<p>Am new to kubernetes and trying out Jenkins kubernetes plugin. I have created a K8s cluster and namespace called jenkins-pl in AWS. Below are my Jenkins deployment and service yaml files:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: jenkins
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      containers:
        - name: jenkins
          image: contactsai123/my-jenkins-image:1.0
          env:
            - name: JAVA_OPTS
              value: -Djenkins.install.runSetupWizard=false
          ports:
            - name: http-port
              containerPort: 8080
            - name: jnlp-port
              containerPort: 50000
          volumeMounts:
            - name: jenkins-home
              mountPath: /var/jenkins_home
      volumes:
        - name: jenkins-home
          emptyDir: {}
</code></pre>

<p>Here is my <code>jenkins-service.yaml</code> file</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: jenkins
spec:
  type: LoadBalancer
  ports:
    - port: 8080
      targetPort: 8080
  selector:
    app: jenkins
</code></pre>

<p>Am able to launch Jenkins successfully, am unsure on what should I provide in kubernetes URL. </p>

<p>I gave "<a href="https://kubernetes.default.svc.cluster.local" rel="nofollow noreferrer">https://kubernetes.default.svc.cluster.local</a>" and get the error message:</p>

<pre><code>Error testing connection https://kubernetes.default.svc.cluster.local: Failure executing: GET at: https://kubernetes.default.svc.cluster.local/api/v1/namespaces/jenkins-pl/pods. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. pods is forbidden: User "system:serviceaccount:jenkins-pl:default" cannot list pods in the namespace "jenkins-pl".
</code></pre>

<p>I executed the command:</p>

<pre><code> $ kubectl cluster-info | grep master
</code></pre>

<p>and got the following output:</p>

<pre><code> https://api-selegrid-k8s-loca-m23tbb-1891259367.us-west-2.elb.amazonaws.com
</code></pre>

<p>I provided the above in Kubernetes URL, for which I get the similar error as before.</p>

<p>Not sure how to move forward?</p>

Sai
<p>Your cluster has RBAC enabled. You have to give your deployment necessary RBAC permission to list pods.</p>

<p>Consider your deployment as a user who need to perform some task in your cluster. So, you have to provide it necessary permission.</p>

<p>At first you have to create a role. It could be <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">ClusterRole or Role</a>.
This role define what can be done under this role. A ClusterRole give permission to do some task in cluster scope where Role give  permission only in a particular namespace.</p>

<p>Then, you have to create a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">Service Account</a>. Consider service account as a user. It is for application instead of a person.</p>

<p>Finally, you have to bind Role or ClusterRole to the service account through <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">RoleBinding or ClusterRoleBinding</a>. This actually tell that which user/service can access permissions defined under which roles.</p>

<p>Check this nice post to understand RBAC: <a href="https://medium.com/containerum/configuring-permissions-in-kubernetes-with-rbac-a456a9717d5d" rel="nofollow noreferrer">Configuring permissions in Kubernetes with RBAC</a></p>

<p>Also this video might help you to understand the basics: <a href="https://www.youtube.com/watch?v=BLktpM--0jA" rel="nofollow noreferrer">Role Based Access Control (RBAC) with Kubernetes</a></p>
