-
New Feature
-
Resolution: Unresolved
-
Major
-
latest versions of jenkins and kubernetes plugin
We use the jenkins cloudbees folder plugin to give a jenkins space per software team. They also store their own credentials in their own scoped folder. With the kubernetes plugin we would like to give each software team their own configured cloud, while using their own folder scoped credential to be used with the configured cloud
With the Kubernetes plugin the cloud configuration is stored globally, and thus also the credential. This means that scoped software teams could possibly read/misuse each other credential ID's which is bad from security perspective.
We programmatically tried changing the credential ID (using groovy) to a folder scoped credential, however this was not allowed as the routine assumes the credential is in the global credential store because of default context being set here
https://github.com/jenkinsci/kubernetes-plugin/blob/4296.v20a_7e4d77cf6/src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubernetesFactoryAdapter.java#L126
And eventually being used here
https://github.com/jenkinsci/kubernetes-plugin/blob/4296.v20a_7e4d77cf6/src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubernetesFactoryAdapter.java#L285
So it would be nice to store the cloud configuration without a credential (which is already possible), and then dynamically inject the credentialsId on the spot, which also provides the right folder context (from the job). Such a declarative pipeline would look something like this:
pipeline { agent { kubernetes { cloud 'team-a-cloud' credentialsId 'team-a-credential-id' yamlFile 'KubernetesPod.yaml' } } // ... stages, etc }
The credentialId and context should NOT be stored in the Cloud object as these values are temporary and only applicable for this job.