<p>This assumes that the namespace is <code>devops-tools</code>.</p>
<h2>Creating an authentication token for an external Jenkins (ie. not deployed inside the kubernets cluster)</h2>
<ol>
<li>Create the serviceAccount<br />
<code>kubectl create serviceaccount jenkins -n devops-tools</code></li>
<li>Create the role yaml file:
<pre class="lang-yml prettyprint-override"><code> ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: jenkins
 rules:
 - apiGroups: [&quot;&quot;]
   resources: [&quot;pods&quot;]
   verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
 - apiGroups: [&quot;&quot;]
   resources: [&quot;pods/exec&quot;]
   verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
 - apiGroups: [&quot;&quot;]
   resources: [&quot;pods/log&quot;]
   verbs: [&quot;get&quot;,&quot;list&quot;,&quot;watch&quot;]
 - apiGroups: [&quot;&quot;]
   resources: [&quot;secrets&quot;]
   verbs: [&quot;get&quot;]
</code></pre>
</li>
<li>Apply the role:
<code>kubectl apply -f jenkins-role.yaml -n devops-tools</code></li>
<li>Create the role yaml file:
<pre class="lang-yml prettyprint-override"><code> ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: jenkins
   namespace: devops-tools
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: jenkins
 subjects:
 - kind: ServiceAccount
   name: jenkins
</code></pre>
</li>
<li>Apply the role:
<code>kubectl apply -f jenkins-rolebinding.yaml -n devops-tools</code></li>
<li>Create the token in the same namespace (you may have clashes in names - serviceaccoutns created in e.g. the <code>default</code> namespace):<br />
<code>kubectl create token jenkins -n devops-tools</code> (copy this jwt token)</li>
<li>Create a new credential in your external Jenkins of type <code>secret text</code> with the token as copied from the last step</li>
</ol>
<h2>Verification of the token</h2>
<p>The token is a JWT so you <em>can</em> base64-decode it or use <a href="https://jwt.io" rel="nofollow noreferrer">https://jwt.io</a> to verify it.</p>
<p>Here is a curl example (linux) to test it out (replace the namespace and url as appropriate):</p>
<pre class="lang-sh prettyprint-override"><code>export JENKINS_TOKEN=PASTE.TOKEN.HERE

curl --location --request GET 'https://localhost:6443/api/v1/namespaces/devops-tools/pods' \  
--header 'Authorization: Bearer $JENKINS_TOKEN'
</code></pre>
<h2>References</h2>
<ul>
<li><a href="https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster" rel="nofollow noreferrer">https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens</a></li>
</ul>

CC BY-SA 4.0
2023-01-17T19:48:42.843Z
2023-01-17T19:48:42.843Z
JoSSte
<p>I want to add a kubernetes cluster to an existing jenkins server (and migrate jobs from docker to kubernetes using named agents).</p>
<p>I set up the kubernetes cluster and added a serviceaccount like for a Jenkins instance running on the same kubernetes (which I find much easier to figure out).</p>
<p>#<a href="https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/kubernetes/service-account.yml" rel="nofollow noreferrer">service-account.yml</a></p>
<pre class="lang-yml prettyprint-override"><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jenkins
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/exec&quot;]
  verbs: [&quot;create&quot;,&quot;delete&quot;,&quot;get&quot;,&quot;list&quot;,&quot;patch&quot;,&quot;update&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/log&quot;]
  verbs: [&quot;get&quot;,&quot;list&quot;,&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;events&quot;]
  verbs: [&quot;watch&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;get&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins

</code></pre>
<p>I execute <code>kubectl create -f service-account.yml</code><br />
then<br />
<code>kubectl -n devops-tools create token jenkins-admin</code><br />
the output of which I copy to the relevant Jenkins credential</p>
<p>Then I set up a job and I always get 401 unauthorized. Do I need to add something else to the serviceaccount when i want to use the token from outside the cluster?</p>
<blockquote>
<p>Caused: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: <a href="https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods" rel="nofollow noreferrer">https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods</a>. Message: Unauthorized. Received status: Status(apiVersion=v1, code=401, details=null, kind=Status, message=Unauthorized, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Unauthorized, status=Failure, additionalProperties={}).</p>
</blockquote>

<kubernetes><jenkins>
Issue (401 unauthorized) adding kubernetes cluster to existing Jenkins server
JoSSte
# Issue (401 unauthorized) adding kubernetes cluster to existing Jenkins server

(Asked by: username_0 on 2023-01-16)

I want to add a kubernetes cluster to an existing jenkins server (and migrate jobs from docker to kubernetes using named agents).
I set up the kubernetes cluster and added a serviceaccount like for a Jenkins instance running on the same kubernetes (which I find much easier to figure out).
#service-account.yml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins


I execute kubectl create -f service-account.yml
then
kubectl -n devops-tools create token jenkins-admin
the output of which I copy to the relevant Jenkins credential
Then I set up a job and I always get 401 unauthorized. Do I need to add something else to the serviceaccount when i want to use the token from outside the cluster?

Caused: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://10.10.0.247:6443/api/v1/namespaces/devops-tools/pods. Message: Unauthorized. Received status: Status(apiVersion=v1, code=401, details=null, kind=Status, message=Unauthorized, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Unauthorized, status=Failure, additionalProperties={}).

**Tags:** kubernetes, jenkins


---

## 1 answers

### Answer by username_0 on 2023-01-17. Score: 0 | Accepted answer

This assumes that the namespace is devops-tools.
Creating an authentication token for an external Jenkins (ie. not deployed inside the kubernets cluster)

Create the serviceAccount
kubectl create serviceaccount jenkins -n devops-tools
Create the role yaml file:
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: jenkins
 rules:
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["create","delete","get","list","patch","update","watch"]
 - apiGroups: [""]
   resources: ["pods/exec"]
   verbs: ["create","delete","get","list","patch","update","watch"]
 - apiGroups: [""]
   resources: ["pods/log"]
   verbs: ["get","list","watch"]
 - apiGroups: [""]
   resources: ["secrets"]
   verbs: ["get"]


Apply the role:
kubectl apply -f jenkins-role.yaml -n devops-tools
Create the role yaml file:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: jenkins
   namespace: devops-tools
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: jenkins
 subjects:
 - kind: ServiceAccount
   name: jenkins


Apply the role:
kubectl apply -f jenkins-rolebinding.yaml -n devops-tools
Create the token in the same namespace (you may have clashes in names - serviceaccoutns created in e.g. the default namespace):
kubectl create token jenkins -n devops-tools (copy this jwt token)
Create a new credential in your external Jenkins of type secret text with the token as copied from the last step

Verification of the token
The token is a JWT so you can base64-decode it or use https://jwt.io to verify it.
Here is a curl example (linux) to test it out (replace the namespace and url as appropriate):
export JENKINS_TOKEN=PASTE.TOKEN.HERE

curl --location --request GET 'https://localhost:6443/api/v1/namespaces/devops-tools/pods' \  
--header 'Authorization: Bearer $JENKINS_TOKEN'

References

https://docs.cloudbees.com/docs/cloudbees-ci-kb/latest/client-and-managed-masters/kubernetes-plugin-authenitcation-to-a-remote-kubernetes-cluster
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#service-account-tokens


---

