Jenkins pass envs to pod template

Question

I have Jenkins job which invoke POD with two containers inside K8s nodes. I have custom python script which fetch temp secrets from remote system and create secret in namespace with this secrets.

def create_secret(body):
    v1.create_namespaced_secret(namespace='default',
                                body=body
                                )

This container which generate secrets is InitContainer. After create secrets, InitContainer is destroyed and starting my apps container. As my secrets is temporary and this is Jenkins Job, I want to make temp secrets with name like "Jenkins job" for example secret name "jenkins-slave-blablabla". After this I want to expose this secrets to my app container inside pod:

  containers:
    - name: "jnlp"
      env:
        - name: HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name

        - name: "TOKEN"
          valueFrom:
            secretKeyRef:
              name: "$(HOSTNAME)"
              key: "TOKEN"

But my Jenkins job is not starting when I put next strings to my POD template in Kubernetes plugin inside Jenkins.

    - name: "TOKEN"
      valueFrom:
        secretKeyRef:
          name: "$(HOSTNAME)"
          key: "TOKEN"

Main issue is Jenkins job and Kubernetes plugin for jenkins, this guys cant start POD because can't pass envs to template, I have tried $HOSTNAME, $(HOSTNAME), ${HOSTNAME} and a lot of another varies, but Job is not working. Every start of Jenkins Job HOSTNAME is new. And name of secret must be every time new. I can't use static name for secrets.

There my template for Kubernetes plugin: Yaml merge strategy: Merge

apiVersion: v1
kind: Pod
spec:
  securityContext:
    fsGroup: 65534
  initContainers:
    - name: "cred-prepare"
      image: XXXXXXXXXX.dkr.ecr.us-east-1.amazonaws.com/kubesdk:latest
      volumeMounts:
        - name: "secret-volume"
          mountPath: "script.py"
          subPath: "script.py"
      command:
        - "/bin/sh"
        - "-c"
        - |
          python3 script.py # Creating secret with name=HOSTNAME
  containers:
    - name: "jnlp"
      env:
        - name: HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name

        - name: "TOKEN"
          valueFrom:
            secretKeyRef:
              name: "$(HOSTNAME)"
              key: "TOKEN"
  volumes:
    - name: "secret-volume"
      secret:
        secretName: "secrets"
        items:
          - key: "script.py"
            path: "script.py"

If sending of secret variables is possible from InitContainer to app Container directly, please let me know how. Thank you.

I got extra logs from org.csanchez.jenkins.plugins.kubernetes

Error in provisioning; agent=KubernetesSlave name: k8s-slave-dispute-81rzs, template=PodTemplate{inheritFrom='', name='k8s-slave-dispute', namespace='default', hostNetwork=false, instanceCap=10, label='k8s-slave-dispute', serviceAccount='jenkins-slave', nodeSelector='', nodeUsageMode=EXCLUSIVE, workspaceVolume=EmptyDirWorkspaceVolume [memory=false], containers=[ContainerTemplate{name='jnlp', image='123123123123123.dkr.ecr.us-east-1.amazonaws.com/jnlp2:latest', workingDir='/home/jenkins/agent', command='', args='', ttyEnabled=true, resourceRequestCpu='', resourceRequestMemory='', resourceLimitCpu='', resourceLimitMemory='', livenessProbe=org.csanchez.jenkins.plugins.kubernetes.ContainerLivenessProbe@2cb36d87}]}
io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://12312312312312312312312.gr7.us-east-1.eks.amazonaws.com/api/v1/namespaces/default/pods. Message: Pod "k8s-slave-dispute-81rzs" is invalid: spec.containers[0].env[3].valueFrom.secretKeyRef.name: Invalid value: "$(JENKINS_NAME)": a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'). Received status: Status(apiVersion=v1, code=422, details=StatusDetails(causes=[StatusCause(field=spec.containers[0].env[3].valueFrom.secretKeyRef.name, message=Invalid value: "$(JENKINS_NAME)": a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'), reason=FieldValueInvalid, additionalProperties={})], group=null, kind=Pod, name=k8s-slave-dispute-81rzs, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=Pod "k8s-slave-dispute-81rzs" is invalid: spec.containers[0].env[3].valueFrom.secretKeyRef.name: Invalid value: "$(JENKINS_NAME)": a DNS-1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'), metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Invalid, status=Failure, additionalProperties={}).

Kubernetes plugin can't pass ENV to pod template.

Invalid value: "$(JENKINS_NAME)": a DNS-1123 subdomain must consist of lower case alphanumeric characters

Env JENKINS_NAME represent POD Hostname.

Jenkins pass envs to pod template

0 Answers