0

I want to add a kubernetes cluster to an existing jenkins server (and migrate jobs from docker to kubernetes using named agents).

I set up the kubernetes cluster and added a serviceaccount like for a Jenkins instance running on the same kubernetes (which I find much easier to figure out).

#service-account.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins

I execute kubectl create -f service-account.yml
then
kubectl -n devops-tools create token jenkins-admin
the output of which I copy to the relevant Jenkins credential

Then I set up a job and I always get 401 unauthorized. Do I need to add something else to the serviceaccount when i want to use the token from outside the cluster?

Caused: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods. Message: Unauthorized. Received status: Status(apiVersion=v1, code=401, details=null, kind=Status, message=Unauthorized, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Unauthorized, status=Failure, additionalProperties={}).

1 Answer 1

0

This assumes that the namespace is devops-tools.

Creating an authentication token for an external Jenkins (ie. not deployed inside the kubernets cluster)

  1. Create the serviceAccount
    kubectl create serviceaccount jenkins -n devops-tools
  2. Create the role yaml file:
     ---
     kind: Role
     apiVersion: rbac.authorization.k8s.io/v1
     metadata:
       name: jenkins
     rules:
     - apiGroups: [""]
       resources: ["pods"]
       verbs: ["create","delete","get","list","patch","update","watch"]
     - apiGroups: [""]
       resources: ["pods/exec"]
       verbs: ["create","delete","get","list","patch","update","watch"]
     - apiGroups: [""]
       resources: ["pods/log"]
       verbs: ["get","list","watch"]
     - apiGroups: [""]
       resources: ["secrets"]
       verbs: ["get"]
    
  3. Apply the role: kubectl apply -f jenkins-role.yaml -n devops-tools
  4. Create the role yaml file:
     ---
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: jenkins
       namespace: devops-tools
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: jenkins
     subjects:
     - kind: ServiceAccount
       name: jenkins
    
  5. Apply the role: kubectl apply -f jenkins-rolebinding.yaml -n devops-tools
  6. Create the token in the same namespace (you may have clashes in names - serviceaccoutns created in e.g. the default namespace):
    kubectl create token jenkins -n devops-tools (copy this jwt token)
  7. Create a new credential in your external Jenkins of type secret text with the token as copied from the last step

Verification of the token

The token is a JWT so you can base64-decode it or use https://jwt.io to verify it.

Here is a curl example (linux) to test it out (replace the namespace and url as appropriate):

export JENKINS_TOKEN=PASTE.TOKEN.HERE

curl --location --request GET 'https://localhost:6443/api/v1/namespaces/devops-tools/pods' \  
--header 'Authorization: Bearer $JENKINS_TOKEN'

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.