone git repository
  params:
  - name: repo-url
    type: string
    description: https://github.com/[username]/[reponame].git
  workspaces:
  - name: shared-data
    description: working directory
  tasks:
  - name: fetch-source
    taskRef:
      name: git-clone
    params:
    - name: url
      value: $(params.repo-url)
    workspaces:
    - name: output
      workspace: shared-data

$ curl -X POST \                                                                                                                                               ok  4s  16.15.0 node  1.59.0 rust  01:12:56
  http://localhost:8080 \
  -H 'Content-Type: application/json' \
  -d '{ "url": "[email protected]:deptno/private-repo.git" }'
{"eventListener":"tt-ev","namespace":"project-things","eventListenerUID":"54001b1f-1859-48a3-802b-d220a954f23c","eventID":"19375452-32d1-4650-aa03-beb73f7f7538"}
$ tkn pr logs                                                                                                                                                      ok  16.15.0 node  1.59.0 rust  01:13:07
? Select pipelinerun: tt-tt-prkbpb2 started 1 second ago
Pipeline still running ...
task fetch-source has failed: "step-clone" exited with code 1 (image: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init@sha256:28ff94e63e4058afc3f15b4c11c08cf3b54fa91faa646a4bbac90380cd7158df"); for logs run: kubectl -n project-things logs tt-tt-prkbpb2-fetch-source-pod -c step-clone

[... logs]

Events:
  Type     Reason            Age   From               Message
  ----     ------            ----  ----               -------
  Warning  FailedScheduling  2m8s  default-scheduler  0/1 nodes are available: pod has unbound immediate PersistentVolumeClaims. preemption: 0/1
 nodes are available: 1 No preemption victims found for incoming pod..

{
    "severity": "fatal",
    "timestamp": "2023-01-28T08:55:54.927Z",
    "logger": "eventlistener",
    "caller": "v2/main.go:205",
    "message": "Start returned an error",
    "error": "Timed out waiting on CaBundle to available for clusterInterceptor: Timed out waiting on CaBundle to available for Interceptor: clusterinterceptors. triggers.tekton.dev is forbidden: User \"system:serviceaccount:project-things:default\" cannot list resource \"clusterinterceptors\" in API group \"triggers.tekton.dev\" at the cluster scope"
}