Ubuntu服务器下Jenkins Pipeline部署Docker镜像到Minikube时遇权限拒绝异常

错误核心 #

从报错堆栈可明确：问题根源是权限不足——Jenkins运行进程无法读取/root/.minikube/ca.crt文件，抛出java.nio.file.AccessDeniedException异常。

解决方法 #

方法1：调整证书目录权限 #

直接给Minikube证书目录添加其他用户读权限，让Jenkins能读取证书文件：

# 递归修改目录及文件权限，开放读权限
chmod -R o+r /root/.minikube/
# 重启Jenkins使权限生效
systemctl restart jenkins

方法2：将Jenkins用户加入root组 #

把Jenkins用户添加到root组，获取root目录访问权限：

usermod -aG root jenkins
systemctl restart jenkins

方法3：复制kubeconfig到Jenkins用户目录（推荐） #

这是更规范的做法，避免直接操作root目录权限：

# 创建Jenkins的kube配置目录
mkdir -p /var/lib/jenkins/.kube/
# 复制Minikube的kubeconfig文件
cp /root/.kube/config /var/lib/jenkins/.kube/
# 修改文件所属用户为Jenkins
chown -R jenkins:jenkins /var/lib/jenkins/.kube/
# 重启Jenkins
systemctl restart jenkins

原始错误日志 #

ERROR: ERROR: io.fabric8.kubernetes.client.KubernetesClientException: An error has occurred.
hudson.remoting.ProxyException: io.fabric8.kubernetes.client.KubernetesClientException: An error has occurred.
    at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:62)
    at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:53)
    at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:182)
    at io.fabric8.kubernetes.client.BaseClient.<init>(BaseClient.java:55)
    at io.fabric8.kubernetes.client.DefaultKubernetesClient.<init>(DefaultKubernetesClient.java:91)
    at com.microsoft.jenkins.kubernetes.KubernetesClientWrapper.<init>(KubernetesClientWrapper.java:78)
    at com.microsoft.jenkins.kubernetes.KubernetesDeployContext$ClientWrapperFactoryImpl.buildClient(KubernetesDeployContext.java:466)
    at com.microsoft.jenkins.kubernetes.command.DeploymentCommand$DeploymentTask.doCall(DeploymentCommand.java:141)
    at com.microsoft.jenkins.kubernetes.command.DeploymentCommand$DeploymentTask.call(DeploymentCommand.java:122)
    at com.microsoft.jenkins.kubernetes.command.DeploymentCommand$DeploymentTask.call(DeploymentCommand.java:105)
    at hudson.FilePath.act(FilePath.java:1288)
    at com.microsoft.jenkins.kubernetes.command.DeploymentCommand.execute(DeploymentCommand.java:67)
    at com.microsoft.jenkins.kubernetes.command.DeploymentCommand.execute(DeploymentCommand.java:46)
    at com.microsoft.jenkins.azurecommons.command.CommandService.runCommand(CommandService.java:88)
    at com.microsoft.jenkins.azurecommons.command.CommandService.execute(CommandService.java:96)
    at com.microsoft.jenkins.azurecommons.command.CommandService.executeCommands(CommandService.java:75)
    at com.microsoft.jenkins.azurecommons.command.BaseCommandContext.executeCommands(BaseCommandContext.java:77)
    at com.microsoft.jenkins.kubernetes.KubernetesDeploy.perform(KubernetesDeploy.java:42)
    at com.microsoft.jenkins.azurecommons.command.SimpleBuildStepExecution.run(SimpleBuildStepExecution.java:54)
    at com.microsoft.jenkins.azurecommons.command.SimpleBuildStepExecution.run(SimpleBuildStepExecution.java:35)
    at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: hudson.remoting.ProxyException: java.nio.file.AccessDeniedException: /root/.minikube/ca.crt
    at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
    at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219)
    at java.base/java.nio.file.Files.newByteChannel(Files.java:371)
    at java.base/java.nio.file.Files.newByteChannel(Files.java:422)
    at java.base/java.nio.file.Files.readAllBytes(Files.java:3206)
    at io.fabric8.kubernetes.client.internal.CertUtils.getInputStreamFromDataOrFile(CertUtils.java:65)
    at io.fabric8.kubernetes.client.internal.CertUtils.createTrustStore(CertUtils.java:71)
    at io.fabric8.kubernetes.client.internal.SSLUtils.trustManagers(SSLUtils.java:115)
    at io.fabric8.kubernetes.client.internal.SSLUtils.trustManagers(SSLUtils.java:94)
    at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:76)
    ... 23 more

内容的提问来源于stack exchange，提问作者Ahmed Khaled Fouad