diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 79e863d7e..2833dc876 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,42 +1,23 @@ - -For fast feedback, please @-mention maintainers that are listed in the Chart.yaml file. +### What does this PR do? -Please make sure you test your changes before you push them. -Once pushed, GitHub Actions will run across your changes and do some initial checks and linting. -These checks run very quickly. -Please check the results. -We would like these checks to pass before we even continue reviewing your changes. + - - -### What this PR does / why we need it -### Which issue this PR fixes +- Fixes # -*(optional, in `fixes #(, fixes #, ...)` format, will close that issue when PR gets merged)* +If you modified files in the `./charts/jenkins/` directory, please also include the following: -- fixes # +```[tasklist] +### Submitter checklist +- [ ] I bumped the "version" key in `./charts/jenkins/Chart.yaml`. +- [ ] I added a new changelog entry to `./charts/jenkins/CHANGELOG.md`. +- [ ] I followed the [technical requirements](https://github.com/jenkinsci/helm-charts/blob/main/CONTRIBUTING.md#technical-requirements). +- [ ] I ran `.github/helm-docs.sh` from the project root. +``` ### Special notes for your reviewer -### Checklist - -- [ ] Chart Version bumped -- [ ] CHANGELOG.md was updated + diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 5ace4600a..000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,6 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" diff --git a/.github/helm-docs.sh b/.github/helm-docs.sh new file mode 100755 index 000000000..c5a31c95e --- /dev/null +++ b/.github/helm-docs.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +set -euxo pipefail + +# check if helm-docs is installed +if ! command -v helm-docs &>/dev/null; then + echo "helm-docs could not be found. You can install it from https://github.com/norwoodj/helm-docs." + exit +fi + +# validate docs +cd charts/jenkins +helm-docs --template-files=VALUES.md.gotmpl --output-file=VALUES.md diff --git a/.github/linters/.textlintrc b/.github/linters/.textlintrc new file mode 100644 index 000000000..091120709 --- /dev/null +++ b/.github/linters/.textlintrc @@ -0,0 +1,11 @@ +{ + "rules": { + "terminology": { + "exclude": [ + "Git", + "XML", + "YAML" + ] + } + } +} diff --git a/.github/renovate-config.json5 b/.github/renovate-config.json5 new file mode 100644 index 000000000..9e3599f73 --- /dev/null +++ b/.github/renovate-config.json5 @@ -0,0 +1,96 @@ +{ + $schema: "https://docs.renovatebot.com/renovate-schema.json", + onboarding: false, + requireConfig: "ignored", + platform: "github", + repositories: ["jenkinsci/helm-charts"], + // eslint-disable-next-line + allowedPostUpgradeCommands: ['^\.github\/renovate-postupgrade\.sh "{{{depName}}}" "{{{newVersion}}}"$'], + prConcurrentLimit: 0, + prHourlyLimit: 5, + semanticCommits: "enabled", + enabledManagers: [ + "helm-values", + "github-actions", + "regex", + ], + packageRules: [ + { + matchPackageNames: ["jenkins/inbound-agent"], + versioning: "regex:^(?\\d+)?\\.(?\\w+?)?-(?\\d+)?$", + }, + { + matchPackageNames: ["jenkins/jenkins"], + versioning: "regex:^(?\\d+?)\\.(?\\d+?)\\.(?\\d+?)(-(?\\w+))?$", + }, + { + matchFileNames: ["charts/jenkins/**"], + postUpgradeTasks: { + commands: [ + '.github/renovate-postupgrade.sh "{{{depName}}}" "{{{newVersion}}}"', + ], + fileFilters: ["charts/jenkins/**"], + executionMode: "branch", + }, + }, + { + matchPackagePatterns: [".*"], + excludePackagePatterns: ["jenkins/jenkins"], + minimumReleaseAge: "12 hours", + }, + ], + customDatasources: { + "python_actions": { + defaultRegistryUrlTemplate: "https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json", + transformTemplates: [ + "{\"releases\": $$[stable=true].files[arch=\"x64\" and platform=\"linux\"].{\"version\":%.version,\"changelogUrl\":\"https://docs.python.org/whatsnew/index.html\"},\"homepage\":\"https://python.org/\",\"changelogUrl\":\"https://docs.python.org/whatsnew/index.html\"}", + ], + }, + }, + customManagers: [ + { + customType: "regex", + fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$", "(^|/)\\.github/[^/]+\\.sh$"], + matchStrings: [ + "# renovate: datasource=(?.*?) depName=(?.*?)( versioning=(?.*?))?\\s+?[\\w\\s-]*?version:? (?.*)\\s", + "# renovate: datasource=(?.*?) depName=(?.*?)( versioning=(?.*?))?\\s.*?_VERSION=(?.*)\\s", + ], + }, + { + customType: "regex", + fileMatch: [ + "^charts/jenkins/Chart.yaml$", + "^charts/jenkins/values.yaml$", + ], + matchStrings: [ + "appVersion: (?.*?)\\s", + 'repository: \\"jenkins/jenkins\\"\\s*?# tag: \\"(?.*?)\\"', + ], + depNameTemplate: "jenkins/jenkins", + datasourceTemplate: "docker", + }, + { + customType: "regex", + fileMatch: ["^charts/jenkins/values.yaml$"], + matchStringsStrategy: "recursive", + matchStrings: [ + "installPlugins:[\\s\\w:.-]*?(?:\\r*\\n){2}", + "- (?.*?):(?.*?)\\s", + ], + datasourceTemplate: "jenkins-plugins", + versioningTemplate: "regex:^(?\\d+)?\\.(?\\w+?)?(\\.(?\\d+?))?$", + }, + { + customType: "regex", + fileMatch: ["^charts/jenkins/Chart.yaml$"], + matchStringsStrategy: "recursive", + matchStrings: [ + "artifacthub\\.io\\/images: \\|[\\s\\w:.\\/-]*(?:artifacthub)", + "image: (?.*?):(?.*?)\\s", + ], + datasourceTemplate: "docker", + versioningTemplate: "regex:^(?\\d+)?\\.(?\\w+?)?(_|\\.)(?\\w+)?(-(?\\d+))?.*", + depNameTemplate: "{{#if (equals depName 'docker.io/jenkins/jenkins')}}jenkins/jenkins{{else}}{{{depName}}}{{/if}}", + }, + ], +} diff --git a/.github/renovate-entrypoint.sh b/.github/renovate-entrypoint.sh new file mode 100755 index 000000000..a8aa8907d --- /dev/null +++ b/.github/renovate-entrypoint.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +# renovate: datasource=github-tags depName=mikefarah/yq +export YQ_VERSION=v4.45.1 + +# renovate: datasource=github-tags depName=helm/helm +export HELM_VERSION=v3.17.0 + +# renovate: datasource=github-tags depName=helm-unittest/helm-unittest +export HELM_UNITTEST_VERSION=v0.7.1 + +# renovate: datasource=github-tags depName=jenkins-x-plugins/jx-release-version +export JENKINS_JX_VERSION=v2.7.8 + +# renovate: datasource=github-releases depName=norwoodj/helm-docs +export HELM_DOCS_VERSION=1.14.2 + +apt update + +apt install -y curl git + +curl -fsSL -o /tmp/helm.tar.gz https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz +mkdir -p /tmp/helm && tar -xf /tmp/helm.tar.gz -C /tmp/helm +mv /tmp/helm/linux-amd64/helm /usr/local/bin/helm +chmod a+x /usr/local/bin/helm + +runuser -u ubuntu -- helm plugin install https://github.com/helm-unittest/helm-unittest --version ${HELM_UNITTEST_VERSION} + +curl -fsSL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 +chmod a+x /usr/local/bin/yq + +curl -fsSL -o /tmp/jx-release.tar.gz https://github.com/jenkins-x-plugins/jx-release-version/releases/download/${JENKINS_JX_VERSION}/jx-release-version-linux-amd64.tar.gz +mkdir -p /tmp/jx && tar -xf /tmp/jx-release.tar.gz -C /tmp/jx +mv /tmp/jx/jx-release-version /usr/local/bin/jx-release-version +chmod a+x /usr/local/bin/jx-release-version + +curl -fsSL -o /tmp/helm-docs.tar.gz https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_Linux_x86_64.tar.gz +mkdir -p /tmp/helm-docs && tar -xf /tmp/helm-docs.tar.gz -C /tmp/helm-docs +mv /tmp/helm-docs/helm-docs /usr/local/bin/helm-docs +chmod a+x /usr/local/bin/helm-docs + +runuser -u ubuntu renovate diff --git a/.github/renovate-postupgrade.sh b/.github/renovate-postupgrade.sh new file mode 100755 index 000000000..4d232c8a9 --- /dev/null +++ b/.github/renovate-postupgrade.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +CHARTVERSION="$(jx-release-version -previous-version=from-file:charts/jenkins/Chart.yaml)" +export CHARTVERSION +depName=$(echo "$1" | tr ' ' '\n' | sort | uniq) +export DEPNAME="$depName" +export NEWVERSION="$2" + +helm unittest --strict -f 'unittests/*.yaml' charts/jenkins -u +yq eval '.version = env(CHARTVERSION)' -i charts/jenkins/Chart.yaml +sed -i "/git commit to be able to get more details./a \\\n## ${CHARTVERSION}\n\nUpdate \`${DEPNAME}\` to version \`${NEWVERSION}\`" charts/jenkins/CHANGELOG.md +.github/helm-docs.sh diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml index 5ad33b386..db8670017 100644 --- a/.github/workflows/lint-test.yaml +++ b/.github/workflows/lint-test.yaml @@ -3,6 +3,9 @@ name: Lint and Test Charts on: pull_request +permissions: + contents: read + jobs: lint-test: runs-on: ubuntu-latest @@ -10,32 +13,36 @@ jobs: strategy: matrix: kubernetes_version: - - "kindest/node:v1.26.3" - - "kindest/node:v1.25.8" - - "kindest/node:v1.24.12" - - "kindest/node:v1.23.17" + # See https://kubernetes.io/releases/ for EOL dates + - "kindest/node:v1.29.0" + - "kindest/node:v1.28.0" + - "kindest/node:v1.27.2" + - "kindest/node:v1.26.4" fail-fast: false steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v4 with: - version: v3.11.2 + # renovate: datasource=github-tags depName=helm/helm + version: v3.17.0 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: - python-version: 3.11.2 + # renovate: datasource=custom.python_actions depName=python + python-version: 3.13.1 - name: Set up chart-testing uses: helm/chart-testing-action@v2 with: - version: v3.8.0 + # renovate: datasource=github-tags depName=helm/chart-testing + version: v3.12.0 - name: Run chart-testing (list-changed) id: list-changed @@ -49,13 +56,14 @@ jobs: if: steps.list-changed.outputs.changed == 'true' run: | helm env - helm plugin install https://github.com/quintush/helm-unittest --version 0.2.11 + # renovate: datasource=github-tags depName=helm-unittest/helm-unittest + helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.3.6 - name: Run chart-testing (lint) run: ct lint --config ct.yaml - name: Create kind cluster - uses: helm/kind-action@v1.5.0 + uses: helm/kind-action@v1.12.0 if: steps.list-changed.outputs.changed == 'true' with: node_image: ${{ matrix.kubernetes_version }} diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 892576fb7..72f41f480 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -2,21 +2,48 @@ name: Lint Code Base on: pull_request +permissions: + contents: read + jobs: build: name: Lint Code Base runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Lint Code Base - uses: github/super-linter@v4 + uses: super-linter/super-linter@v6.7.0 env: VALIDATE_ALL_CODEBASE: true + VALIDATE_CHECKOV: false + VALIDATE_GITLEAKS: false VALIDATE_JSCPD: false - VALIDATE_KUBERNETES_KUBEVAL: false + VALIDATE_JSONC: false + VALIDATE_KUBERNETES_KUBECONFORM: false VALIDATE_YAML: false DEFAULT_BRANCH: main GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # copied from https://github.com/renovatebot/helm-charts + lint-docs: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Install and run helm-docs + run: |- + # renovate: datasource=github-releases depName=norwoodj/helm-docs + HELM_DOCS_VERSION=1.14.2 + + # install helm-docs + curl -fsSL -o /tmp/helm-docs.tar.gz https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_Linux_x86_64.tar.gz + mkdir -p /tmp/helm-docs && tar -xf /tmp/helm-docs.tar.gz -C /tmp/helm-docs + mv /tmp/helm-docs/helm-docs /usr/local/bin/helm-docs + chmod a+x /usr/local/bin/helm-docs + + .github/helm-docs.sh + - name: Check dirty state + run: git diff --exit-code diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 71e93ec33..351cdccea 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -4,13 +4,19 @@ on: push: branches: - main + paths: + - 'charts/**' + +permissions: + contents: write + packages: write jobs: release: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 @@ -19,12 +25,117 @@ jobs: git config user.name "$GITHUB_ACTOR" git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Install Helm - uses: azure/setup-helm@v3.5 + uses: azure/setup-helm@v4 with: - version: v3.8.2 + # renovate: datasource=github-tags depName=helm/helm + version: v3.17.0 + + - name: Retrieve version from Chart.yaml + id: chart_version + run: | + echo "version=$(yq '.version' charts/jenkins/Chart.yaml)" >> "${GITHUB_OUTPUT}" + + - name: Extract version changelog + id: version_changelog + env: + VERSION: ${{ steps.chart_version.outputs.version }} + run: | + changelog=$(awk -v version="${VERSION}" ' + /^(##|###) [0-9]+.[0-9]+.[0-9]+/ { + if (p) { exit }; + if ($2 == version) { + p = 1; next + } + } p + ' charts/jenkins/CHANGELOG.md) + + delimiter="$(openssl rand -hex 8)" + # shellcheck disable=SC2129 + echo "changelog<<${delimiter}" >> "${GITHUB_OUTPUT}" + echo "${changelog}" >> "${GITHUB_OUTPUT}" + echo "${delimiter}" >> "${GITHUB_OUTPUT}" + + - name: Annotate Chart.yaml with current version changelog + if: steps.version_changelog.outputs.changelog != '' + env: + CHANGELOG: ${{ steps.version_changelog.outputs.changelog }} + run: | + # Changelog sanitation + # shellcheck disable=SC2016 + proper_changelog=$(echo "${CHANGELOG}" \ + | grep -v '^$' `# remove empty lines` \ + | grep -v '^|' `# remove table lines` \ + | iconv -c -f utf8 -t ascii `# remove non ascii characters like emoji` \ + | sed 's/^/- /' `# add a dash in front of every line` \ + | sed 's/ / /') # double spaces + + # Add new line to ensure scalar value in Chart.yaml + printf -v change '%s\n' "${proper_changelog}" + + # Update chart annotations using strenv operator (https://mikefarah.gitbook.io/yq/operators/string-operators#string-blocks-bash-and-newlines) + CHANGE="${change}" yq --inplace ".annotations.\"artifacthub.io/changes\" = strenv(CHANGE)" charts/jenkins/Chart.yaml + + - name: Show updated Chart.yaml + run: | + yq charts/jenkins/Chart.yaml - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.5.0 + id: chart_releaser + uses: helm/chart-releaser-action@v1.7.0 env: CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" + + - name: Push Chart to GHCR + run: | + for pkg in .cr-release-packages/*; do + if [ -z "${pkg:-}" ]; then + break + fi + helm push "${pkg}" oci://ghcr.io/jenkinsci/helm-charts + done + + - name: Retrieve release info + id: release_info + if: steps.chart_releaser.outputs.changed_charts != '' + env: + LAST_TAG: "jenkins-${{ steps.chart_version.outputs.version }}" + REPOSITORY: ${{ github.repository }} + run: | + release=$(curl -L "https://api.github.com/repos/${REPOSITORY}/releases/tags/${LAST_TAG}") + + echo "id=$(echo "${release}" | jq '.id')" >> "${GITHUB_OUTPUT}" + + delimiter="$(openssl rand -hex 8)" + # shellcheck disable=SC2129 + echo "body<<${delimiter}" >> "${GITHUB_OUTPUT}" + echo "${release}" | jq --raw-output '.body' >> "${GITHUB_OUTPUT}" + echo "${delimiter}" >> "${GITHUB_OUTPUT}" + + - name: Update release description + id: update_release + if: steps.chart_releaser.outputs.changed_charts != '' + uses: actions/github-script@v7 + env: + ID: ${{ steps.release_info.outputs.id }} + BODY: ${{steps.release_info.outputs.body}} + CHANGELOG: ${{steps.version_changelog.outputs.changelog}} + with: + script: | + try { + await github.rest.repos.updateRelease({ + release_id: process.env.ID, + owner: context.repo.owner, + repo: context.repo.repo, + body: process.env.BODY + "\r\n\r\n## Changelog" + process.env.CHANGELOG, + }); + } catch (error) { + core.setFailed(error.message); + } diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml new file mode 100644 index 000000000..89487ecd3 --- /dev/null +++ b/.github/workflows/renovate.yaml @@ -0,0 +1,40 @@ +name: Renovate +on: + schedule: + - cron: "0 * * * *" + push: + branches: + - main + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: true + +permissions: + contents: write + pull-requests: write + +jobs: + renovate: + runs-on: ubuntu-latest + steps: + - name: Get token + id: get_token + uses: tibdex/github-app-token@v2 + with: + app_id: ${{ secrets.JENKINS_DEPENDENCY_UPDATER_APP_ID }} + private_key: ${{ secrets.JENKINS_DEPENDENCY_UPDATER_PRIVATE_KEY }} + + - name: Checkout + uses: actions/checkout@v4 + + - name: Self-hosted Renovate + uses: renovatebot/github-action@v41.0.10 + with: + token: "${{ steps.get_token.outputs.token }}" + docker-cmd-file: .github/renovate-entrypoint.sh + docker-user: root + configurationFile: .github/renovate-config.json5 + env: + LOG_LEVEL: 'debug' diff --git a/.github/workflows/sync-lts.yaml b/.github/workflows/sync-lts.yaml deleted file mode 100644 index b61addaaf..000000000 --- a/.github/workflows/sync-lts.yaml +++ /dev/null @@ -1,77 +0,0 @@ ---- -name: Sync LTS Version - -on: - schedule: - - cron: "0 * * * 3" - workflow_dispatch: - -jobs: - build: - runs-on: ubuntu-latest - steps: - - name: Check out source code - uses: actions/checkout@v3 - - - name: next release version - id: nextversion - uses: jenkins-x-plugins/jx-release-version@v2.6.10 - with: - previous-version: from-file:charts/jenkins/Chart.yaml - - - name: Jenkins LTS version - id: lts - uses: jenkins-infra/jenkins-version@0.3.2 - with: - version-identifier: lts - - - name: Check if update is available - id: update - run: | - CURRENT_VERSION=$(grep -E "^appVersion:" charts/jenkins/Chart.yaml | awk '{print $2}') - if [ "${CURRENT_VERSION}" = "${{ steps.lts.outputs.jenkins_version }}" ]; then - echo "available=false" >> "${GITHUB_OUTPUT}" - else - echo "available=true" >> "${GITHUB_OUTPUT}" - echo "current-version=${CURRENT_VERSION}" >> "${GITHUB_OUTPUT}" - fi - - - name: Update version in Chart.yaml - uses: mikefarah/yq@v4.33.3 - if: ${{ steps.update.outputs.available == 'true' }} - with: - cmd: yq eval '.version = "${{ steps.nextversion.outputs.version }}"' -i charts/jenkins/Chart.yaml - - - name: Update LTS version in files - if: ${{ steps.update.outputs.available == 'true' }} - run: | - grep -ilr ${{ steps.update.outputs.current-version }} charts/jenkins | grep -v CHANGELOG.md | xargs sed -i 's/${{ steps.update.outputs.current-version }}/${{ steps.lts.outputs.jenkins_version }}/g' - - - name: Changelog - if: ${{ steps.update.outputs.available == 'true' }} - run: | - sed -i '/git commit to be able to get more details./a \\n## ${{ steps.nextversion.outputs.version }}\n\nUpdate Jenkins image and appVersion to jenkins lts release version ${{ steps.lts.outputs.jenkins_version }}\n' charts/jenkins/CHANGELOG.md - - - name: Git Diff - if: ${{ steps.update.outputs.available == 'true' }} - run: | - git diff - # update the changelog - - - uses: tibdex/github-app-token@v1 - id: generate-token - with: - app_id: ${{ secrets.JENKINS_DEPENDENCY_UPDATER_APP_ID }} - private_key: ${{ secrets.JENKINS_DEPENDENCY_UPDATER_PRIVATE_KEY }} - - - name: Create Pull Request - id: cpr - uses: peter-evans/create-pull-request@v5 - if: ${{ steps.update.outputs.available == 'true' }} - with: - token: ${{ steps.generate-token.outputs.token }} - commit-message: 'chore(deps): bump lts to ${{ steps.lts.outputs.jenkins_version }}' - author: jenkins-dependency-updater <81680575+jenkins-dependency-updater[bot]@users.noreply.github.com> - committer: jenkins-dependency-updater <81680575+jenkins-dependency-updater[bot]@users.noreply.github.com> - signoff: true - title: 'chore(deps): bump lts to ${{ steps.lts.outputs.jenkins_version }}' diff --git a/.github/workflows/sync-readme.yaml b/.github/workflows/sync-readme.yaml index 9fdffa96f..a5fd49c8f 100644 --- a/.github/workflows/sync-readme.yaml +++ b/.github/workflows/sync-readme.yaml @@ -4,14 +4,18 @@ on: - 'main' paths: - 'README.md' + +permissions: + contents: write + jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - run: | cp -f README.md ${{ runner.temp }}/README.md - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: ref: gh-pages - run: | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d622df16a..183be1871 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -43,10 +43,10 @@ Tests can be executed like this: ```console # install the unittest plugin -$ helm plugin install https://github.com/quintush/helm-unittest --version 0.2.11 +$ helm plugin install https://github.com/helm-unittest/helm-unittest --version 0.3.6 # run the unittests -$ helm unittest --helm3 --strict -f 'unittests/*.yaml' charts/jenkins +$ helm unittest --strict -f 'unittests/*.yaml' charts/jenkins ### Chart [ jenkins ] charts/jenkins @@ -56,7 +56,6 @@ $ helm unittest --helm3 --strict -f 'unittests/*.yaml' charts/jenkins PASS PersistentVolumeClaim charts/jenkins/unittests/home-pvc-test.yaml PASS Configuration as Code charts/jenkins/unittests/jcasc-config-test.yaml PASS Jenkins Agent Service charts/jenkins/unittests/jenkins-agent-svc-test.yaml - PASS Jenkins Backup Cronjob charts/jenkins/unittests/jenkins-backup-cronjob-test.yaml PASS Controller Prometheus PrometheusRule charts/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml PASS Controller Primary Ingress charts/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml PASS Controller Primary Ingress charts/jenkins/unittests/jenkins-controller-ingress-test.yaml @@ -94,7 +93,7 @@ The chart `version` should follow [SemVer](https://semver.org/). Charts should start at `1.0.0`. Any breaking (backwards incompatible) changes to a chart should: 1. Bump the MAJOR version -2. In the README, under a section called "Upgrading", describe the manual steps necessary to upgrade to the new (specified) MAJOR version +2. In the readme, under a section called "Upgrading", describe the manual steps necessary to upgrade to the new (specified) MAJOR version ### Community Requirements diff --git a/charts/jenkins/CHANGELOG.md b/charts/jenkins/CHANGELOG.md index a09fc45b4..017dd3e67 100644 --- a/charts/jenkins/CHANGELOG.md +++ b/charts/jenkins/CHANGELOG.md @@ -12,6 +12,692 @@ Use the following links to reference issues, PRs, and commits prior to v2.6.0. The changelog until v1.5.7 was auto-generated based on git commits. Those entries include a reference to the git commit to be able to get more details. +## 5.8.5 + +Update `jenkins/inbound-agent` to version `3283.v92c105e0f819-7` + +## 5.8.4 + +Allow setting [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) + +## 5.8.3 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.29.0` + +## 5.8.2 + +Update `jenkins/jenkins` to version `2.479.3-jdk17` + +## 5.8.1 + +Update `configuration-as-code` to version `1915.vcdd0a_d0d2625` + +## 5.8.0 + +Add option to publish not-ready addresses in controller service. + +## 5.7.27 + +Update `git` to version `5.7.0` + +## 5.7.26 + +Update `configuration-as-code` to version `1909.vb_b_f59a_27d013` + +## 5.7.25 + +Update `kubernetes` to version `4306.vc91e951ea_eb_d` + +## 5.7.24 + +Update `kubernetes` to version `4304.v1b_39d4f98210` + +## 5.7.23 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.4` + +## 5.7.22 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.3` + +## 5.7.21 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.1` + +## 5.7.20 + +Update `kubernetes` to version `4302.va_756e4b_67715` + +## 5.7.19 + +Update `configuration-as-code` to version `1903.v004d55388f30` + +## 5.7.18 + +Update `kubernetes` to version `4300.vd82c5692b_3a_e` + +## 5.7.17 + +Update `docker.io/bats/bats` to version `1.11.1` + +## 5.7.16 + +Add tpl support for persistence.storageClassName in home-pvc.yaml and tpl support in controller.ingress parameters(ingressClassName, annotations, hostname) in jenkins-controller-ingress.yaml + +## 5.7.15 + +Update `jenkins/jenkins` to version `2.479.2-jdk17` + +## 5.7.14 + +Update `kubernetes` to version `4296.v20a_7e4d77cf6` + +## 5.7.13 + +Update `configuration-as-code` to version `1897.v79281e066ea_7` + +## 5.7.12 + +Update `configuration-as-code` to version `1887.v9e47623cb_043` + +## 5.7.11 + +Update `git` to version `5.6.0` + +## 5.7.10 + +Update `jenkins/jenkins` to version `2.479.1-jdk17` + +## 5.7.9 + +Update `configuration-as-code` to version `1873.vea_5814ca_9c93` + +## 5.7.8 + +Update `jenkins/inbound-agent` to version `3273.v4cfe589b_fd83-1` + +## 5.7.7 + +Update `kubernetes` to version `4295.v7fa_01b_309c95` + +## 5.7.5 + +Fix helm release deployment with flux revision reconciliation + +## 5.7.4 + +Update `kubernetes` to version `4292.v11898cf8fa_66` + +## 5.7.3 + +Update `git` to version `5.5.2` + +## 5.7.2 + +Update `jenkins/jenkins` to version `2.462.3-jdk17` + +## 5.7.1 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.0` + +## 5.7.0 + +Add RBAC support for using the `nonroot` and `nonroot-v2` `SecurityContextConstraints` on OpenShift. + +## 5.6.5 + +Update `kubernetes` to version `4290.v93ea_4b_b_26a_61` + +## 5.6.4 + +Update `git` to version `5.5.1` + +## 5.6.3 + +Update `git` to version `5.5.0` + +## 5.6.2 + +Update `kubernetes` to version `4288.v1719f9d0c854` + +## 5.6.1 + +Documentation about OCI installation + +## 5.6.0 + +Helm chart is also now deployed on GitHub packages and can be installed from `oci://ghcr.io/jenkinsci/helm-charts/jenkins` + +## 5.5.16 + +Update `kubernetes` to version `4287.v73451380b_576` + +## 5.5.15 + +Add support for `controller.enableServiceLinks` to disable service links in the controller pod. + +## 5.5.14 + +Update `jenkins/jenkins` to version `2.462.2-jdk17` + +## 5.5.13 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.6` + +## 5.5.12 + +Update `configuration-as-code` to version `1850.va_a_8c31d3158b_` + +## 5.5.11 + +Update `configuration-as-code` to version `1849.v3a_d20568000a_` + +## 5.5.10 + +Update `git` to version `5.4.1` + +## 5.5.9 + +Update `git` to version `5.4.0` + +## 5.5.8 + +Add `agent.garbageCollection` to support setting [kubernetes plugin garbage collection](https://plugins.jenkins.io/kubernetes/#plugin-content-garbage-collection-beta). + +## 5.5.7 + +Update `kubernetes` to version `4285.v50ed5f624918` + +## 5.5.6 + +Add `agent.useDefaultServiceAccount` to support omitting setting `serviceAccount` in the default pod template from `serviceAgentAccount.name`. +Add `agent.serviceAccount` to support setting the default pod template value. + +## 5.5.5 + +Update `jenkins/inbound-agent` to version `3261.v9c670a_4748a_9-1` + +## 5.5.4 + +Update `jenkins/jenkins` to version `2.462.1-jdk17` + +## 5.5.3 + +Update `git` to version `5.3.0` + +## 5.5.2 + +Update `kubernetes` to version `4280.vd919fa_528c7e` + +## 5.5.1 + +Update `kubernetes` to version `4265.v78b_d4a_1c864a_` + +## 5.5.0 + +Introduce capability of set skipTlsVerify and usageRestricted flags in additionalClouds + + +## 5.4.4 + +Update CHANGELOG.md, README.md, and UPGRADING.md for linting + +## 5.4.3 + +Update `configuration-as-code` to version `1836.vccda_4a_122a_a_e` + +## 5.4.2 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.5` + +## 5.4.1 + +Update `jenkins/jenkins` to version `2.452.3` + +## 5.4.0 + +Introduce capability of additional mountPaths and logging file paths for config reload container + +## 5.3.6 + +Update `workflow-aggregator` to version `600.vb_57cdd26fdd7` + +## 5.3.5 + +Update `kubernetes` to version `4253.v7700d91739e5` + +## 5.3.4 + +Update `jenkins/jenkins` to version `2.452.3-jdk17` +## 5.3.3 + +Update `jenkins/inbound-agent` to version `3256.v88a_f6e922152-1` + +## 5.3.2 + +Update `kubernetes` to version `4248.vfa_9517757b_b_a_` + +## 5.3.1 + +Fix Tiltfile deprecated value reference + +## 5.3.0 + +Add `controller.topologySpreadConstraints` + +## 5.2.2 + +Update `kubernetes` to version `4246.v5a_12b_1fe120e` + +## 5.2.1 + +Update `jenkins/jenkins` to version `2.452.2-jdk17` + +## 5.2.0 + +Add `agent.inheritYamlMergeStrategy` to allow configuring this setting on the default agent pod template. + +## 5.1.31 + +Update `kubernetes` to version `4245.vf5b_83f1fee6e` + +## 5.1.30 + +Add `controller.JCasC.configMapAnnotations` to allow setting annotations on the JCasC ConfigMaps. + +## 5.1.29 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.4` + +## 5.1.28 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.3` + +## 5.1.27 + +Update `kubernetes` to version `4244.v4fb_b_00994a_90` + +## 5.1.26 + +Update `kubernetes` to version `4238.v41b_3ef14a_5d8` + +## 5.1.25 + +Update `kubernetes` to version `4236.vc06f753c3234` + +## 5.1.24 + +Update `kubernetes` to version `4234.vdf3e78112369` + +## 5.1.23 + +Update `kubernetes` to version `4233.vb_67a_0e11a_039` + +## 5.1.22 + +Update `configuration-as-code` to version `1810.v9b_c30a_249a_4c` + +## 5.1.21 + +Update `kubernetes` to version `4231.vb_a_6b_8936497d` + +## 5.1.20 + +Update `kubernetes` to version `4230.vceef11cb_ca_37` + +## 5.1.19 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.2` + +## 5.1.18 + +Update `configuration-as-code` to version `1807.v0175eda_00a_20` + +## 5.1.17 + +Update `jenkins/inbound-agent` to version `3248.v65ecb_254c298-1` + +## 5.1.16 + +Update `configuration-as-code` to version `1805.v1455f39c04cf` + +## 5.1.15 + +Update `jenkins/jenkins` to version `2.452.1-jdk17` + +## 5.1.14 + +Update `kubernetes` to version `4219.v40ff98cfb_d6f` + +## 5.1.13 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.1` + +## 5.1.12 + +Update `git` to version `5.2.2` + +## 5.1.11 + +Update `kubernetes` to version `4214.vf10083a_42e70` + +## 5.1.10 + +Update `kubernetes` to version `4211.v08850dd0dfa_3` + +## 5.1.9 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.2` + +## 5.1.8 + +Update `kubernetes` to version `4209.vc646b_71e5269` + +## 5.1.7 + +Update `kubernetes` to version `4208.v4017b_a_27a_d67` + +## 5.1.6 + +Update `jenkins/jenkins` to version `2.440.3-jdk17` + +## 5.1.5 + +Fix Prometheus controller name. + +## 5.1.4 + +Update `docker.io/bats/bats` to version `1.11.0` + +## 5.1.3 + +Update `jenkins/jenkins` to version `2.440.2-jdk17` + +## 5.1.2 + +Update `kubernetes` to version `4203.v1dd44f5b_1cf9` + +## 5.1.1 + +Update `kubernetes` to version `4199.va_1647c280eb_2` + +## 5.1.0 + +Add `agent.restrictedPssSecurityContext` to automatically inject in the jnlp container a securityContext that is suitable for the use of the restricted Pod Security Standard + +## 5.0.20 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.1` + +## 5.0.19 + +Introduced helm-docs to automatically generate `values.yaml` documentation. + +## 5.0.18 + +Update `kubernetes` to version `4193.vded98e56cc25` + +## 5.0.17 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.0` + +## 5.0.16 + +Enable support for deleting plugin configuration files at startup. + +## 5.0.15 + +Fixed changelog entries for previous version bumps + + +## 5.0.14 + +Update `jenkins/jenkins` to version `2.440.1-jdk17` + +## 5.0.13 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `1.25.4` + +## 5.0.12 + +Fix controller.sidecars.additionalSidecarContainers renaming and add tests + +## 5.0.11 + +* Add controller.sidecars.configAutoReload.scheme to specify protocol scheme when connecting Jenkins configuration-as-code reload endpoint +* Add controller.sidecars.configAutoReload.skipTlsVerify to force the k8s-sidecar container to skip TLS verification when connecting to an HTTPS Jenkins configuration-as-code reload endpoint + +## 5.0.10 + +Update `jenkins/inbound-agent` to version `3206.vb_15dcf73f6a_9-3` + +## 5.0.9 + +Update `kubernetes` to version `4186.v1d804571d5d4` + +## 5.0.8 + +Update `configuration-as-code` to version `1775.v810dc950b_514` + +## 5.0.7 + +Update `docker.io/kiwigrid/k8s-sidecar` to version `docker.io/kiwigrid/k8s-sidecar` + +## 5.0.6 + +Removed `docker.io` prefix from inbound-agent image + +## 5.0.5 + +Prefixed artifacthub.io/images with `docker.io` + +## 5.0.4 + +Updated super-linter to v6. Updated README.md and CHANGELOG.md to fix linting issues. + +## 5.0.2 + +Update `git` to version `5.2.1` + +## 5.0.1 + +Update `docker.io/bats/bats` to version `v1.10.0` + +## 5.0.0 + + > [!CAUTION] + > Several fields have been renamed or removed. See [UPGRADING.md](./UPGRADING.md#to-500) + +The Helm Chart is now updated automatically via [Renovate](https://docs.renovatebot.com/) + +## 4.12.1 + +Update Jenkins image and appVersion to jenkins lts release version 2.426.3 + +## 4.12.0 + +Add support for [generic ephemeral storage](https://github.com/jenkinsci/kubernetes-plugin/pull/1489) in `agent.volumes` and `agents.workspaceVolume`. + +| plugin | old version | new version | +|------------|---------------------|--------------------| +| kubernetes | 4029.v5712230ccb_f8 | 4174.v4230d0ccd951 | + +## 4.11.2 + +Fixed documentation for controller.initScripts. + +## 4.11.1 + +Updated helm-unittest and made unittests compatible. + +## 4.11.0 + +Add multi-cloud support. + +## 4.10.0 + +Bumped Jenkins inbound agent from 3107.v665000b_51092-15 to 3192.v713e3b_039fb_e-5. + +## 4.9.2 + +Update Jenkins image and appVersion to jenkins lts release version 2.426.2 + + +Notes about [Artifact Hub](https://artifacthub.io/packages/helm/jenkinsci/jenkins?modal=changelog) changelog processing: +- Remove empty lines +- Keep only ASCII characters (no emojis) +- One change per line +- Remove table(s) (lines starting by "|") +- Backticks aren't rendered on artifacthub.io changelog + +## 4.9.1 + +Restore artifact hub notes location in CHANGELOG.md + +## 4.9.0 + +Update base images from JDK 11 to JDK 17. + +## 4.8.6 + +Proper `artifacthub.io/changes` changelog annotation preprocessing. + +## 4.8.5 + +Fix `artifacthub.io/changes` changelog annotation added to the released chart. + +## 4.8.4 + +Add `artifacthub.io/changes` changelog annotation to the released chart. + +## 4.8.3 + +Update Jenkins image and appVersion to jenkins lts release version 2.426.1 + +## 4.8.2 + +Add the ability to modify `retentionTimeout` and `waitForPodSec` default value in JCasC + +## 4.8.1 + +Reintroduces changes from 4.7.0 (reverted in 4.7.1), with additional fixes: + +- METHOD is now allowed in `env` and is not duplicated anymore +- No calls to JCasC reload endpoint from the init container + +## 4.8.0 + +Adds support for ephemeralStorage request and limit in Kubernetes plugin JCasC template + +## 4.7.4 + +Add the config-init-script checksum into the controller statefullset pod annotations to trigger restart of the pod in case of updated init scripts. + +## 4.7.3 + +Update Jenkins image and appVersion to jenkins lts release version 2.414.3 + +## 4.7.1 + +Changes in 4.7.0 were reverted. + +## 4.7.0 + +Runs `config-reload` as an init container, in addition to the sidecar container, to ensure that JCasC YAMLs are present before the main Jenkins container starts. This should fix some race conditions and crashes on startup. + +## 4.6.7 + +Change jenkins-test image label to match the other jenkins images + +## 4.6.5 + +Update Jenkins image and appVersion to jenkins lts release version 2.414.2 + +## 4.6.4 + +Introducing TPL function on variables related to hostname in `./charts/jenkins/templates/jenkins-controller-ingress.yaml` + +## 4.6.3 + +Add values to documentation + +## 4.6.2 + +Update word from hundreds to over 1800 to align with blurb at . + +## 4.6.1 + +Update `configuration-as-code` plugin to fix dependency issues with `azure-ad` plugin + +## 4.6.0 + +Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey` to allow overriding the default secret key containing the JKS file. +Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName` to allow getting the JKS password from a different secret. +Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey` to allow overriding the default secret key containing the JKS password. + +## 4.5.1 + +Update Jenkins image and appVersion to jenkins lts release version 2.414.1 + + +## 4.5.0 + +Added `.Values.persistence.dataSource` to allow cloning home PVC from existing dataSource. + +## 4.4.2 + +Update Jenkins image and appVersion to jenkins lts release version 2.401.3 + + +## 4.4.1 + +Added `.Values.agent.jnlpregistry` to allow agents to be configured with private registry. + +## 4.4.0 + +Add config keys for liveness probes on agent containers. + + +## 4.3.30 + +Update Jenkins version in controller test matching LTS version + +## 4.3.29 + +Update Jenkins image and appVersion to jenkins lts release version 2.401.2 + + +## 4.3.28 + +Allow the kubernetes API server URL to be configurable. + +## 4.3.27 + +Bump kiwigrid/k8s-sidecar from 1.23.1 to 1.24.4 and jenkins/inbound-agent from 3107.v665000b_51092-5 to 3107.v665000b_51092-15. + +## 4.3.26 + +Fix various typos in the chart documentation. + +## 4.3.25 + +| plugin | old version | new version | +|-----------------------|----------------------|-----------------------| +| kubernetes | 3900.va_dce992317b_4 | 3937.vd7b_82db_e347b_ | +| configuration-as-code | 1625.v27444588cc3d | 1647.ve39ca_b_829b_42 | +| git | 5.0.0 | 5.1.0 | +| ldap | 671.v2a_9192a_7419d | 682.v7b_544c9d1512 | + +## 4.3.24 + +Update Jenkins image and appVersion to jenkins lts release version 2.401.1 + + +## 4.3.23 + +Update Jenkins image and appVersion to jenkins lts release version 2.387.3 + + ## 4.3.22 @@ -83,7 +769,7 @@ Disable volume mount if disableSecretMount enabled ## 4.3.9 -Document `.Values.agent.directConnection` in README. +Document `.Values.agent.directConnection` in readme. Add default value for `.Values.agent.directConnection` to `values.yaml` ## 4.3.8 @@ -275,7 +961,7 @@ Fix path of projected secrets from `additionalExistingSecrets`. ## 4.1.7 -Update README with explanation on the required environmental variable `AWS_REGION` in case of using an S3 bucket. +Update readme with explanation on the required environmental variable `AWS_REGION` in case of using an S3 bucket. ## 4.1.6 @@ -283,7 +969,7 @@ project adminSecret, additionalSecrets and additionalExistingSecrets instead of ## 4.1.5 -Update README to fix `JAVA_OPTS` name. +Update readme to fix `JAVA_OPTS` name. ## 4.1.4 Update plugins @@ -398,7 +1084,7 @@ Update default plugin versions ## 3.9.4 -Add JAVA_OPTIONS to the README so proxy settings get picked by jenkins-plugin-cli +Add JAVA_OPTIONS to the readme so proxy settings get picked by jenkins-plugin-cli ## 3.9.3 @@ -691,7 +1377,7 @@ Update Jenkins image and appVersion to jenkins lts release version 2.263.4 ## 3.1.12 -Added GitHub action to automate the updating of LTS releases. +Added GitHub Action to automate the updating of LTS releases. ## 3.1.11 @@ -895,7 +1581,7 @@ Added unit tests for most resources in the Helm chart. ## 2.12.1 -Helm chart README update +Helm chart readme update ## 2.12.0 @@ -957,7 +1643,7 @@ Fixes #19 ## 2.6.0 First release in jenkinsci GitHub org -Updated README for new location +Updated readme for new location ## 2.5.2 @@ -973,7 +1659,7 @@ Add an option to specify that Jenkins master should be initialized only once, du ## 2.4.1 -Reorder README parameters into sections to facilitate chart usage and maintenance +Reorder readme parameters into sections to facilitate chart usage and maintenance ## 2.4.0 Update default agent image @@ -1007,7 +1693,7 @@ Configure `REQ_RETRY_CONNECT` to `10` to give Jenkins more time to start up. Value can be configured via `master.sidecars.configAutoReload.reqRetryConnect` -## 2.1.2 updated README +## 2.1.2 updated readme ## 2.1.1 update credentials-binding plugin to 1.23 @@ -1021,7 +1707,7 @@ Only render authorizationStrategy and securityRealm when values are set. ## 2.0.0 Configuration as Code now default + container does not run as root anymore -The README contains more details for this update. +The readme contains more details for this update. Please note that the updated values contain breaking changes. ## 1.27.0 Update plugin versions & sidecar container @@ -1186,7 +1872,7 @@ In recent version of configuration-as-code-plugin this is no longer necessary. ## 1.9.24 -Update JCasC auto-reload docs and remove stale ssh key references from version "1.8.0 JCasC auto reload works without ssh keys" +Update JCasC auto-reload docs and remove stale SSH key references from version "1.8.0 JCasC auto reload works without SSH keys" ## 1.9.23 Support jenkinsUriPrefix when JCasC is enabled @@ -1257,13 +1943,13 @@ Make `agent.slaveConnectTimeout` configurable: by increasing this value Jenkins ## 1.9.7 Update plugin versions -plugin | old version | new version ---------------------- | ----------- | ---------- -kubernetes | 1.18.2 | 1.21.2 -workflow-job | 2.33 | 2.36 -credentials-binding | 1.19 | 1.20 -git | 3.11.0 | 4.0.0 -configuration-as-code | 1.27 | 1.32 +| plugin | old version | new version | +|-----------------------|-------------|-------------| +| kubernetes | 1.18.2 | 1.21.2 | +| workflow-job | 2.33 | 2.36 | +| credentials-binding | 1.19 | 1.20 | +| git | 3.11.0 | 4.0.0 | +| configuration-as-code | 1.27 | 1.32 | ## 1.9.6 @@ -1311,7 +1997,7 @@ Revert fix in `1.7.10` since direct connection is now disabled by default. Add `master.schedulerName` to allow setting a Kubernetes custom scheduler -## 1.8.0 JCasC auto reload works without ssh keys +## 1.8.0 JCasC auto reload works without SSH keys We