Enable CA Verify with insecure-skip-tls-verify: true is broken about jenkins-client-plugin HOT 4 CLOSED

hey @elconas - "depend" is not really the right word in "The plugin should not depend on System configuration" ... I would say ""... should not get tripped up ... " ;-)

this issue is the plugin to date has been assuming there is no .kube/config file present, hence when
the oc binary is forked and finds the .kube/config path off of $HOME, it reads in those settings and they conflict with what the args to oc that the plugin constructs prior to forking the oc command.

so both short and long term possibilities exist wrt to precedence of config specified, and whether the plugin should even support the use of .kube\config, and if so, orders of precedence choices and option merging.

I'm currently of the following opinion

1. short term, do not support use of .kube/config1, and essentially mimic @elconas 's workaround - set KUBECONFIG to a location that does not have the conflicting .kube/config file

In some experimentation bring up our jenkins image via the template in a pod, I am seeing that KUBECONFIG=/var/lib/origin/openshift.local.config/master/admin.kubeconfig is set. However, that file does not in fact exist in the pod. I'm leaning toward that (vs. WORKSPACE, where a person running jenkins outside of an openshift pod might leverage that location, even accidentally, for oc login.

And drive this change via this issue and the PR I'll compose for it.

2. long term, open a trello feature card for exploring the requirement for devising a config merging order of precedence similar to the oc binary, but include any arg overrides introduced via use of this plugin's DSL as part of that precedence.

@bparees @coreydaley @elconas - opinions of course welcome

thanks

from jenkins-client-plugin.

KUBECONFIG=/var/lib/origin/openshift.local.config/master/admin.kubeconfig

i'd like to know what is setting that. i'm pretty sure it's not our jenkins template... so is that set in all pods on the cluster?

from jenkins-client-plugin.

from jenkins-client-plugin.

Going to close this out with a doc update since our 3.7 image is now setting KUBECONFIG and there is not a need to ... see discussion in #90 (comment) and earlier comments in that pull

Either run from the image in a pod to get the default KUBECONFIG set.

Or If you are running outside openshift and have kube config files in your home dir such that oc will find it, it is your responsibility at that point to manage its settings in conjunction to what you are doing from the pipeline.

That will be the crux of the doc update, which will close this out once the content is agreed upon and we merge.

from jenkins-client-plugin.