From 0be12f5fc74e924eff04a3ab8780179a7acdfe6d Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Mon, 31 Aug 2026 09:41:39 +0530 Subject: [PATCH] added jenkins --- .../jenkins-admin/custom-values.yaml | 1009 ----- .../jenkins/custom-values.yaml | 1266 +----- helm-templates/jenkins-grn/.helmignore | 26 - helm-templates/jenkins-grn/CHANGELOG.md | 3472 ---------------- helm-templates/jenkins-grn/Chart.yaml | 47 - helm-templates/jenkins-grn/README.md | 723 ---- helm-templates/jenkins-grn/Tiltfile | 5 - helm-templates/jenkins-grn/UPGRADING.md | 151 - helm-templates/jenkins-grn/VALUES.md | 324 -- helm-templates/jenkins-grn/VALUES.md.gotmpl | 28 - .../jenkins-grn/ci/default-values.yaml | 5 - .../jenkins-grn/ci/other-values.yaml | 100 - .../jenkins-grn/ci/with-secrets-values.yaml | 4 - .../jenkins-grn/templates/NOTES.txt | 68 - .../jenkins-grn/templates/_helpers.tpl | 697 ---- .../templates/auto-reload-config.yaml | 60 - .../templates/config-init-scripts.yaml | 18 - .../jenkins-grn/templates/config.yaml | 92 - .../jenkins-grn/templates/deprecation.yaml | 151 - .../jenkins-grn/templates/home-pvc.yaml | 41 - .../jenkins-grn/templates/jcasc-config.yaml | 53 - .../templates/jenkins-agent-svc.yaml | 43 - .../jenkins-aws-security-group-policies.yaml | 16 - .../jenkins-controller-alerting-rules.yaml | 26 - .../jenkins-controller-backendconfig.yaml | 24 - .../templates/jenkins-controller-ingress.yaml | 77 - .../jenkins-controller-networkpolicy.yaml | 76 - .../templates/jenkins-controller-pdb.yaml | 34 - .../jenkins-controller-podmonitor.yaml | 30 - .../templates/jenkins-controller-route.yaml | 34 - .../jenkins-controller-secondary-ingress.yaml | 56 - .../jenkins-controller-servicemonitor.yaml | 45 - .../jenkins-controller-statefulset.yaml | 434 -- .../templates/jenkins-controller-svc.yaml | 64 - .../jenkins-grn/templates/rbac.yaml | 198 - .../templates/secret-additional.yaml | 21 - .../jenkins-grn/templates/secret-claims.yaml | 29 - .../templates/secret-https-jks.yaml | 20 - .../jenkins-grn/templates/secret.yaml | 20 - .../templates/service-account-agent.yaml | 27 - .../templates/service-account.yaml | 27 - .../templates/tests/jenkins-test.yaml | 49 - .../templates/tests/test-config.yaml | 14 - .../__snapshot__/config-test.yaml.snap | 15 - .../garbage-collect-test.yaml.snap | 316 -- .../__snapshot__/instance-cap-test.yaml.snap | 170 - .../__snapshot__/jcasc-config-test.yaml.snap | 3508 ----------------- ...kins-controller-statefulset-test.yaml.snap | 443 --- .../unittests/config-init-scripts-test.yaml | 19 - .../jenkins-grn/unittests/config-test.yaml | 117 - .../unittests/garbage-collect-test.yaml | 67 - .../jenkins-grn/unittests/home-pvc-test.yaml | 110 - .../unittests/instance-cap-test.yaml | 42 - .../unittests/jcasc-config-test.yaml | 843 ---- .../unittests/jenkins-agent-svc-test.yaml | 130 - ...enkins-controller-alerting-rules-test.yaml | 79 - .../jenkins-controller-ingress-1.19-test.yaml | 148 - .../jenkins-controller-ingress-DRY-test.yaml | 26 - .../jenkins-controller-ingress-test.yaml | 145 - ...jenkins-controller-networkpolicy-test.yaml | 94 - .../jenkins-controller-pdb-1.21-test.yaml | 44 - .../jenkins-controller-pdb-test.yaml | 57 - ...ontroller-secondary-ingress-1.19-test.yaml | 78 - ...ins-controller-secondary-ingress-test.yaml | 76 - ...enkins-controller-servicemonitor_test.yaml | 114 - .../jenkins-controller-statefulset-test.yaml | 828 ---- .../jenkins-controller-svc-test.yaml | 166 - .../jenkins-grn/unittests/rbac-test.yaml | 276 -- .../unittests/secret-additional-test.yaml | 41 - .../unittests/secret-claims-test.yaml | 82 - .../unittests/secret-existing-test.yaml | 52 - .../jenkins-grn/unittests/secret-test.yaml | 63 - .../unittests/service-account-agent-test.yaml | 103 - .../unittests/service-account-test.yaml | 77 - helm-templates/jenkins-grn/values.yaml | 1382 ------- helm-templates/jenkins/CHANGELOG.md | 2708 ------------- helm-templates/jenkins/Chart.lock | 6 + helm-templates/jenkins/Chart.yaml | 53 +- helm-templates/jenkins/README.md | 1127 ------ helm-templates/jenkins/Tiltfile | 5 - helm-templates/jenkins/VALUES_SUMMARY.md | 421 -- .../jenkins/charts/jenkins-5.8.58.tgz | Bin 0 -> 80241 bytes helm-templates/jenkins/ci/default-values.yaml | 5 - helm-templates/jenkins/ci/other-values.yaml | 95 - .../jenkins/ci/with-secrets-values.yaml | 4 - helm-templates/jenkins/templates/NOTES.txt | 68 - helm-templates/jenkins/templates/_helpers.tpl | 554 --- .../templates/config-init-scripts.yaml | 18 - helm-templates/jenkins/templates/config.yaml | 86 - .../jenkins/templates/deprecation.yaml | 115 - .../jenkins/templates/home-pvc.yaml | 44 - .../jenkins/templates/jcasc-config.yaml | 45 - .../jenkins/templates/jenkins-agent-svc.yaml | 43 - .../jenkins-aws-security-group-policies.yaml | 16 - .../templates/jenkins-backup-cronjob.yaml | 168 - .../templates/jenkins-backup-rbac.yaml | 64 - .../jenkins-controller-alerting-rules.yaml | 26 - .../jenkins-controller-backendconfig.yaml | 24 - .../templates/jenkins-controller-ingress.yaml | 77 - .../jenkins-controller-networkpolicy.yaml | 76 - .../templates/jenkins-controller-pdb.yaml | 34 - .../jenkins-controller-podmonitor.yaml | 30 - .../templates/jenkins-controller-route.yaml | 34 - .../jenkins-controller-secondary-ingress.yaml | 56 - .../jenkins-controller-servicemonitor.yaml | 45 - .../jenkins-controller-statefulset.yaml | 419 -- .../templates/jenkins-controller-svc.yaml | 59 - helm-templates/jenkins/templates/rbac.yaml | 149 - .../jenkins/templates/secret-additional.yaml | 21 - .../jenkins/templates/secret-claims.yaml | 29 - .../jenkins/templates/secret-https-jks.yaml | 20 - helm-templates/jenkins/templates/secret.yaml | 20 - .../templates/service-account-agent.yaml | 26 - .../jenkins/templates/service-account.yaml | 26 - .../jenkins/templates/tests/jenkins-test.yaml | 49 - .../jenkins/templates/tests/test-config.yaml | 14 - ...kins-controller-statefulset-test.yaml.snap | 5 - .../unittests/config-init-scripts-test.yaml | 19 - .../jenkins/unittests/config-test.yaml | 128 - .../jenkins/unittests/home-pvc-test.yaml | 111 - .../jenkins/unittests/jcasc-config-test.yaml | 3039 -------------- .../unittests/jenkins-agent-svc-test.yaml | 130 - .../jenkins-backup-cronjob-test.yaml | 62 - ...enkins-controller-alerting-rules-test.yaml | 79 - .../jenkins-controller-ingress-1.19-test.yaml | 148 - .../jenkins-controller-ingress-DRY-test.yaml | 26 - .../jenkins-controller-ingress-test.yaml | 145 - ...jenkins-controller-networkpolicy-test.yaml | 94 - .../jenkins-controller-pdb-1.21-test.yaml | 44 - .../jenkins-controller-pdb-test.yaml | 57 - ...ontroller-secondary-ingress-1.19-test.yaml | 78 - ...ins-controller-secondary-ingress-test.yaml | 76 - ...enkins-controller-servicemonitor_test.yaml | 114 - .../jenkins-controller-statefulset-test.yaml | 933 ----- .../jenkins-controller-svc-test.yaml | 158 - .../jenkins/unittests/rbac-test.yaml | 217 - .../unittests/secret-additional-test.yaml | 41 - .../jenkins/unittests/secret-claims-test.yaml | 82 - .../unittests/secret-existing-test.yaml | 52 - .../jenkins/unittests/secret-test.yaml | 65 - .../unittests/service-account-agent-test.yaml | 103 - .../unittests/service-account-test.yaml | 77 - helm-templates/jenkins/values.yaml | 999 ----- 143 files changed, 51 insertions(+), 33325 deletions(-) delete mode 100644 helm-overrides/k8s-admin-prd-ase1/jenkins-admin/custom-values.yaml delete mode 100644 helm-templates/jenkins-grn/.helmignore delete mode 100644 helm-templates/jenkins-grn/CHANGELOG.md delete mode 100644 helm-templates/jenkins-grn/Chart.yaml delete mode 100644 helm-templates/jenkins-grn/README.md delete mode 100644 helm-templates/jenkins-grn/Tiltfile delete mode 100644 helm-templates/jenkins-grn/UPGRADING.md delete mode 100644 helm-templates/jenkins-grn/VALUES.md delete mode 100644 helm-templates/jenkins-grn/VALUES.md.gotmpl delete mode 100644 helm-templates/jenkins-grn/ci/default-values.yaml delete mode 100644 helm-templates/jenkins-grn/ci/other-values.yaml delete mode 100644 helm-templates/jenkins-grn/ci/with-secrets-values.yaml delete mode 100644 helm-templates/jenkins-grn/templates/NOTES.txt delete mode 100644 helm-templates/jenkins-grn/templates/_helpers.tpl delete mode 100644 helm-templates/jenkins-grn/templates/auto-reload-config.yaml delete mode 100644 helm-templates/jenkins-grn/templates/config-init-scripts.yaml delete mode 100644 helm-templates/jenkins-grn/templates/config.yaml delete mode 100644 helm-templates/jenkins-grn/templates/deprecation.yaml delete mode 100644 helm-templates/jenkins-grn/templates/home-pvc.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jcasc-config.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-agent-svc.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-aws-security-group-policies.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-alerting-rules.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-backendconfig.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-ingress.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-networkpolicy.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-pdb.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-podmonitor.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-route.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-secondary-ingress.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-servicemonitor.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-statefulset.yaml delete mode 100644 helm-templates/jenkins-grn/templates/jenkins-controller-svc.yaml delete mode 100644 helm-templates/jenkins-grn/templates/rbac.yaml delete mode 100644 helm-templates/jenkins-grn/templates/secret-additional.yaml delete mode 100644 helm-templates/jenkins-grn/templates/secret-claims.yaml delete mode 100644 helm-templates/jenkins-grn/templates/secret-https-jks.yaml delete mode 100644 helm-templates/jenkins-grn/templates/secret.yaml delete mode 100644 helm-templates/jenkins-grn/templates/service-account-agent.yaml delete mode 100644 helm-templates/jenkins-grn/templates/service-account.yaml delete mode 100644 helm-templates/jenkins-grn/templates/tests/jenkins-test.yaml delete mode 100644 helm-templates/jenkins-grn/templates/tests/test-config.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/__snapshot__/config-test.yaml.snap delete mode 100644 helm-templates/jenkins-grn/unittests/__snapshot__/garbage-collect-test.yaml.snap delete mode 100644 helm-templates/jenkins-grn/unittests/__snapshot__/instance-cap-test.yaml.snap delete mode 100644 helm-templates/jenkins-grn/unittests/__snapshot__/jcasc-config-test.yaml.snap delete mode 100644 helm-templates/jenkins-grn/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap delete mode 100644 helm-templates/jenkins-grn/unittests/config-init-scripts-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/config-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/garbage-collect-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/home-pvc-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/instance-cap-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jcasc-config-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-agent-svc-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-alerting-rules-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-1.19-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-DRY-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-networkpolicy-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-1.21-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-servicemonitor_test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-statefulset-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/jenkins-controller-svc-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/rbac-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/secret-additional-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/secret-claims-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/secret-existing-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/secret-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/service-account-agent-test.yaml delete mode 100644 helm-templates/jenkins-grn/unittests/service-account-test.yaml delete mode 100644 helm-templates/jenkins-grn/values.yaml delete mode 100644 helm-templates/jenkins/CHANGELOG.md create mode 100644 helm-templates/jenkins/Chart.lock delete mode 100644 helm-templates/jenkins/README.md delete mode 100644 helm-templates/jenkins/Tiltfile delete mode 100644 helm-templates/jenkins/VALUES_SUMMARY.md create mode 100644 helm-templates/jenkins/charts/jenkins-5.8.58.tgz delete mode 100644 helm-templates/jenkins/ci/default-values.yaml delete mode 100644 helm-templates/jenkins/ci/other-values.yaml delete mode 100644 helm-templates/jenkins/ci/with-secrets-values.yaml delete mode 100644 helm-templates/jenkins/templates/NOTES.txt delete mode 100644 helm-templates/jenkins/templates/_helpers.tpl delete mode 100644 helm-templates/jenkins/templates/config-init-scripts.yaml delete mode 100644 helm-templates/jenkins/templates/config.yaml delete mode 100644 helm-templates/jenkins/templates/deprecation.yaml delete mode 100644 helm-templates/jenkins/templates/home-pvc.yaml delete mode 100644 helm-templates/jenkins/templates/jcasc-config.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-agent-svc.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-aws-security-group-policies.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-backup-cronjob.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-backup-rbac.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-alerting-rules.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-backendconfig.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-ingress.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-networkpolicy.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-pdb.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-podmonitor.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-route.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-secondary-ingress.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-servicemonitor.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-statefulset.yaml delete mode 100644 helm-templates/jenkins/templates/jenkins-controller-svc.yaml delete mode 100644 helm-templates/jenkins/templates/rbac.yaml delete mode 100644 helm-templates/jenkins/templates/secret-additional.yaml delete mode 100644 helm-templates/jenkins/templates/secret-claims.yaml delete mode 100644 helm-templates/jenkins/templates/secret-https-jks.yaml delete mode 100644 helm-templates/jenkins/templates/secret.yaml delete mode 100644 helm-templates/jenkins/templates/service-account-agent.yaml delete mode 100644 helm-templates/jenkins/templates/service-account.yaml delete mode 100644 helm-templates/jenkins/templates/tests/jenkins-test.yaml delete mode 100644 helm-templates/jenkins/templates/tests/test-config.yaml delete mode 100644 helm-templates/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap delete mode 100644 helm-templates/jenkins/unittests/config-init-scripts-test.yaml delete mode 100644 helm-templates/jenkins/unittests/config-test.yaml delete mode 100644 helm-templates/jenkins/unittests/home-pvc-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jcasc-config-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-agent-svc-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-backup-cronjob-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-ingress-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-pdb-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-statefulset-test.yaml delete mode 100644 helm-templates/jenkins/unittests/jenkins-controller-svc-test.yaml delete mode 100644 helm-templates/jenkins/unittests/rbac-test.yaml delete mode 100644 helm-templates/jenkins/unittests/secret-additional-test.yaml delete mode 100644 helm-templates/jenkins/unittests/secret-claims-test.yaml delete mode 100644 helm-templates/jenkins/unittests/secret-existing-test.yaml delete mode 100644 helm-templates/jenkins/unittests/secret-test.yaml delete mode 100644 helm-templates/jenkins/unittests/service-account-agent-test.yaml delete mode 100644 helm-templates/jenkins/unittests/service-account-test.yaml delete mode 100644 helm-templates/jenkins/values.yaml diff --git a/helm-overrides/k8s-admin-prd-ase1/jenkins-admin/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/jenkins-admin/custom-values.yaml deleted file mode 100644 index 63ec1f1..0000000 --- a/helm-overrides/k8s-admin-prd-ase1/jenkins-admin/custom-values.yaml +++ /dev/null @@ -1,1009 +0,0 @@ -# Default values for jenkins. -# This is a YAML-formatted file. -# Declare name/value pairs to be passed into your templates. -# name: value - -## Overrides for generated resource names -# See templates/_helpers.tpl -# nameOverride: -fullnameOverride: jenkins-admin -# namespaceOverride: - -# For FQDN resolving of the controller service. Change this value to match your existing configuration. -# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md -clusterZone: "cluster.local" - -# The URL of the Kubernetes API server -kubernetesURL: "https://kubernetes.default" - -renderHelmLabels: true - -controller: - # Used for label app.kubernetes.io/component - componentName: "jenkins-controller" - image: "jenkins/jenkins" - # tag: "2.426.1-jdk11" - tagLabel: jdk11 - imagePullPolicy: "Always" - imagePullSecretName: - # Optionally configure lifetime for controller-container - lifecycle: - # postStart: - # exec: - # command: - # - "uname" - # - "-a" - disableRememberMe: false - replicas: 1 - numExecutors: 0 - # configures the executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE - executorMode: "NORMAL" - # This is ignored if enableRawHtmlMarkupFormatter is true - markupFormatter: plainText - customJenkinsLabels: [] - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm then you can disable it - adminSecret: true - - hostNetworking: false - # When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist. - # If you disable the non-Jenkins identity store and instead use the Jenkins internal one, - # you should revert controller.adminUser to your preferred admin user: - adminUser: "admin" - # adminPassword: - admin: - existingSecret: "" - userKey: jenkins-admin-user - passwordKey: jenkins-admin-password - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" - jenkinsHome: "/var/jenkins_home" - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" - jenkinsRef: "/usr/share/jenkins/ref" - # Path to the jenkins war file which is used by jenkins-plugin-cli. - jenkinsWar: "/usr/share/jenkins/jenkins.war" - # Overrides the default arguments passed to the war - # overrideArgs: - # - --httpPort=8080 - resources: - requests: - cpu: "200m" - memory: "500Mi" - limits: - cpu: "2000m" - memory: "4096Mi" - # Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod - shareProcessNamespace: false - # Overrides the init container default values - # initContainerResources: - # requests: - # cpu: "50m" - # memory: "256Mi" - # limits: - # cpu: "2000m" - # memory: "4096Mi" - # Environment variables that get added to the init container (useful for e.g. http_proxy) - # initContainerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - # containerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - # Set min/max heap here if needed with: - # javaOpts: "-Xms512m -Xmx512m" - # jenkinsOpts: "" - # If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. - # The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - # jenkinsUrlProtocol: "https" - # If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the url definition. - # jenkinsUrl: "" - # If you set this prefix and use ingress controller then you might want to set the ingress path below - # jenkinsUriPrefix: "/jenkins" - # Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) - usePodSecurityContext: true - # Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are - # being deprecated and replaced by `podSecurityContextOverride`. - # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 1000 - fsGroup: 1000 - # If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here - securityContextCapabilities: {} - # drop: - # - NET_RAW - # Completely overwrites the contents of the `securityContext`, ignoring the - # values provided for the deprecated fields: `runAsUser`, `fsGroup`, and - # `securityContextCapabilities`. In the case of mounting an ext4 filesystem, - # it might be desirable to use `supplementalGroups` instead of `fsGroup` in - # the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496 - # podSecurityContextOverride: - # runAsUser: 1000 - # runAsNonRoot: true - # supplementalGroups: [1000] - # # capabilities: {} - # Container securityContext - containerSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - servicePort: 8080 - targetPort: 8080 - # For minikube, set this to NodePort, elsewhere use LoadBalancer - # Use ClusterIP if your setup includes ingress controller - serviceType: ClusterIP - # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, - # but risks potentially imbalanced traffic spreading. - serviceExternalTrafficPolicy: - # Jenkins controller service annotations - serviceAnnotations: {} - # Jenkins controller custom labels - statefulSetLabels: {} - # foo: bar - # bar: foo - # Jenkins controller service labels - serviceLabels: {} - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https - # Put labels on Jenkins controller pod - podLabels: {} - # Used to create Ingress record (should be used with ServiceType: ClusterIP) - # nodePort: - # -Dcom.sun.management.jmxremote.port=4000 - # -Dcom.sun.management.jmxremote.authenticate=false - # -Dcom.sun.management.jmxremote.ssl=false - # jmxPort: 4000 - # Optionally configure other ports to expose in the controller container - extraPorts: [] - # - name: BuildInfoProxy - # port: 9000 - # targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port) - - # List of plugins to be install during Jenkins controller start - installPlugins: - - kubernetes:4029.v5712230ccb_f8 - - workflow-aggregator:596.v8c21c963d92d - - git:5.1.0 - - configuration-as-code:1670.v564dc8b_982d0 - - # Set to false to download the minimum required version of all dependencies. - installLatestPlugins: true - - # Set to true to download latest dependencies of any plugin that is requested to have the latest version. - installLatestSpecifiedPlugins: false - - # List of plugins to install in addition to those listed in controller.installPlugins - additionalPlugins: [] - - # Enable to initialize the Jenkins controller only once on initial installation. - # Without this, whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates which has the potential to cause breakage. - # Note that for this to work, `persistence.enabled` needs to be set to `true` - initializeOnce: false - - # Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment. - # overwritePlugins: true - - # Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment. - overwritePluginsFromImage: true - - # Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config. - projectNamingStrategy: standard - - # Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter), useful with ghprb plugin. - # The plugin is not installed by default, please update controller.installPlugins. - enableRawHtmlMarkupFormatter: false - # Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval - scriptApproval: [] - # - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - # - "new groovy.json.JsonSlurperClassic" - # List of groovy init scripts to be executed during Jenkins controller start - initScripts: [] - # - | - # print 'adding global pipeline libraries, register properties, bootstrap jobs...' - - # 'name' is a name of an existing secret in same namespace as jenkins, - # 'keyName' is the name of one of the keys inside current secret. - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: - - additionalExistingSecrets: [] - # - name: secret-name-1 - # keyName: username - # - name: secret-name-1 - # keyName: password - - additionalSecrets: [] - # - name: nameOfSecret - # value: secretText - - # Generate SecretClaim resources in order to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. - # 'name' is name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. - # 'path' is the fully qualified path to the secret in Vault - # 'type' is an optional Kubernetes secret type. Defaults to 'Opaque' - # 'renew' is an optional secret renewal time in seconds - secretClaims: [] - # - name: secretName # required - # path: testPath # required - # type: kubernetes.io/tls # optional - # renew: 60 # optional - - # Name of default cloud configuration. - cloudName: "kubernetes" - - # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, - # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in - # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | - # become the content of the configuration yaml file. The first line after this is a JCasC root element, eg jenkins, credentials, - # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: - JCasC: - defaultConfig: true - configUrls: [] - # - https://acme.org/jenkins.yaml - # Remote URL:s for configuration files. - configScripts: {} - # welcome-message: | - # jenkins: - # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - # Allows adding to the top-level security JCasC section. For legacy, default the chart includes apiToken configurations - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - # Ignored if securityRealm is defined in controller.JCasC.configScripts - securityRealm: |- - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - # Ignored if authorizationStrategy is defined in controller.JCasC.configScripts - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false - # Optionally specify additional init-containers - customInitContainers: [] - # - name: custom-init - # image: "alpine:3.7" - # imagePullPolicy: Always - # command: [ "uname", "-a" ] - - sidecars: - configAutoReload: - # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified, - # jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the - # http:///reload-configuration-as-code endpoint to reapply config when changes to the configScripts are detected. - enabled: true - image: kiwigrid/k8s-sidecar:1.24.4 - imagePullPolicy: IfNotPresent - resources: {} - # limits: - # cpu: 100m - # memory: 100Mi - # requests: - # cpu: 50m - # memory: 50Mi - # How many connection-related errors to retry on - reqRetryConnect: 10 - # env: - # - name: REQ_TIMEOUT - # value: "30" - # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. - # Is only used to reload jcasc config from the sidecar container running in the Jenkins controller pod. - # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be - # accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), - # this must be > 1024: - sshTcpPort: 1044 - # folder in the pod that should hold the collected dashboards: - folder: "/var/jenkins_home/casc_configs" - # If specified, the sidecar will search for JCasC config-maps inside this namespace. - # Otherwise the namespace in which the sidecar is running will be used. - # It's also possible to specify ALL to search in all namespaces: - # searchNamespace: - containerSecurityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - - # Allows you to inject additional/other sidecars - other: [] - ## The example below runs the client for https://smee.io as sidecar container next to Jenkins, - ## that allows to trigger build behind a secure firewall. - ## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall - ## - ## Note: To use it you should go to https://smee.io/new and update the url to the generete one. - # - name: smee - # image: docker.io/twalter/smee-client:1.0.2 - # args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"] - # resources: - # limits: - # cpu: 50m - # memory: 128Mi - # requests: - # cpu: 10m - # memory: 32Mi - # Name of the Kubernetes scheduler to use - schedulerName: "" - # Node labels and tolerations for pod assignment - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature - # nodeSelector: {} - - terminationGracePeriodSeconds: - - terminationMessagePath: - terminationMessagePolicy: - - # tolerations: [] - - nodeSelector: - dedicated: devops - - tolerations: - - key: "dedicated" - operator: "Equal" - value: "devops" - effect: "NoSchedule" - - affinity: {} - # Leverage a priorityClass to ensure your pods survive resource shortages - # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - priorityClassName: - - podAnnotations: {} - # Add StatefulSet annotations - statefulSetAnnotations: {} - - # StatefulSet updateStrategy - # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - updateStrategy: {} - - ingress: - enabled: true - # Override for the default paths that map requests to the backend - paths: [] - # - backend: - # serviceName: ssl-redirect - # servicePort: use-annotation - # - backend: - # serviceName: >- - # {{ template "jenkins.fullname" . }} - # # Don't use string here, use only integer value! - # servicePort: 8080 - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - ingressClassName: nginx-internal - # Set this path to jenkinsUriPrefix above or use annotations to rewrite path - # path: "/jenkins" - # configures the hostname e.g. jenkins.example.com - hostName: jenkins-admin.meeshogcp.in - tls: - # - secretName: jenkins.cluster.local - # hosts: - # - jenkins.cluster.local - - # often you want to have your controller all locked down and private - # but you still want to get webhooks from your SCM - # A secondary ingress will let you expose different urls - # with a differnt configuration - secondaryingress: - enabled: false - # paths you want forwarded to the backend - # ex /github-webhook - paths: [] - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - # configures the hostname e.g. jenkins-external.example.com - hostName: - tls: - # - secretName: jenkins-external.example.com - # hosts: - # - jenkins-external.example.com - - # If you're running on GKE and need to configure a backendconfig - # to finish ingress setup, use the following values. - # Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig - backendconfig: - enabled: false - apiVersion: "extensions/v1beta1" - name: - labels: {} - annotations: {} - spec: {} - - # Openshift route - route: - enabled: false - labels: {} - annotations: {} - # path: "/jenkins" - - # controller.hostAliases allows for adding entries to Pod /etc/hosts: - # https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - hostAliases: [] - # - ip: 192.168.50.50 - # hostnames: - # - something.local - # - ip: 10.0.50.50 - # hostnames: - # - other.local - - # Expose Prometheus metrics - prometheus: - # If enabled, add the prometheus plugin to the list of plugins to install - # https://plugins.jenkins.io/prometheus - enabled: false - # Additional labels to add to the ServiceMonitor object - serviceMonitorAdditionalLabels: {} - # Set a custom namespace where to deploy ServiceMonitor resource - # serviceMonitorNamespace: monitoring - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - # Additional labels to add to the PrometheusRule object - alertingRulesAdditionalLabels: {} - # An array of prometheus alerting rules - # See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ - # The `groups` root object is added by default, simply add the rule entries - alertingrules: [] - # Set a custom namespace where to deploy PrometheusRule resource - prometheusRuleNamespace: "" - - # RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds - # relabelings for a few standard Kubernetes fields. The original scrape job’s name - # is available via the __tmp_prometheus_job_name label. - # More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config - relabelings: [] - # MetricRelabelConfigs to apply to samples before ingestion. - metricRelabelings: [] - - googlePodMonitor: - # If enabled, It creates Google Managed Prometheus scraping config - enabled: false - # Set a custom namespace where to deploy PodMonitoring resource - # serviceMonitorNamespace: "" - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - - # Can be used to disable rendering controller test resources when using helm template - testEnabled: true - - httpsKeyStore: - jenkinsHttpsJksSecretName: '' - jenkinsHttpsJksSecretKey: "jenkins-jks-file" - jenkinsHttpsJksPasswordSecretName: "" - jenkinsHttpsJksPasswordSecretKey: "https-jks-password" - enable: false - disableSecretMount: false - httpPort: 8081 - path: "/var/jenkins_keystore" - fileName: "keystore.jks" - password: "password" - # Convert keystore.jks files content to base64 ( cat keystore.jks | base64 ) and put the output here - jenkinsKeyStoreBase64Encoded: | - /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq - AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z - gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe - TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x - QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy - 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR - pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB - Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l - Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG - Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi - HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI - OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO - NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi - Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg - UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te - fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi - Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT - EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ - y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU - iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl - t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ - gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa - jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H - bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn - xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV - BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p - bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx - MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y - b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb - BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC - AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w - Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF - 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP - F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i - d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe - 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl - m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h - /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q - 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog - hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= - -agent: - enabled: true - defaultsProviderTemplate: "" - # URL for connecting to the Jenkins controller - jenkinsUrl: - # connect to the specified host and port, instead of connecting directly to the Jenkins controller - jenkinsTunnel: - kubernetesConnectTimeout: 5 - kubernetesReadTimeout: 15 - maxRequestsPerHostStr: "32" - retentionTimeout: 5 - waitForPodSec: 600 - namespace: - # private registry for agent image - jnlpregistry: - image: "jenkins/inbound-agent" - tag: "3107.v665000b_51092-15" - workingDir: "/home/jenkins/agent" - nodeUsageMode: "NORMAL" - customJenkinsLabels: [] - # name of the secret to be used for image pulling - imagePullSecretName: - componentName: "jenkins-agent" - websocket: false - directConnection: false - privileged: false - runAsUser: - runAsGroup: - hostNetworking: false - resources: - requests: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - limits: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - livenessProbe: {} -# execArgs: "cat /tmp/healthy" -# failureThreshold: 3 -# initialDelaySeconds: 0 -# periodSeconds: 10 -# successThreshold: 1 -# timeoutSeconds: 1 - # You may want to change this to true while testing a new image - alwaysPullImage: false - # Controls how agent pods are retained after the Jenkins build completes - # Possible values: Always, Never, OnFailure - podRetention: "Never" - # Disable if you do not want the Yaml the agent pod template to show up - # in the job Console Output. This can be helpful for either security reasons - # or simply to clean up the output to make it easier to read. - showRawYaml: true - # You can define the volumes that you want to mount for this container - # Allowed types are: ConfigMap, EmptyDir, HostPath, Nfs, PVC, Secret - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes - volumes: [] - # - type: ConfigMap - # configMapName: myconfigmap - # mountPath: /var/myapp/myconfigmap - # - type: EmptyDir - # mountPath: /var/myapp/myemptydir - # memory: false - # - type: HostPath - # hostPath: /var/lib/containers - # mountPath: /var/myapp/myhostpath - # - type: Nfs - # mountPath: /var/myapp/mynfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - # - type: PVC - # claimName: mypvc - # mountPath: /var/myapp/mypvc - # readOnly: false - # - type: Secret - # defaultMode: "600" - # mountPath: /var/myapp/mysecret - # secretName: mysecret - # Pod-wide environment, these vars are visible to any container in the agent pod - - # You can define the workspaceVolume that you want to mount for this container - # Allowed types are: DynamicPVC, EmptyDir, HostPath, Nfs, PVC - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace - workspaceVolume: {} - ## DynamicPVC example - # type: DynamicPVC - # configMapName: myconfigmap - ## EmptyDir example - # type: EmptyDir - # memory: false - ## HostPath example - # type: HostPath - # hostPath: /var/lib/containers - ## NFS example - # type: Nfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - ## PVC example - # type: PVC - # claimName: mypvc - # readOnly: false - # - # Pod-wide environment, these vars are visible to any container in the agent pod - envVars: [] - # - name: PATH - # value: /usr/local/bin - # Mount a secret as environment variable - secretEnvVars: [] - # - key: PATH - # optional: false # default: false - # secretKey: MY-K8S-PATH - # secretName: my-k8s-secret - nodeSelector: {} - # Key Value selectors. Ex: - # jenkins-agent: v1 - - # Executed command when side container gets started - command: - args: "${computer.jnlpmac} ${computer.name}" - # Side container name - sideContainerName: "jnlp" - # Doesn't allocate pseudo TTY by default - TTYEnabled: false - # Max number of spawned agent - containerCap: 10 - # Pod name - podName: "default" - # Allows the Pod to remain active for reuse until the configured number of - # minutes has passed since the last step was executed on it. - idleMinutes: 0 - # Raw yaml template for the Pod. For example this allows usage of toleration for agent pods. - # https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates - # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - yamlTemplate: "" - # yamlTemplate: |- - # apiVersion: v1 - # kind: Pod - # spec: - # tolerations: - # - key: "key" - # operator: "Equal" - # value: "value" - # Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates: merge or override - yamlMergeStrategy: "override" - # Timeout in seconds for an agent to be online - connectTimeout: 100 - # Annotations to apply to the pod. - annotations: {} - - # Add additional containers to the agents. - # Containers specified here are added to all agents. Set key empty to remove container from additional agents. - additionalContainers: [] - # - sideContainerName: dind - # image: docker - # tag: dind - # command: dockerd-entrypoint.sh - # args: "" - # privileged: true - # resources: - # requests: - # cpu: 500m - # memory: 1Gi - # limits: - # cpu: 1 - # memory: 2Gi - - # Disable the default Jenkins Agent configuration. - # Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template. - disableDefaultAgent: false - - # Below is the implementation of custom pod templates for the default configured kubernetes cloud. - # Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. - # For this pod templates configuration to be loaded the following values must be set: - # controller.JCasC.defaultConfig: true - # Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template. - podTemplates: {} - # python: | - # - name: python - # label: jenkins-python - # serviceAccount: jenkins - # containers: - # - name: python - # image: python:3 - # command: "/bin/sh -c" - # args: "cat" - # ttyEnabled: true - # privileged: true - # resourceRequestCpu: "400m" - # resourceRequestMemory: "512Mi" - # resourceLimitCpu: "1" - # resourceLimitMemory: "1024Mi" - -# Here you can add additional agents -# They inherit all values from `agent` so you only need to specify values which differ -additionalAgents: {} -# maven: -# podName: maven -# customJenkinsLabels: maven -# # An example of overriding the jnlp container -# # sideContainerName: jnlp -# image: jenkins/jnlp-agent-maven -# tag: latest -# python: -# podName: python -# customJenkinsLabels: python -# sideContainerName: python -# image: python -# tag: "3" -# command: "/bin/sh -c" -# args: "cat" -# TTYEnabled: true - -persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: - ## jenkins data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - storageClass: - annotations: {} - labels: {} - accessMode: "ReadWriteOnce" - size: "10Gi" - # Existing data source to clone PVC from - # ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/ - dataSource: - # name: PVC-NAME - # kind: PersistentVolumeClaim - volumes: - # - name: nothing - # emptyDir: {} - mounts: - # - mountPath: /var/nothing - # name: nothing - # readOnly: true - -networkPolicy: - # Enable creation of NetworkPolicy resources. - enabled: false - # For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' - # For Kubernetes v1.7, use 'networking.k8s.io/v1' - apiVersion: networking.k8s.io/v1 - # You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range - internalAgents: - allowed: true - podLabels: {} - namespaceLabels: {} - # project: myproject - externalAgents: {} - # ipCIDR: 172.17.0.0/16 - # except: - # - 172.17.1.0/24 - -## Install Default RBAC roles and bindings -rbac: - create: true - readSecrets: false - -serviceAccount: - create: true - # The name of the service account is autogenerated by default - name: - annotations: {} - extraLabels: {} - imagePullSecretName: - - -serviceAccountAgent: - # Specifies whether a ServiceAccount should be created - create: true - # The name of the ServiceAccount to use. - # If not set and create is true, a name is generated using the fullname template - name: - annotations: {} - extraLabels: {} - imagePullSecretName: - -## Backup cronjob configuration -## Ref: https://github.com/maorfr/kube-tasks -backup: - # Backup must use RBAC - # So by enabling backup you are enabling RBAC specific for backup - enabled: false - # Used for label app.kubernetes.io/component - componentName: "backup" - # Schedule to run jobs. Must be in cron time format - # Ref: https://crontab.guru/ - schedule: "0 2 * * *" - labels: {} - serviceAccount: - create: true - name: - annotations: {} - # Example for authorization to AWS S3 using kube2iam or IRSA - # Can also be done using environment variables - # iam.amazonaws.com/role: "jenkins" - # "eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/jenkins-backup" - # Set this to terminate the job that is running/failing continously and set the job status to "Failed" - activeDeadlineSeconds: "" - image: - repository: "maorfr/kube-tasks" - tag: "0.2.0" - imagePullSecretName: - # Additional arguments for kube-tasks - # Ref: https://github.com/maorfr/kube-tasks#simple-backup - extraArgs: [] - # Add existingSecret for AWS credentials - existingSecret: {} - ## Example for using an existing secret - # jenkinsaws: - ## Use this key for AWS access key ID - # awsaccesskey: jenkins_aws_access_key - ## Use this key for AWS secret access key - # awssecretkey: jenkins_aws_secret_key - # Add additional environment variables - # jenkinsgcp: - ## Use this key for GCP credentials - # gcpcredentials: credentials.json - env: [] - # Example environment variable required for AWS credentials chain - # - name: "AWS_REGION" - # value: "us-east-1" - resources: - requests: - memory: 1Gi - cpu: 1 - limits: - memory: 1Gi - cpu: 1 - # Destination to store the backup artifacts - # Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage, Google Cloud Storage - # Additional support can added. Visit this repository for details - # Ref: https://github.com/maorfr/skbn - destination: "s3://jenkins-data/backup" - # By enabling only the jenkins_home/jobs folder gets backed up, not the whole jenkins instance - onlyJobs: false - # Enable backup pod security context (must be `true` if runAsUser or fsGroup are set) - usePodSecurityContext: true - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 1000 - fsGroup: 1000 - securityContextCapabilities: {} - # drop: - # - NET_RAW -cronJob: - apiVersion: batch/v1 - -checkDeprecation: true - -awsSecurityGroupPolicies: - enabled: false - policies: - - name: "" - securityGroupIds: [] - podSelector: {} - -# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md -helmtest: - # A testing framework for bash - bats: - # Bash Automated Testing System (BATS) - image: "bats/bats" - tag: "1.9.0" \ No newline at end of file diff --git a/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml index 11a7f4d..57b74a4 100644 --- a/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml @@ -1,1235 +1,41 @@ -# Default values for jenkins. -# This is a YAML-formatted file. -# Declare name/value pairs to be passed into your templates. -# name: value +jenkins: + # Fresh install. Dynamic Kubernetes build agents come from agent.enabled + # (chart default, not overridden here) — agent pods only exist during + # builds, matching claude.md's "idle cost is just the controller" note. + # Trimmed agent pod resources below anyway, since they still compete for + # the same 8GB box while a build is running. -## Overrides for generated resource names -# See templates/_helpers.tpl -# nameOverride: -fullnameOverride: jenkins-prd -# namespaceOverride: - -# For FQDN resolving of the controller service. Change this value to match your existing configuration. -# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md -clusterZone: "cluster.local" - -# The URL of the Kubernetes API server -kubernetesURL: "https://kubernetes.default" - -renderHelmLabels: true - -labels: - bu: "infra" - team: "devops" - service: "jenkins-prd" - env: "prd" - priority: "p0" - type: "jenkins" - component: "jenkins-master" - -controller: - # Used for label app.kubernetes.io/component - componentName: "jenkins-controller" - image: - # -- Controller image registry - registry: "asia-southeast1-docker.pkg.dev" - # -- Controller image repository - repository: "meesho-devops-admin-0622/admin/devops/jenkins" - # -- Controller image tag override; i.e., tag: "2.440.1-jdk21" - tag: "2.541.2-lts-jdk17" - # -- Controller image tag label - tagLabel: lts-jdk17 - # -- Controller image pull policy - pullPolicy: "Always" - imagePullSecretName: - # Optionally configure lifetime for controller-container - lifecycle: - # postStart: - # exec: - # command: - # - "uname" - # - "-a" - disableRememberMe: false - replicas: 1 - numExecutors: 2 - # configures the executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE - executorMode: "EXCLUSIVE" - customJenkinsLabels: [] - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm then you can disable it - # adminSecret: true - - hostNetworking: false - # When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist. - # If you disable the non-Jenkins identity store and instead use the Jenkins internal one, - # you should revert controller.adminUser to your preferred admin user: - admin: - # -- Admin username created as a secret if `controller.admin.createSecret` is true - username: "admin" - # -- Admin password created as a secret if `controller.admin.createSecret` is true - # @default -- - password: "admin" - - # -- The key in the existing admin secret containing the username - userKey: jenkins-admin-user - # -- The key in the existing admin secret containing the password - passwordKey: jenkins-admin-password - - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm, then you can disable it - # -- Create secret for admin user - createSecret: true - - # -- The name of an existing secret containing the admin credentials - existingSecret: "" - # -- Email address for the administrator of the Jenkins instance - jenkinsAdminEmail: - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" - jenkinsHome: "/var/jenkins_home" - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" - jenkinsRef: "/usr/share/jenkins/ref" - # Path to the jenkins war file which is used by jenkins-plugin-cli. - jenkinsWar: "/usr/share/jenkins/jenkins.war" - # Overrides the default arguments passed to the war - # overrideArgs: - # - --httpPort=8080 - resources: - requests: - cpu: "4000m" - memory: "12Gi" - limits: - cpu: "6000m" - memory: "16Gi" - # Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod - shareProcessNamespace: false - # Overrides the init container default values - initContainerResources: - requests: - cpu: "50m" - memory: "256Mi" - limits: - cpu: "2000m" - memory: "4096Mi" - # Environment variables that get added to the init container (useful for e.g. http_proxy) - # initContainerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - containerEnv: - - name: TZ - value: Asia/Kolkata - # Set min/max heap here if needed with: - javaOpts: "-Dhudson.model.User.allowUserCreationViaUrl=true -Djenkins.security.ApiTokenProperty.adminCanGenerateNewTokens=true -Dcom.cloudbees.hudson.plugins.folder.computed.ThrottleComputationQueueTaskDispatcher.LIMIT=15" - # javaOpts: "-Xms512m -Xmx512m" - # jenkinsOpts: "" - # If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. - # The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - jenkinsUrlProtocol: "https" - # If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the url definition. - jenkinsUrl: https://jenkins-prd.meeshogcp.in - # If you set this prefix and use ingress controller then you might want to set the ingress path below - # jenkinsUriPrefix: "/jenkins" - # Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) - usePodSecurityContext: true - # Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are - # being deprecated and replaced by `podSecurityContextOverride`. - # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 0 - fsGroup: 0 - # If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here - securityContextCapabilities: {} - # drop: - # - NET_RAW - # Completely overwrites the contents of the `securityContext`, ignoring the - # values provided for the deprecated fields: `runAsUser`, `fsGroup`, and - # `securityContextCapabilities`. In the case of mounting an ext4 filesystem, - # it might be desirable to use `supplementalGroups` instead of `fsGroup` in - # the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496 - # podSecurityContextOverride: - # runAsUser: 1000 - # runAsNonRoot: true - # supplementalGroups: [1000] - # # capabilities: {} - # Container securityContext - containerSecurityContext: - runAsUser: 0 - runAsGroup: 0 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - servicePort: 8080 - targetPort: 8080 - # -- enable or disable the controller k8s service - serviceEnabled: true - # For minikube, set this to NodePort, elsewhere use LoadBalancer - # Use ClusterIP if your setup includes ingress controller - serviceType: ClusterIP - # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, - # but risks potentially imbalanced traffic spreading. - serviceExternalTrafficPolicy: - # Jenkins controller service annotations - serviceAnnotations: {} - # Jenkins controller custom labels - statefulSetLabels: {} - # foo: bar - # bar: foo - # Jenkins controller service labels - serviceLabels: {} - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https - # Put labels on Jenkins controller pod - podLabels: {} - # Used to create Ingress record (should be used with ServiceType: ClusterIP) - # nodePort: - # -Dcom.sun.management.jmxremote.port=4000 - # -Dcom.sun.management.jmxremote.authenticate=false - # -Dcom.sun.management.jmxremote.ssl=false - # jmxPort: 4000 - # Optionally configure other ports to expose in the controller container - extraPorts: [] - # - name: BuildInfoProxy - # port: 9000 - # targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port) - - # List of plugins to be install during Jenkins controller start - installPlugins: - - ansicolor:1.0.4 - - antisamy-markup-formatter:162.v0e6ec0fcfcf6 - - apache-httpcomponents-client-4-api:4.5.14-208.v438351942757 - - asm-api:9.9.1-189.vb_5ef2964da_91 - - authentication-tokens:1.119.v50285141b_7e1 - - blueocean-bitbucket-pipeline:1.27.16 - - blueocean-commons:1.27.16 - - blueocean-config:1.27.16 - - blueocean-core-js:1.27.16 - - blueocean-dashboard:1.27.16 - - blueocean-display-url:2.4.3 - - blueocean-events:1.27.16 - - blueocean-git-pipeline:1.27.16 - - blueocean-github-pipeline:1.27.16 - - blueocean-i18n:1.27.16 - - blueocean-jwt:1.27.16 - - blueocean-personalization:1.27.16 - - blueocean-pipeline-api-impl:1.27.16 - - blueocean-pipeline-editor:1.27.16 - - blueocean-pipeline-scm-api:1.27.16 - - blueocean-rest-impl:1.27.16 - - blueocean-rest:1.27.16 - - blueocean-web:1.27.16 - - blueocean:1.27.9 - - bootstrap5-api:5.3.3-1 - - bouncycastle-api:2.30.1.83-289.v8426fcd19371 - - branch-api:2.1280.v0d4e5b_b_460ef - - caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81 - - checks-api:2.2.3 - - cloudbees-bitbucket-branch-source:888.v8e6d479a_1730 - - cloudbees-folder:6.1079.vc0975c2de294 - - cobertura:1.17 - - code-coverage-api:4.99.0 - - commons-lang3-api:3.20.0-109.ve43756e2d2b_4 - - commons-text-api:1.15.0-218.va_61573470393 - - coverage:1.16.1 - - credentials-binding:681.vf91669a_32e45 - - credentials:1502.v5c95e620ddfe - - data-tables-api:2.1.8-1 - - display-url-api:2.204.vf6fddd8a_8b_e9 - - durable-task:568.v8fb_5c57e8417 - - echarts-api:5.5.1-4 - - eddsa-api:0.3.0-4.v84c6f0f4969e - - extended-choice-parameter:376.v2e02857547b_a_ - - favorite:2.221.v19ca_666b_62f5 - - font-awesome-api:6.6.0-2 - - forensics-api:2.7.0 - - git-client:4.7.0 - - git:5.2.1 - - github-api:1.321-468.v6a_9f5f2d5a_7e - - github-autostatus:3.6.2 - - github-branch-source:1793.v1831e9c68d77 - - github:1.40.0 - - google-login:109.v022b_cf87b_e5b_ - - google-oauth-plugin:1.330.vf5e86021cb_ec - - gson-api:2.11.0-41.v019fcf6125dc - - handy-uri-templates-2-api:2.1.8-30.v7e777411b_148 - - htmlpublisher:1.36 - - http_request:1.18 - - instance-identity:201.vd2a_b_5a_468a_a_6 - - ionicons-api:94.vcc3065403257 - - jackson2-api:2.18.3-396.v93cc2d00b_b_7b_ - - jacoco:3.3.7 - - jakarta-activation-api:2.1.3-1 - - jakarta-mail-api:2.1.3-1 - - javax-activation-api:1.2.0-7 - - javax-mail-api:1.6.2-9 - - jaxb:2.3.9-1 - - jdk-tool:66.vd8fa_64ee91b_d - - jenkins-design-language:1.27.16 - - jjwt-api:0.11.5-112.ve82dfb_224b_a_d - - joda-time-api:2.12.7-29.v5a_b_e3a_82269a_ - - jquery3-api:3.7.1-2 - - json-api:20240303-41.v94e11e6de726 - - json-path-api:2.9.0-58.v62e3e85b_a_655 - - junit:1312.v1a_235a_b_94a_31 - - kubernetes-client-api:6.10.0-240.v57880ce8b_0b_2 - - kubernetes-credentials:190.v03c305394deb_ - - kubernetes:4186.v1d804571d5d4 - - mailer:470.vc91f60c5d8e2 - - matrix-project:822.824.v14451b_c0fd42 - - metrics:4.2.21-451.vd51df8df52ec - - mina-sshd-api-common:2.14.0-143.v2b_362fc39576 - - mina-sshd-api-core:2.14.0-143.v2b_362fc39576 - - oauth-credentials:0.653.v14cf2088e950 - - okhttp-api:4.11.0-172.vda_da_1feeb_c6e - - pipeline-build-step:540.vb_e8849e1a_b_d8 - - pipeline-graph-analysis:216.vfd8b_ece330ca_ - - pipeline-groovy-lib:745.vdf6077913de0 - - pipeline-input-step:477.v339683a_8d55e - - pipeline-milestone-step:119.vdfdc43fc3b_9a_ - - pipeline-model-api:2.2218.v56d0cda_37c72 - - pipeline-model-definition:2.2218.v56d0cda_37c72 - - pipeline-model-extensions:2.2218.v56d0cda_37c72 - - pipeline-rest-api:2.34 - - pipeline-stage-step:312.v8cd10304c27a_ - - pipeline-stage-tags-metadata:2.2218.v56d0cda_37c72 - - pipeline-stage-view:2.34 - - pipeline-utility-steps:2.16.0 - - plain-credentials:183.va_de8f1dd5a_2b_ - - plugin-util-api:4.1.0 - - prism-api:1.29.0-18 - - pubsub-light:1.18 - - rebuild:330.v645b_7df10e2a_ - - scm-api:728.vc30dcf7a_0df5 - - scm-filter-branch-pr:148.v0b_5f06e8b_c84 - - script-security:1399.ve6a_66547f6e1 - - slack:684.v833089650554 - - snakeyaml-api:2.3-123.v13484c65210a_ - - sonar-quality-gates:1.3.1 - - sonar:2.16.1 - - sse-gateway:1.27 - - ssh-agent:376.v8933585c69d3 - - ssh-credentials:343.v884f71d78167 - - ssh-slaves:2.973.v0fa_8c0dea_f9f - - sshd:3.303.vefc7119b_ec23 - - structs:362.va_b_695ef4fdf9 - - timestamper:1.26 - - token-macro:400.v35420b_922dcb_ - - trilead-api:2.147.vb_73cc728a_32e - - variant:60.v7290fc0eb_b_cd - - workflow-aggregator:596.v8c21c963d92d - - workflow-api:1413.v2ff1a_5e720fa_ - - workflow-basic-steps:1058.vcb_fc1e3a_21a_9 - - workflow-cps:4275.vb_0565eb_a_3d36 - - workflow-durable-task-step:1331.vc8c2fed35334 - - workflow-job:1571.vb_423c255d6d9 - - workflow-multibranch:821.vc3b_4ea_780798 - - workflow-scm-step:466.va_d69e602552b_ - - workflow-step-api:724.v538c2362b_dfb_ - - workflow-support:1015.v785e5a_b_b_8b_22 - - # Set to false to download the minimum required version of all dependencies. - installLatestPlugins: false - - # Set to true to download latest dependencies of any plugin that is requested to have the latest version. - installLatestSpecifiedPlugins: false - - # List of plugins to install in addition to those listed in controller.installPlugins - additionalPlugins: [] - - # Enable to initialize the Jenkins controller only once on initial installation. - # Without this, whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates which has the potential to cause breakage. - # Note that for this to work, `persistence.enabled` needs to be set to `true` - initializeOnce: false - - # Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment. - # overwritePlugins: true - - # Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment. - overwritePluginsFromImage: true - - # Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config. - projectNamingStrategy: standard - - # Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter), useful with ghprb plugin. - # The plugin is not installed by default, please update controller.installPlugins. - enableRawHtmlMarkupFormatter: false - # This is ignored if enableRawHtmlMarkupFormatter is true - # -- Yaml of the markup formatter to use - markupFormatter: plainText - # Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval - scriptApproval: [] - # - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - # - "new groovy.json.JsonSlurperClassic" - # List of groovy init scripts to be executed during Jenkins controller start - initScripts: [] - # - | - # print 'adding global pipeline libraries, register properties, bootstrap jobs...' - # -- Name of the existing ConfigMap that contains init scripts - initConfigMap: - # 'name' is a name of an existing secret in same namespace as jenkins, - # 'keyName' is the name of one of the keys inside current secret. - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: - - additionalExistingSecrets: [] - # - name: secret-name-1 - # keyName: username - # - name: secret-name-1 - # keyName: password - - additionalSecrets: [] - # - name: nameOfSecret - # value: secretText - - # Generate SecretClaim resources in order to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. - # 'name' is name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. - # 'path' is the fully qualified path to the secret in Vault - # 'type' is an optional Kubernetes secret type. Defaults to 'Opaque' - # 'renew' is an optional secret renewal time in seconds - secretClaims: [] - # - name: secretName # required - # path: testPath # required - # type: kubernetes.io/tls # optional - # renew: 60 # optional - - # Name of default cloud configuration. - cloudName: "kubernetes" - - # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, - # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in - # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | - # become the content of the configuration yaml file. The first line after this is a JCasC root element, eg jenkins, credentials, - # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: - JCasC: - defaultConfig: true - configUrls: [] - # - https://acme.org/jenkins.yaml - # Remote URL:s for configuration files. - configScripts: {} - # securityRealm: |- - # googleOAuth2: - # clientId: "754206588389-96ptu1fev2iq5lva2uov3oio0itoq7op.apps.googleusercontent.com" - # clientSecret: "{AQAAABAAAAAw9LBwNlT3X0nnZfl+cM2j9+aTPOAfDkG+g0ReF7mfoGAmgUfkfbBuE8pthLFS3MGVgkWLpvAQdmvVbe8M82sDHA==}" - # domain: "meesho.com" - # authorizationStrategy: |- - # loggedInUsersCanDoAnything: - # allowAnonymousRead: false - # welcome-message: | - # jenkins: - # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - # Allows adding to the top-level security JCasC section. For legacy, default the chart includes apiToken configurations - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - securityRealm: |- - googleOAuth2: - clientId: "754206588389-96ptu1fev2iq5lva2uov3oio0itoq7op.apps.googleusercontent.com" - clientSecret: "{AQAAABAAAAAw9LBwNlT3X0nnZfl+cM2j9+aTPOAfDkG+g0ReF7mfoGAmgUfkfbBuE8pthLFS3MGVgkWLpvAQdmvVbe8M82sDHA==}" - domain: "meesho.com" - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false - # -- Annotations for the JCasC ConfigMap - configMapAnnotations: {} - # # Ignored if securityRealm is defined in controller.JCasC.configScripts - # securityRealm: |- - # local: - # allowsSignup: false - # enableCaptcha: false - # users: - # - id: "${chart-admin-username}" - # name: "Jenkins Admin" - # password: "${chart-admin-password}" - # # Ignored if authorizationStrategy is defined in controller.JCasC.configScripts - # authorizationStrategy: |- - # loggedInUsersCanDoAnything: - # allowAnonymousRead: false - # Optionally specify additional init-containers - customInitContainers: [] - # - name: custom-init - # image: "alpine:3.7" - # imagePullPolicy: Always - # command: [ "uname", "-a" ] - - sidecars: - configAutoReload: - # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. - # If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up. - # Auto-reload uses the http:///reload-configuration-as-code endpoint to reapply config when changes to - # the configScripts are detected. - # -- Enable Jenkins Config as Code auto-reload - enabled: true - image: - # -- Registry for the image that triggers the reload - registry: docker.io - # -- Repository of the image that triggers the reload - repository: kiwigrid/k8s-sidecar - # -- Tag for the image that triggers the reload - tag: 1.30.3 - imagePullPolicy: IfNotPresent - resources: {} - # limits: - # cpu: 100m - # memory: 100Mi - # requests: - # cpu: 50m - # memory: 50Mi - # -- The scheme to use when connecting to the Jenkins configuration as code endpoint - scheme: http - # -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint - skipTlsVerify: false - # How many connection-related errors to retry on - reqRetryConnect: 10 - # env: - # - name: REQ_TIMEOUT - # value: "30" - # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. - # Is only used to reload jcasc config from the sidecar container running in the Jenkins controller pod. - # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be - # accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), - # this must be > 1024: - sshTcpPort: 1044 - # -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) - sleepTime: - - # -- Environment variable sources for the Jenkins Config as Code auto-reload container - envFrom: [] - # -- Environment variables for the Jenkins Config as Code auto-reload container - env: [] - # - name: REQ_TIMEOUT - # value: "30" - # -- Config auto-reload logging settings - logging: - # See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py - configuration: - # -- Enables custom log config utilizing using the settings below. - override: false - logLevel: INFO - formatter: JSON - logToConsole: true - logToFile: false - maxBytes: 1024 - backupCount: 3 - # folder in the pod that should hold the collected dashboards: - folder: "/var/jenkins_home/casc_configs" - # If specified, the sidecar will search for JCasC config-maps inside this namespace. - # Otherwise the namespace in which the sidecar is running will be used. - # It's also possible to specify ALL to search in all namespaces: - # searchNamespace: - containerSecurityContext: - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - - # Allows you to inject additional/other sidecars - other: [] - ## The example below runs the client for https://smee.io as sidecar container next to Jenkins, - ## that allows to trigger build behind a secure firewall. - ## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall - ## - ## Note: To use it you should go to https://smee.io/new and update the url to the generete one. - # - name: smee - # image: docker.io/twalter/smee-client:1.0.2 - # args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"] - # resources: - # limits: - # cpu: 50m - # memory: 128Mi - # requests: - # cpu: 10m - # memory: 32Mi - # Name of the Kubernetes scheduler to use - schedulerName: "" - # Node labels and tolerations for pod assignment - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature - # nodeSelector: {} - - terminationGracePeriodSeconds: - - terminationMessagePath: - terminationMessagePolicy: - - # tolerations: [] - - nodeSelector: - dedicated: jenkins - - tolerations: - - key: "dedicated" - operator: "Equal" - value: "jenkins" - effect: "NoSchedule" - - affinity: {} - # Leverage a priorityClass to ensure your pods survive resource shortages - # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - priorityClassName: - - podAnnotations: {} - # Add StatefulSet annotations - statefulSetAnnotations: {} - - # StatefulSet updateStrategy - # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - updateStrategy: {} - - ingress: + persistence: enabled: true - # Override for the default paths that map requests to the backend - paths: [] - # - backend: - # serviceName: ssl-redirect - # servicePort: use-annotation - # - backend: - # serviceName: >- - # {{ template "jenkins.fullname" . }} - # # Don't use string here, use only integer value! - # servicePort: 8080 - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx-internal - # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - ingressClassName: nginx-internal - # Set this path to jenkinsUriPrefix above or use annotations to rewrite path - # path: "/jenkins" - # configures the hostname e.g. jenkins.example.com - hostName: jenkins-prd.meeshogcp.in - tls: - # - secretName: jenkins.cluster.local - # hosts: - # - jenkins.cluster.local - - # often you want to have your controller all locked down and private - # but you still want to get webhooks from your SCM - # A secondary ingress will let you expose different urls - # with a differnt configuration - secondaryingress: - enabled: false - # paths you want forwarded to the backend - # ex /github-webhook - paths: [] - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - # configures the hostname e.g. jenkins-external.example.com - hostName: - tls: - # - secretName: jenkins-external.example.com - # hosts: - # - jenkins-external.example.com - - # If you're running on GKE and need to configure a backendconfig - # to finish ingress setup, use the following values. - # Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig - backendconfig: - enabled: false - apiVersion: "extensions/v1beta1" - name: - labels: {} - annotations: {} - spec: {} - - # Openshift route - route: - enabled: false - labels: {} - annotations: {} - # path: "/jenkins" - - # controller.hostAliases allows for adding entries to Pod /etc/hosts: - # https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - hostAliases: [] - # - ip: 192.168.50.50 - # hostnames: - # - something.local - # - ip: 10.0.50.50 - # hostnames: - # - other.local - - # Expose Prometheus metrics - prometheus: - # If enabled, add the prometheus plugin to the list of plugins to install - # https://plugins.jenkins.io/prometheus - enabled: false - # Additional labels to add to the ServiceMonitor object - serviceMonitorAdditionalLabels: {} - # Set a custom namespace where to deploy ServiceMonitor resource - # serviceMonitorNamespace: monitoring - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - # Additional labels to add to the PrometheusRule object - alertingRulesAdditionalLabels: {} - # An array of prometheus alerting rules - # See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ - # The `groups` root object is added by default, simply add the rule entries - alertingrules: [] - # Set a custom namespace where to deploy PrometheusRule resource - prometheusRuleNamespace: "" - - # RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds - # relabelings for a few standard Kubernetes fields. The original scrape job’s name - # is available via the __tmp_prometheus_job_name label. - # More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config - relabelings: [] - # MetricRelabelConfigs to apply to samples before ingestion. - metricRelabelings: [] - - googlePodMonitor: - # If enabled, It creates Google Managed Prometheus scraping config - enabled: false - # Set a custom namespace where to deploy PodMonitoring resource - # serviceMonitorNamespace: "" - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - - # Can be used to disable rendering controller test resources when using helm template - testEnabled: true - - httpsKeyStore: - jenkinsHttpsJksSecretName: '' - jenkinsHttpsJksSecretKey: "jenkins-jks-file" - jenkinsHttpsJksPasswordSecretName: "" - jenkinsHttpsJksPasswordSecretKey: "https-jks-password" - enable: false - disableSecretMount: false - httpPort: 8081 - path: "/var/jenkins_keystore" - fileName: "keystore.jks" - password: "password" - # Convert keystore.jks files content to base64 ( cat keystore.jks | base64 ) and put the output here - jenkinsKeyStoreBase64Encoded: | - /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq - AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z - gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe - TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x - QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy - 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR - pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB - Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l - Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG - Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi - HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI - OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO - NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi - Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg - UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te - fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi - Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT - EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ - y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU - iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl - t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ - gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa - jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H - bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn - xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV - BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p - bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx - MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y - b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb - BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC - AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w - Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF - 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP - F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i - d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe - 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl - m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h - /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q - 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog - hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= - -agent: - enabled: true - defaultsProviderTemplate: "" - # URL for connecting to the Jenkins controller - jenkinsUrl: - # connect to the specified host and port, instead of connecting directly to the Jenkins controller - jenkinsTunnel: - kubernetesConnectTimeout: 5 - kubernetesReadTimeout: 15 - maxRequestsPerHostStr: "32" - retentionTimeout: 5 - waitForPodSec: 600 - namespace: - # private registry for agent image - jnlpregistry: - image: - # -- Registry to pull the agent jnlp image from - registry: "" - # -- Repository to pull the agent jnlp image from - repository: "jenkins/inbound-agent" - # -- Tag of the image to pull - tag: "3309.v27b_9314fd1a_4-4" - workingDir: "/home/jenkins/agent" - nodeUsageMode: "NORMAL" - customJenkinsLabels: [] - # name of the secret to be used for image pulling - imagePullSecretName: - componentName: "jenkins-agent" - websocket: false - directConnection: false - privileged: true - runAsUser: 0 - runAsGroup: 0 - hostNetworking: false - resources: - requests: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - limits: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - livenessProbe: {} -# execArgs: "cat /tmp/healthy" -# failureThreshold: 3 -# initialDelaySeconds: 0 -# periodSeconds: 10 -# successThreshold: 1 -# timeoutSeconds: 1 - # You may want to change this to true while testing a new image - alwaysPullImage: false - # Controls how agent pods are retained after the Jenkins build completes - # Possible values: Always, Never, OnFailure - podRetention: "Never" - # Disable if you do not want the Yaml the agent pod template to show up - # in the job Console Output. This can be helpful for either security reasons - # or simply to clean up the output to make it easier to read. - showRawYaml: true - # You can define the volumes that you want to mount for this container - # Allowed types are: ConfigMap, EmptyDir, HostPath, Nfs, PVC, Secret - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes - volumes: [] - # - type: ConfigMap - # configMapName: myconfigmap - # mountPath: /var/myapp/myconfigmap - # - type: EmptyDir - # mountPath: /var/myapp/myemptydir - # memory: false - # - type: HostPath - # hostPath: /var/lib/containers - # mountPath: /var/myapp/myhostpath - # - type: Nfs - # mountPath: /var/myapp/mynfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - # - type: PVC - # claimName: mypvc - # mountPath: /var/myapp/mypvc - # readOnly: false - # - type: Secret - # defaultMode: "600" - # mountPath: /var/myapp/mysecret - # secretName: mysecret - # Pod-wide environment, these vars are visible to any container in the agent pod - - # You can define the workspaceVolume that you want to mount for this container - # Allowed types are: DynamicPVC, EmptyDir, HostPath, Nfs, PVC - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace - workspaceVolume: {} - ## DynamicPVC example - # type: DynamicPVC - # configMapName: myconfigmap - ## EmptyDir example - # type: EmptyDir - # memory: false - ## HostPath example - # type: HostPath - # hostPath: /var/lib/containers - ## NFS example - # type: Nfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - ## PVC example - # type: PVC - # claimName: mypvc - # readOnly: false - # - # Pod-wide environment, these vars are visible to any container in the agent pod - envVars: - - name: TZ - value: Asia/Kolkata - # - name: PATH - # value: /usr/local/bin - # Mount a secret as environment variable - secretEnvVars: [] - # - key: PATH - # optional: false # default: false - # secretKey: MY-K8S-PATH - # secretName: my-k8s-secret - nodeSelector: - dedicated: jenkins - # Key Value selectors. Ex: - # jenkins-agent: v1 - - # Executed command when side container gets started - command: - args: "${computer.jnlpmac} ${computer.name}" - # Side container name - sideContainerName: "jnlp" - # Doesn't allocate pseudo TTY by default - TTYEnabled: false - # Max number of spawned agent - containerCap: 10 - # Pod name - podName: "default" - # Allows the Pod to remain active for reuse until the configured number of - # minutes has passed since the last step was executed on it. - idleMinutes: 0 - # Raw yaml template for the Pod. For example this allows usage of toleration for agent pods. - # https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates - # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - # yamlTemplate: "" - yamlTemplate: |- - apiVersion: v1 - kind: Pod - metadata: - labels: - bu: "infra" - team: "devops" - service: "jenkins-prd" - env: "prd" - priority: "p0" - type: "jenkins" - component: "jenkins-agent" - spec: - tolerations: - - key: "dedicated" - operator: "Equal" - value: "jenkins" - - # Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates: merge or override - yamlMergeStrategy: "merge" - # Timeout in seconds for an agent to be online - connectTimeout: 100 - # Annotations to apply to the pod. - annotations: {} - - # Add additional containers to the agents. - # Containers specified here are added to all agents. Set key empty to remove container from additional agents. - additionalContainers: [] - # - sideContainerName: devops-tools - # image: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/admin/devops/build-tools - # tag: lunar-v1.0.2 - # command: cat - # args: "" - # privileged: true - # ttyEnabled: true - # resources: - # requests: - # cpu: 1 - # memory: 1Gi - # limits: - # cpu: 4 - # memory: 4Gi - # - sideContainerName: dind - # image: docker - # tag: dind - # command: dockerd-entrypoint.sh - # args: "" - # privileged: true - # resources: - # requests: - # cpu: 500m - # memory: 1Gi - # limits: - # cpu: 1 - # memory: 2Gi - - # Disable the default Jenkins Agent configuration. - # Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template. - disableDefaultAgent: false - - # Below is the implementation of custom pod templates for the default configured kubernetes cloud. - # Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. - # For this pod templates configuration to be loaded the following values must be set: - # controller.JCasC.defaultConfig: true - # Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template. - podTemplates: {} - # devops-tools: | - # - name: devops-tools - # label: devops-tools - # podRetention: "never" - # nodeUsageMode: EXCLUSIVE - # serviceAccount: jenkins-prd-agent - # annotations: - # - key: "kubectl.kubernetes.io/default-container" - # value: "devops-tools" - # envVars: - # - envVar: - # key: "TZ" - # value: "Asia/Kolkata" - # nodeSelector: "dedicated=jenkins" - # containers: - # - name: devops-tools - # image: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/admin/devops/build-tools:lunar-v1.0.2 - # command: "/bin/sh -c" - # args: "cat" - # ttyEnabled: true - # privileged: false - # resourceRequestCpu: "4" - # resourceRequestMemory: "8Gi" - # resourceLimitCpu: "8" - # resourceLimitMemory: "16Gi" - # yaml: |- - # apiVersion: v1 - # kind: Pod - # metadata: - # labels: - # bu: "infra" - # team: "devops" - # service: "jenkins-prd" - # env: "prd" - # priority: "p0" - # type: "jenkins" - # component: "jenkins-agent" - # spec: - # tolerations: - # - key: "dedicated" - # operator: "Equal" - # value: "jenkins" - # yamlMergeStrategy: "merge" - -# Here you can add additional agents -# They inherit all values from `agent` so you only need to specify values which differ -additionalAgents: {} - # devops-tools: - # podName: devops-tools - # customJenkinsLabels: devops-tools - # # An example of overriding the jnlp container - # sideContainerName: jnlp - # image: asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/admin/devops/build-tools - # tag: lunar-v1.0.2 -# maven: -# podName: maven -# customJenkinsLabels: maven -# # An example of overriding the jnlp container -# # sideContainerName: jnlp -# image: jenkins/jnlp-agent-maven -# tag: latest -# python: -# podName: python -# customJenkinsLabels: python -# sideContainerName: python -# image: python -# tag: "3" -# command: "/bin/sh -c" -# args: "cat" -# TTYEnabled: true - -persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "jenkins-prd-tmp" - ## jenkins data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - storageClass: "sc-pd-standard" - annotations: {} - labels: {} - volumeName: "pvc-a8f06a43-5143-458c-84af-cc04c8a95015" - accessMode: "ReadWriteOnce" - size: "300Gi" - # Existing data source to clone PVC from - # ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/ - dataSource: - # name: jenkins-prd-tmp - # kind: PersistentVolumeClaim - volumes: - # - name: nothing - # emptyDir: {} - mounts: - # - mountPath: /var/nothing - # name: nothing - # readOnly: true - -networkPolicy: - # Enable creation of NetworkPolicy resources. - enabled: false - # For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' - # For Kubernetes v1.7, use 'networking.k8s.io/v1' - apiVersion: networking.k8s.io/v1 - # You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range - internalAgents: - allowed: true - podLabels: {} - namespaceLabels: {} - # project: myproject - externalAgents: {} - # ipCIDR: 172.17.0.0/16 - # except: - # - 172.17.1.0/24 - -## Install Default RBAC roles and bindings -rbac: - create: true - readSecrets: false - -serviceAccount: - create: true - # The name of the service account is autogenerated by default - name: - annotations: {} - extraLabels: {} - imagePullSecretName: - - -serviceAccountAgent: - # Specifies whether a ServiceAccount should be created - create: true - # The name of the ServiceAccount to use. - # If not set and create is true, a name is generated using the fullname template - name: - annotations: - iam.gke.io/gcp-service-account: jenkins-prd-agent@meesho-devops-admin-0622.iam.gserviceaccount.com - extraLabels: {} - imagePullSecretName: - automountServiceAccountToken: true - -cronJob: - apiVersion: batch/v1 - -checkDeprecation: true - -awsSecurityGroupPolicies: - enabled: false - policies: - - name: "" - securityGroupIds: [] - podSelector: {} - -# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md -helmtest: - # A testing framework for bash - bats: - # Bash Automated Testing System (BATS) - image: - # -- Registry of the image used to test the framework - registry: "docker.io" - # -- Repository of the image used to test the framework - repository: "bats/bats" - # -- Tag of the image to test the framework - tag: "1.12.0" + storageClass: local-path + size: 5Gi diff --git a/helm-templates/jenkins-grn/.helmignore b/helm-templates/jenkins-grn/.helmignore deleted file mode 100644 index 701e6bc..0000000 --- a/helm-templates/jenkins-grn/.helmignore +++ /dev/null @@ -1,26 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -ci/ -# do not package unittests -unittests/ -Tiltfile -.helmignore diff --git a/helm-templates/jenkins-grn/CHANGELOG.md b/helm-templates/jenkins-grn/CHANGELOG.md deleted file mode 100644 index cd9d056..0000000 --- a/helm-templates/jenkins-grn/CHANGELOG.md +++ /dev/null @@ -1,3472 +0,0 @@ -# Changelog - -This file documents all notable changes to the Jenkins Helm Chart. -The release numbering uses [semantic versioning](http://semver.org). - -Use the following links to reference issues, PRs, and commits prior to v2.6.0. - -- Issue: `https://github.com/helm/charts/issues/[issue#]` -- PR: `https://github.com/helm/charts/pull/[pr#]` -- Commit: `https://github.com/helm/charts/commit/[commit]/stable/jenkins` - -The changelog until v1.5.7 was auto-generated based on git commits. -Those entries include a reference to the git commit to be able to get more details. - -## 5.8.58 - -Add option to specify the agent image registry - -## 5.8.57 - -Add option to disable the default jenkins controller service - -## 5.8.56 - -Update `jenkins/inbound-agent` to version `3309.v27b_9314fd1a_4-4` - -## 5.8.55 - -Update `kubernetes` to version `4353.vb_47977da_9417` - -## 5.8.54 - -Update `kubernetes` to version `4350.va_0283de0d6d6` - -## 5.8.53 - -Update `jenkins/jenkins` to version `2.504.2-jdk21` - -## 5.8.52 - -Update `configuration-as-code` to version `1971.vf9280461ea_89` - -## 5.8.51 - -Update `kubernetes` to version `4349.v8fe8f2b_ee9f1` - -## 5.8.50 - -Update `kubernetes` to version `4347.va_c0cf1c32f38` - -## 5.8.49 - -Update `jenkins/inbound-agent` to version `3309.v27b_9314fd1a_4-3` - -## 5.8.48 - -Update `docker.io/bats/bats` to version `1.12.0` - -## 5.8.47 - -Fix code styling for super-linter 7 upgrade - -## 5.8.46 - -Update `kubernetes` to version `4340.v345364d31a_2a_` - -## 5.8.45 - -Update `jenkins/inbound-agent` to version `3309.v27b_9314fd1a_4-2` - -## 5.8.44 - -Fix the default value for `controller.sidecars.configAutoReload.env` (change from `{}` to `[]`) to address `coalesce.go:286: warning: cannot overwrite table with non table`. - -## 5.8.43 - -Update `configuration-as-code` to version `1967.va_968e15fd05b_` - -## 5.8.42 - -Update `kubernetes` to version `4336.v55d9a_494db_38` - -## 5.8.41 - -Update `jenkins/inbound-agent` to version `3309.v27b_9314fd1a_4-1` - -## 5.8.40 - -Update `kubernetes` to version `4334.v32b_f157682d6` - -## 5.8.39 - -Update `configuration-as-code` to version `1963.v24e046127a_3f` - -## 5.8.38 - -Update `jenkins/jenkins` to version `2.504.1-jdk21` - -## 5.8.37 - -Update `jenkins/inbound-agent` to version `3307.v632ed11b_3a_c7-2` - -## 5.8.36 - -Update `configuration-as-code` to version `1958.vddc0d369b_e16` - -## 5.8.35 - -Support .Values.agent.garbageCollection also in secondary clouds - -## 5.8.34 - -Added .Values.agent.instanceCap to limit number of agents of each type. - -## 5.8.33 - -Update `configuration-as-code` to version `1953.v148f87d74b_1e` - -## 5.8.32 - -Update `jenkins/jenkins` to version `2.492.3-jdk21` - -## 5.8.31 - -Update `jenkins/jenkins` to version `2.492.3-jdk17` - -## 5.8.30 - -Update `jenkins/inbound-agent` to version `3301.v4363ddcca_4e7-3` - -## 5.8.29 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.30.3` - -## 5.8.28 - -Update `jenkins/inbound-agent` to version `3301.v4363ddcca_4e7-2` - -## 5.8.27 - -Update `jenkins/inbound-agent` to version `3301.v4363ddcca_4e7-1` - -## 5.8.26 - -Update `jenkins/inbound-agent` to version `3299.v0d0d06908537-2` - -## 5.8.25 - -Fix indentation in `values.yaml` - -## 5.8.24 - -Update `workflow-aggregator` to version `608.v67378e9d3db_1` - -## 5.8.23 - -Update `configuration-as-code` to version `1947.v7d33fe23569c` - -## 5.8.22 - -Update `jenkins/inbound-agent` to version `3299.v0d0d06908537-1` - -## 5.8.21 - -Update `kubernetes` to version `4324.vfec199a_33512` - -## 5.8.20 - -Update `jenkins/inbound-agent` to version `3291.vb_131b_dc231fa_-1` - -## 5.8.19 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.30.2` - -## 5.8.18 - -Update `jenkins/jenkins` to version `2.492.2-jdk17` - -## 5.8.17 - -Update `kubernetes` to version `4314.v5b_846cf499eb_` - -## 5.8.16 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.30.1` - -## 5.8.15 - -Update `kubernetes` to version `4313.va_9b_4fe2a_0e34` - -## 5.8.14 - -Update `jenkins/inbound-agent` to version `3283.v92c105e0f819-9` - -## 5.8.13 - -Fix `agentListenerPort` not being updated in `config.xml` when set via Helm values. - -## 5.8.12 - -Update plugin count. - -## 5.8.11 - -Update `jenkins/inbound-agent` to version `3283.v92c105e0f819-8` - -## 5.8.10 - -Update `jenkins/jenkins` to version `2.492.1-jdk17` - -## 5.8.9 - -Update `configuration-as-code` to version `1932.v75cb_b_f1b_698d` - -## 5.8.8 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.30.0` - -## 5.8.7 - -Update `configuration-as-code` to version `1929.v036b_5a_e1f123` - -## 5.8.6 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.29.1` - -## 5.8.5 - -Update `jenkins/inbound-agent` to version `3283.v92c105e0f819-7` - -## 5.8.4 - -Allow setting [automountServiceAccountToken](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) - -## 5.8.3 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.29.0` - -## 5.8.2 - -Update `jenkins/jenkins` to version `2.479.3-jdk17` - -## 5.8.1 - -Update `configuration-as-code` to version `1915.vcdd0a_d0d2625` - -## 5.8.0 - -Add option to publish not-ready addresses in controller service. - -## 5.7.27 - -Update `git` to version `5.7.0` - -## 5.7.26 - -Update `configuration-as-code` to version `1909.vb_b_f59a_27d013` - -## 5.7.25 - -Update `kubernetes` to version `4306.vc91e951ea_eb_d` - -## 5.7.24 - -Update `kubernetes` to version `4304.v1b_39d4f98210` - -## 5.7.23 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.4` - -## 5.7.22 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.3` - -## 5.7.21 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.1` - -## 5.7.20 - -Update `kubernetes` to version `4302.va_756e4b_67715` - -## 5.7.19 - -Update `configuration-as-code` to version `1903.v004d55388f30` - -## 5.7.18 - -Update `kubernetes` to version `4300.vd82c5692b_3a_e` - -## 5.7.17 - -Update `docker.io/bats/bats` to version `1.11.1` - -## 5.7.16 - -Add tpl support for persistence.storageClassName in home-pvc.yaml and tpl support in controller.ingress parameters(ingressClassName, annotations, hostname) in jenkins-controller-ingress.yaml - -## 5.7.15 - -Update `jenkins/jenkins` to version `2.479.2-jdk17` - -## 5.7.14 - -Update `kubernetes` to version `4296.v20a_7e4d77cf6` - -## 5.7.13 - -Update `configuration-as-code` to version `1897.v79281e066ea_7` - -## 5.7.12 - -Update `configuration-as-code` to version `1887.v9e47623cb_043` - -## 5.7.11 - -Update `git` to version `5.6.0` - -## 5.7.10 - -Update `jenkins/jenkins` to version `2.479.1-jdk17` - -## 5.7.9 - -Update `configuration-as-code` to version `1873.vea_5814ca_9c93` - -## 5.7.8 - -Update `jenkins/inbound-agent` to version `3273.v4cfe589b_fd83-1` - -## 5.7.7 - -Update `kubernetes` to version `4295.v7fa_01b_309c95` - -## 5.7.5 - -Fix helm release deployment with flux revision reconciliation - -## 5.7.4 - -Update `kubernetes` to version `4292.v11898cf8fa_66` - -## 5.7.3 - -Update `git` to version `5.5.2` - -## 5.7.2 - -Update `jenkins/jenkins` to version `2.462.3-jdk17` - -## 5.7.1 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.28.0` - -## 5.7.0 - -Add RBAC support for using the `nonroot` and `nonroot-v2` `SecurityContextConstraints` on OpenShift. - -## 5.6.5 - -Update `kubernetes` to version `4290.v93ea_4b_b_26a_61` - -## 5.6.4 - -Update `git` to version `5.5.1` - -## 5.6.3 - -Update `git` to version `5.5.0` - -## 5.6.2 - -Update `kubernetes` to version `4288.v1719f9d0c854` - -## 5.6.1 - -Documentation about OCI installation - -## 5.6.0 - -Helm chart is also now deployed on GitHub packages and can be installed from `oci://ghcr.io/jenkinsci/helm-charts/jenkins` - -## 5.5.16 - -Update `kubernetes` to version `4287.v73451380b_576` - -## 5.5.15 - -Add support for `controller.enableServiceLinks` to disable service links in the controller pod. - -## 5.5.14 - -Update `jenkins/jenkins` to version `2.462.2-jdk17` - -## 5.5.13 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.6` - -## 5.5.12 - -Update `configuration-as-code` to version `1850.va_a_8c31d3158b_` - -## 5.5.11 - -Update `configuration-as-code` to version `1849.v3a_d20568000a_` - -## 5.5.10 - -Update `git` to version `5.4.1` - -## 5.5.9 - -Update `git` to version `5.4.0` - -## 5.5.8 - -Add `agent.garbageCollection` to support setting [kubernetes plugin garbage collection](https://plugins.jenkins.io/kubernetes/#plugin-content-garbage-collection-beta). - -## 5.5.7 - -Update `kubernetes` to version `4285.v50ed5f624918` - -## 5.5.6 - -Add `agent.useDefaultServiceAccount` to support omitting setting `serviceAccount` in the default pod template from `serviceAgentAccount.name`. -Add `agent.serviceAccount` to support setting the default pod template value. - -## 5.5.5 - -Update `jenkins/inbound-agent` to version `3261.v9c670a_4748a_9-1` - -## 5.5.4 - -Update `jenkins/jenkins` to version `2.462.1-jdk17` - -## 5.5.3 - -Update `git` to version `5.3.0` - -## 5.5.2 - -Update `kubernetes` to version `4280.vd919fa_528c7e` - -## 5.5.1 - -Update `kubernetes` to version `4265.v78b_d4a_1c864a_` - -## 5.5.0 - -Introduce capability of set skipTlsVerify and usageRestricted flags in additionalClouds - -## 5.4.4 - -Update CHANGELOG.md, README.md, and UPGRADING.md for linting - -## 5.4.3 - -Update `configuration-as-code` to version `1836.vccda_4a_122a_a_e` - -## 5.4.2 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.5` - -## 5.4.1 - -Update `jenkins/jenkins` to version `2.452.3` - -## 5.4.0 - -Introduce capability of additional mountPaths and logging file paths for config reload container - -## 5.3.6 - -Update `workflow-aggregator` to version `600.vb_57cdd26fdd7` - -## 5.3.5 - -Update `kubernetes` to version `4253.v7700d91739e5` - -## 5.3.4 - -Update `jenkins/jenkins` to version `2.452.3-jdk17` - -## 5.3.3 - -Update `jenkins/inbound-agent` to version `3256.v88a_f6e922152-1` - -## 5.3.2 - -Update `kubernetes` to version `4248.vfa_9517757b_b_a_` - -## 5.3.1 - -Fix Tiltfile deprecated value reference - -## 5.3.0 - -Add `controller.topologySpreadConstraints` - -## 5.2.2 - -Update `kubernetes` to version `4246.v5a_12b_1fe120e` - -## 5.2.1 - -Update `jenkins/jenkins` to version `2.452.2-jdk17` - -## 5.2.0 - -Add `agent.inheritYamlMergeStrategy` to allow configuring this setting on the default agent pod template. - -## 5.1.31 - -Update `kubernetes` to version `4245.vf5b_83f1fee6e` - -## 5.1.30 - -Add `controller.JCasC.configMapAnnotations` to allow setting annotations on the JCasC ConfigMaps. - -## 5.1.29 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.4` - -## 5.1.28 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.3` - -## 5.1.27 - -Update `kubernetes` to version `4244.v4fb_b_00994a_90` - -## 5.1.26 - -Update `kubernetes` to version `4238.v41b_3ef14a_5d8` - -## 5.1.25 - -Update `kubernetes` to version `4236.vc06f753c3234` - -## 5.1.24 - -Update `kubernetes` to version `4234.vdf3e78112369` - -## 5.1.23 - -Update `kubernetes` to version `4233.vb_67a_0e11a_039` - -## 5.1.22 - -Update `configuration-as-code` to version `1810.v9b_c30a_249a_4c` - -## 5.1.21 - -Update `kubernetes` to version `4231.vb_a_6b_8936497d` - -## 5.1.20 - -Update `kubernetes` to version `4230.vceef11cb_ca_37` - -## 5.1.19 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.2` - -## 5.1.18 - -Update `configuration-as-code` to version `1807.v0175eda_00a_20` - -## 5.1.17 - -Update `jenkins/inbound-agent` to version `3248.v65ecb_254c298-1` - -## 5.1.16 - -Update `configuration-as-code` to version `1805.v1455f39c04cf` - -## 5.1.15 - -Update `jenkins/jenkins` to version `2.452.1-jdk17` - -## 5.1.14 - -Update `kubernetes` to version `4219.v40ff98cfb_d6f` - -## 5.1.13 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.27.1` - -## 5.1.12 - -Update `git` to version `5.2.2` - -## 5.1.11 - -Update `kubernetes` to version `4214.vf10083a_42e70` - -## 5.1.10 - -Update `kubernetes` to version `4211.v08850dd0dfa_3` - -## 5.1.9 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.2` - -## 5.1.8 - -Update `kubernetes` to version `4209.vc646b_71e5269` - -## 5.1.7 - -Update `kubernetes` to version `4208.v4017b_a_27a_d67` - -## 5.1.6 - -Update `jenkins/jenkins` to version `2.440.3-jdk17` - -## 5.1.5 - -Fix Prometheus controller name. - -## 5.1.4 - -Update `docker.io/bats/bats` to version `1.11.0` - -## 5.1.3 - -Update `jenkins/jenkins` to version `2.440.2-jdk17` - -## 5.1.2 - -Update `kubernetes` to version `4203.v1dd44f5b_1cf9` - -## 5.1.1 - -Update `kubernetes` to version `4199.va_1647c280eb_2` - -## 5.1.0 - -Add `agent.restrictedPssSecurityContext` to automatically inject in the jnlp container a securityContext that is suitable for the use of the restricted Pod Security Standard - -## 5.0.20 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.1` - -## 5.0.19 - -Introduced helm-docs to automatically generate `values.yaml` documentation. - -## 5.0.18 - -Update `kubernetes` to version `4193.vded98e56cc25` - -## 5.0.17 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.26.0` - -## 5.0.16 - -Enable support for deleting plugin configuration files at startup. - -## 5.0.15 - -Fixed changelog entries for previous version bumps - -## 5.0.14 - -Update `jenkins/jenkins` to version `2.440.1-jdk17` - -## 5.0.13 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `1.25.4` - -## 5.0.12 - -Fix controller.sidecars.additionalSidecarContainers renaming and add tests - -## 5.0.11 - -- Add controller.sidecars.configAutoReload.scheme to specify protocol scheme when connecting Jenkins configuration-as-code reload endpoint -- Add controller.sidecars.configAutoReload.skipTlsVerify to force the k8s-sidecar container to skip TLS verification when connecting to an HTTPS Jenkins configuration-as-code reload endpoint - -## 5.0.10 - -Update `jenkins/inbound-agent` to version `3206.vb_15dcf73f6a_9-3` - -## 5.0.9 - -Update `kubernetes` to version `4186.v1d804571d5d4` - -## 5.0.8 - -Update `configuration-as-code` to version `1775.v810dc950b_514` - -## 5.0.7 - -Update `docker.io/kiwigrid/k8s-sidecar` to version `docker.io/kiwigrid/k8s-sidecar` - -## 5.0.6 - -Removed `docker.io` prefix from inbound-agent image - -## 5.0.5 - -Prefixed artifacthub.io/images with `docker.io` - -## 5.0.4 - -Updated super-linter to v6. Updated README.md and CHANGELOG.md to fix linting issues. - -## 5.0.2 - -Update `git` to version `5.2.1` - -## 5.0.1 - -Update `docker.io/bats/bats` to version `v1.10.0` - -## 5.0.0 - -> [!CAUTION] -> Several fields have been renamed or removed. See [UPGRADING.md](./UPGRADING.md#to-500) - -The Helm Chart is now updated automatically via [Renovate](https://docs.renovatebot.com/) - -## 4.12.