Webhook with Openshift Origin v3.9

[nazakahar]

Hi,

I have not been able to configure the webhook for a push in bitbucket to invoke a new build in Openshift Origin v3.9. I have imported the cert from Openshift Origin cert folder to the cacert in JAVA_HOME using Portecle. 

I have entered the following information:

Name: origin-hello-php

Url: https://master1.origin.skin.local:8443/oapi/v1/namespaces/skin-poc/buildconfigs/hello-php/webhooks/e3d60d0dc81f84f3/bitbucket

Secret: e3d60d0dc81f84f3

I am assuming the secret is the one that I used in the webhook url in my openshift origin bitbucket webhook url setup.

I am getting the following error thrown by openshift origin:

HTTP Status: 400

Headers

Cache-Control: no-store
Content-Length: 164
Date: Fri, 16 Mar 2018 04:57:59 GMT
Via: 1.1 localhost (Apache-HttpClient/4.4.1 (cache))
Content-Type: application/json

Body

{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"non-parseable Content-Type  (mime: no media type)","reason":"BadRequest","code":400}

So has anyone out there experienced similar issues?

Naza

[Rickard Hedlund]

I've not experienced the problems you have and I have no idea what "Portecle" is but this might help you find your answer.

i don't know if Enterprise/Origin does any difference but I've done this on OpenShift Enterprise 3.9 with Bitbucket Server.

Short example of what I did to make it work:

In OpenShift:

1. Created a secret in the project that bitbucket will use when using the webhook

apiVersion: v1
data:
 WebHookSecretKey: <removed>
kind: Secret
metadata:
 creationTimestamp: '2000-01-01T00:00:00Z'
 name: webhooksecret
 namespace: <project namespace>
 resourceVersion: '1'
 selfLink: /api/v1/namespaces/<project namespace>/secrets/webhooksecret
 uid: <removed>
type: Opaque

2. Created a secret in the project containing a username and password so OpenShift can authenticate against Bitbucket when pulling

apiVersion: v1
data:
 password: <password>
 username: <username>
kind: Secret
metadata:
 creationTimestamp: '2000-01-01T00:00:00Z'
 name: gituser
 namespace: <project namespace>
 resourceVersion: '1'
 selfLink: /api/v1/namespaces/<project namespace>/secrets/gituser
 uid: <removed>
type: kubernetes.io/basic-auth

3. Build config in OpenShift looking something like this

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
 annotations:
 openshift.io/generated-by: OpenShiftWebConsole
 creationTimestamp: '2000-01-01T00:00:00Z'
 labels:
 app: some-cool-name
 name: some-cool-name
 namespace: <project namespace>
 resourceVersion: '1'
 selfLink: >-
 /apis/build.openshift.io/v1/namespaces/<project namespace>/buildconfigs/some-cool-name
 uid: 1
spec:
 nodeSelector: null
 output:
 to:
 kind: ImageStreamTag
 name: 'some-cool-name:latest'
 postCommit: {}
 resources: {}
 runPolicy: Serial
 source:
 git:
 ref: master
 uri: 'https://<some git user>@git/scm/<some git project>/<some git repo>.git'
 sourceSecret:
 name: gituser
 type: Git
 strategy:
 sourceStrategy:
 from:
 kind: ImageStreamTag
 name: <some base image>
 namespace: <some non-relevant namespace where the base-image exists>
 type: Source
 triggers:
 - type: ConfigChange
 - generic:
 secret: <very important secret>
 type: Generic
status:
 lastVersion: 1

In Bitbucket:

Locate the GIT-repo used in the BuildConfig above

4. Under "Repository settings" -> "Webhooks" -> configure a new webhook

Name: some-cool-name
URL: https://<openshift url (and port) >/oapi/v1/namespaces/<project namespace>/buildconfigs/some-cool-name/webhooks/<very important secret>/generic
Secret: <the secret value you created in step 1 (WebHookSecretKey:THIS) >
Active: yes

You can leave rest as default

5. Make sure that the jdk running Bitbucket trusts the Root CA ( the Root CA is in the java truststore ) that created the OpenShift cert.

Hope this helps you.

[Rickard Hedlund]

Sorry for the bad formatting ( wrong number of spaces in the yaml-config for the buildconfig ) but this editor refused more than two spaces in a row in a code block.

[M]

This  is generic webhook example on OKD side  - triggered by  BitBucket webhook.
Generic webook actually accept everything

For this case OKD has bitbucket trigger:

https://docs.openshift.com/container-platform/3.9/dev_guide/builds/triggering_builds.html#bitbucket-webhooks

which check wheter "ref" form BuildConfig follows the information from triger.

You problem is that the request doesn't contain Content-Type, the BitBucket Webhook does add it.