Jenkins has insufficient RBAC permissions

[Nuru]

Expected Behavior

Jenkins is given all needed RBAC permissions

Actual Behavior

Jenkins log indicates an error while launching remote agent using Kubernetes plugin

io.fabric8.kubernetes.client.KubernetesClientException: events is forbidden: User "system:serviceaccount:jenkins:jenkins-operator-jenkins" cannot watch resource "events" in API group "" in the namespace "jenkins"

Steps to Reproduce the Problem

1. Deploy Jenkins 2.222.3 with kubernetes-operator v0.4.0 using helm chart 0.2.0 onto Kuberentes 1.15.11
2. Configure Jenkins to use remote Kubernetes pods as agents, following directions here
3. See build executor pod launch, Jenkins issues error message shown above.

[tomaszsek]

Hi @Nuru,

By default operator configures the Jenkins Kubernetes plugin for you and it should work out of the box. This is https://itnext.io/utilize-jenkins-in-an-auto-scaling-kubernetes-deployment-on-amazon-eks-with-spot-instances-f9159df00aee#6074 configured by the operator.

What version of the Kubernetes plugin did you use? I think the new version may require more permissions. By default Jenkins master have the permissions described here.

Cheers

[Nuru]

@tomaszsek I used the Kubernetes plugin that was installed automatically (I did not specify the plugin at all), which was version 1.25.2.

I certainly agree it should "work out of the box", but it didn't, which is why I opened this issue. The link you provided showing the Jenkins master permissions does not include the permission in question, which is "watch" on "events".

[tomaszsek]

I've reproduced the error but even with io.fabric8.kubernetes.client.KubernetesClientException: events is forbidden: User "system:serviceaccount:jenkins:jenkins-operator-jenkins" cannot watch resource "events" in API group "" in the namespace "jenkins" in Jenkins logs I was able to run the job successfully.

If you still can't run a job with Kubernetes plugin I think the problem is somewhere else. We will try to narrow the issue. The full logs from the job run and Jenkins might be very useful.

[Nuru]

Yes, there were other issues preventing the agent launch. Jenkins can launch agents without this permission, but I think it fails at monitoring them in some way, like detecting that new agents have launched before they check in.

[bainss]

@tomaszsek @akram
I believe the fix applied here to rbac.go should also fix the helm pod creation problems I have #424

Is there a timeline for when these fixes will make it to a release?

[JTarball]

Any updates on timelines?

[tomaszsek]

Fixed in https://github.com/jenkinsci/kubernetes-operator/releases/tag/v0.5.0