Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-40717

Enable authentication using Kubernetes service account token

XMLWordPrintable

      The plugin allows to use service accounts only when running in Kubernetes. However, service accounts can be used to access a kubernetes cluster from outside as well. See [1].

      To connect a Jenkins instance to an existing kubernetes cluster, it would be very natural for an admin to create a dedicated service account, assign it to a namespace and make use of it to configure the kubernetes plugin.

      Since the functionality is already there, I guess the effort would not be to high. Or is there any reason not to do so?

      [1] http://kubernetes.io/docs/admin/authentication/

        1. Screen Shot 2018-08-28 at 12.03.43 PM.png
          Screen Shot 2018-08-28 at 12.03.43 PM.png
          47 kB
        2. Screen Shot 2018-08-28 at 1.37.02 PM.png
          Screen Shot 2018-08-28 at 1.37.02 PM.png
          189 kB

          [JENKINS-40717] Enable authentication using Kubernetes service account token

          Holger Partsch created issue -

          Carlos Sanchez added a comment -

          I think that adding a token field to https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/ServiceAccountCredential.java should be enough. Read the file if field is empty

          Carlos Sanchez added a comment - I think that adding a token field to https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/ServiceAccountCredential.java should be enough. Read the file if field is empty
          Carlos Sanchez made changes -
          Summary Original: Enable usage of Kubernetes service accounts in general New: Enable authentication using Kubernetes service account token
          Carlos Sanchez made changes -
          Issue Type Original: Improvement [ 4 ] New: New Feature [ 2 ]
          Carlos Sanchez made changes -
          Component/s New: kubernetes-credentials-plugin [ 23230 ]

          Carlos Sanchez added a comment -

          This is possible using OpenShift Oauth token (even in kubernetes)

          Carlos Sanchez added a comment - This is possible using OpenShift Oauth token (even in kubernetes)
          Carlos Sanchez made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: Open [ 1 ] New: Closed [ 6 ]
          Carlos Sanchez made changes -
          Link New: This issue is duplicated by JENKINS-49660 [ JENKINS-49660 ]

          Nitin Padalia added a comment - - edited

          Hi csanchez I am not able to see any token value which I can provide using this plugin.

          It is automatically creating some token value. I am using latest version of kubernetes-credentials-plugin.

          I Jenkins master is outside of Kubernetes cluster. Am I doing something wrong?

          Nitin Padalia added a comment - - edited Hi csanchez I am not able to see any token value which I can provide using this plugin. It is automatically creating some token value. I am using latest version of kubernetes-credentials-plugin. I Jenkins master is outside of Kubernetes cluster. Am I doing something wrong?

          Chris Denneen added a comment -

          csanchez I agree with nitinpadalia When you add this type of Kubernetes Service Account in the Jenkins UI there is no Value field so it shows "Secret text" and you have no control over the value to add the serviceaccount name used or add a token needed for that serviceaccount name.

           

          Anyway to validate with 1.12.0 and 1.12.4 with LTS 2.121.3

          Chris Denneen added a comment - csanchez I agree with nitinpadalia When you add this type of Kubernetes Service Account in the Jenkins UI there is no Value field so it shows "Secret text" and you have no control over the value to add the serviceaccount name used or add a token needed for that serviceaccount name.   Anyway to validate with 1.12.0 and 1.12.4 with LTS 2.121.3
          Chris Denneen made changes -
          Resolution Original: Fixed [ 1 ]
          Status Original: Closed [ 6 ] New: Reopened [ 4 ]

            Unassigned Unassigned
            hpartsch Holger Partsch
            Votes:
            5 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated: