<p>I've bootstrapped with kubeadm Kubernetes 1.9 RBAC cluster and I've started inside a POD Jenkins based on jenkins/jenkins:lts. I would like to try out <a href="https://github.com/jenkinsci/kubernetes-plugin" rel="noreferrer">https://github.com/jenkinsci/kubernetes-plugin</a> . 
I have already created a serviceaccount based on the proposal in <a href="https://gist.github.com/lachie83/17c1fff4eb58cf75c5fb11a4957a64d2" rel="noreferrer">https://gist.github.com/lachie83/17c1fff4eb58cf75c5fb11a4957a64d2</a> </p>

<pre><code>&gt; kubectl -n dev-infra create sa jenkins
&gt; kubectl create clusterrolebinding jenkins --clusterrole cluster-admin --serviceaccount=dev-infra:jenkins
&gt; kubectl -n dev-infra get sa jenkins -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-02-16T12:06:26Z
  name: jenkins
  namespace: dev-infra
  resourceVersion: "1295580"
  selfLink: /api/v1/namespaces/dev-infra/serviceaccounts/jenkins
  uid: d040041c-1311-11e8-a4f8-005056039a14
secrets:
- name: jenkins-token-vmt79

&gt; kubectl -n dev-infra get secret jenkins-token-vmt79 -o yaml
apiVersion: v1
data:
  ca.crt: LS0tL...0tLQo=
  namespace: ZGV2LWluZnJh
  token: ZXlK...tdVE=
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: jenkins
    kubernetes.io/service-account.uid: d040041c-1311-11e8-a4f8-005056039a14
  creationTimestamp: 2018-02-16T12:06:26Z
  name: jenkins-token-vmt79
  namespace: dev-infra
  resourceVersion: "1295579"
  selfLink: /api/v1/namespaces/dev-infra/secrets/jenkins-token-vmt79
  uid: d041fa6c-1311-11e8-a4f8-005056039a14
type: kubernetes.io/service-account-token
</code></pre>

<p>After that I go to Manage Jenkins -> Configure System -> Cloud -> Kubernetes and set the Kubernetes URL to the Cluster API that I use also in my kubectl KUBECONFIG server: url:port.</p>

<p>When I hit test connection I get "Error testing connection <a href="https://url:port" rel="noreferrer">https://url:port</a>: Failure executing: GET at: <a href="https://url:port/api/v1/namespaces/dev-infra/pods" rel="noreferrer">https://url:port/api/v1/namespaces/dev-infra/pods</a>. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:dev-infra:default" cannot list pods in the namespace "dev-infra".</p>

<p>I don't want to give to the dev-infra:default user a cluster-admin role and I want to use the jenkins sa I created. I can't understand how to configure the credentials in Jenkins. When I hit add credentials on the <a href="https://github.com/jenkinsci/kubernetes-plugin/blob/master/configuration.png" rel="noreferrer">https://github.com/jenkinsci/kubernetes-plugin/blob/master/configuration.png</a> I get </p>

<pre><code>&lt;select class="setting-input dropdownList"&gt;
&lt;option value="0"&gt;Username with password&lt;/option&gt;
&lt;option value="1"&gt;Docker Host Certificate Authentication&lt;/option&gt;
&lt;option value="2"&gt;Kubernetes Service Account&lt;/option&gt;
&lt;option value="3"&gt;OpenShift OAuth token&lt;/option&gt;
&lt;option value="4"&gt;OpenShift Username and Password&lt;/option&gt;
&lt;option value="5"&gt;SSH Username with private key&lt;/option&gt;
&lt;option value="6"&gt;Secret file&lt;/option&gt;
&lt;option value="7"&gt;Secret text&lt;/option&gt;
&lt;option value="8"&gt;Certificate&lt;/option&gt;&lt;/select&gt;
</code></pre>

<p>I could not find a clear example how to configure Jenkins Kubernetes Cloud connector to use my Jenkins to authenticate with service account jenkins. 
Could you please help me to find step-by-step guide - what kind of of credentials I need? </p>

<p>Regards,
Pavel</p>

<p>The best practice is to launch you Jenkins master pod with the <code>serviceaccount</code> you created, instead of creating credentials in Jenkins</p>

<p><a href="https://github.com/jenkinsci/kubernetes-plugin/blob/fc40c869edfd9e3904a9a56b0f80c5a25e988fa1/src/main/kubernetes/jenkins.yml#L22" rel="noreferrer">See example yaml</a></p>
