Common Issues
This troubleshooting guide covers issues for both administrators (component deployment, configuration) and regular users (repository setup, pipeline execution).
Important: Throughout this document, we use two different namespaces:
<pac-namespace>: The namespace where PAC components (controller, watcher, webhook) are deployed. Default istekton-pipelines, but can be customized viatargetNamespacein theOpenShiftPipelinesAsCodeCR.<namespace>: The namespace where PipelineRuns are created. This is specified when creating the Repository CR and can be any namespace in your cluster.
Replace these placeholders with your actual namespace names.
This document provides troubleshooting steps for common issues encountered when using Pipelines-as-Code (PAC).
TOC
Before You Start1. Check PAC Components Are Running2. Determine Your Namespaces3. Get Resource Names4. Common Placeholders Used in This DocumentPAC Component Not DeployingSymptomTroubleshooting StepsCommon CausesSolutionPAC Pods Not StartingSymptomTroubleshooting StepsWebhook Not Receiving EventsSymptomTroubleshooting StepsCommon CausesSolutionVerificationPipeline Not TriggeringSymptomTroubleshooting StepsCommon CausesSolutionVerificationPipelineRuns Not CreatedSymptomTroubleshooting StepsCommon CausesSolutionVerificationTasks Not FoundSymptomTroubleshooting StepsCommon CausesSolutionVariables Not ResolvingSymptomTroubleshooting StepsCommon CausesSolutionVerificationStatus Not Reported to GitLabSymptomTroubleshooting StepsCommon CausesSolutionVerificationComment Commands Not WorkingSymptomTroubleshooting StepsCommon CausesSolutionGetting HelpNext StepsBefore You Start
Before troubleshooting specific issues, verify these basics:
1. Check PAC Components Are Running
Verify all PAC pods are running (replace <pac-namespace> with your PAC namespace, default is tekton-pipelines):
Example output (all pods should be Running):
2. Determine Your Namespaces
Get PAC namespace (where PAC components are deployed):
If the command fails or returns empty, use the default: tekton-pipelines
Get Pipeline namespace (where PipelineRuns are created):
This shows all Repository CRs and their namespaces. The namespace column shows where PipelineRuns will be created.
3. Get Resource Names
Get pod names:
Get Repository CR names:
Get PipelineRun names:
4. Common Placeholders Used in This Document
<pac-namespace>: PAC deployment namespace (default:tekton-pipelines)<namespace>: PipelineRun namespace (varies by repository)<repo-name>: Repository CR name (usekubectl get repository -n <namespace>to list)<pod-name>: Pod name (usekubectl get pods -n <pac-namespace>to list)<name>: PipelineRun name (usekubectl get pipelinerun -n <namespace>to list)<gitlab-secret>: GitLab token secret name (check Repository CR spec)
PAC Component Not Deploying
Symptom
OpenShiftPipelinesAsCode CR shows Ready: False or pods are not starting.
Troubleshooting Steps
-
Check CR Status:
Example output (abbreviated):
-
Check CR Events:
Example output (abbreviated):
-
Check TektonInstallerSet:
Note:
TektonInstallerSetis a cluster-scoped resource. This is a read-only check for troubleshooting. Do not modify or delete it directly. If issues persist, troubleshoot through theOpenShiftPipelinesAsCodeCR.
Example output:
-
Check Operator Logs:
Example output (example log entries):
Common Causes
- Incorrect CR name: Must be exactly
pipelines-as-code - Operator not running: Check Tekton Operator status
- Namespace issues: Verify
targetNamespaceexists - Resource conflicts: Check for existing resources
Solution
- Verify the CR name is
pipelines-as-code - Ensure Tekton Operator is running
- Check namespace exists (replace
<pac-namespace>with your actual PAC namespace):kubectl get namespace <pac-namespace> - Delete and recreate the CR if needed
PAC Pods Not Starting
Symptom
PAC pods are in Pending or CrashLoopBackOff state.
Troubleshooting Steps
-
Check Pod Status (replace
<pac-namespace>with your PAC namespace):
Example output:
-
Check Pod Logs:
First, get the pod name (replace
<pac-namespace>with your PAC namespace):Then check logs (replace
<pod-name>with the actual pod name):
Example output (example error):
-
Check Pod Events:
Get the pod name first, then describe it (replace
<pod-name>with the actual pod name):
Example output (abbreviated):
-
Check Resource Limits:
Example output:
Webhook Not Receiving Events
Symptom
GitLab webhook events are not reaching PAC, pipelines not triggering.
