Added documentation for running on EKS

[mrferos]

Hi,

I went through an exercise finding this fix to my issue with authentication in EKS and noticed there were notes for other cloud k8s providers in the README and thought it'd be helpful to make note of this caveat as well.

[jglick]

This is only relevant if the Jenkins master is not running in the cluster using a service account, which I would expect to be the most common mode. That should be made clearer.

Please also read, and refer to, JENKINS-58143 which discusses this flag. Ideally no such tricks would be necessary. The Kubernetes client we use does support exec authentication such as is needed to use aws-iam-authenticator automatically from your kubeconfig, but last I checked it does not yet support automatic reauthentication after token expiry the way the Golang client does (for example).

[mrferos]

Ah, I added the docs in the wrong place then. In our use case, the Jenkins master is running an on EC2 instances out of k8s.

I added this particular bit of documentation because, while it does initially authenticate using the aws-iam-authenticator correctly it does not re-authenticate later (as you stated it would not), however, setting the client cache expiry to something short seems to make it create a new client and thus reauthing.

[mrferos]

Good suggestion @Vlatombe, updated!

[guysoft]

Hey, I am not sure from this side note how you actually set up aws-iam-authenticator. Do I need it installed on the jenkins master? What do you set inside the configure tab in Jenkins? This information is missing.

[mrferos]

Hey, I am not sure from this side note how you actually set up aws-iam-authenticator. Do I need it installed on the jenkins master? What do you set inside the configure tab in Jenkins? This information is missing.

Good catch @guysoft and it's easy to get going:

1. You do need the aws-iam-authenticator installed somewhere in jenkin's $PATH
2. Create a jenkins secret file with a kubeconfig yaml like this one
   important: note the env section where you can specify the AWS API credentials - that will be used by the aws-iam-authenticator when it goes to create the auth token.

After that when you go to configure the cluster in jenkins settings, you should just be able to select the secret file for the credentials section and hit test connection and be good to go.

Don't forget to set the jenkins tunnel IP if your jenkins install is behind a proxy!

[shamsalmon]

i am running jenkins in docker and get nothing but this

Caused: java.io.IOException: Cannot run program "aws-iam-authenticator": error=2, No such file or directory

Anyone seem this before? It doesnt work even if I specify absolute path and permissions are fine

Edit: This was caused by jenkins running two containers... i was testing in the wrong one. Using the helm deployment I recommend just creating your own image and copying to /usr/local/bin.

[mrferos]

Jenkins in docker within k8s? If not, does the user jenkins is running as have permissions to aws-iam-authenticator?

…

On Thu, Oct 31, 2019 at 10:45 AM Sam ***@***.***> wrote: i am running jenkins in docker and get nothing but this Caused: java.io.IOException: Cannot run program "aws-iam-authenticator": error=2, No such file or directory Anyone seem this before? It doesnt work even if I specify absolute path and permissions are fine — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#548?email_source=notifications&email_token=AAAQ7L622TIYFTRRYHFJI6DQRLVOZA5CNFSM4IE3PTX2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECYBEJY#issuecomment-548409895>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAQ7L6S36ZJMT33Q6HH5RLQRLVOZANCNFSM4IE3PTXQ> .

[guysoft]

Ok, got it to work here.
I also had to take in to account what is written here

If Kubernetes URL is not set, the connection options will be autoconfigured from service account or kube config file.

If you skip directly to the aws instruction you have no idea that you need to not include the url and just use the kube config file. It might be worth noting that this is the only way to do it. Because when you see a large list of value UX suggests that you start filling them.

I think its worth adding that as a note. Should I PR something around those lines?

[shamsalmon]

Jenkins in docker within k8s? If not, does the user jenkins is running as have permissions to aws-iam-authenticator?
…
On Thu, Oct 31, 2019 at 10:45 AM Sam @.***> wrote: i am running jenkins in docker and get nothing but this Caused: java.io.IOException: Cannot run program "aws-iam-authenticator": error=2, No such file or directory Anyone seem this before? It doesnt work even if I specify absolute path and permissions are fine — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#548?email_source=notifications&email_token=AAAQ7L622TIYFTRRYHFJI6DQRLVOZA5CNFSM4IE3PTX2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECYBEJY#issuecomment-548409895>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAQ7L6S36ZJMT33Q6HH5RLQRLVOZANCNFSM4IE3PTXQ .

I got it working. See edit. I made a stupid mistake.