-
Bug
-
Resolution: Duplicate
-
Minor
-
Jenkins 2.375.2
Kubernetes Client API Plugin 6.3.1-206.v76d3b_6b_14db_b
Kubernetes Credentials Plugin 0.10.0
Kubernetes plugin 3802.vb_b_600831fcb_3
other plugins are irrelevant
We have a multi cloud configuration with multiple pod templates per "cloud".
On Jenkins masters where there is a ~/.kube/config file in the home directory of the service account running Jenkins, we were seeing multiple spurious warnings and errors in the Jenkins log to the effect of:
... Message: Unauthorized! Token may have expired! Please log-in again. Unauthorized.
Not even the creation of brand new tokens would allow consistent connections.
To recreate this, set up multiple cloud configurations with different service account tokens for login. verify that each cloud is working properly first.
Then from the command line perform a kubectl login to any one of the clusters with the service account token. If you then attempt to spin up agents in a cluster OTHER THAN the one you manually logged into from the command line, you will get a false positive on an expired token.. .specifically because some of the post authentication steps performed to maintain the build agent pods will use the default context (and credential) from the last kubectl login.
I have not walked through all of the 3 plugins' source, but this description should make it fairly easy for the authors/contributors to identify and locate the source of the anomaly.
- duplicates
-
JENKINS-70416 Kubernetes plugin uses controller service account instead of configured credentials
- Resolved