jenkinsci/google-oauth-plugin

Does not work with Workload Identity on GKE

viyh opened this issue · 7 comments

viyh commented

When using this with a Jenkins pod running on GKE using a service account with Workload Identtiy, the plugin no longer works using the automatic metadata credentials.

sstncr commented

I have the same issue. My Jenkins master runs in GKE and the metadata credentials used to work when my cluster had node metadata set to EXPOSED. I updated my cluster, moved to GKE Metadata Server / Workload Identity, done all the GCP and K8S service account configuration and I can confirm that my pods (including Jenkins) can access the metadata server. I can run kubectl/gcloud commands in the pods and everything works as before except for this plugin.

I've looked though the source-code for metadata endpoints accessed and the ones I found I can confirm they are accessible from my pods. Don't really understand where the plugin decides to "hide" the metadata credentials option.

sstncr commented

Here is a pull request that fixes the issue: #91

viyh commented

Any update on getting this merged and released?

sstncr commented

I'm not sure what I can do to get this merged. I guess a maintainer needs to review and merge that pull request. I've manually installed the generated hpi file from the build and running it since then. It would be nice to have this released though.

donmccasland commented
sstncr commented

Thanks Don!

jglick commented

So should this issue be closed?