<p>I created a Kubernetes cluster for a single-master multi-node cluster using kubeadm following the official kubernetes guide:</p>

<p><a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="nofollow noreferrer">Kubernetes cluster</a></p>

<p>I currently connect my laptop to the cluster via this command:</p>

<pre><code>kubectl get nodes --username kubernetes-admin --kubeconfig ~/.kube/config
</code></pre>

<p>However, I now want to add a separate user (or same actual user but different name) for our Jenkins to run commands. I just want a separate username for access/logging purposes. </p>

<p>How can I easily add another "jenkins" username (possibly with its own cert) in the config file? Kubeadm automatically uses <code>--authorization-mode=Node</code> (or at least mine did)</p>

<p>Background info: Only people who may make any changes on our cluster currently have/need access, so I don't need to only give users access to certain namespaces etc. Also, keep in mind we will have a cluster per environment: dev, UAT, production, etc.</p>

<p>It's suitable to use Kubernetes <code>serviceAccount</code> and instruct your Jenkins deployment to use that account (with a bound Role):</p>

<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins


apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: jenkins
  name: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
  template:
    metadata:
      labels:
        app: jenkins
    spec:     
      serviceAccountName: jenkins
</code></pre>
