<p>I have a brand new Kubernetes v1.8 cluster with two nodes (RBAC enabled). Jenkins is deployed as a StatefulSet and recommended ServiceAccount/Role and RoleBindings were created as well (<a href="https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/kubernetes" rel="nofollow noreferrer">from here</a>). Cluster info:</p>

<pre><code>$ kubectl cluster-info
Kubernetes master is running at https://10.182.255.35:6443
</code></pre>

<p>When I'm trying to set up Kubernetes cloud in Jenkins settings I'm getting an error 403 (Forbidden). I followed pugin guide and created 'Kubernetes Service Account' credentials in Jenkins and trying to configure new cloud. <a href="https://i.stack.imgur.com/VCsQi.png" rel="nofollow noreferrer">Jenkins configuration screenshot</a>. Here is the debug log from plugin:</p>

<pre><code>Nov 02, 2017 7:40:57 PM FINE org.csanchez.jenkins.plugins.kubernetes.KubernetesFactoryAdapter
Creating Kubernetes client: KubernetesFactoryAdapter [serviceAddress=https://10.182.255.35:6443, namespace=default, caCertData=null, credentials=org.csanchez.jenkins.plugins.kubernetes.ServiceAccountCredential@99ee54b6, skipTlsVerify=true, connectTimeout=0, readTimeout=0]
Nov 02, 2017 7:40:57 PM FINE org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud
Error connecting to https://10.182.255.35:6443
java.io.IOException: Unexpected response code for CONNECT: 403
  at okhttp3.internal.connection.RealConnection.createTunnel(RealConnection.java:371)
  ...(skipped)
  at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:605)
Caused: io.fabric8.kubernetes.client.KubernetesClientException: Operation: [list]  for kind: [Pod]  with name: [null]  in namespace: [default]  failed.
  at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:62)
  ...(skipped)
</code></pre>

<p>At the same time if I try to make an API call using this serviceAccount from the pod, it's working:</p>

<pre><code>$ kubectl exec -ti jenkins-0 bash (ssh into the pod)
bash-4.3$ KUBE_TOKEN=$(&lt;/var/run/secrets/kubernetes.io/serviceaccount/token)
bash-4.3$ curl -sSk -H "Authorization: Bearer $KUBE_TOKEN" 
https://10.182.255.35:6443/api/v1/namespaces/default/pods
{
  "kind": "PodList",
  "apiVersion": "v1",
  "metadata": {
    "selfLink": "/api/v1/namespaces/default/pods",
    "resourceVersion": "90645"
  },
  "items": [
    {
    ...(skipped)
</code></pre>

<p>Answering my own question: the problem was with my proxy settings. You need to specify instance IP in no_proxy environment variable during cluster setup.</p>