make use of the fact that the Jenkins Configuration as Code Plugin can be triggered via http `POST` to `JENKINS_URL/configuration-as-code/reload`and a pre-shared key. The sidecar container responsible for reloading config changes is now `kiwigrid/k8s-sidecar:0.1.20` instead of it's fork `shadwell/k8s-sidecar`. @@ -1389,7 +2075,7 @@ JCasC default configuration includes: - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace - - serverUrl: "https://kubernetes.default" + - serverUrl: `"https://kubernetes.default"` - template - containers - alwaysPullImage: `agent.alwaysPullImage` @@ -1839,7 +2525,7 @@ commit: 9de96faa0 ## 0.32.7 -Fix Markdown syntax in README (#11496) +Fix Markdown syntax in readme (#11496) commit: a32221a95 ## 0.32.6 @@ -2069,7 +2755,7 @@ commit: e0a20b0b9 ## 0.16.22 -avoid lint errors when adding Values.Ingress.Annotations (#7425) +avoid linting errors when adding Values.Ingress.Annotations (#7425) commit: 99eacc854 ## 0.16.21 @@ -2094,7 +2780,7 @@ commit: bf8180018 ## 0.16.17 -Add Master.AdminPassword in README (#6987) +Add Master.AdminPassword in readme (#6987) commit: 13e754ad7 ## 0.16.16 @@ -2164,7 +2850,7 @@ commit: fc6100c38 ## 0.16.1 -fix typo in jenkins README (#5228) +fix typo in jenkins readme (#5228) commit: 3cd3f4b8b ## 0.16.0 @@ -2285,7 +2971,7 @@ commit: 9a230a6b1 Double retry count for Jenkins test commit: 129c8e824 -Jenkins: Update README | Master.ServiceAnnotations (#2757) +Jenkins: Update readme | Master.ServiceAnnotations (#2757) commit: 6571810bc ## 0.10.0 @@ -2357,7 +3043,7 @@ commit: 4af5810ff ## 0.8.4 -Add support for supplying JENKINS_OPTS and/or uri prefix (#1405) +Add support for supplying JENKINS_OPTS and/or URI prefix (#1405) commit: 6a331901a ## 0.8.3 @@ -2567,7 +3253,7 @@ commit: 3cbd3ced6 Remove 'Getting Started:' from various NOTES.txt. (#181) commit: 2f63fd524 -docs(\*): update READMEs to reference chart repos (#119) +docs(\*): update readmes to reference chart repos (#119) commit: c7d1bff05 ## 0.1.0 diff --git a/charts/jenkins/Chart.yaml b/charts/jenkins/Chart.yaml index cee29bbc3..26fb2c569 100644 --- a/charts/jenkins/Chart.yaml +++ b/charts/jenkins/Chart.yaml @@ -1,9 +1,12 @@ apiVersion: v2 name: jenkins -home: https://jenkins.io/ -version: 4.3.22 -appVersion: 2.387.2 -description: Jenkins - Build great things at any scale! The leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project. +type: application +home: https://www.jenkins.io/ +version: 5.8.5 +appVersion: 2.479.3 +description: > + Jenkins - Build great things at any scale! As the leading open source automation server, Jenkins provides over 1800 plugins to support building, deploying and automating any project. + sources: - https://github.com/jenkinsci/jenkins - https://github.com/jenkinsci/docker-inbound-agent @@ -35,12 +38,10 @@ annotations: url: https://github.com/jenkinsci/helm-charts/issues artifacthub.io/images: | - name: jenkins - image: jenkins/jenkins:2.387.2-jdk11 + image: docker.io/jenkins/jenkins:2.479.3-jdk17 - name: k8s-sidecar - image: kiwigrid/k8s-sidecar:1.23.1 + image: docker.io/kiwigrid/k8s-sidecar:1.29.0 - name: inbound-agent - image: jenkins/inbound-agent:3107.v665000b_51092-5 - - name: backup - image: maorfr/kube-tasks:0.2.0 + image: jenkins/inbound-agent:3283.v92c105e0f819-7 artifacthub.io/category: "integration-delivery" artifacthub.io/license: "Apache-2.0" diff --git a/charts/jenkins/README.md b/charts/jenkins/README.md index 5bcf9c7db..4865a06db 100644 --- a/charts/jenkins/README.md +++ b/charts/jenkins/README.md @@ -5,7 +5,7 @@ [![Releases downloads](https://img.shields.io/github/downloads/jenkinsci/helm-charts/total.svg)](https://github.com/jenkinsci/helm-charts/releases) [![Join the chat at https://app.gitter.im/#/room/#jenkins-ci:matrix.org](https://badges.gitter.im/badge.svg)](https://app.gitter.im/#/room/#jenkins-ci:matrix.org) -[Jenkins](https://www.jenkins.io/) is the leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project. +[Jenkins](https://www.jenkins.io/) is the leading open source automation server, Jenkins provides over 1800 plugins to support building, deploying and automating any project. This chart installs a Jenkins server which spawns agents on [Kubernetes](http://kubernetes.io) utilizing the [Jenkins Kubernetes plugin](https://plugins.jenkins.io/kubernetes/). @@ -23,8 +23,13 @@ _See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentati ## Install Chart ```console -# Helm 3 -$ helm install [RELEASE_NAME] jenkins/jenkins [flags] +helm install [RELEASE_NAME] jenkins/jenkins [flags] +``` + +Since version `5.6.0` the chart is available as an OCI image and can be installed using: + +```console +helm install [RELEASE_NAME] oci://ghcr.io/jenkinsci/helm-charts/jenkins [flags] ``` _See [configuration](#configuration) below._ @@ -70,7 +75,7 @@ To see all configurable options with detailed comments, visit the chart's [value $ helm show values jenkins/jenkins ``` -For a summary of all configurable options, see [VALUES_SUMMARY.md](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md). +For a summary of all configurable options, see [VALUES.md](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES.md). ### Configure Security Realm and Authorization Strategy @@ -222,8 +227,8 @@ Further JCasC examples can be found [here](https://github.com/jenkinsci/configur #### Breaking out large Config as Code scripts -Jenkins Config as Code scripts can become quite large, and maintaining all of your scripts within one yaml file can be difficult. The Config as Code plugin itself suggests updating the `CASC_JENKINS_CONFIG` environment variable to be a comma seperated list of paths for the plugin to traverse, picking up the yaml files as needed. -However, under the Jenkins helm chart, this `CASC_JENKINS_CONFIG` value is maintained through the templates. A better solution is to split your `controller.JCasC.configScripts` into seperate values files, and provide each file during the helm install. +Jenkins Config as Code scripts can become quite large, and maintaining all of your scripts within one yaml file can be difficult. The Config as Code plugin itself suggests updating the `CASC_JENKINS_CONFIG` environment variable to be a comma separated list of paths for the plugin to traverse, picking up the yaml files as needed. +However, under the Jenkins helm chart, this `CASC_JENKINS_CONFIG` value is maintained through the templates. A better solution is to split your `controller.JCasC.configScripts` into separate values files, and provide each file during the helm install. For example, you can have a values file (e.g values_main.yaml) that defines the values described in the `VALUES_SUMMARY.md` for your Jenkins configuration: @@ -294,6 +299,22 @@ agent: ``` This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. +### Change container cleanup timeout API +For tasks that use very large images, this timeout can be increased to avoid early termination of the task while the Kubernetes pod is still deploying. +```yaml +agent: + retentionTimeout: "32" +``` +This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. + +### Change seconds to wait for pod to be running +This will change how long Jenkins will wait (seconds) for pod to be in running state. +```yaml +agent: + waitForPodSec: "32" +``` +This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. + ### Mounting Volumes into Agent Pods Your Jenkins Agents will run as pods, and it's possible to inject volumes where needed: @@ -405,7 +426,7 @@ controller: # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') + # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} # When using existingSecret no need to specify the keyName under additionalExistingSecrets. existingSecret: secret-credentials @@ -471,320 +492,11 @@ controller: RBAC is enabled by default. If you want to disable it you will need to set `rbac.create` to `false`. -### Backup - -Adds a backup CronJob for jenkins, along with required RBAC resources. See additional `backup` values using [configuration commands](#configuration). - -#### Example: Backup to Google Cloud Storage Bucket - -Let's look at a quick example. Let's pretend we are backing up Jenkins to a **Google Cloud Storage (GCS) Bucket**. Here is what the process would look like: - -##### 1. Create a Google Cloud Platform Account - -If you don't have a GCP account, you can create a Free Account with the link below: - -- - -##### 2. Create a GCS bucket with a unique name - -You need to create a GCS bucket with a unique name, which you can do by following the guide below: - -- - -##### 3. Create a GCP Service Account - -In order for the backup job to upload Jenkins data to the GCS bucket, you need to provide it with a Google Service Account, which you can create by following the guide below: - -- - -##### 4. Bind `roles/storage.admin` role to Service Account - -Now you need to provide your GCP Service Account with the `roles/storage.admin` role, which has permissions to read/write content to a GCS bucket. You can do this by following the guide below: - -- - -##### 5. Create a Service Account Key - -Now that you have a Service Account (SA), you need to create a Service Account Key, which is a file that represents the GCP Service Account that will get passed to the Backup Job (and later on to the Recovery Job). You can create it by following the guide below: - -- - -##### 6. Create a Kubernetes Secret from the Service Account key - -In order for the Backup Job to access the GCP Service Account Key you need to create Kubernetes Secret, which you can create using the command below: - -```bash -# Replace with the path to the SA Key -kubectl -n jenkins create secret generic jenkinsgcp --from-file=sa-credentials.json=/path/to/sa_key.json -``` - -**NOTE**: This assumes that you will deploy the Jenkins chart in the `jenkins` namespace. - -##### 7. Deploy the Jenkins Helm Chart using a modified values file - -Rather than using a long command to pass on all the new Chart values, create a values file called `values.yaml`, then put the following content on it, then save it: - -```yaml -backup: - enabled: true - schedule: "0 2 * * *" # Runs every day at 2 am, change it to whatever interval works for you - existingSecret: - jenkinsgcp: # This is the secret name - gcpcredentials: sa-credentials.json # The service account file in the secret - destination: "gcs://BUCKET_NAME/jenkins-k8s-backup" # Replace with Bucket Name from previous step -controller: - initializeOnce: true # Installs latest plugins as soon as Jenkins starts - installLatestPlugins: true -persistence: - enabled: true # So that we have a PVC that we can backup -``` - -**NOTE**: The [`gcpcredentials`](https://github.com/fabiogomezdiaz/helm-charts-1/blob/main/charts/jenkins/values.yaml#L829) key in the [`jenkinsgcp`](https://github.com/fabiogomezdiaz/helm-charts-1/blob/main/charts/jenkins/values.yaml#L827) field tells the Helm chart that we will be using a GCS bucket as our backup. - -##### 8. Deploy Jenkins Chart with new values - -Now that we have everything in place, let's deploy the Jenkins Chart with the new values file: - -```bash -helm upgrade --install jenkins --namespace jenkins \ - -f values.yaml \ - jenkinsci/jenkins; -``` - -**NOTE**: Save the password from this installation as it will be needed in the [Restore from Backup in Google Cloud Storage Bucket](#example-restore-from-backup-in-google-cloud-storage-bucket) section. - -##### 9. Create resources to backup in Jenkins - -Once Jenkins is available, go to Jenkins and create jobs, download plugins, and create credentials so that we have something to backup other than the default Jenkins installation. - -##### 10. Trigger the backup job - -The values file we used to deploy Jenkins runs the backup job every day at 2 AM. - -If you don't want to wait that long for the job to start running, then patch the CronJob to run in the next minute with the following commands: - -```bash -# Update CronJob to run every minute -kubectl -n jenkins patch cronjob.batch/jenkins-backup --patch '{"spec": {"schedule": "* * * * *"}}' - -# Run this command until the "jenkins-backup-*" container is running -kubectl get pods | grep backup; - -# To prevent multiple jobs from spanning every minute, change the CronJob back to original schedule -kubectl -n jenkins patch cronjob.batch/jenkins-backup --patch '{"spec": {"schedule": "0 2 * * *"}}' -``` - -##### 11. Verify that the backup job completed successfully - -Once the job is running, then query the backup pod logs to monitor progress as follows: - -```bash -# Get backup container name -BACKUP_CONTAINER=$(kubectl get pods | grep backup | awk '{print $1}'); - -# Stream logs of backup container until job is finished -kubectl logs -f ${BACKUP_CONTAINER}; -``` - -**NOTE**: The backup job will create a time-stamped folder in the GCS bucket each time the backup job runs. - -If you can see a success message from the backup job and can see the contents of the backup on your GCS bucket, then the backup was successful! - -A similar process would work for AWS S3. See additional `backup` values using [configuration commands](#configuration). - -**NOTE**: If an environmental variable `AWS_REGION` is not provided, the region of the AWS S3 bucket will be assumed to be `eu-central-1`. If you want to use an S3 bucket in another region, you need to provide the bucket's region as an environmental variable as below: - -```yaml -backup: - env: # The region of your S3 bucket. - - name: AWS_REGION - value: us-east-1 -``` - -### Restore From Backup - -To restore a backup, you can use the `kube-tasks` underlying tool called [skbn](https://github.com/maorfr/skbn), which copies files from cloud storage to Kubernetes. -The best way to do it would be using a `Job` to copy files from the desired backup tag to the Jenkins pod. - -See the following example for more details. - -#### Example: Restore from Backup in Google Cloud Storage Bucket - -**NOTE**: This section assumes that you ran the steps in [Example: Backup to Google Cloud Storage Bucket](#example-backup-to-google-cloud-storage-bucket) beforehand and that you **saved the password** for that Jenkins installation, which you will need at the end of this section. - -Let's pretend you are restoring a backup from a Google Cloud Storage Bucket because you completely lost your Jenkins installation and you are starting from scratch. - -In the following steps, we will explain what this process would look like: - -##### 1. Reinstall the Jenkins Helm Chart - -First, we need to remove the old Jenkins installation that we backed up previously, then we can install a clean Jenkins instance to restore from GCS backup. - -To do so, run the following commands: - -```bash -# Delete old Jenkins installation -helm delete jenkins - -# Install Jenkins Chart -helm upgrade --install jenkins --namespace jenkins \ - -f values.yaml \ - jenkinsci/jenkins; -``` - -**NOTE**: This Command uses the same values file that was created in the [7. Deploy the Jenkins Helm Chart using a modified values file](#7-deploy-the-jenkins-helm-chart-using-a-modified-values-file) section. - -Now verify that Jenkins is up and running and it DOES NOT have any of the resources you created earlier. - -##### 2. Create a Kubernetes Service Account for the Restore Job - -In order for the Restore job to pull backup data from the GCS bucket and put it in the jenkins `/var/jenkins_home` folder in the Jenkins pod, you need to create the following: - -- A [Kubernetes Service Account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) (not to be confused with a GCP Service Account) for the Restore job. -- A [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) that lists the necessary permissions to update the data in the volumes of other pods. -- A [Kubernetes ClusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) that binds the above ClusterRole to the Service Account. - -To do so, create a file called `restore-rbac.yaml` and enter the following content, then save it: - -```yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: skbn - name: skbn - namespace: jenkins ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: skbn - name: skbn -rules: -- apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["pods/exec"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: skbn - name: skbn -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: skbn -subjects: -- kind: ServiceAccount - name: skbn - namespace: jenkins -``` - -To apply the above manifest, run the following command: - -```bash -kubectl apply -f restore-rbac.yaml -``` - -##### 3. Create a Kubernetes Job to restore Jenkins - -The logic that will execute the Jenkins restoration from a GCS backup will be done through a -[Kubernetes Job](https://kubernetes.io/docs/concepts/workloads/controllers/job/), which will run only once as needed. - -To create the job, create a manifest file called `restore.yaml` with the following content, then save it: - -```yaml -apiVersion: batch/v1 -kind: Job -metadata: - labels: - app: skbn - name: skbn - namespace: jenkins -spec: - template: - metadata: - labels: - app: skbn - spec: - restartPolicy: OnFailure - serviceAccountName: skbn - containers: - - name: skbn - image: maorfr/skbn - command: ["skbn"] - args: - - "cp" - - "--src" - - "gcs://BUCKET_NAME/jenkins-k8s-backup/BACKUP_NAME" - - "--dst" - - "k8s://jenkins/jenkins-0/jenkins/var/jenkins_home" - imagePullPolicy: IfNotPresent - env: - - name: GOOGLE_APPLICATION_CREDENTIALS - value: /var/run/secrets/jenkinsgcp/sa-credentials.json - volumeMounts: - - mountPath: /var/run/secrets/jenkinsgcp - name: jenkinsgcp - volumes: - - name: jenkinsgcp - secret: - secretName: jenkinsgcp -``` - -While the above Job manifest is mostly complete, you need to replace a couple of things, as follows: - -- Replace `BUCKET_NAME` with the GCS Bucket name created in [Create a GCS bucket with a unique name](#2-create-a-gcs-bucket-with-a-unique-name). -- Go to your GCS bucket and find the name of the latest timestamped folder (i.e. `20210717154947`), then replace `BACKUP_NAME` with it, then save the file. - -Notice that we are using the `jenkinsgcp` Kubernetes Secret that holds the `sa-credentials.json` key file for the GCP Service Account that we created in [Create a Service Account Key](#5-create-a-service-account-key). - -Having the Kubernetes Secret provide the GCP Service Account Key to the Restore Kubernetes Job is what will allow the Job to download the contents of the backup from the GCS bucket and put it into the `/var/jenkins_home` folder in the Persistent Volume Claim of the `jenkins-0` pod. - -##### 4. Deploy the Restore Job - -Deploy the Restore Job using the following command: - -```bash -kubectl apply -f restore.yaml -``` - -Wait about a minute for the Job to start, then query the logs using the following commands: - -```bash -# Get restore container name -RESTORE_CONTAINER=$(kubectl get pods | grep skbn | awk '{print $1}'); - -# Stream logs of restore container until job is finished -kubectl logs -f ${RESTORE_CONTAINER}; -``` - -Watch the logs until the job is done. This usually takes a few minutes. - -##### 5. Verify that Jenkins was restored from GCS Backup - -Login to Jenkins, then click on `Manage Jenkins-> Reload Configuration from Disk`, then press `OK`. - -Jenkins is now going to reload the backup content from disk and restart. Now, if you performed this on a new Jenkins installation, you will **not be able to login** using the password for the new installation of Jenkins. - -Because we are restoring from the backup of a previous installation, we need to login using the password for the old Jenkins installation. - -So, refresh your browser and login to Jenkins using the password from the backup. - -Now, verify that all your jobs, plugins, and credentials from that backup are showing up, and if they are, then CONGRATULATIONS on successfully restoring Jenkins from a GCS Backup! - -A similar process would work for AWS S3. See additional `backup` values using [configuration commands](#configuration) to figure out how what fields to put in the Restore Job manifest. - ### Adding Custom Pod Templates It is possible to add custom pod templates for the default configured kubernetes cloud. Add a key under `agent.podTemplates` for each pod template. Each key (prior to `|` character) is just a label, and can be any value. -Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. +Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. There's no need to add the _jnlp_ container since the kubernetes plugin will automatically inject it into the pod. For this pod templates configuration to be loaded the following values must be set: @@ -899,10 +611,10 @@ controller: If you want to expose Prometheus metrics you need to install the [Jenkins Prometheus Metrics Plugin](https://github.com/jenkinsci/prometheus-plugin). It will expose an endpoint (default `/prometheus`) with metrics where a Prometheus Server can scrape. -If you have implemented [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), you can set `master.prometheus.enabled` to `true` to configure a `ServiceMonitor` and `PrometheusRule`. -If you want to further adjust alerting rules you can do so by configuring `master.prometheus.alertingrules` +If you have implemented [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), you can set `controller.prometheus.enabled` to `true` to configure a `ServiceMonitor` and `PrometheusRule`. +If you want to further adjust alerting rules you can do so by configuring `controller.prometheus.alertingrules` -If you have implemented Prometheus without using the operator, you can leave `master.prometheus.enabled` set to `false`. +If you have implemented Prometheus without using the operator, you can leave `controller.prometheus.enabled` set to `false`. ### Running Behind a Forward Proxy @@ -935,12 +647,13 @@ controller: ### HTTPS Keystore Configuration -[This configuration](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777) enables jenkins to use keystore in order to serve https. +[This configuration](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777) enables jenkins to use keystore in order to serve HTTPS. Here is the [value file section](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777#RunningJenkinswithnativeSSL/HTTPS-ConfigureJenkinstouseHTTPSandtheJKSkeystore) related to keystore configuration. Keystore itself should be placed in front of `jenkinsKeyStoreBase64Encoded` key and in base64 encoded format. To achieve that after having `keystore.jks` file simply do this: `cat keystore.jks | base64` and paste the output in front of `jenkinsKeyStoreBase64Encoded`. -After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same, as `targetPort` will serve https. +After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same, as `targetPort` will serve HTTPS. Do not set `controller.httpsKeyStore.httpPort` to `-1` because it will cause readiness and liveliness prob to fail. -If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` and `https-jks-password`. Example: +If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` (or override the key name using `jenkinsHttpsJksSecretKey`) +and `https-jks-password` (or override the key name using `jenkinsHttpsJksPasswordSecretKey`; additionally you can make it get the password from a different secret using `jenkinsHttpsJksPasswordSecretName`). Example: ```yaml controller: @@ -992,116 +705,4 @@ Upgrade an existing release from `stable/jenkins` to `jenkins/jenkins` seamlessl Chart release versions follow [SemVer](../../CONTRIBUTING.md#versioning), where a MAJOR version change (example `1.0.0` -> `2.0.0`) indicates an incompatible breaking change needing manual actions. -### To 3.0.0 - -* Check `securityRealm` and `authorizationStrategy` and adjust it. - Otherwise, your configured users and permissions will be overridden. -* You need to use helm version 3 as the `Chart.yaml` uses `apiVersion: v2`. -* All XML configuration options have been removed. - In case those are still in use you need to migrate to configuration as code. - Upgrade guide to 2.0.0 contains pointers how to do that. -* Jenkins is now using a `StatefulSet` instead of a `Deployment` -* terminology has been adjusted that's also reflected in values.yaml - The following values from `values.yaml` have been renamed: - - * `master` => `controller` - * `master.useSecurity` => `controller.adminSecret` - * `master.slaveListenerPort` => `controller.agentListenerPort` - * `master.slaveHostPort` => `controller.agentListenerHostPort` - * `master.slaveKubernetesNamespace` => `agent.namespace` - * `master.slaveDefaultsProviderTemplate` => `agent.defaultsProviderTemplate` - * `master.slaveJenkinsUrl` => `agent.jenkinsUrl` - * `master.slaveJenkinsTunnel` => `agent.jenkinsTunnel` - * `master.slaveConnectTimeout` => `agent.kubernetesConnectTimeout` - * `master.slaveReadTimeout` => `agent.kubernetesReadTimeout` - * `master.slaveListenerServiceAnnotations` => `controller.agentListenerServiceAnnotations` - * `master.slaveListenerServiceType` => `controller.agentListenerServiceType` - * `master.slaveListenerLoadBalancerIP` => `controller.agentListenerLoadBalancerIP` - * `agent.slaveConnectTimeout` => `agent.connectTimeout` -* Removed values: - - * `master.imageTag`: use `controller.image` and `controller.tag` instead - * `slave.imageTag`: use `agent.image` and `agent.tag` instead - -### To 2.0.0 - -Configuration as Code is now default + container does not run as root anymore. - -#### Configuration as Code new default - -Configuration is done via [Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) by default. -That means that changes in values which result in a configuration change are always applied. -In contrast, the XML configuration was only applied during the first start and never altered. - -:exclamation::exclamation::exclamation: -Attention: -This also means if you manually altered configuration then this will most likely be reset to what was configured by default. -It also applies to `securityRealm` and `authorizationStrategy` as they are also configured using configuration as code. -:exclamation::exclamation::exclamation: - -#### Image does not run as root anymore - -It's not recommended to run containers in Kubernetes as `root`. - -❗Attention: If you had not configured a different user before then you need to ensure that your image supports the user and group ID configured and also manually change permissions of all files so that Jenkins is still able to use them. - -#### Summary of updated values - -As version 2.0.0 only updates default values and nothing else it's still possible to migrate to this version and opt out of some or all new defaults. -All you have to do is ensure the old values are set in your installation. - -Here we show which values have changed and the previous default values: - -```yaml -controller: - runAsUser: 1000 # was unset before - fsGroup: 1000 # was unset before - JCasC: - enabled: true # was false - defaultConfig: true # was false - sidecars: - configAutoReload: - enabled: true # was false -``` - -#### Migration steps - -Migration instructions heavily depend on your current setup. -So think of the list below more as a general guideline of what should be done. - -- Ensure that the Jenkins image you are using contains a user with ID 1000 and a group with the same ID. - That's the case for `jenkins/jenkins:lts` image, which the chart uses by default -- Make a backup of your existing installation especially the persistent volume -- Ensure that you have the configuration as code plugin installed -- Export your current settings via the plugin: - `Manage Jenkins` -> `Configuration as Code` -> `Download Configuration` -- prepare your values file for the update e.g. add additional configuration as code setting that you need. - The export taken from above might be a good starting point for this. - In addition, the [demos](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) from the plugin itself are quite useful. -- Test drive those setting on a separate installation -- Put Jenkins to Quiet Down mode so that it does not accept new jobs - `/quietDown` -- Change permissions of all files and folders to the new user and group id: - - ```console - kubectl exec -it -c jenkins /bin/bash - chown -R 1000:1000 /var/jenkins_home - ``` - -- Update Jenkins - -### To 1.0.0 - -Breaking changes: - -- Values have been renamed to follow [helm recommended naming conventions](https://helm.sh/docs/chart_best_practices/#naming-conventions) so that all variables start with a lowercase letter and words are separated with camelcase -- All resources are now using [helm recommended standard labels](https://helm.sh/docs/chart_best_practices/#standard-labels) - -As a result of the label changes also the selectors of the deployment have been updated. -Those are immutable so trying an updated will cause an error like: - -```console -Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-controller", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable -``` - -In order to upgrade, [uninstall](#uninstall-chart) the Jenkins Deployment before upgrading: +See [UPGRADING.md](./UPGRADING.md) for a list of breaking changes diff --git a/charts/jenkins/Tiltfile b/charts/jenkins/Tiltfile index 4537cfe66..d1ea3d708 100644 --- a/charts/jenkins/Tiltfile +++ b/charts/jenkins/Tiltfile @@ -1,5 +1,5 @@ # If not using a standard local dev name, specify your k8s context here #allow_k8s_contexts('jenkins-dev') -k8s_yaml(helm('.', values='values.yaml', set=['controller.adminPassword=asdf'])) +k8s_yaml(helm('.', values='values.yaml', set=['controller.admin.password=asdf'])) watch_file('.') diff --git a/charts/jenkins/UPGRADING.md b/charts/jenkins/UPGRADING.md new file mode 100644 index 000000000..0ff90112d --- /dev/null +++ b/charts/jenkins/UPGRADING.md @@ -0,0 +1,148 @@ +# Upgrade Notes + +## To 5.0.0 +- `controller.image`, `controller.tag`, and `controller.tagLabel` have been removed. If you want to overwrite the image you now need to configure any or all of: + - `controller.image.registry` + - `controller.image.repository` + - `controller.image.tag` + - `controller.image.tagLabel` +- `controller.imagePullPolicy` has been removed. If you want to overwrite the pull policy you now need to configure `controller.image.pullPolicy`. +- `controller.sidecars.configAutoReload.image` has been removed. If you want to overwrite the configAutoReload image you now need to configure any or all of: + - `controller.sidecars.configAutoReload.image.registry` + - `controller.sidecars.configAutoReload.image.repository` + - `controller.sidecars.configAutoReload.image.tag` +- `controller.sidecars.other` has been renamed to `controller.sidecars.additionalSidecarContainers`. +- `agent.image` and `agent.tag` have been removed. If you want to overwrite the agent image you now need to configure any or all of: + - `agent.image.repository` + - `agent.image.tag` + - The registry can still be overwritten by `agent.jnlpregistry` +- `agent.additionalContainers[*].image` has been renamed to `agent.additionalContainers[*].image.repository` +- `agent.additionalContainers[*].tag` has been renamed to `agent.additionalContainers[*].image.tag` +- `additionalAgents.*.image` has been renamed to `additionalAgents.*.image.repository` +- `additionalAgents.*.tag` has been renamed to `additionalAgents.*.image.tag` +- `additionalClouds.*.additionalAgents.*.image` has been renamed to `additionalClouds.*.additionalAgents.*.image.repository` +- `additionalClouds.*.additionalAgents.*.tag` has been renamed to `additionalClouds.*.additionalAgents.*.image.tag` +- `helmtest.bats.image` has been split up to: + - `helmtest.bats.image.registry` + - `helmtest.bats.image.repository` + - `helmtest.bats.image.tag` +- `controller.adminUsername` and `controller.adminPassword` have been renamed to `controller.admin.username` and `controller.admin.password` respectively +- `controller.adminSecret` has been renamed to `controller.admin.createSecret` +- `backup.*` was unmaintained and has thus been removed. See the following page for alternatives: [Kubernetes Backup and Migrations](https://nubenetes.com/kubernetes-backup-migrations/). + +## To 4.0.0 +Removes automatic `remotingSecurity` setting when using a container tag older than `2.326` (introduced in [`3.11.7`](./CHANGELOG.md#3117)). If you're using a version older than `2.326`, you should explicitly set `.controller.legacyRemotingSecurityEnabled` to `true`. + +## To 3.0.0 + +* Check `securityRealm` and `authorizationStrategy` and adjust it. + Otherwise, your configured users and permissions will be overridden. +* You need to use helm version 3 as the `Chart.yaml` uses `apiVersion: v2`. +* All XML configuration options have been removed. + In case those are still in use you need to migrate to configuration as code. + Upgrade guide to 2.0.0 contains pointers how to do that. +* Jenkins is now using a `StatefulSet` instead of a `Deployment` +* terminology has been adjusted that's also reflected in values.yaml + The following values from `values.yaml` have been renamed: + + * `master` => `controller` + * `master.useSecurity` => `controller.adminSecret` + * `master.slaveListenerPort` => `controller.agentListenerPort` + * `master.slaveHostPort` => `controller.agentListenerHostPort` + * `master.slaveKubernetesNamespace` => `agent.namespace` + * `master.slaveDefaultsProviderTemplate` => `agent.defaultsProviderTemplate` + * `master.slaveJenkinsUrl` => `agent.jenkinsUrl` + * `master.slaveJenkinsTunnel` => `agent.jenkinsTunnel` + * `master.slaveConnectTimeout` => `agent.kubernetesConnectTimeout` + * `master.slaveReadTimeout` => `agent.kubernetesReadTimeout` + * `master.slaveListenerServiceAnnotations` => `controller.agentListenerServiceAnnotations` + * `master.slaveListenerServiceType` => `controller.agentListenerServiceType` + * `master.slaveListenerLoadBalancerIP` => `controller.agentListenerLoadBalancerIP` + * `agent.slaveConnectTimeout` => `agent.connectTimeout` +* Removed values: + + * `master.imageTag`: use `controller.image` and `controller.tag` instead + * `slave.imageTag`: use `agent.image` and `agent.tag` instead + +## To 2.0.0 + +Configuration as Code is now default + container does not run as root anymore. + +### Configuration as Code new default + +Configuration is done via [Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) by default. +That means that changes in values which result in a configuration change are always applied. +In contrast, the XML configuration was only applied during the first start and never altered. + +:exclamation::exclamation::exclamation: +Attention: +This also means if you manually altered configuration then this will most likely be reset to what was configured by default. +It also applies to `securityRealm` and `authorizationStrategy` as they are also configured using configuration as code. +:exclamation::exclamation::exclamation: + +### Image does not run as root anymore + +It's not recommended to run containers in Kubernetes as `root`. + +❗Attention: If you had not configured a different user before then you need to ensure that your image supports the user and group ID configured and also manually change permissions of all files so that Jenkins is still able to use them. + +### Summary of updated values + +As version 2.0.0 only updates default values and nothing else it's still possible to migrate to this version and opt out of some or all new defaults. +All you have to do is ensure the old values are set in your installation. + +Here we show which values have changed and the previous default values: + +```yaml +controller: + runAsUser: 1000 # was unset before + fsGroup: 1000 # was unset before + JCasC: + enabled: true # was false + defaultConfig: true # was false + sidecars: + configAutoReload: + enabled: true # was false +``` + +### Migration steps + +Migration instructions heavily depend on your current setup. +So think of the list below more as a general guideline of what should be done. + +- Ensure that the Jenkins image you are using contains a user with ID 1000 and a group with the same ID. + That's the case for `jenkins/jenkins:lts` image, which the chart uses by default +- Make a backup of your existing installation especially the persistent volume +- Ensure that you have the configuration as code plugin installed +- Export your current settings via the plugin: + `Manage Jenkins` -> `Configuration as Code` -> `Download Configuration` +- prepare your values file for the update e.g. add additional configuration as code setting that you need. + The export taken from above might be a good starting point for this. + In addition, the [demos](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) from the plugin itself are quite useful. +- Test drive those setting on a separate installation +- Put Jenkins to Quiet Down mode so that it does not accept new jobs + `/quietDown` +- Change permissions of all files and folders to the new user and group ID: + + ```console + kubectl exec -it -c jenkins /bin/bash + chown -R 1000:1000 /var/jenkins_home + ``` + +- Update Jenkins + +## To 1.0.0 + +Breaking changes: + +- Values have been renamed to follow [helm recommended naming conventions](https://helm.sh/docs/chart_best_practices/#naming-conventions) so that all variables start with a lowercase letter and words are separated with camelcase +- All resources are now using [helm recommended standard labels](https://helm.sh/docs/chart_best_practices/#standard-labels) + +As a result of the label changes also the selectors of the deployment have been updated. +Those are immutable so trying an updated will cause an error like: + +```console +Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-controller", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable +``` + +In order to upgrade, [uninstall](./README.md#uninstall-chart) the Jenkins Deployment before upgrading: diff --git a/charts/jenkins/VALUES.md b/charts/jenkins/VALUES.md new file mode 100644 index 000000000..db2d1b274 --- /dev/null +++ b/charts/jenkins/VALUES.md @@ -0,0 +1,321 @@ +# Jenkins + +## Configuration + +The following tables list the configurable parameters of the Jenkins chart and their default values. + +## Values + +| Key | Type | Description | Default | +|:----|:-----|:---------|:------------| +| [additionalAgents](./values.yaml#L1199) | object | Configure additional | `{}` | +| [additionalClouds](./values.yaml#L1224) | object | | `{}` | +| [agent.TTYEnabled](./values.yaml#L1105) | bool | Allocate pseudo tty to the side container | `false` | +| [agent.additionalContainers](./values.yaml#L1152) | list | Add additional containers to the agents | `[]` | +| [agent.alwaysPullImage](./values.yaml#L998) | bool | Always pull agent container image before build | `false` | +| [agent.annotations](./values.yaml#L1148) | object | Annotations to apply to the pod | `{}` | +| [agent.args](./values.yaml#L1099) | string | Arguments passed to command to execute | `"${computer.jnlpmac} ${computer.name}"` | +| [agent.command](./values.yaml#L1097) | string | Command to execute when side container starts | `nil` | +| [agent.componentName](./values.yaml#L966) | string | | `"jenkins-agent"` | +| [agent.connectTimeout](./values.yaml#L1146) | int | Timeout in seconds for an agent to be online | `100` | +| [agent.containerCap](./values.yaml#L1107) | int | Max number of agents to launch | `10` | +| [agent.customJenkinsLabels](./values.yaml#L963) | list | Append Jenkins labels to the agent | `[]` | +| [agent.defaultsProviderTemplate](./values.yaml#L917) | string | The name of the pod template to use for providing default values | `""` | +| [agent.directConnection](./values.yaml#L969) | bool | | `false` | +| [agent.disableDefaultAgent](./values.yaml#L1170) | bool | Disable the default Jenkins Agent configuration | `false` | +| [agent.enabled](./values.yaml#L915) | bool | Enable Kubernetes plugin jnlp-agent podTemplate | `true` | +| [agent.envVars](./values.yaml#L1080) | list | Environment variables for the agent Pod | `[]` | +| [agent.garbageCollection.enabled](./values.yaml#L1114) | bool | When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them. | `false` | +| [agent.garbageCollection.namespaces](./values.yaml#L1116) | string | Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line. | `""` | +| [agent.garbageCollection.timeout](./values.yaml#L1121) | int | Timeout value for orphaned pods | `300` | +| [agent.hostNetworking](./values.yaml#L977) | bool | Enables the agent to use the host network | `false` | +| [agent.idleMinutes](./values.yaml#L1124) | int | Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it | `0` | +| [agent.image.repository](./values.yaml#L956) | string | Repository to pull the agent jnlp image from | `"jenkins/inbound-agent"` | +| [agent.image.tag](./values.yaml#L958) | string | Tag of the image to pull | `"3283.v92c105e0f819-7"` | +| [agent.imagePullSecretName](./values.yaml#L965) | string | Name of the secret to be used to pull the image | `nil` | +| [agent.inheritYamlMergeStrategy](./values.yaml#L1144) | bool | Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one | `false` | +| [agent.jenkinsTunnel](./values.yaml#L933) | string | Overrides the Kubernetes Jenkins tunnel | `nil` | +| [agent.jenkinsUrl](./values.yaml#L929) | string | Overrides the Kubernetes Jenkins URL | `nil` | +| [agent.jnlpregistry](./values.yaml#L953) | string | Custom registry used to pull the agent jnlp image from | `nil` | +| [agent.kubernetesConnectTimeout](./values.yaml#L939) | int | The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5 | `5` | +| [agent.kubernetesReadTimeout](./values.yaml#L941) | int | The read timeout in seconds for connections to Kubernetes API. The minimum value is 15 | `15` | +| [agent.livenessProbe](./values.yaml#L988) | object | | `{}` | +| [agent.maxRequestsPerHostStr](./values.yaml#L943) | string | The maximum concurrent connections to Kubernetes API | `"32"` | +| [agent.namespace](./values.yaml#L949) | string | Namespace in which the Kubernetes agents should be launched | `nil` | +| [agent.nodeSelector](./values.yaml#L1091) | object | Node labels for pod assignment | `{}` | +| [agent.nodeUsageMode](./values.yaml#L961) | string | | `"NORMAL"` | +| [agent.podLabels](./values.yaml#L951) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` | +| [agent.podName](./values.yaml#L1109) | string | Agent Pod base name | `"default"` | +| [agent.podRetention](./values.yaml#L1007) | string | | `"Never"` | +| [agent.podTemplates](./values.yaml#L1180) | object | Configures extra pod templates for the default kubernetes cloud | `{}` | +| [agent.privileged](./values.yaml#L971) | bool | Agent privileged container | `false` | +| [agent.resources](./values.yaml#L979) | object | Resources allocation (Requests and Limits) | `{"limits":{"cpu":"512m","memory":"512Mi"},"requests":{"cpu":"512m","memory":"512Mi"}}` | +| [agent.restrictedPssSecurityContext](./values.yaml#L1004) | bool | Set a restricted securityContext on jnlp containers | `false` | +| [agent.retentionTimeout](./values.yaml#L945) | int | Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated | `5` | +| [agent.runAsGroup](./values.yaml#L975) | string | Configure container group | `nil` | +| [agent.runAsUser](./values.yaml#L973) | string | Configure container user | `nil` | +| [agent.secretEnvVars](./values.yaml#L1084) | list | Mount a secret as environment variable | `[]` | +| [agent.serviceAccount](./values.yaml#L925) | string | Override the default service account | `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true` | +| [agent.showRawYaml](./values.yaml#L1011) | bool | | `true` | +| [agent.sideContainerName](./values.yaml#L1101) | string | Side container name | `"jnlp"` | +| [agent.skipTlsVerify](./values.yaml#L935) | bool | Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI | `false` | +| [agent.usageRestricted](./values.yaml#L937) | bool | Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI | `false` | +| [agent.useDefaultServiceAccount](./values.yaml#L921) | bool | Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount` | `true` | +| [agent.volumes](./values.yaml#L1018) | list | Additional volumes | `[]` | +| [agent.waitForPodSec](./values.yaml#L947) | int | Seconds to wait for pod to be running | `600` | +| [agent.websocket](./values.yaml#L968) | bool | Enables agent communication via websockets | `false` | +| [agent.workingDir](./values.yaml#L960) | string | Configure working directory for default agent | `"/home/jenkins/agent"` | +| [agent.workspaceVolume](./values.yaml#L1053) | object | Workspace volume (defaults to EmptyDir) | `{}` | +| [agent.yamlMergeStrategy](./values.yaml#L1142) | string | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override" | `"override"` | +| [agent.yamlTemplate](./values.yaml#L1131) | string | The raw yaml of a Pod API Object to merge into the agent spec | `""` | +| [awsSecurityGroupPolicies.enabled](./values.yaml#L1356) | bool | | `false` | +| [awsSecurityGroupPolicies.policies[0].name](./values.yaml#L1358) | string | | `""` | +| [awsSecurityGroupPolicies.policies[0].podSelector](./values.yaml#L1360) | object | | `{}` | +| [awsSecurityGroupPolicies.policies[0].securityGroupIds](./values.yaml#L1359) | list | | `[]` | +| [checkDeprecation](./values.yaml#L1353) | bool | Checks if any deprecated values are used | `true` | +| [clusterZone](./values.yaml#L21) | string | Override the cluster name for FQDN resolving | `"cluster.local"` | +| [controller.JCasC.authorizationStrategy](./values.yaml#L543) | string | Jenkins Config as Code Authorization Strategy-section | `"loggedInUsersCanDoAnything:\n allowAnonymousRead: false"` | +| [controller.JCasC.configMapAnnotations](./values.yaml#L548) | object | Annotations for the JCasC ConfigMap | `{}` | +| [controller.JCasC.configScripts](./values.yaml#L517) | object | List of Jenkins Config as Code scripts | `{}` | +| [controller.JCasC.configUrls](./values.yaml#L514) | list | Remote URLs for configuration files. | `[]` | +| [controller.JCasC.defaultConfig](./values.yaml#L508) | bool | Enables default Jenkins configuration via configuration as code plugin | `true` | +| [controller.JCasC.overwriteConfiguration](./values.yaml#L512) | bool | Whether Jenkins Config as Code should overwrite any existing configuration | `false` | +| [controller.JCasC.security](./values.yaml#L524) | object | Jenkins Config as Code security-section | `{"apiToken":{"creationOfLegacyTokenEnabled":false,"tokenGenerationOnCreationEnabled":false,"usageStatisticsEnabled":true}}` | +| [controller.JCasC.securityRealm](./values.yaml#L532) | string | Jenkins Config as Code Security Realm-section | `"local:\n allowsSignup: false\n enableCaptcha: false\n users:\n - id: \"${chart-admin-username}\"\n name: \"Jenkins Admin\"\n password: \"${chart-admin-password}\""` | +| [controller.additionalExistingSecrets](./values.yaml#L469) | list | List of additional existing secrets to mount | `[]` | +| [controller.additionalPlugins](./values.yaml#L419) | list | List of plugins to install in addition to those listed in controller.installPlugins | `[]` | +| [controller.additionalSecrets](./values.yaml#L478) | list | List of additional secrets to create and mount | `[]` | +| [controller.admin.createSecret](./values.yaml#L91) | bool | Create secret for admin user | `true` | +| [controller.admin.existingSecret](./values.yaml#L94) | string | The name of an existing secret containing the admin credentials | `""` | +| [controller.admin.password](./values.yaml#L81) | string | Admin password created as a secret if `controller.admin.createSecret` is true | `` | +| [controller.admin.passwordKey](./values.yaml#L86) | string | The key in the existing admin secret containing the password | `"jenkins-admin-password"` | +| [controller.admin.userKey](./values.yaml#L84) | string | The key in the existing admin secret containing the username | `"jenkins-admin-user"` | +| [controller.admin.username](./values.yaml#L78) | string | Admin username created as a secret if `controller.admin.createSecret` is true | `"admin"` | +| [controller.affinity](./values.yaml#L670) | object | Affinity settings | `{}` | +| [controller.agentListenerEnabled](./values.yaml#L328) | bool | Create Agent listener service | `true` | +| [controller.agentListenerExternalTrafficPolicy](./values.yaml#L338) | string | Traffic Policy of for the agentListener service | `nil` | +| [controller.agentListenerHostPort](./values.yaml#L332) | string | Host port to listen for agents | `nil` | +| [controller.agentListenerLoadBalancerIP](./values.yaml#L368) | string | Static IP for the agentListener LoadBalancer | `nil` | +| [controller.agentListenerLoadBalancerSourceRanges](./values.yaml#L340) | list | Allowed inbound IP for the agentListener service | `["0.0.0.0/0"]` | +| [controller.agentListenerNodePort](./values.yaml#L334) | string | Node port to listen for agents | `nil` | +| [controller.agentListenerPort](./values.yaml#L330) | int | Listening port for agents | `50000` | +| [controller.agentListenerServiceAnnotations](./values.yaml#L363) | object | Annotations for the agentListener service | `{}` | +| [controller.agentListenerServiceType](./values.yaml#L360) | string | Defines how to expose the agentListener service | `"ClusterIP"` | +| [controller.backendconfig.annotations](./values.yaml#L773) | object | backendconfig annotations | `{}` | +| [controller.backendconfig.apiVersion](./values.yaml#L767) | string | backendconfig API version | `"extensions/v1beta1"` | +| [controller.backendconfig.enabled](./values.yaml#L765) | bool | Enables backendconfig | `false` | +| [controller.backendconfig.labels](./values.yaml#L771) | object | backendconfig labels | `{}` | +| [controller.backendconfig.name](./values.yaml#L769) | string | backendconfig name | `nil` | +| [controller.backendconfig.spec](./values.yaml#L775) | object | backendconfig spec | `{}` | +| [controller.cloudName](./values.yaml#L497) | string | Name of default cloud configuration. | `"kubernetes"` | +| [controller.clusterIp](./values.yaml#L223) | string | k8s service clusterIP. Only used if serviceType is ClusterIP | `nil` | +| [controller.componentName](./values.yaml#L34) | string | Used for label app.kubernetes.io/component | `"jenkins-controller"` | +| [controller.containerEnv](./values.yaml#L156) | list | Environment variables for Jenkins Container | `[]` | +| [controller.containerEnvFrom](./values.yaml#L153) | list | Environment variable sources for Jenkins Container | `[]` | +| [controller.containerSecurityContext](./values.yaml#L211) | object | Allow controlling the securityContext for the jenkins container | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":1000}` | +| [controller.csrf.defaultCrumbIssuer.enabled](./values.yaml#L349) | bool | Enable the default CSRF Crumb issuer | `true` | +| [controller.csrf.defaultCrumbIssuer.proxyCompatability](./values.yaml#L351) | bool | Enable proxy compatibility | `true` | +| [controller.customInitContainers](./values.yaml#L551) | list | Custom init-container specification in raw-yaml format | `[]` | +| [controller.customJenkinsLabels](./values.yaml#L68) | list | Append Jenkins labels to the controller | `[]` | +| [controller.disableRememberMe](./values.yaml#L59) | bool | Disable use of remember me | `false` | +| [controller.disabledAgentProtocols](./values.yaml#L343) | list | Disabled agent protocols | `["JNLP-connect","JNLP2-connect"]` | +| [controller.enableRawHtmlMarkupFormatter](./values.yaml#L439) | bool | Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter) | `false` | +| [controller.enableServiceLinks](./values.yaml#L130) | bool | | `false` | +| [controller.executorMode](./values.yaml#L65) | string | Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE" | `"NORMAL"` | +| [controller.existingSecret](./values.yaml#L466) | string | | `nil` | +| [controller.extraPorts](./values.yaml#L398) | list | Optionally configure other ports to expose in the controller container | `[]` | +| [controller.fsGroup](./values.yaml#L192) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | +| [controller.googlePodMonitor.enabled](./values.yaml#L836) | bool | | `false` | +| [controller.googlePodMonitor.scrapeEndpoint](./values.yaml#L841) | string | | `"/prometheus"` | +| [controller.googlePodMonitor.scrapeInterval](./values.yaml#L839) | string | | `"60s"` | +| [controller.healthProbes](./values.yaml#L258) | bool | Enable Kubernetes Probes configuration configured in `controller.probes` | `true` | +| [controller.hostAliases](./values.yaml#L789) | list | Allows for adding entries to Pod /etc/hosts | `[]` | +| [controller.hostNetworking](./values.yaml#L70) | bool | | `false` | +| [controller.httpsKeyStore.disableSecretMount](./values.yaml#L857) | bool | | `false` | +| [controller.httpsKeyStore.enable](./values.yaml#L848) | bool | Enables HTTPS keystore on jenkins controller | `false` | +| [controller.httpsKeyStore.fileName](./values.yaml#L865) | string | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `"keystore.jks"` | +| [controller.httpsKeyStore.httpPort](./values.yaml#L861) | int | HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port. | `8081` | +| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey](./values.yaml#L856) | string | Name of the key in the secret that contains the JKS password | `"https-jks-password"` | +| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName](./values.yaml#L854) | string | Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file | `""` | +| [controller.httpsKeyStore.jenkinsHttpsJksSecretKey](./values.yaml#L852) | string | Name of the key in the secret that already has ssl keystore | `"jenkins-jks-file"` | +| [controller.httpsKeyStore.jenkinsHttpsJksSecretName](./values.yaml#L850) | string | Name of the secret that already has ssl keystore | `""` | +| [controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded](./values.yaml#L870) | string | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | `nil` | +| [controller.httpsKeyStore.password](./values.yaml#L867) | string | Jenkins keystore password | `"password"` | +| [controller.httpsKeyStore.path](./values.yaml#L863) | string | Path of HTTPS keystore file | `"/var/jenkins_keystore"` | +| [controller.image.pullPolicy](./values.yaml#L47) | string | Controller image pull policy | `"Always"` | +| [controller.image.registry](./values.yaml#L37) | string | Controller image registry | `"docker.io"` | +| [controller.image.repository](./values.yaml#L39) | string | Controller image repository | `"jenkins/jenkins"` | +| [controller.image.tag](./values.yaml#L42) | string | Controller image tag override; i.e., tag: "2.440.1-jdk17" | `nil` | +| [controller.image.tagLabel](./values.yaml#L45) | string | Controller image tag label | `"jdk17"` | +| [controller.imagePullSecretName](./values.yaml#L49) | string | Controller image pull secret | `nil` | +| [controller.ingress.annotations](./values.yaml#L712) | object | Ingress annotations | `{}` | +| [controller.ingress.apiVersion](./values.yaml#L708) | string | Ingress API version | `"extensions/v1beta1"` | +| [controller.ingress.enabled](./values.yaml#L691) | bool | Enables ingress | `false` | +| [controller.ingress.hostName](./values.yaml#L725) | string | Ingress hostname | `nil` | +| [controller.ingress.labels](./values.yaml#L710) | object | Ingress labels | `{}` | +| [controller.ingress.path](./values.yaml#L721) | string | Ingress path | `nil` | +| [controller.ingress.paths](./values.yaml#L695) | list | Override for the default Ingress paths | `[]` | +| [controller.ingress.resourceRootUrl](./values.yaml#L727) | string | Hostname to serve assets from | `nil` | +| [controller.ingress.tls](./values.yaml#L729) | list | Ingress TLS configuration | `[]` | +| [controller.initConfigMap](./values.yaml#L456) | string | Name of the existing ConfigMap that contains init scripts | `nil` | +| [controller.initContainerEnv](./values.yaml#L147) | list | Environment variables for Init Container | `[]` | +| [controller.initContainerEnvFrom](./values.yaml#L143) | list | Environment variable sources for Init Container | `[]` | +| [controller.initContainerResources](./values.yaml#L134) | object | Resources allocation (Requests and Limits) for Init Container | `{}` | +| [controller.initScripts](./values.yaml#L452) | object | Map of groovy init scripts to be executed during Jenkins controller start | `{}` | +| [controller.initializeOnce](./values.yaml#L424) | bool | Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true` | `false` | +| [controller.installLatestPlugins](./values.yaml#L413) | bool | Download the minimum required version or latest version of all dependencies | `true` | +| [controller.installLatestSpecifiedPlugins](./values.yaml#L416) | bool | Set to true to download the latest version of any plugin that is requested to have the latest version | `false` | +| [controller.installPlugins](./values.yaml#L405) | list | List of Jenkins plugins to install. If you don't want to install plugins, set it to `false` | `["kubernetes:4306.vc91e951ea_eb_d","workflow-aggregator:600.vb_57cdd26fdd7","git:5.7.0","configuration-as-code:1915.vcdd0a_d0d2625"]` | +| [controller.javaOpts](./values.yaml#L162) | string | Append to `JAVA_OPTS` env var | `nil` | +| [controller.jenkinsAdminEmail](./values.yaml#L96) | string | Email address for the administrator of the Jenkins instance | `nil` | +| [controller.jenkinsHome](./values.yaml#L101) | string | Custom Jenkins home path | `"/var/jenkins_home"` | +| [controller.jenkinsOpts](./values.yaml#L164) | string | Append to `JENKINS_OPTS` env var | `nil` | +| [controller.jenkinsRef](./values.yaml#L106) | string | Custom Jenkins reference path | `"/usr/share/jenkins/ref"` | +| [controller.jenkinsUriPrefix](./values.yaml#L179) | string | Root URI Jenkins will be served on | `nil` | +| [controller.jenkinsUrl](./values.yaml#L174) | string | Set Jenkins URL if you are not using the ingress definitions provided by the chart | `nil` | +| [controller.jenkinsUrlProtocol](./values.yaml#L171) | string | Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise | `nil` | +| [controller.jenkinsWar](./values.yaml#L109) | string | | `"/usr/share/jenkins/jenkins.war"` | +| [controller.jmxPort](./values.yaml#L395) | string | Open a port, for JMX stats | `nil` | +| [controller.legacyRemotingSecurityEnabled](./values.yaml#L371) | bool | Whether legacy remoting security should be enabled | `false` | +| [controller.lifecycle](./values.yaml#L51) | object | Lifecycle specification for controller-container | `{}` | +| [controller.loadBalancerIP](./values.yaml#L386) | string | Optionally assign a known public LB IP | `nil` | +| [controller.loadBalancerSourceRanges](./values.yaml#L382) | list | Allowed inbound IP addresses | `["0.0.0.0/0"]` | +| [controller.markupFormatter](./values.yaml#L443) | string | Yaml of the markup formatter to use | `"plainText"` | +| [controller.nodePort](./values.yaml#L229) | string | k8s node port. Only used if serviceType is NodePort | `nil` | +| [controller.nodeSelector](./values.yaml#L657) | object | Node labels for pod assignment | `{}` | +| [controller.numExecutors](./values.yaml#L62) | int | Set Number of executors | `0` | +| [controller.overwritePlugins](./values.yaml#L428) | bool | Overwrite installed plugins on start | `false` | +| [controller.overwritePluginsFromImage](./values.yaml#L432) | bool | Overwrite plugins that are already installed in the controller image | `true` | +| [controller.podAnnotations](./values.yaml#L678) | object | Annotations for controller pod | `{}` | +| [controller.podDisruptionBudget.annotations](./values.yaml#L322) | object | | `{}` | +| [controller.podDisruptionBudget.apiVersion](./values.yaml#L320) | string | Policy API version | `"policy/v1beta1"` | +| [controller.podDisruptionBudget.enabled](./values.yaml#L315) | bool | Enable Kubernetes Pod Disruption Budget configuration | `false` | +| [controller.podDisruptionBudget.labels](./values.yaml#L323) | object | | `{}` | +| [controller.podDisruptionBudget.maxUnavailable](./values.yaml#L325) | string | Number of pods that can be unavailable. Either an absolute number or a percentage | `"0"` | +| [controller.podLabels](./values.yaml#L251) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` | +| [controller.podSecurityContextOverride](./values.yaml#L208) | string | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities` | `nil` | +| [controller.priorityClassName](./values.yaml#L675) | string | The name of a `priorityClass` to apply to the controller pod | `nil` | +| [controller.probes.livenessProbe.failureThreshold](./values.yaml#L276) | int | Set the failure threshold for the liveness probe | `5` | +| [controller.probes.livenessProbe.httpGet.path](./values.yaml#L279) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | +| [controller.probes.livenessProbe.httpGet.port](./values.yaml#L281) | string | Set the Pod's HTTP port to use for the liveness probe | `"http"` | +| [controller.probes.livenessProbe.initialDelaySeconds](./values.yaml#L290) | string | Set the initial delay for the liveness probe in seconds | `nil` | +| [controller.probes.livenessProbe.periodSeconds](./values.yaml#L283) | int | Set the time interval between two liveness probes executions in seconds | `10` | +| [controller.probes.livenessProbe.timeoutSeconds](./values.yaml#L285) | int | Set the timeout for the liveness probe in seconds | `5` | +| [controller.probes.readinessProbe.failureThreshold](./values.yaml#L294) | int | Set the failure threshold for the readiness probe | `3` | +| [controller.probes.readinessProbe.httpGet.path](./values.yaml#L297) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | +| [controller.probes.readinessProbe.httpGet.port](./values.yaml#L299) | string | Set the Pod's HTTP port to use for the readiness probe | `"http"` | +| [controller.probes.readinessProbe.initialDelaySeconds](./values.yaml#L308) | string | Set the initial delay for the readiness probe in seconds | `nil` | +| [controller.probes.readinessProbe.periodSeconds](./values.yaml#L301) | int | Set the time interval between two readiness probes executions in seconds | `10` | +| [controller.probes.readinessProbe.timeoutSeconds](./values.yaml#L303) | int | Set the timeout for the readiness probe in seconds | `5` | +| [controller.probes.startupProbe.failureThreshold](./values.yaml#L263) | int | Set the failure threshold for the startup probe | `12` | +| [controller.probes.startupProbe.httpGet.path](./values.yaml#L266) | string | Set the Pod's HTTP path for the startup probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | +| [controller.probes.startupProbe.httpGet.port](./values.yaml#L268) | string | Set the Pod's HTTP port to use for the startup probe | `"http"` | +| [controller.probes.startupProbe.periodSeconds](./values.yaml#L270) | int | Set the time interval between two startup probes executions in seconds | `10` | +| [controller.probes.startupProbe.timeoutSeconds](./values.yaml#L272) | int | Set the timeout for the startup probe in seconds | `5` | +| [controller.projectNamingStrategy](./values.yaml#L435) | string | | `"standard"` | +| [controller.prometheus.alertingRulesAdditionalLabels](./values.yaml#L822) | object | Additional labels to add to the PrometheusRule object | `{}` | +| [controller.prometheus.alertingrules](./values.yaml#L820) | list | Array of prometheus alerting rules | `[]` | +| [controller.prometheus.enabled](./values.yaml#L805) | bool | Enables prometheus service monitor | `false` | +| [controller.prometheus.metricRelabelings](./values.yaml#L832) | list | | `[]` | +| [controller.prometheus.prometheusRuleNamespace](./values.yaml#L824) | string | Set a custom namespace where to deploy PrometheusRule resource | `""` | +| [controller.prometheus.relabelings](./values.yaml#L830) | list | | `[]` | +| [controller.prometheus.scrapeEndpoint](./values.yaml#L815) | string | The endpoint prometheus should get metrics from | `"/prometheus"` | +| [controller.prometheus.scrapeInterval](./values.yaml#L811) | string | How often prometheus should scrape metrics | `"60s"` | +| [controller.prometheus.serviceMonitorAdditionalLabels](./values.yaml#L807) | object | Additional labels to add to the service monitor object | `{}` | +| [controller.prometheus.serviceMonitorNamespace](./values.yaml#L809) | string | Set a custom namespace where to deploy ServiceMonitor resource | `nil` | +| [controller.publishNotReadyAddresses](./values.yaml#L237) | string | | `nil` | +| [controller.resources](./values.yaml#L115) | object | Resource allocation (Requests and Limits) | `{"limits":{"cpu":"2000m","memory":"4096Mi"},"requests":{"cpu":"50m","memory":"256Mi"}}` | +| [controller.route.annotations](./values.yaml#L784) | object | Route annotations | `{}` | +| [controller.route.enabled](./values.yaml#L780) | bool | Enables openshift route | `false` | +| [controller.route.labels](./values.yaml#L782) | object | Route labels | `{}` | +| [controller.route.path](./values.yaml#L786) | string | Route path | `nil` | +| [controller.runAsUser](./values.yaml#L189) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | +| [controller.schedulerName](./values.yaml#L653) | string | Name of the Kubernetes scheduler to use | `""` | +| [controller.scriptApproval](./values.yaml#L447) | list | List of groovy functions to approve | `[]` | +| [controller.secondaryingress.annotations](./values.yaml#L747) | object | | `{}` | +| [controller.secondaryingress.apiVersion](./values.yaml#L745) | string | | `"extensions/v1beta1"` | +| [controller.secondaryingress.enabled](./values.yaml#L739) | bool | | `false` | +| [controller.secondaryingress.hostName](./values.yaml#L754) | string | | `nil` | +| [controller.secondaryingress.labels](./values.yaml#L746) | object | | `{}` | +| [controller.secondaryingress.paths](./values.yaml#L742) | list | | `[]` | +| [controller.secondaryingress.tls](./values.yaml#L755) | string | | `nil` | +| [controller.secretClaims](./values.yaml#L490) | list | List of `SecretClaim` resources to create | `[]` | +| [controller.securityContextCapabilities](./values.yaml#L198) | object | | `{}` | +| [controller.serviceAnnotations](./values.yaml#L240) | object | Jenkins controller service annotations | `{}` | +| [controller.serviceExternalTrafficPolicy](./values.yaml#L233) | string | | `nil` | +| [controller.serviceLabels](./values.yaml#L246) | object | Labels for the Jenkins controller-service | `{}` | +| [controller.servicePort](./values.yaml#L225) | int | k8s service port | `8080` | +| [controller.serviceType](./values.yaml#L220) | string | k8s service type | `"ClusterIP"` | +| [controller.shareProcessNamespace](./values.yaml#L124) | bool | | `false` | +| [controller.sidecars.additionalSidecarContainers](./values.yaml#L635) | list | Configures additional sidecar container(s) for the Jenkins controller | `[]` | +| [controller.sidecars.configAutoReload.additionalVolumeMounts](./values.yaml#L581) | list | Enables additional volume mounts for the config auto-reload container | `[]` | +| [controller.sidecars.configAutoReload.containerSecurityContext](./values.yaml#L630) | object | Enable container security context | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` | +| [controller.sidecars.configAutoReload.enabled](./values.yaml#L564) | bool | Enables Jenkins Config as Code auto-reload | `true` | +| [controller.sidecars.configAutoReload.env](./values.yaml#L612) | object | Environment variables for the Jenkins Config as Code auto-reload container | `{}` | +| [controller.sidecars.configAutoReload.envFrom](./values.yaml#L610) | list | Environment variable sources for the Jenkins Config as Code auto-reload container | `[]` | +| [controller.sidecars.configAutoReload.folder](./values.yaml#L623) | string | | `"/var/jenkins_home/casc_configs"` | +| [controller.sidecars.configAutoReload.image.registry](./values.yaml#L567) | string | Registry for the image that triggers the reload | `"docker.io"` | +| [controller.sidecars.configAutoReload.image.repository](./values.yaml#L569) | string | Repository of the image that triggers the reload | `"kiwigrid/k8s-sidecar"` | +| [controller.sidecars.configAutoReload.image.tag](./values.yaml#L571) | string | Tag for the image that triggers the reload | `"1.29.0"` | +| [controller.sidecars.configAutoReload.imagePullPolicy](./values.yaml#L572) | string | | `"IfNotPresent"` | +| [controller.sidecars.configAutoReload.logging](./values.yaml#L587) | object | Config auto-reload logging settings | `{"configuration":{"backupCount":3,"formatter":"JSON","logLevel":"INFO","logToConsole":true,"logToFile":false,"maxBytes":1024,"override":false}}` | +| [controller.sidecars.configAutoReload.logging.configuration.override](./values.yaml#L591) | bool | Enables custom log config utilizing using the settings below. | `false` | +| [controller.sidecars.configAutoReload.reqRetryConnect](./values.yaml#L605) | int | How many connection-related errors to retry on | `10` | +| [controller.sidecars.configAutoReload.resources](./values.yaml#L573) | object | | `{}` | +| [controller.sidecars.configAutoReload.scheme](./values.yaml#L600) | string | The scheme to use when connecting to the Jenkins configuration as code endpoint | `"http"` | +| [controller.sidecars.configAutoReload.skipTlsVerify](./values.yaml#L602) | bool | Skip TLS verification when connecting to the Jenkins configuration as code endpoint | `false` | +| [controller.sidecars.configAutoReload.sleepTime](./values.yaml#L607) | string | How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) | `nil` | +| [controller.sidecars.configAutoReload.sshTcpPort](./values.yaml#L621) | int | | `1044` | +| [controller.statefulSetAnnotations](./values.yaml#L680) | object | Annotations for controller StatefulSet | `{}` | +| [controller.statefulSetLabels](./values.yaml#L242) | object | Jenkins controller custom labels for the StatefulSet | `{}` | +| [controller.targetPort](./values.yaml#L227) | int | k8s target port | `8080` | +| [controller.terminationGracePeriodSeconds](./values.yaml#L663) | string | Set TerminationGracePeriodSeconds | `nil` | +| [controller.terminationMessagePath](./values.yaml#L665) | string | Set the termination message path | `nil` | +| [controller.terminationMessagePolicy](./values.yaml#L667) | string | Set the termination message policy | `nil` | +| [controller.testEnabled](./values.yaml#L844) | bool | Can be used to disable rendering controller test resources when using helm template | `true` | +| [controller.tolerations](./values.yaml#L661) | list | Toleration labels for pod assignment | `[]` | +| [controller.topologySpreadConstraints](./values.yaml#L687) | object | Topology spread constraints | `{}` | +| [controller.updateStrategy](./values.yaml#L684) | object | Update strategy for StatefulSet | `{}` | +| [controller.usePodSecurityContext](./values.yaml#L182) | bool | Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) | `true` | +| [credentialsId](./values.yaml#L27) | string | The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed. | `nil` | +| [fullnameOverride](./values.yaml#L13) | string | Override the full resource names | `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins` | +| [helmtest.bats.image.registry](./values.yaml#L1369) | string | Registry of the image used to test the framework | `"docker.io"` | +| [helmtest.bats.image.repository](./values.yaml#L1371) | string | Repository of the image used to test the framework | `"bats/bats"` | +| [helmtest.bats.image.tag](./values.yaml#L1373) | string | Tag of the image to test the framework | `"1.11.1"` | +| [kubernetesURL](./values.yaml#L24) | string | The URL of the Kubernetes API server | `"https://kubernetes.default"` | +| [nameOverride](./values.yaml#L10) | string | Override the resource name prefix | `Chart.Name` | +| [namespaceOverride](./values.yaml#L16) | string | Override the deployment namespace | `Release.Namespace` | +| [networkPolicy.apiVersion](./values.yaml#L1293) | string | NetworkPolicy ApiVersion | `"networking.k8s.io/v1"` | +| [networkPolicy.enabled](./values.yaml#L1288) | bool | Enable the creation of NetworkPolicy resources | `false` | +| [networkPolicy.externalAgents.except](./values.yaml#L1307) | list | A list of IP sub-ranges to be excluded from the allowlisted IP range | `[]` | +| [networkPolicy.externalAgents.ipCIDR](./values.yaml#L1305) | string | The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16 | `nil` | +| [networkPolicy.internalAgents.allowed](./values.yaml#L1297) | bool | Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels | `true` | +| [networkPolicy.internalAgents.namespaceLabels](./values.yaml#L1301) | object | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller | `{}` | +| [networkPolicy.internalAgents.podLabels](./values.yaml#L1299) | object | A map of labels (keys/values) that agent pods must have to be able to connect to controller | `{}` | +| [persistence.accessMode](./values.yaml#L1263) | string | The PVC access mode | `"ReadWriteOnce"` | +| [persistence.annotations](./values.yaml#L1259) | object | Annotations for the PVC | `{}` | +| [persistence.dataSource](./values.yaml#L1269) | object | Existing data source to clone PVC from | `{}` | +| [persistence.enabled](./values.yaml#L1243) | bool | Enable the use of a Jenkins PVC | `true` | +| [persistence.existingClaim](./values.yaml#L1249) | string | Provide the name of a PVC | `nil` | +| [persistence.labels](./values.yaml#L1261) | object | Labels for the PVC | `{}` | +| [persistence.mounts](./values.yaml#L1281) | list | Additional mounts | `[]` | +| [persistence.size](./values.yaml#L1265) | string | The size of the PVC | `"8Gi"` | +| [persistence.storageClass](./values.yaml#L1257) | string | Storage class for the PVC | `nil` | +| [persistence.subPath](./values.yaml#L1274) | string | SubPath for jenkins-home mount | `nil` | +| [persistence.volumes](./values.yaml#L1276) | list | Additional volumes | `[]` | +| [rbac.create](./values.yaml#L1313) | bool | Whether RBAC resources are created | `true` | +| [rbac.readSecrets](./values.yaml#L1315) | bool | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` | +| [rbac.useOpenShiftNonRootSCC](./values.yaml#L1317) | bool | Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints | `false` | +| [renderHelmLabels](./values.yaml#L30) | bool | Enables rendering of the helm.sh/chart label to the annotations | `true` | +| [serviceAccount.annotations](./values.yaml#L1327) | object | Configures annotations for the ServiceAccount | `{}` | +| [serviceAccount.automountServiceAccountToken](./values.yaml#L1333) | bool | Auto-mount ServiceAccount token | `true` | +| [serviceAccount.create](./values.yaml#L1321) | bool | Configures if a ServiceAccount with this name should be created | `true` | +| [serviceAccount.extraLabels](./values.yaml#L1329) | object | Configures extra labels for the ServiceAccount | `{}` | +| [serviceAccount.imagePullSecretName](./values.yaml#L1331) | string | Controller ServiceAccount image pull secret | `nil` | +| [serviceAccount.name](./values.yaml#L1325) | string | | `nil` | +| [serviceAccountAgent.annotations](./values.yaml#L1344) | object | Configures annotations for the agent ServiceAccount | `{}` | +| [serviceAccountAgent.automountServiceAccountToken](./values.yaml#L1350) | bool | Auto-mount ServiceAccount token | `true` | +| [serviceAccountAgent.create](./values.yaml#L1338) | bool | Configures if an agent ServiceAccount should be created | `false` | +| [serviceAccountAgent.extraLabels](./values.yaml#L1346) | object | Configures extra labels for the agent ServiceAccount | `{}` | +| [serviceAccountAgent.imagePullSecretName](./values.yaml#L1348) | string | Agent ServiceAccount image pull secret | `nil` | +| [serviceAccountAgent.name](./values.yaml#L1342) | string | The name of the agent ServiceAccount to be used by access-controlled resources | `nil` | diff --git a/charts/jenkins/VALUES.md.gotmpl b/charts/jenkins/VALUES.md.gotmpl new file mode 100644 index 000000000..21080e35a --- /dev/null +++ b/charts/jenkins/VALUES.md.gotmpl @@ -0,0 +1,28 @@ +# Jenkins + +## Configuration + +The following tables list the configurable parameters of the Jenkins chart and their default values. + +{{- define "chart.valueDefaultColumnRender" -}} +{{- $defaultValue := (trimAll "`" (default .Default .AutoDefault) | replace "\n" "") -}} +`{{- $defaultValue | replace "\n" "" -}}` +{{- end -}} + +{{- define "chart.typeColumnRender" -}} +{{- .Type -}} +{{- end -}} + +{{- define "chart.valueDescription" -}} +{{- default .Description .AutoDescription }} +{{- end -}} + +{{- define "chart.valuesTable" -}} +| Key | Type | Description | Default | +|:----|:-----|:---------|:------------| +{{- range .Values }} +| [{{ .Key }}](./values.yaml#L{{ .LineNumber }}) | {{ template "chart.typeColumnRender" . }} | {{ template "chart.valueDescription" . }} | {{ template "chart.valueDefaultColumnRender" . }} | +{{- end }} +{{- end }} + +{{ template "chart.valuesSection" . }} diff --git a/charts/jenkins/VALUES_SUMMARY.md b/charts/jenkins/VALUES_SUMMARY.md deleted file mode 100644 index 6a3562b5c..000000000 --- a/charts/jenkins/VALUES_SUMMARY.md +++ /dev/null @@ -1,410 +0,0 @@ -# Jenkins - -## Configuration - -The following tables list the configurable parameters of the Jenkins chart and their default values. - -### Jenkins Controller - -| Parameter | Description | Default | -|---------------------------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------| -| `checkDeprecation` | Checks for deprecated values used | `true` | -| `clusterZone` | Override the cluster name for FQDN resolving | `cluster.local` | -| `nameOverride` | Override the resource name prefix | `jenkins` | -| `renderHelmLabels` | Enables rendering of the helm.sh/chart label to the annotations | `true` | -| `fullnameOverride` | Override the full resource names | `jenkins-{release-name}` (or `jenkins` if release-name is `jenkins`) | -| `namespaceOverride` | Override the deployment namespace | Not set (`Release.Namespace`) | -| `controller.componentName` | Jenkins controller name | `jenkins-controller` | -| `controller.testEnabled` | Can be used to disable rendering test resources when using helm template | `true` | -| `controller.cloudName` | Name of default cloud configuration | `kubernetes` | -| `controller.legacyRemotingSecurityEnabled` | Is remoting security enabled? | Not set (i.e. not enabled) | - -#### Jenkins Configuration as Code (JCasC) - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.JCasC.defaultConfig` | Enables default Jenkins configuration via configuration as code plugin | `true` | -| `controller.JCasC.configScripts` | List of Jenkins Config as Code scripts | `{}` | -| `controller.JCasC.security` | Jenkins Config as Code for Security section | `legacy` | -| `controller.JCasC.securityRealm` | Jenkins Config as Code for Security Realm | `legacy` | -| `controller.JCasC.authorizationStrategy` | Jenkins Config as Code for Authorization Strategy | `loggedInUsersCanDoAnything` | -| `controller.sidecars.configAutoReload` | Jenkins Config as Code auto-reload settings | | -| `controller.sidecars.configAutoReload.enabled` | Jenkins Config as Code auto-reload settings (Attention: rbac needs to be enabled otherwise the sidecar can't read the config map) | `true` | -| `controller.sidecars.configAutoReload.image` | Image which triggers the reload | `kiwigrid/k8s-sidecar:1.23.1` | -| `controller.sidecars.configAutoReload.reqRetryConnect` | How many connection-related errors to retry on | `10` | -| `controller.sidecars.configAutoReload.envFrom` | Environment variable sources for the Jenkins Config as Code auto-reload container | Not set | -| `controller.sidecars.configAutoReload.env` | Environment variables for the Jenkins Config as Code auto-reload container | Not set | -| `controller.sidecars.configAutoReload.containerSecurityContext` | Enable container security context | `{readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` | - -#### Jenkins Configuration Files & Scripts - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.initScripts` | List of Jenkins init scripts | `[]` | -| `controller.initConfigMap` | Pre-existing init scripts | Not set | - -#### Jenkins Global Security - -| Parameter | Description | Default | -| --------------------------------- | ---------------------------------------- | ----------------------------------------- | -| `controller.adminSecret` | Create secret for admin user | `true` | -| `controller.disableRememberMe` | Disable use of remember me | `false` | -| `controller.enableRawHtmlMarkupFormatter` | Enable HTML parsing using | false | -| `controller.markupFormatter` | Yaml of the markup formatter to use | `plainText` | -| `controller.disabledAgentProtocols` | Disabled agent protocols | `JNLP-connect JNLP2-connect` | -| `controller.csrf.defaultCrumbIssuer.enabled` | Enable the default CSRF Crumb issuer | `true` | -| `controller.csrf.defaultCrumbIssuer.proxyCompatability` | Enable proxy compatibility | `true` | - -#### Jenkins Global Settings - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.numExecutors` | Set Number of executors | 0 | -| `controller.executorMode` | Set executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE | NORMAL | -| `controller.customJenkinsLabels` | Append Jenkins labels to the controller | `[]` | -| `controller.jenkinsHome` | Custom Jenkins home path | `/var/jenkins_home` | -| `controller.jenkinsRef` | Custom Jenkins reference path | `/usr/share/jenkins/ref` | -| `controller.jenkinsAdminEmail` | Email address for the administrator of the Jenkins instance | Not set | -| `controller.jenkinsUrl` | Set Jenkins URL if you are not using the ingress definitions provided by the chart | Not set | -| `controller.jenkinsUrlProtocol` | Set protocol for Jenkins URL | Set to `https` if `controller.ingress.tls`, `http` otherwise | -| `controller.jenkinsUriPrefix` | Root Uri Jenkins will be served on | Not set | - -#### Jenkins In-Process Script Approval - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.scriptApproval` | List of groovy functions to approve | `[]` | - -#### Jenkins Plugins - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.installPlugins` | List of Jenkins plugins to install. If you don't want to install plugins set it to `false` | `kubernetes:1.31.3 workflow-aggregator:2.6 git:4.10.2 configuration-as-code:1414.v878271fc496f` | -| `controller.additionalPlugins` | List of Jenkins plugins to install in addition to those listed in controller.installPlugins | `[]` | -| `controller.initializeOnce` | Initialize only on first install. