How to Set Kubernetes Elastic Agent Plugin Token ?? #11352

xlw712 · 2023-03-03T12:24:14Z

xlw712
Mar 3, 2023

I think my token configuration is wrong,The agent cannot be created at this time,Please tell me how to configure a method,
Here's how I did it

Copy to

I get below error msg

Answered by xlw712

Mar 3, 2023

This is serviceAccount gocd config

apiVersion: v1
kind: ServiceAccount
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"
rules:

apiGroups: [""]
resources:
- pods
- pods/log
  verbs: ["*"]
apiGroups: [""]
resources:
- nodes
  verbs: ["get", "list"]
apiGroups: [""]
resources:
- events
  verbs: ["list", "watch"]
apiGroups: [""]
resources:
- namespaces
  verbs: ["get"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"
subjects:

View full answer

xlw712 · 2023-03-03T12:24:45Z

xlw712
Mar 3, 2023
Author

thank you very much

0 replies

xlw712 · 2023-03-03T12:49:05Z

xlw712
Mar 3, 2023
Author

I think my token configuration is wrong,The agent cannot be created at this time,Please tell me how to configure a method, Here's how I did it Copy to I get below error msg

This is plugin log
2023-03-03 12:48:15,776 ERROR [167@MessageListener for CreateAgentListener] KubernetesPlugin:127 - Error occurred while trying to list kubernetes pods: io.fabric8.kubernetes.client.KubernetesClientException: Operation: [list] for kind: [Pod] with name: [null] in namespace: [default] failed. at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:130) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.listRequestHelper(BaseOperation.java:140) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:415) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:404) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.list(BaseOperation.java:83) at cd.go.contrib.elasticagent.KubernetesAgentInstances.refreshAll(KubernetesAgentInstances.java:159) at cd.go.contrib.elasticagent.KubernetesAgentInstances.create(KubernetesAgentInstances.java:64) at cd.go.contrib.elasticagent.KubernetesAgentInstances.create(KubernetesAgentInstances.java:39) at cd.go.contrib.elasticagent.executors.CreateAgentRequestExecutor.execute(CreateAgentRequestExecutor.java:52) at cd.go.contrib.elasticagent.KubernetesPlugin.handle(KubernetesPlugin.java:82) at com.thoughtworks.go.plugin.infra.DefaultPluginManager.lambda$submitTo$0(DefaultPluginManager.java:134) at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.executeActionOnTheService(FelixGoPluginOSGiFramework.java:208) at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.doOn(FelixGoPluginOSGiFramework.java:164) at com.thoughtworks.go.plugin.infra.DefaultPluginManager.submitTo(DefaultPluginManager.java:131) at com.thoughtworks.go.plugin.access.PluginRequestHelper.submitRequest(PluginRequestHelper.java:49) at com.thoughtworks.go.plugin.access.elastic.v5.ElasticAgentExtensionV5.createAgent(ElasticAgentExtensionV5.java:141) at com.thoughtworks.go.plugin.access.elastic.ElasticAgentExtension.createAgent(ElasticAgentExtension.java:59) at com.thoughtworks.go.plugin.access.elastic.ElasticAgentPluginRegistry.createAgent(ElasticAgentPluginRegistry.java:42) at com.thoughtworks.go.server.messaging.elasticagents.CreateAgentListener.onMessage(CreateAgentListener.java:31) at com.thoughtworks.go.server.messaging.elasticagents.CreateAgentListener.onMessage(CreateAgentListener.java:21) at com.thoughtworks.go.server.messaging.activemq.JMSMessageListenerAdapter.runImpl(JMSMessageListenerAdapter.java:83) at com.thoughtworks.go.server.messaging.activemq.JMSMessageListenerAdapter.run(JMSMessageListenerAdapter.java:63) at java.base/java.lang.Thread.run(Unknown Source) Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source) at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source) at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source) at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source) at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source) at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:320) at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:284) at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:169) at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:258) at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:135) at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:114) at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:127) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at io.fabric8.kubernetes.client.okhttp.OkHttpClientBuilderImpl$InteceptorAdapter.intercept(OkHttpClientBuilderImpl.java:62) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at io.fabric8.kubernetes.client.okhttp.OkHttpClientBuilderImpl$InteceptorAdapter.intercept(OkHttpClientBuilderImpl.java:62) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at io.fabric8.kubernetes.client.okhttp.OkHttpClientBuilderImpl$InteceptorAdapter.intercept(OkHttpClientBuilderImpl.java:62) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at io.fabric8.kubernetes.client.okhttp.OkHttpClientBuilderImpl$InteceptorAdapter.intercept(OkHttpClientBuilderImpl.java:62) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:257) at okhttp3.RealCall.execute(RealCall.java:93) at io.fabric8.kubernetes.client.okhttp.OkHttpClientImpl.send(OkHttpClientImpl.java:138) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.retryWithExponentialBackoff(OperationSupport.java:574) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:553) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:518) at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:502) at io.fabric8.kubernetes.client.dsl.base.BaseOperation.listRequestHelper(BaseOperation.java:133) ... 21 common frames omitted Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source) at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source) at java.base/sun.security.validator.Validator.validate(Unknown Source) at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ... 70 common frames omitted Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) at java.base/java.security.cert.CertPathBuilder.build(Unknown Source) ... 75 common frames omitted

