[INFO] Fetching and executing solve-pr-pairing.sh... [INFO] Setting up env vars for 'release-service' [INFO] Writing env file to /var/workdir/.env COMPONENT_NAME=release-service IMAGE_REPO=quay.io/redhat-user-workloads/rhtap-release-2-tenant/release-service/release-service IMAGE_TAG=2ee1b340a605e09639890265cc9c6bea4966e376.instrumented PR_OWNER=konflux-ci PR_SHA=2ee1b340a605e09639890265cc9c6bea4966e376 [INFO] Checking for paired PR in redhat-appstudio/infra-deployments [INFO] No paired PR found in redhat-appstudio/infra-deployments. Falling back to branch: main [INFO] Downloading release_service_config.yaml... [INFO] Downloaded release-service-config.yaml [INFO] Downloading release-pipeline-resources-clusterrole.yaml... [INFO] Downloaded release-pipeline-resources-clusterrole.yaml [INFO] Configuration files updated. [INFO] Loading env vars from /var/workdir/.env: COMPONENT_NAME=release-service IMAGE_REPO=quay.io/redhat-user-workloads/rhtap-release-2-tenant/release-service/release-service IMAGE_TAG=2ee1b340a605e09639890265cc9c6bea4966e376.instrumented PR_OWNER=konflux-ci PR_SHA=2ee1b340a605e09639890265cc9c6bea4966e376 [INFO] Updating image repository to quay.io/redhat-user-workloads/rhtap-release-2-tenant/release-service/release-service [INFO] Updating image tag to 2ee1b340a605e09639890265cc9c6bea4966e376.instrumented [INFO] Updating GitHub reference to konflux-ci@2ee1b340a605e09639890265cc9c6bea4966e376 [INFO] kubernetes cluster is hosted on: https://3.138.237.61:6443 [INFO] Configuring PAC_WEBHOOK_URL to use smee channel: https://hook.pipelinesascode.com/FMPGBULUKAyF Kubernetes control plane is running at https://3.138.237.61:6443 CoreDNS is running at https://3.138.237.61:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. [INFO] Installing Konflux CI dependencies ๐Ÿ” Checking requirements kubectl is installed openssl is installed Checking kubectl version kubectl version v1.35.1 meets minimum requirement (v1.31.4) All requirements are met Continue ๐Ÿงช Testing PVC creation for default storage class Creating PVC from './dependencies/pre-deployment-pvc-binding' using the cluster's default storage class === Storage Diagnostics (Initial State) === --- Storage Classes --- NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE standard (default) rancher.io/local-path Delete WaitForFirstConsumer false 2m49s === End Storage Diagnostics === namespace/test-pvc-ns created persistentvolumeclaim/test-pvc created pod/test-pvc-consumer created persistentvolumeclaim/test-pvc condition met namespace "test-pvc-ns" deleted persistentvolumeclaim "test-pvc" deleted from test-pvc-ns namespace pod "test-pvc-consumer" deleted from test-pvc-ns namespace PVC binding successfull ๐ŸŒŠ Deploying Konflux Dependencies ๐Ÿ” Deploying Cert Manager... namespace/cert-manager created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created serviceaccount/cert-manager created serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager-startupapicheck created serviceaccount/cert-manager-webhook created role.rbac.authorization.k8s.io/cert-manager-startupapicheck:create-cert created role.rbac.authorization.k8s.io/cert-manager-tokenrequest created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-cluster-view created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created rolebinding.rbac.authorization.k8s.io/cert-manager-startupapicheck:create-cert created rolebinding.rbac.authorization.k8s.io/cert-manager-tokenrequest created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created service/cert-manager created service/cert-manager-cainjector created service/cert-manager-webhook created deployment.apps/cert-manager created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager-webhook created job.batch/cert-manager-startupapicheck created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created deployment.apps/cert-manager condition met deployment.apps/cert-manager-cainjector condition met deployment.apps/cert-manager-webhook condition met ๐Ÿค Deploying Trust Manager... customresourcedefinition.apiextensions.k8s.io/bundles.trust.cert-manager.io created serviceaccount/trust-manager created role.rbac.authorization.k8s.io/trust-manager created role.rbac.authorization.k8s.io/trust-manager:leaderelection created clusterrole.rbac.authorization.k8s.io/trust-manager created rolebinding.rbac.authorization.k8s.io/trust-manager created rolebinding.rbac.authorization.k8s.io/trust-manager:leaderelection created clusterrolebinding.rbac.authorization.k8s.io/trust-manager created service/trust-manager created service/trust-manager-metrics created deployment.apps/trust-manager created certificate.cert-manager.io/trust-manager created issuer.cert-manager.io/trust-manager created validatingwebhookconfiguration.admissionregistration.k8s.io/trust-manager created pod/trust-manager-5d5c6867f9-6hn6d condition met ๐Ÿ“œ Setting up Cluster Issuer... Warning: spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. certificate.cert-manager.io/selfsigned-ca created clusterissuer.cert-manager.io/ca-issuer created clusterissuer.cert-manager.io/self-signed-cluster-issuer created ๐Ÿฑ Deploying Tekton... ๐Ÿฑ Installing Tekton via upstream Operator... namespace/tekton-operator created customresourcedefinition.apiextensions.k8s.io/manualapprovalgates.