jenkins - 默认服务帐户不适用于 jenkins 上的 kubernetes 插件

Question

我已经配置了 Kubernetes 插件来启动从属服务器。
但是我在访问控制方面遇到了问题。
当 master 尝试启动新的 pod(slave)时出现错误

Unexpected exception encountered while provisioning agent Kubernetes Pod Template io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://kubernetes.default/api/v1/namespaces/npd-test/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked.. at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:315) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:266) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:237) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:230) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleCreate(OperationSupport.java:208) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:643) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.create(BaseOperation.java:300) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud$ProvisioningCallback.call(KubernetesCloud.java:636) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud$ProvisioningCallback.call(KubernetesCloud.java:581) at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745)

我已经检查了位于 /var/run/secrets/kubernetes.io/serviceaccount/token 的默认服务帐户的访问权限。并尝试在 https://kubernetes.default/api/v1/namespaces/npd-test/pods. 中创建一个 pod使用 token 并且它可以工作。

不知道为什么插件提示服务帐户无权访问。

我尝试使用无凭据和 Kubernetes 服务帐户凭据(无法指定帐户)来配置 Kubernetes 插件，但都不起作用。

Answer 1

奇怪的是，服务帐户正常为您工作，但在 Jenkins 中不起作用。在我的设置中，我必须添加一个 RoleBinding为服务帐户提供 edit角色(我的命名空间实际上是 jenkins，但我在此处更改它以匹配您的命名空间)。

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkins
  namespace: npd-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
- kind: ServiceAccount
  name: default
  namespace: npd-test

在我这样做之后，我像这样配置了 Kubernetes Cloud 插件，它对我有用。

Kubernetes URL: https://kubernetes.default.svc.cluster.local
Kubernetes server certificate key:
Disable https certificate check: off
Kubernetes Namespace: npd-test
Credentials: - none -