jenkins 用户认证token的方式连接k8s

helm install my \
  --set jenkinsUser=admin \
  --set jenkinsPassword=123qweasd \
  --set persistence.enabled=true \
  --set persistence.storageClass="openebs-hostpath" \
  --set persistence.size=5Gi \
  bitnami/jenkins

• rbac授权
  Jenkins通过kubernetes-plugin对k8s进行操作，需要在k8s内提前进行rbac授权。为方便管理，我们为其绑定cluster-admin角色。当然也可以进一步缩小使用权限。

创建serviceaccounts

kubectl create sa jenkins

对jenkins做cluster-admin绑定

kubectl create clusterrolebinding jenkins --clusterrole cluster-admin --serviceaccount=default:jenkins

kubernetes-plugin与k8s连接时，并不是直接使用serviceaccount，而是通过token。因此我们需要获取serviceaccount:jenkins对应的token。

1.查看sa

[root@master128 ~]# kubectl get sa -n default
NAME      SECRETS   AGE
default   1         2d3h
jenkins   1         16s

2.查看secret

[root@master128 ~]# kubectl describe sa jenkins -n default
Name:                jenkins
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   jenkins-token-kg4h8
Tokens:              jenkins-token-kg4h8
Events:              <none>

3.获取token

[root@master128 ~]# kubectl describe secrets jenkins-token-kg4h8 -n default
Name:         jenkins-token-kg4h8
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: jenkins
              kubernetes.io/service-account.uid: faf7c2da-cb76-4aca-bc3e-202b2b19b258

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1099 bytes
namespace:  7 bytes
token: eyJhbGciOiJS ####这里就是所需的token

jenkins配置