Troubleshooting Steps
-
Check Webhook Configuration in GitLab:
- Go to GitLab project → Settings → Webhooks
- Verify webhook URL is correct
- Check webhook secret matches Repository CR
-
Check PAC Controller Logs (replace
<pac-namespace>with your PAC namespace):
Example output (example log entries):
-
Test Webhook from GitLab:
- Go to GitLab project → Settings → Webhooks
- Click "Test" → "Push events"
- Check webhook response
-
Verify Controller URL is Accessible:
Example output:
Example output:
-
Check Repository CR:
First, list all Repository CRs to find the name (replace
<namespace>with your Pipeline namespace):Then check the specific Repository CR (replace
<repo-name>with the actual repository name):
Example output (abbreviated):
Common Causes
- Controller URL not accessible: Firewall or network issues
- Webhook secret mismatch: Secret in GitLab doesn't match Repository CR
- Webhook URL incorrect: Wrong controller URL configured
- Ingress/Service not configured: Controller not exposed
Solution
- Verify controller URL is accessible from GitLab servers
- Ensure webhook secret matches in both GitLab and Repository CR
- Check Ingress/Service configuration
- Test webhook manually using
curl
Verification
After applying solutions, verify the fix:
-
Test webhook from GitLab:
- Go to GitLab project → Settings → Webhooks
- Click "Test" → "Push events"
- Check that webhook returns
200 OKresponse
-
Check PAC Controller logs for webhook events:
You should see log entries indicating webhook events are being received.
Pipeline Not Triggering
Symptom
Pipelines are not being created when Git events occur.
Troubleshooting Steps
-
Check Pipeline Annotations:
Example output:
-
Verify Branch Names Match:
Example output:
-
Check PAC Controller Logs:
Example output (example log entries):
-
Check Repository CR Status:
First, list Repository CRs to find the name:
Then check the Repository CR (replace
<repo-name>with the actual repository name):
Example output (abbreviated):
-
Verify Pipeline File Exists:
Example output:
Common Causes
- Annotation syntax error: Incorrect annotation format
- Branch name mismatch: Branch pattern doesn't match actual branch
- Pipeline file not found: File not in expected location
- Path filtering: Files changed don't match path filter
- Repository CR not found: No matching Repository CR for the repository
Solution
- Verify annotation syntax: Use
pipelinesascode.tekton.dev/on-target-branch: "[refs/heads/main]"andpipelinesascode.tekton.dev/on-event: "[push]"instead of the deprecatedon-pushannotation - Check branch names match exactly (case-sensitive)
- Ensure
.tekton/pipelinerun.yamlexists in repository - Review path filtering if configured
- Verify Repository CR exists and matches repository URL
Verification
After applying solutions, verify the fix:
-
Trigger a test event:
- Push a commit to the branch specified in your pipeline annotation
- Or create a Merge Request if testing MR triggers
-
Check if PipelineRun is created:
You should see a new PipelineRun created after the Git event.
-
Check PAC Controller logs:
Look for log entries indicating the event was processed.
PipelineRuns Not Created
Symptom
Webhook events are received but PipelineRuns are not created.
Troubleshooting Steps
-
Check PAC Controller Logs:
Example output (example error):
-
Check Repository CR:
First, list Repository CRs to find the name:
Then check the Repository CR (replace
<repo-name>with the actual repository name):
Example output (abbreviated):
-
Verify Namespace Exists:
Example output:
If namespace doesn't exist, you'll see:
-
Check RBAC Permissions:
Example output:
-
Check GitLab Token:
First, find the secret name from Repository CR:
Then check the secret (replace
<gitlab-secret>with the actual secret name):
Example output (abbreviated, token is base64 encoded):
Common Causes
- Namespace doesn't exist: Target namespace not created
- RBAC permissions: PAC ServiceAccount lacks permissions
- GitLab token invalid: Token expired or incorrect
- Pipeline definition error: Invalid YAML or Tekton syntax
- Repository access: Cannot access Git repository
Solution
-
Create namespace if missing:
Example output:
-
Verify RBAC: Check ServiceAccount and RoleBindings
Check what ServiceAccount PAC uses:
Check if ServiceAccount has required permissions:
-
Update GitLab token if expired
-
Validate pipeline YAML syntax
-
Test GitLab token:
Example output (if token is valid):
If token is invalid:
Verification
After applying solutions, verify the fix:
-
Trigger a Git event (push or create MR) and check if PipelineRun is created:
-
Check PipelineRun status:
The PipelineRun should be created and start executing.
Tasks Not Found
Symptom
PipelineRun fails with "task not found" error.
Troubleshooting Steps
-
Check PipelineRun Status:
First, list PipelineRuns to find the name:
Then check the PipelineRun (replace
<name>with the actual PipelineRun name):
Example output (abbreviated, showing error):
-
Check Task References:
Example output:
-
Verify Task Exists:
Example output (if task exists):
If task doesn't exist:
Example output (if task exists):
-
Check Network Connectivity:
Example output (if accessible):
Example output (if accessible):
Common Causes
- Task name incorrect: Typo in task name
- Task not in namespace: Task defined in different namespace
- Tekton Hub unavailable: Network issues accessing Tekton Hub
- Remote URL inaccessible: Cannot fetch task from remote URL
- Task resolver error: Resolver configuration incorrect
Solution
- Verify task name spelling
- Check task exists in correct namespace
- Test Tekton Hub connectivity
- Verify remote URLs are accessible
- Check task resolver configuration
Variables Not Resolving
Symptom
Pipeline variables like {{revision}} are not being replaced.