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/syncerservices.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonchains.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonconfigs.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektondashboards.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonhubs.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektoninstallersets.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonmulticlusterproxyaaes.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonpipelines.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonpruners.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonresults.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektonschedulers.operator.tekton.dev created customresourcedefinition.apiextensions.k8s.io/tektontriggers.operator.tekton.dev created serviceaccount/tekton-operator created role.rbac.authorization.k8s.io/tekton-operator-info created clusterrole.rbac.authorization.k8s.io/tekton-config-read-role created clusterrole.rbac.authorization.k8s.io/tekton-multicluster-proxy-aae-role created clusterrole.rbac.authorization.k8s.io/tekton-operator created clusterrole.rbac.authorization.k8s.io/tekton-result-read-role created clusterrole.rbac.authorization.k8s.io/tekton-scheduler-role created rolebinding.rbac.authorization.k8s.io/tekton-operator-info created clusterrolebinding.rbac.authorization.k8s.io/tekton-config-read-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/tekton-multicluster-proxy-aae-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/tekton-operator created clusterrolebinding.rbac.authorization.k8s.io/tekton-result-read-rolebinding created clusterrolebinding.rbac.authorization.k8s.io/tekton-scheduler-rolebinding created configmap/config-logging created configmap/tekton-config-defaults created configmap/tekton-config-observability created configmap/tekton-operator-controller-config-leader-election created configmap/tekton-operator-info created configmap/tekton-operator-webhook-config-leader-election created secret/tekton-operator-webhook-certs created service/tekton-operator created service/tekton-operator-webhook created deployment.apps/tekton-operator created deployment.apps/tekton-operator-webhook created pod/tekton-operator-6b96d7c975-tgq62 condition met pod/tekton-operator-webhook-65d7569769-m7r52 condition met tektonconfig.operator.tekton.dev/config condition met โš™๏ธ Configuring Tekton... error: error validating "./dependencies/tekton-config": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false ๐Ÿ”„ Retrying command (attempt 2/3)... error: error validating "./dependencies/tekton-config": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false ๐Ÿ”„ Retrying command (attempt 3/3)... error: error validating "./dependencies/tekton-config": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false kubectl apply -k ./dependencies/tekton-config: The Tekton Config resource was not updated within the allocated time. โŒ Deployment failed during: Tekton โœ… Completed steps: - Cert Manager - Trust Manager - Cluster Issuer ๐Ÿ’ก The script is idempotent - you can re-run it after fixing the issue. [INFO] Reading required secrets... [INFO] Deploying image-controller... ๐Ÿ’ง Starting Image Controller deployment... ๐ŸŒŠ Deploying Image Controller components... error: error validating "./konflux-ci/image-controller": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false [INFO] Creating Test Resources... Deploying test resources... Setting up demo users... error: error validating "./test/resources/demo-users/user/": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false [INFO] Creating cluster-config ConfigMap in konflux-info namespace... error: error validating "STDIN": error validating data: failed to download openapi: Get "https://3.138.237.61:6443/openapi/v2?timeout=32s": tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes"); if you choose to ignore these errors, turn validation off with --validate=false