Answers: <p>This assumes that the namespace is <code>devops-tools</code>.</p>
  <h2>Creating an authentication token for an external Jenkins (ie. not deployed inside the kubernets cluster)</h2>
  <ol>
  <li>Create the serviceAccount<br />
  <code>kubectl create serviceaccount jenkins -n devops-tools</code></li>
  <li>Create the role yaml file:
  <pre class="lang-yml prettyprint-override"><code> ---
   kind: Role
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: jenkins
   rules:
   - apiGroups: [&quot;&quot;]
     resources: [&quot;pods&quot;]
     verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
   - apiGroups: [&quot;&quot;]
     resources: [&quot;pods/exec&quot;]
     verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
   - apiGroups: [&quot;&quot;]
     resources: [&quot;pods/log&quot;]
     verbs: [&quot;get&quot;,&quot;list&quot;,&quot;watch&quot;]
   - apiGroups: [&quot;&quot;]
     resources: [&quot;secrets&quot;]
     verbs: [&quot;get&quot;]
  </code></pre>
  </li>
  <li>Apply the role:
  <code>kubectl apply -f jenkins-role.yaml -n devops-tools</code></li>
  <li>Create the role yaml file:
  <pre class="lang-yml prettyprint-override"><code> ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: jenkins
     namespace: devops-tools
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: Role
     name: jenkins
   subjects:
   - kind: ServiceAccount
     name: jenkins
  </code></pre>
  </li>
  <li>Apply the role:
  <code>kubectl apply -f jenkins-rolebinding.yaml -n devops-tools</code></li>
  <li>Create the token in the same namespace (you may have clashes in names - serviceaccoutns created in e.g. the <code>default</code> namespace):<br />
  <code>kubectl create token jenkins -n devops-tools</code> (copy this jwt token)</li>
  <li>Create a new credential in your external Jenkins of type <code>secret text</code> with the token as copied from the last step</li>
  </ol>
  <h2>Verification of the token</h2>
  <p>The token is a JWT so you <em>can</em> base64-decode it or use <a href="https://jwt.io" rel="nofollow noreferrer">https://jwt.io</a> to verify it.</p>
  <p>Here is a curl example (linux) to test it out (replace the namespace and url as appropriate):</p>
  <pre class="lang-sh prettyprint-override"><code>export JENKINS_TOKEN=PASTE.TOKEN.HERE
  
  curl --location --request GET 'https://localhost:6443/api/v1/namespaces/devops-tools/pods' \  
  --header 'Authorization: Bearer $JENKINS_TOKEN'
  </code></pre>
  <h2>References</h2>
  <ul>
  <li><a href="https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster" rel="nofollow noreferrer">https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster</a></li>
  <li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens</a></li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2023-01-17T19:48:42.843Z
Answers: 2023-01-17T19:48:42.843Z
Answers: JoSSte
Body: <p>I want to add a kubernetes cluster to an existing jenkins server (and migrate jobs from docker to kubernetes using named agents).</p>
  <p>I set up the kubernetes cluster and added a serviceaccount like for a Jenkins instance running on the same kubernetes (which I find much easier to figure out).</p>
  <p>#<a href="https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml" rel="nofollow noreferrer">service-account.yml</a></p>
  <pre class="lang-yml prettyprint-override"><code>---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: jenkins
  
  ---
  kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: jenkins
  rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pods&quot;]
    verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pods/exec&quot;]
    verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;pods/log&quot;]
    verbs: [&quot;get&quot;,&quot;list&quot;,&quot;watch&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;events&quot;]
    verbs: [&quot;watch&quot;]
  - apiGroups: [&quot;&quot;]
    resources: [&quot;secrets&quot;]
    verbs: [&quot;get&quot;]
  
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: jenkins
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: jenkins
  subjects:
  - kind: ServiceAccount
    name: jenkins
  
  </code></pre>
  <p>I execute <code>kubectl create -f service-account.yml</code><br />
  then<br />
  <code>kubectl -n devops-tools create token jenkins-admin</code><br />
  the output of which I copy to the relevant Jenkins credential</p>
  <p>Then I set up a job and I always get 401 unauthorized. Do I need to add something else to the serviceaccount when i want to use the token from outside the cluster?</p>
  <blockquote>
  <p>Caused: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: <a href="https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods" rel="nofollow noreferrer">https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods</a>. Message: Unauthorized. Received status: Status(apiVersion=v1, code=401, details=null, kind=Status, message=Unauthorized, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Unauthorized, status=Failure, additionalProperties={}).</p>
  </blockquote>
  
Tags: <kubernetes><jenkins>
Title: Issue (401 unauthorized) adding kubernetes cluster to existing Jenkins server
UserDisplayName: JoSSte
ThreadText: # Issue (401 unauthorized) adding kubernetes cluster to existing Jenkins server
  
  (Asked by: username_0 on 2023-01-16)
  
  I want to add a kubernetes cluster to an existing jenkins server (and migrate jobs from docker to kubernetes using named agents).
  
  I set up the kubernetes cluster and added a serviceaccount like for a Jenkins instance running on the same kubernetes (which I find much easier to figure out).
  
  #[service-account.yml](https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml)
  
  ```yml
  ---
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: jenkins
  
  ---
  kind: Role
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: jenkins
  rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get","list","watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
  
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: jenkins
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: jenkins
  subjects:
  - kind: ServiceAccount
    name: jenkins
  
  ```
  
  I execute `kubectl create -f service-account.yml`  
  then  
  `kubectl -n devops-tools create token jenkins-admin`  
  the output of which I copy to the relevant Jenkins credential
  
  Then I set up a job and I always get 401 unauthorized. Do I need to add something else to the serviceaccount when i want to use the token from outside the cluster?
  
  > Caused: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: <https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods>. Message: Unauthorized. Received status: Status(apiVersion=v1, code=401, details=null, kind=Status, message=Unauthorized, metadata=ListMeta(\_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Unauthorized, status=Failure, additionalProperties={}).
  
  **Tags:** kubernetes, jenkins
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-01-17. Score: 0 | Accepted answer
  
  This assumes that the namespace is `devops-tools`.
  
  ## Creating an authentication token for an external Jenkins (ie. not deployed inside the kubernets cluster)
  
  1. Create the serviceAccount  
     `kubectl create serviceaccount jenkins -n devops-tools`
  2. Create the role yaml file:
  
     ```yml
      ---
      kind: Role
      apiVersion: rbac.authorization.k8s.io/v1
      metadata:
        name: jenkins
      rules:
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["create","delete","get","list","patch","update","watch"]
      - apiGroups: [""]
        resources: ["pods/exec"]
        verbs: ["create","delete","get","list","patch","update","watch"]
      - apiGroups: [""]
        resources: ["pods/log"]
        verbs: ["get","list","watch"]
      - apiGroups: [""]
        resources: ["secrets"]
        verbs: ["get"]
  
     ```
  3. Apply the role:
     `kubectl apply -f jenkins-role.yaml -n devops-tools`
  4. Create the role yaml file:
  
     ```yml
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: jenkins
        namespace: devops-tools
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: jenkins
      subjects:
      - kind: ServiceAccount
        name: jenkins
  
     ```
  5. Apply the role:
     `kubectl apply -f jenkins-rolebinding.yaml -n devops-tools`
  6. Create the token in the same namespace (you may have clashes in names - serviceaccoutns created in e.g. the `default` namespace):  
     `kubectl create token jenkins -n devops-tools` (copy this jwt token)
  7. Create a new credential in your external Jenkins of type `secret text` with the token as copied from the last step
  
  ## Verification of the token
  
  The token is a JWT so you *can* base64-decode it or use <https://jwt.io> to verify it.
  
  Here is a curl example (linux) to test it out (replace the namespace and url as appropriate):
  
  ```sh
  export JENKINS_TOKEN=PASTE.TOKEN.HERE
  
  curl --location --request GET 'https://localhost:6443/api/v1/namespaces/devops-tools/pods' \  
  --header 'Authorization: Bearer $JENKINS_TOKEN'
  
  ```
  
  ## References
  
  * <https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster>
  * <https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens>
  
  
  ---
  
  