[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV edited a comment on JENKINS-57352
Re: Test connection fails and also unable to get K8s pods via Jenkins using service account
Using GKE kubernetes.Service account is created and its roles are were applied as defined in the https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml.But test connection still throws the error:{code}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized.{code}
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1637.1557759540139%40Atlassian.JIRA.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV edited a comment on JENKINS-57352
Re: Test connection fails and also unable to get K8s pods via Jenkins using service account
Using GKE kubernetes . Service account is created and its roles are applied as defined in the https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml.But test connection still throws the error:{code}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized.{code}
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1446.1557753600107%40Atlassian.JIRA.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV updated an issue
Jenkins / JENKINS-57352
Test connection fails and also unable to get K8s pods via Jenkins using service account
Change By:
Harsha GV
Comment:
Service account is created and its roles are applied as defined in the https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml.But test connection still throws the error:{code}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized.{code}
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1442.1557753540213%40Atlassian.JIRA.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV edited a comment on JENKINS-57352
Re: Test connection fails and also unable to get K8s pods via Jenkins using service account
GKE kubernetesService account is created and its roles are applied as defined in the https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml.But test connection still throws the error:{code}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized.{code}
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1444.1557753540242%40Atlassian.JIRA.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV commented on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account Service account is created and its roles are applied as defined in the https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml. But test connection still throws the error: Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Unauthorized! Configured service account doesn't have access. Service account may have been revoked. Unauthorized. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1243.1557750240261%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV commented on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account GKE kubernetes Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.1218.1557746460240%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV commented on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account K8s: Client v1.11.5 Server v1.13.5 Jenkins deployed in K8s. Also could you please point me to any documentation to get the minimum roles and rolebindings needs to be assigned to a Jenkins service account - used by k8s plugin to to dynamically provision a Jenkins agent, run a single build, then tear-down that agent? Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.22208.1557416040574%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV edited a comment on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account K8s: Client v1.11.5Server v1.13.5Jenkins deployed in K8s. And also could you please point me to any documentation to get the minimum roles and rolebindings needs to be assigned to a Jenkins service account - used by k8s plugin to to dynamically provision a Jenkins agent, run a single build, then tear-down that agent. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.22202.1557416040477%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV updated an issue Jenkins / JENKINS-57352 Test connection fails and also unable to get K8s pods via Jenkins using service account Change By: Harsha GV Comment: K8s: Client v1.11.5Server v1.13.5Jenkins deployed in K8s.And also could you please point me to any documentation to get the minimum roles and rolebindings needs to be assigned to a Jenkins service account - used by k8s plugin to to dynamically provision a Jenkins agent, run a single build, then tear-down that agent. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.22206.1557416040552%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV commented on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account K8s: Client v1.11.5 Server v1.13.5 Jenkins deployed in K8s. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.22182.1557415680091%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV commented on JENKINS-57352 Re: Test connection fails and also unable to get K8s pods via Jenkins using service account Using secret text by adding token string of service account Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199130.1557226492000.20930.1557339300098%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV updated an issue
Jenkins / JENKINS-57352
Test connection fails and also unable to get K8s pods via Jenkins using service account
Change By:
Harsha GV
*PS: Jenkins is deployed in K8s and not using openshift [do not intend to]*Provisioning of K8s pods from Kubernetes Jenkins plugin using the my cloud credentials is failing, hence created service account using below command:{code:java}kubectl -n mynamespace create serviceaccount jenkins{code}Then after selecting service account authentication credentials tried Test Connection from *_Test Connection_* in K8s-plugin cloud configuration page , but connection failed with below error:{code:java}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:mynamespace:default" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:serviceaccount:mynamespace:default.{code}Also when jenkins triggered to run in labeled k8s pods, fails with below error:{code:java}Failed to count the # of live instances on Kubernetesio.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods?labelSelector=jenkins%3Dslave. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:anonymous" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:anonymous. at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:472) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:409) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:381) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:344) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:328) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:584) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:49) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.addProvisionedSlave(KubernetesCloud.java:493) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.provision(KubernetesCloud.java:448) at hudson.slaves.NodeProvisioner$StandardStrategyImpl.apply(NodeProvisioner.java:715) at hudson.slaves.NodeProvisioner.update(NodeProvisioner.java:320) at hudson.slaves.NodeProvisioner.access$000(NodeProvisioner.java:61) at hudson.slaves.NodeProvisioner$NodeProvisionerInvoker.doRun(NodeProvisioner.java:809) at hudson.triggers.SafeTimerTask.run(SafeTimerTask.java:72) at jenkins.security.ImpersonatingScheduledExecutorS
