<p>I want to configure Jenkins sever to execute commands into Kubernetes. I created token using:</p>
<pre><code>kubectl create sa cicd

kubectl get sa,secret


cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: cicd
spec:
  serviceAccount: cicd
  containers:
  - image: nginx
    name: cicd
EOF


kubectl exec cicd -- cat /run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; echo

kubectl create token cicd

kubectl create token cicd --duration=999999h

kubectl create clusterrole cicd --verb=get,list --resource=namespaces
kubectl create clusterrolebinding cicd --clusterrole=cicd --serviceaccount=default:cicd


cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: cicd
  annotations:
    kubernetes.io/service-account.name: &quot;cicd&quot;
EOF


kubectl get sa,secret

kubectl describe secret cicd

kubectl describe sa cicd

kubectl get sa cicd -oyaml

kubectl get sa,secret
</code></pre>
<p>Test:</p>
<pre><code>curl -k  https://10.0.0.x:6443/api/v1/namespaces -H &quot;Authorization: Bearer &lt;.......&gt;&quot;
</code></pre>
<p>I copied this secrets file ~./kube/config</p>
<pre><code>apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: &lt;.....&gt;
    server: https://10.0.0.x:6443
  name: cluster.local
contexts:
- context:
    cluster: cluster.local
    user: grafana
  name: grafana
current-context: grafana
users:
- name: grafana
  user:
    token: &lt;.....&gt;
</code></pre>
<p>Jenkins configuration:</p>
<pre><code>pipeline {
    agent any
    stages {
        .......
        stage('helm deploy') {
            steps {
                script {
                    withKubeConfig([credentialsId: 'config_de']) {
                        ..........
                    }
                }            
            }
        }
    }
}
</code></pre>
<p>But I get error:</p>
<pre><code>Error: Kubernetes cluster unreachable: Get &quot;https://x.x.x.x:6443/version&quot;: tls: failed to verify certificate: x509: certificate is valid for 10.x.x.x, 10.x.x.x, 127.0.0.1, not x.x.x.x
</code></pre>
<p>Do you know how I have to configure the IP properly?</p>

Peter Penzov
<p>I would first check the Subject Alternative Name (SAN) details of a certificate using OpenSSL:</p>
<pre class="lang-bash prettyprint-override"><code>openssl s_client -connect 10.0.0.x:6443 -showcerts &lt;/dev/null 2&gt;/dev/null | \
openssl x509 -text -noout | \
awk '/X509v3 Subject Alternative Name:/{flag=1; next} /X509v3/{flag=0} flag'
</code></pre>
<p>After you have identified the SAN details, choose one of the IP addresses or DNS names listed in the SAN to be used in Jenkins. Make sure to update the <code>kubeconfig</code> file or any other Kubernetes configuration in Jenkins to use this address. Specifically, the <code>server</code> URL in the <code>kubeconfig</code> file under the <code>clusters</code> section should match one of the addresses or DNS names in the SAN.</p>
<p>For example, if your SAN shows <code>DNS:kubernetes, DNS:kubernetes.default, IP Address:10.x.x.x, IP Address:127.0.0.1</code>, then your <code>kubeconfig</code> might look like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: &lt;.....&gt;
    server: https://10.x.x.x:6443  # That IP should match one from the SAN
  name: cluster.local
</code></pre>
<p>Update this file and make sure Jenkins uses this updated <code>kubeconfig</code> in its pipeline configuration.</p>
<hr />
<pre class="lang-bash prettyprint-override"><code>rm /etc/kubernetes/pki/apiserver.* -f
kubeadm init phase certs apiserver --apiserver-cert-extra-sans 10.0.0.x \
     --apiserver-cert-extra-sans 10.233.0.x --apiserver-cert-extra-sans localhost
</code></pre>
<p>The solution of deleting the old certificate and creating a new one with <code>kubeadm</code> essentially replaces the Kubernetes API server's certificate with a new one that contains the additional Subject Alternative Names (SANs).</p>
<p>The command specifies these extra SANs with the <code>--apiserver-cert-extra-sans</code> flags. The new certificate will therefore be valid for connections originating from those IP addresses, in addition to any originally configured.</p>
<p>Once the new certificate is in place, update the <code>kubeconfig</code> file or any other Kubernetes configuration in Jenkins to match one of the addresses or DNS names in the new SAN list.</p>
<p>For example, your <code>kubeconfig</code> may look like:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Config
preferences: {}
clusters:
- cluster:
    certificate-authority-data: &lt;.....&gt;
    server: https://10.0.0.x:6443  # That IP should match one from the new SAN
  name: cluster.local
</code></pre>
<p>Update this file and ensure that Jenkins uses this updated <code>kubeconfig</code> in its pipeline configuration.</p>
