jenkins cannot provision new pods agents after renew certificates - kubeadm alpha certs renew all

Question

Today, it's 366 days since the kubernetes 1.17 cluster is running. Accordingly, All PKI certificates are expired. Since we are using k8s 1.17, we are able to renew certificates

kubeadm alpha certs renew all

everything is OK , except jenkins: still not able to spin off new pods as agents. :(

• no pipeline agent is able to be Running .. always pending then it's recreated

• The pb is that "Test Connection" works even thu jenkins was not provision agent

• The other apps which uses (https://kubernetes.default) internally, are working fine ( like ArgoCD,...)

I tried to :

• Restart kubeapi ( delete the pod kubeapi in kube-system to restart automatically)
• Safely restart jenkins

After all these trials, the same bahavior in Jenkins :

• no pipeline agent is able to be Running .. always pending then it's recreated

Answer 1

actually the issue is not jenkins , but it was kubernetes master. actually, i have to restart the control plane. I reboot master tomake sure that all control plane components are refreshed. Issue is fixed now

Answer 2

It looks like your Jenkins instance is deployed outside of Kubernetes cluster. Most likely Jenkins still use old certificate to authenticate calls to Kubernetes API server.

To restore connection, you need to add renewed certificate to Jenkins, I recommend using this instruction https://illya-chekrygin.com/2017/08/26/configuring-certificates-for-jenkins-kubernetes-plugin-0-12/ . It explains how to convert your ~/.kube/config to format supported by Jenkins Kubernetes plugin.