k8s集成jenkins权限故障记录

背景：
k8s与jenkins集成实现cd

问题：
jenkins在构建测试时，报以下错误；

Started by user admin
Running as SYSTEM
Building in workspace /var/lib/jenkins/workspace/jiuzhuang
using credential ac79727f-4dc6-40e2-bd77-81beed53b44f
 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url git@gitlab.cheng.com:root/jiuzhuang.git # timeout=10
Fetching upstream changes from git@gitlab.cheng.com:root/jiuzhuang.git
 > git --version # timeout=10
using GIT_SSH to set credentials 
 > git fetch --tags --progress git@gitlab.cheng.com:root/jiuzhuang.git +refs/heads/*:refs/remotes/origin/*
 > git rev-parse refs/remotes/origin/master^{commit} # timeout=10
 > git rev-parse refs/remotes/origin/origin/master^{commit} # timeout=10
Checking out Revision 5f820ab8a6b53dda1a37a7093b2403b344447baa (refs/remotes/origin/master)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 5f820ab8a6b53dda1a37a7093b2403b344447baa
Commit message: "add dockerfile"
 > git rev-list --no-walk 5f820ab8a6b53dda1a37a7093b2403b344447baa # timeout=10
[jiuzhuang] $ /bin/sh -xe /tmp/jenkins1282839084168007622.sh
+ docker build -t 10.0.0.11:5000/putaojiu:v7 .
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.26/build?buildargs=%7B%7D&buildbinds=null&cachefrom=%5B%5D&cgroupparent=&cpuperiod=0&cpuquota=0&cpusetcpus=&cpusetmems=&cpushares=0&dockerfile=dockerfile&labels=%7B%7D&memory=0&memswap=0&networkmode=default&rm=1&shmsize=0&t=10.0.0.11%3A5000%2Fputaojiu%3Av7&ulimits=null: dial unix /var/run/docker.sock: connect: permission denied
Build step 'Execute shell' marked build as failure
Finished: FAILURE

问题分析：
第一眼就看出权限不足；permission denied

故障排查：

1.我部署的jenkins默认是以jenkins用户运行的；而docker是以root用户运行；
2.针对此问题，我刚开始试着给jenkins用户添加了root和docker组
[root@k8s-node-2 workspace]# id jenkins
uid=994(jenkins) gid=991(jenkins) groups=991(jenkins),0(root),1000(docker)
3.发现还是解决不了；头疼了半天，最后决定给jenkins用户配置sudo权限，然后build镜像

结果：
故障已解决，可以正常从远程私有仓库构建镜像------>推送至远程仓库----OK~