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`. | `false` | -| `controller.overwritePlugins` | Overwrite installed plugins on start.| `false` | -| `controller.overwritePluginsFromImage` | Keep plugins that are already installed in the controller image.| `true` | -| `controller.installLatestPlugins` | Set to false to download the minimum required version of all dependencies. | `true` | -| `controller.installLatestSpecifiedPlugins` | Set to true to download latest dependencies of any plugin that is requested to have the latest version. | `false` | - -#### Jenkins Agent Listener - -| Parameter | Description | Default | -| -------------------------------------------- | ----------------------------------------------- | ------------ | -| `controller.agentListenerEnabled` | Create Agent listener service | `true` | -| `controller.agentListenerPort` | Listening port for agents | `50000` | -| `controller.agentListenerHostPort` | Host port to listen for agents | Not set | -| `controller.agentListenerNodePort` | Node port to listen for agents | Not set | -| `controller.agentListenerServiceType` | Defines how to expose the agentListener service | `ClusterIP` | -| `controller.agentListenerServiceAnnotations` | Annotations for the agentListener service | `{}` | -| `controller.agentListenerLoadBalancerIP` | Static IP for the agentListener LoadBalancer | Not set | -| `controller.agentListenerExternalTrafficPolicy` | [Traffic Policy](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies) of for the agentListener service | Not set | -| `controller.agentListenerLoadBalancerSourceRanges` | Allowed inbound IP for the agentListener service | `0.0.0.0/0` | - -#### Kubernetes StatefulSet & Service - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.image` | Controller image name | `jenkins/jenkins` | -| `controller.tagLabel` | Controller image tag label | `jdk11` | -| `controller.tag` | Controller image tag override | Not set | -| `controller.imagePullPolicy` | Controller image pull policy | `Always` | -| `controller.imagePullSecretName` | Controller image pull secret | Not set | -| `controller.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 50m, memory: 256Mi}, limits: {cpu: 2000m, memory: 4096Mi}}`| -| `controller.initContainerResources` | Resources allocation (Requests and Limits) for Init Container | Not set | -| `controller.initContainerEnvFrom` | Environment variable sources for Init Container | Not set | -| `controller.initContainerEnv` | Environment variables for Init Container | Not set | -| `controller.containerEnvFrom` | Environment variable sources for Jenkins Container | Not set | -| `controller.containerEnv` | Environment variables for Jenkins Container | Not set | -| `controller.usePodSecurityContext` | Enable pod security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` | -| `controller.runAsUser` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | -| `controller.fsGroup` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | -| `controller.podSecurityContextOverride` | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set | -| `controller.containerSecurityContext` | Allow to control securityContext for the jenkins container. | `{runAsUser: 1000, runAsGroup: 1000, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` | -| `controller.hostAliases` | Aliases for IPs in `/etc/hosts` | `[]` | -| `controller.serviceAnnotations` | Service annotations | `{}` | -| `controller.serviceType` | k8s service type | `ClusterIP` | -| `controller.clusterIP` | k8s service clusterIP | Not set | -| `controller.servicePort` | k8s service port | `8080` | -| `controller.targetPort` | k8s target port | `8080` | -| `controller.nodePort` | k8s node port | Not set | -| `controller.jmxPort` | Open a port, for JMX stats | Not set | -| `controller.extraPorts` | Open extra ports, for other uses | `[]` | -| `controller.loadBalancerSourceRanges` | Allowed inbound IP addresses | `0.0.0.0/0` | -| `controller.loadBalancerIP` | Optional fixed external IP | Not set | -| `controller.statefulSetLabels` | Custom StatefulSet labels | Not set | -| `controller.serviceLabels` | Custom Service labels | Not set | -| `controller.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set | -| `controller.nodeSelector` | Node labels for pod assignment | `{}` | -| `controller.affinity` | Affinity settings | `{}` | -| `controller.schedulerName` | Kubernetes scheduler name | Not set | -| `controller.terminationGracePeriodSeconds` | Set TerminationGracePeriodSeconds | Not set | -| `controller.terminationMessagePath` | Set the termination message path | Not set | -| `controller.terminationMessagePolicy` | Set the termination message policy | Not set | -| `controller.tolerations` | Toleration labels for pod assignment | `[]` | -| `controller.podAnnotations` | Annotations for controller pod | `{}` | -| `controller.statefulSetAnnotations` | Annotations for controller StatefulSet | `{}` | -| `controller.updateStrategy` | Update strategy for StatefulSet | `{}` | -| `controller.lifecycle` | Lifecycle specification for controller-container | Not set | -| `controller.priorityClassName` | The name of a `priorityClass` to apply to the controller pod | Not set | -| `controller.admin.existingSecret` | The name of an existing secret containing the admin credentials. | `""`| -| `controller.admin.userKey` | The key in the existing admin secret containing the username. | `jenkins-admin-user` | -| `controller.admin.passwordKey` | The key in the existing admin secret containing the password. | `jenkins-admin-password` | -| `controller.customInitContainers` | Custom init-container specification in raw-yaml format | Not set | -| `controller.sidecars.other` | Configures additional sidecar container(s) for Jenkins controller | `[]` | - -#### Kubernetes Pod Disruption Budget - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.podDisruptionBudget.enabled` | Enable [Kubernetes Pod Disruption Budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) configuration from `controller.podDisruptionBudget` (see below) | `false` | -| `controller.podDisruptionBudget.apiVersion` | Policy API version | `policy/v1beta1` | -| `controller.podDisruptionBudget.maxUnavailable` | Number of pods that can be unavailable. Either an absolute number or a percentage. | Not set | - -#### Kubernetes Health Probes - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.healthProbes` | Enable [Kubernetes Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes) configuration from `controller.probes` (see below) | `true` | -| `controller.probes.livenessProbe.timeoutSeconds` | Set the timeout for the liveness probe in seconds | `5` | -| `controller.probes.livenessProbe.periodSeconds` | Set the time interval (in seconds) between two liveness probes executions | `10` | -| `controller.probes.livenessProbe.failureThreshold` | Set the failure threshold for the liveness probe | `5` | -| `controller.probes.livenessProbe.initialDelaySeconds` | Set the initial delay for the liveness probe | Not set | -| `controller.probes.livenessProbe.httpGet.port` | Set the Pod's HTTP port to use for the liveness probe | `http` | -| `controller.probes.livenessProbe.httpGet.path` | Set the HTTP's path for the liveness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | -| `controller.probes.readinessProbe.timeoutSeconds` | Set the timeout for the readiness probe in seconds | `5` | -| `controller.probes.readinessProbe.periodSeconds` | Set the time interval (in seconds) between two readiness probes executions | `10` | -| `controller.probes.readinessProbe.failureThreshold` | Set the failure threshold for the readiness probe | `3` | -| `controller.probes.readinessProbe.initialDelaySeconds` | Set the initial delay for the readiness probe | Not set | -| `controller.probes.readinessProbe.httpGet.port` | Set the Pod's HTTP port to use for the readiness probe | `http` | -| `controller.probes.readinessProbe.httpGet.path` | Set the HTTP's path for the readiness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | -| `controller.probes.startupProbe.timeoutSeconds` | Set the timeout for the startup probe in seconds | `5` | -| `controller.probes.startupProbe.periodSeconds` | Set the time interval (in seconds) between two startup probes executions | `10` | -| `controller.probes.startupProbe.failureThreshold` | Set the failure threshold for the startup probe | `12` | -| `controller.probes.startupProbe.initialDelaySeconds` | Set the initial delay for the startup probe | Not set | -| `controller.probes.startupProbe.httpGet.port` | Set the Pod's HTTP port to use for the startup probe | `http` | -| `controller.probes.startupProbe.httpGet.path` | Set the HTTP's path for the startup probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | - -#### Kubernetes Ingress - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.ingress.enabled` | Enables ingress | `false` | -| `controller.ingress.apiVersion` | Ingress API version | `extensions/v1beta1` | -| `controller.ingress.hostName` | Ingress hostname | Not set | -| `controller.ingress.resourceRootUrl` | Hostname to serve assets from | Not set | -| `controller.ingress.annotations` | Ingress annotations | `{}` | -| `controller.ingress.labels` | Ingress labels | `{}` | -| `controller.ingress.path` | Ingress path | Not set | -| `controller.ingress.paths` | Override for the default Ingress paths | `[]` | -| `controller.ingress.tls` | Ingress TLS configuration | `[]` | - -#### GKE BackendConfig - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.backendconfig.enabled` | Enables backendconfig | `false` | -| `controller.backendconfig.apiVersion` | backendconfig API version | `extensions/v1beta1` | -| `controller.backendconfig.name` | backendconfig name | Not set | -| `controller.backendconfig.annotations` | backendconfig annotations | `{}` | -| `controller.backendconfig.labels` | backendconfig labels | `{}` | -| `controller.backendconfig.spec` | backendconfig spec | `{}` | - -#### OpenShift Route - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.route.enabled` | Enables openshift route | `false` | -| `controller.route.annotations` | Route annotations | `{}` | -| `controller.route.labels` | Route labels | `{}` | -| `controller.route.path` | Route path | Not set | - -#### Prometheus - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.prometheus.enabled` | Enables prometheus service monitor | `false` | -| `controller.prometheus.serviceMonitorAdditionalLabels` | Additional labels to add to the service monitor object | `{}` | -| `controller.prometheus.serviceMonitorNamespace` | Custom namespace for serviceMonitor | Not set (same ns where is Jenkins being deployed) | -| `controller.prometheus.scrapeInterval` | How often prometheus should scrape metrics | `60s` | -| `controller.prometheus.scrapeEndpoint` | The endpoint prometheus should get metrics from | `/prometheus` | -| `controller.prometheus.alertingrules` | Array of prometheus alerting rules | `[]` | -| `controller.prometheus.alertingRulesAdditionalLabels` | Additional labels to add to the prometheus rule object | `{}` | -| `controller.prometheus.prometheusRuleNamespace` | Custom namespace for PrometheusRule | `""` (same ns where Jenkins being deployed) | - -#### HTTPS Keystore - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.httpsKeyStore.enable` | Enables HTTPS keystore on jenkins controller | `false` | -| `controller.httpsKeyStore.jenkinsHttpsJksSecretName` | Name of the secret that already has ssl keystore | `` | -| `controller.httpsKeyStore.httpPort` | HTTP Port that Jenkins should listen on along with HTTPS, it also serves liveness and readiness probs port. When HTTPS keystore is enabled servicePort and targetPort will be used as HTTPS port | `8081` | -| `controller.httpsKeyStore.path` | Path of HTTPS keystore file | `/var/jenkins_keystore` | -| `controller.httpsKeyStore.fileName` | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `keystore.jks` | -| `controller.httpsKeyStore.password` | Jenkins keystore password | `password` | -| `controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded` | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | a self signed cert | - -#### Kubernetes Secret - -| Parameter | Description | Default | -|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ----------------------------------------- | -| `controller.adminUser` | Admin username (and password) created as a secret if adminSecret is true | `admin` | -| `controller.adminPassword` | Admin password (and user) created as a secret if adminSecret is true | Random value | -| `controller.existingSecret` | The name of an existing secret containing keys credentials. | `""`| -| `controller.additionalSecrets` | List of additional secrets to create and mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` | -| `controller.additionalExistingSecrets` | List of additional existing secrets to mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` | -| `controller.secretClaims` | List of `SecretClaim` resources to create | `[]` | - -#### Kubernetes NetworkPolicy - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources. | `false` | -| `networkPolicy.apiVersion` | NetworkPolicy ApiVersion | `networking.k8s.io/v1` | -| `networkPolicy.internalAgents.allowed` | Allow internal agents (from the same cluster) to connect to controller. Agent pods would be filtered based on PodLabels. | `false` | -| `networkPolicy.internalAgents.podLabels` | A map of labels (keys/values) that agents pods must have to be able to connect to controller. | `{}` | -| `networkPolicy.internalAgents.namespaceLabels` | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller. | `{}` | -| `networkPolicy.externalAgents.ipCIDR` | The IP range from which external agents are allowed to connect to controller. | `` | -| `networkPolicy.externalAgents.except` | A list of IP sub-ranges to be excluded from the whitelisted IP range. | `[]` | - -#### Kubernetes RBAC - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `rbac.create` | Whether RBAC resources are created | `true` | -| `rbac.readSecrets` | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` | - -#### Kubernetes ServiceAccount - Controller - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `serviceAccount.name` | name of the ServiceAccount to be used by access-controlled resources | autogenerated | -| `serviceAccount.create` | Configures if a ServiceAccount with this name should be created | `true` | -| `serviceAccount.annotations` | Configures annotation for the ServiceAccount | `{}` | -| `serviceAccount.extraLabels` | Configures extra labels for the ServiceAccount | `{}` | -| `serviceAccount.imagePullSecretName` | Controller ServiceAccount image pull secret | Not set | - -#### Kubernetes ServiceAccount - Agent - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `serviceAccountAgent.name` | name of the agent ServiceAccount to be used by access-controlled resources | autogenerated | -| `serviceAccountAgent.create` | Configures if an agent ServiceAccount with this name should be created | `false` | -| `serviceAccountAgent.annotations` | Configures annotation for the agent ServiceAccount | `{}` | -| `serviceAccountAgent.extraLabels` | Configures extra labels for the agent ServiceAccount | `{}` | -| `serviceAccountAgent.imagePullSecretName` | Agent ServiceAccount image pull secret | Not set | - -### Jenkins Agent(s) - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- | ---------------------- | -| `agent.enabled` | Enable Kubernetes plugin jnlp-agent podTemplate | `true` | -| `agent.namespace` | Namespace in which the Kubernetes agents should be launched | Not set | -| `agent.containerCap` | Maximum number of agent | 10 | -| `agent.defaultsProviderTemplate` | The name of the pod template to use for providing default values | Not set | -| `agent.jenkinsUrl` | Overrides the Kubernetes Jenkins URL | Not set | -| `agent.jenkinsTunnel` | Overrides the Kubernetes Jenkins tunnel | Not set | -| `agent.kubernetesConnectTimeout` | The connection timeout in seconds for connections to Kubernetes API. Minimum value is 5. | 5 | -| `agent.kubernetesReadTimeout` | The read timeout in seconds for connections to Kubernetes API. Minimum value is 15. | 15 | -| `agent.maxRequestsPerHostStr` | The maximum concurrent connections to Kubernetes API | 32 | -| `agent.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set | - -#### Pod Configuration - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- | ---------------------- | -| `agent.websocket` | Enables agent communication via websockets | false | -| `agent.podName` | Agent Pod base name | Not set | -| `agent.customJenkinsLabels`| Append Jenkins labels to the agent | `[]` | -| `agent.envVars` | Environment variables for the agent Pod | `[]` | -| `agent.idleMinutes` | Allows the Pod to remain active for reuse | 0 | -| `agent.imagePullSecretName` | Agent image pull secret | Not set | -| `agent.hostNetworking` | Enabled agent to use hostnetwork | false | -| `agent.nodeSelector` | Node labels for pod assignment | `{}` | -| `agent.connectTimeout` | Timeout in seconds for an agent to be online | 100 | -| `agent.volumes` | Additional volumes | `[]` | -| `agent.workspaceVolume` | Workspace volume (defaults to EmptyDir) | `{}` | -| `agent.yamlTemplate` | The raw yaml of a Pod API Object to merge into the agent spec | Not set | -| `agent.yamlMergeStrategy` | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates | `override` | -| `agent.annotations` | Annotations to apply to the pod | `{}` | -| `agent.additionalContainers` | Add additional containers to the agents. | `[]` | - -#### Side Container Configuration - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- |--------------------------------------------------------------------------------| -| `agent.sideContainerName` | Side container name in agent | jnlp | -| `agent.image` | Agent image name | `jenkins/inbound-agent` | -| `agent.tag` | Agent image tag | `3107.v665000b_51092-5` | -| `agent.alwaysPullImage` | Always pull agent container image before build | `false` | -| `agent.privileged` | Agent privileged container | `false` | -| `agent.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 512m, memory: 512Mi}, limits: {cpu: 512m, memory: 512Mi}}` | -| `agent.runAsUser` | Configure container user | Not set | -| `agent.runAsGroup` | Configure container group | Not set | -| `agent.command` | Executed command when side container starts | Not set | -| `agent.args` | Arguments passed to executed command | `${computer.jnlpmac} ${computer.name}` | -| `agent.TTYEnabled` | Allocate pseudo tty to the side container | false | -| `agent.workingDir` | Configure working directory for default agent | `/home/jenkins/agent` | - -#### Other - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- | ---------------------- | -| `agent.disableDefaultAgent` | Ignore the default Jenkins Agent configuration | false | -| `agent.podTemplates` | Configures extra pod templates for the default kubernetes cloud | `{}` | -| `additionalAgents` | Configure additional agents which inherit values from `agent` | `{}` | - -### Persistence - -| Parameter | Description | Default | -| --------------------------- | ------------------------------- | --------------- | -| `persistence.enabled` | Enable the use of a Jenkins PVC | `true` | -| `persistence.existingClaim` | Provide the name of a PVC | `nil` | -| `persistence.storageClass` | Storage class for the PVC | `nil` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `persistence.labels` | Labels for the PVC | `{}` | -| `persistence.accessMode` | The PVC access mode | `ReadWriteOnce` | -| `persistence.size` | The size of the PVC | `8Gi` | -| `persistence.subPath` | SubPath for jenkins-home mount | `nil` | -| `persistence.volumes` | Additional volumes | `nil` | -| `persistence.mounts` | Additional mounts | `nil` | - -### Backup - -| Parameter | Description | Default | -| ---------------------------------------- | ----------------------------------------------------------------- | --------------------------------- | -| `backup.enabled` | Enable the use of a backup CronJob | `false` | -| `backup.schedule` | Schedule to run jobs | `0 2 * * *` | -| `backup.labels` | Backup pod labels | `{}` | -| `backup.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `backup.serviceAccount.name` | name of the backup ServiceAccount | autogenerated | -| `backup.serviceAccount.annotations` | Backup pod annotations | `{}` | -| `backup.image.repo` | Backup image repository | `maorfr/kube-tasks` | -| `backup.image.tag` | Backup image tag | `0.2.0` | -| `backup.image.imagePullSecretName` | Backup image pull secret | Not set | -| `backup.extraArgs` | Additional arguments for kube-tasks | `[]` | -| `backup.existingSecret` | Environment variables to add to the cronjob container | `{}` | -| `backup.existingSecret.*` | Specify the secret name containing the AWS or GCP credentials | `jenkinsaws` | -| `backup.existingSecret.*.awsaccesskey` | `secretKeyRef.key` used for `AWS_ACCESS_KEY_ID` | `jenkins_aws_access_key` | -| `backup.existingSecret.*.awssecretkey` | `secretKeyRef.key` used for `AWS_SECRET_ACCESS_KEY` | `jenkins_aws_secret_key` | -| `backup.existingSecret.*.azstorageaccount`| `secretKeyRef.key` used for `AZURE_STORAGE_ACCOUNT` | `""` | -| `backup.existingSecret.*.azstoragekey` | `secretKeyRef.key` used for `AZURE_STORAGE_ACCESS_KEY` | `""` | -| `backup.existingSecret.*.gcpcredentials` | Mounts secret as volume and sets `GOOGLE_APPLICATION_CREDENTIALS` | `credentials.json` | -| `backup.env` | Backup environment variables | `[]` | -| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` | -| `backup.destination` | Destination to store backup artifacts | `s3://jenkins-data/backup` | -| `backup.onlyJobs` | Only backup the job folder | `false` | -| `backup.usePodSecurityContext` | Enable backup pod's security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` | -| `backup.runAsUser` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | -| `backup.fsGroup` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | -| `backup.podSecurityContextOverride` | Completely overwrites the contents of the backup pod's security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set | -| `cronJob.apiVersion` | CronJob API version | 'batch/v1' | -| `awsSecurityGroupPolicies.enabled` | Enable the creation of SecurityGroupPolicy resources | `false` | -| `awsSecurityGroupPolicies.policies` | Security Group Policy definitions. `awsSecurityGroupPolicies.enabled` must be `true` | Not set | - -### Helm Tests - -| Parameter | Description | Default | -| --------------------- | --------------------------------- | --------------- | -| `helmtest.bats.image` | Image used to test the framework | `bats/bats` | -| `helmtest.bats.tag` | Test framework image tag override | `1.2.1` | diff --git a/charts/jenkins/ci/other-values.yaml b/charts/jenkins/ci/other-values.yaml index 56549cf51..a532c948a 100644 --- a/charts/jenkins/ci/other-values.yaml +++ b/charts/jenkins/ci/other-values.yaml @@ -18,7 +18,7 @@ controller: fromUserRecord: attributeName: "memberOf" additionalPlugins: - - ldap:671.v2a_9192a_7419d + - ldap:682.v7b_544c9d1512 scriptApproval: - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - "new groovy.json.JsonSlurperClassic" @@ -41,6 +41,9 @@ agent: value: /usr/local/bin nodeSelector: "app.kubernetes.io/component": "{{ .Values.agent.componentName }}" + restrictedPssSecurityContext: true + runAsUser: 1000 + runAsGroup: 1000 yamlTemplate: |- apiVersion: v1 kind: Pod @@ -56,14 +59,16 @@ agent: customJenkinsLabels: maven # An example of overriding the jnlp container # sideContainerName: jnlp - image: jenkins/jnlp-agent-maven - tag: latest + image: + repository: jenkins/jnlp-agent-maven + tag: latest python: podName: python customJenkinsLabels: python sideContainerName: python - image: python - tag: "3" + image: + repository: python + tag: "3" command: "/bin/sh -c" args: "cat" TTYEnabled: true diff --git a/charts/jenkins/templates/NOTES.txt b/charts/jenkins/templates/NOTES.txt index 0d2df0b93..953dd2606 100644 --- a/charts/jenkins/templates/NOTES.txt +++ b/charts/jenkins/templates/NOTES.txt @@ -1,6 +1,6 @@ {{- $prefix := .Values.controller.jenkinsUriPrefix | default "" -}} {{- $url := "" -}} -1. Get your '{{ .Values.controller.adminUser }}' user password by running: +1. Get your '{{ .Values.controller.admin.username }}' user password by running: kubectl exec --namespace {{ template "jenkins.namespace" . }} -it svc/{{ template "jenkins.fullname" . }} -c jenkins -- /bin/cat /run/secrets/additional/chart-admin-password && echo {{- if .Values.controller.ingress.hostName -}} {{- if .Values.controller.ingress.tls -}} @@ -43,7 +43,7 @@ {{- end }} {{- end }} -3. Login with the password from step 1 and the username: {{ .Values.controller.adminUser }} +3. Login with the password from step 1 and the username: {{ .Values.controller.admin.username }} 4. Configure security realm and authorization strategy 5. Use Jenkins Configuration as Code by specifying configScripts in your values.yaml file, see documentation: {{ $url }}/configuration-as-code and examples: https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos @@ -53,7 +53,7 @@ https://cloud.google.com/solutions/jenkins-on-container-engine For more information about Jenkins Configuration as Code, visit: https://jenkins.io/projects/jcasc/ -{{ if (eq .Values.controller.image "jenkins/jenkins") }} +{{ if and (eq .Values.controller.image.repository "jenkins/jenkins") (eq .Values.controller.image.registry "docker.io") }} NOTE: Consider using a custom image with pre-installed plugins {{- else if .Values.controller.installPlugins }} NOTE: Consider disabling `installPlugins` if your image already contains plugins. diff --git a/charts/jenkins/templates/_helpers.tpl b/charts/jenkins/templates/_helpers.tpl index f223e1f4f..dd3895b65 100644 --- a/charts/jenkins/templates/_helpers.tpl +++ b/charts/jenkins/templates/_helpers.tpl @@ -61,8 +61,8 @@ Returns the admin password https://github.com/helm/charts/issues/5167#issuecomment-619137759 */}} {{- define "jenkins.password" -}} - {{ if .Values.controller.adminPassword -}} - {{- .Values.controller.adminPassword | b64enc | quote }} + {{- if .Values.controller.admin.password -}} + {{- .Values.controller.admin.password | b64enc | quote }} {{- else -}} {{- $secret := (lookup "v1" "Secret" .Release.Namespace (include "jenkins.fullname" .)).data -}} {{- if $secret -}} @@ -88,9 +88,9 @@ Returns the Jenkins URL {{- else }} {{- if .Values.controller.ingress.hostName }} {{- if .Values.controller.ingress.tls }} - {{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ .Values.controller.ingress.hostName }}{{ default "" .Values.controller.jenkinsUriPrefix }} + {{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} {{- else }} - {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ .Values.controller.ingress.hostName }}{{ default "" .Values.controller.jenkinsUriPrefix }} + {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} {{- end }} {{- else }} {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ template "jenkins.fullname" . }}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }} @@ -140,6 +140,17 @@ jenkins: clouds: - kubernetes: containerCapStr: "{{ .Values.agent.containerCap }}" + {{- if .Values.agent.garbageCollection.enabled }} + garbageCollection: + {{- if .Values.agent.garbageCollection.namespaces }} + namespaces: |- + {{- .Values.agent.garbageCollection.namespaces | nindent 10 }} + {{- end }} + timeout: "{{ .Values.agent.garbageCollection.timeout }}" + {{- end }} + {{- if .Values.agent.jnlpregistry }} + jnlpregistry: "{{ .Values.agent.jnlpregistry }}" + {{- end }} defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}" connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}" readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}" @@ -161,10 +172,16 @@ jenkins: webSocket: true {{- end }} {{- end }} + skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}} + usageRestricted: {{ .Values.agent.usageRestricted | default false}} maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }} + retentionTimeout: {{ .Values.agent.retentionTimeout | quote }} + waitForPodSec: {{ .Values.agent.waitForPodSec | quote }} name: "{{ .Values.controller.cloudName }}" namespace: "{{ template "jenkins.agent.namespace" . }}" - serverUrl: "https://kubernetes.default" + restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }} + serverUrl: "{{ .Values.kubernetesURL }}" + credentialsId: "{{ .Values.credentialsId }}" {{- if .Values.agent.enabled }} podLabels: - key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}" @@ -174,10 +191,10 @@ jenkins: value: {{ $val | quote }} {{- end }} templates: - {{- if not .Values.agent.disableDefaultAgent }} + {{- if not .Values.agent.disableDefaultAgent }} {{- include "jenkins.casc.podTemplate" . | nindent 8 }} - {{- end }} - {{- if .Values.additionalAgents }} + {{- end }} + {{- if .Values.additionalAgents }} {{- /* save .Values.agent */}} {{- $agent := .Values.agent }} {{- range $name, $additionalAgent := .Values.additionalAgents }} @@ -194,29 +211,122 @@ jenkins: {{- end }} {{- /* restore .Values.agent */}} {{- $_ := set .Values "agent" $agent }} - {{- end }} + {{- end }} {{- if .Values.agent.podTemplates }} - {{- range $key, $val := .Values.agent.podTemplates }} - {{- tpl $val $ | nindent 8 }} - {{- end }} + {{- range $key, $val := .Values.agent.podTemplates }} + {{- tpl $val $ | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.additionalClouds }} + {{- /* save root */}} + {{- $oldRoot := deepCopy $ }} + {{- range $name, $additionalCloud := .Values.additionalClouds }} + {{- $newRoot := deepCopy $ }} + {{- /* clear additionalAgents from the copy if override set to `true` */}} + {{- if .additionalAgentsOverride }} + {{- $_ := set $newRoot.Values "additionalAgents" list}} + {{- end}} + {{- $newValues := merge $additionalCloud $newRoot.Values }} + {{- $_ := set $newRoot "Values" $newValues }} + {{- /* clear additionalClouds from the copy */}} + {{- $_ := set $newRoot.Values "additionalClouds" list }} + {{- with $newRoot}} + - kubernetes: + containerCapStr: "{{ .Values.agent.containerCap }}" + {{- if .Values.agent.jnlpregistry }} + jnlpregistry: "{{ .Values.agent.jnlpregistry }}" {{- end }} + defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}" + connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}" + readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}" + {{- if .Values.agent.directConnection }} + directConnection: true + {{- else }} + {{- if .Values.agent.jenkinsUrl }} + jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}" + {{- else }} + jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}" + {{- end }} + {{- if not .Values.agent.websocket }} + {{- if .Values.agent.jenkinsTunnel }} + jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}" + {{- else }} + jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" + {{- end }} + {{- else }} + webSocket: true + {{- end }} + {{- end }} + skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}} + usageRestricted: {{ .Values.agent.usageRestricted | default false}} + maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }} + retentionTimeout: {{ .Values.agent.retentionTimeout | quote }} + waitForPodSec: {{ .Values.agent.waitForPodSec | quote }} + name: {{ $name | quote }} + namespace: "{{ template "jenkins.agent.namespace" . }}" + restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }} + serverUrl: "{{ .Values.kubernetesURL }}" + credentialsId: "{{ .Values.credentialsId }}" + {{- if .Values.agent.enabled }} + podLabels: + - key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}" + value: "true" + {{- range $key, $val := .Values.agent.podLabels }} + - key: {{ $key | quote }} + value: {{ $val | quote }} {{- end }} + templates: + {{- if not .Values.agent.disableDefaultAgent }} + {{- include "jenkins.casc.podTemplate" . | nindent 8 }} + {{- end }} + {{- if .Values.additionalAgents }} + {{- /* save .Values.agent */}} + {{- $agent := .Values.agent }} + {{- range $name, $additionalAgent := .Values.additionalAgents }} + {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }} + {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}} + {{- $additionalAgent := merge $additionalAgent $agent }} + {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}} + {{- if $additionalContainersEmpty }} + {{- $_ := set $additionalAgent "additionalContainers" list }} + {{- end }} + {{- /* set .Values.agent to $additionalAgent */}} + {{- $_ := set $.Values "agent" $additionalAgent }} + {{- include "jenkins.casc.podTemplate" $ | nindent 8 }} + {{- end }} + {{- /* restore .Values.agent */}} + {{- $_ := set .Values "agent" $agent }} + {{- end }} + {{- with .Values.agent.podTemplates }} + {{- range $key, $val := . }} + {{- tpl $val $ | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- /* restore root */}} + {{- $_ := set $ "Values" $oldRoot.Values }} + {{- end }} {{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }} crumbIssuer: standard: excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }} {{- end }} {{- include "jenkins.casc.security" . }} -{{- if .Values.controller.scriptApproval }} +{{- with .Values.controller.scriptApproval }} scriptApproval: approvedSignatures: -{{- range $key, $val := .Values.controller.scriptApproval }} + {{- range $key, $val := . }} - "{{ $val }}" -{{- end }} + {{- end }} {{- end }} unclassified: location: - adminAddress: {{ default "" .Values.controller.jenkinsAdminEmail }} + {{- with .Values.controller.jenkinsAdminEmail }} + adminAddress: {{ . }} + {{- end }} url: {{ template "jenkins.url" . }} {{- end -}} @@ -248,7 +358,9 @@ Returns kubernetes pod template configuration as code - name: "{{ .Values.agent.sideContainerName }}" alwaysPullImage: {{ .Values.agent.alwaysPullImage }} args: "{{ .Values.agent.args | replace "$" "^$" }}" - command: {{ .Values.agent.command }} + {{- with .Values.agent.command }} + command: {{ . }} + {{- end }} envVars: - envVar: {{- if .Values.agent.directConnection }} @@ -266,21 +378,42 @@ Returns kubernetes pod template configuration as code value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}" {{- end }} {{- end }} - image: "{{ .Values.agent.image }}:{{ .Values.agent.tag }}" + image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}" + {{- if .Values.agent.livenessProbe }} + livenessProbe: + execArgs: {{.Values.agent.livenessProbe.execArgs | quote}} + failureThreshold: {{.Values.agent.livenessProbe.failureThreshold}} + initialDelaySeconds: {{.Values.agent.livenessProbe.initialDelaySeconds}} + periodSeconds: {{.Values.agent.livenessProbe.periodSeconds}} + successThreshold: {{.Values.agent.livenessProbe.successThreshold}} + timeoutSeconds: {{.Values.agent.livenessProbe.timeoutSeconds}} + {{- end }} privileged: "{{- if .Values.agent.privileged }}true{{- else }}false{{- end }}" resourceLimitCpu: {{.Values.agent.resources.limits.cpu}} resourceLimitMemory: {{.Values.agent.resources.limits.memory}} + {{- with .Values.agent.resources.limits.ephemeralStorage }} + resourceLimitEphemeralStorage: {{.}} + {{- end }} resourceRequestCpu: {{.Values.agent.resources.requests.cpu}} resourceRequestMemory: {{.Values.agent.resources.requests.memory}} - runAsUser: {{ .Values.agent.runAsUser }} - runAsGroup: {{ .Values.agent.runAsGroup }} + {{- with .Values.agent.resources.requests.ephemeralStorage }} + resourceRequestEphemeralStorage: {{.}} + {{- end }} + {{- with .Values.agent.runAsUser }} + runAsUser: {{ . }} + {{- end }} + {{- with .Values.agent.runAsGroup }} + runAsGroup: {{ . }} + {{- end }} ttyEnabled: {{ .Values.agent.TTYEnabled }} workingDir: {{ .Values.agent.workingDir }} {{- range $additionalContainers := .Values.agent.additionalContainers }} - name: "{{ $additionalContainers.sideContainerName }}" alwaysPullImage: {{ $additionalContainers.alwaysPullImage | default $.Values.agent.alwaysPullImage }} args: "{{ $additionalContainers.args | replace "$" "^$" }}" - command: {{ $additionalContainers.command }} + {{- with $additionalContainers.command }} + command: {{ . }} + {{- end }} envVars: - envVar: key: "JENKINS_URL" @@ -289,14 +422,27 @@ Returns kubernetes pod template configuration as code {{- else }} value: "http://{{ template "jenkins.fullname" $ }}.{{ template "jenkins.namespace" $ }}.svc.{{ $.Values.clusterZone }}:{{ $.Values.controller.servicePort }}{{ default "/" $.Values.controller.jenkinsUriPrefix }}" {{- end }} - image: "{{ $additionalContainers.image }}:{{ $additionalContainers.tag }}" + image: "{{ $additionalContainers.image.repository }}:{{ $additionalContainers.image.tag }}" + {{- if $additionalContainers.livenessProbe }} + livenessProbe: + execArgs: {{$additionalContainers.livenessProbe.execArgs | quote}} + failureThreshold: {{$additionalContainers.livenessProbe.failureThreshold}} + initialDelaySeconds: {{$additionalContainers.livenessProbe.initialDelaySeconds}} + periodSeconds: {{$additionalContainers.livenessProbe.periodSeconds}} + successThreshold: {{$additionalContainers.livenessProbe.successThreshold}} + timeoutSeconds: {{$additionalContainers.livenessProbe.timeoutSeconds}} + {{- end }} privileged: "{{- if $additionalContainers.privileged }}true{{- else }}false{{- end }}" resourceLimitCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.cpu }}{{ else }}{{ $.Values.agent.resources.limits.cpu }}{{ end }} resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }} resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }} resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }} + {{- if or $additionalContainers.runAsUser $.Values.agent.runAsUser }} runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }} + {{- end }} + {{- if or $additionalContainers.runAsGroup $.Values.agent.runAsGroup }} runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }} + {{- end }} ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }} workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }} {{- end }} @@ -337,13 +483,17 @@ Returns kubernetes pod template configuration as code nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }} podRetention: {{ .Values.agent.podRetention }} showRawYaml: {{ .Values.agent.showRawYaml }} - serviceAccount: "{{ include "jenkins.serviceAccountAgentName" . }}" +{{- $asaname := default (include "jenkins.serviceAccountAgentName" .) .Values.agent.serviceAccount -}} +{{- if or (.Values.agent.useDefaultServiceAccount) (.Values.agent.serviceAccount) }} + serviceAccount: "{{ $asaname }}" +{{- end }} slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}" {{- if .Values.agent.volumes }} volumes: {{- range $index, $volume := .Values.agent.volumes }} -{{- if (eq $volume.type "ConfigMap") }} configMapVolume: {{- else if (eq $volume.type "EmptyDir") }} emptyDirVolume: + {{- else if (eq $volume.type "EphemeralVolume") }} genericEphemeralVolume: {{- else if (eq $volume.type "HostPath") }} hostPathVolume: {{- else if (eq $volume.type "Nfs") }} nfsVolume: {{- else if (eq $volume.type "PVC") }} persistentVolumeClaim: @@ -363,6 +513,8 @@ Returns kubernetes pod template configuration as code dynamicPVC: {{- else if (eq .Values.agent.workspaceVolume.type "EmptyDir") }} emptyDirWorkspaceVolume: + {{- else if (eq .Values.agent.workspaceVolume.type "EphemeralVolume") }} + genericEphemeralVolume: {{- else if (eq .Values.agent.workspaceVolume.type "HostPath") }} hostPathWorkspaceVolume: {{- else if (eq .Values.agent.workspaceVolume.type "Nfs") }} @@ -383,12 +535,13 @@ Returns kubernetes pod template configuration as code {{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }} {{- end }} yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }} + inheritYamlMergeStrategy: {{ .Values.agent.inheritYamlMergeStrategy }} {{- end -}} {{- define "jenkins.kubernetes-version" -}} {{- if .Values.controller.installPlugins -}} {{- range .Values.controller.installPlugins -}} - {{ if hasPrefix "kubernetes:" . }} + {{- if hasPrefix "kubernetes:" . }} {{- $split := splitList ":" . }} {{- printf "%s" (index $split 1 ) -}} {{- end -}} @@ -427,25 +580,14 @@ Create the name of the service account for Jenkins agents to use {{- end -}} {{- end -}} -{{/* -Create the name of the service account for Jenkins backup to use -*/}} -{{- define "backup.serviceAccountBackupName" -}} -{{- if .Values.backup.serviceAccount.create -}} - {{ default (printf "%s-%s" (include "jenkins.fullname" .) "backup") .Values.backup.