Bitbucket Cloud适配Tekton EventListener拦截器遇403权限问题求助

我在为Bitbucket Cloud仓库配置Tekton EventListener时，发现官方文档提供的Bitbucket拦截器仅支持Bitbucket Server，当前的EventListener配置如下：

---
apiVersion: triggers.tekton.dev/v1alpha1
kind: EventListener
metadata:
  name: bitbucket-el
spec:
  serviceAccountName: tekton-triggers-admin
  triggers:
    - name: bitbucket-triggers
      interceptors:
        - bitbucket:
            secretRef:
              secretName: bitbucket-secret
              secretKey: secretToken
            eventTypes:
        - cel:
            filter: "header.match('X-Event-Key', 'repo:push')"
            overlays:
              - key: extensions.tag_name
                expression: "split(body.ref, '/')[2]"
              - key: extensions.mangledtag
                expression: "split(split(body.ref, '/')[2], '.')[0]+'-'+split(split(body.ref, '/')[2], '.')[1]+'-'+split(split(body.ref, '/')[2], '.')[2]"
      bindings:
        - ref: bitbucket-binding
      template:
        ref: bitbucket-template

通过Bitbucket Cloud OAuth生成consumer secret并存入bitbucket-secret，最初Ingress启用基础认证时Webhook返回401未授权，移除基础认证后推送触发时出现403 Forbidden错误。以下是针对性的解决方案：

核心问题：Bitbucket拦截器不兼容Bitbucket Cloud #

Tekton官方的bitbucket拦截器是为Bitbucket Server设计的，两者Webhook签名验证逻辑不同，直接使用会导致签名验证失败，返回403，需替换为自定义签名验证逻辑。

解决方案步骤 #

1. 替换拦截器，手动验证Bitbucket Cloud签名 #

Bitbucket Cloud使用HMAC-SHA256对请求体签名，签名值放在X-Hub-Signature-256请求头中。用CEL拦截器实现签名验证：

- cel:
    filter: >-
      crypto.hmac(body, '${params.secret}', 'sha256') == header.get('X-Hub-Signature-256').split('=')[1]
    params:
      - name: secret
        valueFrom:
          secretKeyRef:
            name: bitbucket-secret
            key: secretToken

2. 修正完整的EventListener配置 #

移除原有的bitbucket拦截器，替换为上述CEL签名验证拦截器，保留原有的事件过滤和字段转换逻辑：

---
apiVersion: triggers.tekton.dev/v1alpha1
kind: EventListener
metadata:
  name: bitbucket-el
spec:
  serviceAccountName: tekton-triggers-admin
  triggers:
    - name: bitbucket-triggers
      interceptors:
        - cel:
            filter: >-
              crypto.hmac(body, '${params.secret}', 'sha256') == header.get('X-Hub-Signature-256').split('=')[1]
            params:
              - name: secret
                valueFrom:
                  secretKeyRef:
                    name: bitbucket-secret
                    key: secretToken
        - cel:
            filter: "header.match('X-Event-Key', 'repo:push')"
            overlays:
              - key: extensions.tag_name
                expression: "split(body.ref, '/')[2]"
              - key: extensions.mangledtag
                expression: "split(split(body.ref, '/')[2], '.')[0]+'-'+split(split(body.ref, '/')[2], '.')[1]+'-'+split(split(body.ref, '/')[2], '.')[2]"
      bindings:
        - ref: bitbucket-binding
      template:
        ref: bitbucket-template

3. 检查Bitbucket Cloud Webhook配置 #

确保仓库Webhook设置满足：

• 触发事件勾选repo:push
• 签名密钥与K8s Secret中secretToken完全一致
• 请求URL指向EventListener的Ingress地址，且为POST方法、application/json内容类型

4. 验证ServiceAccount权限 #

确认tekton-triggers-adminServiceAccount具备足够权限，比如创建PipelineRun、访问Trigger相关资源的权限，可通过检查其绑定的ClusterRole/Role确认。

内容的提问来源于stack exchange，提问作者Alioune Badara Diakhaté