Jenkins集成k8s報錯：Error testing connection https://kubernetes.default.svc.cluster.local: Failure

背景：jenkins部署在k8s中的命名空間infra中

 

 Jenkins集成k8s報錯  連接測試報錯：

Error testing connection https://kubernetes.default.svc.cluster.local: Failure executing: GET at: https://kubernetes.default.svc.cluster.local/api/v1/namespaces/defualt/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:infra:default" cannot list resource "pods" in API group "" in the namespace "defualt".

意思：serviceaccount中 infra:default 沒有權限“GET”這個命名空間的 "pods"。權限是“get”對象是“pods”。

出處：https://www.cnblogs.com/liucx/

 

解決辦法是：需要給infra:default賦權get去訪問pods。

出處：

1.新建一個service-reader-cluster-role.yaml
vi service-reader-cluster-role.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: infra
  name: service-reader
rules:
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","list","patch","watch"]

kubectl apply -f service-reader-cluster-role.yaml

2.添加serviceacount的binding
kubectl create clusterrolebinding service-reader-pod --clusterrole=service-reader --serviceaccount=infra:default

驗證：kubectl -n infra get clusterrolebinding|grep service-reader-pod

 

然后就可以了。