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.426.3 - -## 4.12.0 - -Add support for [generic ephemeral storage](https://github.com/jenkinsci/kubernetes-plugin/pull/1489) in `agent.volumes` and `agents.workspaceVolume`. - -| plugin | old version | new version | -| ---------- | ------------------- | ------------------ | -| kubernetes | 4029.v5712230ccb_f8 | 4174.v4230d0ccd951 | - -## 4.11.2 - -Fixed documentation for controller.initScripts. - -## 4.11.1 - -Updated helm-unittest and made unittests compatible. - -## 4.11.0 - -Add multi-cloud support. - -## 4.10.0 - -Bumped Jenkins inbound agent from 3107.v665000b_51092-15 to 3192.v713e3b_039fb_e-5. - -## 4.9.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.426.2 - -Notes about [Artifact Hub](https://artifacthub.io/packages/helm/jenkinsci/jenkins?modal=changelog) changelog processing: - -- Remove empty lines -- Keep only ASCII characters (no emojis) -- One change per line -- Remove table(s) (lines starting by "|") -- Backticks aren't rendered on artifacthub.io changelog - -## 4.9.1 - -Restore artifact hub notes location in CHANGELOG.md - -## 4.9.0 - -Update base images from JDK 11 to JDK 17. - -## 4.8.6 - -Proper `artifacthub.io/changes` changelog annotation preprocessing. - -## 4.8.5 - -Fix `artifacthub.io/changes` changelog annotation added to the released chart. - -## 4.8.4 - -Add `artifacthub.io/changes` changelog annotation to the released chart. - -## 4.8.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.426.1 - -## 4.8.2 - -Add the ability to modify `retentionTimeout` and `waitForPodSec` default value in JCasC - -## 4.8.1 - -Reintroduces changes from 4.7.0 (reverted in 4.7.1), with additional fixes: - -- METHOD is now allowed in `env` and is not duplicated anymore -- No calls to JCasC reload endpoint from the init container - -## 4.8.0 - -Adds support for ephemeralStorage request and limit in Kubernetes plugin JCasC template - -## 4.7.4 - -Add the config-init-script checksum into the controller statefullset pod annotations to trigger restart of the pod in case of updated init scripts. - -## 4.7.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.3 - -## 4.7.1 - -Changes in 4.7.0 were reverted. - -## 4.7.0 - -Runs `config-reload` as an init container, in addition to the sidecar container, to ensure that JCasC YAMLs are present before the main Jenkins container starts. This should fix some race conditions and crashes on startup. - -## 4.6.7 - -Change jenkins-test image label to match the other jenkins images - -## 4.6.5 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.2 - -## 4.6.4 - -Introducing TPL function on variables related to hostname in `./charts/jenkins/templates/jenkins-controller-ingress.yaml` - -## 4.6.3 - -Add values to documentation - -## 4.6.2 - -Update word from hundreds to over 1800 to align with blurb at . - -## 4.6.1 - -Update `configuration-as-code` plugin to fix dependency issues with `azure-ad` plugin - -## 4.6.0 - -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey` to allow overriding the default secret key containing the JKS file. -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName` to allow getting the JKS password from a different secret. -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey` to allow overriding the default secret key containing the JKS password. - -## 4.5.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.1 - -## 4.5.0 - -Added `.Values.persistence.dataSource` to allow cloning home PVC from existing dataSource. - -## 4.4.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.3 - -## 4.4.1 - -Added `.Values.agent.jnlpregistry` to allow agents to be configured with private registry. - -## 4.4.0 - -Add config keys for liveness probes on agent containers. - -## 4.3.30 - -Update Jenkins version in controller test matching LTS version - -## 4.3.29 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.2 - -## 4.3.28 - -Allow the kubernetes API server URL to be configurable. - -## 4.3.27 - -Bump kiwigrid/k8s-sidecar from 1.23.1 to 1.24.4 and jenkins/inbound-agent from 3107.v665000b_51092-5 to 3107.v665000b_51092-15. - -## 4.3.26 - -Fix various typos in the chart documentation. - -## 4.3.25 - -| plugin | old version | new version | -| --------------------- | -------------------- | --------------------- | -| kubernetes | 3900.va_dce992317b_4 | 3937.vd7b*82db_e347b* | -| configuration-as-code | 1625.v27444588cc3d | 1647.ve39ca_b_829b_42 | -| git | 5.0.0 | 5.1.0 | -| ldap | 671.v2a_9192a_7419d | 682.v7b_544c9d1512 | - -## 4.3.24 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.1 - -## 4.3.23 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.3 - -## 4.3.22 - -Bump chart version. - -## 4.3.21 - -Document building charts for weekly releases. - -## 4.3.20 - -Enhance repository appearance and miscellaneous cleanup. - -## 4.3.19 - -Comply with superlinter rules and address ShellCheck issues. - -## 4.3.18 - -Bump kiwigrid/k8s-sidecar from 1.15.0 to 1.23.1. - -## 4.3.17 - -Bump jenkins/inbound-agent from 4.11.2-4 to 3107.v665000b_51092-5. - -## 4.3.16 - -Update bundled plugins: - -- [ldap](https://plugins.jenkins.io/ldap/): From 2.5 to 671.v2a_9192a_7419d -- [kubernetes](https://plugins.jenkins.io/kubernetes/): From 3734.v562b_b_a_627ea_c to 3900.va_dce992317b_4 -- [workflow-aggregator](https://plugins.jenkins.io/workflow-aggregator/): From 590.v6a_d052e5a_a_b_5 to 590.v6a_d052e5a_a_b_5 -- [configuration-as-code](https://plugins.jenkins.io/configuration-as-code/): From 1569.vb_72405b_80249 to 1625.v27444588cc3d - -## 4.3.15 - -Update bats from 1.2.1 to 1.9.0. - -## 4.3.14 - -Update various GH actions, typo fixes, and miscellaneous chores. - -## 4.3.13 - -Bump helm-unittest from 0.2.8 to 0.2.11. - -## 4.3.12 - -Update wording in values.yml. - -## 4.3.11 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.2 - -## 4.3.10 - -Correct incorrect env var definition -Disable volume mount if disableSecretMount enabled - -## 4.3.9 - -Document `.Values.agent.directConnection` in readme. -Add default value for `.Values.agent.directConnection` to `values.yaml` - -## 4.3.8 - -Added `.Values.agent.directConnection` to allow agents to be configured to connect direct to the JNLP port on the -controller, preventing the need for an external HTTP endpoint for this purpose. - -## 4.3.7 - -Added `.Values.controller.shareProcessNamespace` and `.Values.controller.httpsKeyStore.disableSecretMount` to enable sourcing TLS certs from external issuers - -## 4.3.6 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.1 - -## 4.3.5 - -Added `.Values.helmtest.bats.image` and `.Values.helmtest.bats.image` to allow unit tests to be configurable. Fixes [https://github.com/jenkinsci/helm-charts/issues/683] - -## 4.3.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.3 - -## 4.3.3 - -Removed hardcoding of chart version in tests to make maintenance easier - -## 4.3.2 - -Added `.Values.serviceAccount.extraLabels` on Service Account -Added `.Values.serviceAccountAgent.extraLabels` on Agent's Service Account - -## 4.3.0 - -Moved use of `.Values.containerEnv` within `jenkins` Container to top of `env` block to allow for subsequent Environment Variables to reference these additional ones. - -## 4.2.21 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.2 - -## 4.2.20 - -Fixed the `controller.prometheus.metricRelabelings` being unable to convert the value to the ServiceMonitor. -Added `controller.prometheus.relabelings` to allow relabling before scrape. -Added default values for `controller.prometheus.relabelings` and `controller.prometheus.metricRelabelings`. - -## 4.2.19 - -CronJob API version upgraded to batch/v1 - -## 4.2.18 - -Added option to set secretEnvVars. - -## 4.2.17 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.1 - -## 4.2.16 - -Fixed chart notes not rendering Jenkins URL with prefix when `controller.jenkinsUriPrefix` is set. -Fixed chart notes not rendering Jenkins URL with `https` when `controller.ingress.tls` or `controller.controller.httpsKeyStore.enable` is set. -Fixed chart notes rendering wrong JCasC URL when not using `controller.ingress`. - -## 4.2.15 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.4 - -## 4.2.14 - -Added option to mount all keys from an existing k8s secret - -## 4.2.13 - -Adding `tpl` to `controller.additionalExistingSecrets` - -## 4.2.12 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.3 - -## 4.2.11 - -Update default plugin versions - -| plugin | old version | new version | -| --------------------- | ------------------- | ---------------------- | -| kubernetes | 3706.vdfb_d599579f3 | 3734.v562b_b_a_627ea_c | -| git | 4.11.5 | 4.13.0 | -| configuration-as-code | 1512.vb_79d418d5fc8 | 1569.vb_72405b_80249 | - -## 4.2.10 - -Fix grammar and typos - -## 4.2.9 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.2 - -## 4.2.8 - -Modify the condition to trigger copying jenkins_config files when configAutoReload option is disabled during Jenkins initialization - -## 4.2.7 - -Support for remote URL for configuration - -## 4.2.6 - -Add option to set hostnetwork for agents - -## 4.2.5 - -Add an extra optional argument to extraPorts in order to specify targetPort - -## 4.2.4 - -Remove k8s capibility requirements when setting priority class for controller - -## 4.2.3 Update plugin versions - -| plugin | old version | new version | -| --------------------- | --------------------- | --------------------- | -| kubernetes | 3600.v144b*cd192ca_a* | 3706.vdfb_d599579f3 | -| workflow-aggregator | 581.v0c46fa_697ffd | 590.v6a_d052e5a_a_b_5 | -| configuration-as-code | 1429.v09b_044a_c93de | 1512.vb_79d418d5fc8 | -| git | 4.11.3 | 4.11.5 | - -Resolve version conflict between default install of plugins. - -## 4.2.2 - -Support Google Managed Prometheus - -## 4.2.1 - -Remove option to provide command and args of agent as YAML. This feature was never supported by the Jenkins Kubernetes -plugin. - -## 4.2.0 - -Add option to provide additional containers to agents - -## 4.1.18 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.1 - -## 4.1.17 - -Update Jenkins casc default settings to allow `security` configs to be provided - -## 4.1.16 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.3 - -## 4.1.15 - -`projectNamingStrategy` is configurable in default config. - -## 4.1.14 - -If `installPlugins` is disabled, don't create unused plugins volume. - -## 4.1.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.2 - -## 4.1.12 - -If keystore is defined, it is now also made available in the initContainer. - -## 4.1.11 - -JCasC ConfigMaps now generate their name from the `jenkins.casc.configName` helper - -## 4.1.10 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.1 - -## 4.1.9 - -Allow setting `imagePullSecret` for backup job via `backup.imagePullSecretName` - -## 4.1.8 - -Fix path of projected secrets from `additionalExistingSecrets`. - -## 4.1.7 - -Update readme with explanation on the required environmental variable `AWS_REGION` in case of using an S3 bucket. - -## 4.1.6 - -project adminSecret, additionalSecrets and additionalExistingSecrets instead of mount with subPath - -## 4.1.5 - -Update readme to fix `JAVA_OPTS` name. - -## 4.1.4 - -Update plugins - -## 4.1.3 - -Update jenkins-controller-statefulset projected volumes definition - -## 4.1.1 - -Added 'controller.prometheus.metricRelabelings' to allow relabling and dropping unused prometheus metrics - -## 4.1.0 - -Added `controller.sidecars.configAutoReload.envFrom`, `controller.initContainerEnvFrom`, `controller.containerEnvFrom` - -## 4.0.1 - -No code changes - CI updated to run unit tests using Helm 3.8.2. - -## 4.0.0 - -Removes automatic `remotingSecurity` setting when using a container tag older than `2.326` (introduced in [`3.11.7`](#3117)). If you're using a version older than `2.326`, you should explicitly set `.controller.legacyRemotingSecurityEnabled` to `true`. - -## 3.12.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.3 - -## 3.12.1 - -Make namespace configurable for agents and additional agents. - -## 3.12.0 - -Added a flag for disabling the default Jenkins Agent configuration. - -## 3.11.10 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.2 - -## 3.11.9 Bump configuration-as-code plugin version - -| plugin | old version | new version | -| --------------------- | ----------- | ------------------ | -| configuration-as-code | 1.51 | 1414.v878271fc496f | - -## 3.11.8 - -Make [externalTrafficPolicy](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies) and `loadBalancerSourceRanges` fields customizable for Agent listener service via `controller.agentListenerExternalTrafficPolicy` and `controller.loadBalancerSourceRanges`. - -## 3.11.7 - -Removed Configuration as Code `remotingSecurity` section for Jenkins 2.326 or newer. See [Documentation](https://www.jenkins.io/redirect/AdminWhitelistRule) to learn more. - -## 3.11.6 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.1 - -## 3.11.5 - -Change Backup Role name function call to match the RoleDef function call in the Backup RoleBinding - -## 3.11.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.3 - -## 3.11.3 - -Update kiwigrid/k8s-sidecar:1.15.0 -Update jenkins/inbound-agent:4.11.2-4 - -## 3.11.2 - -Improve example for workspaceVolume. Clarify that this is not a list. - -## 3.11.1 - -Update configuration-as-code plugin to 1.55.1 - -## 3.11.0 - -Update default plugin versions - -| plugin | old version | new version | -| ---------- | ----------- | ----------- | -| kubernetes | 1.31.1 | 1.31.3 | -| git | 4.10.1 | 4.10.2 | - -## 3.10.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.2 - -## 3.10.2 - -Fix definition of startupProbe when deploying on a Kubernetes cluster < 1.16 - -## 3.10.1 - -correct VALUES_SUMMARY.md for installLatestPlugins - -## 3.10.0 - -Update default plugin versions - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.30.11 | 1.31.1 | -| git | 4.10.0 | 4.10.1 | -| configuration-as-code | 1.54 | 1.55 | - -## 3.9.4 - -Add JAVA_OPTIONS to the readme so proxy settings get picked by jenkins-plugin-cli - -## 3.9.3 - -Fix config reload request URL when httpsKeystore in use - -## 3.9.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.1 -Update following plugins: - -- kubernetes:1.30.11 -- git:4.10.0 -- configuration-as-code:1.54 - -## 3.9.1 - -Adding `tpl` to `controller.overrideArgs` - -## 3.9.0 - -Added containerSecurityContext - -## 3.8.9 - -Fix mounting of HTTPS keystore secret when httpsKeyStore is enabled - -## 3.8.8 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.3 - -## 3.8.7 - -Adding `tpl` to `initScripts` - -## 3.8.6 - -Add `controller.tagLabel` to specify the label for the image tag, for example `jdk11` or `alpine` - -## 3.8.5 - -Move jenkins web root outside of home dir - -## 3.8.4 - -Add `controller.initConfigMap` to pass pre-existing `init.groovy.d` ConfigMaps to the controller - -## 3.8.3 - -Update missed reference to jenkins/inbound-agent:4.11-1 - -## 3.8.2 - -Update jenkins/inbound-agent:4.11-1 - -## 3.8.1 - -Update jenkins/inbound-agent:4.10-3 - -## 3.8.0 - -Update kiwigrid/k8s-sidecar:1.14.2 - -## 3.7.1 - -Update git and casc plugins versions - -## 3.7.0 - -Added the option to create AWS SecurityGroupPolicy resources - -## 3.6.2 - -Fix httpsKeyStore mount when `controller.httpsKeyStore.enable` is `true` - -## 3.6.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.2 - -## 3.6.0 - -Support custom agent pod labels - -## 3.5.20 - -Disallow ingress on port 50000 when agent listener is disabled - -## 3.5.19 - -Add support for specifying termination-log behaviour for Jenkins controller - -## 3.5.18 - -Add support for creating a Pod Disruption Budget for Jenkins controller - -## 3.5.17 - -Update workdingDir to `/home/jenkins/agent` - -## 3.5.16 - -Update location of icon (wiki.jenkins.io is down) - -## 3.5.15 - -Add support for adding labels to the Jenkins home Persistent Volume Claim (pvc) - -## 3.5.14 - -- Updated versions of default plugins -- Use verbose logging during plugin installation -- download the latest version of all plugin dependencies (Fixes #442) - -## 3.5.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.1 - -## 3.5.12 - -Added extended documentation for Backup and Restore. - -## 3.5.11 - -Sanitized the Jenkins Label - -## 3.5.10 - -Fixed `controller.customJenkinsLabels` not getting templated into the controller `labelString:` field in JCasC - -## 3.5.9 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.3 - -## 3.5.8 - -Add parameter `backup.serviceAccount.create` to disable service account creation for backup service and `backup.serviceAccount.name` to allow change of the SA name. -`backup.annotations` was moved to `backup.serviceAccount.annotations` - -## 3.5.7 - -Enable setting `controller.serviceExternalTrafficPolicy` to set [the standard Service option](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip). `externalTrafficPolicy` denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. - -## 3.5.6 - -Add optional `controller.initContainerResources`, if set, it will change resources allocation for init controller, overwise the `controller.resources` will be used - -## 3.5.5 - -Allow to configure nodeUsageMode via `agent.nodeUsageMode` - -## 3.5.4 - -Update tests to work with unittest 0.2.6 - -## 3.5.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.2 - -## 3.5.2 - -Enable setting `controller.installLatestSpecifiedPlugins` to set whether to download the latest dependencies of any plugin that is requested to have the latest version. - -## 3.5.1 - -Fix activeDeadlineSeconds wrong type bug in jenkins-backup-cronjob template - -## 3.5.0 - -Allow `controller.podAnnotations` to be render as a template - -## 3.4.1 - -Allow showRawYaml for the default agent's pod template to be customized. - -## 3.4.0 - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.275` to `kiwigrid/k8s-sidecar:1.12.2` - -## 3.3.23 - -Make `controller.ingress.resourceRootUrl` compatible with API version networking.k8s.io/v1 on k8s >= 1.19.x - -## 3.3.22 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.1 - -## 3.3.21 - -`persistence.mounts` additionally mount to init container to allow custom CA certificate keystore - -## 3.3.18 - -Added `controller.overrideArgs` so any cli argument can be passed to the WAR. - -## 3.3.17 - -Correct docs on disabling plugin installation - -## 3.3.16 - -Support generating `SecretClaim` resources in order to read secrets from HashiCorp Vault into Kubernetes using `kube-vault-controller`. - -## 3.3.15 - -Prevent `controller.httpsKeyStore` from improperly being quoted, leading to an invalid location on disk - -## 3.3.14 - -Correct docs on disabling plugin installation - -## 3.3.13 - -Update plugins - -## 3.3.12 - -Add `controller.additionalExistingSecrets` property - -## 3.3.11 - -Add support for disabling the Agent listener service via `controller.agentListenerEnabled`. - -## 3.3.10 - -Update Jenkins image and appVersion to jenkins lts release version 2.277.4 - -## 3.3.9 - -- Change helper template so user defined `agent.jenkinsUrl` value will always be used, if set -- Simplify logic for `jenkinsUrl` and `jenkinsTunnel` generation: always use fully qualified address - -## 3.3.8 - -Update Jenkins image and appVersion to jenkins lts release version 2.277.3 - -## 3.3.7 - -fix controller-ingress line feed bug - -## 3.3.6 - -Update Git plugin version to v4.7.1 -Update ldap plugin version to v2.5 - -## 3.3.5 - -Use tpl function for environment vars. Fixes [https://github.com/jenkinsci/helm-charts/issues/324] - -## 3.3.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.277.2 - -## 3.3.3 - -Enable setting `controller.installLatestPlugins` to set whether to download the minimum required version of all dependencies. - -## 3.3.2 - -Add `controller.additionalSecrets` documentation - -## 3.3.1 - -Add `controller.additionalSecrets` property - -## 3.3.0 - -Change default Jenkins image to `jdk11` variant - -## 3.2.6 - -Add missing `controller.jenkinsUrlProtocol` property - -## 3.2.5 - -Add additional metadata `artifacthub.io/images` for artifacthub - -## 3.2.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.277.1 -Update Git plugin version to v4.6.0 -Update kubernetes plugin version to v1.29.2 - -## 3.2.3 - -Fix rendering `controller.ingress.path` - -## 3.2.2 - -Added description for `controller.jenkinsUrl` value - -## 3.2.1 - -Enable setting ImagePullSecrets to controller and agent service accounts. - -## 3.2.0 - -Calculate consistent unique agent IDs to be used in pod templates. Fixes [https://github.com/jenkinsci/helm-charts/issues/270] - -## 3.1.15 - -Fix documentation for the kubernetes probes - -## 3.1.14 - -Typo in documentation - -## 3.1.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.4 - -## 3.1.12 - -Added GitHub Action to automate the updating of LTS releases. - -## 3.1.11 - -Enable setting controller.updateStrategy to change the update strategy for StatefulSet - -## 3.1.10 - -Fixed issue for the AgentListener where it was not possible to attribute a NodePort - -## 3.1.9 - -Upgrade kubernetes plugin to 1.29.0 and CasC plugin to 1.47 - -## 3.1.8 - -Fix init scripts config map name - -## 3.1.7 - -Fix missing newline when `httpsKeyStore` is enabled - -## 3.1.6 - -Mount controller init scripts from ConfigMap - -## 3.1.5 - -Fix `namespaceOverride` not applied when loading JCasC - -## 3.1.4 - -Update Git plugin version to v4.5.2 - -## 3.1.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.3 - -## 3.1.2 - -Enable setting maxRequestsPerHostStr to change the max concurrent connections to Kubernetes API - -## 3.1.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.2 - -## 3.1.0 - -- Added `.Values.controller.podSecurityContextOverride` and `.Values.backup.podSecurityContextOverride`. -- Added simple default values tests for `jenkins-backup-cronjob.yaml`. - -## 3.0.14 - -Enable to only backup job folder instead of whole jenkins - -## 3.0.13 - -Improve Documentation around JCasc and Custom Image - -## 3.0.12 - -Added GitHub Action testing on Kind 1.16, 1.17, 1.18, 1.19 & 1.20 - -## 3.0.11 - -Fixes & unit tests for Ingress resources on Kubernetes 1.19 and above - -## 3.0.10 - -Ingress resources on Kubernetes 1.19 (or above) are created with the version `networking.k8s.io/v1` - -## 3.0.9 - -Added support for backing up to Azure Blob Storage. - -## 3.0.8 - -- Typo in documentation - -## 3.0.7 - -- Add support for setting default agent workspaceVolume - -## 3.0.6 - -Use 2.263.1 image - -## 3.0.5 - -- Update appVersion to reflect new jenkins lts release version 2.263.1 - -## 3.0.4 - -- Fix documentation for additional secret mounts - -## 3.0.3 - -- Update `README.md` with explanation on how to mount additional secrets - -## 3.0.2 - -- Fix `.Values.controller.tolerations` and `.Values.controller.nodeSelector` variable names in templates\jenkins-backup-cronjob.yaml - -## 3.0.1 - -- added 'runAsNonroot' to security context - -## 3.0.0 - -- Chart uses StatefulSet instead of Deployment -- XML configuration was removed in favor of JCasC -- chart migrated to helm 3.0.0 (apiVersion v2) -- offending terms have been removed -- values have been renamed and re-ordered to make it easier to use -- already deprecated items have been removed -- componentName for the controller is now `jenkins-controller` -- componentName for the agent is now `jenkins-agent` -- container names are now - - `init` for the init container which downloads Jenkins plugins - - `jenkins` for the Jenkins controller - - `config-reload` for the sidecar container which automatically reloads JCasC -- Updated UI tests to use official `bats/bats` image instead of `dduportal/bats` - -For migration instructions from previous versions and additional information check README.md. - -## 2.19.0 - -- Use lts version 2.249.3 -- Update kubernetes, workflow-aggregator, git and configuration-as-code plugins. -- Fail apply_config.sh script if an error occurs. - -## 2.18.2 - -Fix: `master.javaOpts` issue with quoted values - -## 2.18.1 - -Recommend installing plugins in custom image - -## 2.18.0 - -Removed /tmp volume. Making /tmp a volume causes permission issues with jmap/jstack on certain Kubernetes clusters - -## 2.17.1 - -Fix location of jenkins.war file. -It is located in `/usr/share/jenkins/jenkins.war` and can be fonfigured via `master.jenkinsWar`. - -## 2.17.0 - -Add support for plugin-installation-manager-tool - -## 2.16.0 - -Added Startup probe for Jenkins pod when Kubernetes cluster is 1.16 or newer - -## 2.15.5 - -scriptApproval is taken into account when enableXmlConfig is false. - -## 2.15.4 - -Add Tilt support for easier helm chart development. - -## 2.15.3 - -Fix error on missing `ingress.paths` value - -## 2.15.2 - -Added documentation for ingress and jenkins URL - -## 2.15.1 - -Fix priorityClassName entry in values.yaml file - -## 2.15.0 - -Added support for disabling the helm.sh/chart annotation - -## 2.14.0 - -Added support for annotations in podTemplates - -## 2.13.2 - -Add nodeSelector in the backup pod -Fix tolerations in the backup pod - -## 2.13.1 - -Update list of maintainers - -## 2.13.0 - -Added Support for websockets in the default Jcasc config -Added trailing slash to JENKINS_URL env var - -## 2.12.2 - -Added unit tests for most resources in the Helm chart. - -## 2.12.1 - -Helm chart readme update - -## 2.12.0 - -Add option to configure securityContext capabilities - -## 2.11.0 - -Added configurable security context for jenkins backup CronJob and annotations to its serviceaccount. - -## 2.10.0 - -Make activeDeadlineSeconds for backup job configurable - -## 2.9.0 - -Make namespace of PrometheusRule configurable - -## 2.8.2 - -Bumped configuration-as-code plugin version from 1.41 to 1.43. -See [configuration-as-code plugin issue #1478](https://github.com/jenkinsci/configuration-as-code-plugin/issues/1478) - -## 2.8.1 - -Fix indentation of JAVA_OPTS - -## 2.8.0 - -Add support for helm unittest and include first tests - -## 2.7.2 - -Target port of container `jenkins-sc-config` taken the value from values.yaml. - -## 2.7.0 - -Add a secondary ingress template for those who want a second ingress with different labels or annotations or whatever else. - -Example: You want /github-webhook to be on a public ingress, while the main Jenkins intance to be on a private locked down ingress. - -## 2.6.5 - -Update configScripts example - -## 2.6.4 - -Add timja as a maintainer - -## 2.6.3 - -Update k8s-sidecar image to 0.1.193 - -## 2.6.2 - -Only mount empty dir secrets-dir if either `master.enableXmlConfig` or `master.secretsFilesSecret` is set -Fixes #19 - -## 2.6.1 Do not render empty JCasC templates - -## 2.6.0 First release in jenkinsci GitHub org - -Updated readme for new location - -## 2.5.2 - -Fix as per JENKINS-47112 - -## 2.5.1 - -Support Jenkins Resource Root URL - -## 2.5.0 - -Add an option to specify that Jenkins master should be initialized only once, during first install. - -## 2.4.1 - -Reorder readme parameters into sections to facilitate chart usage and maintenance - -## 2.4.0 Update default agent image - -`jenkins/jnlp-slave` is deprected and `jenkins/inbound-agent` should be used instead. -Also updated it to newest version (4.3-4). - -## 2.3.3 correct templating of master.slaveJenkinsUrl - -Fixes #22708 - -## 2.3.2 Fix wrong value for overwritePluginsFromImage - -Fixes #23003 -Fixes #22633 - -Also fixes indentation for #23114 - -## 2.3.1 - -Always mount {{ .Values.master.jenkinsRef }}/secrets/ directory. Previous it -was mounted only when `master.enableXmlConfig` was enabled. - -## 2.3.0 - -Add an option to specify pod based on labels that can connect to master if NetworkPolicy is enabled - -## 2.2.0 increase retry for config auto reload - -Configure `REQ_RETRY_CONNECT` to `10` to give Jenkins more time to start up. - - -Value can be configured via `master.sidecars.configAutoReload.reqRetryConnect` - -## 2.1.2 updated readme - -## 2.1.1 update credentials-binding plugin to 1.23 - -## 2.1.0 - -Add support to set `runAsUser` and `runAsGroup` for `agent`. - -## 2.0.1 - -Only render authorizationStrategy and securityRealm when values are set. - -## 2.0.0 Configuration as Code now default + container does not run as root anymore - -The readme contains more details for this update. -Please note that the updated values contain breaking changes. - -## 1.27.0 Update plugin versions & sidecar container - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.25.3 | 1.25.7 | -| workflow-job | 2.38 | 2.39 | -| credentials-binding | 1.21 | 1.22 | -| configuration-as-code | 1.39 | 1.41 | - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.132` to `kiwigrid/k8s-sidecar:0.1.144` - -## 1.26.0 - -Add support to override `workingDir` for default pod template - -## 1.25.0 - -Add support for installing plugins in addition to the chart's default plugins via `master.additionalPlugins` - -## 1.24.0 - -Allow configuration of yamlMergeStrategy via `agent.yamlMergeStrategy` - -## 1.23.2 - -In the `jenkins.xml.podTemplate` helper function, allow templating of all string values under `agent.volumes` except `type` by rendering them with the `tpl` function - -## 1.23.1 - -Added auto detection for Ingress API version - -## 1.23.0 - -Allow to use an existing secret for the jenkins admin credentials - -## 1.22.0 - -Add support for UI security in the default JCasC via `master.JCasC.securityRealm` and `master.JCasC.authorizationStrategy` which deny anonymous access by default - -## 1.21.3 - -Render `agent.envVars` in kubernetes pod template JCasC - -## 1.21.2 - -Cleanup `agent.yamlTemplate` rendering in kubernetes pod template XML configuration - -## 1.21.1 - -Render `agent.nodeSelector` in the kubernetes pod template JCasC - -## 1.21.0 - -Add support for overriding Ingress paths via `master.ingress.paths` - -## 1.20.0 - -Add the following options for configuring the Kubernetes plugin. - -- master.slaveDefaultsProviderTemplate -- master.slaveJenkinsUrl -- master.slaveJenkinsTunnel -- master.slaveConnectTimeout -- master.slaveReadTimeout - -## 1.19.0 - -Add support for disabling remember me via `master.disableRememberMe` -Add support for using a different markup formatter via `master.markupFormatter` - -## 1.18.1 - -Add support for executor mode configuraton with `master.executorMode`. - -## 1.18.0 Make installation of configuration-as-code plugin explicit - -Instead of configuring the configuration-as-code plugin version via -`master.JCasC.pluginVersion` it is now installed via `master.installPlugins` - -## 1.17.2 - -Allow templating of `serviceAccount.annotations` and `serviceAccountAgent.annotations` by rendering them with the `tpl` function - -## 1.17.1 - -Add support for Persistent Volume Claim (PVC) in `agent.volumes` - -## 1.17.0 - -Render `agent.volumes` in kubernetes pod template JCasC - -## 1.16.2 - -Reverts 1.16.1 as it introduced an error #22047 - -## 1.16.1 - -Fixed a bug with master.runAsUser variable due to use wrong type for comparison. - -## 1.16.0 - -Add `master.overwritePluginsFromImage` to allow support for jenkins plugins installed in the master image to persist. - -## 1.15.0 Update plugin versions & sidecar container - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.25.1 | 1.25.3 | -| workflow-job | 2.36 | 2.38 | -| git | 4.2.0 | 4.2.2 | -| configuration-as-code | 1.36 | 1.39 | - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.20` to `kiwigrid/k8s-sidecar:0.1.132` - -## 1.14.0 - -support auto-reload container environment variables configuration - -## 1.13.3 - -Fix wrong indent in tolerations - -## 1.13.2 - -Add support for custom ClusterIP - -## 1.13.1 - -Fix `agent.yamlTemplate` rendering in kubernetes pod template JCasC - -## 1.13.0 - -Add `master.networkPolicy.internalAgents` and `master.networkPolicy.externalAgents` stanzas to fine grained controls over where internal/external agents can connect from. Internal ones are allowed based on pod labels and (optionally) namespaces, and external ones are allowed based on IP ranges. - -## 1.12.0 Support additional agents - -Add support for easy configuration of additional agents which inherit values from `agent`. - -## 1.11.3 - -Update the kubernetes plugin from 1.24.1 to 1.25.1 and grant 'watch' permission to 'events' which is required since this plugin version. - -## 1.11.2 Configure agent.args in values.yaml - -## 1.11.1 Support for master.additionalConfig - -Fixed a bug with jenkinsHome variable in range block when master.additionalConfig is set - Helm cannot evaluate field Values in type interface {}. - -## 1.11.0 Add support for configuring custom pod templates - -Add `agent.podTemplates` option for declaring custom pod templates in the default configured kubernetes cloud. - -## 1.10.1 Only copy JCasC files if there are any - -The chart always tried to copy Configuration as Code configs even if there are none. That resulted in an error which is resolved with this. - -## 1.10.0 Remove configuration-as-code-support plugins - -In recent version of configuration-as-code-plugin this is no longer necessary. - -## 1.9.24 - -Update JCasC auto-reload docs and remove stale SSH key references from version "1.8.0 JCasC auto reload works without SSH keys" - -## 1.9.23 Support jenkinsUriPrefix when JCasC is enabled - -Fixed a bug in the configuration as code reload URL, where it wouldn't work with a jenkinsUriPrefix set. - -## 1.9.22 - -Add `master.jenkinsHome` and `master.jenkinsRef` options to use docker images derivates from Jenkins - -## 1.9.21 - -Add `master.terminationGracePeriodSeconds` option - -## 1.9.20 - -Update default plugins - -- kubernetes:1.24.1 -- workflow-job:2.36 -- workflow-aggregator:2.6 -- credentials-binding:1.21 -- git:4.2.0 -- configuration-as-code:1.36 - -## 1.9.19 - -Update docs for Helm 3 - -## 1.9.18 - -Make `jenkins-home` attachable to Azure Disks without pvc - -```yaml -volumes: - - name: jenkins-home - azureDisk: - kind: Managed - diskName: myAKSDisk - diskURI: /subscriptions//resourceGroups/MC_myAKSCluster_myAKSCluster_eastus/providers/Microsoft.Compute/disks/myAKSDisk -``` - -## 1.9.16 - -Fix PodLabel for NetworkPolicy to work if enabled - -## 1.9.14 - -Properly fix case sense in `Values.master.overwriteConfig` in `config.yaml` - -## 1.9.13 - -Fix case sense in `Values.master.overwriteConfig` in `config.yaml` - -## 1.9.12 - -Scriptapprovals are overwritten when overwriteConfig is enabled - -## 1.9.10 - -Added documentation for `persistence.storageClass`. - -## 1.9.9 - -Make `master.deploymentAnnotation` configurable. - -## 1.9.8 - -Make `agent.slaveConnectTimeout` configurable: by increasing this value Jenkins will not cancel&ask k8s for a pod again, while it's on `ContainerCreating`. Useful when you have big images or autoscaling takes some time. - -## 1.9.7 Update plugin versions - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.18.2 | 1.21.2 | -| workflow-job | 2.33 | 2.36 | -| credentials-binding | 1.19 | 1.20 | -| git | 3.11.0 | 4.0.0 | -| configuration-as-code | 1.27 | 1.32 | - -## 1.9.6 - -Enables jenkins to use keystore inorder to have native ssl support #17790 - -## 1.9.5 Enable remoting security - -`Manage Jenkins` -> `Configure Global Security` -> `Enable Agent → Master Access Control` is now enabled via configuration as code plugin - -## 1.9.4 Option to set existing secret with Google Application Default Credentials - -Google application credentials are kept in a file, which has to be mounted to a pod. You can set `gcpcredentials` in `existingSecret` as follows: - -```yaml -existingSecret: - jenkins-service-account: - gcpcredentials: application_default_credentials.json -``` - -Helm template then creates the necessary volume mounts and `GOOGLE_APPLICATION_CREDENTIALS` environmental variable. - -## 1.9.3 Fix `JAVA_OPTS` when config auto-reload is enabled - -## 1.9.2 Add support for kubernetes-credentials-provider-plugin - -[kubernetes-credentials-provider-plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/) needs permissions to get/watch/list kubernetes secrets in the namespaces where Jenkins is running. - -The necessary role binding can be created using `rbac.readSecrets` when `rbac.create` is `true`. - -To quote from the plugin documentation: - -> Because granting these permissions for secrets is not something that should be done lightly it is highly advised for security reasons that you both create a unique service account to run Jenkins as, and run Jenkins in a unique namespace. - -Therefor this is disabled by default. - -## 1.9.1 Update kubernetes plugin URL - -## 1.9.0 Change default serviceType to ClusterIP - -## 1.8.2 - -Revert fix in `1.7.10` since direct connection is now disabled by default. - -## 1.8.1 - -Add `master.schedulerName` to allow setting a Kubernetes custom scheduler - -## 1.8.0 JCasC auto reload works without SSH keys - -We make use of the fact that the Jenkins Configuration as Code Plugin can be triggered via http `POST` to `JENKINS_URL/configuration-as-code/reload`and a pre-shared key. -The sidecar container responsible for reloading config changes is now `kiwigrid/k8s-sidecar:0.1.20` instead of it's fork `shadwell/k8s-sidecar`. - -References: - -- [Triggering Configuration Reload](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md) -- [kiwigrid/k8s-sidecar](https://hub.docker.com/r/kiwigrid/k8s-sidecar) - -`master.sidecars.configAutoReload.enabled` now works using `casc.reload.token` - -## 1.7.10 - -Disable direct connection in default configuration (when kubernetes plugin version >= 1.20.2). -Note: In case direct connection is going to be used `jenkins/jnlp-slave` needs to be version `3.35-5` or newer. - -## 1.7.9 - -Prevented Jenkins Setup Wizard on new installations - -## 1.7.8 - -Extend extraPorts to be opened on the Service object, not just the container. - -## 1.7.7 - -Add persistentvolumeclaim permission to the role to support new dynamic pvc workspaces. - -## 1.7.6 - -Updated `master.slaveKubernetesNamespace` to parse helm templates. -Defined an sensible empty value to the following variables, to silence invalid warnings: - -- master.extraPorts -- master.scriptApproval -- master.initScripts -- master.JCasC.configScripts -- master.sidecars.other -- agent.envVars -- agent.volumes - -## 1.7.5 - -Fixed an issue where the JCasC won't run if JCasC auto-reload is enabled [issue #17135](https://github.com/helm/charts/issues/17135) - -## 1.7.4 - -Comments out JCasC example of jenkins.systemMessage so that it can be used by end users. Previously, an attempt to set systemMessage causes Jenkins to startup, citing duplicate JCasC settings for systemMessage [issue #13333](https://github.com/helm/charts/issues/13333) - -## 1.7.2 - -Update kubernetes-plugin to version 1.18.2 which fixes frequently encountered [JENKINS-59000](https://issues.jenkins-ci.org/plugins/servlet/mobile#issue/JENKINS-59000) - -## 1.7.1 - -Update the default requirements for jenkins-agent to 512Mi which fixes frequently encountered [issue #3723](https://github.com/helm/charts/issues/3723) - -## 1.7.0 - -[Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) default configuration can now be enabled via `master.JCasC.defaultConfig`. - -JCasC default configuration includes: - -- Jenkins URL -- Admin email `master.jenkinsAdminEmail` -- crumbIssuer -- disableRememberMe: false -- mode: NORMAL -- numExecutors: {{ .Values.master.numExecutors }} -- projectNamingStrategy: "standard" -- kubernetes plugin - - containerCapStr via `agent.containerCap` - - jenkinsTunnel - - jenkinsUrl - - maxRequestsPerHostStr: "32" - - name: "kubernetes" - - namespace - - serverUrl: `"https://kubernetes.default"` - - template - - containers - - alwaysPullImage: `agent.alwaysPullImage` - - args - - command - - envVars - - image: `agent.image:agent.imageTag` - - name: `.agent.sideContainerName` - - privileged: `.agent.privileged` - - resourceLimitCpu: `agent.resources.limits.cpu` - - resourceLimitMemory: `agent.resources.limits.memory` - - resourceRequestCpu: `agent.resources.requests.cpu` - - resourceRequestMemory: `agent.resources.requests.memory` - - ttyEnabled: `agent.TTYEnabled` - - workingDir: "/home/jenkins" - - idleMinutes: `agent.idleMinutes` - - instanceCap: 2147483647 - - imagePullSecrets: - - name: `.agent.imagePullSecretName` - - label - - name - - nodeUsageMode: "NORMAL" - - podRetention: `agent.podRetention` - - serviceAccount - - showRawYaml: true - - slaveConnectTimeoutStr: "100" - - yaml: `agent.yamlTemplate` - - yamlMergeStrategy: "override" -- security: - - apiToken: - - creationOfLegacyTokenEnabled: false - - tokenGenerationOnCreationEnabled: false - - usageStatisticsEnabled: true - -Example `values.yaml` which enables JCasC, it's default config and configAutoReload: - -```yaml -master: - JCasC: - enabled: true - defaultConfig: true - sidecars: - configAutoReload: - enabled: true -``` - -add master.JCasC.defaultConfig and configure location - -- JCasC configuration is stored in template `jenkins.casc.defaults` - so that it can be used in `config.yaml` and `jcasc-config.yaml` - depending on if configAutoReload is enabled or not - -- Jenkins Location (URL) is configured to provide a startin point - for the config - -## 1.6.1 - -Print error message when `master.sidecars.configAutoReload.enabled` is `true`, but the admin user can't be found to configure the SSH key. - -## 1.6.0 - -Add support for Google Cloud Storage for backup CronJob (migrating from nuvo/kube-tasks to maorfr/kube-tasks) - -## 1.5.9 - -Fixed a warning when sidecar resources are provided through a parent chart or override values - -## 1.5.8 - -Fixed an issue when master.enableXmlConfig is set to false: Always mount jenkins-secrets volume if secretsFilesSecret is set (#16512) - -## 1.5.7 - -added initial changelog (#16324) -commit: cee2ebf98 - -## 1.5.6 - -enable xml config misspelling (#16477) -commit: a125b99f9 - -## 1.5.5 - -Jenkins master label (#16469) -commit: 4802d14c9 - -## 1.5.4 - -add option enableXmlConfig (#16346) -commit: 387d97a4c - -## 1.5.3 - -extracted "jenkins.URL" into template (#16347) -commit: f2fdf5332 - -## 1.5.2 - -Fix backups when deployment has custom name (#16279) -commit: 16b89bfff - -## 1.5.1 - -Ability to set custom namespace for ServiceMonitor (#16145) -commit: 18ee6cf01 - -## 1.5.0 - -update Jenkins plugins to fix security issue (#16069) -commit: 603cf2d2b - -## 1.4.3 - -Use fixed container name (#16068) -commit: b3e4b4a49 - -## 1.4.2 - -Provide default job value (#15963) -commit: c462e2017 - -## 1.4.1 - -Add Jenkins backendconfig values (#15471) -commit: 7cc9b54c7 - -## 1.4.0 - -Change the value name for docker image tags - standartise to helm preferred value name - tag; this also allows auto-deployments using weaveworks flux (#15565) -commit: 5c3d920e7 - -## 1.3.6 - -jenkins deployment port should be target port (#15503) -commit: 83909ebe3 - -## 1.3.5 - -Add support for namespace specification (#15202) -commit: e773201a6 - -## 1.3.4 - -Adding sub-path option for scraping (#14833) -commit: e04021154 - -## 1.3.3 - -Add existingSecret to Jenkins backup AWS credentials (#13392) -commit: d9374f57d - -## 1.3.2 - -Fix JCasC version (#14992) -commit: 26a6d2b99 - -## 1.3.1 - -Update affinity for a backup cronjob (#14886) -commit: c21ed8331 - -## 1.3.0 - -only install casc support plugin when needed (#14862) -commit: a56fc0540 - -## 1.2.2 - -DNS Zone customization (#14775) -commit: da2910073 - -## 1.2.1 - -only render comment if configAutoReload is enabled (#14754) -commit: e07ead283 - -## 1.2.0 - -update plugins to latest version (#14744) -commit: 84336558e - -## 1.1.24 - -add example for EmptyDir volume (#14499) -commit: cafb60209 - -## 1.1.23 - -check if installPlugins is set before using it (#14168) -commit: 1218f0359 - -## 1.1.22 - -Support servicemonitor and alerting rules (#14124) -commit: e15a27f48 - -## 1.1.21 - -Fix: healthProbe timeouts mapping to initial delay (#13875) -commit: 825b32ece - -## 1.1.20 - -Properly handle overwrite config for additional configs (#13915) -commit: 18ce9b558 - -## 1.1.18 - -update maintainer (#13897) -commit: 223002b27 - -## 1.1.17 - -add apiVersion (#13795) -commit: cd1e5c35a - -## 1.1.16 - -allow changing of the target port to support TLS termination sidecar (#13576) -commit: a34d3bbcc - -## 1.1.15 - -fix wrong pod selector in jenkins-backup (#13542) -commit: b5df4fd7e - -## 1.1.14 - -allow templating of customInitContainers (#13536) -commit: d1e1421f4 - -## 1.1.13 - -fix #13467 (wrong deprecation message) (#13511) -commit: fbe28fa1c - -## 1.1.12 - -Correct customInitContainers Name example. (#13405) -commit: 6c6e40405 - -## 1.1.11 - -fix master.runAsUser, master.fsGroup examples (#13389) -commit: 2d7e5bf72 - -## 1.1.10 - -Ability to specify raw yaml template (#13319) -commit: 77aaa9a5f - -## 1.1.9 - -correct NOTES.txt - use master.ingress.hostname (#13318) -commit: b08ef6280 - -## 1.1.8 - -explain how to upgrade major versions (#13273) -commit: e7617a97e - -## 1.1.7 - -Add support for idleMinutes and serviceAccount (#13263) -commit: 4595ee033 - -## 1.1.6 - -Use same JENKINS_URL no matter if slaves use different namespace (#12564) -commit: 94c90339f - -## 1.1.5 - -fix deprecation checks (#13224) -commit: c7d2f8105 - -## 1.1.4 - -Fix issue introduced in #13136 (#13232) -commit: 0dbcded2e - -## 1.1.3 - -fix chart errors (#13197) -commit: 692a1e3da - -## 1.1.2 - -correct selector for jenkins pod (#13200) -commit: 4537e7fda - -## 1.1.1 - -Fix rendering of customInitContainers and lifecycle for Jenkins helm chart (#13189) -commit: e8f6b0ada - -## 1.1.0 - -Add support for openshift route in jenkins (#12973) -commit: 48c58a430 - -## 1.0.0 - -helm chart best practices (#13136) -commit: b02ae3f48 - -### Breaking changes - -- values have been renamed to follow helm chart best practices for naming conventions so - that all variables start with a lowercase letter and words are separated with camelCase - -- all resources are now using recommended standard labels - - -As a result of the label changes also the selectors of the deployment have been updated. -Those are immutable so trying an updated will cause an error like: - -```text -Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-master", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable -``` - -In order to upgrade, delete the Jenkins Deployment before upgrading: - -```console -kubectl delete deploy jenkins -``` - -## 0.40.0 - -Allow to override jenkins location protocol (#12257) -commit: 18a830626 - -## 0.39.0 - -Add possibility to add custom init-container and lifecycle for master-container (#13062) -commit: 14d043593 - -## 0.38.0 - -Support `priorityClassName` on Master Deployment (#13069) -commit: e896c62bc - -## 0.37.3 - -Add support for service account annotations in jenkins (#12969) -commit: b22774e2f - -## 0.37.2 - -fix: add hostName to ingress in values.yaml (#12946) -commit: 041045e9b - -## 0.37.1 - -Update to match actual defaults in value.yaml (#12904) -commit: 73b6d37eb - -## 0.37.0 - -Support multiple Jenkins instances in same namespace (#12748) -commit: 32ff2f343 - -## 0.36.5 - -Fix wrong comment in values.yaml (#12761) -commit: 9db8ced23 - -## 0.36.4 - -Re-add value for Ingress API Version (#12753) -commit: ecb7791b5 - -## 0.36.3 - -allow templating of volumes (#12734) -commit: adbda2ca6 - -## 0.36.2 - -Fix self-introduced whitespace bug (#12528) -commit: eec1678eb - -## 0.36.1 - -Add flag to overwrite jobs definition from values.yaml (#12427) -commit: fd349b2fc - -## 0.36.0 - -Replace OwnSshKey with AdminSshKey (#12140) (#12466) -commit: 80a8c9eb6 - -## 0.35.2 - -add note for breaking changes (#12203) -commit: e779c5a54 - -## 0.35.1 - -Allow Jenkins to run with READONLYROOTFS psp (#12338) -commit: 7c419e191 - -## 0.35.0 - -Jenkins OverwriteConfig setting also overwrites init scripts (#9468) -commit: 501335b76 - -## 0.34.1 - -Fix typo on hostname variable (#12156) -commit: 3d337d8dd - -## 0.34.0 - -Allow ingress without host rule (#11960) -commit: ddc966d1e - -## 0.33.2 - -Improve documentation - clarify that rbac is needed for autoreload (#11739) -commit: 9d75a5c34 - -## 0.33.1 - -use object for rollingUpdate (#11909) -commit: cb9cf21e8 - -## 0.33.0 - -Add hostAliases (#11701) -commit: 0b89e1094 - -## 0.32.10 - -Fix slave jnlp port always being reset when container is restarted (#11685) -commit: d7d51797b - -## 0.32.9 - -add ingress Hostname an ApiVersion to docs (#11576) -commit: 4d3e77137 - -## 0.32.8 - -Support custom master pod labels in deployment (#9714) (#11511) -commit: 9de96faa0 - -## 0.32.7 - -Fix Markdown syntax in readme (#11496) -commit: a32221a95 - -## 0.32.6 - -Added