與詹金斯Kubernetes插件失敗

Question

我想添加Kubernetes作爲雲詹金斯服務器與相應的Kubernetes URL和其他細節。當我添加的細節和測試連接 我得到以下錯誤

錯誤連接到https://192.168.X.XX:6443：失敗執行：詳細瞭解：https://192.168.X.XX:6443/api/v1/namespaces/default/pods。消息：用戶「系統：無名氏」不能列出莢命名空間「默認」 ..」

我試圖用，但被記錄在同一以下錯誤--insecure選項執行卷曲

。消息：用戶「系統：無名氏」不能列出莢命名空間「默認」 ..」

我嘗試使用以下命令kubectl

添加詹金斯和用戶憑據登錄到詹金斯作爲clusteradminrole個

kubectl創建rolebinding詹金斯管理員結合--clusterrole =管理員--user =詹金斯 - 命名空間=默認

但還是同樣的錯誤。

什麼都不見了？

編輯1：試圖做以下的建議

的OpenSSL genrsa -out jenkins.key 2048

OpenSSL的REQ -new -key jenkins.key退房手續jenkins.csr -subj「/CN = jenkins/O = admin_jenkins「

openssl x509 -req -in jenkins.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out jenkins.crt -days 500

kubectl config set-credentials jenkins --client-certificate =/root/pods/admin_jenkins/.certs/jenkins.crt --client-key =/root/pods/admin_jenkins/.certs/jenkins.key

kubectl config set-上下文詹金斯上下文--cluster = kubernetes --namespace =默認--user =詹金斯

kubectl創建-f role.yaml（如所描述的角色文件）

kubectl創建-f角色binding.yaml

即使在此之後

kubectl --context=jenkins-context get deployments 
gives the following error 
"Error from server (Forbidden): User "jenkins" cannot list deployments.extensions in the namespace "default". (get deployments.extensions)" 

更新2：

after following above steps 
"kubectl --context=jenkins-context get deployments" was successful. 

i did the whole exercise after doing a kubeadm reset and it worked 

但問題仍然存在與詹金斯整合K8當我試圖將其添加爲使用它的插件雲的。

Answer 1

您是否定義了admin？如果沒有定義管理員角色。在你的文檔下面引用它。

https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

更新： 1.您可以創建文件role.yaml這樣創造的角色。然後運行kubectl apply -f role.yaml

kind: Role 
    apiVersion: rbac.authorization.k8s.io/v1beta1 
    metadata: 
    namespace: default 
    name: admin 
    rules: 
    - apiGroups: ["", "extensions", "apps"] 
    resources: ["deployments", "replicasets", "pods"] 
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] 

你需要這個角色來驗證通過客戶端證書。

從您的第二個問題，您嘗試使用此帳戶來驗證jenkin應用程序用戶。我不確定這種方法是否適用於您。

更新在17年9月25日

Username: admin 
Group: jenkins 


openssl genrsa -out admin.key 2048 
openssl req -new -key admin.key -out admin.csr -subj "/CN=admin/O=jenkins" 

#Run this as root user in master node 
openssl x509 -req -in admin.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out admin.crt -days 500 

mkdir .certs/ 
mv admin.* .certs/ 
kubectl config set-credentials admin --client-certificate=/home/jenkin/.certs/admin.crt --client-key=/home/jenkin/.certs/admin.key 
kubectl config set-context admin-context --cluster=kubernetes --namespace=jenkins --user=admin 

這個保存在文件中，並創建角色

kind: Role 
apiVersion: rbac.authorization.k8s.io/v1beta1 
metadata: 
    namespace: jenkins 
    name: deployment-manager 
rules: 
- apiGroups: ["", "extensions", "apps"] 
    resources: ["deployments", "replicasets", "pods"] 
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"] 
--- 
kind: RoleBinding 
apiVersion: rbac.authorization.k8s.io/v1beta1 
metadata: 
    name: deployment-manager-binding 
    namespace: jenkins 
subjects: 
- kind: User 
    name: admin 
    apiGroup: "" 
roleRef: 
    kind: Role 
    name: deployment-manager 
    apiGroup: "" 

運行Get莢命令

kubectl --context=admin-context get pods