Add admin user for Jenkins to kubeadm kubernetes cluster

Question

I created a Kubernetes cluster for a single-master multi-node cluster using kubeadm following the official kubernetes guide:

Kubernetes cluster

I currently connect my laptop to the cluster via this command:

kubectl get nodes --username kubernetes-admin --kubeconfig ~/.kube/config

However, I now want to add a separate user (or same actual user but different name) for our Jenkins to run commands. I just want a separate username for access/logging purposes.

How can I easily add another "jenkins" username (possibly with its own cert) in the config file? Kubeadm automatically uses --authorization-mode=Node (or at least mine did)

Background info: Only people who may make any changes on our cluster currently have/need access, so I don't need to only give users access to certain namespaces etc. Also, keep in mind we will have a cluster per environment: dev, UAT, production, etc.

you can deploy jenkins using another namespace kindly follow this link : itnext.io/… — chintan thakar

Nicola Ben Nicola Ben · Accepted Answer · 2018-06-26T07:51:27

It's suitable to use Kubernetes serviceAccount and instruct your Jenkins deployment to use that account (with a bound Role):

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins


apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    app: jenkins
  name: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
  template:
    metadata:
      labels:
        app: jenkins
    spec:     
      serviceAccountName: jenkins

Add admin user for Jenkins to kubeadm kubernetes cluster

1 Answers