Troubleshooting Steps
-
Check Variable Syntax:
Example output:
-
Validate YAML Syntax with Dry-Run:
Use
kubectl apply --dry-run=clientto validate the PipelineRun YAML syntax and catch errors early:
Example output (if syntax is valid):
Example output (if there are syntax errors):
Note: This dry-run check validates YAML syntax and Tekton schema, but it won't validate variable resolution (variables like {{revision}} will remain as literal strings in dry-run). For variable resolution issues, check PAC controller logs.
-
Check PAC Controller Logs:
Example output (example log entries):
-
Verify Variable Names:
{{revision}}- correct{{Revision}}or{{REVISION}}- incorrect (case-sensitive)- Use double curly braces:
{{variable_name}}
-
Check PipelineRun Parameters:
First, get the PipelineRun name:
Then check parameters (replace
<name>with the actual PipelineRun name):
Example output:
Common Causes
- Syntax error: Missing curly braces or incorrect format
- Case sensitivity: Variable names are case-sensitive
- Variable not available: Variable not available for current event type (e.g.,
{{pull_request_number}}is only available for pull_request events) - PAC version: Older PAC version may not support certain variables
Solution
- Verify variable syntax: Use
{{variable_name}}format, for example{{revision}}or{{repo_url}} - Check variable names are correct (case-sensitive):
{{repo_owner}},{{source_branch}},{{pull_request_number}} - Ensure variable is available for event type: Some variables like
{{pull_request_number}}are only available forpull_requestevents - Update PAC to latest version if needed
For a complete list of available variables, see Parameterizing Commits and URLs.
Verification
After applying solutions, verify the fix:
-
Check if variables are resolved in the created PipelineRun:
Variables should be replaced with actual values (e.g.,
{{revision}}should be replaced with a commit SHA). -
Check PAC Controller logs for variable resolution:
There should be no warnings about unknown variables.
Status Not Reported to GitLab
Symptom
Pipelines run successfully but status is not shown in GitLab.
Troubleshooting Steps
-
Check PAC Watcher Logs:
Example output (example log entries):
-
Check GitLab Token:
First, find the secret name from Repository CR:
Then check the secret (replace
<gitlab-secret>with the actual secret name):
Example output (abbreviated, token is base64 encoded):
-
Test GitLab API Access:
Example output (if token is valid):
If token is invalid or expired:
-
Check Repository CR:
Example output (abbreviated):
-
Verify PipelineRun Status:
List PipelineRuns to find the name:
Then check status (replace
<name>with the actual PipelineRun name):
Example output:
Common Causes
- GitLab token invalid: Token expired or incorrect
- Token permissions: Token lacks required scopes
- Network issues: Cannot reach GitLab API
- PAC Watcher not running: Watcher pod not running
- Repository CR misconfigured: Incorrect GitLab configuration
Solution
- Verify GitLab token is valid and not expired
- Ensure token has
apiscope - Test GitLab API connectivity
- Check PAC Watcher pod is running
- Verify Repository CR GitLab configuration
Verification
After applying solutions, verify the fix:
-
Check PAC Watcher logs for successful status updates:
You should see log entries indicating status updates were sent successfully.
-
Check GitLab UI:
- Go to your GitLab project
- Check the Merge Request or commit
- Verify that pipeline status is displayed (e.g., "passed", "failed", "running")
-
Verify PipelineRun completed:
The PipelineRun should show
SucceededorFailedstatus, and this status should be reflected in GitLab.
Comment Commands Not Working
Symptom
Comment commands like /retest are not triggering pipelines.
Troubleshooting Steps
-
Check Annotation Configuration:
Example output:
-
Verify Comment Format:
- Commands must be on their own line or at the start of a line
/retest- correctPlease /retest- incorrect (command not at start)
-
Check PAC Controller Logs:
Example output (example log entries):
-
Verify Merge Request Exists:
- Comment commands only work in Merge Requests
- Not available for regular commits
-
Check Webhook Configuration:
Common Causes
- Annotation missing:
on-commentannotation not configured - Command format: Command not at start of line
- Not in Merge Request: Comment commands only work in Merge Requests
- Webhook not configured: Comments event not enabled in webhook
- Command name mismatch: Command in comment doesn't match annotation
Solution
- Add
on-commentannotation:pipelinesascode.tekton.dev/on-comment: "retest" - Ensure commands are at the start of a line
- Use commands only in Merge Requests
- Enable "Comments" in GitLab webhook configuration
- Match command names exactly (case-sensitive)
Getting Help
If you're still experiencing issues:
- Review Logs: Check all component logs for errors
- Verify Configuration: Double-check all configuration files
- Check Documentation: Review the PAC documentation in this guide
- Review Troubleshooting: Check other troubleshooting sections in this document
Next Steps
- Manage PAC Component - Deployment and management guide
- Configure Repository - Repository setup guide
- Trigger Pipelines - Trigger configuration guide