Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-70450

Kuberntes plugin will use the ~/kube/config file if present instead of the provided credential

XMLWordPrintable

      We have a multi cloud configuration with multiple pod templates per "cloud".
      On Jenkins masters where there is a ~/.kube/config file in the home directory of the service account running Jenkins, we were seeing multiple spurious warnings and errors in the Jenkins log to the effect of:

      ... Message: Unauthorized! Token may have expired! Please log-in again. Unauthorized.

      Not even the creation of brand new tokens would allow consistent connections.

      To recreate this, set up multiple cloud configurations with different service account tokens for login.  verify that each cloud is working properly first.

      Then from the command line perform a kubectl login to any one of the clusters with the service account token.  If you then attempt to spin up agents in a cluster OTHER THAN the one you manually logged into from the command line, you will get a false positive on an expired token.. .specifically because some of the post authentication steps performed to maintain the build agent pods will use the default context (and credential) from the last kubectl login.

      I have not walked through all of the 3 plugins' source, but this description should make it fairly easy for the authors/contributors to identify and locate the source of the anomaly.

            Unassigned Unassigned
            lfiorino Lou Fiorino
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: