与詹金斯Kubernetes插件失败

Question

我想添加Kubernetes作为云詹金斯服务器与相应的Kubernetes URL和其他细节。当我添加的细节和测试连接 我得到以下错误

错误连接到https://192.168.X.XX:6443：失败执行：详细了解：https://192.168.X.XX:6443/api/v1/namespaces/default/pods。消息：用户“系统：无名氏”不能列出荚命名空间“默认” ..”

我试图用，但被记录在同一以下错误--insecure选项执行卷曲

。消息：用户“系统：无名氏”不能列出荚命名空间“默认” ..”

我尝试使用以下命令kubectl

添加詹金斯和用户凭据登录到詹金斯作为clusteradminrole个

kubectl创建rolebinding詹金斯管理员结合--clusterrole =管理员--user =詹金斯 - 命名空间=默认

但还是同样的错误。

什么都不见了？

编辑1：试图做以下的建议

的OpenSSL genrsa -out jenkins.key 2048

OpenSSL的REQ -new -key jenkins.key退房手续jenkins.csr -subj“/CN = jenkins/O = admin_jenkins“

openssl x509 -req -in jenkins.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out jenkins.crt -days 500

kubectl config set-credentials jenkins --client-certificate =/root/pods/admin_jenkins/.certs/jenkins.crt --client-key =/root/pods/admin_jenkins/.certs/jenkins.key

kubectl config set-上下文詹金斯上下文--cluster = kubernetes --namespace =默认--user =詹金斯

kubectl创建-f role.yaml（如所描述的角色文件）

kubectl创建-f角色binding.yaml

即使在此之后

kubectl --context=jenkins-context get deployments 
gives the following error 
"Error from server (Forbidden): User "jenkins" cannot list deployments.extensions in the namespace "default". (get deployments.extensions)" 

更新2：

after following above steps 
"kubectl --context=jenkins-context get deployments" was successful. 

i did the whole exercise after doing a kubeadm reset and it worked 

但问题仍然存在与詹金斯整合K8当我试图将其添加为使用它的插件云的。

Answer 1

您是否定义了admin？如果没有定义管理员角色。在你的文档下面引用它。

https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

更新： 1.您可以创建文件role.yaml这样创造的角色。然后运行kubectl apply -f role.yaml

kind: Role 
    apiVersion: rbac.authorization.k8s.io/v1beta1 
    metadata: 
    namespace: default 
    name: admin 
    rules: 
    - apiGroups: ["", "extensions", "apps"] 
    resources: ["deployments", "replicasets", "pods"] 
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] 

你需要这个角色来验证通过客户端证书。

从您的第二个问题，您尝试使用此帐户来验证jenkin应用程序用户。我不确定这种方法是否适用于您。

更新在17年9月25日

Username: admin 
Group: jenkins 


openssl genrsa -out admin.key 2048 
openssl req -new -key admin.key -out admin.csr -subj "/CN=admin/O=jenkins" 

#Run this as root user in master node 
openssl x509 -req -in admin.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out admin.crt -days 500 

mkdir .certs/ 
mv admin.* .certs/ 
kubectl config set-credentials admin --client-certificate=/home/jenkin/.certs/admin.crt --client-key=/home/jenkin/.certs/admin.key 
kubectl config set-context admin-context --cluster=kubernetes --namespace=jenkins --user=admin 

这个保存在文件中，并创建角色

kind: Role 
apiVersion: rbac.authorization.k8s.io/v1beta1 
metadata: 
    namespace: jenkins 
    name: deployment-manager 
rules: 
- apiGroups: ["", "extensions", "apps"] 
    resources: ["deployments", "replicasets", "pods"] 
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] 
--- 
kind: RoleBinding 
apiVersion: rbac.authorization.k8s.io/v1beta1 
metadata: 
    name: deployment-manager-binding 
    namespace: jenkins 
subjects: 
- kind: User 
    name: admin 
    apiGroup: "" 
roleRef: 
    kind: Role 
    name: deployment-manager 
    apiGroup: "" 

运行Get荚命令

kubectl --context=admin-context get pods