this has been fixed in master already and there is a role definition at https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml

csanchez hm the role and role binding are only per Namespace Roles, and i get this error, any ideas?

Failed to count the # of live instances on Kubernetes io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://kubernetes.example.net/api/v1/pods?labelSelector=jenkins%3Dslave. Message: User "docker-ci" cannot list pods at the cluster scope.. at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:470) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:409) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:379) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:343) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:327) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:583) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:68) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.addProvisionedSlave(KubernetesCloud.java:792) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.provision(KubernetesCloud.java:593) at hudson.slaves.NodeProvisioner$StandardStrategyImpl.apply(NodeProvisioner.java:715) at hudson.slaves.NodeProvisioner.update(NodeProvisioner.java:320) at hudson.slaves.NodeProvisioner.access$000(NodeProvisioner.java:61) at hudson.slaves.NodeProvisioner$NodeProvisionerInvoker.doRun(NodeProvisioner.java:809) at hudson.triggers.SafeTimerTask.run(SafeTimerTask.java:51) at jenkins.security.ImpersonatingScheduledExecutorService$1.run(ImpersonatingScheduledExecutorService.java:58) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748)

csanchez ok build the plugin from master, now it does work

Code changed in jenkins
User: Mark Waite
Path:
src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
http://jenkins-ci.org/commit/git-client-plugin/52f681e6153eb088495edd497a82d6dc919dcae3
Log:
[Fixed JENKINS-46054] submodule repo URL with '.url' substring failed

Modify the submodule config parsing regular expression to correctly
extract the submodule name from the config output.

Splits cli submodule URL regexp use into two cases.

git config --get-regex applies the regex to match keys, and returns all
matches (including substring matches).

Thus, a config call:

git config -f .gitmodules --get-regexp "^submodule\.([^ ]+)\.url"

will report two lines of output if the submodule URL includes ".url":

submodule.modules/JENKINS-46504.url.path modules/JENKINS-46504.url
submodule.modules/JENKINS-46504.url.url https://github.com/MarkEWaite/JENKINS-46054.url

The code originally used the same pattern for get-regexp and for output parsing.
By using the same pattern in both places, it incorrectly took the first line
of output as the URL of a submodule (when it is instead the path of a submodule).

Fixes tests added in previous commits.