custom labels on jenkins ingress (#11466) -commit: c875d2b9b - -## 0.32.5 - -fix typo in default jenkins agent image fixes #11356 (#11463) -commit: 30adb9a91 - -## 0.32.4 - -fix incorrect Deployment when using sidecars (#11413) -commit: 362b4cef8 - -## 0.32.3 - -[]: #10131 (#11411) -commit: 49cb72055 - -## 0.32.2 - -Option to expose the slave listener port as host port (#11187) -commit: 2f85a9663 - -## 0.32.1 - -Updating Jenkins deployment fails appears rollingUpdate needs to be (#11166) -commit: 07fc9dbde - -## 0.32.0 - -Merge Sidecard configs (#11339) -commit: 3696090b9 - -## 0.31.0 - -Add option to overwrite plugins (#11231) -commit: 0e9aa00a5 - -## 0.30.0 - -Added slave Pod env vars (#8743) -commit: 1499f6608 - -## 0.29.3 - -revert indentation to previous working version (#11293) -commit: 61662f17a - -## 0.29.2 - -allow running sidecar containers for Jenkins master (#10950) -commit: 9084ce54a - -## 0.29.1 - -Indent lines related to EnableRawHtmlMarkupFormatter (#11252) -commit: 20b310c08 - -## 0.29.0 - -Jenkins Configuration as Code (#9057) -commit: c3e8c0b17 - -## 0.28.11 - -Allow to enable OWASP Markup Formatter Plugin (#10851) -commit: 9486e5ddf - -## 0.28.10 - -Fixes #1341 -- update Jenkins chart documentation (#10290) -commit: 411c81cd0 - -## 0.28.9 - -Quoted JavaOpts values (#10671) -commit: 926a843a8 - -## 0.28.8 - -Support custom labels in deployment (#9714) (#10533) -commit: 3e00b47fa - -## 0.28.7 - -separate test resources (#10597) -commit: 7b7ae2d11 - -## 0.28.6 - -allow customizing livenessProbe periodSeconds (#10534) -commit: 3c94d250d - -## 0.28.5 - -Add role kind option (#8498) -commit: e791ad124 - -## 0.28.4 - -workaround for busybox's cp (Closes: #10471) (#10497) -commit: 0d51a4187 - -## 0.28.3 - -fix parsing java options (#10140) -commit: 9448d0293 - -## 0.28.2 - -Fix job definitions in standard values.yaml (#10184) -commit: 6b6355ae7 - -## 0.28.1 - -add numExecutors as a variable in values file (#10236) -commit: d5ea2050f - -## 0.28.0 - -various (#10223) -commit: e17d2a65d - -## 0.27.0 - -add backup cronjob (#10095) -commit: 863ead8db - -## 0.26.2 - -add namespace flag for port-forwarding in jenkins notes (#10399) -commit: 846b589a9 - -## 0.26.1 - -- fixes #10267 when executed with helm template - otherwise produces an invalid template. (#10403) - commit: 266f9d839 - -## 0.26.0 - -Add subPath for jenkins-home mount (#9671) -commit: a9c76ac9b - -## 0.25.1 - -update readme to indicate the correct image that is used by default (#9915) -commit: 6aba9631c - -## 0.25.0 - -Add ability to manually set Jenkins URL (#7405) -commit: a0178fcb4 - -## 0.24.0 - -Make AuthorizationStrategy configurable (#9567) -commit: 06545b226 - -## 0.23.0 - -Update Jenkins public chart (#9296) -commit: 4e5f5918b - -## 0.22.0 - -allow to override jobs (#9004) -commit: dca9f9ab9 - -## 0.21.0 - -Simple implementation of the option to define the ingress path to the jenkins service (#8101) -commit: 013159609 - -## 0.20.2 - -Cosmetic change to remove necessity of changing "appVersion" for every new LTS release (#8866) -commit: f52af042a - -## 0.20.1 - -Added ExtraPorts to open in the master pod (#7759) -commit: 78858a2fb - -## 0.19.1 - -Fix component label in NOTES.txt ... (#8300) -commit: c5494dbfe - -## 0.19.0 - -Kubernetes 1.9 support as well as automatic apiVersion detection (#7988) -commit: 6853ad364 - -## 0.18.1 - -Respect SlaveListenerPort value in config.xml (#7220) -commit: 0a5ddac35 - -## 0.18.0 - -Allow replacement of Jenkins config with configMap. (#7450) -commit: c766da3de - -## 0.17.0 - -Add option to allow host networking (#7530) -commit: dc2eeff32 - -## 0.16.25 - -add custom jenkins labels to the build agent (#7167) -commit: 3ecde5dbf - -## 0.16.24 - -Move kubernetes and job plugins to latest versions (#7438) -commit: 019e39456 - -## 0.16.23 - -Add different Deployment Strategies based on persistence (#6132) -commit: e0a20b0b9 - -## 0.16.22 - -avoid linting errors when adding Values.Ingress.Annotations (#7425) -commit: 99eacc854 - -## 0.16.21 - -bump appVersion to reflect new jenkins lts release version 2.121.3 (#7217) -commit: 296df165d - -## 0.16.20 - -Configure kubernetes plugin for including namespace value (#7164) -commit: c0dc6cc48 - -## 0.16.19 - -make pod retention policy setting configurable (#6962) -commit: e614c1033 - -## 0.16.18 - -Update plugins version (#6988) -commit: bf8180018 - -## 0.16.17 - -Add Master.AdminPassword in readme (#6987) -commit: 13e754ad7 - -## 0.16.16 - -Added jenkins location configuration (#6573) -commit: 79de7026c - -## 0.16.15 - -use generic env var, not oracle specific env var (#6116) -commit: 6084ab4a4 - -## 0.16.14 - -Allow to specify resource requests and limits on initContainers (#6723) -commit: 942a33b1a - -## 0.16.13 - -Added support for NodePort service type for jenkens agent svc (#6571) -commit: 89a213c2b - -## 0.16.12 - -Added ability to configure multiple LoadBalancerSourceRanges (#6243) -commit: 01604ddbc - -## 0.16.11 - -Removing ContainerPort configuration as at the moment it does not work when you change this setting (#6411) -commit: e1c0468bd - -## 0.16.9 - -Fix jobs parsing for configmap by adding toYaml to jobs.yaml template (#3747) -commit: b2542a123 - -## 0.16.8 - -add jenkinsuriprefix in healthprobes (#5737) -commit: 435d7a7b9 - -## 0.16.7 - -Added the ability to switch from ClusterRoleBinding to RoleBinding. (#6190) -commit: dde03ede0 - -## 0.16.6 - -Make jenkins master pod security context optional (#6122) -commit: 63653fd59 - -## 0.16.5 - -Rework resources requests and limits (#6077) (#6077) -commit: e738f99d0 - -## 0.16.4 - -Add jenkins master pod annotations (#6313) -commit: 5e7325721 - -## 0.16.3 - -Split Jenkins readiness and liveness probe periods (#5704) -commit: fc6100c38 - -## 0.16.1 - -fix typo in jenkins readme (#5228) -commit: 3cd3f4b8b - -## 0.16.0 - -Inherit existing plugins from Jenkins image (#5409) -commit: fd93bff82 - -## 0.15.1 - -Allow NetworkPolicy.ApiVersion and Master.Ingress.ApiVersion to Differ (#5103) -commit: 78ee4ba15 - -## 0.15.0 - -Secure Defaults (#5026) -commit: 0fe90b520 - -## 0.14.6 - -Wait for up to 2 minutes before failing liveness check (#5161) -commit: 2cd3fc481 - -## 0.14.5 - -correct ImageTag setting (#4371) -commit: 8ea04174d - -## 0.14.4 - -Update jenkins/README.md (#4559) -commit: d4e6352dd - -## 0.14.3 - -Bump appVersion (#4177) -commit: 605d3d441 - -## 0.14.2 - -Master.InitContainerEnv: Init Container Env Vars (#3495) -commit: c64abe27d - -## 0.14.1 - -Allow more configuration of Jenkins agent service (#4028) -commit: fc82f39b2 - -## 0.14.0 - -Add affinity settings (#3839) -commit: 64e82fa6a - -## 0.13.5 - -bump test timeouts (#3886) -commit: cd05dd99c - -## 0.13.4 - -Add OWNERS to jenkins chart (#3881) -commit: 1c106b9c8 - -## 0.13.3 - -Add fullnameOverride support (#3705) -commit: ec8080839 - -## 0.13.2 - -Update README.md (#3638) -commit: f6d274c37 - -## 0.13.1 - -Lower initial healthcheck delay (#3463) -commit: 9b99db67c - -## 0.13.0 - -Provision credentials.xml, secrets files and jobs (#3316) -commit: d305c5961 - -## 0.12.1 - -fix the default value for nodeUsageMode. (#3299) -commit: b68d19516 - -## 0.12.0 - -Recreate pods when CustomConfigMap is true and there are changes to the ConfigMap (which is how the vanilla chart works) (#3181) -commit: 86d29f804 - -## 0.11.1 - -Optionally adds liveness and readiness probes to jenkins (#3245) -commit: 8b9aa73ee - -## 0.11.0 - -Feature/run jenkins as non root user (#2899) -commit: 8918f4175 - -## 0.10.3 - -template the version to keep them synced (#3084) -commit: 35e7fa49a - -## 0.10.2 - -Update Chart.yaml -commit: e3e617a0b - -## 0.10.1 - -Merge branch 'master' into jenkins-test-timeout -commit: 9a230a6b1 - -Double retry count for Jenkins test -commit: 129c8e824 - -Jenkins: Update readme | Master.ServiceAnnotations (#2757) -commit: 6571810bc - -## 0.10.0 - -Update Jenkins images and plugins (#2496) -commit: 2e2622682 - -## 0.9.4 - -Updating to remove the `.lock` directory as well (#2747) -commit: 6e676808f - -## 0.9.3 - -Use variable for service port when testing (#2666) -commit: d044f99be - -## 0.9.2 - -Review jenkins networkpolicy docs (#2618) -commit: 49911e458 - -Add image pull secrets to jenkins templates (#1389) -commit: 4dfae21fd - -## 0.9.1 - -Added persistent volume claim annotations (#2619) -commit: ac9e5306e - -Fix failing CI lint (#2758) -commit: 26f709f0e - -## 0.9.0 - -namespace defined templates with chart name (#2140) -commit: 408ae0b3f - -## 0.8.9 - -added useSecurity and adminUser to params (#1903) -commit: 39d2a03cd - -Use storageClassName for jenkins. (#1997) -commit: 802f6449b - -## 0.8.8 - -Remove old plugin locks before installing plugins (#1746) -commit: 6cd7b8ff4 - -promote initContainrs to podspec (#1740) -commit: fecc804fc - -## 0.8.7 - -add optional LoadBalancerIP option. (#1568) -commit: d39f11408 - -## 0.8.6 - -Fix bad key in values.yaml (#1633) -commit: dc27e5af3 - -## 0.8.5 - -Update Jenkins to support node selectors for agents. (#1532) -commit: 4af5810ff - -## 0.8.4 - -Add support for supplying JENKINS_OPTS and/or URI prefix (#1405) -commit: 6a331901a - -## 0.8.3 - -Add serviceAccountName to deployment (#1477) -commit: 0dc349b44 - -## 0.8.2 - -Remove path from ingress specification to allow other paths (#1599) -commit: e727f6b32 - -Update git plugin to 3.4.0 for CVE-2017-1000084 (#1505) -commit: 03482f995 - -## 0.8.1 - -Use consistent whitespace in template placeholders (#1437) -commit: 912f50c71 - -add configurable service annotations #1234 (#1244) -commit: 286861ca8 - -## 0.8.0 - -Jenkins v0.8.0 (#1385) -commit: 0009a2393 - -## 0.7.4 - -Use imageTag as version in config map (#1333) -commit: e8bb6ebb4 - -## 0.7.3 - -Add NetworkPolicy to Jenkins (#1228) -commit: 572b36c6d - -## 0.7.2 - -- Workflow plugin pin (#1178) - commit: ac3a0c7bc - -## 0.7.1 - -copy over plugins.txt in case of update (#1222) -commit: 75b5b1174 - -## 0.7.0 - -add jmx option (#964) -commit: 6ae8d1945 - -## 0.6.4 - -update jenkins to latest LTS 2.46.3 (#1182) -commit: ad90b4c27 - -## 0.6.3 - -Update chart maints to gh u/n (#1107) -commit: f357b77ed - -## 0.6.2 - -Add Agent.Privileged option (#957) -commit: 2cf4aced2 - -## 0.6.1 - -Upgrade jenkins to 2.46.2 (#971) -commit: 41bd742b4 - -## 0.6.0 - -Smoke test for Jenkins Chart (#944) -commit: 110441054 - -## 0.5.1 - -removed extra space from hardcoded password (#925) -commit: 85a9b9123 - -## 0.5.0 - -move config to init-container allowing use of upstream containers (#921) -commit: 1803c3d33 - -## 0.4.1 - -add ability to toggle jnlp-agent podTemplate generation (#918) -commit: accd53203 - -## 0.4.0 - -Jenkins add script approval (#916) -commit: c1746656e - -## 0.3.1 - -Update Jenkins to Latest LTS fixes #731 (#733) -commit: e9a3aed8b - -## 0.3.0 - -Added option to add Jenkins init scripts (#617) -commit: b889623d0 - -## 0.2.0 - -Add existing PVC (#716) -commit: 05271f145 - -## 0.1.15 - -use Master.ServicePort in config.xml (#769) -commit: f351f4b16 - -## 0.1.14 - -Added option to disable security on master node (#403) -commit: 3a6113d18 - -## 0.1.13 - -Added: extra mount points support for jenkins master (#474) -commit: fab0f7eb1 - -## 0.1.12 - -fix storageclass config typo (#548) -commit: 6fc0ff242 - -## 0.1.10 - -Changed default value of Kubernetes Cloud name to match one in kubernetes plugin (#404) -commit: 68351304a - -Add support for overriding the Jenkins ConfigMap (#524) -commit: f97ca53b1 - -## 0.1.9 - -Added jenkins-master ingress support (#402) -commit: d76a09588 - -## 0.1.8 - -Change description (#553) -commit: 91f5c24e1 - -Removed default Persistence.StorageClass: generic (#530) -commit: c87494c10 - -Update to the recommended pvc patterns. (#448) -commit: a7fc595aa - -Remove helm.sh/created annotations (#505) -commit: f380da2fb - -## 0.1.7 - -add support for explicit NodePort on jenkins chart (#342) -commit: f63c188da - -Add configurable loadBalancerSourceRanges for jenkins chart (#360) -commit: 44007c50e - -Update Jenkins version to current LTS (2.19.4) and Kubernetes Plugin to 0.10 (#341) -commit: 6c8678167 - -## 0.1.6 - -Add imagePullPolicy to init container (#295) -commit: 103ee1952 - -## 0.1.5 - -bump chart version with PVC metadata label additions -commit: 4aa9cf5b1 - -## 0.1.4 - -removed `*` from `jenkins/templates/NOTES.txt` -commit: 76212230b - -apply standard metadata labels to PVC's -commit: 58b730836 - -specify namespace in `kubectl get svc` commands in NOTES.txt -commit: 7d3287e81 - -Update Jenkins version to current LTS (#194) -commit: 2c0404049 - -## 0.1.1 - -escape fixed -commit: 2026e1d15 - -.status.loadBalancer.ingress[0].ip is empty in AWS -commit: 1810e37f4 - -.status.loadBalancer.ingress[0].ip is empty in AWS -commit: 3cbd3ced6 - -Remove 'Getting Started:' from various NOTES.txt. (#181) -commit: 2f63fd524 - -docs(\*): update readmes to reference chart repos (#119) -commit: c7d1bff05 - -## 0.1.0 - -Move first batch of PVC charts to stable -commit: d745f4879 diff --git a/helm-templates/jenkins-grn/Chart.yaml b/helm-templates/jenkins-grn/Chart.yaml deleted file mode 100644 index bd129ea..0000000 --- a/helm-templates/jenkins-grn/Chart.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: v2 -name: jenkins -type: application -home: https://www.jenkins.io/ -version: 5.8.58 -appVersion: 2.504.2 -description: > - Jenkins - Build great things at any scale! As the leading open source automation server, Jenkins provides over 2000 plugins to support building, deploying and automating any project. - -sources: - - https://github.com/jenkinsci/jenkins - - https://github.com/jenkinsci/docker-inbound-agent - - https://github.com/maorfr/kube-tasks - - https://github.com/jenkinsci/configuration-as-code-plugin -maintainers: - - name: maorfr - email: maor.friedman@redhat.com - - name: torstenwalter - email: mail@torstenwalter.de - - name: mogaal - email: garridomota@gmail.com - - name: wmcdona89 - email: wmcdona89@gmail.com - - name: timja - email: timjacomb1@gmail.com -icon: https://get.jenkins.io/art/jenkins-logo/logo.svg -keywords: - - jenkins - - ci - - devops -annotations: - artifacthub.io/links: | - - name: Chart Source - url: https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins - - name: Jenkins - url: https://www.jenkins.io/ - - name: support - url: https://github.com/jenkinsci/helm-charts/issues - artifacthub.io/images: | - - name: jenkins - image: docker.io/jenkins/jenkins:2.504.2-jdk21 - - name: k8s-sidecar - image: docker.io/kiwigrid/k8s-sidecar:1.30.3 - - name: inbound-agent - image: jenkins/inbound-agent:3309.v27b_9314fd1a_4-4 - artifacthub.io/category: "integration-delivery" - artifacthub.io/license: "Apache-2.0" diff --git a/helm-templates/jenkins-grn/README.md b/helm-templates/jenkins-grn/README.md deleted file mode 100644 index 08136d2..0000000 --- a/helm-templates/jenkins-grn/README.md +++ /dev/null @@ -1,723 +0,0 @@ -# Jenkins - -[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/jenkins)](https://artifacthub.io/packages/helm/jenkinsci/jenkins) -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) -[![Releases downloads](https://img.shields.io/github/downloads/jenkinsci/helm-charts/total.svg)](https://github.com/jenkinsci/helm-charts/releases) -[![Join the chat at https://app.gitter.im/#/room/#jenkins-ci:matrix.org](https://badges.gitter.im/badge.svg)](https://app.gitter.im/#/room/#jenkins-ci:matrix.org) - -[Jenkins](https://www.jenkins.io/) is the leading open source automation server, Jenkins provides over 2000 plugins to support building, deploying and automating any project. - -This chart installs a Jenkins server which spawns agents on [Kubernetes](http://kubernetes.io) utilizing the [Jenkins Kubernetes plugin](https://plugins.jenkins.io/kubernetes/). - -Inspired by the awesome work of [Carlos Sanchez](https://github.com/carlossg). - -## Get Repository Info - -```console -helm repo add jenkins https://charts.jenkins.io -helm repo update -``` - -_See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentation._ - -## Install Chart - -```console -helm install [RELEASE_NAME] jenkins/jenkins [flags] -``` - -Since version `5.6.0` the chart is available as an OCI image and can be installed using: - -```console -helm install [RELEASE_NAME] oci://ghcr.io/jenkinsci/helm-charts/jenkins [flags] -``` - -_See [configuration](#configuration) below._ - -_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ - -## Uninstall Chart - -```console -# Helm 3 -$ helm uninstall [RELEASE_NAME] -``` - -This removes all the Kubernetes components associated with the chart and deletes the release. - -_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ - -## Upgrade Chart - -```console -# Helm 3 -$ helm upgrade [RELEASE_NAME] jenkins/jenkins [flags] -``` - -_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ - -Visit the chart's [CHANGELOG](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/CHANGELOG.md) to view the chart's release history. -For migration between major version check [migration guide](#migration-guide). - -## Building weekly releases - -The default charts target Long-Term-Support (LTS) releases of Jenkins. -To use other versions the easiest way is to update the image tag to the version you want. -You can also rebuild the chart if you want the `appVersion` field to match. - -## Configuration - -See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). -To see all configurable options with detailed comments, visit the chart's [values.yaml](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/values.yaml), or run these configuration commands: - -```console -# Helm 3 -$ helm show values jenkins/jenkins -``` - -For a summary of all configurable options, see [VALUES.md](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES.md). - -### Configure Security Realm and Authorization Strategy - -This chart configured a `securityRealm` and `authorizationStrategy` as shown below: - -```yaml -controller: - JCasC: - securityRealm: |- - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false -``` - -With the configuration above there is only a single user. -This is fine for getting started quickly, but it needs to be adjusted for any serious environment. - -So you should adjust this to suite your needs. -That could be using LDAP / OIDC / .. as authorization strategy and use globalMatrix as authorization strategy to configure more fine-grained permissions. - -### Consider using a custom image - -This chart allows the user to specify plugins which should be installed. However, for production use cases one should consider to build a custom Jenkins image which has all required plugins pre-installed. -This way you can be sure which plugins Jenkins is using when starting up and you avoid trouble in case of connectivity issues to the Jenkins update site. - -The [docker repository](https://github.com/jenkinsci/docker) for the Jenkins image contains [documentation](https://github.com/jenkinsci/docker#preinstalling-plugins) how to do it. - -Here is an example how that can be done: - -```Dockerfile -FROM jenkins/jenkins:lts -RUN jenkins-plugin-cli --plugins kubernetes workflow-aggregator git configuration-as-code -``` - -NOTE: If you want a reproducible build then you should specify a non-floating tag for the image `jenkins/jenkins:2.249.3` and specify plugin versions. - -Once you built the image and pushed it to your registry you can specify it in your values file like this: - -```yaml -controller: - image: "registry/my-jenkins" - tag: "v1.2.3" - installPlugins: false -``` - -Notice: `installPlugins` is set to false to disable plugin download. In this case, the image `registry/my-jenkins:v1.2.3` must have the plugins specified as default value for [the `controller.installPlugins` directive](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins) to ensure that the configuration side-car system works as expected. - -In case you are using a private registry you can use 'imagePullSecretName' to specify the name of the secret to use when pulling the image: - -```yaml -controller: - image: "registry/my-jenkins" - tag: "v1.2.3" - imagePullSecretName: registry-secret - installPlugins: false -``` - -### External URL Configuration - -If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. -The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - -If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the URL definition. - -### Configuration as Code - -Jenkins Configuration as Code (JCasC) is now a standard component in the Jenkins project. -To allow JCasC's configuration from the helm values, the plugin [`configuration-as-code`](https://plugins.jenkins.io/configuration-as-code/) must be installed in the Jenkins Controller's Docker image (which is the case by default as specified by the [default value of the directive `controller.installPlugins`](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins)). - -JCasc configuration is passed through Helm values under the key `controller.JCasC`. -The section ["Jenkins Configuration as Code (JCasC)" of the page "VALUES_SUMMARY.md"](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-configuration-as-code-jcasc) lists all the possible directives. - -In particular, you may specify custom JCasC scripts by adding sub-key under the `controller.JCasC.configScripts` for each configuration area where each corresponds to a plugin or section of the UI. - -The sub-keys (prior to `|` character) are only labels used to give the section a meaningful name. -The only restriction is they must conform to RFC 1123 definition of a DNS label, so they may only contain lowercase letters, numbers, and hyphens. - -Each key will become the name of a configuration yaml file on the controller in `/var/jenkins_home/casc_configs` (by default) and will be processed by the Configuration as Code Plugin during Jenkins startup. - -The lines after each `|` become the content of the configuration yaml file. - -The first line after this is a JCasC root element, e.g. jenkins, credentials, etc. - -Best reference is the Documentation link here: `https:///configuration-as-code`. - -The example below sets custom systemMessage: - -```yaml -controller: - JCasC: - configScripts: - welcome-message: | - jenkins: - systemMessage: Welcome to our CI\CD server. -``` - -More complex example that creates ldap settings: - -```yaml -controller: - JCasC: - configScripts: - ldap-settings: | - jenkins: - securityRealm: - ldap: - configurations: - - server: ldap.acme.com - rootDN: dc=acme,dc=uk - managerPasswordSecret: ${LDAP_PASSWORD} - groupMembershipStrategy: - fromUserRecord: - attributeName: "memberOf" -``` - -Keep in mind that default configuration file already contains some values that you won't be able to override under configScripts section. - -For example, you can not configure Jenkins URL and System Admin email address like this because of conflicting configuration error. - -Incorrect: - -```yaml -controller: - JCasC: - configScripts: - jenkins-url: | - unclassified: - location: - url: https://example.com/jenkins - adminAddress: example@mail.com -``` - -Correct: - -```yaml -controller: - jenkinsUrl: https://example.com/jenkins - jenkinsAdminEmail: example@mail.com -``` - -Further JCasC examples can be found [here](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos). - -#### Breaking out large Config as Code scripts - -Jenkins Config as Code scripts can become quite large, and maintaining all of your scripts within one yaml file can be difficult. The Config as Code plugin itself suggests updating the `CASC_JENKINS_CONFIG` environment variable to be a comma separated list of paths for the plugin to traverse, picking up the yaml files as needed. -However, under the Jenkins helm chart, this `CASC_JENKINS_CONFIG` value is maintained through the templates. A better solution is to split your `controller.JCasC.configScripts` into separate values files, and provide each file during the helm install. - -For example, you can have a values file (e.g values_main.yaml) that defines the values described in the `VALUES_SUMMARY.md` for your Jenkins configuration: - -```yaml -jenkins: - controller: - jenkinsUrlProtocol: https - installPlugins: false - ... -``` - -In a second file (e.g values_jenkins_casc.yaml), you can define a section of your config scripts: - -```yaml -jenkins: - controller: - JCasC: - configScripts: - jenkinsCasc: | - jenkins: - disableRememberMe: false - mode: NORMAL - ... -``` - -And keep extending your config scripts by creating more files (so not all config scripts are located in one yaml file for better maintenance): - -values_jenkins_unclassified.yaml - -```yaml -jenkins: - controller: - JCasC: - configScripts: - unclassifiedCasc: | - unclassified: - ... -``` - -When installing, you provide all relevant yaml files (e.g `helm install -f values_main.yaml -f values_jenkins_casc.yaml -f values_jenkins_unclassified.yaml ...`). Instead of updating the `CASC_JENKINS_CONFIG` environment variable to include multiple paths, multiple CasC yaml files will be created in the same path `var/jenkins_home/casc_configs`. - -#### Config as Code With or Without Auto-Reload - -Config as Code changes (to `controller.JCasC.configScripts`) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. -If you set `controller.sidecars.configAutoReload.enabled` to `true`, a second, auxiliary container will be installed into the Jenkins controller pod, known as a "sidecar". -This watches for changes to configScripts, copies the content onto the Jenkins file-system and issues a POST to `http:///reload-configuration-as-code` with a pre-shared key. -You can monitor this sidecar's logs using command `kubectl logs -c config-reload -f`. -If you want to enable auto-reload then you also need to configure rbac as the container which triggers the reload needs to watch the config maps: - -```yaml -controller: - sidecars: - configAutoReload: - enabled: true -rbac: - create: true -``` - -### Allow Limited HTML Markup in User-Submitted Text - -Some third-party systems (e.g. GitHub) use HTML-formatted data in their payload sent to a Jenkins webhook (e.g. URL of a pull-request being built). -To display such data as processed HTML instead of raw text set `controller.enableRawHtmlMarkupFormatter` to true. -This option requires installation of the [OWASP Markup Formatter Plugin (antisamy-markup-formatter)](https://plugins.jenkins.io/antisamy-markup-formatter/). -This plugin is **not** installed by default but may be added to `controller.additionalPlugins`. - -### Change max connections to Kubernetes API - -When using agents with containers other than JNLP, The kubernetes plugin will communicate with those containers using the Kubernetes API. this changes the maximum concurrent connections - -```yaml -agent: - maxRequestsPerHostStr: "32" -``` - -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Change container cleanup timeout API - -For tasks that use very large images, this timeout can be increased to avoid early termination of the task while the Kubernetes pod is still deploying. - -```yaml -agent: - retentionTimeout: "32" -``` - -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Change seconds to wait for pod to be running - -This will change how long Jenkins will wait (seconds) for pod to be in running state. - -```yaml -agent: - waitForPodSec: "32" -``` - -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Mounting Volumes into Agent Pods - -Your Jenkins Agents will run as pods, and it's possible to inject volumes where needed: - -```yaml -agent: - volumes: - - type: Secret - secretName: jenkins-mysecrets - mountPath: /var/run/secrets/jenkins-mysecrets -``` - -The supported volume types are: `ConfigMap`, `EmptyDir`, `HostPath`, `Nfs`, `PVC`, `Secret`. -Each type supports a different set of configurable attributes, defined by [the corresponding Java class](https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes). - -### NetworkPolicy - -To make use of the NetworkPolicy resources created by default, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin). - -[Install](#install-chart) helm chart with network policy enabled by setting `networkPolicy.enabled` to `true`. - -You can use `controller.networkPolicy.internalAgents` and `controller.networkPolicy.externalAgents` stanzas for fine-grained controls over where internal/external agents can connect from. -Internal ones are allowed based on pod labels and (optionally) namespaces, and external ones are allowed based on IP ranges. - -### Script approval list - -`controller.scriptApproval` allows to pass function signatures that will be allowed in pipelines. -Example: - -```yaml -controller: - scriptApproval: - - "method java.util.Base64$Decoder decode java.lang.String" - - "new java.lang.String byte[]" - - "staticMethod java.util.Base64 getDecoder" -``` - -### Custom Labels - -`controller.serviceLabels` can be used to add custom labels in `jenkins-controller-svc.yaml`. -For example: - -```yaml -ServiceLabels: - expose: true -``` - -### Persistence - -The Jenkins image stores persistence under `/var/jenkins_home` path of the container. -A dynamically managed Persistent Volume Claim is used to keep the data across deployments, by default. -This is known to work in GCE, AWS, and minikube. Alternatively, a previously configured Persistent Volume Claim can be used. - -It is possible to mount several volumes using `persistence.volumes` and `persistence.mounts` parameters. -See additional `persistence` values using [configuration commands](#configuration). - -#### Existing PersistentVolumeClaim - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. [Install](#install-chart) the chart, setting `persistence.existingClaim` to `PVC_NAME` - -#### Long Volume Attach-/Mount Times - -Certain volume type and filesystem format combinations may experience long -attach/mount times, [10 or more minutes][K8S_VOLUME_TIMEOUT], when using -`fsGroup`. This issue may result in the following entries in the pod's event -history: - -```console -Warning FailedMount 38m kubelet, aks-default-41587790-2 Unable to attach or mount volumes: unmounted volumes=[jenkins-home], unattached volumes=[plugins plugin-dir jenkins-token-rmq2g sc-config-volume tmp jenkins-home jenkins-config secrets-dir]: timed out waiting for the condition -``` - -In these cases, experiment with replacing `fsGroup` with -`supplementalGroups` in the pod's `securityContext`. This can be achieved by -setting the `controller.podSecurityContextOverride` Helm chart value to -something like: - -```yaml -controller: - podSecurityContextOverride: - runAsNonRoot: true - runAsUser: 1000 - supplementalGroups: [1000] -``` - -This issue has been reported on [azureDisk with ext4][K8S_VOLUME_TIMEOUT] and -on [Alibaba cloud][K8S_VOLUME_TIMEOUT_ALIBABA]. - -[K8S_VOLUME_TIMEOUT]: https://github.com/kubernetes/kubernetes/issues/67014 -[K8S_VOLUME_TIMEOUT_ALIBABA]: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-698770511 - -#### Storage Class - -It is possible to define which storage class to use, by setting `persistence.storageClass` to `[customStorageClass]`. -If set to a dash (`-`), dynamic provisioning is disabled. -If the storage class is set to null or left undefined (`""`), the default provisioner is used (gp2 on AWS, standard on GKE, AWS & OpenStack). - -### Additional Secrets - -Additional secrets and Additional Existing Secrets, -can be mounted into the Jenkins controller through the chart or created using `controller.additionalSecrets` or `controller.additionalExistingSecrets`. -A common use case might be identity provider credentials if using an external LDAP or OIDC-based identity provider. -The secret may then be referenced in JCasC configuration (see [JCasC configuration](#configuration-as-code)). - -`values.yaml` controller section, referencing mounted secrets: - -```yaml -controller: - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: secret-credentials - - additionalExistingSecrets: - - name: secret-credentials - keyName: github-username - - name: secret-credentials - keyName: github-password - - name: secret-credentials - keyName: token - - additionalSecrets: - - name: client_id - value: abc123 - - name: client_secret - value: xyz999 - JCasC: - securityRealm: | - oic: - clientId: ${client_id} - clientSecret: ${client_secret} - ... - configScripts: - jenkins-casc-configs: | - credentials: - system: - domainCredentials: - - credentials: - - string: - description: "github access token" - id: "github_app_token" - scope: GLOBAL - secret: ${secret-credentials-token} - - usernamePassword: - description: "github access username password" - id: "github_username_pass" - password: ${secret-credentials-github-password} - scope: GLOBAL - username: ${secret-credentials-github-username} -``` - -For more information, see [JCasC documentation](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets). - -### Secret Claims from HashiCorp Vault - -It's possible for this chart to generate `SecretClaim` resources in order to automatically create and maintain Kubernetes `Secrets` from HashiCorp [Vault](https://www.vaultproject.io/) via [`kube-vault-controller`](https://github.com/roboll/kube-vault-controller) - -These `Secrets` can then be referenced in the same manner as Additional Secrets above. - -This can be achieved by defining required Secret Claims within `controller.secretClaims`, as follows: - -```yaml -controller: - secretClaims: - - name: jenkins-secret - path: secret/path - - name: jenkins-short-ttl - path: secret/short-ttl-path - renew: 60 -``` - -### RBAC - -RBAC is enabled by default. If you want to disable it you will need to set `rbac.create` to `false`. - -### Adding Custom Pod Templates - -It is possible to add custom pod templates for the default configured kubernetes cloud. -Add a key under `agent.podTemplates` for each pod template. Each key (prior to `|` character) is just a label, and can be any value. -Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. -There's no need to add the _jnlp_ container since the kubernetes plugin will automatically inject it into the pod. -For this pod templates configuration to be loaded the following values must be set: - -```yaml -controller.JCasC.defaultConfig: true -``` - -The example below creates a python pod template in the kubernetes cloud: - -```yaml -agent: - podTemplates: - python: | - - name: python - label: jenkins-python - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" -``` - -Best reference is `https:///configuration-as-code/reference#Cloud-kubernetes`. - -### Adding Pod Templates Using additionalAgents - -`additionalAgents` may be used to configure additional kubernetes pod templates. -Each additional agent corresponds to `agent` in terms of the configurable values and inherits all values from `agent` so you only need to specify values which differ. -For example: - -```yaml -agent: - podName: default - customJenkinsLabels: default - # set resources for additional agents to inherit - resources: - limits: - cpu: "1" - memory: "2048Mi" - -additionalAgents: - maven: - podName: maven - customJenkinsLabels: maven - # An example of overriding the jnlp container - # sideContainerName: jnlp - image: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: python - tag: "3" - command: "/bin/sh -c" - args: "cat" - TTYEnabled: true -``` - -### Ingress Configuration - -This chart provides ingress resources configurable via the `controller.ingress` block. - -The simplest configuration looks like the following: - -```yaml -controller: - ingress: - enabled: true - paths: [] - apiVersion: "extensions/v1beta1" - hostName: jenkins.example.com -``` - -This snippet configures an ingress rule for exposing jenkins at `jenkins.example.com` - -You can define labels and annotations via `controller.ingress.labels` and `controller.ingress.annotations` respectively. -Additionally, you can configure the ingress tls via `controller.ingress.tls`. -By default, this ingress rule exposes all paths. -If needed this can be overwritten by specifying the wanted paths in `controller.ingress.paths` - -If you want to configure a secondary ingress e.g. you don't want the jenkins instance exposed but still want to receive webhooks you can configure `controller.secondaryingress`. -The secondaryingress doesn't expose anything by default and has to be configured via `controller.secondaryingress.paths`: - -```yaml -controller: - ingress: - enabled: true - apiVersion: "extensions/v1beta1" - hostName: "jenkins.internal.example.com" - annotations: - kubernetes.io/ingress.class: "internal" - secondaryingress: - enabled: true - apiVersion: "extensions/v1beta1" - hostName: "jenkins-scm.example.com" - annotations: - kubernetes.io/ingress.class: "public" - paths: - - /github-webhook -``` - -## Prometheus Metrics - -If you want to expose Prometheus metrics you need to install the [Jenkins Prometheus Metrics Plugin](https://github.com/jenkinsci/prometheus-plugin). -It will expose an endpoint (default `/prometheus`) with metrics where a Prometheus Server can scrape. - -If you have implemented [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), you can set `controller.prometheus.enabled` to `true` to configure a `ServiceMonitor` and `PrometheusRule`. -If you want to further adjust alerting rules you can do so by configuring `controller.prometheus.alertingrules` - -If you have implemented Prometheus without using the operator, you can leave `controller.prometheus.enabled` set to `false`. - -### Running Behind a Forward Proxy - -The controller pod uses an Init Container to install plugins etc. If you are behind a corporate proxy it may be useful to set `controller.initContainerEnv` to add environment variables such as `http_proxy`, so that these can be downloaded. - -Additionally, you may want to add env vars for the init container, the Jenkins container, and the JVM (`controller.javaOpts`): - -```yaml -controller: - initContainerEnv: - - name: http_proxy - value: "http://192.168.64.1:3128" - - name: https_proxy - value: "http://192.168.64.1:3128" - - name: no_proxy - value: "" - - name: JAVA_OPTS - value: "-Dhttps.proxyHost=proxy_host_name_without_protocol -Dhttps.proxyPort=3128" - containerEnv: - - name: http_proxy - value: "http://192.168.64.1:3128" - - name: https_proxy - value: "http://192.168.64.1:3128" - javaOpts: >- - -Dhttp.proxyHost=192.168.64.1 - -Dhttp.proxyPort=3128 - -Dhttps.proxyHost=192.168.64.1 - -Dhttps.proxyPort=3128 -``` - -### HTTPS Keystore Configuration - -[This configuration](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777) enables jenkins to use keystore in order to serve HTTPS. -Here is the [value file section](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777#RunningJenkinswithnativeSSL/HTTPS-ConfigureJenkinstouseHTTPSandtheJKSkeystore) related to keystore configuration. -Keystore itself should be placed in front of `jenkinsKeyStoreBase64Encoded` key and in base64 encoded format. To achieve that after having `keystore.jks` file simply do this: `cat keystore.jks | base64` and paste the output in front of `jenkinsKeyStoreBase64Encoded`. -After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same, as `targetPort` will serve HTTPS. -Do not set `controller.httpsKeyStore.httpPort` to `-1` because it will cause readiness and liveliness prob to fail. -If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` (or override the key name using `jenkinsHttpsJksSecretKey`) -and `https-jks-password` (or override the key name using `jenkinsHttpsJksPasswordSecretKey`; additionally you can make it get the password from a different secret using `jenkinsHttpsJksPasswordSecretName`). Example: - -```yaml -controller: - httpsKeyStore: - enable: true - jenkinsHttpsJksSecretName: "" - httpPort: 8081 - path: "/var/jenkins_keystore" - fileName: "keystore.jks" - password: "changeit" - jenkinsKeyStoreBase64Encoded: "" -``` - -### AWS Security Group Policies - -To create SecurityGroupPolicies set `awsSecurityGroupPolicies.enabled` to true and add your policies. Each policy requires a `name`, array of `securityGroupIds` and a `podSelector`. Example: - -```yaml -awsSecurityGroupPolicies: - enabled: true - policies: - - name: "jenkins-controller" - securityGroupIds: - - sg-123456789 - podSelector: - matchExpressions: - - key: app.kubernetes.io/component - operator: In - values: - - jenkins-controller -``` - -### Agent Direct Connection - -Set `directConnection` to `true` to allow agents to connect directly to a given TCP port without having to negotiate a HTTP(S) connection. This can allow you to have agent connections without an external HTTP(S) port. Example: - -```yaml -agent: - jenkinsTunnel: "jenkinsci-agent:50000" - directConnection: true -``` - -## Migration Guide - -### From stable repository - -Upgrade an existing release from `stable/jenkins` to `jenkins/jenkins` seamlessly by ensuring you have the latest [repository info](#get-repository-info) and running the [upgrade commands](#upgrade-chart) specifying the `jenkins/jenkins` chart. - -### Major Version Upgrades - -Chart release versions follow [SemVer](../../CONTRIBUTING.md#versioning), where a MAJOR version change (example `1.0.0` -> `2.0.0`) indicates an incompatible breaking change needing manual actions. - -See [UPGRADING.md](./UPGRADING.md) for a list of breaking changes diff --git a/helm-templates/jenkins-grn/Tiltfile b/helm-templates/jenkins-grn/Tiltfile deleted file mode 100644 index d1ea3d7..0000000 --- a/helm-templates/jenkins-grn/Tiltfile +++ /dev/null @@ -1,5 +0,0 @@ - -# If not using a standard local dev name, specify your k8s context here -#allow_k8s_contexts('jenkins-dev') -k8s_yaml(helm('.', values='values.yaml', set=['controller.admin.password=asdf'])) -watch_file('.') diff --git a/helm-templates/jenkins-grn/UPGRADING.md b/helm-templates/jenkins-grn/UPGRADING.md deleted file mode 100644 index ff4cde4..0000000 --- a/helm-templates/jenkins-grn/UPGRADING.md +++ /dev/null @@ -1,151 +0,0 @@ -# Upgrade Notes - -## To 5.0.0 - -- `controller.image`, `controller.tag`, and `controller.tagLabel` have been removed. If you want to overwrite the image you now need to configure any or all of: - - `controller.image.registry` - - `controller.image.repository` - - `controller.image.tag` - - `controller.image.tagLabel` -- `controller.imagePullPolicy` has been removed. If you want to overwrite the pull policy you now need to configure `controller.image.pullPolicy`. -- `controller.sidecars.configAutoReload.image` has been removed. If you want to overwrite the configAutoReload image you now need to configure any or all of: - - `controller.sidecars.configAutoReload.image.registry` - - `controller.sidecars.configAutoReload.image.repository` - - `controller.sidecars.configAutoReload.image.tag` -- `controller.sidecars.other` has been renamed to `controller.sidecars.additionalSidecarContainers`. -- `agent.image` and `agent.tag` have been removed. If you want to overwrite the agent image you now need to configure any or all of: - - `agent.image.repository` - - `agent.image.tag` - - The registry can still be overwritten by `agent.jnlpregistry` -- `agent.additionalContainers[*].image` has been renamed to `agent.additionalContainers[*].image.repository` -- `agent.additionalContainers[*].tag` has been renamed to `agent.additionalContainers[*].image.tag` -- `additionalAgents.*.image` has been renamed to `additionalAgents.*.image.repository` -- `additionalAgents.*.tag` has been renamed to `additionalAgents.*.image.tag` -- `additionalClouds.*.additionalAgents.*.image` has been renamed to `additionalClouds.*.additionalAgents.*.image.repository` -- `additionalClouds.*.additionalAgents.*.tag` has been renamed to `additionalClouds.*.additionalAgents.*.image.tag` -- `helmtest.bats.image` has been split up to: - - `helmtest.bats.image.registry` - - `helmtest.bats.image.repository` - - `helmtest.bats.image.tag` -- `controller.adminUsername` and `controller.adminPassword` have been renamed to `controller.admin.username` and `controller.admin.password` respectively -- `controller.adminSecret` has been renamed to `controller.admin.createSecret` -- `backup.