Skip to content

Remove custom role in favour of Kubernetes Engine Cluster Viewer role - #454

Open
ViliusS wants to merge 1 commit into
jenkinsci:developfrom
ViliusS:remove-custom-role
Open

Remove custom role in favour of Kubernetes Engine Cluster Viewer role#454
ViliusS wants to merge 1 commit into
jenkinsci:developfrom
ViliusS:remove-custom-role

Conversation

@ViliusS

@ViliusS ViliusS commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Built-in Kubernetes Engine Cluster Viewer role is very minimal and contains all permissions needed to run this plugin. This PR removes custom role from documentation and Terraform files, and replaces it with built-in role.

Previous suggested permissions:

  • container.apiServices.get
  • container.apiServices.list
  • container.clusters.get
  • container.clusters.getCredentials
  • container.clusters.list
  • resourcemanager.projects.get

New permissions in built-in role:

  • container.clusters.connect
  • container.clusters.get
  • container.clusters.list
  • resourcemanager.projects.get
  • resourcemanager.projects.list

I think container.apiServices.* where included by mistake previously. These permissions grant access to Kubernetes level APIServices objects and should be included in RBAC if one really needs to deploy them through plugin.

container.clusters.getCredentials was also not really correct as credentials are generated dynamically, using service account API key. Kubeconfig file is never retrieved or created AFAIK.

Testing done

Configured my Service Account to only have new built-in role. Then tested both, Jenkins Declarative Pipeline and Jenkins UI. Plugin works as before.

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests that demonstrate the feature works or the issue is fixed

Built-in Kubernetes Engine Cluster Viewer role is very minimal and
contains all permissions needed to run this plugin.
@ViliusS
ViliusS requested a review from a team as a code owner July 7, 2026 11:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant