{"action":"created","issue":{"url":"https://api.github.com/repos/helm/charts/issues/1092","repository_url":"https://api.github.com/repos/helm/charts","labels_url":"https://api.github.com/repos/helm/charts/issues/1092/labels{/name}","comments_url":"https://api.github.com/repos/helm/charts/issues/1092/comments","events_url":"https://api.github.com/repos/helm/charts/issues/1092/events","html_url":"https://github.com/helm/charts/issues/1092","id":229035099,"node_id":"MDU6SXNzdWUyMjkwMzUwOTk=","number":1092,"title":"Jenkins deployment with Kubernetes plugin does not have cluster access using RBAC","user":{"login":"carlosedp","id":20382,"node_id":"MDQ6VXNlcjIwMzgy","avatar_url":"https://avatars0.githubusercontent.com/u/20382?v=4","gravatar_id":"","url":"https://api.github.com/users/carlosedp","html_url":"https://github.com/carlosedp","followers_url":"https://api.github.com/users/carlosedp/followers","following_url":"https://api.github.com/users/carlosedp/following{/other_user}","gists_url":"https://api.github.com/users/carlosedp/gists{/gist_id}","starred_url":"https://api.github.com/users/carlosedp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carlosedp/subscriptions","organizations_url":"https://api.github.com/users/carlosedp/orgs","repos_url":"https://api.github.com/users/carlosedp/repos","events_url":"https://api.github.com/users/carlosedp/events{/privacy}","received_events_url":"https://api.github.com/users/carlosedp/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-05-16T13:34:42Z","updated_at":"2019-03-12T12:58:49Z","closed_at":"2017-06-29T19:51:59Z","author_association":"NONE","body":"I've deployed the Jenkins chart that comes bundled with the Jenkins Kubernetes plugin but the plugin needs cluster access to create it's test pods.\r\n\r\nSince the chart is deployed with the default serviceaccount, I need to grant full access to all serviceaccounts to the cluster with the command:\r\n\r\n`kubectl create clusterrolebinding permissive-binding --clusterrole=cluster-admin --user=admin --user=kubelet --group=system:serviceaccounts`\r\n\r\nIt would be better if Jenkins could be deployed with a specific account and grant the cluster-admin role just to it."},"comment":{"url":"https://api.github.com/repos/helm/charts/issues/comments/471989653","html_url":"https://github.com/helm/charts/issues/1092#issuecomment-471989653","issue_url":"https://api.github.com/repos/helm/charts/issues/1092","id":471989653,"node_id":"MDEyOklzc3VlQ29tbWVudDQ3MTk4OTY1Mw==","user":{"login":"stubbi","id":24454679,"node_id":"MDQ6VXNlcjI0NDU0Njc5","avatar_url":"https://avatars1.githubusercontent.com/u/24454679?v=4","gravatar_id":"","url":"https://api.github.com/users/stubbi","html_url":"https://github.com/stubbi","followers_url":"https://api.github.com/users/stubbi/followers","following_url":"https://api.github.com/users/stubbi/following{/other_user}","gists_url":"https://api.github.com/users/stubbi/gists{/gist_id}","starred_url":"https://api.github.com/users/stubbi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stubbi/subscriptions","organizations_url":"https://api.github.com/users/stubbi/orgs","repos_url":"https://api.github.com/users/stubbi/repos","events_url":"https://api.github.com/users/stubbi/events{/privacy}","received_events_url":"https://api.github.com/users/stubbi/received_events","type":"User","site_admin":false},"created_at":"2019-03-12T12:58:49Z","updated_at":"2019-03-12T12:58:49Z","author_association":"NONE","body":"Hi there!\r\n\r\nI just ran into the same issue. Trying to run a pipeline on the agents results in:\r\n\r\n> Still waiting to schedule task\r\nWaiting for next available executor\r\n\r\nin the Jenkins UI and\r\n\r\n`io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://kubernetes.default/api/v1/namespaces/jenkins/pods?labelSelector=jenkins%3Dslave. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User \"system:serviceaccount:jenkins:default\" cannot list pods in the namespace \"jenkins\". at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:478) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:415) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:381) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:344) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:328) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.listRequestHelper(BaseOperation.java:165) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:607) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:67) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.addProvisionedSlave(KubernetesCloud.java:505) at org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud.provision(KubernetesCloud.java:458) at hudson.slaves.NodeProvisioner$StandardStrategyImpl.apply(NodeProvisioner.java:715) at hudson.slaves.NodeProvisioner.update(NodeProvisioner.java:320) at hudson.slaves.NodeProvisioner.access$000(NodeProvisioner.java:61) at hudson.slaves.NodeProvisioner$NodeProvisionerInvoker.doRun(NodeProvisioner.java:809) at hudson.triggers.SafeTimerTask.run(SafeTimerTask.java:72) at jenkins.security.ImpersonatingScheduledExecutorService$1.run(ImpersonatingScheduledExecutorService.java:58) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748)`\r\n\r\nin the container logs.\r\n\r\nI will try to fix it with the solution suggested above.\r\n\r\nI wonder though that - as far as I understand this issue - everyone using the chart will run into it by default. Isn't it possible to overcome this issue by creating a (cluster)rolebinding for the jenkins account with the helm chart?"}}
{"actor":{"display_login":"stubbi"}}