jenkins slave still does not run with jenkins SA on latest master

[clemensutschig]

from the logs

[@containerTemplate(name=jnlp,image=docker-registry.default.svc:5000/cd/jenkins-slave-base,workingDir=/tmp,alwaysPullImage=true,args=${computer.jnlpmac} ${computer.name},*serviceAccount=jenkins*)], 

‘Jenkins’ doesn’t have label ‘pod-a3baadd4-edd5-4b7b-8238-ebadc8eda50d’
Agent jenkins-slave-xklpg-x6dk3 is provisioned from template Kubernetes Pod Template
Agent specification [Kubernetes Pod Template] (pod-a3baadd4-edd5-4b7b-8238-ebadc8eda50d): 
* [jnlp] docker-registry.default.svc:5000/cd/jenkins-slave-base

Running on jenkins-slave-xklpg-x6dk3 in /tmp/workspace/ods26-cd/ods26-cd-dockerplain-master

[ods26-cd-dockerplain-master] Running shell script
+ oc whoami
system:serviceaccount:ods26-cd:default

[clemensutschig]

https://github.com/opendevstack/ods-jenkins-shared-library/blob/master/src/org/ods/OdsPipeline.groovy#L50-L54

does not look like it would take the SA into account. this breaks current master (and me from pushing this to production(

[clemensutschig]

this should have been fixed with #70 and also looks correct according to
https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/PodTemplate.java#L95

[clemensutschig]

I took a look into the pod def of the spun up pod

  restartPolicy: Never
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1002070000
    seLinuxOptions:
      level: 's0:c46,c0'
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  volumes:

so clearly this thing does NOT run as jenkins

[clemensutschig]

https://jenkins.io/doc/pipeline/steps/kubernetes/

shows that serviceAccount needs to be * on the same level* as name while alwayPullImage is UNDER containers

[michaelsauter]

Oh no - sorry! I'll update in an hour, but then need to run through the steps to check if things still work ....

[clemensutschig]

Lets jump on a Quick Call - whatever we do is a breaking change... or i seed for backward compatibitlity Michael Sauter <notifications@github.com> schrieb am Fr., 3. Mai 2019, 07:34:

…

Oh no - sorry! I'll update in an hour, but then need to run through the steps to check if things still work .... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#78 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AJV7CSAYRWETAHSTCL4KE6LPTPFFZANCNFSM4HJ76BFA> .