*` was unmaintained and has thus been removed. See the following page for alternatives: [Kubernetes Backup and Migrations](https://nubenetes.com/kubernetes-backup-migrations/). - -## To 4.0.0 - -Removes automatic `remotingSecurity` setting when using a container tag older than `2.326` (introduced in [`3.11.7`](./CHANGELOG.md#3117)). If you're using a version older than `2.326`, you should explicitly set `.controller.legacyRemotingSecurityEnabled` to `true`. - -## To 3.0.0 - -- Check `securityRealm` and `authorizationStrategy` and adjust it. - Otherwise, your configured users and permissions will be overridden. -- You need to use helm version 3 as the `Chart.yaml` uses `apiVersion: v2`. -- All XML configuration options have been removed. - In case those are still in use you need to migrate to configuration as code. - Upgrade guide to 2.0.0 contains pointers how to do that. -- Jenkins is now using a `StatefulSet` instead of a `Deployment` -- terminology has been adjusted that's also reflected in values.yaml - The following values from `values.yaml` have been renamed: - - - `master` => `controller` - - `master.useSecurity` => `controller.adminSecret` - - `master.slaveListenerPort` => `controller.agentListenerPort` - - `master.slaveHostPort` => `controller.agentListenerHostPort` - - `master.slaveKubernetesNamespace` => `agent.namespace` - - `master.slaveDefaultsProviderTemplate` => `agent.defaultsProviderTemplate` - - `master.slaveJenkinsUrl` => `agent.jenkinsUrl` - - `master.slaveJenkinsTunnel` => `agent.jenkinsTunnel` - - `master.slaveConnectTimeout` => `agent.kubernetesConnectTimeout` - - `master.slaveReadTimeout` => `agent.kubernetesReadTimeout` - - `master.slaveListenerServiceAnnotations` => `controller.agentListenerServiceAnnotations` - - `master.slaveListenerServiceType` => `controller.agentListenerServiceType` - - `master.slaveListenerLoadBalancerIP` => `controller.agentListenerLoadBalancerIP` - - `agent.slaveConnectTimeout` => `agent.connectTimeout` - -- Removed values: - - - `master.imageTag`: use `controller.image` and `controller.tag` instead - - `slave.imageTag`: use `agent.image` and `agent.tag` instead - -## To 2.0.0 - -Configuration as Code is now default + container does not run as root anymore. - -### Configuration as Code new default - -Configuration is done via [Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) by default. -That means that changes in values which result in a configuration change are always applied. -In contrast, the XML configuration was only applied during the first start and never altered. - -:exclamation::exclamation::exclamation: -Attention: -This also means if you manually altered configuration then this will most likely be reset to what was configured by default. -It also applies to `securityRealm` and `authorizationStrategy` as they are also configured using configuration as code. -:exclamation::exclamation::exclamation: - -### Image does not run as root anymore - -It's not recommended to run containers in Kubernetes as `root`. - -❗Attention: If you had not configured a different user before then you need to ensure that your image supports the user and group ID configured and also manually change permissions of all files so that Jenkins is still able to use them. - -### Summary of updated values - -As version 2.0.0 only updates default values and nothing else it's still possible to migrate to this version and opt out of some or all new defaults. -All you have to do is ensure the old values are set in your installation. - -Here we show which values have changed and the previous default values: - -```yaml -controller: - runAsUser: 1000 # was unset before - fsGroup: 1000 # was unset before - JCasC: - enabled: true # was false - defaultConfig: true # was false - sidecars: - configAutoReload: - enabled: true # was false -``` - -### Migration steps - -Migration instructions heavily depend on your current setup. -So think of the list below more as a general guideline of what should be done. - -- Ensure that the Jenkins image you are using contains a user with ID 1000 and a group with the same ID. - That's the case for `jenkins/jenkins:lts` image, which the chart uses by default -- Make a backup of your existing installation especially the persistent volume -- Ensure that you have the configuration as code plugin installed -- Export your current settings via the plugin: - `Manage Jenkins` -> `Configuration as Code` -> `Download Configuration` -- prepare your values file for the update e.g. add additional configuration as code setting that you need. - The export taken from above might be a good starting point for this. - In addition, the [demos](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) from the plugin itself are quite useful. -- Test drive those setting on a separate installation -- Put Jenkins to Quiet Down mode so that it does not accept new jobs - `/quietDown` -- Change permissions of all files and folders to the new user and group ID: - - ```console - kubectl exec -it -c jenkins /bin/bash - chown -R 1000:1000 /var/jenkins_home - ``` - -- Update Jenkins - -## To 1.0.0 - -Breaking changes: - -- Values have been renamed to follow [helm recommended naming conventions](https://helm.sh/docs/chart_best_practices/#naming-conventions) so that all variables start with a lowercase letter and words are separated with camelCase -- All resources are now using [helm recommended standard labels](https://helm.sh/docs/chart_best_practices/#standard-labels) - -As a result of the label changes also the selectors of the deployment have been updated. -Those are immutable so trying an updated will cause an error like: - -```console -Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-controller", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable -``` - -In order to upgrade, [uninstall](./README.md#uninstall-chart) the Jenkins Deployment before upgrading: diff --git a/helm-templates/jenkins-grn/VALUES.md b/helm-templates/jenkins-grn/VALUES.md deleted file mode 100644 index 2c8aaf7..0000000 --- a/helm-templates/jenkins-grn/VALUES.md +++ /dev/null @@ -1,324 +0,0 @@ -# Jenkins - -## Configuration - -The following tables list the configurable parameters of the Jenkins chart and their default values. - -## Values - -| Key | Type | Description | Default | -|:----|:-----|:---------|:------------| -| [additionalAgents](./values.yaml#L1207) | object | Configure additional | `{}` | -| [additionalClouds](./values.yaml#L1232) | object | | `{}` | -| [agent.TTYEnabled](./values.yaml#L1112) | bool | Allocate pseudo tty to the side container | `false` | -| [agent.additionalContainers](./values.yaml#L1160) | list | Add additional containers to the agents | `[]` | -| [agent.alwaysPullImage](./values.yaml#L1005) | bool | Always pull agent container image before build | `false` | -| [agent.annotations](./values.yaml#L1156) | object | Annotations to apply to the pod | `{}` | -| [agent.args](./values.yaml#L1106) | string | Arguments passed to command to execute | `"${computer.jnlpmac} ${computer.name}"` | -| [agent.command](./values.yaml#L1104) | string | Command to execute when side container starts | `nil` | -| [agent.componentName](./values.yaml#L973) | string | | `"jenkins-agent"` | -| [agent.connectTimeout](./values.yaml#L1154) | int | Timeout in seconds for an agent to be online | `100` | -| [agent.containerCap](./values.yaml#L1114) | int | Max number of agents to launch for a whole cluster. | `10` | -| [agent.customJenkinsLabels](./values.yaml#L970) | list | Append Jenkins labels to the agent | `[]` | -| [agent.defaultsProviderTemplate](./values.yaml#L922) | string | The name of the pod template to use for providing default values | `""` | -| [agent.directConnection](./values.yaml#L976) | bool | | `false` | -| [agent.disableDefaultAgent](./values.yaml#L1178) | bool | Disable the default Jenkins Agent configuration | `false` | -| [agent.enabled](./values.yaml#L920) | bool | Enable Kubernetes plugin jnlp-agent podTemplate | `true` | -| [agent.envVars](./values.yaml#L1087) | list | Environment variables for the agent Pod | `[]` | -| [agent.garbageCollection.enabled](./values.yaml#L1123) | bool | When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them. | `false` | -| [agent.garbageCollection.namespaces](./values.yaml#L1125) | string | Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line. | `""` | -| [agent.garbageCollection.timeout](./values.yaml#L1130) | int | Timeout value for orphaned pods | `300` | -| [agent.hostNetworking](./values.yaml#L984) | bool | Enables the agent to use the host network | `false` | -| [agent.idleMinutes](./values.yaml#L1133) | int | Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it | `0` | -| [agent.image.registry](./values.yaml#L961) | string | Registry to pull the agent jnlp image from | `""` | -| [agent.image.repository](./values.yaml#L963) | string | Repository to pull the agent jnlp image from | `"jenkins/inbound-agent"` | -| [agent.image.tag](./values.yaml#L965) | string | Tag of the image to pull | `"3309.v27b_9314fd1a_4-4"` | -| [agent.imagePullSecretName](./values.yaml#L972) | string | Name of the secret to be used to pull the image | `nil` | -| [agent.inheritYamlMergeStrategy](./values.yaml#L1152) | bool | Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one | `false` | -| [agent.instanceCap](./values.yaml#L1116) | int | Max number of agents to launch for this type of agent | `2147483647` | -| [agent.jenkinsTunnel](./values.yaml#L938) | string | Overrides the Kubernetes Jenkins tunnel | `nil` | -| [agent.jenkinsUrl](./values.yaml#L934) | string | Overrides the Kubernetes Jenkins URL | `nil` | -| [agent.jnlpregistry](./values.yaml#L958) | string | Custom registry used to pull the agent jnlp image from | `nil` | -| [agent.kubernetesConnectTimeout](./values.yaml#L944) | int | The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5 | `5` | -| [agent.kubernetesReadTimeout](./values.yaml#L946) | int | The read timeout in seconds for connections to Kubernetes API. The minimum value is 15 | `15` | -| [agent.livenessProbe](./values.yaml#L995) | object | | `{}` | -| [agent.maxRequestsPerHostStr](./values.yaml#L948) | string | The maximum concurrent connections to Kubernetes API | `"32"` | -| [agent.namespace](./values.yaml#L954) | string | Namespace in which the Kubernetes agents should be launched | `nil` | -| [agent.nodeSelector](./values.yaml#L1098) | object | Node labels for pod assignment | `{}` | -| [agent.nodeUsageMode](./values.yaml#L968) | string | | `"NORMAL"` | -| [agent.podLabels](./values.yaml#L956) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` | -| [agent.podName](./values.yaml#L1118) | string | Agent Pod base name | `"default"` | -| [agent.podRetention](./values.yaml#L1014) | string | | `"Never"` | -| [agent.podTemplates](./values.yaml#L1188) | object | Configures extra pod templates for the default kubernetes cloud | `{}` | -| [agent.privileged](./values.yaml#L978) | bool | Agent privileged container | `false` | -| [agent.resources](./values.yaml#L986) | object | Resources allocation (Requests and Limits) | `{"limits":{"cpu":"512m","memory":"512Mi"},"requests":{"cpu":"512m","memory":"512Mi"}}` | -| [agent.restrictedPssSecurityContext](./values.yaml#L1011) | bool | Set a restricted securityContext on jnlp containers | `false` | -| [agent.retentionTimeout](./values.yaml#L950) | int | Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated | `5` | -| [agent.runAsGroup](./values.yaml#L982) | string | Configure container group | `nil` | -| [agent.runAsUser](./values.yaml#L980) | string | Configure container user | `nil` | -| [agent.secretEnvVars](./values.yaml#L1091) | list | Mount a secret as environment variable | `[]` | -| [agent.serviceAccount](./values.yaml#L930) | string | Override the default service account | `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true` | -| [agent.showRawYaml](./values.yaml#L1018) | bool | | `true` | -| [agent.sideContainerName](./values.yaml#L1108) | string | Side container name | `"jnlp"` | -| [agent.skipTlsVerify](./values.yaml#L940) | bool | Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI | `false` | -| [agent.usageRestricted](./values.yaml#L942) | bool | Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI | `false` | -| [agent.useDefaultServiceAccount](./values.yaml#L926) | bool | Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount` | `true` | -| [agent.volumes](./values.yaml#L1025) | list | Additional volumes | `[]` | -| [agent.waitForPodSec](./values.yaml#L952) | int | Seconds to wait for pod to be running | `600` | -| [agent.websocket](./values.yaml#L975) | bool | Enables agent communication via websockets | `false` | -| [agent.workingDir](./values.yaml#L967) | string | Configure working directory for default agent | `"/home/jenkins/agent"` | -| [agent.workspaceVolume](./values.yaml#L1060) | object | Workspace volume (defaults to EmptyDir) | `{}` | -| [agent.yamlMergeStrategy](./values.yaml#L1150) | string | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override" | `"override"` | -| [agent.yamlTemplate](./values.yaml#L1139) | string | The raw yaml of a Pod API Object to merge into the agent spec | `""` | -| [awsSecurityGroupPolicies.enabled](./values.yaml#L1365) | bool | | `false` | -| [awsSecurityGroupPolicies.policies[0].name](./values.yaml#L1367) | string | | `""` | -| [awsSecurityGroupPolicies.policies[0].podSelector](./values.yaml#L1369) | object | | `{}` | -| [awsSecurityGroupPolicies.policies[0].securityGroupIds](./values.yaml#L1368) | list | | `[]` | -| [checkDeprecation](./values.yaml#L1362) | bool | Checks if any deprecated values are used | `true` | -| [clusterZone](./values.yaml#L21) | string | Override the cluster name for FQDN resolving | `"cluster.local"` | -| [controller.JCasC.authorizationStrategy](./values.yaml#L545) | string | Jenkins Config as Code Authorization Strategy-section | `"loggedInUsersCanDoAnything:\n allowAnonymousRead: false"` | -| [controller.JCasC.configMapAnnotations](./values.yaml#L550) | object | Annotations for the JCasC ConfigMap | `{}` | -| [controller.JCasC.configScripts](./values.yaml#L519) | object | List of Jenkins Config as Code scripts | `{}` | -| [controller.JCasC.configUrls](./values.yaml#L516) | list | Remote URLs for configuration files. | `[]` | -| [controller.JCasC.defaultConfig](./values.yaml#L510) | bool | Enables default Jenkins configuration via configuration as code plugin | `true` | -| [controller.JCasC.overwriteConfiguration](./values.yaml#L514) | bool | Whether Jenkins Config as Code should overwrite any existing configuration | `false` | -| [controller.JCasC.security](./values.yaml#L526) | object | Jenkins Config as Code security-section | `{"apiToken":{"creationOfLegacyTokenEnabled":false,"tokenGenerationOnCreationEnabled":false,"usageStatisticsEnabled":true}}` | -| [controller.JCasC.securityRealm](./values.yaml#L534) | string | Jenkins Config as Code Security Realm-section | `"local:\n allowsSignup: false\n enableCaptcha: false\n users:\n - id: \"${chart-admin-username}\"\n name: \"Jenkins Admin\"\n password: \"${chart-admin-password}\""` | -| [controller.additionalExistingSecrets](./values.yaml#L471) | list | List of additional existing secrets to mount | `[]` | -| [controller.additionalPlugins](./values.yaml#L421) | list | List of plugins to install in addition to those listed in controller.installPlugins | `[]` | -| [controller.additionalSecrets](./values.yaml#L480) | list | List of additional secrets to create and mount | `[]` | -| [controller.admin.createSecret](./values.yaml#L90) | bool | Create secret for admin user | `true` | -| [controller.admin.existingSecret](./values.yaml#L93) | string | The name of an existing secret containing the admin credentials | `""` | -| [controller.admin.password](./values.yaml#L80) | string | Admin password created as a secret if `controller.admin.createSecret` is true | `` | -| [controller.admin.passwordKey](./values.yaml#L85) | string | The key in the existing admin secret containing the password | `"jenkins-admin-password"` | -| [controller.admin.userKey](./values.yaml#L83) | string | The key in the existing admin secret containing the username | `"jenkins-admin-user"` | -| [controller.admin.username](./values.yaml#L77) | string | Admin username created as a secret if `controller.admin.createSecret` is true | `"admin"` | -| [controller.affinity](./values.yaml#L674) | object | Affinity settings | `{}` | -| [controller.agentListenerEnabled](./values.yaml#L330) | bool | Create Agent listener service | `true` | -| [controller.agentListenerExternalTrafficPolicy](./values.yaml#L340) | string | Traffic Policy of for the agentListener service | `nil` | -| [controller.agentListenerHostPort](./values.yaml#L334) | string | Host port to listen for agents | `nil` | -| [controller.agentListenerLoadBalancerIP](./values.yaml#L370) | string | Static IP for the agentListener LoadBalancer | `nil` | -| [controller.agentListenerLoadBalancerSourceRanges](./values.yaml#L342) | list | Allowed inbound IP for the agentListener service | `["0.0.0.0/0"]` | -| [controller.agentListenerNodePort](./values.yaml#L336) | string | Node port to listen for agents | `nil` | -| [controller.agentListenerPort](./values.yaml#L332) | int | Listening port for agents | `50000` | -| [controller.agentListenerServiceAnnotations](./values.yaml#L365) | object | Annotations for the agentListener service | `{}` | -| [controller.agentListenerServiceType](./values.yaml#L362) | string | Defines how to expose the agentListener service | `"ClusterIP"` | -| [controller.backendconfig.annotations](./values.yaml#L778) | object | backendconfig annotations | `{}` | -| [controller.backendconfig.apiVersion](./values.yaml#L772) | string | backendconfig API version | `"extensions/v1beta1"` | -| [controller.backendconfig.enabled](./values.yaml#L770) | bool | Enables backendconfig | `false` | -| [controller.backendconfig.labels](./values.yaml#L776) | object | backendconfig labels | `{}` | -| [controller.backendconfig.name](./values.yaml#L774) | string | backendconfig name | `nil` | -| [controller.backendconfig.spec](./values.yaml#L780) | object | backendconfig spec | `{}` | -| [controller.cloudName](./values.yaml#L499) | string | Name of default cloud configuration. | `"kubernetes"` | -| [controller.clusterIp](./values.yaml#L225) | string | k8s service clusterIP. Only used if serviceType is ClusterIP | `nil` | -| [controller.componentName](./values.yaml#L34) | string | Used for label app.kubernetes.io/component | `"jenkins-controller"` | -| [controller.containerEnv](./values.yaml#L155) | list | Environment variables for Jenkins Container | `[]` | -| [controller.containerEnvFrom](./values.yaml#L152) | list | Environment variable sources for Jenkins Container | `[]` | -| [controller.containerSecurityContext](./values.yaml#L210) | object | Allow controlling the securityContext for the jenkins container | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":1000}` | -| [controller.csrf.defaultCrumbIssuer.enabled](./values.yaml#L351) | bool | Enable the default CSRF Crumb issuer | `true` | -| [controller.csrf.defaultCrumbIssuer.proxyCompatability](./values.yaml#L353) | bool | Enable proxy compatibility | `true` | -| [controller.customInitContainers](./values.yaml#L553) | list | Custom init-container specification in raw-yaml format | `[]` | -| [controller.customJenkinsLabels](./values.yaml#L68) | list | Append Jenkins labels to the controller | `[]` | -| [controller.disableRememberMe](./values.yaml#L59) | bool | Disable use of remember me | `false` | -| [controller.disabledAgentProtocols](./values.yaml#L345) | list | Disabled agent protocols | `["JNLP-connect","JNLP2-connect"]` | -| [controller.enableRawHtmlMarkupFormatter](./values.yaml#L441) | bool | Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter) | `false` | -| [controller.enableServiceLinks](./values.yaml#L129) | bool | | `false` | -| [controller.executorMode](./values.yaml#L65) | string | Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE" | `"NORMAL"` | -| [controller.existingSecret](./values.yaml#L468) | string | | `nil` | -| [controller.extraPorts](./values.yaml#L400) | list | Optionally configure other ports to expose in the controller container | `[]` | -| [controller.fsGroup](./values.yaml#L191) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | -| [controller.googlePodMonitor.enabled](./values.yaml#L841) | bool | | `false` | -| [controller.googlePodMonitor.scrapeEndpoint](./values.yaml#L846) | string | | `"/prometheus"` | -| [controller.googlePodMonitor.scrapeInterval](./values.yaml#L844) | string | | `"60s"` | -| [controller.healthProbes](./values.yaml#L260) | bool | Enable Kubernetes Probes configuration configured in `controller.probes` | `true` | -| [controller.hostAliases](./values.yaml#L794) | list | Allows for adding entries to Pod /etc/hosts | `[]` | -| [controller.hostNetworking](./values.yaml#L70) | bool | | `false` | -| [controller.httpsKeyStore.disableSecretMount](./values.yaml#L862) | bool | | `false` | -| [controller.httpsKeyStore.enable](./values.yaml#L853) | bool | Enables HTTPS keystore on jenkins controller | `false` | -| [controller.httpsKeyStore.fileName](./values.yaml#L870) | string | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `"keystore.jks"` | -| [controller.httpsKeyStore.httpPort](./values.yaml#L866) | int | HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port. | `8081` | -| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey](./values.yaml#L861) | string | Name of the key in the secret that contains the JKS password | `"https-jks-password"` | -| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName](./values.yaml#L859) | string | Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file | `""` | -| [controller.httpsKeyStore.jenkinsHttpsJksSecretKey](./values.yaml#L857) | string | Name of the key in the secret that already has ssl keystore | `"jenkins-jks-file"` | -| [controller.httpsKeyStore.jenkinsHttpsJksSecretName](./values.yaml#L855) | string | Name of the secret that already has ssl keystore | `""` | -| [controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded](./values.yaml#L875) | string | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | `nil` | -| [controller.httpsKeyStore.password](./values.yaml#L872) | string | Jenkins keystore password | `"password"` | -| [controller.httpsKeyStore.path](./values.yaml#L868) | string | Path of HTTPS keystore file | `"/var/jenkins_keystore"` | -| [controller.image.pullPolicy](./values.yaml#L47) | string | Controller image pull policy | `"Always"` | -| [controller.image.registry](./values.yaml#L37) | string | Controller image registry | `"docker.io"` | -| [controller.image.repository](./values.yaml#L39) | string | Controller image repository | `"jenkins/jenkins"` | -| [controller.image.tag](./values.yaml#L42) | string | Controller image tag override; i.e., tag: "2.440.1-jdk21" | `nil` | -| [controller.image.tagLabel](./values.yaml#L45) | string | Controller image tag label | `"jdk21"` | -| [controller.imagePullSecretName](./values.yaml#L49) | string | Controller image pull secret | `nil` | -| [controller.ingress.annotations](./values.yaml#L716) | object | Ingress annotations | `{}` | -| [controller.ingress.apiVersion](./values.yaml#L712) | string | Ingress API version | `"extensions/v1beta1"` | -| [controller.ingress.enabled](./values.yaml#L695) | bool | Enables ingress | `false` | -| [controller.ingress.hostName](./values.yaml#L730) | string | Ingress hostname | `nil` | -| [controller.ingress.labels](./values.yaml#L714) | object | Ingress labels | `{}` | -| [controller.ingress.path](./values.yaml#L726) | string | Ingress path | `nil` | -| [controller.ingress.paths](./values.yaml#L699) | list | Override for the default Ingress paths | `[]` | -| [controller.ingress.resourceRootUrl](./values.yaml#L732) | string | Hostname to serve assets from | `nil` | -| [controller.ingress.tls](./values.yaml#L734) | list | Ingress TLS configuration | `[]` | -| [controller.initConfigMap](./values.yaml#L458) | string | Name of the existing ConfigMap that contains init scripts | `nil` | -| [controller.initContainerEnv](./values.yaml#L146) | list | Environment variables for Init Container | `[]` | -| [controller.initContainerEnvFrom](./values.yaml#L142) | list | Environment variable sources for Init Container | `[]` | -| [controller.initContainerResources](./values.yaml#L133) | object | Resources allocation (Requests and Limits) for Init Container | `{}` | -| [controller.initScripts](./values.yaml#L454) | object | Map of groovy init scripts to be executed during Jenkins controller start | `{}` | -| [controller.initializeOnce](./values.yaml#L426) | bool | Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true` | `false` | -| [controller.installLatestPlugins](./values.yaml#L415) | bool | Download the minimum required version or latest version of all dependencies | `true` | -| [controller.installLatestSpecifiedPlugins](./values.yaml#L418) | bool | Set to true to download the latest version of any plugin that is requested to have the latest version | `false` | -| [controller.installPlugins](./values.yaml#L407) | list | List of Jenkins plugins to install. If you don't want to install plugins, set it to `false` | `["kubernetes:4353.vb_47977da_9417","workflow-aggregator:608.v67378e9d3db_1","git:5.7.0","configuration-as-code:1971.vf9280461ea_89"]` | -| [controller.javaOpts](./values.yaml#L161) | string | Append to `JAVA_OPTS` env var | `nil` | -| [controller.jenkinsAdminEmail](./values.yaml#L95) | string | Email address for the administrator of the Jenkins instance | `nil` | -| [controller.jenkinsHome](./values.yaml#L100) | string | Custom Jenkins home path | `"/var/jenkins_home"` | -| [controller.jenkinsOpts](./values.yaml#L163) | string | Append to `JENKINS_OPTS` env var | `nil` | -| [controller.jenkinsRef](./values.yaml#L105) | string | Custom Jenkins reference path | `"/usr/share/jenkins/ref"` | -| [controller.jenkinsUriPrefix](./values.yaml#L178) | string | Root URI Jenkins will be served on | `nil` | -| [controller.jenkinsUrl](./values.yaml#L173) | string | Set Jenkins URL if you are not using the ingress definitions provided by the chart | `nil` | -| [controller.jenkinsUrlProtocol](./values.yaml#L170) | string | Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise | `nil` | -| [controller.jenkinsWar](./values.yaml#L108) | string | | `"/usr/share/jenkins/jenkins.war"` | -| [controller.jmxPort](./values.yaml#L397) | string | Open a port, for JMX stats | `nil` | -| [controller.legacyRemotingSecurityEnabled](./values.yaml#L373) | bool | Whether legacy remoting security should be enabled | `false` | -| [controller.lifecycle](./values.yaml#L51) | object | Lifecycle specification for controller-container | `{}` | -| [controller.loadBalancerIP](./values.yaml#L388) | string | Optionally assign a known public LB IP | `nil` | -| [controller.loadBalancerSourceRanges](./values.yaml#L384) | list | Allowed inbound IP addresses | `["0.0.0.0/0"]` | -| [controller.markupFormatter](./values.yaml#L445) | string | Yaml of the markup formatter to use | `"plainText"` | -| [controller.nodePort](./values.yaml#L231) | string | k8s node port. Only used if serviceType is NodePort | `nil` | -| [controller.nodeSelector](./values.yaml#L661) | object | Node labels for pod assignment | `{}` | -| [controller.numExecutors](./values.yaml#L62) | int | Set Number of executors | `0` | -| [controller.overwritePlugins](./values.yaml#L430) | bool | Overwrite installed plugins on start | `false` | -| [controller.overwritePluginsFromImage](./values.yaml#L434) | bool | Overwrite plugins that are already installed in the controller image | `true` | -| [controller.podAnnotations](./values.yaml#L682) | object | Annotations for controller pod | `{}` | -| [controller.podDisruptionBudget.annotations](./values.yaml#L324) | object | | `{}` | -| [controller.podDisruptionBudget.apiVersion](./values.yaml#L322) | string | Policy API version | `"policy/v1beta1"` | -| [controller.podDisruptionBudget.enabled](./values.yaml#L317) | bool | Enable Kubernetes Pod Disruption Budget configuration | `false` | -| [controller.podDisruptionBudget.labels](./values.yaml#L325) | object | | `{}` | -| [controller.podDisruptionBudget.maxUnavailable](./values.yaml#L327) | string | Number of pods that can be unavailable. Either an absolute number or a percentage | `"0"` | -| [controller.podLabels](./values.yaml#L253) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` | -| [controller.podSecurityContextOverride](./values.yaml#L207) | string | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities` | `nil` | -| [controller.priorityClassName](./values.yaml#L679) | string | The name of a `priorityClass` to apply to the controller pod | `nil` | -| [controller.probes.livenessProbe.failureThreshold](./values.yaml#L278) | int | Set the failure threshold for the liveness probe | `5` | -| [controller.probes.livenessProbe.httpGet.path](./values.yaml#L281) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | -| [controller.probes.livenessProbe.httpGet.port](./values.yaml#L283) | string | Set the Pod's HTTP port to use for the liveness probe | `"http"` | -| [controller.probes.livenessProbe.initialDelaySeconds](./values.yaml#L292) | string | Set the initial delay for the liveness probe in seconds | `nil` | -| [controller.probes.livenessProbe.periodSeconds](./values.yaml#L285) | int | Set the time interval between two liveness probes executions in seconds | `10` | -| [controller.probes.livenessProbe.timeoutSeconds](./values.yaml#L287) | int | Set the timeout for the liveness probe in seconds | `5` | -| [controller.probes.readinessProbe.failureThreshold](./values.yaml#L296) | int | Set the failure threshold for the readiness probe | `3` | -| [controller.probes.readinessProbe.httpGet.path](./values.yaml#L299) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | -| [controller.probes.readinessProbe.httpGet.port](./values.yaml#L301) | string | Set the Pod's HTTP port to use for the readiness probe | `"http"` | -| [controller.probes.readinessProbe.initialDelaySeconds](./values.yaml#L310) | string | Set the initial delay for the readiness probe in seconds | `nil` | -| [controller.probes.readinessProbe.periodSeconds](./values.yaml#L303) | int | Set the time interval between two readiness probes executions in seconds | `10` | -| [controller.probes.readinessProbe.timeoutSeconds](./values.yaml#L305) | int | Set the timeout for the readiness probe in seconds | `5` | -| [controller.probes.startupProbe.failureThreshold](./values.yaml#L265) | int | Set the failure threshold for the startup probe | `12` | -| [controller.probes.startupProbe.httpGet.path](./values.yaml#L268) | string | Set the Pod's HTTP path for the startup probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` | -| [controller.probes.startupProbe.httpGet.port](./values.yaml#L270) | string | Set the Pod's HTTP port to use for the startup probe | `"http"` | -| [controller.probes.startupProbe.periodSeconds](./values.yaml#L272) | int | Set the time interval between two startup probes executions in seconds | `10` | -| [controller.probes.startupProbe.timeoutSeconds](./values.yaml#L274) | int | Set the timeout for the startup probe in seconds | `5` | -| [controller.projectNamingStrategy](./values.yaml#L437) | string | | `"standard"` | -| [controller.prometheus.alertingRulesAdditionalLabels](./values.yaml#L827) | object | Additional labels to add to the PrometheusRule object | `{}` | -| [controller.prometheus.alertingrules](./values.yaml#L825) | list | Array of prometheus alerting rules | `[]` | -| [controller.prometheus.enabled](./values.yaml#L810) | bool | Enables prometheus service monitor | `false` | -| [controller.prometheus.metricRelabelings](./values.yaml#L837) | list | | `[]` | -| [controller.prometheus.prometheusRuleNamespace](./values.yaml#L829) | string | Set a custom namespace where to deploy PrometheusRule resource | `""` | -| [controller.prometheus.relabelings](./values.yaml#L835) | list | | `[]` | -| [controller.prometheus.scrapeEndpoint](./values.yaml#L820) | string | The endpoint prometheus should get metrics from | `"/prometheus"` | -| [controller.prometheus.scrapeInterval](./values.yaml#L816) | string | How often prometheus should scrape metrics | `"60s"` | -| [controller.prometheus.serviceMonitorAdditionalLabels](./values.yaml#L812) | object | Additional labels to add to the service monitor object | `{}` | -| [controller.prometheus.serviceMonitorNamespace](./values.yaml#L814) | string | Set a custom namespace where to deploy ServiceMonitor resource | `nil` | -| [controller.publishNotReadyAddresses](./values.yaml#L239) | string | | `nil` | -| [controller.resources](./values.yaml#L114) | object | Resource allocation (Requests and Limits) | `{"limits":{"cpu":"2000m","memory":"4096Mi"},"requests":{"cpu":"50m","memory":"256Mi"}}` | -| [controller.route.annotations](./values.yaml#L789) | object | Route annotations | `{}` | -| [controller.route.enabled](./values.yaml#L785) | bool | Enables openshift route | `false` | -| [controller.route.labels](./values.yaml#L787) | object | Route labels | `{}` | -| [controller.route.path](./values.yaml#L791) | string | Route path | `nil` | -| [controller.runAsUser](./values.yaml#L188) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | -| [controller.schedulerName](./values.yaml#L657) | string | Name of the Kubernetes scheduler to use | `""` | -| [controller.scriptApproval](./values.yaml#L449) | list | List of groovy functions to approve | `[]` | -| [controller.secondaryingress.annotations](./values.yaml#L752) | object | | `{}` | -| [controller.secondaryingress.apiVersion](./values.yaml#L750) | string | | `"extensions/v1beta1"` | -| [controller.secondaryingress.enabled](./values.yaml#L744) | bool | | `false` | -| [controller.secondaryingress.hostName](./values.yaml#L759) | string | | `nil` | -| [controller.secondaryingress.labels](./values.yaml#L751) | object | | `{}` | -| [controller.secondaryingress.paths](./values.yaml#L747) | list | | `[]` | -| [controller.secondaryingress.tls](./values.yaml#L760) | string | | `nil` | -| [controller.secretClaims](./values.yaml#L492) | list | List of `SecretClaim` resources to create | `[]` | -| [controller.securityContextCapabilities](./values.yaml#L197) | object | | `{}` | -| [controller.serviceAnnotations](./values.yaml#L242) | object | Jenkins controller service annotations | `{}` | -| [controller.serviceEnabled](./values.yaml#L217) | bool | enable or disable the controller k8s service | `true` | -| [controller.serviceExternalTrafficPolicy](./values.yaml#L235) | string | | `nil` | -| [controller.serviceLabels](./values.yaml#L248) | object | Labels for the Jenkins controller-service | `{}` | -| [controller.servicePort](./values.yaml#L227) | int | k8s service port | `8080` | -| [controller.serviceType](./values.yaml#L222) | string | k8s service type | `"ClusterIP"` | -| [controller.shareProcessNamespace](./values.yaml#L123) | bool | | `false` | -| [controller.sidecars.additionalSidecarContainers](./values.yaml#L639) | list | Configures additional sidecar container(s) for the Jenkins controller | `[]` | -| [controller.sidecars.configAutoReload.additionalVolumeMounts](./values.yaml#L584) | list | Enables additional volume mounts for the config auto-reload container | `[]` | -| [controller.sidecars.configAutoReload.containerSecurityContext](./values.yaml#L634) | object | Enable container security context | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` | -| [controller.sidecars.configAutoReload.enabled](./values.yaml#L566) | bool | Enable Jenkins Config as Code auto-reload | `true` | -| [controller.sidecars.configAutoReload.env](./values.yaml#L616) | list | Environment variables for the Jenkins Config as Code auto-reload container | `[]` | -| [controller.sidecars.configAutoReload.envFrom](./values.yaml#L614) | list | Environment variable sources for the Jenkins Config as Code auto-reload container | `[]` | -| [controller.sidecars.configAutoReload.folder](./values.yaml#L627) | string | | `"/var/jenkins_home/casc_configs"` | -| [controller.sidecars.configAutoReload.image.registry](./values.yaml#L569) | string | Registry for the image that triggers the reload | `"docker.io"` | -| [controller.sidecars.configAutoReload.image.repository](./values.yaml#L571) | string | Repository of the image that triggers the reload | `"kiwigrid/k8s-sidecar"` | -| [controller.sidecars.configAutoReload.image.tag](./values.yaml#L573) | string | Tag for the image that triggers the reload | `"1.30.3"` | -| [controller.sidecars.configAutoReload.imagePullPolicy](./values.yaml#L574) | string | | `"IfNotPresent"` | -| [controller.sidecars.configAutoReload.logging](./values.yaml#L591) | object | Config auto-reload logging settings | `{"configuration":{"backupCount":3,"formatter":"JSON","logLevel":"INFO","logToConsole":true,"logToFile":false,"maxBytes":1024,"override":false}}` | -| [controller.sidecars.configAutoReload.logging.configuration.override](./values.yaml#L595) | bool | Enables custom log config utilizing using the settings below. | `false` | -| [controller.sidecars.configAutoReload.reqRetryConnect](./values.yaml#L609) | int | How many connection-related errors to retry on | `10` | -| [controller.sidecars.configAutoReload.resources](./values.yaml#L575) | object | | `{}` | -| [controller.sidecars.configAutoReload.scheme](./values.yaml#L604) | string | The scheme to use when connecting to the Jenkins configuration as code endpoint | `"http"` | -| [controller.sidecars.configAutoReload.skipTlsVerify](./values.yaml#L606) | bool | Skip TLS verification when connecting to the Jenkins configuration as code endpoint | `false` | -| [controller.sidecars.configAutoReload.sleepTime](./values.yaml#L611) | string | How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) | `nil` | -| [controller.sidecars.configAutoReload.sshTcpPort](./values.yaml#L625) | int | | `1044` | -| [controller.statefulSetAnnotations](./values.yaml#L684) | object | Annotations for controller StatefulSet | `{}` | -| [controller.statefulSetLabels](./values.yaml#L244) | object | Jenkins controller custom labels for the StatefulSet | `{}` | -| [controller.targetPort](./values.yaml#L229) | int | k8s target port | `8080` | -| [controller.terminationGracePeriodSeconds](./values.yaml#L667) | string | Set TerminationGracePeriodSeconds | `nil` | -| [controller.terminationMessagePath](./values.yaml#L669) | string | Set the termination message path | `nil` | -| [controller.terminationMessagePolicy](./values.yaml#L671) | string | Set the termination message policy | `nil` | -| [controller.testEnabled](./values.yaml#L849) | bool | Can be used to disable rendering controller test resources when using helm template | `true` | -| [controller.tolerations](./values.yaml#L665) | list | Toleration labels for pod assignment | `[]` | -| [controller.topologySpreadConstraints](./values.yaml#L691) | object | Topology spread constraints | `{}` | -| [controller.updateStrategy](./values.yaml#L688) | object | Update strategy for StatefulSet | `{}` | -| [controller.usePodSecurityContext](./values.yaml#L181) | bool | Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) | `true` | -| [credentialsId](./values.yaml#L27) | string | The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed. | `nil` | -| [fullnameOverride](./values.yaml#L13) | string | Override the full resource names | `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins` | -| [helmtest.bats.image.registry](./values.yaml#L1378) | string | Registry of the image used to test the framework | `"docker.io"` | -| [helmtest.bats.image.repository](./values.yaml#L1380) | string | Repository of the image used to test the framework | `"bats/bats"` | -| [helmtest.bats.image.tag](./values.yaml#L1382) | string | Tag of the image to test the framework | `"1.12.0"` | -| [kubernetesURL](./values.yaml#L24) | string | The URL of the Kubernetes API server | `"https://kubernetes.default"` | -| [nameOverride](./values.yaml#L10) | string | Override the resource name prefix | `Chart.Name` | -| [namespaceOverride](./values.yaml#L16) | string | Override the deployment namespace | `Release.Namespace` | -| [networkPolicy.apiVersion](./values.yaml#L1301) | string | NetworkPolicy ApiVersion | `"networking.k8s.io/v1"` | -| [networkPolicy.enabled](./values.yaml#L1296) | bool | Enable the creation of NetworkPolicy resources | `false` | -| [networkPolicy.externalAgents.except](./values.yaml#L1316) | list | A list of IP sub-ranges to be excluded from the allowlisted IP range | `[]` | -| [networkPolicy.externalAgents.ipCIDR](./values.yaml#L1314) | string | The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16 | `nil` | -| [networkPolicy.internalAgents.allowed](./values.yaml#L1305) | bool | Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels | `true` | -| [networkPolicy.internalAgents.namespaceLabels](./values.yaml#L1309) | object | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller | `{}` | -| [networkPolicy.internalAgents.podLabels](./values.yaml#L1307) | object | A map of labels (keys/values) that agent pods must have to be able to connect to controller | `{}` | -| [persistence.accessMode](./values.yaml#L1271) | string | The PVC access mode | `"ReadWriteOnce"` | -| [persistence.annotations](./values.yaml#L1267) | object | Annotations for the PVC | `{}` | -| [persistence.dataSource](./values.yaml#L1277) | object | Existing data source to clone PVC from | `{}` | -| [persistence.enabled](./values.yaml#L1251) | bool | Enable the use of a Jenkins PVC | `true` | -| [persistence.existingClaim](./values.yaml#L1257) | string | Provide the name of a PVC | `nil` | -| [persistence.labels](./values.yaml#L1269) | object | Labels for the PVC | `{}` | -| [persistence.mounts](./values.yaml#L1289) | list | Additional mounts | `[]` | -| [persistence.size](./values.yaml#L1273) | string | The size of the PVC | `"8Gi"` | -| [persistence.storageClass](./values.yaml#L1265) | string | Storage class for the PVC | `nil` | -| [persistence.subPath](./values.yaml#L1282) | string | SubPath for jenkins-home mount | `nil` | -| [persistence.volumes](./values.yaml#L1284) | list | Additional volumes | `[]` | -| [rbac.create](./values.yaml#L1323) | bool | Whether RBAC resources are created | `true` | -| [rbac.readSecrets](./values.yaml#L1325) | bool | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` | -| [rbac.useOpenShiftNonRootSCC](./values.yaml#L1327) | bool | Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints | `false` | -| [renderHelmLabels](./values.yaml#L30) | bool | Enables rendering of the helm.sh/chart label to the annotations | `true` | -| [serviceAccount.annotations](./values.yaml#L1337) | object | Configures annotations for the ServiceAccount | `{}` | -| [serviceAccount.automountServiceAccountToken](./values.yaml#L1343) | bool | Auto-mount ServiceAccount token | `true` | -| [serviceAccount.create](./values.yaml#L1331) | bool | Configures if a ServiceAccount with this name should be created | `true` | -| [serviceAccount.extraLabels](./values.yaml#L1339) | object | Configures extra labels for the ServiceAccount | `{}` | -| [serviceAccount.imagePullSecretName](./values.yaml#L1341) | string | Controller ServiceAccount image pull secret | `nil` | -| [serviceAccount.name](./values.yaml#L1335) | string | | `nil` | -| [serviceAccountAgent.annotations](./values.yaml#L1353) | object | Configures annotations for the agent ServiceAccount | `{}` | -| [serviceAccountAgent.automountServiceAccountToken](./values.yaml#L1359) | bool | Auto-mount ServiceAccount token | `true` | -| [serviceAccountAgent.create](./values.yaml#L1347) | bool | Configures if an agent ServiceAccount should be created | `false` | -| [serviceAccountAgent.extraLabels](./values.yaml#L1355) | object | Configures extra labels for the agent ServiceAccount | `{}` | -| [serviceAccountAgent.imagePullSecretName](./values.yaml#L1357) | string | Agent ServiceAccount image pull secret | `nil` | -| [serviceAccountAgent.name](./values.yaml#L1351) | string | The name of the agent ServiceAccount to be used by access-controlled resources | `nil` | diff --git a/helm-templates/jenkins-grn/VALUES.md.gotmpl b/helm-templates/jenkins-grn/VALUES.md.gotmpl deleted file mode 100644 index 21080e3..0000000 --- a/helm-templates/jenkins-grn/VALUES.md.gotmpl +++ /dev/null @@ -1,28 +0,0 @@ -# Jenkins - -## Configuration - -The following tables list the configurable parameters of the Jenkins chart and their default values. - -{{- define "chart.valueDefaultColumnRender" -}} -{{- $defaultValue := (trimAll "`" (default .Default .AutoDefault) | replace "\n" "") -}} -`{{- $defaultValue | replace "\n" "" -}}` -{{- end -}} - -{{- define "chart.typeColumnRender" -}} -{{- .Type -}} -{{- end -}} - -{{- define "chart.valueDescription" -}} -{{- default .Description .AutoDescription }} -{{- end -}} - -{{- define "chart.valuesTable" -}} -| Key | Type | Description | Default | -|:----|:-----|:---------|:------------| -{{- range .Values }} -| [{{ .Key }}](./values.yaml#L{{ .LineNumber }}) | {{ template "chart.typeColumnRender" . }} | {{ template "chart.valueDescription" . }} | {{ template "chart.valueDefaultColumnRender" . }} | -{{- end }} -{{- end }} - -{{ template "chart.valuesSection" . }} diff --git a/helm-templates/jenkins-grn/ci/default-values.yaml b/helm-templates/jenkins-grn/ci/default-values.yaml deleted file mode 100644 index 37c37f4..0000000 --- a/helm-templates/jenkins-grn/ci/default-values.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# this file is empty to check if defaults within values.yaml work as expected -controller: - JCasC: - configScripts: - empty: "" diff --git a/helm-templates/jenkins-grn/ci/other-values.yaml b/helm-templates/jenkins-grn/ci/other-values.yaml deleted file mode 100644 index a532c94..0000000 --- a/helm-templates/jenkins-grn/ci/other-values.yaml +++ /dev/null @@ -1,100 +0,0 @@ ---- -controller: - overwritePluginsFromImage: false - containerSecurityContext: "" - runAsUser: 0 - fsGroup: 1000 - JCasC: - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: true - securityRealm: |- - ldap: - configurations: - - server: ldap.acme.com - rootDN: dc=acme,dc=uk - managerPasswordSecret: ${LDAP_PASSWORD} - groupMembershipStrategy: - fromUserRecord: - attributeName: "memberOf" - additionalPlugins: - - ldap:682.v7b_544c9d1512 - scriptApproval: - - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - - "new groovy.json.JsonSlurperClassic" - - ingress: - enabled: true - -persistence: - enabled: false - -agent: - resources: - limits: - cpu: "1" - memory: "2048Mi" - envVars: - - name: HOME - value: /home/jenkins/agent - - name: PATH - value: /usr/local/bin - nodeSelector: - "app.kubernetes.io/component": "{{ .Values.agent.componentName }}" - restrictedPssSecurityContext: true - runAsUser: 1000 - runAsGroup: 1000 - yamlTemplate: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "app.kubernetes.io/component" - operator: "Equal" - value: "{{ .Values.agent.componentName }}" - effect: "NoSchedule" - additionalAgents: - maven: - podName: maven - customJenkinsLabels: maven - # An example of overriding the jnlp container - # sideContainerName: jnlp - image: - repository: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: - repository: python - tag: "3" - command: "/bin/sh -c" - args: "cat" - TTYEnabled: true - podTemplates: - python: | - - name: python - label: jenkins-python - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - volumes: - - type: EmptyDir - mountPath: /var/myapp/myemptydir - memory: false -serviceAccount: - annotations: - description: "Used by release {{ .Release.Name }} for role-based access control" -serviceAccountAgent: - create: true - annotations: - description: "Used by release {{ .Release.Name }} for role-based access control" diff --git a/helm-templates/jenkins-grn/ci/with-secrets-values.yaml b/helm-templates/jenkins-grn/ci/with-secrets-values.yaml deleted file mode 100644 index a1b8169..0000000 --- a/helm-templates/jenkins-grn/ci/with-secrets-values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -controller: - additionalSecrets: - - name: nameOfSecret - value: secretText diff --git a/helm-templates/jenkins-grn/templates/NOTES.txt b/helm-templates/jenkins-grn/templates/NOTES.txt deleted file mode 100644 index 953dd26..0000000 --- a/helm-templates/jenkins-grn/templates/NOTES.txt +++ /dev/null @@ -1,68 +0,0 @@ -{{- $prefix := .Values.controller.jenkinsUriPrefix | default "" -}} -{{- $url := "" -}} -1. Get your '{{ .Values.controller.admin.username }}' user password by running: - kubectl exec --namespace {{ template "jenkins.namespace" . }} -it svc/{{ template "jenkins.fullname" . }} -c jenkins -- /bin/cat /run/secrets/additional/chart-admin-password && echo -{{- if .Values.controller.ingress.hostName -}} -{{- if .Values.controller.ingress.tls -}} -{{- $url = print "https://" .Values.controller.ingress.hostName $prefix -}} -{{- else -}} -{{- $url = print "http://" .Values.controller.ingress.hostName $prefix -}} -{{- end }} -2. Visit {{ $url }} -{{- else }} -2. Get the Jenkins URL to visit by running these commands in the same shell: -{{- if contains "NodePort" .Values.controller.serviceType }} - export NODE_PORT=$(kubectl get --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "jenkins.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://$NODE_IP:$NODE_PORT" $prefix -}} -{{- else -}} -{{- $url = print "http://$NODE_IP:$NODE_PORT" $prefix -}} -{{- end }} - echo {{ $url }} - -{{- else if contains "LoadBalancer" .Values.controller.serviceType }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get svc --namespace {{ template "jenkins.namespace" . }} -w {{ template "jenkins.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ template "jenkins.namespace" . }} {{ template "jenkins.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://$SERVICE_IP:" .Values.controller.servicePort $prefix -}} -{{- else -}} -{{- $url = print "http://$SERVICE_IP:" .Values.controller.servicePort $prefix -}} -{{- end }} - echo {{ $url }} - -{{- else if contains "ClusterIP" .Values.controller.serviceType -}} -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://127.0.0.1:" .Values.controller.servicePort $prefix -}} -{{- else -}} -{{- $url = print "http://127.0.0.1:" .Values.controller.servicePort $prefix -}} -{{- end }} - echo {{ $url }} - kubectl --namespace {{ template "jenkins.namespace" . }} port-forward svc/{{template "jenkins.fullname" . }} {{ .Values.controller.servicePort }}:{{ .Values.controller.servicePort }} -{{- end }} -{{- end }} - -3. Login with the password from step 1 and the username: {{ .Values.controller.admin.username }} -4. Configure security realm and authorization strategy -5. Use Jenkins Configuration as Code by specifying configScripts in your values.yaml file, see documentation: {{ $url }}/configuration-as-code and examples: https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos - -For more information on running Jenkins on Kubernetes, visit: -https://cloud.google.com/solutions/jenkins-on-container-engine - -For more information about Jenkins Configuration as Code, visit: -https://jenkins.io/projects/jcasc/ - -{{ if and (eq .Values.controller.image.repository "jenkins/jenkins") (eq .Values.controller.image.registry "docker.io") }} -NOTE: Consider using a custom image with pre-installed plugins -{{- else if .Values.controller.installPlugins }} -NOTE: Consider disabling `installPlugins` if your image already contains plugins. -{{- end }} - -{{- if .Values.persistence.enabled }} -{{- else }} -################################################################################# -###### WARNING: Persistence is disabled!!! You will lose your data when ##### -###### the Jenkins pod is terminated. ##### -################################################################################# -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/_helpers.tpl b/helm-templates/jenkins-grn/templates/_helpers.tpl deleted file mode 100644 index eff7c6e..0000000 --- a/helm-templates/jenkins-grn/templates/_helpers.tpl +++ /dev/null @@ -1,697 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "jenkins.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Expand the label of the chart. -*/}} -{{- define "jenkins.label" -}} -{{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{/* -Allow the release namespace to be overridden for multi-namespace deployments in combined charts. -*/}} -{{- define "jenkins.namespace" -}} - {{- if .Values.namespaceOverride -}} - {{- .Values.namespaceOverride -}} - {{- else -}} - {{- .Release.Namespace -}} - {{- end -}} -{{- end -}} - -{{- define "jenkins.agent.namespace" -}} - {{- if .Values.agent.namespace -}} - {{- tpl .Values.agent.namespace . -}} - {{- else -}} - {{- if .Values.namespaceOverride -}} - {{- .Values.namespaceOverride -}} - {{- else -}} - {{- .Release.Namespace -}} - {{- end -}} - {{- end -}} -{{- end -}} - - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "jenkins.