Jenkins的Kubernetes插件失败

Question

我正在尝试将Kubernetes作为云添加到Jenkins服务器，并提供相应的Kubernetes URL和其他详细信息。当我添加细节并测试连接时，我得到了以下错误

连接到时出错https://192.168.X.XX:6443:执行失败：获取：https://192.168.X.XX:6443/api/v1/namespaces/default/pods.消息：用户“system:anonymous”无法在名称空间“default”中列出pod。。"

我试图执行curl与--inSecurity选项，但相同的以下错误被记录。

消息：用户“系统：匿名”不能在命名空间“默认”中列出豆荚..."

我尝试使用以下kubectl命令添加jenkins和用户凭据以登录到jenkins

kubectl创建rolebinding jenkins管理绑定——clusterrole=admin——user=jenkins——namespace=default

但还是一样的错误。

少了什么？

编辑1：尝试按照建议执行以下操作

openssl genrsa-out jenkins。钥匙2048

openssl请求-新建-密钥jenkins。钥匙出了詹金斯。csr-subc“/CN=jenkins/O=admin_jenkins”

openssl x509-req-in jenkins。csr-CA/etc/kubernetes/pki/CA.crt-CAkey/etc/kubernetes/pki/CA.key-CAcreateserial-out-jenkins。crt-500天

kubectl config set credentials jenkins--客户端证书=/root/pods/admin_jenkins/。证书/詹金斯。crt——客户机密钥=/root/pods/admin_jenkins/。证书/詹金斯。钥匙

kubectl config set context jenkins context--cluster=kubernetes--namespace=default--user=jenkins

kubectl创建-f角色。yaml（如上所述的角色文件）

创建-frole-binding.yaml

即使在这之后

kubectl --context=jenkins-context get deployments 
gives the following error
"Error from server (Forbidden): User "jenkins" cannot list deployments.extensions in the namespace "default". (get deployments.extensions)"

更新二：

after following above steps 
"kubectl --context=jenkins-context get deployments" was successful.

 i did the whole exercise after doing a kubeadm reset and it worked

但是，当我试图使用K8的插件将其添加为云时，将其与Jenkins集成仍然是一个问题。

Answer 1

您是否定义了角色admin？如果没有，请定义管理员角色。下面是你的文件，请参考。

https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/

更新：1。您可以创建文件角色。yaml像这样创建角色。然后运行kubectl apply-f角色。yaml

 kind: Role
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    namespace: default
    name: admin
  rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["deployments", "replicasets", "pods"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"]

您需要通过具有此角色的客户端证书进行身份验证。

从第二个问题开始，您试图使用此帐户验证jenkin应用程序用户。我不确定这种方法是否适合你。

2017年9月25日更新

Username: admin
Group: jenkins


 openssl genrsa -out admin.key 2048
 openssl req -new -key admin.key -out admin.csr -subj "/CN=admin/O=jenkins"

 #Run this as root user in master node
 openssl x509 -req -in admin.csr -CA /etc/kubernetes/pki/ca.crt  -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out admin.crt -days 500

 mkdir .certs/
 mv admin.* .certs/
 kubectl config set-credentials admin --client-certificate=/home/jenkin/.certs/admin.crt  --client-key=/home/jenkin/.certs/admin.key
 kubectl config set-context admin-context --cluster=kubernetes --namespace=jenkins --user=admin 

将其保存在文件中并创建角色

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: jenkins
  name: deployment-manager
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: deployment-manager-binding
  namespace: jenkins
subjects:
- kind: User
  name: admin
  apiGroup: ""
roleRef:
  kind: Role
  name: deployment-manager
  apiGroup: ""

运行get pods命令

kubectl --context=admin-context get pods