Alauda DevOps Pipelines Docs

Get the PAC Webhook URL

Important

Before using this page, an administrator must expose the PAC controller as described in Configure Access.

Use this page to get the webhook URL for PAC. This URL lets Git providers notify PAC about repository events, such as commits and merge requests, so PAC can trigger matching PipelineRuns.

Choose the section that matches how PAC was exposed: Gateway API, Ingress, or NodePort. Examples use the default PAC namespace tekton-pipelines; replace it in the commands if your OpenShiftPipelinesAsCode CR uses a different targetNamespace.

TOC

Using Gateway APIUsing IngressUsing NodePortRecord the Webhook URLVerificationNext steps

Using Gateway API

Use this section if PAC was exposed with Gateway API.

Read the host from the HTTPRoute and print the webhook URL:

HOST=$(kubectl get httproute pipelines-as-code -n tekton-pipelines \
  -o jsonpath='{.spec.hostnames[0]}')

if [ -z "${HOST}" ]; then
  echo "HTTPRoute host is empty. Configure a hostname in the exposure manifest first."
  exit 1
fi

WEBHOOK_URL="http://${HOST}"
echo "${WEBHOOK_URL}"

Expected result: the command prints the host-based PAC webhook URL.

Use this URL when configuring the Git provider webhook or setting up a repository integration. For automatic webhook registration, also record this URL in pipelines-as-code-info as described below.

Using Ingress

Use this section if PAC was exposed with an Ingress.

Read the host from the Ingress and print the webhook URL:

HOST=$(kubectl get ingress pipelines-as-code -n tekton-pipelines \
  -o jsonpath='{.spec.rules[0].host}')

if [ -z "${HOST}" ]; then
  echo "Ingress host is empty. Configure a host rule or use a reachable address from the Ingress controller."
  exit 1
fi

WEBHOOK_URL="http://${HOST}"
echo "${WEBHOOK_URL}"

Use https://${HOST} instead if the Ingress has TLS configured:

WEBHOOK_URL="https://${HOST}"
echo "${WEBHOOK_URL}"

Using NodePort

Use this section if PAC was exposed with a dedicated NodePort Service. Print the URL from a reachable node IP and the generated NodePort:

NODEPORT=$(kubectl get svc pipelines-as-code-controller-nodeport -n tekton-pipelines \
  -o jsonpath='{.spec.ports[?(@.name=="http-listener")].nodePort}')

NODE_IP=$(kubectl get nodes \
  -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')

WEBHOOK_URL="http://${NODE_IP}:${NODEPORT}"
echo "${WEBHOOK_URL}"

Record the Webhook URL

Automatic webhook registration reads the public PAC webhook URL from pipelines-as-code-info.data.controller-url. After choosing and verifying WEBHOOK_URL, update the PAC component options so the Tekton Operator manages that ConfigMap.

If PAC is managed through OpenShiftPipelinesAsCode, update the resource like this:

apiVersion: operator.tekton.dev/v1alpha1
kind: OpenShiftPipelinesAsCode
metadata:
  name: pipelines-as-code
spec:
  targetNamespace: tekton-pipelines
  options:
    configMaps:
      pipelines-as-code-info:
        data:
          controller-url: https://pac.example.com

If PAC is managed through TektonConfig, update the platforms.openshift.pipelinesAsCode options instead:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  platforms:
    openshift:
      pipelinesAsCode:
        enable: true
        options:
          configMaps:
            pipelines-as-code-info:
              data:
                controller-url: https://pac.example.com

Replace https://pac.example.com with the value printed as WEBHOOK_URL. When this value changes, the webhook registration controller reconciles all PAC Repository resources so their provider-side webhooks use the new URL.

Verification

The webhook URL must be reachable from your Git provider. For a public Git provider, the URL must be publicly reachable. For a self-hosted Git provider, network reachability from the provider host to the cluster is enough.

If DNS is not ready yet, verify the route with the host resolved to the Gateway or Ingress external address from the Git provider network. Do not register a raw IP URL unless the PAC exposure is configured without a host requirement.

After setting WEBHOOK_URL, run a quick check from a host that can reach the PAC endpoint:

curl -i "${WEBHOOK_URL}"

In current PAC versions, GET / returns 200 OK with a small JSON status body. A connection refused or timeout indicates a network issue.

Next steps