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Returns the admin password -https://github.com/helm/charts/issues/5167#issuecomment-619137759 -*/}} -{{- define "jenkins.password" -}} - {{- if .Values.controller.admin.password -}} - {{- .Values.controller.admin.password | b64enc | quote }} - {{- else -}} - {{- $secret := (lookup "v1" "Secret" .Release.Namespace (include "jenkins.fullname" .)).data -}} - {{- if $secret -}} - {{/* - Reusing current password since secret exists - */}} - {{- index $secret ( .Values.controller.admin.passwordKey | default "jenkins-admin-password" ) -}} - {{- else -}} - {{/* - Generate new password - */}} - {{- randAlphaNum 22 | b64enc | quote }} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Returns the Jenkins URL -*/}} -{{- define "jenkins.url" -}} -{{- if .Values.controller.jenkinsUrl }} - {{- .Values.controller.jenkinsUrl }} -{{- else }} - {{- if .Values.controller.ingress.hostName }} - {{- if .Values.controller.ingress.tls }} - {{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- else }} - {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- end }} - {{- else }} - {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ template "jenkins.fullname" . }}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- end}} -{{- end}} -{{- end -}} - -{{/* -Returns configuration as code default config -*/}} -{{- define "jenkins.casc.defaults" -}} -jenkins: - {{- $configScripts := toYaml .Values.controller.JCasC.configScripts }} - {{- if and (.Values.controller.JCasC.authorizationStrategy) (not (contains "authorizationStrategy:" $configScripts)) }} - authorizationStrategy: - {{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 4 }} - {{- end }} - {{- if and (.Values.controller.JCasC.securityRealm) (not (contains "securityRealm:" $configScripts)) }} - securityRealm: - {{- tpl .Values.controller.JCasC.securityRealm . | nindent 4 }} - {{- end }} - disableRememberMe: {{ .Values.controller.disableRememberMe }} - {{- if .Values.controller.legacyRemotingSecurityEnabled }} - remotingSecurity: - enabled: true - {{- end }} - mode: {{ .Values.controller.executorMode }} - numExecutors: {{ .Values.controller.numExecutors }} - {{- if not (kindIs "invalid" .Values.controller.customJenkinsLabels) }} - labelString: "{{ join " " .Values.controller.customJenkinsLabels }}" - {{- end }} - {{- if .Values.controller.projectNamingStrategy }} - {{- if kindIs "string" .Values.controller.projectNamingStrategy }} - projectNamingStrategy: "{{ .Values.controller.projectNamingStrategy }}" - {{- else }} - projectNamingStrategy: - {{- toYaml .Values.controller.projectNamingStrategy | nindent 4 }} - {{- end }} - {{- end }} - markupFormatter: - {{- if .Values.controller.enableRawHtmlMarkupFormatter }} - rawHtml: - disableSyntaxHighlighting: true - {{- else }} - {{- toYaml .Values.controller.markupFormatter | nindent 4 }} - {{- end }} - clouds: - - kubernetes: - containerCapStr: "{{ .Values.agent.containerCap }}" - {{- if .Values.agent.garbageCollection.enabled }} - garbageCollection: - {{- if .Values.agent.garbageCollection.namespaces }} - namespaces: |- - {{- .Values.agent.garbageCollection.namespaces | nindent 10 }} - {{- end }} - timeout: "{{ .Values.agent.garbageCollection.timeout }}" - {{- end }} - {{- if .Values.agent.jnlpregistry }} - jnlpregistry: "{{ .Values.agent.jnlpregistry }}" - {{- end }} - defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}" - connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}" - readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}" - {{- if .Values.agent.directConnection }} - directConnection: true - {{- else }} - {{- if .Values.agent.jenkinsUrl }} - jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}" - {{- else }} - jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}" - {{- end }} - {{- if not .Values.agent.websocket }} - {{- if .Values.agent.jenkinsTunnel }} - jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}" - {{- else }} - jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" - {{- end }} - {{- else }} - webSocket: true - {{- end }} - {{- end }} - skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}} - usageRestricted: {{ .Values.agent.usageRestricted | default false}} - maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }} - retentionTimeout: {{ .Values.agent.retentionTimeout | quote }} - waitForPodSec: {{ .Values.agent.waitForPodSec | quote }} - name: "{{ .Values.controller.cloudName }}" - namespace: "{{ template "jenkins.agent.namespace" . }}" - restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }} - serverUrl: "{{ .Values.kubernetesURL }}" - credentialsId: "{{ .Values.credentialsId }}" - {{- if .Values.agent.enabled }} - podLabels: - - key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}" - value: "true" - {{- range $key, $val := .Values.agent.podLabels }} - - key: {{ $key | quote }} - value: {{ $val | quote }} - {{- end }} - templates: - {{- if not .Values.agent.disableDefaultAgent }} - {{- include "jenkins.casc.podTemplate" . | nindent 8 }} - {{- end }} - {{- if .Values.additionalAgents }} - {{- /* save .Values.agent */}} - {{- $agent := .Values.agent }} - {{- range $name, $additionalAgent := .Values.additionalAgents }} - {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }} - {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}} - {{- $additionalAgent := merge $additionalAgent $agent }} - {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}} - {{- if $additionalContainersEmpty }} - {{- $_ := set $additionalAgent "additionalContainers" list }} - {{- end }} - {{- /* set .Values.agent to $additionalAgent */}} - {{- $_ := set $.Values "agent" $additionalAgent }} - {{- include "jenkins.casc.podTemplate" $ | nindent 8 }} - {{- end }} - {{- /* restore .Values.agent */}} - {{- $_ := set .Values "agent" $agent }} - {{- end }} - {{- if .Values.agent.podTemplates }} - {{- range $key, $val := .Values.agent.podTemplates }} - {{- tpl $val $ | nindent 8 }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.additionalClouds }} - {{- /* save root */}} - {{- $oldRoot := deepCopy $ }} - {{- range $name, $additionalCloud := .Values.additionalClouds }} - {{- $newRoot := deepCopy $ }} - {{- /* clear additionalAgents from the copy if override set to `true` */}} - {{- if .additionalAgentsOverride }} - {{- $_ := set $newRoot.Values "additionalAgents" list}} - {{- end}} - {{- $newValues := merge $additionalCloud $newRoot.Values }} - {{- $_ := set $newRoot "Values" $newValues }} - {{- /* clear additionalClouds from the copy */}} - {{- $_ := set $newRoot.Values "additionalClouds" list }} - {{- with $newRoot}} - - kubernetes: - containerCapStr: "{{ .Values.agent.containerCap }}" - {{- if .Values.agent.garbageCollection.enabled }} - garbageCollection: - {{- if .Values.agent.garbageCollection.namespaces }} - namespaces: |- - {{- .Values.agent.garbageCollection.namespaces | nindent 10 }} - {{- end }} - timeout: "{{ .Values.agent.garbageCollection.timeout }}" - {{- end }} - {{- if .Values.agent.jnlpregistry }} - jnlpregistry: "{{ .Values.agent.jnlpregistry }}" - {{- end }} - defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}" - connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}" - readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}" - {{- if .Values.agent.directConnection }} - directConnection: true - {{- else }} - {{- if .Values.agent.jenkinsUrl }} - jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}" - {{- else }} - jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}" - {{- end }} - {{- if not .Values.agent.websocket }} - {{- if .Values.agent.jenkinsTunnel }} - jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}" - {{- else }} - jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" - {{- end }} - {{- else }} - webSocket: true - {{- end }} - {{- end }} - skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}} - usageRestricted: {{ .Values.agent.usageRestricted | default false}} - maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }} - retentionTimeout: {{ .Values.agent.retentionTimeout | quote }} - waitForPodSec: {{ .Values.agent.waitForPodSec | quote }} - name: {{ $name | quote }} - namespace: "{{ template "jenkins.agent.namespace" . }}" - restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }} - serverUrl: "{{ .Values.kubernetesURL }}" - credentialsId: "{{ .Values.credentialsId }}" - {{- if .Values.agent.enabled }} - podLabels: - - key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}" - value: "true" - {{- range $key, $val := .Values.agent.podLabels }} - - key: {{ $key | quote }} - value: {{ $val | quote }} - {{- end }} - templates: - {{- if not .Values.agent.disableDefaultAgent }} - {{- include "jenkins.casc.podTemplate" . | nindent 8 }} - {{- end }} - {{- if .Values.additionalAgents }} - {{- /* save .Values.agent */}} - {{- $agent := .Values.agent }} - {{- range $name, $additionalAgent := .Values.additionalAgents }} - {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }} - {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}} - {{- $additionalAgent := merge $additionalAgent $agent }} - {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}} - {{- if $additionalContainersEmpty }} - {{- $_ := set $additionalAgent "additionalContainers" list }} - {{- end }} - {{- /* set .Values.agent to $additionalAgent */}} - {{- $_ := set $.Values "agent" $additionalAgent }} - {{- include "jenkins.casc.podTemplate" $ | nindent 8 }} - {{- end }} - {{- /* restore .Values.agent */}} - {{- $_ := set .Values "agent" $agent }} - {{- end }} - {{- with .Values.agent.podTemplates }} - {{- range $key, $val := . }} - {{- tpl $val $ | nindent 8 }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - {{- /* restore root */}} - {{- $_ := set $ "Values" $oldRoot.Values }} - {{- end }} - slaveAgentPort: {{ .Values.controller.agentListenerPort }} - {{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }} - crumbIssuer: - standard: - excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }} - {{- end }} -{{- include "jenkins.casc.security" . }} -{{- with .Values.controller.scriptApproval }} - scriptApproval: - approvedSignatures: - {{- range $key, $val := . }} - - "{{ $val }}" - {{- end }} -{{- end }} -unclassified: - location: - {{- with .Values.controller.jenkinsAdminEmail }} - adminAddress: {{ . }} - {{- end }} - url: {{ template "jenkins.url" . }} -{{- end -}} - -{{/* -Returns a name template to be used for jcasc configmaps, using -suffix passed in at call as index 0 -*/}} -{{- define "jenkins.casc.configName" -}} -{{- $name := index . 0 -}} -{{- $root := index . 1 -}} -"{{- include "jenkins.fullname" $root -}}-jenkins-{{ $name }}" -{{- end -}} - -{{/* -Returns kubernetes pod template configuration as code -*/}} -{{- define "jenkins.casc.podTemplate" -}} -- name: "{{ .Values.agent.podName }}" - namespace: "{{ template "jenkins.agent.namespace" . }}" -{{- if .Values.agent.annotations }} - annotations: - {{- range $key, $value := .Values.agent.annotations }} - - key: {{ $key }} - value: {{ $value | quote }} - {{- end }} -{{- end }} - id: {{ sha256sum (toYaml .Values.agent) }} - containers: - - name: "{{ .Values.agent.sideContainerName }}" - alwaysPullImage: {{ .Values.agent.alwaysPullImage }} - args: "{{ .Values.agent.args | replace "$" "^$" }}" - {{- with .Values.agent.command }} - command: {{ . }} - {{- end }} - envVars: - - envVar: - {{- if .Values.agent.directConnection }} - key: "JENKINS_DIRECT_CONNECTION" - {{- if .Values.agent.jenkinsTunnel }} - value: "{{ tpl .Values.agent.jenkinsTunnel . }}" - {{- else }} - value: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" - {{- end }} - {{- else }} - key: "JENKINS_URL" - {{- if .Values.agent.jenkinsUrl }} - value: {{ tpl .Values.agent.jenkinsUrl . }} - {{- else }} - value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}" - {{- end }} - {{- end }} - {{- if ne .Values.agent.image.registry "" }} - image: "{{ .Values.agent.image.registry}}/{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}" - {{- else }} - image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}" - {{- end }} - {{- if .Values.agent.livenessProbe }} - livenessProbe: - execArgs: {{.Values.agent.livenessProbe.execArgs | quote}} - failureThreshold: {{.Values.agent.livenessProbe.failureThreshold}} - initialDelaySeconds: {{.Values.agent.livenessProbe.initialDelaySeconds}} - periodSeconds: {{.Values.agent.livenessProbe.periodSeconds}} - successThreshold: {{.Values.agent.livenessProbe.successThreshold}} - timeoutSeconds: {{.Values.agent.livenessProbe.timeoutSeconds}} - {{- end }} - privileged: "{{- if .Values.agent.privileged }}true{{- else }}false{{- end }}" - resourceLimitCpu: {{.Values.agent.resources.limits.cpu}} - resourceLimitMemory: {{.Values.agent.resources.limits.memory}} - {{- with .Values.agent.resources.limits.ephemeralStorage }} - resourceLimitEphemeralStorage: {{.}} - {{- end }} - resourceRequestCpu: {{.Values.agent.resources.requests.cpu}} - resourceRequestMemory: {{.Values.agent.resources.requests.memory}} - {{- with .Values.agent.resources.requests.ephemeralStorage }} - resourceRequestEphemeralStorage: {{.}} - {{- end }} - {{- with .Values.agent.runAsUser }} - runAsUser: {{ . }} - {{- end }} - {{- with .Values.agent.runAsGroup }} - runAsGroup: {{ . }} - {{- end }} - ttyEnabled: {{ .Values.agent.TTYEnabled }} - workingDir: {{ .Values.agent.workingDir }} -{{- range $additionalContainers := .Values.agent.additionalContainers }} - - name: "{{ $additionalContainers.sideContainerName }}" - alwaysPullImage: {{ $additionalContainers.alwaysPullImage | default $.Values.agent.alwaysPullImage }} - args: "{{ $additionalContainers.args | replace "$" "^$" }}" - {{- with $additionalContainers.command }} - command: {{ . }} - {{- end }} - envVars: - - envVar: - key: "JENKINS_URL" - {{- if $additionalContainers.jenkinsUrl }} - value: {{ tpl ($additionalContainers.jenkinsUrl) . }} - {{- else }} - value: "http://{{ template "jenkins.fullname" $ }}.{{ template "jenkins.namespace" $ }}.svc.{{ $.Values.clusterZone }}:{{ $.Values.controller.servicePort }}{{ default "/" $.Values.controller.jenkinsUriPrefix }}" - {{- end }} - image: "{{ $additionalContainers.image.repository }}:{{ $additionalContainers.image.tag }}" - {{- if $additionalContainers.livenessProbe }} - livenessProbe: - execArgs: {{$additionalContainers.livenessProbe.execArgs | quote}} - failureThreshold: {{$additionalContainers.livenessProbe.failureThreshold}} - initialDelaySeconds: {{$additionalContainers.livenessProbe.initialDelaySeconds}} - periodSeconds: {{$additionalContainers.livenessProbe.periodSeconds}} - successThreshold: {{$additionalContainers.livenessProbe.successThreshold}} - timeoutSeconds: {{$additionalContainers.livenessProbe.timeoutSeconds}} - {{- end }} - privileged: "{{- if $additionalContainers.privileged }}true{{- else }}false{{- end }}" - resourceLimitCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.cpu }}{{ else }}{{ $.Values.agent.resources.limits.cpu }}{{ end }} - resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }} - resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }} - resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }} - {{- if or $additionalContainers.runAsUser $.Values.agent.runAsUser }} - runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }} - {{- end }} - {{- if or $additionalContainers.runAsGroup $.Values.agent.runAsGroup }} - runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }} - {{- end }} - ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }} - workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }} -{{- end }} -{{- if or .Values.agent.envVars .Values.agent.secretEnvVars }} - envVars: - {{- range $index, $var := .Values.agent.envVars }} - - envVar: - key: {{ $var.name }} - value: {{ tpl $var.value $ }} - {{- end }} - {{- range $index, $var := .Values.agent.secretEnvVars }} - - secretEnvVar: - key: {{ $var.key }} - secretName: {{ $var.secretName }} - secretKey: {{ $var.secretKey }} - optional: {{ $var.optional | default false }} - {{- end }} -{{- end }} - idleMinutes: {{ .Values.agent.idleMinutes }} - instanceCap: {{ int .Values.agent.instanceCap }} - {{- if .Values.agent.hostNetworking }} - hostNetwork: {{ .Values.agent.hostNetworking }} - {{- end }} - {{- if .Values.agent.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.agent.imagePullSecretName }} - {{- end }} - label: "{{ .Release.Name }}-{{ .Values.agent.componentName }} {{ .Values.agent.customJenkinsLabels | join " " }}" -{{- if .Values.agent.nodeSelector }} - nodeSelector: - {{- $local := dict "first" true }} - {{- range $key, $value := .Values.agent.nodeSelector }} - {{- if $local.first }} {{ else }},{{ end }} - {{- $key }}={{ tpl $value $ }} - {{- $_ := set $local "first" false }} - {{- end }} -{{- end }} - nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }} - podRetention: {{ .Values.agent.podRetention }} - showRawYaml: {{ .Values.agent.showRawYaml }} -{{- $asaname := default (include "jenkins.serviceAccountAgentName" .) .Values.agent.serviceAccount -}} -{{- if or (.Values.agent.useDefaultServiceAccount) (.Values.agent.serviceAccount) }} - serviceAccount: "{{ $asaname }}" -{{- end }} - slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}" -{{- if .Values.agent.volumes }} - volumes: - {{- range $index, $volume := .Values.agent.volumes }} - -{{- if (eq $volume.type "ConfigMap") }} configMapVolume: - {{- else if (eq $volume.type "EmptyDir") }} emptyDirVolume: - {{- else if (eq $volume.type "EphemeralVolume") }} genericEphemeralVolume: - {{- else if (eq $volume.type "HostPath") }} hostPathVolume: - {{- else if (eq $volume.type "Nfs") }} nfsVolume: - {{- else if (eq $volume.type "PVC") }} persistentVolumeClaim: - {{- else if (eq $volume.type "Secret") }} secretVolume: - {{- else }} {{ $volume.type }}: - {{- end }} - {{- range $key, $value := $volume }} - {{- if not (eq $key "type") }} - {{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} -{{- if .Values.agent.workspaceVolume }} - workspaceVolume: - {{- if (eq .Values.agent.workspaceVolume.type "DynamicPVC") }} - dynamicPVC: - {{- else if (eq .Values.agent.workspaceVolume.type "EmptyDir") }} - emptyDirWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "EphemeralVolume") }} - genericEphemeralVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "HostPath") }} - hostPathWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "Nfs") }} - nfsWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "PVC") }} - persistentVolumeClaimWorkspaceVolume: - {{- else }} - {{ .Values.agent.workspaceVolume.type }}: - {{- end }} - {{- range $key, $value := .Values.agent.workspaceVolume }} - {{- if not (eq $key "type") }} - {{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }} - {{- end }} - {{- end }} -{{- end }} -{{- if .Values.agent.yamlTemplate }} - yaml: |- - {{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }} -{{- end }} - yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }} - inheritYamlMergeStrategy: {{ .Values.agent.inheritYamlMergeStrategy }} -{{- end -}} - -{{- define "jenkins.kubernetes-version" -}} - {{- if .Values.controller.installPlugins -}} - {{- range .Values.controller.installPlugins -}} - {{- if hasPrefix "kubernetes:" . }} - {{- $split := splitList ":" . }} - {{- printf "%s" (index $split 1 ) -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{- define "jenkins.casc.security" }} -security: -{{- with .Values.controller.JCasC }} -{{- if .security }} - {{- .security | toYaml | nindent 2 }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "jenkins.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "jenkins.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the service account for Jenkins agents to use -*/}} -{{- define "jenkins.serviceAccountAgentName" -}} -{{- if .Values.serviceAccountAgent.create -}} - {{ default (printf "%s-%s" (include "jenkins.fullname" .) "agent") .Values.serviceAccountAgent.name }} -{{- else -}} - {{ default "default" .Values.serviceAccountAgent.name }} -{{- end -}} -{{- end -}} - -{{/* -Create a full tag name for controller image -*/}} -{{- define "controller.image.tag" -}} -{{- if .Values.controller.image.tagLabel -}} - {{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.image.tagLabel) .Values.controller.image.tag -}} -{{- else -}} - {{- default .Chart.AppVersion .Values.controller.image.tag -}} -{{- end -}} -{{- end -}} - -{{/* -Create the HTTP port for interacting with the controller -*/}} -{{- define "controller.httpPort" -}} -{{- if .Values.controller.httpsKeyStore.enable -}} - {{- .Values.controller.httpsKeyStore.httpPort -}} -{{- else -}} - {{- .Values.controller.targetPort -}} -{{- end -}} -{{- end -}} - -{{- define "jenkins.configReloadContainer" -}} -{{- $root := index . 0 -}} -{{- $containerName := index . 1 -}} -{{- $containerType := index . 2 -}} -- name: {{ $containerName }} - image: "{{ $root.Values.controller.sidecars.configAutoReload.image.registry }}/{{ $root.Values.controller.sidecars.configAutoReload.image.repository }}:{{ $root.Values.controller.sidecars.configAutoReload.image.tag }}" - imagePullPolicy: {{ $root.Values.controller.sidecars.configAutoReload.imagePullPolicy }} - {{- if $root.Values.controller.sidecars.configAutoReload.containerSecurityContext }} - securityContext: {{- toYaml $root.Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 4 }} - {{- end }} - {{- if $root.Values.controller.sidecars.configAutoReload.envFrom }} - envFrom: -{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.envFrom) $root) | indent 4 }} - {{- end }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: "{{ template "jenkins.fullname" $root }}-jenkins-config" - - name: FOLDER - value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}" - - name: NAMESPACE - value: '{{ $root.Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" $root) }}' - {{- if eq $containerType "init" }} - - name: METHOD - value: "LIST" - {{- else if $root.Values.controller.sidecars.configAutoReload.sleepTime }} - - name: METHOD - value: "SLEEP" - - name: SLEEP_TIME - value: "{{ $root.Values.controller.sidecars.configAutoReload.sleepTime }}" - {{- end }} - {{- if eq $containerType "sidecar" }} - - name: REQ_URL - value: "{{- default "http" $root.Values.controller.sidecars.configAutoReload.scheme }}://localhost:{{- include "controller.httpPort" $root -}}{{- $root.Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" - - name: REQ_METHOD - value: "POST" - - name: REQ_RETRY_CONNECT - value: "{{ $root.Values.controller.sidecars.configAutoReload.reqRetryConnect }}" - {{- if $root.Values.controller.sidecars.configAutoReload.skipTlsVerify }} - - name: REQ_SKIP_TLS_VERIFY - value: "true" - {{- end }} - {{- end }} - - {{- if $root.Values.controller.sidecars.configAutoReload.env }} - {{- range $envVarItem := $root.Values.controller.sidecars.configAutoReload.env -}} - {{- if or (ne $containerType "init") (ne .name "METHOD") }} -{{- (tpl (toYaml (list $envVarItem)) $root) | nindent 4 }} - {{- end -}} - {{- end -}} - {{- end }} - {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }} - - name: LOG_CONFIG - value: "{{ $root.Values.controller.jenkinsHome }}/auto-reload/auto-reload-config.yaml" - {{- end }} - - resources: -{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }} - volumeMounts: - - name: sc-config-volume - mountPath: {{ $root.Values.controller.sidecars.configAutoReload.folder | quote }} - - name: jenkins-home - mountPath: {{ $root.Values.controller.jenkinsHome }} - {{- if $root.Values.persistence.subPath }} - subPath: {{ $root.Values.persistence.subPath }} - {{- end }} - {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }} - - name: auto-reload-config - mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload - - name: auto-reload-config-logs - mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload-logs - {{- end }} - {{- if $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts }} -{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts) $root) | indent 4 }} - {{- end }} - -{{- end -}} diff --git a/helm-templates/jenkins-grn/templates/auto-reload-config.yaml b/helm-templates/jenkins-grn/templates/auto-reload-config.yaml deleted file mode 100644 index 77b0f52..0000000 --- a/helm-templates/jenkins-grn/templates/auto-reload-config.yaml +++ /dev/null @@ -1,60 +0,0 @@ -{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }}-auto-reload-config - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": {{ template "jenkins.name" . }} - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" - "app.kubernetes.io/instance": "{{ $.Release.Name }}" - "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" -data: - auto-reload-config.yaml: |- - version: 1 - disable_existing_loggers: false - root: - level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }} - handlers: - {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}} - - console - {{- end }} - {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }} - - file - {{- end }} - handlers: - {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}} - console: - class: logging.StreamHandler - level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }} - formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }} - {{- end }} - {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }} - file: - class : logging.handlers.RotatingFileHandler - formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }} - filename: {{ .Values.controller.jenkinsHome }}/auto-reload-logs/file.log - maxBytes: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.maxBytes }} - backupCount: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.backupCount }} - {{- end }} - formatters: - JSON: - "()": logger.JsonFormatter - format: "%(levelname)s %(message)s" - rename_fields: - message: msg - levelname: level - LOGFMT: - "()": logger.LogfmtFormatter - keys: - - time - - level - - msg - mapping: - time: asctime - level: levelname - msg: message - {{- end }} \ No newline at end of file diff --git a/helm-templates/jenkins-grn/templates/config-init-scripts.yaml b/helm-templates/jenkins-grn/templates/config-init-scripts.yaml deleted file mode 100644 index 7dd253c..0000000 --- a/helm-templates/jenkins-grn/templates/config-init-scripts.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.controller.initScripts -}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }}-init-scripts - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -data: -{{- range $key, $val := .Values.controller.initScripts }} - init{{ $key }}.groovy: |- -{{ tpl $val $ | indent 4 }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/config.yaml b/helm-templates/jenkins-grn/templates/config.yaml deleted file mode 100644 index 5de0b9f..0000000 --- a/helm-templates/jenkins-grn/templates/config.yaml +++ /dev/null @@ -1,92 +0,0 @@ -{{- $jenkinsHome := .Values.controller.jenkinsHome -}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -data: - apply_config.sh: |- - set -e -{{- if .Values.controller.initializeOnce }} - if [ -f {{ .Values.controller.jenkinsHome }}/initialization-completed ]; then - echo "controller was previously initialized, refusing to re-initialize" - exit 0 - fi -{{- end }} - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.InstallUtil.lastExecVersion -{{- if .Values.controller.overwritePlugins }} - echo "remove all plugins from shared volume" - # remove all plugins from shared volume - rm -rf {{ .Values.controller.jenkinsHome }}/plugins/* -{{- end }} -{{- if .Values.controller.JCasC.overwriteConfiguration }} - echo "deleting all XML config files" - rm -f {{ .Values.controller.jenkinsHome }}/config.xml - rm -f {{ .Values.controller.jenkinsHome }}/*plugins*.xml - find {{ .Values.controller.jenkinsHome }} -maxdepth 1 -type f -iname '*configuration*.xml' -exec rm -f {} \; -{{- end }} -{{- if .Values.controller.installPlugins }} - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt {{ .Values.controller.jenkinsHome }}; - rm -rf {{ .Values.controller.jenkinsRef }}/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "{{ .Values.controller.jenkinsWar }}" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "{{ .Values.controller.jenkinsWar }}" --plugin-file "{{ .Values.controller.jenkinsHome }}/plugins.txt" --latest {{ .Values.controller.installLatestPlugins }}{{- if .Values.controller.installLatestSpecifiedPlugins }} --latest-specified{{- end }}; - else - /usr/local/bin/install-plugins.sh `echo $(cat {{ .Values.controller.jenkinsHome }}/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i {{ .Values.controller.jenkinsRef }}/plugins/* /var/jenkins_plugins/; -{{- end }} - {{- if not .Values.controller.sidecars.configAutoReload.enabled }} - echo "copy configuration as code files" - mkdir -p {{ .Values.controller.jenkinsHome }}/casc_configs; - rm -rf {{ .Values.controller.jenkinsHome }}/casc_configs/* - {{- if or .Values.controller.JCasC.defaultConfig .Values.controller.JCasC.configScripts }} - cp -v /var/jenkins_config/*.yaml {{ .Values.controller.jenkinsHome }}/casc_configs - {{- end }} - {{- end }} - echo "finished initialization" -{{- if .Values.controller.initializeOnce }} - touch {{ .Values.controller.jenkinsHome }}/initialization-completed -{{- end }} - {{- if not .Values.controller.sidecars.configAutoReload.enabled }} -# Only add config to this script if we aren't auto-reloading otherwise the pod will restart upon each config change: -{{- if .Values.controller.JCasC.defaultConfig }} - jcasc-default-config.yaml: |- - {{- include "jenkins.casc.defaults" . |nindent 4}} -{{- end }} -{{- range $key, $val := .Values.controller.JCasC.configScripts }} - {{ $key }}.yaml: |- -{{ tpl $val $| indent 4 }} -{{- end }} -{{- end }} - plugins.txt: |- -{{- if .Values.controller.installPlugins }} - {{- range $installPlugin := .Values.controller.installPlugins }} - {{- $installPlugin | nindent 4 }} - {{- end }} - {{- range $addlPlugin := .Values.controller.additionalPlugins }} - {{- /* duplicate plugin check */}} - {{- range $installPlugin := $.Values.controller.installPlugins }} - {{- if eq (splitList ":" $addlPlugin | first) (splitList ":" $installPlugin | first) }} - {{- $message := print "[PLUGIN CONFLICT] controller.additionalPlugins contains '" $addlPlugin "'" }} - {{- $message := print $message " but controller.installPlugins already contains '" $installPlugin "'." }} - {{- $message := print $message " Override controller.installPlugins to use '" $addlPlugin "' plugin." }} - {{- fail $message }} - {{- end }} - {{- end }} - {{- $addlPlugin | nindent 4 }} - {{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/deprecation.yaml b/helm-templates/jenkins-grn/templates/deprecation.yaml deleted file mode 100644 index f54017c..0000000 --- a/helm-templates/jenkins-grn/templates/deprecation.yaml +++ /dev/null @@ -1,151 +0,0 @@ -{{- if .Values.checkDeprecation }} - {{- if .Values.master }} - {{ fail "`master` does no longer exist. It has been renamed to `controller`" }} - {{- end }} - - {{- if .Values.controller.imageTag }} - {{ fail "`controller.imageTag` does no longer exist. Please use `controller.image.tag` instead" }} - {{- end }} - - {{- if .Values.controller.slaveListenerPort }} - {{ fail "`controller.slaveListenerPort` does no longer exist. It has been renamed to `controller.agentListenerPort`" }} - {{- end }} - - {{- if .Values.controller.slaveHostPort }} - {{ fail "`controller.slaveHostPort` does no longer exist. It has been renamed to `controller.agentListenerHostPort`" }} - {{- end }} - - {{- if .Values.controller.slaveKubernetesNamespace }} - {{ fail "`controller.slaveKubernetesNamespace` does no longer exist. It has been renamed to `agent.namespace`" }} - {{- end }} - - {{- if .Values.controller.slaveDefaultsProviderTemplate }} - {{ fail "`controller.slaveDefaultsProviderTemplate` does no longer exist. It has been renamed to `agent.defaultsProviderTemplate`" }} - {{- end }} - - {{- if .Values.controller.useSecurity }} - {{ fail "`controller.useSecurity` does no longer exist. It has been renamed to `controller.adminSecret`" }} - {{- end }} - - {{- if .Values.controller.slaveJenkinsUrl }} - {{ fail "`controller.slaveJenkinsUrl` does no longer exist. It has been renamed to `agent.jenkinsUrl`" }} - {{- end }} - - {{- if .Values.controller.slaveJenkinsTunnel }} - {{ fail "`controller.slaveJenkinsTunnel` does no longer exist. It has been renamed to `agent.jenkinsTunnel`" }} - {{- end }} - - {{- if .Values.controller.slaveConnectTimeout }} - {{ fail "`controller.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.kubernetesConnectTimeout`" }} - {{- end }} - - {{- if .Values.controller.slaveReadTimeout }} - {{ fail "`controller.slaveReadTimeout` does no longer exist. It has been renamed to `agent.kubernetesReadTimeout`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerServiceType }} - {{ fail "`controller.slaveListenerServiceType` does no longer exist. It has been renamed to `controller.agentListenerServiceType`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerLoadBalancerIP }} - {{ fail "`controller.slaveListenerLoadBalancerIP` does no longer exist. It has been renamed to `controller.agentListenerLoadBalancerIP`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerServiceAnnotations }} - {{ fail "`controller.slaveListenerServiceAnnotations` does no longer exist. It has been renamed to `controller.agentListenerServiceAnnotations`" }} - {{- end }} - - {{- if .Values.agent.slaveConnectTimeout }} - {{ fail "`agent.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.connectTimeout`" }} - {{- end }} - - {{- if .Values.NetworkPolicy }} - - {{- if .Values.NetworkPolicy.Enabled }} - {{ fail "`NetworkPolicy.Enabled` does no longer exist. It has been renamed to `networkPolicy.enabled`" }} - {{- end }} - - {{- if .Values.NetworkPolicy.ApiVersion }} - {{ fail "`NetworkPolicy.ApiVersion` does no longer exist. It has been renamed to `networkPolicy.apiVersion`" }} - {{- end }} - - {{ fail "NetworkPolicy.* values have been renamed, please check the documentation" }} - {{- end }} - - - {{- if .Values.rbac.install }} - {{ fail "`rbac.install` does no longer exist. It has been renamed to `rbac.create` and is enabled by default!" }} - {{- end }} - - {{- if .Values.rbac.serviceAccountName }} - {{ fail "`rbac.serviceAccountName` does no longer exist. It has been renamed to `serviceAccount.name`" }} - {{- end }} - - {{- if .Values.rbac.serviceAccountAnnotations }} - {{ fail "`rbac.serviceAccountAnnotations` does no longer exist. It has been renamed to `serviceAccount.annotations`" }} - {{- end }} - - {{- if .Values.rbac.roleRef }} - {{ fail "`rbac.roleRef` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.rbac.roleKind }} - {{ fail "`rbac.roleKind` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.rbac.roleBindingKind }} - {{ fail "`rbac.roleBindingKind` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.controller.JCasC.pluginVersion }} - {{ fail "controller.JCasC.pluginVersion has been deprecated, please use controller.installPlugins instead" }} - {{- end }} - - {{- if .Values.controller.deploymentLabels }} - {{ fail "`controller.deploymentLabels` does no longer exist. It has been renamed to `controller.statefulSetLabels`" }} - {{- end }} - - {{- if .Values.controller.deploymentAnnotations }} - {{ fail "`controller.deploymentAnnotations` does no longer exist. It has been renamed to `controller.statefulSetAnnotations`" }} - {{- end }} - - {{- if .Values.controller.rollingUpdate }} - {{ fail "`controller.rollingUpdate` does no longer exist. It is no longer relevant, since a StatefulSet is used for the Jenkins controller" }} - {{- end }} - - {{- if .Values.controller.tag }} - {{ fail "`controller.tag` no longer exists. It has been renamed to `controller.image.tag'" }} - {{- end }} - - {{- if .Values.controller.tagLabel }} - {{ fail "`controller.tagLabel` no longer exists. It has been renamed to `controller.image.tagLabel`" }} - {{- end }} - - {{- if .Values.controller.adminSecret }} - {{ fail "`controller.adminSecret` no longer exists. It has been renamed to `controller.admin.createSecret`" }} - {{- end }} - - {{- if .Values.controller.adminUser }} - {{ fail "`controller.adminUser` no longer exists. It has been renamed to `controller.admin.username`" }} - {{- end }} - - {{- if .Values.controller.adminPassword }} - {{ fail "`controller.adminPassword` no longer exists. It has been renamed to `controller.admin.password`" }} - {{- end }} - - {{- if .Values.controller.sidecars.other }} - {{ fail "`controller.sidecars.other` no longer exists. It has been renamed to `controller.sidecars.additionalSidecarContainers`" }} - {{- end }} - - {{- if .Values.agent.tag }} - {{ fail "`controller.agent.tag` no longer exists. It has been renamed to `controller.agent.image.tag`" }} - {{- end }} - - {{- if .Values.backup }} - {{ fail "`controller.backup` no longer exists." }} - {{- end }} - - {{- if .Values.helmtest.bats.tag }} - {{ fail "`helmtest.bats.tag` no longer exists. It has been renamed to `helmtest.bats.image.tag`" }} - {{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/home-pvc.yaml b/helm-templates/jenkins-grn/templates/home-pvc.yaml deleted file mode 100644 index 1c22724..0000000 --- a/helm-templates/jenkins-grn/templates/home-pvc.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}} -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: -{{- if .Values.persistence.annotations }} - annotations: -{{ toYaml .Values.persistence.annotations | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.persistence.labels }} -{{ toYaml .Values.persistence.labels | indent 4 }} -{{- end }} -spec: -{{- if .Values.persistence.dataSource }} - dataSource: -{{ toYaml .Values.persistence.dataSource | indent 4 }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ tpl .Values.persistence.storageClass . }}" -{{- end }} -{{- end }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jcasc-config.yaml b/helm-templates/jenkins-grn/templates/jcasc-config.yaml deleted file mode 100644 index ab8dcd8..0000000 --- a/helm-templates/jenkins-grn/templates/jcasc-config.yaml +++ /dev/null @@ -1,53 +0,0 @@ -{{- $root := . }} -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- range $key, $val := .Values.controller.JCasC.configScripts }} -{{- if $val }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}} - namespace: {{ template "jenkins.namespace" $root }} - labels: - "app.kubernetes.io/name": {{ template "jenkins.name" $root}} - {{- if $root.Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" - "app.kubernetes.io/instance": "{{ $.Release.Name }}" - "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" - {{ template "jenkins.fullname" $root }}-jenkins-config: "true" -{{- if $root.Values.controller.JCasC.configMapAnnotations }} - annotations: -{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }} -{{- end }} -data: - {{ $key }}.yaml: |- -{{ tpl $val $| indent 4 }} -{{- end }} -{{- end }} -{{- if .Values.controller.JCasC.defaultConfig }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}} - namespace: {{ template "jenkins.namespace" $root }} - labels: - "app.kubernetes.io/name": {{ template "jenkins.name" $root}} - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" - "app.kubernetes.io/instance": "{{ $.Release.Name }}" - "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" - {{ template "jenkins.fullname" $root }}-jenkins-config: "true" -{{- if $root.Values.controller.JCasC.configMapAnnotations }} - annotations: -{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }} -{{- end }} -data: - jcasc-default-config.yaml: |- - {{- include "jenkins.casc.defaults" . | nindent 4 }} -{{- end}} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-agent-svc.yaml b/helm-templates/jenkins-grn/templates/jenkins-agent-svc.yaml deleted file mode 100644 index 4440b91..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-agent-svc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if .Values.controller.agentListenerEnabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jenkins.fullname" . }}-agent - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.agentListenerServiceAnnotations }} - annotations: - {{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }} - {{- end }} -spec: - {{- if .Values.controller.agentListenerExternalTrafficPolicy }} - externalTrafficPolicy: {{.Values.controller.agentListenerExternalTrafficPolicy}} - {{- end }} - ports: - - port: {{ .Values.controller.agentListenerPort }} - targetPort: {{ .Values.controller.agentListenerPort }} - {{- if (and (eq .Values.controller.agentListenerServiceType "NodePort") (not (empty .Values.controller.agentListenerNodePort))) }} - nodePort: {{ .Values.controller.agentListenerNodePort }} - {{- end }} - name: agent-listener - selector: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - type: {{ .Values.controller.agentListenerServiceType }} - {{if eq .Values.controller.agentListenerServiceType "LoadBalancer"}} -{{- if .Values.controller.agentListenerLoadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml .Values.controller.agentListenerLoadBalancerSourceRanges | indent 4 }} -{{- end }} - {{- end }} - {{- if and (eq .Values.controller.agentListenerServiceType "LoadBalancer") (.Values.controller.agentListenerLoadBalancerIP) }} - loadBalancerIP: {{ .Values.controller.agentListenerLoadBalancerIP }} - {{- end }} - {{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-aws-security-group-policies.yaml b/helm-templates/jenkins-grn/templates/jenkins-aws-security-group-policies.yaml deleted file mode 100644 index 2f6e7a1..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-aws-security-group-policies.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.awsSecurityGroupPolicies.enabled -}} -{{- range .Values.awsSecurityGroupPolicies.policies -}} -apiVersion: vpcresources.k8s.aws/v1beta1 -kind: SecurityGroupPolicy -metadata: - name: {{ .name }} - namespace: {{ template "jenkins.namespace" $ }} -spec: - podSelector: - {{- toYaml .podSelector | nindent 6}} - securityGroups: - groupIds: - {{- toYaml .securityGroupIds | nindent 6}} ---- -{{- end -}} -{{- end -}} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-alerting-rules.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-alerting-rules.yaml deleted file mode 100644 index 3fd8061..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-alerting-rules.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and .Values.controller.prometheus.enabled .Values.controller.prometheus.alertingrules }} ---- -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.prometheus.prometheusRuleNamespace }} - namespace: {{ .Values.controller.prometheus.prometheusRuleNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} -spec: - groups: -{{ toYaml .Values.controller.prometheus.alertingrules | indent 2 }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-backendconfig.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-backendconfig.yaml deleted file mode 100644 index 0e8a566..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-backendconfig.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if .Values.controller.backendconfig.enabled }} -apiVersion: {{ .Values.controller.backendconfig.apiVersion }} -kind: BackendConfig -metadata: - name: {{ .Values.controller.backendconfig.name }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.controller.backendconfig.labels }} -{{ toYaml .Values.controller.backendconfig.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.backendconfig.annotations }} - annotations: -{{ toYaml .Values.controller.backendconfig.annotations | indent 4 }} -{{- end }} -spec: -{{ toYaml .Values.controller.backendconfig.spec | indent 2 }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-ingress.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-ingress.yaml deleted file mode 100644 index 5094e56..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-ingress.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if .Values.controller.ingress.enabled }} -{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.ingress.apiVersion }} -{{- end }} -kind: Ingress -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.controller.ingress.labels }} -{{ toYaml .Values.controller.ingress.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.ingress.annotations }} - annotations: -{{ tpl (toYaml .Values.controller.ingress.annotations) . | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }} -spec: -{{- if .Values.controller.ingress.ingressClassName }} - ingressClassName: {{ tpl .Values.controller.ingress.ingressClassName . | quote }} -{{- end }} - rules: - - http: - paths: -{{- if empty (.Values.controller.ingress.paths) }} - - backend: -{{- if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ template "jenkins.fullname" . }} - port: - number: {{ .Values.controller.servicePort }} - pathType: ImplementationSpecific -{{- else }} - serviceName: {{ template "jenkins.fullname" . }} - servicePort: {{ .Values.controller.servicePort }} -{{- end }} -{{- if .Values.controller.ingress.path }} - path: {{ .Values.controller.ingress.path }} -{{- end -}} -{{- else }} -{{ tpl (toYaml .Values.controller.ingress.paths | indent 6) . }} -{{- end -}} -{{- if .Values.controller.ingress.hostName }} - host: {{ tpl .Values.controller.ingress.hostName . | quote }} -{{- end }} -{{- if .Values.controller.ingress.resourceRootUrl }} - - http: - paths: - - backend: -{{- if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ template "jenkins.fullname" . }} - port: - number: {{ .Values.controller.servicePort }} - pathType: ImplementationSpecific -{{- else }} - serviceName: {{ template "jenkins.fullname" . }} - servicePort: {{ .Values.controller.servicePort }} -{{- end }} - host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }} -{{- end }} -{{- if .Values.controller.ingress.tls }} - tls: -{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }} -{{- end -}} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-networkpolicy.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-networkpolicy.yaml deleted file mode 100644 index 82835f2..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-networkpolicy.yaml +++ /dev/null @@ -1,76 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ .Values.networkPolicy.apiVersion }} -metadata: - name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}" - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -spec: - podSelector: - matchLabels: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - ingress: - # Allow web access to the UI - - ports: - - port: {{ .Values.controller.targetPort }} - {{- if .Values.controller.agentListenerEnabled }} - # Allow inbound connections from agents - - from: - {{- if .Values.networkPolicy.internalAgents.allowed }} - - podSelector: - matchLabels: - "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true" - {{- range $k,$v:= .Values.networkPolicy.internalAgents.podLabels }} - {{ $k }}: {{ $v }} - {{- end }} - {{- if .Values.networkPolicy.internalAgents.namespaceLabels }} - namespaceSelector: - matchLabels: - {{- range $k,$v:= .Values.networkPolicy.internalAgents.namespaceLabels }} - {{ $k }}: {{ $v }} - {{- end }} - {{- end }} - {{- end }} - {{- if or .Values.networkPolicy.externalAgents.ipCIDR .Values.networkPolicy.externalAgents.except }} - - ipBlock: - cidr: {{ required "ipCIDR is required if you wish to allow external agents to connect to Jenkins Controller." .Values.networkPolicy.externalAgents.ipCIDR }} - {{- if .Values.networkPolicy.externalAgents.except }} - except: - {{- range .Values.networkPolicy.externalAgents.except }} - - {{ . }} - {{- end }} - {{- end }} - {{- end }} - ports: - - port: {{ .Values.controller.agentListenerPort }} - {{- end }} -{{- if .Values.agent.enabled }} ---- -kind: NetworkPolicy -apiVersion: {{ .Values.networkPolicy.apiVersion }} -metadata: - name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}" - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -spec: - podSelector: - matchLabels: - # DefaultDeny - "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true" -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-pdb.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-pdb.yaml deleted file mode 100644 index 9dc1faf..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-pdb.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.controller.podDisruptionBudget.enabled }} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if semverCompare ">=1.21-0" $kubeTargetVersion -}} -apiVersion: policy/v1 -{{- else if semverCompare ">=1.5-0" $kubeTargetVersion -}} -apiVersion: policy/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.podDisruptionBudget.apiVersion }} -{{- end }} -kind: PodDisruptionBudget -metadata: - name: {{ template "jenkins.fullname" . }}-pdb - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.podDisruptionBudget.labels -}} - {{ toYaml .Values.controller.podDisruptionBudget.labels | nindent 4 }} - {{- end }} - {{- if .Values.controller.podDisruptionBudget.annotations }} - annotations: {{ toYaml .Values.controller.podDisruptionBudget.annotations | nindent 4 }} - {{- end }} -spec: - maxUnavailable: {{ .Values.controller.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-podmonitor.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-podmonitor.yaml deleted file mode 100644 index 9a04019..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-podmonitor.