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.backup.serviceAccount.name }} -{{- end -}} -{{- end -}} - {{/* Create a full tag name for controller image */}} -{{- define "controller.tag" -}} -{{- if .Values.controller.tagLabel -}} - {{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.tagLabel) .Values.controller.tag -}} +{{- define "controller.image.tag" -}} +{{- if .Values.controller.image.tagLabel -}} + {{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.image.tagLabel) .Values.controller.image.tag -}} {{- else -}} - {{- default .Chart.AppVersion .Values.controller.tag -}} + {{- default .Chart.AppVersion .Values.controller.image.tag -}} {{- end -}} {{- end -}} @@ -459,3 +601,84 @@ Create the HTTP port for interacting with the controller {{- .Values.controller.targetPort -}} {{- end -}} {{- end -}} + +{{- define "jenkins.configReloadContainer" -}} +{{- $root := index . 0 -}} +{{- $containerName := index . 1 -}} +{{- $containerType := index . 2 -}} +- name: {{ $containerName }} + image: "{{ $root.Values.controller.sidecars.configAutoReload.image.registry }}/{{ $root.Values.controller.sidecars.configAutoReload.image.repository }}:{{ $root.Values.controller.sidecars.configAutoReload.image.tag }}" + imagePullPolicy: {{ $root.Values.controller.sidecars.configAutoReload.imagePullPolicy }} + {{- if $root.Values.controller.sidecars.configAutoReload.containerSecurityContext }} + securityContext: {{- toYaml $root.Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 4 }} + {{- end }} + {{- if $root.Values.controller.sidecars.configAutoReload.envFrom }} + envFrom: +{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.envFrom) $root) | indent 4 }} + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: LABEL + value: "{{ template "jenkins.fullname" $root }}-jenkins-config" + - name: FOLDER + value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}" + - name: NAMESPACE + value: '{{ $root.Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" $root) }}' + {{- if eq $containerType "init" }} + - name: METHOD + value: "LIST" + {{- else if $root.Values.controller.sidecars.configAutoReload.sleepTime }} + - name: METHOD + value: "SLEEP" + - name: SLEEP_TIME + value: "{{ $root.Values.controller.sidecars.configAutoReload.sleepTime }}" + {{- end }} + {{- if eq $containerType "sidecar" }} + - name: REQ_URL + value: "{{- default "http" $root.Values.controller.sidecars.configAutoReload.scheme }}://localhost:{{- include "controller.httpPort" $root -}}{{- $root.Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" + - name: REQ_METHOD + value: "POST" + - name: REQ_RETRY_CONNECT + value: "{{ $root.Values.controller.sidecars.configAutoReload.reqRetryConnect }}" + {{- if $root.Values.controller.sidecars.configAutoReload.skipTlsVerify }} + - name: REQ_SKIP_TLS_VERIFY + value: "true" + {{- end }} + {{- end }} + + {{- if $root.Values.controller.sidecars.configAutoReload.env }} + {{- range $envVarItem := $root.Values.controller.sidecars.configAutoReload.env -}} + {{- if or (ne $containerType "init") (ne .name "METHOD") }} +{{- (tpl (toYaml (list $envVarItem)) $root) | nindent 4 }} + {{- end -}} + {{- end -}} + {{- end }} + {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }} + - name: LOG_CONFIG + value: "{{ $root.Values.controller.jenkinsHome }}/auto-reload/auto-reload-config.yaml" + {{- end }} + + resources: +{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }} + volumeMounts: + - name: sc-config-volume + mountPath: {{ $root.Values.controller.sidecars.configAutoReload.folder | quote }} + - name: jenkins-home + mountPath: {{ $root.Values.controller.jenkinsHome }} + {{- if $root.Values.persistence.subPath }} + subPath: {{ $root.Values.persistence.subPath }} + {{- end }} + {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }} + - name: auto-reload-config + mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload + - name: auto-reload-config-logs + mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload-logs + {{- end }} + {{- if $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts }} +{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts) $root) | indent 4 }} + {{- end }} + +{{- end -}} diff --git a/charts/jenkins/templates/auto-reload-config.yaml b/charts/jenkins/templates/auto-reload-config.yaml new file mode 100644 index 000000000..77b0f523f --- /dev/null +++ b/charts/jenkins/templates/auto-reload-config.yaml @@ -0,0 +1,60 @@ +{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "jenkins.fullname" . }}-auto-reload-config + namespace: {{ template "jenkins.namespace" . }} + labels: + "app.kubernetes.io/name": {{ template "jenkins.name" . }} + {{- if .Values.renderHelmLabels }} + "helm.sh/chart": "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + {{- end }} + "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" + "app.kubernetes.io/instance": "{{ $.Release.Name }}" + "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" +data: + auto-reload-config.yaml: |- + version: 1 + disable_existing_loggers: false + root: + level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }} + handlers: + {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}} + - console + {{- end }} + {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }} + - file + {{- end }} + handlers: + {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}} + console: + class: logging.StreamHandler + level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }} + formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }} + {{- end }} + {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }} + file: + class : logging.handlers.RotatingFileHandler + formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }} + filename: {{ .Values.controller.jenkinsHome }}/auto-reload-logs/file.log + maxBytes: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.maxBytes }} + backupCount: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.backupCount }} + {{- end }} + formatters: + JSON: + "()": logger.JsonFormatter + format: "%(levelname)s %(message)s" + rename_fields: + message: msg + levelname: level + LOGFMT: + "()": logger.LogfmtFormatter + keys: + - time + - level + - msg + mapping: + time: asctime + level: levelname + msg: message + {{- end }} \ No newline at end of file diff --git a/charts/jenkins/templates/config.yaml b/charts/jenkins/templates/config.yaml index b94c79f5d..5de0b9f72 100644 --- a/charts/jenkins/templates/config.yaml +++ b/charts/jenkins/templates/config.yaml @@ -28,6 +28,12 @@ data: # remove all plugins from shared volume rm -rf {{ .Values.controller.jenkinsHome }}/plugins/* {{- end }} +{{- if .Values.controller.JCasC.overwriteConfiguration }} + echo "deleting all XML config files" + rm -f {{ .Values.controller.jenkinsHome }}/config.xml + rm -f {{ .Values.controller.jenkinsHome }}/*plugins*.xml + find {{ .Values.controller.jenkinsHome }} -maxdepth 1 -type f -iname '*configuration*.xml' -exec rm -f {} \; +{{- end }} {{- if .Values.controller.installPlugins }} echo "download plugins" # Install missing plugins diff --git a/charts/jenkins/templates/deprecation.yaml b/charts/jenkins/templates/deprecation.yaml index 43a798de9..f54017ce4 100644 --- a/charts/jenkins/templates/deprecation.yaml +++ b/charts/jenkins/templates/deprecation.yaml @@ -4,7 +4,7 @@ {{- end }} {{- if .Values.controller.imageTag }} - {{ fail "`controller.imageTag` does no longer exist. Please use `controller.tag` instead" }} + {{ fail "`controller.imageTag` does no longer exist. Please use `controller.image.tag` instead" }} {{- end }} {{- if .Values.controller.slaveListenerPort }} @@ -112,4 +112,40 @@ {{- if .Values.controller.rollingUpdate }} {{ fail "`controller.rollingUpdate` does no longer exist. It is no longer relevant, since a StatefulSet is used for the Jenkins controller" }} {{- end }} + + {{- if .Values.controller.tag }} + {{ fail "`controller.tag` no longer exists. It has been renamed to `controller.image.tag'" }} + {{- end }} + + {{- if .Values.controller.tagLabel }} + {{ fail "`controller.tagLabel` no longer exists. It has been renamed to `controller.image.tagLabel`" }} + {{- end }} + + {{- if .Values.controller.adminSecret }} + {{ fail "`controller.adminSecret` no longer exists. It has been renamed to `controller.admin.createSecret`" }} + {{- end }} + + {{- if .Values.controller.adminUser }} + {{ fail "`controller.adminUser` no longer exists. It has been renamed to `controller.admin.username`" }} + {{- end }} + + {{- if .Values.controller.adminPassword }} + {{ fail "`controller.adminPassword` no longer exists. It has been renamed to `controller.admin.password`" }} + {{- end }} + + {{- if .Values.controller.sidecars.other }} + {{ fail "`controller.sidecars.other` no longer exists. It has been renamed to `controller.sidecars.additionalSidecarContainers`" }} + {{- end }} + + {{- if .Values.agent.tag }} + {{ fail "`controller.agent.tag` no longer exists. It has been renamed to `controller.agent.image.tag`" }} + {{- end }} + + {{- if .Values.backup }} + {{ fail "`controller.backup` no longer exists." }} + {{- end }} + + {{- if .Values.helmtest.bats.tag }} + {{ fail "`helmtest.bats.tag` no longer exists. It has been renamed to `helmtest.bats.image.tag`" }} + {{- end }} {{- end }} diff --git a/charts/jenkins/templates/home-pvc.yaml b/charts/jenkins/templates/home-pvc.yaml index af17f7c17..1c22724e3 100644 --- a/charts/jenkins/templates/home-pvc.yaml +++ b/charts/jenkins/templates/home-pvc.yaml @@ -21,6 +21,10 @@ metadata: {{ toYaml .Values.persistence.labels | indent 4 }} {{- end }} spec: +{{- if .Values.persistence.dataSource }} + dataSource: +{{ toYaml .Values.persistence.dataSource | indent 4 }} +{{- end }} accessModes: - {{ .Values.persistence.accessMode | quote }} resources: @@ -30,7 +34,7 @@ spec: {{- if (eq "-" .Values.persistence.storageClass) }} storageClassName: "" {{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" + storageClassName: "{{ tpl .Values.persistence.storageClass . }}" {{- end }} {{- end }} {{- end }} diff --git a/charts/jenkins/templates/jcasc-config.yaml b/charts/jenkins/templates/jcasc-config.yaml index 684c985ab..ab8dcd8e9 100644 --- a/charts/jenkins/templates/jcasc-config.yaml +++ b/charts/jenkins/templates/jcasc-config.yaml @@ -11,12 +11,16 @@ metadata: labels: "app.kubernetes.io/name": {{ template "jenkins.name" $root}} {{- if $root.Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}" + "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}" {{- end }} "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" "app.kubernetes.io/instance": "{{ $.Release.Name }}" "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" {{ template "jenkins.fullname" $root }}-jenkins-config: "true" +{{- if $root.Values.controller.JCasC.configMapAnnotations }} + annotations: +{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }} +{{- end }} data: {{ $key }}.yaml: |- {{ tpl $val $| indent 4 }} @@ -32,14 +36,18 @@ metadata: labels: "app.kubernetes.io/name": {{ template "jenkins.name" $root}} {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}" + "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}" {{- end }} "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" "app.kubernetes.io/instance": "{{ $.Release.Name }}" "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" {{ template "jenkins.fullname" $root }}-jenkins-config: "true" +{{- if $root.Values.controller.JCasC.configMapAnnotations }} + annotations: +{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }} +{{- end }} data: jcasc-default-config.yaml: |- - {{- include "jenkins.casc.defaults" . |nindent 4 }} + {{- include "jenkins.casc.defaults" . | nindent 4 }} {{- end}} {{- end }} diff --git a/charts/jenkins/templates/jenkins-backup-cronjob.yaml b/charts/jenkins/templates/jenkins-backup-cronjob.yaml deleted file mode 100644 index d710dd5e5..000000000 --- a/charts/jenkins/templates/jenkins-backup-cronjob.yaml +++ /dev/null @@ -1,168 +0,0 @@ -{{- if .Values.backup.enabled }} -apiVersion: {{ .Values.cronJob.apiVersion }} -kind: CronJob -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.backup.componentName }}" -spec: - schedule: {{ .Values.backup.schedule | quote }} - concurrencyPolicy: Forbid - startingDeadlineSeconds: 120 - jobTemplate: - spec: -{{- if .Values.backup.activeDeadlineSeconds }} - activeDeadlineSeconds: {{ .Values.backup.activeDeadlineSeconds }} -{{- end }} - template: - metadata: - {{- if .Values.backup.labels }} - labels: - {{- toYaml .Values.backup.labels | trim | nindent 12 }} - {{- end }} - {{- if .Values.backup.annotations }} - annotations: - {{- toYaml .Values.backup.annotations | trim | nindent 12 }} - {{- end }} - spec: - restartPolicy: OnFailure - serviceAccountName: {{ include "backup.serviceAccountBackupName" . }} - {{- if .Values.backup.usePodSecurityContext }} - securityContext: - {{- if hasKey .Values.backup "podSecurityContextOverride" }} - {{- tpl (toYaml .Values.backup.podSecurityContextOverride | nindent 12) . }} - {{- else }} - runAsUser: {{ default 0 .Values.backup.runAsUser }} - {{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }} - {{- if not (eq (int .Values.backup.runAsUser) 0) }} - fsGroup: {{ .Values.backup.fsGroup }} - {{- end }} - {{- end }} - {{- if .Values.backup.securityContextCapabilities }} - capabilities: - {{- toYaml .Values.backup.securityContextCapabilities | nindent 12 }} - {{- end }} - {{- end }} - {{- end }} - containers: - - name: jenkins-backup - image: "{{ .Values.backup.image.repository }}:{{ .Values.backup.image.tag }}" - command: ["kube-tasks"] - args: - - simple-backup - - -n - - {{ template "jenkins.namespace" . }} - - -l - - app.kubernetes.io/instance={{ .Release.Name }} - - --container - - jenkins - - --path - {{- if .Values.backup.onlyJobs }} - - {{ .Values.controller.jenkinsHome }}/jobs - {{- else}} - - {{ .Values.controller.jenkinsHome }} - {{- end}} - - --dst - - {{ .Values.backup.destination }} - {{- with .Values.backup.extraArgs }} - {{- toYaml . | nindent 12 }} - {{- end }} - env: - {{- with .Values.backup.env }} - {{- toYaml . | trim | nindent 12 }} - {{- end }} - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.awsaccesskey }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.awsaccesskey | quote }} - {{- end }} - {{- if $value.awssecretkey }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.awssecretkey | quote}} - {{- end }} - {{- if $value.azstorageaccount }} - - name: AZURE_STORAGE_ACCOUNT - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.azstorageaccount | quote}} - {{- end }} - {{- if $value.azstoragekey }} - - name: AZURE_STORAGE_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.azstoragekey | quote}} - {{- end }} - {{- if $value.gcpcredentials }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/var/run/secrets/{{ $key }}/{{ $value.gcpcredentials }}" - {{- end }} - {{- end }} - {{- end }} - {{- with .Values.backup.resources }} - resources: - {{- toYaml . | trim | nindent 14 }} - {{- end }} - volumeMounts: - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.gcpcredentials }} - - mountPath: /var/run/secrets/{{ $key }} - name: {{ $key }} - {{- end }} - {{- end }} - {{- end }} - volumes: - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.gcpcredentials }} - - name: {{ $key }} - secret: - secretName: {{ $key }} - {{- end }} - {{- end }} - {{- end }} - affinity: - podAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - topologyKey: "kubernetes.io/hostname" - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - {{ template "jenkins.fullname" . }} - - key: release - operator: In - values: - - {{ .Release.Name }} - {{- with .Values.controller.tolerations }} - tolerations: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.controller.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if .Values.backup.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.backup.imagePullSecretName }} - {{- end -}} -{{- end }} diff --git a/charts/jenkins/templates/jenkins-backup-rbac.yaml b/charts/jenkins/templates/jenkins-backup-rbac.yaml deleted file mode 100644 index 0f94fa833..000000000 --- a/charts/jenkins/templates/jenkins-backup-rbac.yaml +++ /dev/null @@ -1,64 +0,0 @@ -{{- if .Values.backup.enabled }} -{{- if .Values.backup.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "backup.serviceAccountBackupName" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.backup.serviceAccount.annotations }} - annotations: - {{- toYaml .Values.backup.serviceAccount.annotations | nindent 4 }} - {{- end }} -{{- end }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["pods/exec"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-backup -subjects: -- kind: ServiceAccount - name: {{ include "backup.serviceAccountBackupName" . }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} diff --git a/charts/jenkins/templates/jenkins-controller-ingress.yaml b/charts/jenkins/templates/jenkins-controller-ingress.yaml index e7b6c6fd3..5094e564c 100644 --- a/charts/jenkins/templates/jenkins-controller-ingress.yaml +++ b/charts/jenkins/templates/jenkins-controller-ingress.yaml @@ -23,12 +23,12 @@ metadata: {{- end }} {{- if .Values.controller.ingress.annotations }} annotations: -{{ toYaml .Values.controller.ingress.annotations | indent 4 }} +{{ tpl (toYaml .Values.controller.ingress.annotations) . | indent 4 }} {{- end }} name: {{ template "jenkins.fullname" . }} spec: {{- if .Values.controller.ingress.ingressClassName }} - ingressClassName: {{ .Values.controller.ingress.ingressClassName | quote }} + ingressClassName: {{ tpl .Values.controller.ingress.ingressClassName . | quote }} {{- end }} rules: - http: @@ -52,7 +52,7 @@ spec: {{ tpl (toYaml .Values.controller.ingress.paths | indent 6) . }} {{- end -}} {{- if .Values.controller.ingress.hostName }} - host: {{ .Values.controller.ingress.hostName | quote }} + host: {{ tpl .Values.controller.ingress.hostName . | quote }} {{- end }} {{- if .Values.controller.ingress.resourceRootUrl }} - http: @@ -68,10 +68,10 @@ spec: serviceName: {{ template "jenkins.fullname" . }} servicePort: {{ .Values.controller.servicePort }} {{- end }} - host: {{ .Values.controller.ingress.resourceRootUrl | quote }} + host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }} {{- end }} {{- if .Values.controller.ingress.tls }} tls: -{{ toYaml .Values.controller.ingress.tls | indent 4 }} +{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }} {{- end -}} {{- end }} diff --git a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml index 91cf6db11..82835f2bd 100644 --- a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml +++ b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml @@ -39,7 +39,7 @@ spec: {{- end }} {{- end }} {{- end }} - {{- if .Values.networkPolicy.externalAgents }} + {{- if or .Values.networkPolicy.externalAgents.ipCIDR .Values.networkPolicy.externalAgents.except }} - ipBlock: cidr: {{ required "ipCIDR is required if you wish to allow external agents to connect to Jenkins Controller." .Values.networkPolicy.externalAgents.ipCIDR }} {{- if .Values.networkPolicy.externalAgents.except }} diff --git a/charts/jenkins/templates/jenkins-controller-statefulset.yaml b/charts/jenkins/templates/jenkins-controller-statefulset.yaml index 477e083f9..29ccc92c0 100644 --- a/charts/jenkins/templates/jenkins-controller-statefulset.yaml +++ b/charts/jenkins/templates/jenkins-controller-statefulset.yaml @@ -45,6 +45,9 @@ spec: {{- end}} annotations: checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }} + {{- if .Values.controller.initScripts }} + checksum/config-init-scripts: {{ include (print $.Template.BasePath "/config-init-scripts.yaml") . | sha256sum }} + {{- end }} {{- if .Values.controller.podAnnotations }} {{ tpl (toYaml .Values.controller.podAnnotations | indent 8) . }} {{- end }} @@ -63,6 +66,10 @@ spec: {{- if .Values.controller.affinity }} affinity: {{ toYaml .Values.controller.affinity | indent 8 }} + {{- end }} + {{- if .Values.controller.topologySpreadConstraints }} + topologySpreadConstraints: +{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }} {{- end }} {{- if quote .Values.controller.terminationGracePeriodSeconds }} terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} @@ -73,9 +80,12 @@ spec: {{- if .Values.controller.shareProcessNamespace }} shareProcessNamespace: true {{- end }} + {{- if not .Values.controller.enableServiceLinks }} + enableServiceLinks: false + {{- end }} {{- if .Values.controller.usePodSecurityContext }} securityContext: - {{- if hasKey .Values.controller "podSecurityContextOverride" }} + {{- if kindIs "map" .Values.controller.podSecurityContextOverride }} {{- tpl (toYaml .Values.controller.podSecurityContextOverride | nindent 8) . -}} {{- else }} {{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed: @@ -97,6 +107,7 @@ spec: {{- end }} {{- end }} serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}" + automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} {{- if .Values.controller.hostNetworking }} hostNetwork: true dnsPolicy: ClusterFirstWithHostNet @@ -109,9 +120,14 @@ spec: {{- if .Values.controller.customInitContainers }} {{ tpl (toYaml .Values.controller.customInitContainers) . | indent 8 }} {{- end }} + +{{- if .Values.controller.sidecars.configAutoReload.enabled }} +{{- include "jenkins.configReloadContainer" (list $ "config-reload-init" "init") | nindent 8 }} +{{- end}} + - name: "init" - image: "{{ .Values.controller.image }}:{{- include "controller.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.imagePullPolicy }}" + image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" + imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}" {{- if .Values.controller.containerSecurityContext }} securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} {{- end }} @@ -162,8 +178,8 @@ spec: {{- end }} containers: - name: jenkins - image: "{{ .Values.controller.image }}:{{- include "controller.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.imagePullPolicy }}" + image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" + imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}" {{- if .Values.controller.containerSecurityContext }} securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} {{- end }} @@ -197,7 +213,7 @@ spec: {{- if .Values.controller.containerEnv }} {{ (tpl ( toYaml .Values.controller.containerEnv) .) | indent 12 }} {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} + {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - name: SECRETS value: /run/secrets/additional {{- end }} @@ -218,8 +234,8 @@ spec: {{- if not .Values.controller.httpsKeyStore.disableSecretMount }} valueFrom: secretKeyRef: - name: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} - key: {{ "https-jks-password" | quote }} + name: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ else if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} + key: "{{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey }}" {{- else }} value: {{ .Values.controller.httpsKeyStore.password }} {{- end }} @@ -290,7 +306,7 @@ spec: - name: sc-config-volume mountPath: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }} {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} + {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - name: jenkins-secrets mountPath: /run/secrets/additional readOnly: true @@ -301,57 +317,25 @@ spec: name: tmp-volume {{- if .Values.controller.sidecars.configAutoReload.enabled }} - - name: config-reload - image: "{{ .Values.controller.sidecars.configAutoReload.image }}" - imagePullPolicy: {{ .Values.controller.sidecars.configAutoReload.imagePullPolicy }} - {{- if .Values.controller.sidecars.configAutoReload.containerSecurityContext }} - securityContext: {{- toYaml .Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 12 }} - {{- end }} - {{- if .Values.controller.sidecars.configAutoReload.envFrom }} - envFrom: -{{ (tpl (toYaml .Values.controller.sidecars.configAutoReload.envFrom) .) | indent 12 }} - {{- end }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: "{{ template "jenkins.fullname" . }}-jenkins-config" - - name: FOLDER - value: "{{ .Values.controller.sidecars.configAutoReload.folder }}" - - name: NAMESPACE - value: '{{ .Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" .) }}' - - name: REQ_URL - value: "http://localhost:{{- include "controller.httpPort" . -}}{{- .Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" - - name: REQ_METHOD - value: "POST" - - name: REQ_RETRY_CONNECT - value: "{{ .Values.controller.sidecars.configAutoReload.reqRetryConnect }}" - {{- if .Values.controller.sidecars.configAutoReload.env }} -{{ (tpl (toYaml .Values.controller.sidecars.configAutoReload.env) .) | indent 12 }} - {{- end }} - resources: -{{ toYaml .Values.controller.sidecars.configAutoReload.resources | indent 12 }} - volumeMounts: - - name: sc-config-volume - mountPath: {{ .Values.controller.sidecars.configAutoReload.folder | quote }} - - name: jenkins-home - mountPath: {{ .Values.controller.jenkinsHome }} - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} +{{- include "jenkins.configReloadContainer" (list $ "config-reload" "sidecar") | nindent 8 }} {{- end}} -{{- if .Values.controller.sidecars.other}} -{{ tpl (toYaml .Values.controller.sidecars.other | indent 8) .}} +{{- if .Values.controller.sidecars.additionalSidecarContainers}} +{{ tpl (toYaml .Values.controller.sidecars.additionalSidecarContainers | indent 8) .}} {{- end }} volumes: {{- if .Values.persistence.volumes }} {{ tpl (toYaml .Values.persistence.volumes | indent 6) . }} {{- end }} + {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }} + - name: auto-reload-config + configMap: + name: {{ template "jenkins.fullname" . }}-auto-reload-config + - name: auto-reload-config-logs + emptyDir: {} + {{- end }} {{- if .Values.controller.installPlugins }} {{- if .Values.controller.overwritePluginsFromImage }} - name: plugins @@ -382,7 +366,7 @@ spec: - name: plugin-dir emptyDir: {} {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} + {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - name: jenkins-secrets projected: sources: @@ -399,7 +383,7 @@ spec: path: {{ tpl $value.name $ }}-{{ tpl $value.keyName $ }} {{- end }} {{- end }} - {{- if .Values.controller.adminSecret }} + {{- if .Values.controller.admin.createSecret }} - secret: name: {{ .Values.controller.admin.existingSecret | default (include "jenkins.fullname" .) }} items: @@ -434,7 +418,7 @@ spec: secret: secretName: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} items: - - key: jenkins-jks-file + - key: {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey }} path: {{ .Values.controller.httpsKeyStore.fileName }} {{- end }} diff --git a/charts/jenkins/templates/jenkins-controller-svc.yaml b/charts/jenkins/templates/jenkins-controller-svc.yaml index a83466ce3..d43d407fe 100644 --- a/charts/jenkins/templates/jenkins-controller-svc.yaml +++ b/charts/jenkins/templates/jenkins-controller-svc.yaml @@ -41,6 +41,9 @@ spec: targetPort: {{ $port.port }} {{- end -}} {{- end }} + {{- if .Values.controller.publishNotReadyAddresses }} + publishNotReadyAddresses: true + {{- end }} selector: "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" "app.kubernetes.io/instance": "{{ .Release.Name }}" diff --git a/charts/jenkins/templates/rbac.yaml b/charts/jenkins/templates/rbac.yaml index 581cb8d48..8fa5abae6 100644 --- a/charts/jenkins/templates/rbac.yaml +++ b/charts/jenkins/templates/rbac.yaml @@ -99,6 +99,55 @@ subjects: --- {{- end}} +{{- if .Values.rbac.useOpenShiftNonRootSCC }} +# This is needed if you are running on OpenShift and using the default +# containerSecurityContext in the chart. It grants the Jenkins service account +# permission to use the "nonroot" and "nonroot-v2" SecurityContextConstraints. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $serviceName }}-use-nonroot-scc + namespace: {{ template "jenkins.namespace" . }} + labels: + "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' + {{- if .Values.renderHelmLabels }} + "helm.sh/chart": "{{ template "jenkins.label" .}}" + {{- end }} + "app.kubernetes.io/managed-by": "{{ .Release.Service }}" + "app.kubernetes.io/instance": "{{ .Release.Name }}" + "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" +rules: + - apiGroups: ["security.openshift.io"] + resources: ["securitycontextconstraints"] + resourceNames: ["nonroot", "nonroot-v2"] + verbs: ["use"] +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ $serviceName }}-use-nonroot-scc + namespace: {{ template "jenkins.namespace" . }} + labels: + "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' + {{- if .Values.renderHelmLabels }} + "helm.sh/chart": "{{ template "jenkins.label" .}}" + {{- end }} + "app.kubernetes.io/managed-by": "{{ .Release.Service }}" + "app.kubernetes.io/instance": "{{ .Release.Name }}" + "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "jenkins.fullname" . }}-use-nonroot-scc +subjects: + - kind: ServiceAccount + name: {{ template "jenkins.serviceAccountName" . }} + namespace: {{ template "jenkins.namespace" . }} + +--- +{{- end}} + {{- if .Values.controller.sidecars.configAutoReload.enabled }} # The sidecar container which is responsible for reloading configuration changes # needs permissions to watch ConfigMaps diff --git a/charts/jenkins/templates/secret.yaml b/charts/jenkins/templates/secret.yaml index 4feb52f42..cc6ace179 100644 --- a/charts/jenkins/templates/secret.yaml +++ b/charts/jenkins/templates/secret.yaml @@ -1,4 +1,4 @@ -{{- if and (not .Values.controller.admin.existingSecret) (.Values.controller.adminSecret) -}} +{{- if and (not .Values.controller.admin.existingSecret) (.Values.controller.admin.createSecret) -}} apiVersion: v1 kind: Secret @@ -16,5 +16,5 @@ metadata: type: Opaque data: jenkins-admin-password: {{ template "jenkins.password" . }} - jenkins-admin-user: {{ .Values.controller.adminUser | b64enc | quote }} + jenkins-admin-user: {{ .Values.controller.admin.username | b64enc | quote }} {{- end }} diff --git a/charts/jenkins/templates/service-account-agent.yaml b/charts/jenkins/templates/service-account-agent.yaml index 48f08ba6c..c826039b5 100644 --- a/charts/jenkins/templates/service-account-agent.yaml +++ b/charts/jenkins/templates/service-account-agent.yaml @@ -1,6 +1,7 @@ {{ if .Values.serviceAccountAgent.create }} apiVersion: v1 kind: ServiceAccount +automountServiceAccountToken: {{ .Values.serviceAccountAgent.automountServiceAccountToken }} metadata: name: {{ include "jenkins.serviceAccountAgentName" . }} namespace: {{ template "jenkins.agent.namespace" . }} diff --git a/charts/jenkins/templates/service-account.yaml b/charts/jenkins/templates/service-account.yaml index b44eb488c..76f23ce26 100644 --- a/charts/jenkins/templates/service-account.yaml +++ b/charts/jenkins/templates/service-account.yaml @@ -1,6 +1,7 @@ {{ if .Values.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} metadata: name: {{ include "jenkins.serviceAccountName" . }} namespace: {{ template "jenkins.namespace" . }} diff --git a/charts/jenkins/templates/tests/jenkins-test.yaml b/charts/jenkins/templates/tests/jenkins-test.yaml index f9d7877a9..12a935ecc 100644 --- a/charts/jenkins/templates/tests/jenkins-test.yaml +++ b/charts/jenkins/templates/tests/jenkins-test.yaml @@ -17,7 +17,7 @@ spec: {{- end }} initContainers: - name: "test-framework" - image: {{ .Values.helmtest.bats.image }}:{{ .Values.helmtest.bats.tag }} + image: "{{ .Values.helmtest.bats.image.registry }}/{{ .Values.helmtest.bats.image.repository }}:{{ .Values.helmtest.bats.image.tag }}" command: - "bash" - "-c" @@ -31,7 +31,7 @@ spec: name: tools containers: - name: {{ .Release.Name }}-ui-test - image: {{ .Values.controller.image }}:{{ .Chart.AppVersion }}-{{ .Values.controller.tagLabel }} + image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" command: ["/tools/bats/bin/bats", "-t", "/tests/run.sh"] volumeMounts: - mountPath: /tests diff --git a/charts/jenkins/unittests/__snapshot__/config-test.yaml.snap b/charts/jenkins/unittests/__snapshot__/config-test.yaml.snap new file mode 100644 index 000000000..11c6f146f --- /dev/null +++ b/charts/jenkins/unittests/__snapshot__/config-test.yaml.snap @@ -0,0 +1,15 @@ +additional plugins config: + 1: | + |- + kubernetes:4306.vc91e951ea_eb_d + workflow-aggregator:600.vb_57cdd26fdd7 + git:5.7.0 + configuration-as-code:1915.vcdd0a_d0d2625 + kubernetes-credentials-provider +default config: + 1: | + |- + kubernetes:4306.vc91e951ea_eb_d + workflow-aggregator:600.vb_57cdd26fdd7 + git:5.7.0 + configuration-as-code:1915.vcdd0a_d0d2625 diff --git a/charts/jenkins/unittests/__snapshot__/jcasc-config-test.yaml.snap b/charts/jenkins/unittests/__snapshot__/jcasc-config-test.yaml.snap new file mode 100644 index 000000000..5dcca0984 --- /dev/null +++ b/charts/jenkins/unittests/__snapshot__/jcasc-config-test.yaml.snap @@ -0,0 +1,3474 @@ +additional clouds: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "remote-cloud-1" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://api.remote-cloud.com" + credentialsId: "remote-cloud-token" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +additional clouds inheriting additional agents: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "maven" + namespace: "maven" + id: 1daed6c97163cca6958ec75f76cf9087fb62ff029c70e04d8cb5355286167bc7 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/jnlp-agent-maven:latest" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent maven" + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "remote-cloud-1" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://api.remote-cloud.com" + credentialsId: "remote-cloud-token" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "maven" + namespace: "maven" + id: 1daed6c97163cca6958ec75f76cf9087fb62ff029c70e04d8cb5355286167bc7 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/jnlp-agent-maven:latest" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent maven" + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +additional clouds overriding additional agents: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "maven" + namespace: "maven" + id: 1daed6c97163cca6958ec75f76cf9087fb62ff029c70e04d8cb5355286167bc7 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/jnlp-agent-maven:latest" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent maven" + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "remote-cloud-1" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://api.remote-cloud.com" + credentialsId: "remote-cloud-token" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +additional clouds set skipTlsVerify: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: true + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "remote-cloud-1" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://api.remote-cloud.com" + credentialsId: "remote-cloud-token" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 2d3ba0c1d64ca26aa7b8f37ee3b84c6c99c45c6a2df8d4cd669a24759cd582f5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +additional clouds set usageRestricted: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: true + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "remote-cloud-1" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://api.remote-cloud.com" + credentialsId: "remote-cloud-token" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: bae23615b7544b16340f44d7aec9606475bca800b37996de274d3665bdb89782 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +adds custom labels on agent pods: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "NAMESPACE" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + - key: "label-one" + value: "value-one" + - key: "label-two" + value: "true" + templates: + - name: "default" + namespace: "NAMESPACE" + id: fc09034a7b6259cd20d113c9fa6230e78e2b50faa512b8d02616f1d16460e03d + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +agent namespace and templates: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "jenkins-agents" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "jenkins-agents" + id: ac92f60f16eaca4164fde72bc513a5588045158d4074b4716eca6d2c9f7122bd + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "maven" + namespace: "maven" + id: cb127477096a0c03787fe373d78523be1a399a3dd5ac8df1393c1c53ad21ef88 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" + image: "jenkins/jnlp-agent-maven:latest" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent maven" + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "python" + namespace: "jenkins-agents" + id: e186df5e263fbadca22c1783cc35f8ee5b898be59358580b693b1419ddd55a64 + containers: + - name: "python" + alwaysPullImage: false + args: "cat" + command: /bin/sh -c + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" + image: "python:3" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: true + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent python" + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: python3 + label: jenkins-python3 + serviceAccount: jenkins + containers: + - name: python + image: python:3 + command: "/bin/sh -c" + args: "cat" + ttyEnabled: true + privileged: true + resourceRequestCpu: "400m" + resourceRequestMemory: "512Mi" + resourceRequestEphemeralStorage: "1Gi" + resourceLimitCpu: "1" + resourceLimitMemory: "1024Mi" + resourceLimitEphemeralStorage: "2Gi" + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +agent with liveness probe: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 49c16dabc028ae34fd2059c59bec91da7840da707b031bb241af6219befec45c + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + livenessProbe: + execArgs: "cat /tmp/healthy" + failureThreshold: 3 + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +agents with liveness probe: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 2c61df818311f168e06152b7692c56629198c3c83c0e3b8826b61d9c824e226d + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + - name: "side-container" + alwaysPullImage: false + args: "" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "REPOSITORY:TAG" + livenessProbe: + execArgs: "cat /tmp/healthy" + failureThreshold: 3 + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +configure hostnetworking to agent: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: cc1998e9567b4116e2d560d14c629970021ecf559aa0a709f990c6054ce84d7b + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + hostNetwork: true + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom dynamic pvc workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: d3409df5d5b1d074277a97079493551dc1b711ee1f7d3f5a355b38fbc5c4d106 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + dynamicPVC: + accessModes: "ReadWriteOnce" + requestsSize: "2Gi" + storageClassName: "gp2" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom emptyDir workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 1e7739c582559b6f27d73d904d9dd3163428b5df7b445606ff1601b36ddc4141 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + emptyDirWorkspaceVolume: + memory: true + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom hostPath workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: fd6fd102240553ce5afb5e7b81b21ad3988e38e85d20446904ce0c64ede53124 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + hostPathWorkspaceVolume: + hostPath: "/data" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom jenkins label: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "testlabel" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom nfs workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: f806f454b9ced27dec67a6980791a953ef2f2f38063c6a63fd7e4b1547a09686 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + nfsWorkspaceVolume: + readOnly: false + serverAddress: "1.1.1.1" + serverPath: "/data" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom other workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 650cff33dd7b7b10b6f607f3508b09f2d19465dc043ed0ac9496a823b7b40442 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + persistentVolumeClaimWorkspaceVolume: + claimName: "my-claim" + readOnly: false + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +custom pvc workspace volume: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 05af578b8e3ef07c828bb8a7304f5136bda2e35b03e3642c0609f0671ec784e4 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + workspaceVolume: + persistentVolumeClaimWorkspaceVolume: + claimName: "my-claim" + readOnly: false + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +customized config: + 1: | + |- + jenkins: + authorizationStrategy: + globalMatrix: + permissions: + - "Overall/Read:anonymous" + securityRealm: + local + disableRememberMe: true + mode: EXCLUSIVE + numExecutors: 1 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + rawHtml: + disableSyntaxHighlighting: true + clouds: + - kubernetes: + containerCapStr: "22" + jnlpregistry: "private.registry.com" + defaultsProviderTemplate: "my-defaults" + connectTimeout: "11" + readTimeout: "12" + jenkinsUrl: "http://my-release-jenkins.other.svc.cluster.local:8080" + jenkinsTunnel: "my-release-jenkins-agent.other.