说明

kubernetes v1.24.0 更新之后进行创建 ServiceAccount 不会自动生成 Secret 需要对其手动创建。

网上的很多教程都没有创建 Secret 这步，应该是之前版本的教程，笔者使用的是 v1.25 版本，这部分需要特别添加。

创建

cat >role-jenkins.yaml<<EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jenkins
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
roleRef:
  kind: ClusterRole
  name: cluster-jenkins
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
---
apiVersion: v1
kind: Secret
metadata:
  name: jenkins
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: "jenkins"
type: kubernetes.io/service-account-token
EOF

# 创建 ServiceAccount 和 Secret
kubectl apply -f role-jenkins.yaml
# 获取 Secret
kubectl -n kube-system get secrets
# 查看 Secret 详情
kubectl -n kube-system describe secrets jenkins
# 获取 Token
kubectl -n kube-system get secrets jenkins -o go-template --template '{{index .data "token"}}' | base64 --decode