[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Jesse Glick updated an issue Jenkins / JENKINS-49660 Unable to configure plugin using ibm k8s Change By: Jesse Glick Labels: kuberenetes- plugin plugin Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.188588.1519157955000.26238.1560368042720%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo resolved as Not A Defect Jenkins / JENKINS-49660 Unable to configure plugin using ibm k8s Change By: Steve Szabo Status: Open Resolved Resolution: Not A Defect Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s I plan to create a service account to manage the namespace from jenkins. Thanks for your help on this one - cheers Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Carlos Sanchez commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s typically you would create a ServiceAccount in k8s and use its token for authentication. oidc could work if you use refresh-token as token but it has an expiration time Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s Using the basic token format works: users: - name: usern...@company.com user: token: AAA This version does not work: users: - name: usern...@company.com user: auth-provider: name: oidc config: client-id: bx client-secret: bx id-token: AAA idp-issuer-url: https://iam.ng.bluemix.net/kubernetes refresh-token: BBB Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo updated an issue Jenkins / JENKINS-49660 Unable to configure plugin using ibm k8s Change By: Steve Szabo Attachment: config.token.fixed Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s Have you tested the plugin using a token? token Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title
Steve Szabo commented on JENKINS-49660
Re: Unable to configure plugin using ibm k8s
Using the token from config.token I'm able to list pods using kubectl and curl:
sszabo@xxx [/home/sszabo/tmp] $ curl -s --cacert $KUBE_CERT -X GET -H "$KUBE_HEADER" $KUBE_MASTER/api/v1/namespaces/$KUBE_NAMESPACE/pods
{
"kind": "PodList",
"apiVersion": "v1",
"metadata": {
"selfLink": "/api/v1/namespaces/jenkins/pods",
"resourceVersion": "882144"
},
"items": []
}
Add Comment
This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s I'm not running the master in k8s however I was able to get it working with my local cluster by pointing the service endpoints to the master. I don't think this is the issue under ibm as it gives a permission error when I test the connection from jenkins config page. How are you authenticating from the master to k8s - you seem to be using the kubectl config. --- kind: Endpoints apiVersion: v1 metadata: name: jenkins-master namespace: jenkins labels: oiqclient: jenkins subsets: - addresses: - ip: 192.168.0.100 ports: - port: 8080 name: jenkins-master - addresses: - ip: 192.168.0.100 ports: - port: 5 name: jenkins-jnlp --- kind: Service apiVersion: v1 metadata: name: jenkins-master namespace: jenkins labels: oiqclient: jenkins spec: ports: - name: jenkins-master protocol: TCP port: 8080 targetPort: 8080 nodePort: 0 - name: jenkins-jnlp protocol: TCP port: 5 targetPort: 5 nodePort: 0 Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Carlos Sanchez commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s if you run the jenkins master in k8s you should just run it using serviceAccount for authentication Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo commented on JENKINS-49660 Re: Unable to configure plugin using ibm k8s I should mention that using config.token I'm able to list pods using kubectl so the role should have the correct perms: sszabo@xxx [/home/sszabo] $ kubectl get pods No resources found. Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-49660) Unable to configure plugin using ibm k8s
Title: Message Title Steve Szabo created an issue Jenkins / JENKINS-49660 Unable to configure plugin using ibm k8s Issue Type: Bug Assignee: Carlos Sanchez Attachments: config.cert, config.token Components: kubernetes-plugin Created: 2018-02-20 20:19 Labels: plugin kuberenetes-plugin Priority: Minor Reporter: Steve Szabo I was able to configure the plugin to use my local k8s cluster however I can't get it working using my ibm k8s instance. The difference seems to be that ibm is using auth tokens and my local instance is using cert+key. See attached io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://127.0.0.1:1234/api/v1/namespaces/jenkins/pods. Message: Forbidden! User usern...@company.com doesn't have permission. pods is forbidden: User "system:anonymous" cannot list pods in the namespace "jenki ns". at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:470) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:407) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:379) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:343) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:327) at