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/my-release-jenkins-agent" + value: "true" + templates: + - name: "my-agent" + namespace: "default" + annotations: + - key: ci.jenkins-agent/test + value: "custom" + id: 9afefe2f46fd71d6468ea8ae10d4eebcfac8c35f4606e8f5179b86aff17fdac5 + containers: + - name: "sideContainer" + alwaysPullImage: true + args: "^${computer.jnlpmac} ^${computer.name}" + command: /bin/command + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://my-release-jenkins.other.svc.cluster.local:8080/" + image: "my-image/jnlp:v1.2.3" + privileged: "true" + resourceLimitCpu: 1024m + resourceLimitMemory: 1Gi + resourceLimitEphemeralStorage: 1Gi + resourceRequestCpu: 756m + resourceRequestMemory: 768Mi + resourceRequestEphemeralStorage: 512Mi + runAsUser: 2000 + runAsGroup: 2000 + ttyEnabled: true + workingDir: /workdir + envVars: + - envVar: + key: VAR + value: value + idleMinutes: 30 + instanceCap: 2147483647 + imagePullSecrets: + - name: pullSecret + label: "my-release-jenkins-agent " + nodeSelector: jenkins-agent=v1,selector=abc + nodeUsageMode: "NORMAL" + podRetention: onFailure + showRawYaml: true + serviceAccount: "agent-serviceaccount" + slaveConnectTimeoutStr: "111" + volumes: + - configMapVolume: + configMapName: "myconfigmap" + mountPath: "/var/myapp/myconfigmap" + - emptyDirVolume: + memory: false + mountPath: "/var/myapp/myemptydir" + - hostPathVolume: + hostPath: "/var/lib/containers" + mountPath: "/var/myapp/myhostpath" + - nfsVolume: + mountPath: "/var/myapp/mynfs" + readOnly: false + serverAddress: "192.0.2.0" + serverPath: "/var/lib/containers" + - persistentVolumeClaim: + claimName: "mypvc" + mountPath: "/var/myapp/mypvc" + readOnly: false + - secretVolume: + defaultMode: "600" + mountPath: "/var/myapp/mysecret" + secretName: "mysecret" + - genericEphemeralVolume: + accessModes: "ReadWriteOnce" + mountPath: "/var/myapp/myephemeralvolume" + requestsSize: "2Gi" + storageClassName: "test-storageclass" + yaml: |- + apiVersion: v1 + kind: Pod + spec: + tolerations: + - key: "key" + operator: "Equal" + value: "value" + yamlMergeStrategy: merge + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + adminAddress: admin@example.org + url: https://jenkins.example.com +default config: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +disable agents: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "controller-namespace" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +disable useDefaultServiceAccount: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "NAMESPACE" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "NAMESPACE" + id: 11e8916dd1e8125134d4a40bcc0cb339d3f45ab2cc70ac9a0f3213b1b2af132c + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +empty projectNamingStrategy: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +legacyRemotingSecurityEnabled = false: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +legacyRemotingSecurityEnabled = true: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + remotingSecurity: + enabled: true + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +non-string projectNamingStrategy: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: + myConfiguration: + mySetting1: true + mySetting2: something + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +set agent.serviceAccount: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "NAMESPACE" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "NAMESPACE" + id: b5d3da37219b6dd3695c22a0633430327d6e8c5ccd23a5fbe86cd5320c82e10c + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "testing" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +set directConnection: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + directConnection: true + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: b401e7d5cd23fb25364e76645180803771da298016efeb62bb7af4ef609168c7 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_DIRECT_CONNECTION" + value: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +set restrictedPssSecurityContext: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: true + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 8976a78ff32940de240eae5701554ae3c963d128663cd431a428a8b15378b291 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +set secretEnvVars: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 0343d349a63cca3fc58879b0281622833ebaa1997ce8a762e766f9f131f9448f + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + envVars: + - envVar: + key: UNITTEST_ENV + value: testvalue + - secretEnvVar: + key: UNITTEST_PATH + secretName: k8s-unittest-secret-name + secretKey: UNITTEST_K8S_PATH + optional: false + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +specify additional container: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: d91b8c997f70d246801a991ded01478a4233a6ab42432a66d38be4fec20c4038 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + - name: "dind" + alwaysPullImage: false + args: "" + command: dockerd-entrypoint.sh + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "docker:dind" + privileged: "true" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +specify additional container and clear in additional agent: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: d91b8c997f70d246801a991ded01478a4233a6ab42432a66d38be4fec20c4038 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + - name: "dind" + alwaysPullImage: false + args: "" + command: dockerd-entrypoint.sh + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "docker:dind" + privileged: "true" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "additional-agent" + namespace: "default" + id: 4785afb6d292d0c8a76186d462117c86d5817e0d4d8c0bee499937f2715d40f5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +specify additional container and overwrite in additional agent: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: d91b8c997f70d246801a991ded01478a4233a6ab42432a66d38be4fec20c4038 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + - name: "dind" + alwaysPullImage: false + args: "" + command: dockerd-entrypoint.sh + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "docker:dind" + privileged: "true" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + - name: "additional-agent" + namespace: "default" + id: b90f9bb302dccf01102a7e2c4f6b48c882be1043d82b6f8bf700e1fc332ff3c7 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + - name: "additional" + alwaysPullImage: false + args: "arg1 arg2" + command: entrypoint.sh + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "my-additional-container-image:latest" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +specify security settings with apiToken override: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: overridden + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 +specify security settings without apiToken override: + 1: | + |- + jenkins: + authorizationStrategy: + loggedInUsersCanDoAnything: + allowAnonymousRead: false + securityRealm: + local: + allowsSignup: false + enableCaptcha: false + users: + - id: "${chart-admin-username}" + name: "Jenkins Admin" + password: "${chart-admin-password}" + disableRememberMe: false + mode: NORMAL + numExecutors: 0 + labelString: "" + projectNamingStrategy: "standard" + markupFormatter: + plainText + clouds: + - kubernetes: + containerCapStr: "10" + defaultsProviderTemplate: "" + connectTimeout: "5" + readTimeout: "15" + jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" + jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" + skipTlsVerify: false + usageRestricted: false + maxRequestsPerHostStr: "32" + retentionTimeout: "5" + waitForPodSec: "600" + name: "kubernetes" + namespace: "default" + restrictedPssSecurityContext: false + serverUrl: "https://kubernetes.default" + credentialsId: "" + podLabels: + - key: "jenkins/RELEASE-NAME-jenkins-agent" + value: "true" + templates: + - name: "default" + namespace: "default" + id: 7b68818f8b4901ff2afd650378a729dbafd70ccb9d161a6d83690c0a2c944ba5 + containers: + - name: "jnlp" + alwaysPullImage: false + args: "^${computer.jnlpmac} ^${computer.name}" + envVars: + - envVar: + key: "JENKINS_URL" + value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" + image: "jenkins/inbound-agent:3283.v92c105e0f819-7" + privileged: "false" + resourceLimitCpu: 512m + resourceLimitMemory: 512Mi + resourceRequestCpu: 512m + resourceRequestMemory: 512Mi + ttyEnabled: false + workingDir: /home/jenkins/agent + idleMinutes: 0 + instanceCap: 2147483647 + label: "RELEASE-NAME-jenkins-agent " + nodeUsageMode: "NORMAL" + podRetention: Never + showRawYaml: true + serviceAccount: "default" + slaveConnectTimeoutStr: "100" + yamlMergeStrategy: override + inheritYamlMergeStrategy: false + crumbIssuer: + standard: + excludeClientIPFromCrumb: true + security: + apiToken: + creationOfLegacyTokenEnabled: false + tokenGenerationOnCreationEnabled: false + usageStatisticsEnabled: true + gitHostKeyVerificationConfiguration: + sshHostKeyVerificationStrategy: acceptFirstConnectionStrategy + unclassified: + location: + url: http://RELEASE-NAME-jenkins:8080 diff --git a/charts/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap b/charts/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap index 2b82dee72..0d3741178 100644 --- a/charts/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap +++ b/charts/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap @@ -1,5 +1,443 @@ +configure empty image tag label: + 1: | + docker.io/jenkins/jenkins:2.479.3 +configure image tag label: + 1: | + docker.io/jenkins/jenkins:2.479.3-alpine +default values: + 1: | + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/component: jenkins-controller + app.kubernetes.io/instance: my-release + serviceName: my-release-jenkins + template: + metadata: + annotations: + checksum/config: 52e82c6643fb77cf70daa49053c298ecfd3804445e4d2db395563a31f685993f + labels: + app.kubernetes.io/component: jenkins-controller + app.kubernetes.io/instance: my-release + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: jenkins + spec: + automountServiceAccountToken: true + containers: + - args: + - --httpPort=8080 + env: + - name: SECRETS + value: /run/secrets/additional + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: JAVA_OPTS + value: '-Dcasc.reload.token=$(POD_NAME) ' + - name: JENKINS_OPTS + value: '--webroot=/var/jenkins_cache/war ' + - name: JENKINS_SLAVE_AGENT_PORT + value: "50000" + - name: CASC_JENKINS_CONFIG + value: /var/jenkins_home/casc_configs + image: docker.io/jenkins/jenkins:2.479.3-jdk17 + imagePullPolicy: Always + livenessProbe: + failureThreshold: 5 + httpGet: + path: /login + port: http + initialDelaySeconds: null + periodSeconds: 10 + timeoutSeconds: 5 + name: jenkins + ports: + - containerPort: 8080 + name: http + - containerPort: 50000 + name: agent-listener + readinessProbe: + failureThreshold: 3 + httpGet: + path: /login + port: http + initialDelaySeconds: null + periodSeconds: 10 + timeoutSeconds: 5 + resources: + limits: + cpu: 2000m + memory: 4096Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsUser: 1000 + startupProbe: + failureThreshold: 12 + httpGet: + path: /login + port: http + periodSeconds: 10 + timeoutSeconds: 5 + volumeMounts: + - mountPath: /var/jenkins_home + name: jenkins-home + readOnly: false + - mountPath: /var/jenkins_config + name: jenkins-config + readOnly: true + - mountPath: /usr/share/jenkins/ref/plugins/ + name: plugin-dir + readOnly: false + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /run/secrets/additional + name: jenkins-secrets + readOnly: true + - mountPath: /var/jenkins_cache + name: jenkins-cache + - mountPath: /tmp + name: tmp-volume + - env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: LABEL + value: my-release-jenkins-jenkins-config + - name: FOLDER + value: /var/jenkins_home/casc_configs + - name: NAMESPACE + value: my-namespace + - name: REQ_URL + value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) + - name: REQ_METHOD + value: POST + - name: REQ_RETRY_CONNECT + value: "10" + image: docker.io/kiwigrid/k8s-sidecar:1.29.0 + imagePullPolicy: IfNotPresent + name: config-reload + resources: {} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /var/jenkins_home + name: jenkins-home + enableServiceLinks: false + initContainers: + - env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: LABEL + value: my-release-jenkins-jenkins-config + - name: FOLDER + value: /var/jenkins_home/casc_configs + - name: NAMESPACE + value: my-namespace + - name: METHOD + value: LIST + image: docker.io/kiwigrid/k8s-sidecar:1.29.0 + imagePullPolicy: IfNotPresent + name: config-reload-init + resources: {} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /var/jenkins_home + name: jenkins-home + - command: + - sh + - /var/jenkins_config/apply_config.sh + image: docker.io/jenkins/jenkins:2.479.3-jdk17 + imagePullPolicy: Always + name: init + resources: + limits: + cpu: 2000m + memory: 4096Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsUser: 1000 + volumeMounts: + - mountPath: /var/jenkins_home + name: jenkins-home + - mountPath: /var/jenkins_config + name: jenkins-config + - mountPath: /usr/share/jenkins/ref/plugins + name: plugins + - mountPath: /var/jenkins_plugins + name: plugin-dir + - mountPath: /tmp + name: tmp-volume + securityContext: + fsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + serviceAccountName: my-release-jenkins + volumes: + - emptyDir: {} + name: plugins + - configMap: + name: my-release-jenkins + name: jenkins-config + - emptyDir: {} + name: plugin-dir + - name: jenkins-secrets + projected: + sources: + - secret: + items: + - key: jenkins-admin-user + path: chart-admin-username + - key: jenkins-admin-password + path: chart-admin-password + name: my-release-jenkins + - emptyDir: {} + name: jenkins-cache + - name: jenkins-home + persistentVolumeClaim: + claimName: my-release-jenkins + - emptyDir: {} + name: sc-config-volume + - emptyDir: {} + name: tmp-volume render pod annotations: 1: | - checksum/config: 572b6e6e44f82aa907092e9fcd7e4070830217a6bdca52f224d0c82dea885b9a + checksum/config: 52e82c6643fb77cf70daa49053c298ecfd3804445e4d2db395563a31f685993f fixed-annotation: some-fixed-annotation templated-annotations: my-release +test scheme for config-reload: + 1: | + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/component: jenkins-controller + app.kubernetes.io/instance: my-release + serviceName: my-release-jenkins + template: + metadata: + annotations: + checksum/config: 52e82c6643fb77cf70daa49053c298ecfd3804445e4d2db395563a31f685993f + labels: + app.kubernetes.io/component: jenkins-controller + app.kubernetes.io/instance: my-release + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: jenkins + spec: + automountServiceAccountToken: true + containers: + - args: + - --httpPort=8080 + env: + - name: SECRETS + value: /run/secrets/additional + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: JAVA_OPTS + value: '-Dcasc.reload.token=$(POD_NAME) ' + - name: JENKINS_OPTS + value: '--webroot=/var/jenkins_cache/war ' + - name: JENKINS_SLAVE_AGENT_PORT + value: "50000" + - name: CASC_JENKINS_CONFIG + value: /var/jenkins_home/casc_configs + image: docker.io/jenkins/jenkins:2.479.3-jdk17 + imagePullPolicy: Always + livenessProbe: + failureThreshold: 5 + httpGet: + path: /login + port: http + initialDelaySeconds: null + periodSeconds: 10 + timeoutSeconds: 5 + name: jenkins + ports: + - containerPort: 8080 + name: http + - containerPort: 50000 + name: agent-listener + readinessProbe: + failureThreshold: 3 + httpGet: + path: /login + port: http + initialDelaySeconds: null + periodSeconds: 10 + timeoutSeconds: 5 + resources: + limits: + cpu: 2000m + memory: 4096Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsUser: 1000 + startupProbe: + failureThreshold: 12 + httpGet: + path: /login + port: http + periodSeconds: 10 + timeoutSeconds: 5 + volumeMounts: + - mountPath: /var/jenkins_home + name: jenkins-home + readOnly: false + - mountPath: /var/jenkins_config + name: jenkins-config + readOnly: true + - mountPath: /usr/share/jenkins/ref/plugins/ + name: plugin-dir + readOnly: false + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /run/secrets/additional + name: jenkins-secrets + readOnly: true + - mountPath: /var/jenkins_cache + name: jenkins-cache + - mountPath: /tmp + name: tmp-volume + - env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: LABEL + value: my-release-jenkins-jenkins-config + - name: FOLDER + value: /var/jenkins_home/casc_configs + - name: NAMESPACE + value: my-namespace + - name: REQ_URL + value: https://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) + - name: REQ_METHOD + value: POST + - name: REQ_RETRY_CONNECT + value: "10" + image: docker.io/kiwigrid/k8s-sidecar:1.29.0 + imagePullPolicy: IfNotPresent + name: config-reload + resources: {} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /var/jenkins_home + name: jenkins-home + enableServiceLinks: false + initContainers: + - env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: LABEL + value: my-release-jenkins-jenkins-config + - name: FOLDER + value: /var/jenkins_home/casc_configs + - name: NAMESPACE + value: my-namespace + - name: METHOD + value: LIST + image: docker.io/kiwigrid/k8s-sidecar:1.29.0 + imagePullPolicy: IfNotPresent + name: config-reload-init + resources: {} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/jenkins_home/casc_configs + name: sc-config-volume + - mountPath: /var/jenkins_home + name: jenkins-home + - command: + - sh + - /var/jenkins_config/apply_config.sh + image: docker.io/jenkins/jenkins:2.479.3-jdk17 + imagePullPolicy: Always + name: init + resources: + limits: + cpu: 2000m + memory: 4096Mi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsUser: 1000 + volumeMounts: + - mountPath: /var/jenkins_home + name: jenkins-home + - mountPath: /var/jenkins_config + name: jenkins-config + - mountPath: /usr/share/jenkins/ref/plugins + name: plugins + - mountPath: /var/jenkins_plugins + name: plugin-dir + - mountPath: /tmp + name: tmp-volume + securityContext: + fsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + serviceAccountName: my-release-jenkins + volumes: + - emptyDir: {} + name: plugins + - configMap: + name: my-release-jenkins + name: jenkins-config + - emptyDir: {} + name: plugin-dir + - name: jenkins-secrets + projected: + sources: + - secret: + items: + - key: jenkins-admin-user + path: chart-admin-username + - key: jenkins-admin-password + path: chart-admin-password + name: my-release-jenkins + - emptyDir: {} + name: jenkins-cache + - name: jenkins-home + persistentVolumeClaim: + claimName: my-release-jenkins + - emptyDir: {} + name: sc-config-volume + - emptyDir: {} + name: tmp-volume diff --git a/charts/jenkins/unittests/config-init-scripts-test.yaml b/charts/jenkins/unittests/config-init-scripts-test.yaml index b524460ca..b0b7d1795 100644 --- a/charts/jenkins/unittests/config-init-scripts-test.yaml +++ b/charts/jenkins/unittests/config-init-scripts-test.yaml @@ -14,6 +14,6 @@ tests: - hasDocuments: count: 1 - equal: - path: data.inittest\.groovy + path: data["inittest.groovy"] value: |- my script here val here diff --git a/charts/jenkins/unittests/config-test.yaml b/charts/jenkins/unittests/config-test.yaml index 3004636c6..97f8f5aa8 100644 --- a/charts/jenkins/unittests/config-test.yaml +++ b/charts/jenkins/unittests/config-test.yaml @@ -16,7 +16,7 @@ tests: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: jenkins - equal: - path: data.apply_config\.sh + path: data["apply_config.sh"] value: |- set -e echo "disable Setup Wizard" @@ -37,19 +37,14 @@ tests: # Copy plugins to shared volume yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; echo "finished initialization" - - equal: - path: data.plugins\.txt - value: |- - kubernetes:3900.va_dce992317b_4 - workflow-aggregator:596.v8c21c963d92d - git:5.0.0 - configuration-as-code:1625.v27444588cc3d + - matchSnapshot: + path: data["plugins.txt"] - it: no plugins set: controller.installPlugins: [] asserts: - equal: - path: data.apply_config\.sh + path: data["apply_config.sh"] value: |- set -e echo "disable Setup Wizard" @@ -58,7 +53,7 @@ tests: echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion echo "finished initialization" - equal: - path: data.plugins\.txt + path: data["plugins.txt"] value: "" - it: additional plugins config set: @@ -66,20 +61,14 @@ tests: additionalPlugins: - kubernetes-credentials-provider asserts: - - equal: - path: data.plugins\.txt - value: |- - kubernetes:3900.va_dce992317b_4 - workflow-aggregator:596.v8c21c963d92d - git:5.0.0 - configuration-as-code:1625.v27444588cc3d - kubernetes-credentials-provider + - matchSnapshot: + path: data["plugins.txt"] - it: install latest plugins set: controller.installLatestPlugins: false asserts: - equal: - path: data.apply_config\.sh + path: data["apply_config.sh"] value: |- set -e echo "disable Setup Wizard" @@ -105,7 +94,7 @@ tests: controller.installLatestSpecifiedPlugins: true asserts: - equal: - path: data.apply_config\.sh + path: data["apply_config.sh"] value: |- set -e echo "disable Setup Wizard" diff --git a/charts/jenkins/unittests/home-pvc-test.yaml b/charts/jenkins/unittests/home-pvc-test.yaml index 1ad52e566..b213bda17 100644 --- a/charts/jenkins/unittests/home-pvc-test.yaml +++ b/charts/jenkins/unittests/home-pvc-test.yaml @@ -19,7 +19,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -30,6 +30,8 @@ tests: path: spec.resources.requests value: storage: 8Gi + - isNull: + path: spec.dataSource - isNull: path: spec.storageClassName @@ -92,3 +94,18 @@ tests: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: jenkins test-label: test-value + + - it: clone from dataSource + set: + persistence: + dataSource: + name: PVC-NAME + kind: PersistentVolumeClaim + asserts: + - equal: + path: spec.dataSource.name + value: PVC-NAME + - equal: + path: spec.dataSource.kind + value: PersistentVolumeClaim + diff --git a/charts/jenkins/unittests/jcasc-config-test.yaml b/charts/jenkins/unittests/jcasc-config-test.yaml index 53672a318..51d01ed09 100644 --- a/charts/jenkins/unittests/jcasc-config-test.yaml +++ b/charts/jenkins/unittests/jcasc-config-test.yaml @@ -11,91 +11,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: agent namespace and templates release: namespace: controller-namespace @@ -105,21 +26,23 @@ tests: namespace: maven podName: maven customJenkinsLabels: maven - image: jenkins/jnlp-agent-maven - tag: latest + image: + repository: jenkins/jnlp-agent-maven + tag: latest python: podName: python customJenkinsLabels: python sideContainerName: python - image: python - tag: "3" + image: + repository: python + tag: "3" command: /bin/sh -c args: "cat" TTYEnabled: true agent: namespace: jenkins-agents podTemplates: - python3: | + python3: |- - name: python3 label: jenkins-python3 serviceAccount: jenkins @@ -132,167 +55,13 @@ tests: privileged: true resourceRequestCpu: "400m" resourceRequestMemory: "512Mi" + resourceRequestEphemeralStorage: "1Gi" resourceLimitCpu: "1" resourceLimitMemory: "1024Mi" + resourceLimitEphemeralStorage: "2Gi" asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "jenkins-agents" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "jenkins-agents" - id: 67908da8853cf5cad0226b130ab2fb2ffbc366c94701a41d296bdaf49f3cffa5 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "maven" - namespace: "maven" - id: 98603b48bbb1de225597bf5880686872d42061c877fee35c4fab6ccb88e272bf - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "python" - namespace: "jenkins-agents" - id: 531bebaf0c72403411727c4707cb4e2059b9b704931b7ad5e4252e764d5271fb - containers: - - name: "python" - alwaysPullImage: false - args: "cat" - command: /bin/sh -c - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "python:3" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: true - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent python" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: python3 - label: jenkins-python3 - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: customized config set: controller: @@ -320,6 +89,7 @@ tests: agent: namespace: default containerCap: 22 + jnlpregistry: private.registry.com defaultsProviderTemplate: my-defaults kubernetesConnectTimeout: 11 kubernetesReadTimeout: 12 @@ -327,16 +97,19 @@ tests: sideContainerName: sideContainer alwaysPullImage: true command: /bin/command - image: my-image/jnlp - tag: v1.2.3 + image: + repository: my-image/jnlp + tag: v1.2.3 privileged: true resources: limits: cpu: 1024m memory: 1Gi + ephemeralStorage: 1Gi requests: cpu: 756m memory: 768Mi + ephemeralStorage: 512Mi runAsUser: 2000 runAsGroup: 2000 TTYEnabled: true @@ -374,6 +147,11 @@ tests: defaultMode: "600" mountPath: /var/myapp/mysecret secretName: mysecret + - type: EphemeralVolume + mountPath: /var/myapp/myephemeralvolume + accessModes: ReadWriteOnce + requestsSize: 2Gi + storageClassName: test-storageclass annotations: ci.jenkins-agent/test: "custom" yamlTemplate: |- @@ -397,7 +175,7 @@ tests: isKind: of: ConfigMap - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - documentIndex: 0 equal: @@ -408,7 +186,7 @@ tests: path: metadata.namespace value: other - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - documentIndex: 1 isKind: @@ -437,124 +215,8 @@ tests: jenkins: systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - documentIndex: 1 - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - globalMatrix: - permissions: - - "Overall/Read:anonymous" - securityRealm: - local - disableRememberMe: true - mode: EXCLUSIVE - numExecutors: 1 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - rawHtml: - disableSyntaxHighlighting: true - clouds: - - kubernetes: - containerCapStr: "22" - defaultsProviderTemplate: "my-defaults" - connectTimeout: "11" - readTimeout: "12" - jenkinsUrl: "http://my-release-jenkins.other.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.other.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "my-agent" - namespace: "default" - annotations: - - key: ci.jenkins-agent/test - value: "custom" - id: e79c14afdc6e664e7b1a3b6f34bb7eec6bf98ac59160622d57ab8da1f01d6001 - containers: - - name: "sideContainer" - alwaysPullImage: true - args: "^${computer.jnlpmac} ^${computer.name}" - command: /bin/command - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.other.svc.cluster.local:8080/" - image: "my-image/jnlp:v1.2.3" - privileged: "true" - resourceLimitCpu: 1024m - resourceLimitMemory: 1Gi - resourceRequestCpu: 756m - resourceRequestMemory: 768Mi - runAsUser: 2000 - runAsGroup: 2000 - ttyEnabled: true - workingDir: /workdir - envVars: - - envVar: - key: VAR - value: value - idleMinutes: 30 - instanceCap: 2147483647 - imagePullSecrets: - - name: pullSecret - label: "my-release-jenkins-agent " - nodeSelector: jenkins-agent=v1,selector=abc - nodeUsageMode: "NORMAL" - podRetention: onFailure - showRawYaml: true - serviceAccount: "agent-serviceaccount" - slaveConnectTimeoutStr: "111" - volumes: - - configMapVolume: - configMapName: "myconfigmap" - mountPath: "/var/myapp/myconfigmap" - - emptyDirVolume: - memory: false - mountPath: "/var/myapp/myemptydir" - - hostPathVolume: - hostPath: "/var/lib/containers" - mountPath: "/var/myapp/myhostpath" - - nfsVolume: - mountPath: "/var/myapp/mynfs" - readOnly: false - serverAddress: "192.0.2.0" - serverPath: "/var/lib/containers" - - persistentVolumeClaim: - claimName: "mypvc" - mountPath: "/var/myapp/mypvc" - readOnly: false - - secretVolume: - defaultMode: "600" - mountPath: "/var/myapp/mysecret" - secretName: "mysecret" - yaml: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "key" - operator: "Equal" - value: "value" - yamlMergeStrategy: merge - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: admin@example.org - url: https://jenkins.example.com + matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom dynamic pvc workspace volume set: agent: @@ -571,96 +233,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: bacdf2e1a72d322877ad560492ebcfaf80d4ad59365b467882b934edcc33587a - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - dynamicPVC: - accessModes: "ReadWriteOnce" - requestsSize: "2Gi" - storageClassName: "gp2" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom emptyDir workspace volume set: agent: @@ -675,94 +253,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 53621a16409165a8c558c4109e49d6daff72e551751055db28bb317c9ad6ddba - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - emptyDirWorkspaceVolume: - memory: true - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom hostPath workspace volume set: agent: @@ -777,94 +273,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 7890750e97ceaac3fef2593299438dc6a7b8fa32501fe17959c5e4014d738bfb - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - hostPathWorkspaceVolume: - hostPath: "/data" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom nfs workspace volume set: agent: @@ -881,96 +295,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: ed2358510eaa4d700e7601efc8d63b23c6fb9eaebcae714b201d0cc4a15b7fcc - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - nfsWorkspaceVolume: - readOnly: false - serverAddress: "1.1.1.1" - serverPath: "/data" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom pvc workspace volume set: agent: @@ -986,95 +316,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: ef77b14c9ce0a495d147a75ab1df4416366c8044912ec9caaa0b207f1fea7211 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: custom other workspace volume set: agent: @@ -1090,95 +337,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 561e119ef9d6bebe219e7cb626ba618a97009170823d46edd4a33be891c88c57 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: disable helm.sh label set: renderHelmLabels: false @@ -1197,52 +361,8 @@ tests: set: agent.enabled: false asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "controller-namespace" - serverUrl: "https://kubernetes.default" - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: disable default config set: controller.JCasC.defaultConfig: false @@ -1261,91 +381,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "testlabel" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: adds custom labels on agent pods set: agent: @@ -1358,95 +399,44 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "NAMESPACE" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - - key: "label-one" - value: "value-one" - - key: "label-two" - value: "true" - templates: - - name: "default" - namespace: "NAMESPACE" - id: 2165d75efe14a64900a4476f8141a123a643889416f0724d74f878e4c94dad69 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: disable useDefaultServiceAccount + set: + agent: + useDefaultServiceAccount: false + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: set agent.serviceAccount + set: + agent: + serviceAccount: "testing" + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: legacyRemotingSecurityEnabled = false release: namespace: default @@ -1459,91 +449,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: legacyRemotingSecurityEnabled = true release: namespace: default @@ -1556,93 +467,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - remotingSecurity: - enabled: true - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: empty projectNamingStrategy release: namespace: default @@ -1650,86 +480,8 @@ tests: controller: projectNamingStrategy: asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: non-string projectNamingStrategy release: namespace: default @@ -1740,90 +492,8 @@ tests: mySetting1: true mySetting2: something asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: - myConfiguration: - mySetting1: true - mySetting2: something - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: specify security settings without apiToken override release: namespace: default @@ -1834,90 +504,9 @@ tests: gitHostKeyVerificationConfiguration: sshHostKeyVerificationStrategy: "acceptFirstConnectionStrategy" asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - gitHostKeyVerificationConfiguration: - sshHostKeyVerificationStrategy: acceptFirstConnectionStrategy - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify security settings without apiToken override + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: specify security settings with apiToken override release: namespace: default set: @@ -1926,84 +515,8 @@ tests: security: apiToken: overridden asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e0cd10fbcdae0f46f80cd106dcebfbc8d442809678e09bccf7e773fe9accbf8f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: overridden - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: specify additional container release: namespace: default @@ -2011,111 +524,15 @@ tests: agent: additionalContainers: - sideContainerName: dind - image: docker - tag: dind + image: + repository: docker + tag: dind command: dockerd-entrypoint.sh args: "" privileged: true asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 03cd1338d0314d386eba7b9beab89ca680a007c468a7e30bb4adcf47f16a78ee - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: specify additional container and overwrite in additional agent release: namespace: default @@ -2123,8 +540,9 @@ tests: agent: additionalContainers: - sideContainerName: dind - image: docker - tag: dind + image: + repository: docker + tag: dind command: dockerd-entrypoint.sh args: "" privileged: true @@ -2133,159 +551,14 @@ tests: podName: additional-agent additionalContainers: - sideContainerName: additional - image: my-additional-container-image - tag: latest + image: + repository: my-additional-container-image + tag: latest command: entrypoint.sh args: arg1 arg2 asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 03cd1338d0314d386eba7b9beab89ca680a007c468a7e30bb4adcf47f16a78ee - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "additional-agent" - namespace: "default" - id: c2af7380218139b99ea8bbb9c88dc9d20f2ad50281ad6d38477e25fc33c24012 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "additional" - alwaysPullImage: false - args: "arg1 arg2" - command: entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "my-additional-container-image:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: specify additional container and clear in additional agent release: namespace: default @@ -2293,8 +566,9 @@ tests: agent: additionalContainers: - sideContainerName: dind - image: docker - tag: dind + image: + repository: docker + tag: dind command: dockerd-entrypoint.sh args: "" privileged: true @@ -2303,136 +577,8 @@ tests: podName: additional-agent additionalContainers: [] asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 03cd1338d0314d386eba7b9beab89ca680a007c468a7e30bb4adcf47f16a78ee - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "additional-agent" - namespace: "default" - id: f9e3f06260d37c1b82ca4d934a79f6ab50660ad9f78969d5c97cd5c277f593cd - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: configure hostnetworking to agent release: namespace: default @@ -2440,88 +586,8 @@ tests: agent: hostNetworking: true asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: d6dfac7ba19edddafc17052d7c6f246c9bf28d3a102013597cd6a38aea949f73 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - hostNetwork: true - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: set secretEnvVars set: agent: @@ -2540,100 +606,12 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: d1472cb06e768e986a767e6668ec662150d533997c3f18d74eb04547ff264ab4 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - envVars: - - envVar: - key: UNITTEST_ENV - value: testvalue - - secretEnvVar: - key: UNITTEST_PATH - secretName: k8s-unittest-secret-name - secretKey: UNITTEST_K8S_PATH - optional: false - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + - matchSnapshot: + path: data["jcasc-default-config.yaml"] - it: set directConnection set: agent: @@ -2646,87 +624,220 @@ tests: - hasDocuments: count: 1 - isNotEmpty: - path: data.jcasc-default-config\.yaml + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: set restrictedPssSecurityContext + set: + agent: + restrictedPssSecurityContext: true + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: agent with liveness probe + set: + agent: + livenessProbe: + execArgs: "cat /tmp/healthy" + failureThreshold: 3 + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: agents with liveness probe + set: + agent: + additionalContainers: + - sideContainerName: side-container + image: + repository: REPOSITORY + tag: TAG + args: "" + command: "" + livenessProbe: + execArgs: "cat /tmp/healthy" + failureThreshold: 3 + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: additional clouds + set: + additionalClouds: + remote-cloud-1: + kubernetesURL: https://api.remote-cloud.com + credentialsId: "remote-cloud-token" + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: additional clouds inheriting additional agents + set: + additionalAgents: + maven: + namespace: maven + podName: maven + customJenkinsLabels: maven + image: + repository: jenkins/jnlp-agent-maven + tag: latest + additionalClouds: + remote-cloud-1: + kubernetesURL: https://api.remote-cloud.com + credentialsId: "remote-cloud-token" + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: additional clouds overriding additional agents + set: + additionalAgents: + maven: + namespace: maven + podName: maven + customJenkinsLabels: maven + image: + repository: jenkins/jnlp-agent-maven + tag: latest + additionalClouds: + remote-cloud-1: + kubernetesURL: https://api.remote-cloud.com + credentialsId: "remote-cloud-token" + additionalAgentsOverride: true + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: custom configmap annotations + set: + controller: + JCasC: + configMapAnnotations: + jenkins.example.com/anno1: "custom-annotation" + jenkins.example.com/anno2: "another-annotation" + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - directConnection: true - maxRequestsPerHostStr: "32" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: c8daeb4c4b3467acc0217358350fe49c9ce283c75134acdfb56dd64453425560 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_DIRECT_CONNECTION" - value: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - image: "jenkins/inbound-agent:3107.v665000b_51092-5" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 + path: metadata.annotations + value: + jenkins.example.com/anno1: "custom-annotation" + jenkins.example.com/anno2: "another-annotation" + - it: additional clouds set skipTlsVerify + set: + additionalClouds: + remote-cloud-1: + kubernetesURL: https://api.remote-cloud.com + credentialsId: "remote-cloud-token" + agent: + skipTlsVerify: true + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] + - it: additional clouds set usageRestricted + set: + additionalClouds: + remote-cloud-1: + kubernetesURL: https://api.remote-cloud.com + credentialsId: "remote-cloud-token" + agent: + usageRestricted: true + release: + namespace: default + asserts: + - isKind: + of: ConfigMap + - hasDocuments: + count: 1 + - isNotEmpty: + path: data["jcasc-default-config.yaml"] + - matchRegex: + path: metadata.labels["helm.sh/chart"] + pattern: ^jenkins- + - matchSnapshot: + path: data["jcasc-default-config.yaml"] \ No newline at end of file diff --git a/charts/jenkins/unittests/jenkins-agent-svc-test.yaml b/charts/jenkins/unittests/jenkins-agent-svc-test.yaml index ec1048a9d..4b0367c65 100644 --- a/charts/jenkins/unittests/jenkins-agent-svc-test.yaml +++ b/charts/jenkins/unittests/jenkins-agent-svc-test.yaml @@ -19,7 +19,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -127,4 +127,4 @@ tests: agentListenerEnabled: false asserts: - hasDocuments: - count: 0 \ No newline at end of file + count: 0 diff --git a/charts/jenkins/unittests/jenkins-backup-cronjob-test.yaml b/charts/jenkins/unittests/jenkins-backup-cronjob-test.yaml deleted file mode 100644 index e1dd18fba..000000000 --- a/charts/jenkins/unittests/jenkins-backup-cronjob-test.yaml +++ /dev/null @@ -1,62 +0,0 @@ -suite: Jenkins Backup Cronjob -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-backup-cronjob.yaml -tests: - - it: test default values - set: - backup: - enabled: true - asserts: - - isKind: - of: CronJob - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: - fsGroup: 1000 - runAsUser: 1000 - - it: test empty backup.podSecurityContextOverride - set: - backup: - enabled: true - podSecurityContextOverride: {} - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: {} - - it: test backup.podSecurityContextOverride - set: - backup: - enabled: true - podSecurityContextOverride: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: [5555] - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: - - 5555 - - it: test empty backup.imagePullSecretName - set: - backup: - enabled: true - imagePullSecretName: - asserts: - - isNull: - path: spec.jobTemplate.spec.template.spec.imagePullSecrets - - it: test backup.imagePullSecretName - set: - backup: - enabled: true - imagePullSecretName: my-secret - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.imagePullSecrets - value: - - name: my-secret diff --git a/charts/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml b/charts/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml index bdeece874..98b1a8436 100644 --- a/charts/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml @@ -33,13 +33,13 @@ tests: path: metadata.name value: my-release-jenkins - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - equal: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - equal: path: spec @@ -76,4 +76,4 @@ tests: app.kubernetes.io/component: jenkins-controller app.kubernetes.io/instance: my-release app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins \ No newline at end of file + app.kubernetes.io/name: jenkins diff --git a/charts/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml b/charts/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml index 0183331be..a9f8b38e4 100644 --- a/charts/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml @@ -35,7 +35,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml b/charts/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml new file mode 100644 index 000000000..a57e667a4 --- /dev/null +++ b/charts/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml @@ -0,0 +1,26 @@ +suite: Controller Ingress - DRY Support +release: + name: my-release + namespace: my-namespace +templates: + - jenkins-controller-ingress.yaml + - jcasc-config.yaml +tests: + - it: controller-ingress + template: jenkins-controller-ingress.yaml + set: + global.jenkinsHostname: "jenkins.example.com" + controller.ingress: + enabled: true + hostName: "{{ .Values.global.jenkinsHostname }}" + resourceRootUrl: "{{ .Values.global.jenkinsHostname }}" + tls: + - hosts: + - "{{ .Values.global.jenkinsHostname }}" + asserts: + - equal: + path: spec.rules[0].host + value: "jenkins.example.com" + - equal: + path: spec.tls[0].hosts[0] + value: "jenkins.example.com" diff --git a/charts/jenkins/unittests/jenkins-controller-ingress-test.yaml b/charts/jenkins/unittests/jenkins-controller-ingress-test.yaml index 6508d7e65..15bf17287 100644 --- a/charts/jenkins/unittests/jenkins-controller-ingress-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-ingress-test.yaml @@ -35,7 +35,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml b/charts/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml index 09047ff1c..80ffd2657 100644 --- a/charts/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml @@ -24,7 +24,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml b/charts/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml index c9b6bb759..0c1fd882a 100644 --- a/charts/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml @@ -30,7 +30,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-pdb-test.yaml b/charts/jenkins/unittests/jenkins-controller-pdb-test.yaml index 7a43bfc9f..c3251c6ad 100644 --- a/charts/jenkins/unittests/jenkins-controller-pdb-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-pdb-test.yaml @@ -30,7 +30,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml b/charts/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml index 8df3a3493..3c28e52ad 100644 --- a/charts/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml @@ -37,7 +37,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml b/charts/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml index b5aed8c46..cd8a0a3c2 100644 --- a/charts/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml @@ -14,7 +14,7 @@ tests: count: 0 - it: enabled set: - controller.secondaryingress: + "controller.secondaryingress": enabled: true hostName: jenkins.example.com ingressClassName: nginx @@ -37,7 +37,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml b/charts/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml index a847061e3..2c12ed57c 100644 --- a/charts/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml @@ -25,7 +25,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - equal: path: spec diff --git a/charts/jenkins/unittests/jenkins-controller-statefulset-test.yaml b/charts/jenkins/unittests/jenkins-controller-statefulset-test.yaml index c9f4e72b3..7fb31d2c0 100644 --- a/charts/jenkins/unittests/jenkins-controller-statefulset-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-statefulset-test.yaml @@ -5,6 +5,8 @@ release: templates: - jenkins-controller-statefulset.yaml - config.yaml + - config-init-scripts.yaml + - auto-reload-config.yaml tests: - it: default values template: jenkins-controller-statefulset.yaml @@ -21,7 +23,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -34,194 +36,8 @@ tests: matchLabels: app.kubernetes.io/component: jenkins-controller app.kubernetes.io/instance: my-release - - equal: + - matchSnapshot: path: spec - value: - serviceName: my-release-jenkins - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - template: - metadata: - annotations: - checksum/config: 572b6e6e44f82aa907092e9fcd7e4070830217a6bdca52f224d0c82dea885b9a - labels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - spec: - containers: - - args: - - --httpPort=8080 - env: - - name: SECRETS - value: /run/secrets/additional - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: "-Dcasc.reload.token=$(POD_NAME) " - - name: JENKINS_OPTS - value: "--webroot=/var/jenkins_cache/war " - - name: JENKINS_SLAVE_AGENT_PORT - value: "50000" - - name: CASC_JENKINS_CONFIG - value: /var/jenkins_home/casc_configs - image: jenkins/jenkins:2.387.2-jdk11 - imagePullPolicy: Always - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - livenessProbe: - failureThreshold: 5 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - name: jenkins - ports: - - containerPort: 8080 - name: http - - containerPort: 50000 - name: agent-listener - readinessProbe: - failureThreshold: 3 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - startupProbe: - httpGet: - path: "/login" - port: http - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 12 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - readOnly: false - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - - mountPath: /usr/share/jenkins/ref/plugins/ - name: plugin-dir - readOnly: false - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - mountPath: /var/jenkins_cache - name: jenkins-cache - - mountPath: /tmp - name: tmp-volume - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: REQ_URL - value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) - - name: REQ_METHOD - value: POST - - name: REQ_RETRY_CONNECT - value: "10" - image: kiwigrid/k8s-sidecar:1.23.1 - imagePullPolicy: IfNotPresent - securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - name: config-reload - resources: {} - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - initContainers: - - command: - - sh - - /var/jenkins_config/apply_config.sh - image: jenkins/jenkins:2.387.2-jdk11 - imagePullPolicy: Always - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - name: init - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - - mountPath: /var/jenkins_config - name: jenkins-config - - mountPath: /usr/share/jenkins/ref/plugins - name: plugins - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - securityContext: - fsGroup: 1000 - runAsUser: 1000 - runAsNonRoot: true - serviceAccountName: my-release-jenkins - volumes: - - emptyDir: {} - name: plugins - - configMap: - name: my-release-jenkins - name: jenkins-config - - emptyDir: {} - name: plugin-dir - - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - emptyDir: {} - name: jenkins-cache - - name: jenkins-home - persistentVolumeClaim: - claimName: my-release-jenkins - - emptyDir: {} - name: sc-config-volume - - emptyDir: {} - name: tmp-volume - it: test different values template: jenkins-controller-statefulset.yaml capabilities: @@ -248,6 +64,13 @@ tests: values: - S1 topologyKey: failure-domain.beta.kubernetes.io/zone + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: "topology.kubernetes.io/zone" + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: jenkins-controller terminationGracePeriodSeconds: 120 priorityClassName: important runAsUser: 2000 @@ -295,6 +118,15 @@ tests: values: - S1 topologyKey: failure-domain.beta.kubernetes.io/zone + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - maxSkew: 1 + topologyKey: "topology.kubernetes.io/zone" + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/component: jenkins-controller - equal: path: spec.template.spec.terminationGracePeriodSeconds value: 120 @@ -337,42 +169,41 @@ tests: - it: configure image tag template: jenkins-controller-statefulset.yaml set: - controller.tag: 2.249.1-slim - controller.imagePullPolicy: IfNotPresent + controller.image.tag: slim + controller.image.pullPolicy: IfNotPresent asserts: - equal: path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.249.1-slim + value: docker.io/jenkins/jenkins:slim - equal: path: spec.template.spec.containers[0].imagePullPolicy value: IfNotPresent - it: configure image tag label template: jenkins-controller-statefulset.yaml set: - controller.tagLabel: alpine + controller.image.tagLabel: alpine asserts: - - equal: + - matchSnapshot: path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.387.2-alpine - it: configure empty image tag label template: jenkins-controller-statefulset.yaml set: - controller.tagLabel: + controller.image.tagLabel: asserts: - - equal: + - matchSnapshot: path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.387.2 - it: custom image template: jenkins-controller-statefulset.yaml set: controller: - image: registry/image - tag: my-tag + image: + repository: registry/image + tag: my-tag javaOpts: -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true asserts: - equal: path: spec.template.spec.containers[0].image - value: registry/image:my-tag + value: docker.io/registry/image:my-tag - contains: path: spec.template.spec.containers[0].env content: @@ -425,18 +256,74 @@ tests: template: jenkins-controller-statefulset.yaml set: controller: - podSecurityContextOverride: + podSecurityContextOverride: &expected runAsNonRoot: true runAsUser: 4444 supplementalGroups: [5555] asserts: - equal: path: spec.template.spec.securityContext + value: *expected + - it: test controller.sidecars.additionalSidecarContainers + template: jenkins-controller-statefulset.yaml + set: + controller: + sidecars: + additionalSidecarContainers: + - name: otel-collector + image: opentelemetry-collector:0.93.0 + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + asserts: + - equal: + path: spec.template.spec.containers[2] value: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: - - 5555 + name: otel-collector + image: opentelemetry-collector:0.93.0 + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 200m + memory: 256Mi + requests: + cpu: 100m + memory: 128Mi + - it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 1) + template: jenkins-controller-statefulset.yaml + set: + controller.sidecars.configAutoReload.enabled: true + controller.sidecars.configAutoReload.logging.configuration.override: true + asserts: + - equal: + path: spec.template.spec.volumes[0] + value: + name: auto-reload-config + configMap: + name: my-release-jenkins-auto-reload-config + - equal: + path: spec.template.spec.initContainers[0].env[5] + value: + name: LOG_CONFIG + value: /var/jenkins_home/auto-reload/auto-reload-config.yaml + - equal: + path: spec.template.spec.containers[1].env[7] + value: + name: LOG_CONFIG + value: /var/jenkins_home/auto-reload/auto-reload-config.yaml + - it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 2) + template: auto-reload-config.yaml + set: + controller.sidecars.configAutoReload.enabled: true + controller.sidecars.configAutoReload.logging.configuration.override: true + asserts: + - isKind: + of: ConfigMap - it: test 2 additional secrets template: jenkins-controller-statefulset.yaml set: @@ -558,18 +445,28 @@ tests: name: special-config controller.sidecars.configAutoReload.envFrom: - configMapRef: - name: special-config + name: special-config-auto-reload controller.containerEnvFrom: - configMapRef: name: special-config asserts: - contains: path: spec.template.spec.initContainers[0].env + content: + name: "TEST_ENV_VAR_CONFIG" + value: "test-env-var-config" + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: "TEST_ENV_VAR_CONFIG_TEMPLATED" + value: "some-value" + - contains: + path: spec.template.spec.initContainers[1].env content: name: "TEST_ENV_VAR_INIT" value: "test-env-var-init" - contains: - path: spec.template.spec.initContainers[0].env + path: spec.template.spec.initContainers[1].env content: name: "TEST_ENV_VAR_INIT_TEMPLATED" value: "some-value" @@ -595,6 +492,11 @@ tests: value: "some-value" - contains: path: spec.template.spec.initContainers[0].envFrom + content: + configMapRef: + name: special-config-auto-reload + - contains: + path: spec.template.spec.initContainers[1].envFrom content: configMapRef: name: special-config @@ -607,7 +509,69 @@ tests: path: spec.template.spec.containers[1].envFrom content: configMapRef: - name: special-config + name: special-config-auto-reload + - it: test sleep time for config-reload + template: jenkins-controller-statefulset.yaml + set: + controller.sidecars.configAutoReload.sleepTime: 60 + asserts: + - contains: + # METHOD remains LIST on the config-reload init container + path: spec.template.spec.initContainers[0].env + content: + name: "METHOD" + value: "LIST" + - contains: + path: spec.template.spec.containers[1].env + content: + name: "METHOD" + value: "SLEEP" + - contains: + path: spec.template.spec.containers[1].env + content: + name: "SLEEP_TIME" + value: "60" + - it: test METHOD env var for config-reload + template: jenkins-controller-statefulset.yaml + set: + controller.sidecars.configAutoReload.env: + - name: "METHOD" + value: "SLEEP" + asserts: + - contains: + # METHOD remains LIST on the config-reload init container + path: spec.template.spec.initContainers[0].env + content: + name: "METHOD" + value: "LIST" + - notContains: + # only one METHOD on the config-reload init container + path: spec.template.spec.initContainers[0].env + content: + name: "METHOD" + value: "SLEEP" + - contains: + path: spec.template.spec.containers[1].env + content: + name: "METHOD" + value: "SLEEP" + - it: test scheme for config-reload + template: jenkins-controller-statefulset.yaml + set: + controller.sidecars.configAutoReload.scheme: "https" + asserts: + - matchSnapshot: + path: spec + - it: test skip tls verify for config-reload + template: jenkins-controller-statefulset.yaml + set: + controller.sidecars.configAutoReload.skipTlsVerify: true + asserts: + - contains: + path: spec.template.spec.containers[1].env + content: + name: "REQ_SKIP_TLS_VERIFY" + value: "true" - it: overrides container args template: jenkins-controller-statefulset.yaml set: @@ -659,6 +623,23 @@ tests: asserts: - isNull: path: spec.template.spec.shareProcessNamespace + - it: test false enableServiceLinks + template: jenkins-controller-statefulset.yaml + set: + controller: + enableServiceLinks: false + asserts: + - equal: + path: spec.template.spec.enableServiceLinks + value: false + - it: test true enableServiceLinks + template: jenkins-controller-statefulset.yaml + set: + controller: + enableServiceLinks: true + asserts: + - isNull: + path: spec.template.spec.enableServiceLinks - it: test disableSecretMount template: jenkins-controller-statefulset.yaml set: @@ -682,7 +663,7 @@ tests: mountPath: /some/path name: jenkins-https-keystore - notContains: - path: spec.template.spec.initContainers[0].volumeMounts + path: spec.template.spec.initContainers[1].volumeMounts content: mountPath: /some/path name: jenkins-https-keystore @@ -721,7 +702,7 @@ tests: mountPath: /some/path name: jenkins-https-keystore - contains: - path: spec.template.spec.initContainers[0].volumeMounts + path: spec.template.spec.initContainers[1].volumeMounts content: mountPath: /some/path name: jenkins-https-keystore @@ -734,6 +715,48 @@ tests: items: - key: jenkins-jks-file path: some-file-name + - it: test override with jenkinsHttpsJksPasswordSecretName and jenkinsHttpsJksPasswordSecretKey + template: jenkins-controller-statefulset.yaml + set: + controller: + httpsKeyStore: + enable: true + disableSecretMount: false + jenkinsHttpsJksPasswordSecretName: "some-jks-name" + jenkinsHttpsJksPasswordSecretKey: "some-jks-password" + jenkinsHttpsJksSecretName: some-secret-name + path: /some/path + fileName: some-file-name + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" + valueFrom: + secretKeyRef: + name: "some-jks-name" + key: "some-jks-password" + - it: test jenkinsHttpsJksSecretKey override + template: jenkins-controller-statefulset.yaml + set: + controller: + httpsKeyStore: + enable: true + disableSecretMount: false + jenkinsHttpsJksSecretName: some-secret-name + path: /some/path + fileName: some-file-name + jenkinsHttpsJksSecretKey: "some.jks" + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: jenkins-https-keystore + secret: + secretName: some-secret-name + items: + - key: "some.jks" + path: some-file-name - it: template: jenkins-controller-statefulset.yaml set: @@ -746,7 +769,7 @@ tests: name: plugins emptyDir: {} - notContains: - path: spec.template.spec.initContainers[0].volumeMounts + path: spec.template.spec.initContainers[1].volumeMounts content: name: plugins - it: @@ -790,3 +813,16 @@ tests: content: name: "CASC_JENKINS_CONFIG" value: "/var/jenkins_home/casc_configs" + + - it: test checksum for config-init-script + template: jenkins-controller-statefulset.yaml + set: + controller: + initScripts: + test: |- + This is a test script + asserts: + - isSubset: + path: spec.template.metadata.annotations + content: + checksum/config-init-scripts: 2ee2c03a600a50a55cf62cbed3f1d558d5322eda7544b4047beeb4df66e8ec11 diff --git a/charts/jenkins/unittests/jenkins-controller-svc-test.yaml b/charts/jenkins/unittests/jenkins-controller-svc-test.yaml index f1349ee5d..334ac4c8d 100644 --- a/charts/jenkins/unittests/jenkins-controller-svc-test.yaml +++ b/charts/jenkins/unittests/jenkins-controller-svc-test.yaml @@ -19,7 +19,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -156,3 +156,11 @@ tests: app.kubernetes.io/instance: my-release app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: jenkins + - it: publish not-ready addresses + set: + controller: + publishNotReadyAddresses: true + asserts: + - equal: + path: spec.publishNotReadyAddresses + value: true diff --git a/charts/jenkins/unittests/rbac-test.yaml b/charts/jenkins/unittests/rbac-test.yaml index 592373ea9..6c817ed0a 100644 --- a/charts/jenkins/unittests/rbac-test.yaml +++ b/charts/jenkins/unittests/rbac-test.yaml @@ -145,7 +145,7 @@ tests: - hasDocuments: count: 6 - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - it: disable helm.sh label @@ -215,3 +215,55 @@ tests: name: my-release-jenkins namespace: my-namespace + - it: Role use-nonroot-scc + set: + rbac.useOpenShiftNonRootSCC: true + documentIndex: 2 + asserts: + - isKind: + of: Role + - equal: + path: apiVersion + value: rbac.authorization.k8s.io/v1 + - equal: + path: metadata.name + value: my-release-jenkins-use-nonroot-scc + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: rules + value: + - apiGroups: ["security.openshift.io"] + resources: ["securitycontextconstraints"] + resourceNames: ["nonroot", "nonroot-v2"] + verbs: ["use"] + + - it: RoleBinding use-nonroot-scc + set: + rbac.useOpenShiftNonRootSCC: true + documentIndex: 3 + asserts: + - isKind: + of: RoleBinding + - equal: + path: apiVersion + value: rbac.authorization.k8s.io/v1 + - equal: + path: metadata.name + value: my-release-jenkins-use-nonroot-scc + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: roleRef + value: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: my-release-jenkins-use-nonroot-scc + - equal: + path: subjects + value: + - kind: ServiceAccount + name: my-release-jenkins + namespace: my-namespace diff --git a/charts/jenkins/unittests/secret-additional-test.yaml b/charts/jenkins/unittests/secret-additional-test.yaml index 99d445609..d075f87a2 100644 --- a/charts/jenkins/unittests/secret-additional-test.yaml +++ b/charts/jenkins/unittests/secret-additional-test.yaml @@ -29,7 +29,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations diff --git a/charts/jenkins/unittests/secret-claims-test.yaml b/charts/jenkins/unittests/secret-claims-test.yaml index d7ca286eb..04bd88463 100644 --- a/charts/jenkins/unittests/secret-claims-test.yaml +++ b/charts/jenkins/unittests/secret-claims-test.yaml @@ -34,7 +34,7 @@ tests: value: my-release-jenkins-simple-secret - documentIndex: 0 matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - documentIndex: 0 isNull: @@ -63,7 +63,7 @@ tests: value: my-release-jenkins-complex-secret - documentIndex: 1 matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - documentIndex: 1 isNull: @@ -79,4 +79,4 @@ tests: - documentIndex: 1 equal: path: spec.renew - value: 60 \ No newline at end of file + value: 60 diff --git a/charts/jenkins/unittests/secret-test.yaml b/charts/jenkins/unittests/secret-test.yaml index 12ea5c17e..67e93436a 100644 --- a/charts/jenkins/unittests/secret-test.yaml +++ b/charts/jenkins/unittests/secret-test.yaml @@ -19,7 +19,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -30,7 +30,7 @@ tests: path: data.jenkins-admin-password - it: set admin password set: - controller.adminPassword: secret + controller.admin.password: secret asserts: - equal: path: data.jenkins-admin-user @@ -51,8 +51,7 @@ tests: app.kubernetes.io/name: jenkins - it: disable set: - controller: - adminSecret: false + controller.admin.createSecret: false asserts: - hasDocuments: count: 0 diff --git a/charts/jenkins/unittests/service-account-agent-test.yaml b/charts/jenkins/unittests/service-account-agent-test.yaml index 26d26e087..b1eea0532 100644 --- a/charts/jenkins/unittests/service-account-agent-test.yaml +++ b/charts/jenkins/unittests/service-account-agent-test.yaml @@ -26,7 +26,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -51,7 +51,7 @@ tests: path: metadata.namespace value: agents - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - equal: path: metadata.annotations @@ -90,14 +90,14 @@ tests: "this.is.another.test.label": "with a different value" asserts: - equal: - path: metadata.labels.\app\.kubernetes\.io/name + path: metadata.labels["app.kubernetes.io/name"] value: "jenkins" - equal: - path: metadata.labels.app\.kubernetes\.io/managed-by + path: metadata.labels["app.kubernetes.io/managed-by"] value: "Helm" - equal: - path: metadata.labels.this\.\is\.a\.test\.label + path: metadata.labels["this.is.a.test.label"] value: "with a value" - equal: - path: metadata.labels.this\.is\.another\.test\.label + path: metadata.labels["this.is.another.test.label"] value: "with a different value" diff --git a/charts/jenkins/unittests/service-account-test.yaml b/charts/jenkins/unittests/service-account-test.yaml index 4aa20fe75..e0c755a26 100644 --- a/charts/jenkins/unittests/service-account-test.yaml +++ b/charts/jenkins/unittests/service-account-test.yaml @@ -19,7 +19,7 @@ tests: path: metadata.namespace value: my-namespace - matchRegex: - path: metadata.labels.helm\.sh/chart + path: metadata.labels["helm.sh/chart"] pattern: ^jenkins- - isNull: path: metadata.annotations @@ -64,14 +64,14 @@ tests: "this.is.another.test.label": "with a different value" asserts: - equal: - path: metadata.labels.\app\.kubernetes\.io/name + path: metadata.labels["app.kubernetes.io/name"] value: "jenkins" - equal: - path: metadata.labels.app\.kubernetes\.io/managed-by + path: metadata.labels["app.kubernetes.io/managed-by"] value: "Helm" - equal: - path: metadata.labels.this\.\is\.a\.test\.label + path: metadata.labels["this.is.a.test.label"] value: "with a value" - equal: - path: metadata.labels.this\.is\.another\.test\.label + path: metadata.labels["this.is.another.test.label"] value: "with a different value" diff --git a/charts/jenkins/values.yaml b/charts/jenkins/values.yaml index 6073875b0..9632913fd 100644 --- a/charts/jenkins/values.yaml +++ b/charts/jenkins/values.yaml @@ -5,63 +5,113 @@ ## Overrides for generated resource names # See templates/_helpers.tpl -# nameOverride: -# fullnameOverride: -# namespaceOverride: +# -- Override the resource name prefix +# @default -- `Chart.Name` +nameOverride: +# -- Override the full resource names +# @default -- `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins` +fullnameOverride: +# -- Override the deployment namespace +# @default -- `Release.Namespace` +namespaceOverride: # For FQDN resolving of the controller service. Change this value to match your existing configuration. # ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md +# -- Override the cluster name for FQDN resolving clusterZone: "cluster.local" +# -- The URL of the Kubernetes API server +kubernetesURL: "https://kubernetes.default" + +# -- The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed. +credentialsId: + +# -- Enables rendering of the helm.sh/chart label to the annotations renderHelmLabels: true controller: - # Used for label app.kubernetes.io/component + # -- Used for label app.kubernetes.io/component componentName: "jenkins-controller" - image: "jenkins/jenkins" - # tag: "2.387.2-jdk11" - tagLabel: jdk11 - imagePullPolicy: "Always" + image: + # -- Controller image registry + registry: "docker.io" + # -- Controller image repository + repository: "jenkins/jenkins" + + # -- Controller image tag override; i.e., tag: "2.440.1-jdk17" + tag: + + # -- Controller image tag label + tagLabel: jdk17 + # -- Controller image pull policy + pullPolicy: "Always" + # -- Controller image pull secret imagePullSecretName: - # Optionally configure lifetime for controller-container - lifecycle: + # -- Lifecycle specification for controller-container + lifecycle: {} # postStart: # exec: # command: # - "uname" # - "-a" + + # -- Disable use of remember me disableRememberMe: false + + # -- Set Number of executors numExecutors: 0 - # configures the executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE + + # -- Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE" executorMode: "NORMAL" - # This is ignored if enableRawHtmlMarkupFormatter is true - markupFormatter: plainText + + # -- Append Jenkins labels to the controller customJenkinsLabels: [] - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm then you can disable it - adminSecret: true hostNetworking: false + # When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist. # If you disable the non-Jenkins identity store and instead use the Jenkins internal one, - # you should revert controller.adminUser to your preferred admin user: - adminUser: "admin" - # adminPassword: + # you should revert controller.admin.username to your preferred admin user: admin: - existingSecret: "" + + # -- Admin username created as a secret if `controller.admin.createSecret` is true + username: "admin" + # -- Admin password created as a secret if `controller.admin.createSecret` is true + # @default -- + password: + + # -- The key in the existing admin secret containing the username userKey: jenkins-admin-user + # -- The key in the existing admin secret containing the password passwordKey: jenkins-admin-password - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" + + # The default configuration uses this secret to configure an admin user + # If you don't need that user or use a different security realm, then you can disable it + # -- Create secret for admin user + createSecret: true + + # -- The name of an existing secret containing the admin credentials + existingSecret: "" + # -- Email address for the administrator of the Jenkins instance + jenkinsAdminEmail: + + # This value should not be changed unless you use your custom image of jenkins or any derived from. + # If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" + # -- Custom Jenkins home path jenkinsHome: "/var/jenkins_home" - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" + + # This value should not be changed unless you use your custom image of jenkins or any derived from. + # If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" + # -- Custom Jenkins reference path jenkinsRef: "/usr/share/jenkins/ref" + # Path to the jenkins war file which is used by jenkins-plugin-cli. jenkinsWar: "/usr/share/jenkins/jenkins.war" - # Overrides the default arguments passed to the war + # Override the default arguments passed to the war # overrideArgs: # - --httpPort=8080 + + # -- Resource allocation (Requests and Limits) resources: requests: cpu: "50m" @@ -69,9 +119,19 @@ controller: limits: cpu: "2000m" memory: "4096Mi" + # Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod shareProcessNamespace: false + + # Service links might cause issue if running in a namespace with a large amount of services + # that might cause a slow startup when plugins are copied from ref to volume + # Set to true to keep previous behavior + # See https://github.com/kubernetes/kubernetes/issues/121787 + enableServiceLinks: false + # Overrides the init container default values + # -- Resources allocation (Requests and Limits) for Init Container + initContainerResources: {} # initContainerResources: # requests: # cpu: "50m" @@ -79,142 +139,238 @@ controller: # limits: # cpu: "2000m" # memory: "4096Mi" - # Environment variables that get added to the init container (useful for e.g. http_proxy) + # -- Environment variable sources for Init Container + initContainerEnvFrom: [] + + # useful for i.e., http_proxy + # -- Environment variables for Init Container + initContainerEnv: [] # initContainerEnv: # - name: http_proxy # value: "http://192.168.64.1:3128" - # containerEnv: + + # -- Environment variable sources for Jenkins Container + containerEnvFrom: [] + + # -- Environment variables for Jenkins Container + containerEnv: [] # - name: http_proxy # value: "http://192.168.64.1:3128" - # Set min/max heap here if needed with: - # javaOpts: "-Xms512m -Xmx512m" - # jenkinsOpts: "" - # If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. + + # Set min/max heap here if needed with "-Xms512m -Xmx512m" + # -- Append to `JAVA_OPTS` env var + javaOpts: + # -- Append to `JENKINS_OPTS` env var + jenkinsOpts: + + # If you are using the ingress definitions provided by this chart via the `controller.ingress` block, + # the configured hostname will be the ingress hostname starting with `https://` + # or `http://` depending on the `tls` configuration. # The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - # jenkinsUrlProtocol: "https" - # If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the url definition. - # jenkinsUrl: "" - # If you set this prefix and use ingress controller then you might want to set the ingress path below - # jenkinsUriPrefix: "/jenkins" - # Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) + # -- Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise + jenkinsUrlProtocol: + + # -- Set Jenkins URL if you are not using the ingress definitions provided by the chart + jenkinsUrl: + + # If you set this prefix and use ingress controller, then you might want to set the ingress path below + # I.e., "/jenkins" + # -- Root URI Jenkins will be served on + jenkinsUriPrefix: + + # -- Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) usePodSecurityContext: true + # Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are # being deprecated and replaced by `podSecurityContextOverride`. - # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: + # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins', which exists in 'jenkins/jenkins' docker image. + # When configuring runAsUser to a different value than 0 also set fsGroup to the same value: + # -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. runAsUser: 1000 + + # -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. fsGroup: 1000 + # If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here - securityContextCapabilities: {} + # securityContextCapabilities: # drop: # - NET_RAW - # Completely overwrites the contents of the `securityContext`, ignoring the - # values provided for the deprecated fields: `runAsUser`, `fsGroup`, and - # `securityContextCapabilities`. In the case of mounting an ext4 filesystem, - # it might be desirable to use `supplementalGroups` instead of `fsGroup` in + securityContextCapabilities: {} + + # In the case of mounting an ext4 filesystem, it might be desirable to use `supplementalGroups` instead of `fsGroup` in # the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496 # podSecurityContextOverride: # runAsUser: 1000 # runAsNonRoot: true # supplementalGroups: [1000] - # # capabilities: {} - # Container securityContext + # capabilities: {} + # -- Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities` + podSecurityContextOverride: ~ + + # -- Allow controlling the securityContext for the jenkins container containerSecurityContext: runAsUser: 1000 runAsGroup: 1000 readOnlyRootFilesystem: true allowPrivilegeEscalation: false - servicePort: 8080 - targetPort: 8080 - # For minikube, set this to NodePort, elsewhere use LoadBalancer + + # For minikube, set this to NodePort, elsewhere uses LoadBalancer # Use ClusterIP if your setup includes ingress controller + # -- k8s service type serviceType: ClusterIP - # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, + + # -- k8s service clusterIP. Only used if serviceType is ClusterIP + clusterIp: + # -- k8s service port + servicePort: 8080 + # -- k8s target port + targetPort: 8080 + # -- k8s node port. Only used if serviceType is NodePort + nodePort: + + # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and NodePort type services, # but risks potentially imbalanced traffic spreading. serviceExternalTrafficPolicy: - # Jenkins controller service annotations + + # If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and + # auto-reload on restart feature possible. + publishNotReadyAddresses: + + # -- Jenkins controller service annotations serviceAnnotations: {} - # Jenkins controller custom labels + # -- Jenkins controller custom labels for the StatefulSet statefulSetLabels: {} # foo: bar # bar: foo - # Jenkins controller service labels + # -- Labels for the Jenkins controller-service serviceLabels: {} # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https + # Put labels on Jenkins controller pod + # -- Custom Pod labels (an object with `label-key: label-value` pairs) podLabels: {} - # Used to create Ingress record (should be used with ServiceType: ClusterIP) - # nodePort: # -Dcom.sun.management.jmxremote.port=4000 # -Dcom.sun.management.jmxremote.authenticate=false # -Dcom.sun.management.jmxremote.ssl=false # jmxPort: 4000 - # Optionally configure other ports to expose in the controller container + # -- Open a port, for JMX stats + jmxPort: + + # -- Optionally configure other ports to expose in the controller container extraPorts: [] # - name: BuildInfoProxy # port: 9000 # targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port) - # List of plugins to be install during Jenkins controller start + # Plugins will be installed during Jenkins controller start + # -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false` installPlugins: - - kubernetes:3900.va_dce992317b_4 - - workflow-aggregator:596.v8c21c963d92d - - git:5.0.0 - - configuration-as-code:1625.v27444588cc3d + - kubernetes:4306.vc91e951ea_eb_d + - workflow-aggregator:600.vb_57cdd26fdd7 + - git:5.7.0 + - configuration-as-code:1915.vcdd0a_d0d2625 - # Set to false to download the minimum required version of all dependencies. + # If set to false, Jenkins will download the minimum required version of all dependencies. + # -- Download the minimum required version or latest version of all dependencies installLatestPlugins: true - # Set to true to download latest dependencies of any plugin that is requested to have the latest version. + # -- Set to true to download the latest version of any plugin that is requested to have the latest version installLatestSpecifiedPlugins: false - # List of plugins to install in addition to those listed in controller.installPlugins + # -- List of plugins to install in addition to those listed in controller.installPlugins additionalPlugins: [] - # Enable to initialize the Jenkins controller only once on initial installation. - # Without this, whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates which has the potential to cause breakage. + # Without this; whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates that have the potential to cause breakage. # Note that for this to work, `persistence.enabled` needs to be set to `true` + # -- Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true` initializeOnce: false # Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment. - # overwritePlugins: true + # -- Overwrite installed plugins on start + overwritePlugins: false # Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment. + # -- Overwrite plugins that are already installed in the controller image overwritePluginsFromImage: true # Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config. projectNamingStrategy: standard - # Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter), useful with ghprb plugin. - # The plugin is not installed by default, please update controller.installPlugins. + # Useful with ghprb plugin. The OWASP plugin is not installed by default, please update controller.installPlugins. + # -- Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter) enableRawHtmlMarkupFormatter: false + + # This is ignored if enableRawHtmlMarkupFormatter is true + # -- Yaml of the markup formatter to use + markupFormatter: plainText + # Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval + # -- List of groovy functions to approve scriptApproval: [] # - "method groovy.json.JsonSlurperClassic parseText java.lang.String" # - "new groovy.json.JsonSlurperClassic" - # List of groovy init scripts to be executed during Jenkins controller start - initScripts: [] - # - | + + # -- Map of groovy init scripts to be executed during Jenkins controller start + initScripts: {} + # test: |- # print 'adding global pipeline libraries, register properties, bootstrap jobs...' + # -- Name of the existing ConfigMap that contains init scripts + initConfigMap: - # 'name' is a name of an existing secret in same namespace as jenkins, - # 'keyName' is the name of one of the keys inside current secret. + # 'name' is a name of an existing secret in the same namespace as jenkins, + # 'keyName' is the name of one of the keys inside the current secret. # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} + # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password} # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} + # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') + # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username} # When using existingSecret no need to specify the keyName under additionalExistingSecrets. existingSecret: + # -- List of additional existing secrets to mount additionalExistingSecrets: [] + # ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets + # additionalExistingSecrets: # - name: secret-name-1 # keyName: username # - name: secret-name-1 # keyName: password + # -- List of additional secrets to create and mount additionalSecrets: [] + # ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets + # additionalSecrets: # - name: nameOfSecret # value: secretText - # Generate SecretClaim resources in order to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. - # 'name' is name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. + # Generate SecretClaim resources to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. + # 'name' is the name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. # 'path' is the fully qualified path to the secret in Vault - # 'type' is an optional Kubernetes secret type. Defaults to 'Opaque' + # 'type' is an optional Kubernetes secret type. The default is 'Opaque' # 'renew' is an optional secret renewal time in seconds + # -- List of `SecretClaim` resources to create secretClaims: [] # - name: secretName # required # path: testPath # required # type: kubernetes.io/tls # optional # renew: 60 # optional - # Name of default cloud configuration. + # -- Name of default cloud configuration. cloudName: "kubernetes" - # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, - # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in - # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | - # become the content of the configuration yaml file. The first line after this is a JCasC root element, eg jenkins, credentials, - # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: + # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, + # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. + # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label + # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in + # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | + # become the content of the configuration yaml file. The first line after this is a JCasC root element, e.g., jenkins, credentials, + # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: JCasC: + # -- Enables default Jenkins configuration via configuration as code plugin defaultConfig: true + + # If true, the init container deletes all the plugin config files and Jenkins Config as Code overwrites any existing configuration + # -- Whether Jenkins Config as Code should overwrite any existing configuration + overwriteConfiguration: false + # -- Remote URLs for configuration files. configUrls: [] # - https://acme.org/jenkins.yaml - # Remote URL:s for configuration files. + # -- List of Jenkins Config as Code scripts configScripts: {} # welcome-message: | # jenkins: - # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - # Allows adding to the top-level security JCasC section. For legacy, default the chart includes apiToken configurations + # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. + + # Allows adding to the top-level security JCasC section. For legacy purposes, by default, the chart includes apiToken configurations + # -- Jenkins Config as Code security-section security: apiToken: creationOfLegacyTokenEnabled: false tokenGenerationOnCreationEnabled: false usageStatisticsEnabled: true + # Ignored if securityRealm is defined in controller.JCasC.configScripts + # -- Jenkins Config as Code Security Realm-section securityRealm: |- local: allowsSignup: false @@ -346,24 +537,38 @@ controller: - id: "${chart-admin-username}" name: "Jenkins Admin" password: "${chart-admin-password}" + # Ignored if authorizationStrategy is defined in controller.JCasC.configScripts + # -- Jenkins Config as Code Authorization Strategy-section authorizationStrategy: |- loggedInUsersCanDoAnything: allowAnonymousRead: false - # Optionally specify additional init-containers + + # -- Annotations for the JCasC ConfigMap + configMapAnnotations: {} + + # -- Custom init-container specification in raw-yaml format customInitContainers: [] # - name: custom-init - # image: "alpine:3.7" + # image: "alpine:3" # imagePullPolicy: Always # command: [ "uname", "-a" ] sidecars: configAutoReload: - # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified, - # jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the - # http:///reload-configuration-as-code endpoint to reapply config when changes to the configScripts are detected. + # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. + # If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up. + # Auto-reload uses the http:///reload-configuration-as-code endpoint to reapply config when changes to + # the configScripts are detected. + # -- Enables Jenkins Config as Code auto-reload enabled: true - image: kiwigrid/k8s-sidecar:1.23.1 + image: + # -- Registry for the image that triggers the reload + registry: docker.io + # -- Repository of the image that triggers the reload + repository: kiwigrid/k8s-sidecar + # -- Tag for the image that triggers the reload + tag: 1.29.0 imagePullPolicy: IfNotPresent resources: {} # limits: @@ -372,34 +577,67 @@ controller: # requests: # cpu: 50m # memory: 50Mi - # How many connection-related errors to retry on + # -- Enables additional volume mounts for the config auto-reload container + additionalVolumeMounts: [] + # - name: auto-reload-config + # mountPath: /var/config/logger + # - name: auto-reload-logs + # mountPath: /var/log/auto_reload + # -- Config auto-reload logging settings + logging: + # See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py + configuration: + # -- Enables custom log config utilizing using the settings below. + override: false + logLevel: INFO + formatter: JSON + logToConsole: true + logToFile: false + maxBytes: 1024 + backupCount: 3 + + # -- The scheme to use when connecting to the Jenkins configuration as code endpoint + scheme: http + # -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint + skipTlsVerify: false + + # -- How many connection-related errors to retry on reqRetryConnect: 10 - # env: + # -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) + sleepTime: + + # -- Environment variable sources for the Jenkins Config as Code auto-reload container + envFrom: [] + # -- Environment variables for the Jenkins Config as Code auto-reload container + env: {} # - name: REQ_TIMEOUT # value: "30" - # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. - # Is only used to reload jcasc config from the sidecar container running in the Jenkins controller pod. + + # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. + # This is only used to reload JCasC config from the sidecar container running in the Jenkins controller pod. # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be - # accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), + # accessible via SSH from outside the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), # this must be > 1024: sshTcpPort: 1044 # folder in the pod that should hold the collected dashboards: folder: "/var/jenkins_home/casc_configs" + # If specified, the sidecar will search for JCasC config-maps inside this namespace. - # Otherwise the namespace in which the sidecar is running will be used. + # Otherwise, the namespace in which the sidecar is running will be used. # It's also possible to specify ALL to search in all namespaces: # searchNamespace: + # -- Enable container security context containerSecurityContext: readOnlyRootFilesystem: true allowPrivilegeEscalation: false - # Allows you to inject additional/other sidecars - other: [] + # -- Configures additional sidecar container(s) for the Jenkins controller + additionalSidecarContainers: [] ## The example below runs the client for https://smee.io as sidecar container next to Jenkins, - ## that allows to trigger build behind a secure firewall. + ## that allows triggering build behind a secure firewall. ## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall ## - ## Note: To use it you should go to https://smee.io/new and update the url to the generete one. + ## Note: To use it you should go to https://smee.io/new and update the url to the generated one. # - name: smee # image: docker.io/twalter/smee-client:1.0.2 # args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"] @@ -410,36 +648,50 @@ controller: # requests: # cpu: 10m # memory: 32Mi - # Name of the Kubernetes scheduler to use + + # -- Name of the Kubernetes scheduler to use schedulerName: "" - # Node labels and tolerations for pod assignment + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature + # -- Node labels for pod assignment nodeSelector: {} + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature + # -- Toleration labels for pod assignment + tolerations: [] + # -- Set TerminationGracePeriodSeconds terminationGracePeriodSeconds: - + # -- Set the termination message path terminationMessagePath: + # -- Set the termination message policy terminationMessagePolicy: - tolerations: [] - + # -- Affinity settings affinity: {} + # Leverage a priorityClass to ensure your pods survive resource shortages # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ + # -- The name of a `priorityClass` to apply to the controller pod priorityClassName: + # -- Annotations for controller pod podAnnotations: {} - # Add StatefulSet annotations + # -- Annotations for controller StatefulSet statefulSetAnnotations: {} - # StatefulSet updateStrategy # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + # -- Update strategy for StatefulSet updateStrategy: {} + # -- Topology spread constraints + topologySpreadConstraints: {} + ingress: + # -- Enables ingress enabled: false + # Override for the default paths that map requests to the backend + # -- Override for the default Ingress paths paths: [] # - backend: # serviceName: ssl-redirect @@ -449,29 +701,40 @@ controller: # {{ template "jenkins.fullname" . }} # # Don't use string here, use only integer value! # servicePort: 8080 + # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' # For Kubernetes v1.19+, use 'networking.k8s.io/v1' + # -- Ingress API version apiVersion: "extensions/v1beta1" + # -- Ingress labels labels: {} + # -- Ingress annotations annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress # ingressClassName: nginx + # Set this path to jenkinsUriPrefix above or use annotations to rewrite path - # path: "/jenkins" + # -- Ingress path + path: + # configures the hostname e.g. jenkins.example.com + # -- Ingress hostname hostName: - tls: + # -- Hostname to serve assets from + resourceRootUrl: + # -- Ingress TLS configuration + tls: [] # - secretName: jenkins.cluster.local # hosts: # - jenkins.cluster.local - # often you want to have your controller all locked down and private + # often you want to have your controller all locked down and private, # but you still want to get webhooks from your SCM # A secondary ingress will let you expose different urls - # with a differnt configuration + # with a different configuration secondaryingress: enabled: false # paths you want forwarded to the backend @@ -487,7 +750,7 @@ controller: # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress # ingressClassName: nginx - # configures the hostname e.g. jenkins-external.example.com + # configures the hostname e.g., jenkins-external.example.com hostName: tls: # - secretName: jenkins-external.example.com @@ -498,23 +761,34 @@ controller: # to finish ingress setup, use the following values. # Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig backendconfig: + # -- Enables backendconfig enabled: false + # -- backendconfig API version apiVersion: "extensions/v1beta1" + # -- backendconfig name name: + # -- backendconfig labels labels: {} + # -- backendconfig annotations annotations: {} + # -- backendconfig spec spec: {} # Openshift route route: + # -- Enables openshift route enabled: false + # -- Route labels labels: {} + # -- Route annotations annotations: {} - # path: "/jenkins" + # -- Route path + path: - # controller.hostAliases allows for adding entries to Pod /etc/hosts: - # https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + # -- Allows for adding entries to Pod /etc/hosts hostAliases: [] + # ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + # hostAliases: # - ip: 192.168.50.50 # hostnames: # - something.local @@ -526,21 +800,27 @@ controller: prometheus: # If enabled, add the prometheus plugin to the list of plugins to install # https://plugins.jenkins.io/prometheus + + # -- Enables prometheus service monitor enabled: false - # Additional labels to add to the ServiceMonitor object + # -- Additional labels to add to the service monitor object serviceMonitorAdditionalLabels: {} - # Set a custom namespace where to deploy ServiceMonitor resource - # serviceMonitorNamespace: monitoring + # -- Set a custom namespace where to deploy ServiceMonitor resource + serviceMonitorNamespace: + # -- How often prometheus should scrape metrics scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin + + # Defaults to the default endpoint used by the prometheus plugin + # -- The endpoint prometheus should get metrics from scrapeEndpoint: /prometheus - # Additional labels to add to the PrometheusRule object - alertingRulesAdditionalLabels: {} - # An array of prometheus alerting rules + # See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ - # The `groups` root object is added by default, simply add the rule entries + # The `groups` root object is added by default, add the rule entries + # -- Array of prometheus alerting rules alertingrules: [] - # Set a custom namespace where to deploy PrometheusRule resource + # -- Additional labels to add to the PrometheusRule object + alertingRulesAdditionalLabels: {} + # -- Set a custom namespace where to deploy PrometheusRule resource prometheusRuleNamespace: "" # RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds @@ -560,94 +840,168 @@ controller: # This is the default endpoint used by the prometheus plugin scrapeEndpoint: /prometheus - # Can be used to disable rendering controller test resources when using helm template + # -- Can be used to disable rendering controller test resources when using helm template testEnabled: true httpsKeyStore: - jenkinsHttpsJksSecretName: '' + # -- Enables HTTPS keystore on jenkins controller enable: false + # -- Name of the secret that already has ssl keystore + jenkinsHttpsJksSecretName: "" + # -- Name of the key in the secret that already has ssl keystore + jenkinsHttpsJksSecretKey: "jenkins-jks-file" + # -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file + jenkinsHttpsJksPasswordSecretName: "" + # -- Name of the key in the secret that contains the JKS password + jenkinsHttpsJksPasswordSecretKey: "https-jks-password" disableSecretMount: false + + # When HTTPS keystore is enabled, servicePort and targetPort will be used as HTTPS port + # -- HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port. httpPort: 8081 + # -- Path of HTTPS keystore file path: "/var/jenkins_keystore" + # -- Jenkins keystore filename which will appear under controller.httpsKeyStore.path fileName: "keystore.jks" + # -- Jenkins keystore password password: "password" - # Convert keystore.jks files content to base64 ( cat keystore.jks | base64 ) and put the output here - jenkinsKeyStoreBase64Encoded: | - /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq - AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z - gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe - TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x - QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy - 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR - pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB - Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l - Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG - Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi - HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI - OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO - NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi - Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg - UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te - fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi - Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT - EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ - y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU - iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl - t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ - gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa - jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H - bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn - xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV - BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p - bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx - MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y - b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb - BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC - AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w - Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF - 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP - F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i - d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe - 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl - m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h - /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q - 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog - hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= + + # -- Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here + jenkinsKeyStoreBase64Encoded: + # Convert keystore.jks files content to base64 > $ cat keystore.jks | base64 +# /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq +# AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z +# gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe +# TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x +# QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy +# 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR +# pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB +# Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l +# Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG +# Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi +# HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI +# OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO +# NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi +# Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg +# UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te +# fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi +# Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT +# EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ +# y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU +# iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl +# t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ +# gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa +# jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H +# bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn +# xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV +# BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p +# bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx +# MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y +# b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb +# BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +# AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w +# Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF +# 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP +# F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i +# d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe +# 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl +# m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h +# /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q +# 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog +# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= agent: + # -- Enable Kubernetes plugin jnlp-agent podTemplate enabled: true + # -- The name of the pod template to use for providing default values defaultsProviderTemplate: "" - # URL for connecting to the Jenkins controller + + # Useful for not including a serviceAccount in the template if `false` + # -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount` + useDefaultServiceAccount: true + + # -- Override the default service account + # @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true` + serviceAccount: + + # For connecting to the Jenkins controller + # -- Overrides the Kubernetes Jenkins URL jenkinsUrl: - # connect to the specified host and port, instead of connecting directly to the Jenkins controller + + # connects to the specified host and port, instead of connecting directly to the Jenkins controller + # -- Overrides the Kubernetes Jenkins tunnel jenkinsTunnel: + # -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI + skipTlsVerify: false + # -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI + usageRestricted: false + # -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5 kubernetesConnectTimeout: 5 + # -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15 kubernetesReadTimeout: 15 + # -- The maximum concurrent connections to Kubernetes API maxRequestsPerHostStr: "32" + # -- Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated + retentionTimeout: 5 + # -- Seconds to wait for pod to be running + waitForPodSec: 600 + # -- Namespace in which the Kubernetes agents should be launched namespace: - image: "jenkins/inbound-agent" - tag: "3107.v665000b_51092-5" + # -- Custom Pod labels (an object with `label-key: label-value` pairs) + podLabels: {} + # -- Custom registry used to pull the agent jnlp image from + jnlpregistry: + image: + # -- Repository to pull the agent jnlp image from + repository: "jenkins/inbound-agent" + # -- Tag of the image to pull + tag: "3283.v92c105e0f819-7" + # -- Configure working directory for default agent workingDir: "/home/jenkins/agent" nodeUsageMode: "NORMAL" + # -- Append Jenkins labels to the agent customJenkinsLabels: [] - # name of the secret to be used for image pulling + # -- Name of the secret to be used to pull the image imagePullSecretName: componentName: "jenkins-agent" + # -- Enables agent communication via websockets websocket: false directConnection: false + # -- Agent privileged container privileged: false + # -- Configure container user runAsUser: + # -- Configure container group runAsGroup: + # -- Enables the agent to use the host network hostNetworking: false + # -- Resources allocation (Requests and Limits) resources: requests: cpu: "512m" memory: "512Mi" + # ephemeralStorage: limits: cpu: "512m" memory: "512Mi" + # ephemeralStorage: + livenessProbe: {} +# execArgs: "cat /tmp/healthy" +# failureThreshold: 3 +# initialDelaySeconds: 0 +# periodSeconds: 10 +# successThreshold: 1 +# timeoutSeconds: 1 + # You may want to change this to true while testing a new image + # -- Always pull agent container image before build alwaysPullImage: false + # When using Pod Security Admission in the Agents namespace with the restricted Pod Security Standard, + # the jnlp container cannot be scheduled without overriding its container definition with a securityContext. + # This option allows to automatically inject in the jnlp container a securityContext + # that is suitable for the use of the restricted Pod Security Standard. + # -- Set a restricted securityContext on jnlp containers + restrictedPssSecurityContext: false # Controls how agent pods are retained after the Jenkins build completes # Possible values: Always, Never, OnFailure podRetention: "Never" @@ -655,10 +1009,12 @@ agent: # in the job Console Output. This can be helpful for either security reasons # or simply to clean up the output to make it easier to read. showRawYaml: true + # You can define the volumes that you want to mount for this container - # Allowed types are: ConfigMap, EmptyDir, HostPath, Nfs, PVC, Secret + # Allowed types are: ConfigMap, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC, Secret # Configure the attributes as they appear in the corresponding Java class for that type # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes + # -- Additional volumes volumes: [] # - type: ConfigMap # configMapName: myconfigmap @@ -666,6 +1022,11 @@ agent: # - type: EmptyDir # mountPath: /var/myapp/myemptydir # memory: false + # - type: EphemeralVolume + # mountPath: /var/myapp/myephemeralvolume + # accessModes: ReadWriteOnce + # requestsSize: 10Gi + # storageClassName: mystorageclass # - type: HostPath # hostPath: /var/lib/containers # mountPath: /var/myapp/myhostpath @@ -685,60 +1046,88 @@ agent: # Pod-wide environment, these vars are visible to any container in the agent pod # You can define the workspaceVolume that you want to mount for this container - # Allowed types are: DynamicPVC, EmptyDir, HostPath, Nfs, PVC + # Allowed types are: DynamicPVC, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC # Configure the attributes as they appear in the corresponding Java class for that type # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace + # -- Workspace volume (defaults to EmptyDir) workspaceVolume: {} ## DynamicPVC example - # type: DynamicPVC - # configMapName: myconfigmap + # - type: DynamicPVC + # configMapName: myconfigmap ## EmptyDir example - # type: EmptyDir - # memory: false + # - type: EmptyDir + # memory: false + ## EphemeralVolume example + # - type: EphemeralVolume + # accessModes: ReadWriteOnce + # requestsSize: 10Gi + # storageClassName: mystorageclass ## HostPath example - # type: HostPath - # hostPath: /var/lib/containers + # - type: HostPath + # hostPath: /var/lib/containers ## NFS example - # type: Nfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers + # - type: Nfs + # readOnly: false + # serverAddress: "192.0.2.0" + # serverPath: /var/lib/containers ## PVC example - # type: PVC - # claimName: mypvc - # readOnly: false - # + # - type: PVC + # claimName: mypvc + # readOnly: false + # Pod-wide environment, these vars are visible to any container in the agent pod + # -- Environment variables for the agent Pod envVars: [] # - name: PATH # value: /usr/local/bin - # Mount a secret as environment variable + # -- Mount a secret as environment variable secretEnvVars: [] # - key: PATH # optional: false # default: false # secretKey: MY-K8S-PATH # secretName: my-k8s-secret + + # -- Node labels for pod assignment nodeSelector: {} # Key Value selectors. Ex: - # jenkins-agent: v1 + # nodeSelector + # jenkins-agent: v1 - # Executed command when side container gets started + # -- Command to execute when side container starts command: + # -- Arguments passed to command to execute args: "${computer.jnlpmac} ${computer.name}" - # Side container name + # -- Side container name sideContainerName: "jnlp" + # Doesn't allocate pseudo TTY by default + # -- Allocate pseudo tty to the side container TTYEnabled: false - # Max number of spawned agent + # -- Max number of agents to launch containerCap: 10 - # Pod name + # -- Agent Pod base name podName: "default" - # Allows the Pod to remain active for reuse until the configured number of - # minutes has passed since the last step was executed on it. + + # Enables garbage collection of orphan pods for this Kubernetes cloud. (beta) + garbageCollection: + # -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them. + enabled: false + # -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line. + namespaces: "" + # namespaces: |- + # namespaceOne + # namespaceTwo + # -- Timeout value for orphaned pods + timeout: 300 + + # -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it idleMinutes: 0 - # Raw yaml template for the Pod. For example this allows usage of toleration for agent pods. + + + # The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods. # https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + # -- The raw yaml of a Pod API Object to merge into the agent spec yamlTemplate: "" # yamlTemplate: |- # apiVersion: v1 @@ -748,19 +1137,23 @@ agent: # - key: "key" # operator: "Equal" # value: "value" - # Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates: merge or override + + # -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override" yamlMergeStrategy: "override" - # Timeout in seconds for an agent to be online + # -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one + inheritYamlMergeStrategy: false + # -- Timeout in seconds for an agent to be online connectTimeout: 100 - # Annotations to apply to the pod. + # -- Annotations to apply to the pod annotations: {} - # Add additional containers to the agents. # Containers specified here are added to all agents. Set key empty to remove container from additional agents. + # -- Add additional containers to the agents additionalContainers: [] # - sideContainerName: dind - # image: docker - # tag: dind + # image: + # repository: docker + # tag: dind # command: dockerd-entrypoint.sh # args: "" # privileged: true @@ -772,17 +1165,18 @@ agent: # cpu: 1 # memory: 2Gi - # Disable the default Jenkins Agent configuration. # Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template. + # -- Disable the default Jenkins Agent configuration disableDefaultAgent: false # Below is the implementation of custom pod templates for the default configured kubernetes cloud. # Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label + # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label # characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. - # For this pod templates configuration to be loaded the following values must be set: + # For this pod templates configuration to be loaded, the following values must be set: # controller.JCasC.defaultConfig: true # Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template. + # -- Configures extra pod templates for the default kubernetes cloud podTemplates: {} # python: | # - name: python @@ -800,163 +1194,162 @@ agent: # resourceLimitCpu: "1" # resourceLimitMemory: "1024Mi" -# Here you can add additional agents -# They inherit all values from `agent` so you only need to specify values which differ +# Inherits all values from `agent` so you only need to specify values which differ +# -- Configure additional additionalAgents: {} # maven: # podName: maven # customJenkinsLabels: maven # # An example of overriding the jnlp container # # sideContainerName: jnlp -# image: jenkins/jnlp-agent-maven -# tag: latest +# image: +# repository: jenkins/jnlp-agent-maven +# tag: latest # python: # podName: python # customJenkinsLabels: python # sideContainerName: python -# image: python -# tag: "3" +# image: +# repository: python +# tag: "3" # command: "/bin/sh -c" # args: "cat" # TTYEnabled: true +# Here you can add additional clouds +# They inherit all values from the default cloud (including the main agent), so +# you only need to specify values which differ. If you want to override +# default additionalAgents with the additionalClouds.additionalAgents set +# additionalAgentsOverride to `true`. +additionalClouds: {} +# remote-cloud-1: +# kubernetesURL: https://api.remote-cloud.com +# additionalAgentsOverride: true +# additionalAgents: +# maven-2: +# podName: maven-2 +# customJenkinsLabels: maven +# # An example of overriding the jnlp container +# # sideContainerName: jnlp +# image: +# repository: jenkins/jnlp-agent-maven +# tag: latest +# namespace: my-other-maven-namespace +# remote-cloud-2: +# kubernetesURL: https://api.remote-cloud.com + persistence: + # -- Enable the use of a Jenkins PVC enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound + + # A manually managed Persistent Volume and Claim + # Requires persistence.enabled: true + # If defined, PVC must be created manually before volume will be bound + # -- Provide the name of a PVC existingClaim: - ## jenkins data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## + + # jenkins data Persistent Volume Storage Class + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack) + # -- Storage class for the PVC storageClass: + # -- Annotations for the PVC annotations: {} + # -- Labels for the PVC labels: {} + # -- The PVC access mode accessMode: "ReadWriteOnce" + # -- The size of the PVC size: "8Gi" - volumes: + + # ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/ + # -- Existing data source to clone PVC from + dataSource: {} + # name: PVC-NAME + # kind: PersistentVolumeClaim + + # -- SubPath for jenkins-home mount + subPath: + # -- Additional volumes + volumes: [] # - name: nothing # emptyDir: {} - mounts: + + # -- Additional mounts + mounts: [] # - mountPath: /var/nothing # name: nothing # readOnly: true networkPolicy: - # Enable creation of NetworkPolicy resources. + # -- Enable the creation of NetworkPolicy resources enabled: false + # For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' # For Kubernetes v1.7, use 'networking.k8s.io/v1' + # -- NetworkPolicy ApiVersion apiVersion: networking.k8s.io/v1 # You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range internalAgents: + # -- Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels allowed: true + # -- A map of labels (keys/values) that agent pods must have to be able to connect to controller podLabels: {} + # -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller namespaceLabels: {} # project: myproject - externalAgents: {} - # ipCIDR: 172.17.0.0/16 - # except: - # - 172.17.1.0/24 + externalAgents: + # -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16 + ipCIDR: + # -- A list of IP sub-ranges to be excluded from the allowlisted IP range + except: [] + # - 172.17.1.0/24 ## Install Default RBAC roles and bindings rbac: + # -- Whether RBAC resources are created create: true + # -- Whether the Jenkins service account should be able to read Kubernetes secrets readSecrets: false + # -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints + useOpenShiftNonRootSCC: false serviceAccount: + # -- Configures if a ServiceAccount with this name should be created create: true - # The name of the service account is autogenerated by default + + # The name of the ServiceAccount is autogenerated by default + # -- The name of the ServiceAccount to be used by access-controlled resources name: + # -- Configures annotations for the ServiceAccount annotations: {} + # -- Configures extra labels for the ServiceAccount extraLabels: {} + # -- Controller ServiceAccount image pull secret imagePullSecretName: + # -- Auto-mount ServiceAccount token + automountServiceAccountToken: true serviceAccountAgent: - # Specifies whether a ServiceAccount should be created + # -- Configures if an agent ServiceAccount should be created create: false - # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + # -- The name of the agent ServiceAccount to be used by access-controlled resources name: + # -- Configures annotations for the agent ServiceAccount annotations: {} + # -- Configures extra labels for the agent ServiceAccount extraLabels: {} + # -- Agent ServiceAccount image pull secret imagePullSecretName: + # -- Auto-mount ServiceAccount token + automountServiceAccountToken: true -## Backup cronjob configuration -## Ref: https://github.com/maorfr/kube-tasks -backup: - # Backup must use RBAC - # So by enabling backup you are enabling RBAC specific for backup - enabled: false - # Used for label app.kubernetes.io/component - componentName: "backup" - # Schedule to run jobs. Must be in cron time format - # Ref: https://crontab.guru/ - schedule: "0 2 * * *" - labels: {} - serviceAccount: - create: true - name: - annotations: {} - # Example for authorization to AWS S3 using kube2iam or IRSA - # Can also be done using environment variables - # iam.amazonaws.com/role: "jenkins" - # "eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/jenkins-backup" - # Set this to terminate the job that is running/failing continously and set the job status to "Failed" - activeDeadlineSeconds: "" - image: - repository: "maorfr/kube-tasks" - tag: "0.2.0" - imagePullSecretName: - # Additional arguments for kube-tasks - # Ref: https://github.com/maorfr/kube-tasks#simple-backup - extraArgs: [] - # Add existingSecret for AWS credentials - existingSecret: {} - ## Example for using an existing secret - # jenkinsaws: - ## Use this key for AWS access key ID - # awsaccesskey: jenkins_aws_access_key - ## Use this key for AWS secret access key - # awssecretkey: jenkins_aws_secret_key - # Add additional environment variables - # jenkinsgcp: - ## Use this key for GCP credentials - # gcpcredentials: credentials.json - env: [] - # Example environment variable required for AWS credentials chain - # - name: "AWS_REGION" - # value: "us-east-1" - resources: - requests: - memory: 1Gi - cpu: 1 - limits: - memory: 1Gi - cpu: 1 - # Destination to store the backup artifacts - # Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage, Google Cloud Storage - # Additional support can added. Visit this repository for details - # Ref: https://github.com/maorfr/skbn - destination: "s3://jenkins-data/backup" - # By enabling only the jenkins_home/jobs folder gets backed up, not the whole jenkins instance - onlyJobs: false - # Enable backup pod security context (must be `true` if runAsUser or fsGroup are set) - usePodSecurityContext: true - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 1000 - fsGroup: 1000 - securityContextCapabilities: {} - # drop: - # - NET_RAW -cronJob: - apiVersion: batch/v1 - +# -- Checks if any deprecated values are used checkDeprecation: true awsSecurityGroupPolicies: @@ -971,5 +1364,10 @@ helmtest: # A testing framework for bash bats: # Bash Automated Testing System (BATS) - image: "bats/bats" - tag: "1.9.0" + image: + # -- Registry of the image used to test the framework + registry: "docker.io" + # -- Repository of the image used to test the framework + repository: "bats/bats" + # -- Tag of the image to test the framework + tag: "1.11.1" diff --git a/ct.yaml b/ct.yaml index 0bcc28361..eb4f211dc 100644 --- a/ct.yaml +++ b/ct.yaml @@ -5,4 +5,4 @@ chart-dirs: - charts helm-extra-args: --timeout 600s additional-commands: - - helm unittest --helm3 --strict -f 'unittests/*.yaml' {{ .Path }} + - helm unittest --strict -f 'unittests/*.yaml' {{ .Path }}