Jenkins集成k8s报错：Error testing connection https://kubernetes.default.svc.cluster.local: Failure

背景：jenkins部署在k8s中的命名空间infra中

 

 Jenkins集成k8s报错  连接测试报错：

Error testing connection https://kubernetes.default.svc.cluster.local: Failure executing: GET at: https://kubernetes.default.svc.cluster.local/api/v1/namespaces/defualt/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:infra:default" cannot list resource "pods" in API group "" in the namespace "defualt".

意思：serviceaccount中 infra:default 没有权限“GET”这个命名空间的 "pods"。权限是“get”对象是“pods”。

出处：https://www.cnblogs.com/liucx/

 

解决办法是：需要给infra:default赋权get去访问pods。

出处：

1.新建一个service-reader-cluster-role.yaml
vi service-reader-cluster-role.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: infra
  name: service-reader
rules:
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","list","patch","watch"]

kubectl apply -f service-reader-cluster-role.yaml

2.添加serviceacount的binding
kubectl create clusterrolebinding service-reader-pod --clusterrole=service-reader --serviceaccount=infra:default

验证：kubectl -n infra get clusterrolebinding|grep service-reader-pod

 

然后就可以了。