0 replies

xlw712 · 2023-03-03T13:06:05Z

xlw712
Mar 3, 2023
Author

This is serviceAccount gocd config

apiVersion: v1
kind: ServiceAccount
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"
rules:

apiGroups: [""]
resources:
- pods
- pods/log
  verbs: ["*"]
apiGroups: [""]
resources:
- nodes
  verbs: ["get", "list"]
apiGroups: [""]
resources:
- events
  verbs: ["list", "watch"]
apiGroups: [""]
resources:
- namespaces
  verbs: ["get"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"
subjects:

kind: ServiceAccount
name: gocd
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: gocd

3 replies

chadlwilson Mar 3, 2023
Maintainer

Your plugin doesn't trust your cluster API server and can't connect to it via HTTPS so hasn't actually sent the token yet. Check the cluster CA cert that is populated in the plugin config. For most clusters it would be the same as the ca.crt in the service account token.

xlw712 Mar 3, 2023
Author

Your plugin doesn't trust your cluster API server and can't connect to it via HTTPS so hasn't actually sent the token yet. Check the cluster CA cert that is populated in the plugin config. For most clusters it would be the same as the ca.crt in the service account token.

NIce,Can Work,I forgot I was https server,However, I used the default installation and saw that the ca.crt content was not populated in the Cluster CA certificate data,If possible, I recommend making the error log more user-friendly。

chadlwilson Mar 4, 2023
Maintainer

Perhaps, but

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Is a relatively standard Java error when a TLS connection cannot verify the server certificate and should be pretty searchable.

xlw712 · 2023-03-03T15:28:49Z

xlw712
Mar 3, 2023
Author

Can someone please help me

0 replies

xlw712 · 2023-03-03T15:29:46Z

xlw712
Mar 3, 2023
Author

@chadlwilson Can you take a look? thanks

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to Set Kubernetes Elastic Agent Plugin Token ?? #11352

{{title}}

Replies: 5 comments 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

How to Set Kubernetes Elastic Agent Plugin Token ?? #11352

xlw712 Mar 3, 2023

This is serviceAccount gocd config

apiVersion: v1 kind: ServiceAccount metadata: name: gocd namespace: default labels: version: "gocd-22.3.0" app: "gocd"

Replies: 5 comments · 3 replies

xlw712 Mar 3, 2023 Author

xlw712 Mar 3, 2023 Author

xlw712 Mar 3, 2023 Author

This is serviceAccount gocd config

apiVersion: v1 kind: ServiceAccount metadata: name: gocd namespace: default labels: version: "gocd-22.3.0" app: "gocd"

chadlwilson Mar 3, 2023 Maintainer

xlw712 Mar 3, 2023 Author

chadlwilson Mar 4, 2023 Maintainer

xlw712 Mar 3, 2023 Author

xlw712 Mar 3, 2023 Author

xlw712
Mar 3, 2023

apiVersion: v1
kind: ServiceAccount
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"

Replies: 5 comments 3 replies

xlw712
Mar 3, 2023
Author

xlw712
Mar 3, 2023
Author

xlw712
Mar 3, 2023
Author

apiVersion: v1
kind: ServiceAccount
metadata:
name: gocd
namespace: default
labels:
version: "gocd-22.3.0"
app: "gocd"

chadlwilson Mar 3, 2023
Maintainer

xlw712 Mar 3, 2023
Author

chadlwilson Mar 4, 2023
Maintainer

xlw712
Mar 3, 2023
Author

xlw712
Mar 3, 2023
Author