CI/CD 尝试从 Jenkins 部署到 AKS 失败

Question

我已经获得了 Microsoft templates for CI/CD 之一，使用：Jenkins、Docker (ACS)、Kubernetes (AKS)。此模板附带一个管道示例，但在尝试启动它时，我在尝试与 Azure Kubernetes (AKS) 集成时出现以下错误：

Starting Azure Container Service / Kubernetes Service Deployment
Delete Kubernetes management config file 
/var/lib/jenkins/workspace/hello-world/kubeconfig-7112538207763465492
ERROR: ERROR: Status code 403, {"error": 
{"code":"AuthorizationFailed","message":"The client '7912b768-a178-4996- 
b6e6-38912a9b90da' with object id '7912b768-a178-4996-b6e6-38912a9b90da' 
does not have authorization to perform action 
'Microsoft.ContainerService/managedClusters/accessProfiles
/listCredential/action' over scope '/subscriptions/4e601d44-4d18-4e49- 
95001793e668f9e0/resourcegroups/SystemBackend_Resource/
providers/Microsoft.ContainerService/managedClusters/aksa5ru5sgbdaum2/
accessProfiles/clusterAdmin'."}}

有什么想法吗？

Answer 1

错误说明了一切，您用来访问 AKS 群集的客户端（凭据）无权对该群集使用 listCredentials 操作。您需要授予该客户这些权限。将 7912b768-a178-4996-b6e6-38912a9b90da 的贡献者权限授予 SystemBackend_Resource 资源组的最简单方法。

New-AzureRmRoleAssignment -ObjectId 7912b768-a178-4996-b6e6-38912a9b90da `
  -RoleDefinitionName "Contributor" `
  -Scope '/subscriptions/4e601d44-4d18-4e49-95001793e668f9e0/resourcegroups/SystemBackend_Resource/'

您显然可以使用自定义角色仅向该实体授予该权限，但这只是一个示例

CI/CD 尝试从 Jenkins 部署到 AKS 失败

CI/CD failed trying to deploy from Jenkins to AKS

continuous-integration

azure

continuous-deployment

jenkins

kubernetes