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV updated an issue
Jenkins / JENKINS-57352
Test connection fails and also unable to get K8s pods via Jenkins using service account
Change By:
Harsha GV
*PS: Jenkins is deployed in K8s and not using openshift [doe not intend to]* Provisioning of K8s pods from Kubernetes Jenkins plugin using the my cloud credentials is failing, hence created service account using below command: PS: Jenkins is deployed in K8s {code :java }kubectl -n mynamespace create serviceaccount jenkins{code} Then tried Test Connection from K8s-plugin, but connection failed with below error:{code :java }Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:mynamespace:default" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:serviceaccount:mynamespace:default.{code} Also when jenkins triggered to run in labeled k8s pods, fails with below error:{code :java }Failed to count the # of live instances on Kubernetesio.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods?labelSelector=jenkins%3Dslave. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:anonymous" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:anonymous. at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:472) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:409) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:381) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:344) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:328) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:584) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:49) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.addProvisionedSlave(KubernetesCloud.java:493) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.provision(KubernetesCloud.java:448) at hudson.slaves.NodeProvisioner$StandardStrategyImpl.apply(NodeProvisioner.java:715) at hudson.slaves.NodeProvisioner.update(NodeProvisioner.java:320) at hudson.slaves.NodeProvisioner.access$000(NodeProvisioner.java:61) at hudson.slaves.NodeProvisioner$NodeProvisionerInvoker.doRun(NodeProvisioner.java:809) at hudson.triggers.SafeTimerTask.run(SafeTimerTask.java:72) at jenkins.security.ImpersonatingScheduledExecutorService$1.run(ImpersonatingScheduledExecutorService.java:58) at java.u
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title
Harsha GV updated an issue
Jenkins / JENKINS-57352
Test connection fails and also unable to get K8s pods via Jenkins using service account
Change By:
Harsha GV
*PS: Jenkins is deployed in K8s and not using openshift [ doe do not intend to]*Provisioning of K8s pods from Kubernetes Jenkins plugin using the my cloud credentials is failing, hence created service account using below command:{code:java}kubectl -n mynamespace create serviceaccount jenkins{code}Then tried Test Connection from K8s-plugin, but connection failed with below error:{code:java}Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:mynamespace:default" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:serviceaccount:mynamespace:default.{code}Also when jenkins triggered to run in labeled k8s pods, fails with below error:{code:java}Failed to count the # of live instances on Kubernetesio.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods?labelSelector=jenkins%3Dslave. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:anonymous" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpected user-id: system:anonymous. at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:472) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:409) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:381) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:344) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:328) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:584) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:49) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.addProvisionedSlave(KubernetesCloud.java:493) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.provision(KubernetesCloud.java:448) at hudson.slaves.NodeProvisioner$StandardStrategyImpl.apply(NodeProvisioner.java:715) at hudson.slaves.NodeProvisioner.update(NodeProvisioner.java:320) at hudson.slaves.NodeProvisioner.access$000(NodeProvisioner.java:61) at hudson.slaves.NodeProvisioner$NodeProvisionerInvoker.doRun(NodeProvisioner.java:809) at hudson.triggers.SafeTimerTask.run(SafeTimerTask.java:72) at jenkins.security.ImpersonatingScheduledExecutorService$1.run(ImpersonatingScheduledExecutorService.java:58) at java.util.concurrent.Executors$RunnableAdapte
[JIRA] (JENKINS-57352) Test connection fails and also unable to get K8s pods via Jenkins using service account
Title: Message Title Harsha GV created an issue Jenkins / JENKINS-57352 Test connection fails and also unable to get K8s pods via Jenkins using service account Issue Type: Bug Assignee: Carlos Sanchez Components: kubernetes-plugin Created: 2019-05-07 10:54 Environment: Jenkins in K8s Labels: kubernetes kubernetes-plugin Priority: Minor Reporter: Harsha GV Provisioning of K8s pods from Kubernetes Jenkins plugin using the my cloud credentials is failing, hence created service account using below command: PS: Jenkins is deployed in K8s kubectl -n mynamespace create serviceaccount jenkins Then tried Test Connection from K8s-plugin, but connection failed with below error: Error testing connection https://api.k8s2.apac.cloud.net:6443: Failure executing: GET at: https://api.k8s2.apac.cloud.net:6443/api/v1/namespaces/mynamespace/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:mynamespace:default" cannot list resource "pods" in API group "" in the namespace "mynamespace": Unexpect