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if .Values.controller.googlePodMonitor.enabled }} -apiVersion: monitoring.googleapis.com/v1 -kind: PodMonitoring - -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.googlePodMonitor.serviceMonitorNamespace }} - namespace: {{ .Values.controller.googlePodMonitor.serviceMonitorNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - -spec: - endpoints: - - interval: {{ .Values.controller.googlePodMonitor.scrapeInterval }} - port: http - path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.googlePodMonitor.scrapeEndpoint }} - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-route.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-route.yaml deleted file mode 100644 index 3550380..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-route.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.controller.route.enabled }} -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - app: {{ template "jenkins.fullname" . }} - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" - component: "{{ .Release.Name }}-{{ .Values.controller.componentName }}" -{{- if .Values.controller.route.labels }} -{{ toYaml .Values.controller.route.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.route.annotations }} - annotations: -{{ toYaml .Values.controller.route.annotations | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }} -spec: - host: {{ .Values.controller.route.path }} - port: - targetPort: http - tls: - insecureEdgeTerminationPolicy: Redirect - termination: edge - to: - kind: Service - name: {{ template "jenkins.fullname" . }} - weight: 100 - wildcardPolicy: None -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-secondary-ingress.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-secondary-ingress.yaml deleted file mode 100644 index c63e482..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-secondary-ingress.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- if .Values.controller.secondaryingress.enabled }} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- $serviceName := include "jenkins.fullname" . -}} -{{- $servicePort := .Values.controller.servicePort -}} -{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.secondaryingress.apiVersion }} -{{- end }} -kind: Ingress -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.secondaryingress.labels -}} - {{ toYaml .Values.controller.secondaryingress.labels | nindent 4 }} - {{- end }} - {{- if .Values.controller.secondaryingress.annotations }} - annotations: {{ toYaml .Values.controller.secondaryingress.annotations | nindent 4 }} - {{- end }} - name: {{ template "jenkins.fullname" . }}-secondary -spec: -{{- if .Values.controller.secondaryingress.ingressClassName }} - ingressClassName: {{ .Values.controller.secondaryingress.ingressClassName | quote }} -{{- end }} - rules: - - host: {{ .Values.controller.secondaryingress.hostName }} - http: - paths: - {{- range .Values.controller.secondaryingress.paths }} - - path: {{ . | quote }} - backend: -{{ if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ $serviceName }} - port: - number: {{ $servicePort }} - pathType: ImplementationSpecific -{{ else }} - serviceName: {{ $serviceName }} - servicePort: {{ $servicePort }} -{{ end }} - {{- end}} -{{- if .Values.controller.secondaryingress.tls }} - tls: -{{ toYaml .Values.controller.secondaryingress.tls | indent 4 }} -{{- end -}} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-servicemonitor.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-servicemonitor.yaml deleted file mode 100644 index 8710b2b..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-servicemonitor.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if and .Values.controller.prometheus.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor - -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.prometheus.serviceMonitorNamespace }} - namespace: {{ .Values.controller.prometheus.serviceMonitorNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.prometheus.serviceMonitorAdditionalLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - -spec: - endpoints: - - interval: {{ .Values.controller.prometheus.scrapeInterval }} - port: http - path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.prometheus.scrapeEndpoint }} - {{- with .Values.controller.prometheus.relabelings }} - relabelings: - {{- toYaml . | nindent 6 }} - {{- end }} - {{- with .Values.controller.prometheus.metricRelabelings }} - metricRelabelings: - {{- toYaml . | nindent 6 }} - {{- end }} - jobLabel: {{ template "jenkins.fullname" . }} - namespaceSelector: - matchNames: - - "{{ template "jenkins.namespace" $ }}" - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-statefulset.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-statefulset.yaml deleted file mode 100644 index 40020b3..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-statefulset.yaml +++ /dev/null @@ -1,434 +0,0 @@ -{{- if .Capabilities.APIVersions.Has "apps/v1" }} -apiVersion: apps/v1 -{{- else }} -apiVersion: apps/v1beta1 -{{- end }} -kind: StatefulSet -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.statefulSetLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - {{- with .Values.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.controller.statefulSetAnnotations }} - annotations: -{{ toYaml .Values.controller.statefulSetAnnotations | indent 4 }} - {{- end }} -spec: - serviceName: {{ template "jenkins.fullname" . }} - replicas: 1 - selector: - matchLabels: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - {{- if .Values.controller.updateStrategy }} - updateStrategy: -{{ toYaml .Values.controller.updateStrategy | indent 4 }} - {{- end }} - template: - metadata: - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.podLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - {{- with .Values.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - annotations: - checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }} - {{- if .Values.controller.initScripts }} - checksum/config-init-scripts: {{ include (print $.Template.BasePath "/config-init-scripts.yaml") . | sha256sum }} - {{- end }} - {{- if .Values.controller.podAnnotations }} -{{ tpl (toYaml .Values.controller.podAnnotations | indent 8) . }} - {{- end }} - spec: - {{- if .Values.controller.schedulerName }} - schedulerName: {{ .Values.controller.schedulerName }} - {{- end }} - {{- if .Values.controller.nodeSelector }} - nodeSelector: -{{ toYaml .Values.controller.nodeSelector | indent 8 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: -{{ toYaml .Values.controller.tolerations | indent 8 }} - {{- end }} - {{- if .Values.controller.affinity }} - affinity: -{{ toYaml .Values.controller.affinity | indent 8 }} - {{- end }} - {{- if .Values.controller.topologySpreadConstraints }} - topologySpreadConstraints: -{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }} - {{- end }} - {{- if quote .Values.controller.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} - {{- end }} - {{- if .Values.controller.shareProcessNamespace }} - shareProcessNamespace: true - {{- end }} - {{- if not .Values.controller.enableServiceLinks }} - enableServiceLinks: false - {{- end }} -{{- if .Values.controller.usePodSecurityContext }} - securityContext: - {{- if kindIs "map" .Values.controller.podSecurityContextOverride }} - {{- tpl (toYaml .Values.controller.podSecurityContextOverride | nindent 8) . -}} - {{- else }} - {{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed: - runAsUser: 1000 - fsGroup: 1000 - runAsNonRoot: true - */}} - runAsUser: {{ default 0 .Values.controller.runAsUser }} - {{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }} - {{- if not (eq (int .Values.controller.runAsUser) 0) }} - fsGroup: {{ .Values.controller.fsGroup }} - runAsNonRoot: true - {{- end }} - {{- if .Values.controller.securityContextCapabilities }} - capabilities: - {{- toYaml .Values.controller.securityContextCapabilities | nindent 10 }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} - serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}" - automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -{{- if .Values.controller.hostNetworking }} - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet -{{- end }} - {{- if .Values.controller.hostAliases }} - hostAliases: - {{- toYaml .Values.controller.hostAliases | nindent 8 }} - {{- end }} - initContainers: -{{- if .Values.controller.customInitContainers }} -{{ tpl (toYaml .Values.controller.customInitContainers) . | indent 8 }} -{{- end }} - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- include "jenkins.configReloadContainer" (list $ "config-reload-init" "init") | nindent 8 }} -{{- end}} - - - name: "init" - image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}" - {{- if .Values.controller.containerSecurityContext }} - securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} - {{- end }} - command: [ "sh", "/var/jenkins_config/apply_config.sh" ] - {{- if .Values.controller.initContainerEnvFrom }} - envFrom: -{{ (tpl (toYaml .Values.controller.initContainerEnvFrom) .) | indent 12 }} - {{- end }} - {{- if .Values.controller.initContainerEnv }} - env: -{{ (tpl (toYaml .Values.controller.initContainerEnv) .) | indent 12 }} - {{- end }} - resources: -{{- if .Values.controller.initContainerResources }} -{{ toYaml .Values.controller.initContainerResources | indent 12 }} -{{- else }} -{{ toYaml .Values.controller.resources | indent 12 }} -{{- end }} - volumeMounts: - {{- if .Values.persistence.mounts }} -{{ toYaml .Values.persistence.mounts | indent 12 }} - {{- end }} - - mountPath: {{ .Values.controller.jenkinsHome }} - name: jenkins-home - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - mountPath: /var/jenkins_config - name: jenkins-config - {{- if .Values.controller.installPlugins }} - {{- if .Values.controller.overwritePluginsFromImage }} - - mountPath: {{ .Values.controller.jenkinsRef }}/plugins - name: plugins - {{- end }} - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - {{- end }} - {{- if or .Values.controller.initScripts .Values.controller.initConfigMap }} - - mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d - name: init-scripts - {{- end }} - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - {{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }} - - mountPath: {{ $httpsJKSDirPath }} - name: jenkins-https-keystore - {{- end }} - containers: - - name: jenkins - image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}" - {{- if .Values.controller.containerSecurityContext }} - securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} - {{- end }} - {{- if .Values.controller.overrideArgs }} - args: [ - {{- range $overrideArg := .Values.controller.overrideArgs }} - "{{- tpl $overrideArg $ }}", - {{- end }} - ] - {{- else if .Values.controller.httpsKeyStore.enable }} - {{- $httpsJKSFilePath := printf "%s/%s" .Values.controller.httpsKeyStore.path .Values.controller.httpsKeyStore.fileName }} - args: [ "--httpPort={{.Values.controller.httpsKeyStore.httpPort}}", "--httpsPort={{.Values.controller.targetPort}}", '--httpsKeyStore={{ $httpsJKSFilePath }}', "--httpsKeyStorePassword=$(JENKINS_HTTPS_KEYSTORE_PASSWORD)" ] - {{- else }} - args: [ "--httpPort={{.Values.controller.targetPort}}"] - {{- end }} - {{- if .Values.controller.lifecycle }} - lifecycle: -{{ toYaml .Values.controller.lifecycle | indent 12 }} - {{- end }} -{{- if .Values.controller.terminationMessagePath }} - terminationMessagePath: {{ .Values.controller.terminationMessagePath }} -{{- end }} -{{- if .Values.controller.terminationMessagePolicy }} - terminationMessagePolicy: {{ .Values.controller.terminationMessagePolicy }} -{{- end }} - {{- if .Values.controller.containerEnvFrom }} - envFrom: -{{ (tpl ( toYaml .Values.controller.containerEnvFrom) .) | indent 12 }} - {{- end }} - env: - {{- if .Values.controller.containerEnv }} -{{ (tpl ( toYaml .Values.controller.containerEnv) .) | indent 12 }} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - - name: SECRETS - value: /run/secrets/additional - {{- end }} - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: >- - {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ default "" .Values.controller.javaOpts }} - - name: JENKINS_OPTS - value: >- - {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ default "" .Values.controller.jenkinsOpts}} - - name: JENKINS_SLAVE_AGENT_PORT - value: "{{ .Values.controller.agentListenerPort }}" - {{- if .Values.controller.httpsKeyStore.enable }} - - name: JENKINS_HTTPS_KEYSTORE_PASSWORD - {{- if not .Values.controller.httpsKeyStore.disableSecretMount }} - valueFrom: - secretKeyRef: - name: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ else if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} - key: "{{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey }}" - {{- else }} - value: {{ .Values.controller.httpsKeyStore.password }} - {{- end }} - {{- end }} - - - name: CASC_JENKINS_CONFIG - value: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }}{{- if .Values.controller.JCasC.configUrls }},{{ join "," .Values.controller.JCasC.configUrls }}{{- end }} - ports: - {{- if .Values.controller.httpsKeyStore.enable }} - - containerPort: {{.Values.controller.httpsKeyStore.httpPort}} - {{- else }} - - containerPort: {{.Values.controller.targetPort}} - {{- end }} - name: http - - containerPort: {{ .Values.controller.agentListenerPort }} - name: agent-listener - {{- if .Values.controller.agentListenerHostPort }} - hostPort: {{ .Values.controller.agentListenerHostPort }} - {{- end }} - {{- if .Values.controller.jmxPort }} - - containerPort: {{ .Values.controller.jmxPort }} - name: jmx - {{- end }} -{{- range $index, $port := .Values.controller.extraPorts }} - - containerPort: {{ $port.port }} - name: {{ $port.name }} -{{- end }} -{{- if and .Values.controller.healthProbes .Values.controller.probes}} - {{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion }} - startupProbe: -{{ tpl (toYaml .Values.controller.probes.startupProbe | indent 12) .}} - {{- end }} - livenessProbe: -{{ tpl (toYaml .Values.controller.probes.livenessProbe | indent 12) .}} - readinessProbe: -{{ tpl (toYaml .Values.controller.probes.readinessProbe | indent 12) .}} -{{- end }} - resources: -{{ toYaml .Values.controller.resources | indent 12 }} - volumeMounts: -{{- if .Values.persistence.mounts }} -{{ toYaml .Values.persistence.mounts | indent 12 }} -{{- end }} - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - {{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }} - - mountPath: {{ $httpsJKSDirPath }} - name: jenkins-https-keystore - {{- end }} - - mountPath: {{ .Values.controller.jenkinsHome }} - name: jenkins-home - readOnly: false - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - {{- if .Values.controller.installPlugins }} - - mountPath: {{ .Values.controller.jenkinsRef }}/plugins/ - name: plugin-dir - readOnly: false - {{- end }} - {{- if or .Values.controller.initScripts .Values.controller.initConfigMap }} - - mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d - name: init-scripts - {{- end }} - {{- if .Values.controller.sidecars.configAutoReload.enabled }} - - name: sc-config-volume - mountPath: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - - name: jenkins-secrets - mountPath: /run/secrets/additional - readOnly: true - {{- end }} - - name: jenkins-cache - mountPath: /var/jenkins_cache - - mountPath: /tmp - name: tmp-volume - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- include "jenkins.configReloadContainer" (list $ "config-reload" "sidecar") | nindent 8 }} -{{- end}} - - -{{- if .Values.controller.sidecars.additionalSidecarContainers}} -{{ tpl (toYaml .Values.controller.sidecars.additionalSidecarContainers | indent 8) .}} -{{- end }} - - volumes: -{{- if .Values.persistence.volumes }} -{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }} -{{- end }} - {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }} - - name: auto-reload-config - configMap: - name: {{ template "jenkins.fullname" . }}-auto-reload-config - - name: auto-reload-config-logs - emptyDir: {} - {{- end }} - {{- if .Values.controller.installPlugins }} - {{- if .Values.controller.overwritePluginsFromImage }} - - name: plugins - emptyDir: {} - {{- end }} - {{- end }} - {{- if and .Values.controller.initScripts .Values.controller.initConfigMap }} - - name: init-scripts - projected: - sources: - - configMap: - name: {{ template "jenkins.fullname" . }}-init-scripts - - configMap: - name: {{ .Values.controller.initConfigMap }} - {{- else if .Values.controller.initConfigMap }} - - name: init-scripts - configMap: - name: {{ .Values.controller.initConfigMap }} - {{- else if .Values.controller.initScripts }} - - name: init-scripts - configMap: - name: {{ template "jenkins.fullname" . }}-init-scripts - {{- end }} - - name: jenkins-config - configMap: - name: {{ template "jenkins.fullname" . }} - {{- if .Values.controller.installPlugins }} - - name: plugin-dir - emptyDir: {} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }} - - name: jenkins-secrets - projected: - sources: - {{- if .Values.controller.additionalSecrets }} - - secret: - name: {{ template "jenkins.fullname" . }}-additional-secrets - {{- end }} - {{- if .Values.controller.additionalExistingSecrets }} - {{- range $key, $value := .Values.controller.additionalExistingSecrets }} - - secret: - name: {{ tpl $value.name $ }} - items: - - key: {{ tpl $value.keyName $ }} - path: {{ tpl $value.name $ }}-{{ tpl $value.keyName $ }} - {{- end }} - {{- end }} - {{- if .Values.controller.admin.createSecret }} - - secret: - name: {{ .Values.controller.admin.existingSecret | default (include "jenkins.fullname" .) }} - items: - - key: {{ .Values.controller.admin.userKey | default "jenkins-admin-user" }} - path: chart-admin-username - - key: {{ .Values.controller.admin.passwordKey | default "jenkins-admin-password" }} - path: chart-admin-password - {{- end }} - {{- if .Values.controller.existingSecret }} - - secret: - name: {{ .Values.controller.existingSecret }} - {{- end }} - {{- end }} - - name: jenkins-cache - emptyDir: {} - {{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }} - - name: jenkins-home - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "jenkins.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end -}} - {{- end }} - - name: sc-config-volume - emptyDir: {} - - name: tmp-volume - emptyDir: {} - - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - - name: jenkins-https-keystore - secret: - secretName: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} - items: - - key: {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey }} - path: {{ .Values.controller.httpsKeyStore.fileName }} - {{- end }} - -{{- if .Values.controller.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.controller.imagePullSecretName }} -{{- end -}} diff --git a/helm-templates/jenkins-grn/templates/jenkins-controller-svc.yaml b/helm-templates/jenkins-grn/templates/jenkins-controller-svc.yaml deleted file mode 100644 index 8423322..0000000 --- a/helm-templates/jenkins-grn/templates/jenkins-controller-svc.yaml +++ /dev/null @@ -1,64 +0,0 @@ -{{- if .Values.controller.serviceEnabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.serviceLabels }} -{{ toYaml .Values.controller.serviceLabels | indent 4 }} - {{- end }} - {{- with .Values.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -{{- if .Values.controller.serviceAnnotations }} - annotations: -{{ toYaml .Values.controller.serviceAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.controller.serviceExternalTrafficPolicy }} - externalTrafficPolicy: {{.Values.controller.serviceExternalTrafficPolicy}} - {{- end }} - {{- if (and (eq .Values.controller.serviceType "ClusterIP") (not (empty .Values.controller.clusterIP))) }} - clusterIP: {{.Values.controller.clusterIP}} - {{- end }} - ports: - - port: {{.Values.controller.servicePort}} - name: http - targetPort: {{ .Values.controller.targetPort }} - {{- if (and (eq .Values.controller.serviceType "NodePort") (not (empty .Values.controller.nodePort))) }} - nodePort: {{.Values.controller.nodePort}} - {{- end }} -{{- range $index, $port := .Values.controller.extraPorts }} - - port: {{ $port.port }} - name: {{ $port.name }} - {{- if $port.targetPort }} - targetPort: {{ $port.targetPort }} - {{- else }} - targetPort: {{ $port.port }} - {{- end -}} -{{- end }} - {{- if .Values.controller.publishNotReadyAddresses }} - publishNotReadyAddresses: true - {{- end }} - selector: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - type: {{.Values.controller.serviceType}} - {{if eq .Values.controller.serviceType "LoadBalancer"}} -{{- if .Values.controller.loadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml .Values.controller.loadBalancerSourceRanges | indent 4 }} -{{- end }} - {{if .Values.controller.loadBalancerIP}} - loadBalancerIP: {{.Values.controller.loadBalancerIP}} - {{end}} - {{end}} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/rbac.yaml b/helm-templates/jenkins-grn/templates/rbac.yaml deleted file mode 100644 index 8fa5aba..0000000 --- a/helm-templates/jenkins-grn/templates/rbac.yaml +++ /dev/null @@ -1,198 +0,0 @@ -{{ if .Values.rbac.create }} -{{- $serviceName := include "jenkins.fullname" . -}} - -# This role is used to allow Jenkins scheduling of agents via Kubernetes plugin. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $serviceName }}-schedule-agents - namespace: {{ template "jenkins.agent.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["pods", "pods/exec", "persistentvolumeclaims"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] - ---- - -# We bind the role to the Jenkins service account. The role binding is created in the namespace -# where the agents are supposed to run. -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-schedule-agents - namespace: {{ template "jenkins.agent.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $serviceName }}-schedule-agents -subjects: -- kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" .}} - namespace: {{ template "jenkins.namespace" . }} - ---- - -{{- if .Values.rbac.readSecrets }} -# This is needed if you want to use https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/ -# as it needs permissions to get/watch/list Secrets -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-read-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "watch", "list"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-read-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-read-secrets -subjects: - - kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} - ---- -{{- end}} - -{{- if .Values.rbac.useOpenShiftNonRootSCC }} -# This is needed if you are running on OpenShift and using the default -# containerSecurityContext in the chart. It grants the Jenkins service account -# permission to use the "nonroot" and "nonroot-v2" SecurityContextConstraints. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $serviceName }}-use-nonroot-scc - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: - - apiGroups: ["security.openshift.io"] - resources: ["securitycontextconstraints"] - resourceNames: ["nonroot", "nonroot-v2"] - verbs: ["use"] ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-use-nonroot-scc - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-use-nonroot-scc -subjects: - - kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} - ---- -{{- end}} - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -# The sidecar container which is responsible for reloading configuration changes -# needs permissions to watch ConfigMaps -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-casc-reload - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "watch", "list"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-watch-configmaps - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-casc-reload -subjects: -- kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} - -{{- end}} - -{{ end }} diff --git a/helm-templates/jenkins-grn/templates/secret-additional.yaml b/helm-templates/jenkins-grn/templates/secret-additional.yaml deleted file mode 100644 index d1908aa..0000000 --- a/helm-templates/jenkins-grn/templates/secret-additional.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.controller.additionalSecrets -}} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }}-additional-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: -{{- range .Values.controller.additionalSecrets }} - {{ .name }}: {{ .value | b64enc }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/secret-claims.yaml b/helm-templates/jenkins-grn/templates/secret-claims.yaml deleted file mode 100644 index e8b6d6c..0000000 --- a/helm-templates/jenkins-grn/templates/secret-claims.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if .Values.controller.secretClaims -}} -{{- $r := .Release -}} -{{- $v := .Values -}} -{{- $chart := printf "%s-%s" .Chart.Name .Chart.Version -}} -{{- $namespace := include "jenkins.namespace" . -}} -{{- $serviceName := include "jenkins.fullname" . -}} -{{ range .Values.controller.secretClaims }} ---- -kind: SecretClaim -apiVersion: vaultproject.io/v1 -metadata: - name: {{ $serviceName }}-{{ .name | default .path | lower }} - namespace: {{ $namespace }} - labels: - "app.kubernetes.io/name": '{{ $serviceName }}' - {{- if $v.renderHelmLabels }} - "helm.sh/chart": "{{ $chart }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $r.Service }}" - "app.kubernetes.io/instance": "{{ $r.Name }}" - "app.kubernetes.io/component": "{{ $v.controller.componentName }}" -spec: - type: {{ .type | default "Opaque" }} - path: {{ .path }} -{{- if .renew }} - renew: {{ .renew }} -{{- end }} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/helm-templates/jenkins-grn/templates/secret-https-jks.yaml b/helm-templates/jenkins-grn/templates/secret-https-jks.yaml deleted file mode 100644 index 5348de4..0000000 --- a/helm-templates/jenkins-grn/templates/secret-https-jks.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.controller.httpsKeyStore.enable ( not .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName ) (not .Values.controller.httpsKeyStore.disableSecretMount) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }}-https-jks - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: - jenkins-jks-file: | -{{ .Values.controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded | indent 4 }} - https-jks-password: {{ .Values.controller.httpsKeyStore.password | b64enc }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/secret.yaml b/helm-templates/jenkins-grn/templates/secret.yaml deleted file mode 100644 index cc6ace1..0000000 --- a/helm-templates/jenkins-grn/templates/secret.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and (not .Values.controller.admin.existingSecret) (.Values.controller.admin.createSecret) -}} - -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: - jenkins-admin-password: {{ template "jenkins.password" . }} - jenkins-admin-user: {{ .Values.controller.admin.username | b64enc | quote }} -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/service-account-agent.yaml b/helm-templates/jenkins-grn/templates/service-account-agent.yaml deleted file mode 100644 index c826039..0000000 --- a/helm-templates/jenkins-grn/templates/service-account-agent.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{ if .Values.serviceAccountAgent.create }} -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: {{ .Values.serviceAccountAgent.automountServiceAccountToken }} -metadata: - name: {{ include "jenkins.serviceAccountAgentName" . }} - namespace: {{ template "jenkins.agent.namespace" . }} -{{- if .Values.serviceAccountAgent.annotations }} - annotations: -{{ tpl (toYaml .Values.serviceAccountAgent.annotations) . | indent 4 }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.serviceAccountAgent.extraLabels }} -{{ tpl (toYaml .Values.serviceAccountAgent.extraLabels) . | indent 4 }} -{{- end }} -{{- if .Values.serviceAccountAgent.imagePullSecretName }} -imagePullSecrets: - - name: {{ .Values.serviceAccountAgent.imagePullSecretName }} -{{- end -}} -{{ end }} diff --git a/helm-templates/jenkins-grn/templates/service-account.yaml b/helm-templates/jenkins-grn/templates/service-account.yaml deleted file mode 100644 index 76f23ce..0000000 --- a/helm-templates/jenkins-grn/templates/service-account.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{ if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -metadata: - name: {{ include "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} -{{- if .Values.serviceAccount.annotations }} - annotations: -{{ tpl (toYaml .Values.serviceAccount.annotations) . | indent 4 }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.serviceAccount.extraLabels }} -{{ tpl (toYaml .Values.serviceAccount.extraLabels) . | indent 4 }} -{{- end }} -{{- if .Values.serviceAccount.imagePullSecretName }} -imagePullSecrets: - - name: {{ .Values.serviceAccount.imagePullSecretName }} -{{- end -}} -{{ end }} diff --git a/helm-templates/jenkins-grn/templates/tests/jenkins-test.yaml b/helm-templates/jenkins-grn/templates/tests/jenkins-test.yaml deleted file mode 100644 index 12a935e..0000000 --- a/helm-templates/jenkins-grn/templates/tests/jenkins-test.yaml +++ /dev/null @@ -1,49 +0,0 @@ -{{- if .Values.controller.testEnabled }} -apiVersion: v1 -kind: Pod -metadata: - name: "{{ .Release.Name }}-ui-test-{{ randAlphaNum 5 | lower }}" - namespace: {{ template "jenkins.namespace" . }} - annotations: - "helm.sh/hook": test-success -spec: - {{- if .Values.controller.nodeSelector }} - nodeSelector: -{{ toYaml .Values.controller.nodeSelector | indent 4 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: -{{ toYaml .Values.controller.tolerations | indent 4 }} - {{- end }} - initContainers: - - name: "test-framework" - image: "{{ .Values.helmtest.bats.image.registry }}/{{ .Values.helmtest.bats.image.repository }}:{{ .Values.helmtest.bats.image.tag }}" - command: - - "bash" - - "-c" - args: - - | - # copy bats to tools dir - set -ex - cp -R /opt/bats /tools/bats/ - volumeMounts: - - mountPath: /tools - name: tools - containers: - - name: {{ .Release.Name }}-ui-test - image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}" - command: ["/tools/bats/bin/bats", "-t", "/tests/run.sh"] - volumeMounts: - - mountPath: /tests - name: tests - readOnly: true - - mountPath: /tools - name: tools - volumes: - - name: tests - configMap: - name: {{ template "jenkins.fullname" . }}-tests - - name: tools - emptyDir: {} - restartPolicy: Never -{{- end }} diff --git a/helm-templates/jenkins-grn/templates/tests/test-config.yaml b/helm-templates/jenkins-grn/templates/tests/test-config.yaml deleted file mode 100644 index 12c5b3a..0000000 --- a/helm-templates/jenkins-grn/templates/tests/test-config.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.controller.testEnabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }}-tests - namespace: {{ template "jenkins.namespace" . }} - annotations: - "helm.sh/hook": test -data: - run.sh: |- - @test "Testing Jenkins UI is accessible" { - curl --retry 48 --retry-delay 10 {{ template "jenkins.fullname" . }}:{{ .Values.controller.servicePort }}{{ default "" .Values.controller.jenkinsUriPrefix }}/login - } -{{- end }} diff --git a/helm-templates/jenkins-grn/unittests/__snapshot__/config-test.yaml.snap b/helm-templates/jenkins-grn/unittests/__snapshot__/config-test.yaml.snap deleted file mode 100644 index e238a05..0000000 --- a/helm-templates/jenkins-grn/unittests/__snapshot__/config-test.yaml.snap +++ /dev/null @@ -1,15 +0,0 @@ -additional plugins config: - 1: | - |- - kubernetes:4353.vb_47977da_9417 - workflow-aggregator:608.v67378e9d3db_1 - git:5.7.0 - configuration-as-code:1971.vf9280461ea_89 - kubernetes-credentials-provider -default config: - 1: | - |- - kubernetes:4353.vb_47977da_9417 - workflow-aggregator:608.v67378e9d3db_1 - git:5.7.0 - configuration-as-code:1971.vf9280461ea_89 diff --git a/helm-templates/jenkins-grn/unittests/__snapshot__/garbage-collect-test.yaml.snap b/helm-templates/jenkins-grn/unittests/__snapshot__/garbage-collect-test.yaml.snap deleted file mode 100644 index 6645ef9..0000000 --- a/helm-templates/jenkins-grn/unittests/__snapshot__/garbage-collect-test.yaml.snap +++ /dev/null @@ -1,316 +0,0 @@ -namespaces: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - garbageCollection: - namespaces: |- - namespace1 - namespace2 - timeout: "300" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: c1b261d31fc5fd6a3d1f677587cb3d33ed080e32dc72853e981f95d526cb35a0 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://my-release-jenkins:8080 -one cloud: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - garbageCollection: - timeout: "300" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: 21e0459a6eaf68defd393abec10ed1cfe90336673940ff4d25ad9cdbb1f4e68e - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://my-release-jenkins:8080 -second cloud: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - garbageCollection: - timeout: "300" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: 21e0459a6eaf68defd393abec10ed1cfe90336673940ff4d25ad9cdbb1f4e68e - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "5" - garbageCollection: - timeout: "300" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "second" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: 62ee705db3e7c29e425499fa11beb4807dc8322e9ad84f83da0571623bcf02ac - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://my-release-jenkins:8080 diff --git a/helm-templates/jenkins-grn/unittests/__snapshot__/instance-cap-test.yaml.snap b/helm-templates/jenkins-grn/unittests/__snapshot__/instance-cap-test.yaml.snap deleted file mode 100644 index 9168e14..0000000 --- a/helm-templates/jenkins-grn/unittests/__snapshot__/instance-cap-test.yaml.snap +++ /dev/null @@ -1,170 +0,0 @@ -default-cap: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://my-release-jenkins:8080 -limited-cap: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "my-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "my-namespace" - id: bb8d2dd40188d32e71b3a4b8fc4988a3461c0cf05afba398e1b181248d0281cd - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 5 - label: "my-release-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://my-release-jenkins:8080 diff --git a/helm-templates/jenkins-grn/unittests/__snapshot__/jcasc-config-test.yaml.snap b/helm-templates/jenkins-grn/unittests/__snapshot__/jcasc-config-test.yaml.snap deleted file mode 100644 index 8a3fceb..0000000 --- a/helm-templates/jenkins-grn/unittests/__snapshot__/jcasc-config-test.yaml.snap +++ /dev/null @@ -1,3508 +0,0 @@ -additional clouds: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "remote-cloud-1" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://api.remote-cloud.com" - credentialsId: "remote-cloud-token" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -additional clouds inheriting additional agents: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "maven" - namespace: "maven" - id: 6259994af2ee2301f5f7570a0c6ac0cb657a723f2bca0e498c24656cb6c15909 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "remote-cloud-1" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://api.remote-cloud.com" - credentialsId: "remote-cloud-token" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "maven" - namespace: "maven" - id: 6259994af2ee2301f5f7570a0c6ac0cb657a723f2bca0e498c24656cb6c15909 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -additional clouds overriding additional agents: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "maven" - namespace: "maven" - id: 6259994af2ee2301f5f7570a0c6ac0cb657a723f2bca0e498c24656cb6c15909 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "remote-cloud-1" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://api.remote-cloud.com" - credentialsId: "remote-cloud-token" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -additional clouds set skipTlsVerify: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: true - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "remote-cloud-1" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://api.remote-cloud.com" - credentialsId: "remote-cloud-token" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 8682c649aff7b87a5eb66c0b6552953f2c8cd6f3641878fc56043d58be00f052 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -additional clouds set usageRestricted: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: true - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "remote-cloud-1" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://api.remote-cloud.com" - credentialsId: "remote-cloud-token" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: a5a97b0f79c40ef9fa36cd5bd54b0be5f83d3b97707bc24be16b7778a0400442 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -adds custom labels on agent pods: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "NAMESPACE" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - - key: "label-one" - value: "value-one" - - key: "label-two" - value: "true" - templates: - - name: "default" - namespace: "NAMESPACE" - id: 9632552a5e043267b12edddd5f7843522058eceed9c649db0a81f4cb048a77c6 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -agent namespace and templates: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "jenkins-agents" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "jenkins-agents" - id: 6b8499b6e7289602106c60f9f9c3ba25a6a9a8c0ca5e931e0ba77e7c2276b42f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "maven" - namespace: "maven" - id: bb800a1c3085f77f33e2209f2c16aa5ea4894bc919b25e32d0a7cc7fba80f205 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "python" - namespace: "jenkins-agents" - id: 475cb70f861ac29f9234e42d92fe6f06327b45ee8b567381058c4fd2ed91f1b2 - containers: - - name: "python" - alwaysPullImage: false - args: "cat" - command: /bin/sh -c - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "python:3" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: true - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent python" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: python3 - label: jenkins-python3 - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceRequestEphemeralStorage: "1Gi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - resourceLimitEphemeralStorage: "2Gi" - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -agent with liveness probe: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 7203be1aca61c149812c9e4eb4fbb042ec3e3c117f5c7b308bc449f01a687b86 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -agents with liveness probe: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 78e60d053350cfb54d56180ceba39d04f720dc04fc3a192a9acc0f1a4433cd06 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "side-container" - alwaysPullImage: false - args: "" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "REPOSITORY:TAG" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -configure hostnetworking to agent: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: dcb4aed49fca25c5470cf855019c70387b6beb4e827c519bd502ff3f383e2941 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - hostNetwork: true - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom dynamic pvc workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 255708ab65aa190c422d5abf799bf1b52b83ed3fb3fe5e06b48c7b91d3f565d4 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - dynamicPVC: - accessModes: "ReadWriteOnce" - requestsSize: "2Gi" - storageClassName: "gp2" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom emptyDir workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 2088c63074fe987c33340c2d9cb5937ba6f452a7067cf0e5c26e9c0f98670f62 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - emptyDirWorkspaceVolume: - memory: true - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom hostPath workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: f81d1e805d512992c2e3feaf4a351fedb0cb16a662e45db534dab968b908c7b2 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - hostPathWorkspaceVolume: - hostPath: "/data" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom jenkins label: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "testlabel" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom nfs workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: c22adb6db4808e11d338a6b355328001d38f671b44a63a9082389d711c49337c - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - nfsWorkspaceVolume: - readOnly: false - serverAddress: "1.1.1.1" - serverPath: "/data" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom other workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: c20bdf6637e6b058700acd1dbaf5b344501cd0dfcd36312062f8497097868f5c - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -custom pvc workspace volume: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 576d2a4b25c68e89c59316d7cbcd7a8e5c6aa0e6e92067a39893965a2e1c7d01 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -customized config: - 1: | - |- - jenkins: - authorizationStrategy: - globalMatrix: - permissions: - - "Overall/Read:anonymous" - securityRealm: - local - disableRememberMe: true - mode: EXCLUSIVE - numExecutors: 1 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - rawHtml: - disableSyntaxHighlighting: true - clouds: - - kubernetes: - containerCapStr: "22" - jnlpregistry: "private.registry.com" - defaultsProviderTemplate: "my-defaults" - connectTimeout: "11" - readTimeout: "12" - jenkinsUrl: "http://my-release-jenkins.other.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.other.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "my-agent" - namespace: "default" - annotations: - - key: ci.jenkins-agent/test - value: "custom" - id: f5eac9df656fa71574142e06fc04f282b6e6ef56c598d8e0ca7bc3ec0d9405ba - containers: - - name: "sideContainer" - alwaysPullImage: true - args: "^${computer.jnlpmac} ^${computer.name}" - command: /bin/command - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.other.svc.cluster.local:8080/" - image: "my-image/jnlp:v1.2.3" - privileged: "true" - resourceLimitCpu: 1024m - resourceLimitMemory: 1Gi - resourceLimitEphemeralStorage: 1Gi - resourceRequestCpu: 756m - resourceRequestMemory: 768Mi - resourceRequestEphemeralStorage: 512Mi - runAsUser: 2000 - runAsGroup: 2000 - ttyEnabled: true - workingDir: /workdir - envVars: - - envVar: - key: VAR - value: value - idleMinutes: 30 - instanceCap: 2147483647 - imagePullSecrets: - - name: pullSecret - label: "my-release-jenkins-agent " - nodeSelector: jenkins-agent=v1,selector=abc - nodeUsageMode: "NORMAL" - podRetention: onFailure - showRawYaml: true - serviceAccount: "agent-serviceaccount" - slaveConnectTimeoutStr: "111" - volumes: - - configMapVolume: - configMapName: "myconfigmap" - mountPath: "/var/myapp/myconfigmap" - - emptyDirVolume: - memory: false - mountPath: "/var/myapp/myemptydir" - - hostPathVolume: - hostPath: "/var/lib/containers" - mountPath: "/var/myapp/myhostpath" - - nfsVolume: - mountPath: "/var/myapp/mynfs" - readOnly: false - serverAddress: "192.0.2.0" - serverPath: "/var/lib/containers" - - persistentVolumeClaim: - claimName: "mypvc" - mountPath: "/var/myapp/mypvc" - readOnly: false - - secretVolume: - defaultMode: "600" - mountPath: "/var/myapp/mysecret" - secretName: "mysecret" - - genericEphemeralVolume: - accessModes: "ReadWriteOnce" - mountPath: "/var/myapp/myephemeralvolume" - requestsSize: "2Gi" - storageClassName: "test-storageclass" - yaml: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "key" - operator: "Equal" - value: "value" - yamlMergeStrategy: merge - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: admin@example.org - url: https://jenkins.example.com -default config: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -disable agents: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "controller-namespace" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -disable useDefaultServiceAccount: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "NAMESPACE" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "NAMESPACE" - id: 84a2a9b142f03b4d1f0fed2e89a3450b1f1f5fd2287ad9bbb68bac23ee076253 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -empty projectNamingStrategy: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -legacyRemotingSecurityEnabled = false: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -legacyRemotingSecurityEnabled = true: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - remotingSecurity: - enabled: true - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -non-string projectNamingStrategy: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: - myConfiguration: - mySetting1: true - mySetting2: something - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -set agent.serviceAccount: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "NAMESPACE" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "NAMESPACE" - id: adee95c9b34b1d2a678c8158a9cb15758aceb51f97a9afe7fd43ddf7a61a70c5 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "testing" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -set directConnection: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - directConnection: true - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 77f44d8e2c65f60a255cabb844ac11227046483dbb225d2d401565eecb72ded0 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_DIRECT_CONNECTION" - value: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -set restrictedPssSecurityContext: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: true - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: d81b69e027d61f97d07bcbfaf8263b9e30129b93ec46b1cfa45f95c58337797d - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -set secretEnvVars: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: dc114c1780f5169f4485222bb3a73721669d4a09980dd2f6db3b3216a02440d6 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - envVars: - - envVar: - key: UNITTEST_ENV - value: testvalue - - secretEnvVar: - key: UNITTEST_PATH - secretName: k8s-unittest-secret-name - secretKey: UNITTEST_K8S_PATH - optional: false - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -specify additional container: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: eaf74d1533e41395741ca3a6adeeea43dd6c81ebfd9c1b7862456ad3d7053cb7 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -specify additional container and clear in additional agent: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: eaf74d1533e41395741ca3a6adeeea43dd6c81ebfd9c1b7862456ad3d7053cb7 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "additional-agent" - namespace: "default" - id: 7ddcf9427ec97e09f3ae4bab643941224724bab210ccc5437881cabba5c003d7 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -specify additional container and overwrite in additional agent: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: eaf74d1533e41395741ca3a6adeeea43dd6c81ebfd9c1b7862456ad3d7053cb7 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - - name: "additional-agent" - namespace: "default" - id: 025d39effb262bc15aad56025ef589eb65312043d8a78689a93a280c6a1c4c2e - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "additional" - alwaysPullImage: false - args: "arg1 arg2" - command: entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "my-additional-container-image:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -specify security settings with apiToken override: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: overridden - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 -specify security settings without apiToken override: - 1: | - |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - skipTlsVerify: false - usageRestricted: false - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - restrictedPssSecurityContext: false - serverUrl: "https://kubernetes.default" - credentialsId: "" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - inheritYamlMergeStrategy: false - slaveAgentPort: 50000 - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - gitHostKeyVerificationConfiguration: - sshHostKeyVerificationStrategy: acceptFirstConnectionStrategy - unclassified: - location: - url: http://RELEASE-NAME-jenkins:8080 diff --git a/helm-templates/jenkins-grn/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap b/helm-templates/jenkins-grn/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap deleted file mode 100644 index 93accfc..0000000 --- a/helm-templates/jenkins-grn/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap +++ /dev/null @@ -1,443 +0,0 @@ -configure empty image tag label: - 1: | - docker.io/jenkins/jenkins:2.504.2 -configure image tag label: - 1: | - docker.io/jenkins/jenkins:2.504.2-alpine -default values: - 1: | - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - serviceName: my-release-jenkins - template: - metadata: - annotations: - checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff - labels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - spec: - automountServiceAccountToken: true - containers: - - args: - - --httpPort=8080 - env: - - name: SECRETS - value: /run/secrets/additional - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: '-Dcasc.reload.token=$(POD_NAME) ' - - name: JENKINS_OPTS - value: '--webroot=/var/jenkins_cache/war ' - - name: JENKINS_SLAVE_AGENT_PORT - value: "50000" - - name: CASC_JENKINS_CONFIG - value: /var/jenkins_home/casc_configs - image: docker.io/jenkins/jenkins:2.504.2-jdk21 - imagePullPolicy: Always - livenessProbe: - failureThreshold: 5 - httpGet: - path: /login - port: http - initialDelaySeconds: null - periodSeconds: 10 - timeoutSeconds: 5 - name: jenkins - ports: - - containerPort: 8080 - name: http - - containerPort: 50000 - name: agent-listener - readinessProbe: - failureThreshold: 3 - httpGet: - path: /login - port: http - initialDelaySeconds: null - periodSeconds: 10 - timeoutSeconds: 5 - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 1000 - runAsUser: 1000 - startupProbe: - failureThreshold: 12 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - readOnly: false - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - - mountPath: /usr/share/jenkins/ref/plugins/ - name: plugin-dir - readOnly: false - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - mountPath: /var/jenkins_cache - name: jenkins-cache - - mountPath: /tmp - name: tmp-volume - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: REQ_URL - value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) - - name: REQ_METHOD - value: POST - - name: REQ_RETRY_CONNECT - value: "10" - image: docker.io/kiwigrid/k8s-sidecar:1.30.3 - imagePullPolicy: IfNotPresent - name: config-reload - resources: {} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - enableServiceLinks: false - initContainers: - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: METHOD - value: LIST - image: docker.io/kiwigrid/k8s-sidecar:1.30.3 - imagePullPolicy: IfNotPresent - name: config-reload-init - resources: {} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - - command: - - sh - - /var/jenkins_config/apply_config.sh - image: docker.io/jenkins/jenkins:2.504.2-jdk21 - imagePullPolicy: Always - name: init - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 1000 - runAsUser: 1000 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - - mountPath: /var/jenkins_config - name: jenkins-config - - mountPath: /usr/share/jenkins/ref/plugins - name: plugins - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - securityContext: - fsGroup: 1000 - runAsNonRoot: true - runAsUser: 1000 - serviceAccountName: my-release-jenkins - volumes: - - emptyDir: {} - name: plugins - - configMap: - name: my-release-jenkins - name: jenkins-config - - emptyDir: {} - name: plugin-dir - - name: jenkins-secrets - projected: - sources: - - secret: - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - name: my-release-jenkins - - emptyDir: {} - name: jenkins-cache - - name: jenkins-home - persistentVolumeClaim: - claimName: my-release-jenkins - - emptyDir: {} - name: sc-config-volume - - emptyDir: {} - name: tmp-volume -render pod annotations: - 1: | - checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff - fixed-annotation: some-fixed-annotation - templated-annotations: my-release -test scheme for config-reload: - 1: | - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - serviceName: my-release-jenkins - template: - metadata: - annotations: - checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff - labels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - spec: - automountServiceAccountToken: true - containers: - - args: - - --httpPort=8080 - env: - - name: SECRETS - value: /run/secrets/additional - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: '-Dcasc.reload.token=$(POD_NAME) ' - - name: JENKINS_OPTS - value: '--webroot=/var/jenkins_cache/war ' - - name: JENKINS_SLAVE_AGENT_PORT - value: "50000" - - name: CASC_JENKINS_CONFIG - value: /var/jenkins_home/casc_configs - image: docker.io/jenkins/jenkins:2.504.2-jdk21 - imagePullPolicy: Always - livenessProbe: - failureThreshold: 5 - httpGet: - path: /login - port: http - initialDelaySeconds: null - periodSeconds: 10 - timeoutSeconds: 5 - name: jenkins - ports: - - containerPort: 8080 - name: http - - containerPort: 50000 - name: agent-listener - readinessProbe: - failureThreshold: 3 - httpGet: - path: /login - port: http - initialDelaySeconds: null - periodSeconds: 10 - timeoutSeconds: 5 - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 1000 - runAsUser: 1000 - startupProbe: - failureThreshold: 12 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - readOnly: false - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - - mountPath: /usr/share/jenkins/ref/plugins/ - name: plugin-dir - readOnly: false - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - mountPath: /var/jenkins_cache - name: jenkins-cache - - mountPath: /tmp - name: tmp-volume - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: REQ_URL - value: https://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) - - name: REQ_METHOD - value: POST - - name: REQ_RETRY_CONNECT - value: "10" - image: docker.io/kiwigrid/k8s-sidecar:1.30.3 - imagePullPolicy: IfNotPresent - name: config-reload - resources: {} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - enableServiceLinks: false - initContainers: - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: METHOD - value: LIST - image: docker.io/kiwigrid/k8s-sidecar:1.30.3 - imagePullPolicy: IfNotPresent - name: config-reload-init - resources: {} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - - command: - - sh - - /var/jenkins_config/apply_config.sh - image: docker.io/jenkins/jenkins:2.504.2-jdk21 - imagePullPolicy: Always - name: init - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 1000 - runAsUser: 1000 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - - mountPath: /var/jenkins_config - name: jenkins-config - - mountPath: /usr/share/jenkins/ref/plugins - name: plugins - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - securityContext: - fsGroup: 1000 - runAsNonRoot: true - runAsUser: 1000 - serviceAccountName: my-release-jenkins - volumes: - - emptyDir: {} - name: plugins - - configMap: - name: my-release-jenkins - name: jenkins-config - - emptyDir: {} - name: plugin-dir - - name: jenkins-secrets - projected: - sources: - - secret: - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - name: my-release-jenkins - - emptyDir: {} - name: jenkins-cache - - name: jenkins-home - persistentVolumeClaim: - claimName: my-release-jenkins - - emptyDir: {} - name: sc-config-volume - - emptyDir: {} - name: tmp-volume diff --git a/helm-templates/jenkins-grn/unittests/config-init-scripts-test.yaml b/helm-templates/jenkins-grn/unittests/config-init-scripts-test.yaml deleted file mode 100644 index e4ccc96..0000000 --- a/helm-templates/jenkins-grn/unittests/config-init-scripts-test.yaml +++ /dev/null @@ -1,19 +0,0 @@ -suite: ConfigMap -templates: - - config-init-scripts.yaml -tests: - - it: config templates - set: - some.val: val here - controller.initScripts: - test: |- - my script here {{ .Values.some.val }} - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - equal: - path: data["inittest.groovy"] - value: |- - my script here val here diff --git a/helm-templates/jenkins-grn/unittests/config-test.yaml b/helm-templates/jenkins-grn/unittests/config-test.yaml deleted file mode 100644 index eceb550..0000000 --- a/helm-templates/jenkins-grn/unittests/config-test.yaml +++ /dev/null @@ -1,117 +0,0 @@ -suite: ConfigMap -templates: - - config.yaml -tests: - - it: default config - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - equal: - path: data["apply_config.sh"] - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" - - matchSnapshot: - path: data["plugins.txt"] - - it: no plugins - set: - controller.installPlugins: [] - asserts: - - equal: - path: data["apply_config.sh"] - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "finished initialization" - - equal: - path: data["plugins.txt"] - value: "" - - it: additional plugins config - set: - controller: - additionalPlugins: - - kubernetes-credentials-provider - asserts: - - matchSnapshot: - path: data["plugins.txt"] - - it: install latest plugins - set: - controller.installLatestPlugins: false - asserts: - - equal: - path: data["apply_config.sh"] - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest false; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" - - it: install latest specified plugins - set: - controller.installLatestSpecifiedPlugins: true - asserts: - - equal: - path: data["apply_config.sh"] - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true --latest-specified; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" diff --git a/helm-templates/jenkins-grn/unittests/garbage-collect-test.yaml b/helm-templates/jenkins-grn/unittests/garbage-collect-test.yaml deleted file mode 100644 index a986779..0000000 --- a/helm-templates/jenkins-grn/unittests/garbage-collect-test.yaml +++ /dev/null @@ -1,67 +0,0 @@ -suite: Garbage collection of pods -release: - name: my-release - namespace: my-namespace -templates: - - jcasc-config.yaml -tests: - - it: one cloud - set: - agent.garbageCollection.enabled: true - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - equal: - path: metadata.namespace - value: my-namespace - - - it: second cloud - set: - agent.garbageCollection.enabled: true - additionalClouds.second.agent.containerCap: 5 - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - equal: - path: metadata.namespace - value: my-namespace - - - it: namespaces - set: - agent.garbageCollection.enabled: true - agent.garbageCollection.namespaces: |- - namespace1 - namespace2 - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - equal: - path: metadata.namespace - value: my-namespace diff --git a/helm-templates/jenkins-grn/unittests/home-pvc-test.yaml b/helm-templates/jenkins-grn/unittests/home-pvc-test.yaml deleted file mode 100644 index fea2478..0000000 --- a/helm-templates/jenkins-grn/unittests/home-pvc-test.yaml +++ /dev/null @@ -1,110 +0,0 @@ -suite: PersistentVolumeClaim -release: - name: my-release - namespace: my-namespace -templates: - - home-pvc.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: PersistentVolumeClaim - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - contains: - path: spec.accessModes - content: ReadWriteOnce - - equal: - path: spec.resources.requests - value: - storage: 8Gi - - isNull: - path: spec.dataSource - - isNull: - path: spec.storageClassName - - - it: test different values - set: - persistence: - annotations: - my-annotation: value - accessMode: ReadWriteMany - size: 20Gi - storageClass: gp2 - asserts: - - equal: - path: metadata.annotations - value: - my-annotation: value - - contains: - path: spec.accessModes - content: ReadWriteMany - - equal: - path: spec.resources.requests - value: - storage: 20Gi - - equal: - path: spec.storageClassName - value: gp2 - - - it: existing claim - set: - persistence: - existingClaim: my-pvc - asserts: - - hasDocuments: - count: 0 - - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: add label - set: - renderHelmLabels: false - persistence: - labels: - test-label: test-value - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - test-label: test-value - - - it: clone from dataSource - set: - persistence: - dataSource: - name: PVC-NAME - kind: PersistentVolumeClaim - asserts: - - equal: - path: spec.dataSource.name - value: PVC-NAME - - equal: - path: spec.dataSource.kind - value: PersistentVolumeClaim diff --git a/helm-templates/jenkins-grn/unittests/instance-cap-test.yaml b/helm-templates/jenkins-grn/unittests/instance-cap-test.yaml deleted file mode 100644 index 22008e5..0000000 --- a/helm-templates/jenkins-grn/unittests/instance-cap-test.yaml +++ /dev/null @@ -1,42 +0,0 @@ -suite: Instance cap tests -release: - name: my-release - namespace: my-namespace -templates: - - jcasc-config.yaml -tests: - - it: default-cap - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - equal: - path: metadata.namespace - value: my-namespace - - - it: limited-cap - set: - agent.instanceCap: 5 - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - equal: - path: metadata.namespace - value: my-namespace diff --git a/helm-templates/jenkins-grn/unittests/jcasc-config-test.yaml b/helm-templates/jenkins-grn/unittests/jcasc-config-test.yaml deleted file mode 100644 index d67dc3d..0000000 --- a/helm-templates/jenkins-grn/unittests/jcasc-config-test.yaml +++ /dev/null @@ -1,843 +0,0 @@ -suite: Configuration as Code -templates: - - jcasc-config.yaml -tests: - - it: default config - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: agent namespace and templates - release: - namespace: controller-namespace - set: - additionalAgents: - maven: - namespace: maven - podName: maven - customJenkinsLabels: maven - image: - repository: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: - repository: python - tag: "3" - command: /bin/sh -c - args: "cat" - TTYEnabled: true - agent: - namespace: jenkins-agents - podTemplates: - python3: |- - - name: python3 - label: jenkins-python3 - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceRequestEphemeralStorage: "1Gi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - resourceLimitEphemeralStorage: "2Gi" - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: customized config - set: - controller: - disableRememberMe: true - executorMode: EXCLUSIVE - numExecutors: 1 - enableRawHtmlMarkupFormatter: true - JCasC: - authorizationStrategy: |- - globalMatrix: - permissions: - - "Overall/Read:anonymous" - configScripts: - welcome-message: | - jenkins: - systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - securityRealm: local - jenkinsAdminEmail: admin@example.org - ingress: - hostName: jenkins.example.com - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - agent: - namespace: default - containerCap: 22 - jnlpregistry: private.registry.com - defaultsProviderTemplate: my-defaults - kubernetesConnectTimeout: 11 - kubernetesReadTimeout: 12 - podName: my-agent - sideContainerName: sideContainer - alwaysPullImage: true - command: /bin/command - image: - repository: my-image/jnlp - tag: v1.2.3 - privileged: true - resources: - limits: - cpu: 1024m - memory: 1Gi - ephemeralStorage: 1Gi - requests: - cpu: 756m - memory: 768Mi - ephemeralStorage: 512Mi - runAsUser: 2000 - runAsGroup: 2000 - TTYEnabled: true - workingDir: /workdir - envVars: - - name: VAR - value: value - idleMinutes: 30 - imagePullSecretName: pullSecret - nodeSelector: - jenkins-agent: v1 - selector: abc - podRetention: onFailure - connectTimeout: 111 - volumes: - - type: ConfigMap - configMapName: myconfigmap - mountPath: /var/myapp/myconfigmap - - type: EmptyDir - mountPath: /var/myapp/myemptydir - memory: false - - type: HostPath - hostPath: /var/lib/containers - mountPath: /var/myapp/myhostpath - - type: Nfs - mountPath: /var/myapp/mynfs - readOnly: false - serverAddress: "192.0.2.0" - serverPath: /var/lib/containers - - type: PVC - claimName: mypvc - mountPath: /var/myapp/mypvc - readOnly: false - - type: Secret - defaultMode: "600" - mountPath: /var/myapp/mysecret - secretName: mysecret - - type: EphemeralVolume - mountPath: /var/myapp/myephemeralvolume - accessModes: ReadWriteOnce - requestsSize: 2Gi - storageClassName: test-storageclass - annotations: - ci.jenkins-agent/test: "custom" - yamlTemplate: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "key" - operator: "Equal" - value: "value" - yamlMergeStrategy: merge - serviceAccountAgent: - name: agent-serviceaccount - release: - name: my-release - namespace: other - asserts: - - hasDocuments: - count: 2 - - documentIndex: 0 - isKind: - of: ConfigMap - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - documentIndex: 0 - equal: - path: metadata.name - value: my-release-jenkins-jenkins-config-welcome-message - - documentIndex: 0 - equal: - path: metadata.namespace - value: other - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - documentIndex: 1 - isKind: - of: ConfigMap - - documentIndex: 1 - equal: - path: metadata.name - value: my-release-jenkins-jenkins-jcasc-config - - documentIndex: 1 - equal: - path: metadata.namespace - value: other - - documentIndex: 0 - equal: - path: metadata.labels.my-release-jenkins-jenkins-config - value: "true" - - documentIndex: 1 - equal: - path: metadata.labels.my-release-jenkins-jenkins-config - value: "true" - - documentIndex: 0 - equal: - path: data - value: - welcome-message.yaml: |- - jenkins: - systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - - documentIndex: 1 - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom dynamic pvc workspace volume - set: - agent: - workspaceVolume: - type: "DynamicPVC" - accessModes: "ReadWriteOnce" - requestsSize: "2Gi" - storageClassName: "gp2" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom emptyDir workspace volume - set: - agent: - workspaceVolume: - type: "EmptyDir" - memory: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom hostPath workspace volume - set: - agent: - workspaceVolume: - type: "HostPath" - hostPath: "/data" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom nfs workspace volume - set: - agent: - workspaceVolume: - type: "Nfs" - readOnly: false - serverAddress: "1.1.1.1" - serverPath: "/data" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom pvc workspace volume - set: - agent: - workspaceVolume: - type: "PVC" - claimName: "my-claim" - readOnly: false - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom other workspace volume - set: - agent: - workspaceVolume: - type: "persistentVolumeClaimWorkspaceVolume" - claimName: "my-claim" - readOnly: false - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - RELEASE-NAME-jenkins-jenkins-config: "true" - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agents - release: - namespace: controller-namespace - set: - agent.enabled: false - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: disable default config - set: - controller.JCasC.defaultConfig: false - asserts: - - hasDocuments: - count: 0 - - it: custom jenkins label - set: - controller: - customJenkinsLabels: ["testlabel"] - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: adds custom labels on agent pods - set: - agent: - podLabels: - label-one: value-one - label-two: true - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: disable useDefaultServiceAccount - set: - agent: - useDefaultServiceAccount: false - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: set agent.serviceAccount - set: - agent: - serviceAccount: "testing" - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: legacyRemotingSecurityEnabled = false - release: - namespace: default - set: - controller: - legacyRemotingSecurityEnabled: false - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: legacyRemotingSecurityEnabled = true - release: - namespace: default - set: - controller: - legacyRemotingSecurityEnabled: true - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: empty projectNamingStrategy - release: - namespace: default - set: - controller: - projectNamingStrategy: - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: non-string projectNamingStrategy - release: - namespace: default - set: - controller: - projectNamingStrategy: - myConfiguration: - mySetting1: true - mySetting2: something - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: specify security settings without apiToken override - release: - namespace: default - set: - controller: - JCasC: - security: - gitHostKeyVerificationConfiguration: - sshHostKeyVerificationStrategy: "acceptFirstConnectionStrategy" - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: specify security settings with apiToken override - release: - namespace: default - set: - controller: - JCasC: - security: - apiToken: overridden - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: specify additional container - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: - repository: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: specify additional container and overwrite in additional agent - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: - repository: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - additionalAgents: - additional-agent: - podName: additional-agent - additionalContainers: - - sideContainerName: additional - image: - repository: my-additional-container-image - tag: latest - command: entrypoint.sh - args: arg1 arg2 - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: specify additional container and clear in additional agent - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: - repository: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - additionalAgents: - additional-agent: - podName: additional-agent - additionalContainers: [] - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: configure hostnetworking to agent - release: - namespace: default - set: - agent: - hostNetworking: true - asserts: - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: set secretEnvVars - set: - agent: - secretEnvVars: - - key: UNITTEST_PATH - secretKey: UNITTEST_K8S_PATH - secretName: k8s-unittest-secret-name - envVars: - - name: UNITTEST_ENV - value: testvalue - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: set directConnection - set: - agent: - directConnection: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: set restrictedPssSecurityContext - set: - agent: - restrictedPssSecurityContext: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: agent with liveness probe - set: - agent: - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: agents with liveness probe - set: - agent: - additionalContainers: - - sideContainerName: side-container - image: - repository: REPOSITORY - tag: TAG - args: "" - command: "" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: additional clouds - set: - additionalClouds: - remote-cloud-1: - kubernetesURL: https://api.remote-cloud.com - credentialsId: "remote-cloud-token" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: additional clouds inheriting additional agents - set: - additionalAgents: - maven: - namespace: maven - podName: maven - customJenkinsLabels: maven - image: - repository: jenkins/jnlp-agent-maven - tag: latest - additionalClouds: - remote-cloud-1: - kubernetesURL: https://api.remote-cloud.com - credentialsId: "remote-cloud-token" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: additional clouds overriding additional agents - set: - additionalAgents: - maven: - namespace: maven - podName: maven - customJenkinsLabels: maven - image: - repository: jenkins/jnlp-agent-maven - tag: latest - additionalClouds: - remote-cloud-1: - kubernetesURL: https://api.remote-cloud.com - credentialsId: "remote-cloud-token" - additionalAgentsOverride: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: custom configmap annotations - set: - controller: - JCasC: - configMapAnnotations: - jenkins.example.com/anno1: "custom-annotation" - jenkins.example.com/anno2: "another-annotation" - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - equal: - path: metadata.annotations - value: - jenkins.example.com/anno1: "custom-annotation" - jenkins.example.com/anno2: "another-annotation" - - it: additional clouds set skipTlsVerify - set: - additionalClouds: - remote-cloud-1: - kubernetesURL: https://api.remote-cloud.com - credentialsId: "remote-cloud-token" - agent: - skipTlsVerify: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] - - it: additional clouds set usageRestricted - set: - additionalClouds: - remote-cloud-1: - kubernetesURL: https://api.remote-cloud.com - credentialsId: "remote-cloud-token" - agent: - usageRestricted: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data["jcasc-default-config.yaml"] - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - matchSnapshot: - path: data["jcasc-default-config.yaml"] diff --git a/helm-templates/jenkins-grn/unittests/jenkins-agent-svc-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-agent-svc-test.yaml deleted file mode 100644 index 2588389..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-agent-svc-test.yaml +++ /dev/null @@ -1,130 +0,0 @@ -suite: Jenkins Agent Service -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-agent-svc.yaml -tests: - - it: default tests - asserts: - - isKind: - of: Service - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: other values - set: - controller: - agentListenerServiceAnnotations: - key: value - agentListenerPort: 55555 - asserts: - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 55555 - targetPort: 55555 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: node port random - set: - controller: - agentListenerServiceType: NodePort - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: node port defined - set: - controller: - agentListenerServiceType: NodePort - agentListenerNodePort: 32123 - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - nodePort: 32123 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: load balancer - set: - controller: - agentListenerServiceType: LoadBalancer - agentListenerLoadBalancerIP: 10.10.10.10 - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: LoadBalancer - loadBalancerIP: 10.10.10.10 - loadBalancerSourceRanges: - - 0.0.0.0/0 - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agent service - set: - controller: - agentListenerEnabled: false - asserts: - - hasDocuments: - count: 0 diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-alerting-rules-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-alerting-rules-test.yaml deleted file mode 100644 index cc9057d..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-alerting-rules-test.yaml +++ /dev/null @@ -1,79 +0,0 @@ -suite: Controller Prometheus PrometheusRule -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-alerting-rules.yaml -tests: - - it: defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.prometheus: - enabled: true - alertingrules: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - asserts: - - isKind: - of: PrometheusRule - - equal: - path: apiVersion - value: monitoring.coreos.com/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - equal: - path: spec - value: - groups: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.prometheus: - enabled: true - alertingrules: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-1.19-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-1.19-test.yaml deleted file mode 100644 index 17aa4b9..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-1.19-test.yaml +++ /dev/null @@ -1,148 +0,0 @@ -suite: Controller Primary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 19 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: other values - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - annotations: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - paths: - - backend: - service: - name: ssl-redirect - port: - number: use-annotation - pathType: ImplementationSpecific - - backend: - service: - name: >- - {{ template "jenkins.fullname" . }} - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - equal: - path: metadata.annotations - value: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: ssl-redirect - port: - number: use-annotation - pathType: ImplementationSpecific - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: empty paths - set: - controller.ingress: - enabled: true - paths: - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-DRY-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-DRY-test.yaml deleted file mode 100644 index ce7285d..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-DRY-test.yaml +++ /dev/null @@ -1,26 +0,0 @@ -suite: Controller Ingress - DRY Support -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml - - jcasc-config.yaml -tests: - - it: controller-ingress - template: jenkins-controller-ingress.yaml - set: - global.jenkinsHostname: "jenkins.example.com" - controller.ingress: - enabled: true - hostName: "{{ .Values.global.jenkinsHostname }}" - resourceRootUrl: "{{ .Values.global.jenkinsHostname }}" - tls: - - hosts: - - "{{ .Values.global.jenkinsHostname }}" - asserts: - - equal: - path: spec.rules[0].host - value: "jenkins.example.com" - - equal: - path: spec.tls[0].hosts[0] - value: "jenkins.example.com" diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-test.yaml deleted file mode 100644 index d5c9032..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-test.yaml +++ /dev/null @@ -1,145 +0,0 @@ -suite: Controller Primary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: other values - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - annotations: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - paths: - - backend: - serviceName: ssl-redirect - servicePort: use-annotation - - backend: - serviceName: >- - {{ template "jenkins.fullname" . }} - servicePort: 8080 - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - equal: - path: metadata.annotations - value: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: ssl-redirect - servicePort: use-annotation - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: empty paths - set: - controller.ingress: - enabled: true - paths: - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - - it: single path - set: - controller.ingress: - enabled: true - path: /jenkins/ - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - path: /jenkins/ - backend: - serviceName: my-release-jenkins - servicePort: 8080 diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-networkpolicy-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-networkpolicy-test.yaml deleted file mode 100644 index 5c95733..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-networkpolicy-test.yaml +++ /dev/null @@ -1,94 +0,0 @@ -suite: Network Policy -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-networkpolicy.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - networkPolicy.enabled: true - asserts: - - hasDocuments: - count: 2 - - isKind: - of: NetworkPolicy - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: metadata.name - value: my-release-jenkins-controller - documentIndex: 0 - - equal: - path: spec - value: - ingress: - - ports: - - port: 8080 - - from: - - podSelector: - matchLabels: - jenkins/my-release-jenkins-agent: "true" - ports: - - port: 50000 - podSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - documentIndex: 0 - - equal: - path: spec - value: - podSelector: - matchLabels: - jenkins/my-release-jenkins-agent: "true" - documentIndex: 1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - documentIndex: 1 - - it: disable helm.sh label - set: - renderHelmLabels: false - networkPolicy.enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agent listener - set: - networkPolicy.enabled: true - controller.agentListenerEnabled: false - asserts: - - hasDocuments: - count: 2 - - isKind: - of: NetworkPolicy - - equal: - path: spec - value: - ingress: - - ports: - - port: 8080 - podSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - documentIndex: 0 diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-1.21-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-1.21-test.yaml deleted file mode 100644 index 116d846..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-1.21-test.yaml +++ /dev/null @@ -1,44 +0,0 @@ -suite: Controller Pod Disruption Budget -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-pdb.yaml -capabilities: - majorVersion: 1 - minorVersion: 21 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.podDisruptionBudget: - enabled: true - maxUnavailable: "0" - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: apiVersion - value: policy/v1 - - equal: - path: metadata.name - value: my-release-jenkins-pdb - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - maxUnavailable: 0 - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/name": "jenkins" diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-test.yaml deleted file mode 100644 index 4f77227..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-test.yaml +++ /dev/null @@ -1,57 +0,0 @@ -suite: Controller Pod Disruption Budget -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-pdb.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.podDisruptionBudget: - enabled: true - maxUnavailable: "0" - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: apiVersion - value: policy/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins-pdb - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - maxUnavailable: 0 - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/name": "jenkins" - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.podDisruptionBudget: - enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml deleted file mode 100644 index e293c1b..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml +++ /dev/null @@ -1,78 +0,0 @@ -suite: Controller Secondary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-secondary-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 19 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-secondary - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - path: /github-webhook - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - paths: - - /github-webhook - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-test.yaml deleted file mode 100644 index 8ac7e9e..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-test.yaml +++ /dev/null @@ -1,76 +0,0 @@ -suite: Controller Secondary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-secondary-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - "controller.secondaryingress": - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins-secondary - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - path: /github-webhook - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-servicemonitor_test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-servicemonitor_test.yaml deleted file mode 100644 index a577c96..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-servicemonitor_test.yaml +++ /dev/null @@ -1,114 +0,0 @@ -suite: Controller Prometheus ServiceMonitor -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-servicemonitor.yaml -tests: - - it: defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.prometheus.enabled: true - asserts: - - isKind: - of: ServiceMonitor - - equal: - path: apiVersion - value: monitoring.coreos.com/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - equal: - path: spec - value: - endpoints: - - interval: 60s - port: http - path: /prometheus - jobLabel: my-release-jenkins - namespaceSelector: - matchNames: - - "my-namespace" - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/component": "jenkins-controller" - - it: custom values - set: - controller: - jenkinsUriPrefix: /prefix - prometheus: - enabled: true - scrapeInterval: 120s - scrapeEndpoint: /monitoring - asserts: - - equal: - path: spec - value: - endpoints: - - interval: 120s - port: http - path: /prefix/monitoring - jobLabel: my-release-jenkins - namespaceSelector: - matchNames: - - "my-namespace" - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/component": "jenkins-controller" - - it: disable helm.sh label - set: - renderHelmLabels: false - controller: - prometheus: - enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: set relabling - set: - controller: - prometheus: - enabled: true - relabelings: - - sourceLabels: [metric] - regex: "(.*)" - action: drop - asserts: - - equal: - path: spec.endpoints[0].relabelings - value: - - sourceLabels: [metric] - regex: "(.*)" - action: drop - - it: set metricRelabelings - set: - controller: - prometheus: - enabled: true - metricRelabelings: - - sourceLabels: [__name__] - regex: "kubernetes_cloud_(.*)_provision_request_total" - action: drop - asserts: - - equal: - path: spec.endpoints[0].metricRelabelings - value: - - sourceLabels: [__name__] - regex: "kubernetes_cloud_(.*)_provision_request_total" - action: drop diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-statefulset-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-statefulset-test.yaml deleted file mode 100644 index 266b915..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-statefulset-test.yaml +++ /dev/null @@ -1,828 +0,0 @@ -suite: Jenkins Controller -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-statefulset.yaml - - config.yaml - - config-init-scripts.yaml - - auto-reload-config.yaml -tests: - - it: default values - template: jenkins-controller-statefulset.yaml - asserts: - - isKind: - of: StatefulSet - - equal: - path: apiVersion - value: apps/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec.replicas - value: 1 - - equal: - path: spec.selector - value: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - - matchSnapshot: - path: spec - - it: test different values - template: jenkins-controller-statefulset.yaml - capabilities: - apiVersions: - - scheduling.k8s.io/v1beta1 - set: - controller: - statefulSetAnnotations: - my-annotation: value - schedulerName: my-scheduler - nodeSelector: - nodeLabel: value - tolerations: - - key: "key" - operator: "Equal" - value: "value" - effect: "NoSchedule" - affinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: security - operator: In - values: - - S1 - topologyKey: failure-domain.beta.kubernetes.io/zone - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: "topology.kubernetes.io/zone" - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - terminationGracePeriodSeconds: 120 - priorityClassName: important - runAsUser: 2000 - fsGroup: 4000 - securityContextCapabilities: - drop: - - NET_RAW - hostNetworking: true - terminationMessagePath: /tmp/termination-log-diff - terminationMessagePolicy: FallbackToLogsOnError - hostAliases: - - ip: 192.168.50.50 - hostnames: - - something.local - updateStrategy: - type: OnDelete - serviceAccount.name: my-serviceaccount - asserts: - - equal: - path: metadata.annotations - value: - my-annotation: value - - equal: - path: spec.template.spec.schedulerName - value: my-scheduler - - equal: - path: spec.template.spec.nodeSelector - value: - nodeLabel: value - - equal: - path: spec.template.spec.tolerations - value: - - key: "key" - operator: "Equal" - value: "value" - effect: "NoSchedule" - - equal: - path: spec.template.spec.affinity - value: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: security - operator: In - values: - - S1 - topologyKey: failure-domain.beta.kubernetes.io/zone - - equal: - path: spec.template.spec.topologySpreadConstraints - value: - - maxSkew: 1 - topologyKey: "topology.kubernetes.io/zone" - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - - equal: - path: spec.template.spec.terminationGracePeriodSeconds - value: 120 - - equal: - path: spec.template.spec.priorityClassName - value: important - - equal: - path: spec.template.spec.securityContext - value: - runAsUser: 2000 - fsGroup: 4000 - runAsNonRoot: true - capabilities: - drop: - - NET_RAW - - equal: - path: spec.template.spec.serviceAccountName - value: my-serviceaccount - - equal: - path: spec.template.spec.hostNetwork - value: true - - equal: - path: spec.template.spec.containers[0].terminationMessagePath - value: /tmp/termination-log-diff - - equal: - path: spec.template.spec.containers[0].terminationMessagePolicy - value: FallbackToLogsOnError - - equal: - path: spec.template.spec.dnsPolicy - value: ClusterFirstWithHostNet - - equal: - path: spec.template.spec.hostAliases - value: - - ip: 192.168.50.50 - hostnames: - - something.local - - equal: - path: spec.updateStrategy.type - value: OnDelete - - it: configure image tag - template: jenkins-controller-statefulset.yaml - set: - controller.image.tag: slim - controller.image.pullPolicy: IfNotPresent - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: docker.io/jenkins/jenkins:slim - - equal: - path: spec.template.spec.containers[0].imagePullPolicy - value: IfNotPresent - - it: configure image tag label - template: jenkins-controller-statefulset.yaml - set: - controller.image.tagLabel: alpine - asserts: - - matchSnapshot: - path: spec.template.spec.containers[0].image - - it: configure empty image tag label - template: jenkins-controller-statefulset.yaml - set: - controller.image.tagLabel: - asserts: - - matchSnapshot: - path: spec.template.spec.containers[0].image - - it: custom image - template: jenkins-controller-statefulset.yaml - set: - controller: - image: - repository: registry/image - tag: my-tag - javaOpts: -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: docker.io/registry/image:my-tag - - contains: - path: spec.template.spec.containers[0].env - content: - name: JAVA_OPTS - value: >- - -Dcasc.reload.token=$(POD_NAME) -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true - - it: disable helm.sh label - template: jenkins-controller-statefulset.yaml - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: java & jenkins opts with quotes - template: jenkins-controller-statefulset.yaml - set: - controller: - javaOpts: >- - -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';" - jenkinsOpts: >- - -Dtest="custom: 'true'" - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: JAVA_OPTS - value: >- - -Dcasc.reload.token=$(POD_NAME) -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';" - - contains: - path: spec.template.spec.containers[0].env - content: - name: JENKINS_OPTS - value: >- - --webroot=/var/jenkins_cache/war -Dtest="custom: 'true'" - - it: test empty controller.podSecurityContextOverride - template: jenkins-controller-statefulset.yaml - set: - controller: - podSecurityContextOverride: {} - asserts: - - equal: - path: spec.template.spec.securityContext - value: {} - - it: test controller.podSecurityContextOverride - template: jenkins-controller-statefulset.yaml - set: - controller: - podSecurityContextOverride: &expected - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: [5555] - asserts: - - equal: - path: spec.template.spec.securityContext - value: *expected - - it: test controller.sidecars.additionalSidecarContainers - template: jenkins-controller-statefulset.yaml - set: - controller: - sidecars: - additionalSidecarContainers: - - name: otel-collector - image: opentelemetry-collector:0.93.0 - imagePullPolicy: IfNotPresent - resources: - limits: - cpu: 200m - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - asserts: - - equal: - path: spec.template.spec.containers[2] - value: - name: otel-collector - image: opentelemetry-collector:0.93.0 - imagePullPolicy: IfNotPresent - resources: - limits: - cpu: 200m - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - - it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 1) - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.enabled: true - controller.sidecars.configAutoReload.logging.configuration.override: true - asserts: - - equal: - path: spec.template.spec.volumes[0] - value: - name: auto-reload-config - configMap: - name: my-release-jenkins-auto-reload-config - - equal: - path: spec.template.spec.initContainers[0].env[5] - value: - name: LOG_CONFIG - value: /var/jenkins_home/auto-reload/auto-reload-config.yaml - - equal: - path: spec.template.spec.containers[1].env[7] - value: - name: LOG_CONFIG - value: /var/jenkins_home/auto-reload/auto-reload-config.yaml - - it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 2) - template: auto-reload-config.yaml - set: - controller.sidecars.configAutoReload.enabled: true - controller.sidecars.configAutoReload.logging.configuration.override: true - asserts: - - isKind: - of: ConfigMap - - it: test 2 additional secrets - template: jenkins-controller-statefulset.yaml - set: - controller.additionalSecrets: - - name: something - value: secret - - name: anotherthing - value: anothersecret - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins-additional-secrets - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - it: test existing secret without additionalExistingSecrets - template: jenkins-controller-statefulset.yaml - set: - controller.existingSecret: my-exisiting-credentials - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-exisiting-credentials - - it: test existing secret with additionalExistingSecrets - template: jenkins-controller-statefulset.yaml - set: - controller.existingSecret: my-exisiting-credentials - controller.additionalExistingSecrets: - - name: my-exisiting-credentials - keyName: github-username - - name: my-exisiting-credentials - keyName: github-password - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - items: - - key: github-username - path: my-exisiting-credentials-github-username - name: my-exisiting-credentials - - secret: - items: - - key: github-password - path: my-exisiting-credentials-github-password - name: my-exisiting-credentials - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-exisiting-credentials - - it: test templated environment variables - template: jenkins-controller-statefulset.yaml - set: - testValue: some-value - controller.initContainerEnv: - - name: "TEST_ENV_VAR_INIT" - value: "test-env-var-init" - - name: "TEST_ENV_VAR_INIT_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.sidecars.configAutoReload.env: - - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.containerEnv: - - name: "TEST_ENV_VAR_CONTAINER" - value: "test-env-var-container" - - name: "TEST_ENV_VAR__CONTAINER_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.initContainerEnvFrom: - - configMapRef: - name: special-config - controller.sidecars.configAutoReload.envFrom: - - configMapRef: - name: special-config-auto-reload - controller.containerEnvFrom: - - configMapRef: - name: special-config - asserts: - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.initContainers[1].env - content: - name: "TEST_ENV_VAR_INIT" - value: "test-env-var-init" - - contains: - path: spec.template.spec.initContainers[1].env - content: - name: "TEST_ENV_VAR_INIT_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.containers[0].env - content: - name: "TEST_ENV_VAR_CONTAINER" - value: "test-env-var-container" - - contains: - path: spec.template.spec.containers[0].env - content: - name: "TEST_ENV_VAR__CONTAINER_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.initContainers[0].envFrom - content: - configMapRef: - name: special-config-auto-reload - - contains: - path: spec.template.spec.initContainers[1].envFrom - content: - configMapRef: - name: special-config - - contains: - path: spec.template.spec.containers[0].envFrom - content: - configMapRef: - name: special-config - - contains: - path: spec.template.spec.containers[1].envFrom - content: - configMapRef: - name: special-config-auto-reload - - it: test sleep time for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.sleepTime: 60 - asserts: - - contains: - # METHOD remains LIST on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "LIST" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "METHOD" - value: "SLEEP" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "SLEEP_TIME" - value: "60" - - it: test METHOD env var for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.env: - - name: "METHOD" - value: "SLEEP" - asserts: - - contains: - # METHOD remains LIST on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "LIST" - - notContains: - # only one METHOD on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "SLEEP" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "METHOD" - value: "SLEEP" - - it: test scheme for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.scheme: "https" - asserts: - - matchSnapshot: - path: spec - - it: test skip tls verify for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.skipTlsVerify: true - asserts: - - contains: - path: spec.template.spec.containers[1].env - content: - name: "REQ_SKIP_TLS_VERIFY" - value: "true" - - it: overrides container args - template: jenkins-controller-statefulset.yaml - set: - controller.overrideArgs: - - --httpPort=8080 - - --requestHeaderSize=32768 - asserts: - - equal: - path: spec.template.spec.containers[0].args - value: - - --httpPort=8080 - - --requestHeaderSize=32768 - - it: allows templating in container args overrides - template: jenkins-controller-statefulset.yaml - set: - controller.overrideArgs: - - --httpPort={{.Values.controller.targetPort}} - - --requestHeaderSize=32768 - asserts: - - equal: - path: spec.template.spec.containers[0].args - value: - - --httpPort=8080 - - --requestHeaderSize=32768 - - it: render pod annotations - template: jenkins-controller-statefulset.yaml - set: - controller: - podAnnotations: - templated-annotations: "{{ .Release.Name }}" - fixed-annotation: some-fixed-annotation - asserts: - - matchSnapshot: - path: spec.template.metadata.annotations - - it: test true shareProcessNamespace - template: jenkins-controller-statefulset.yaml - set: - controller: - shareProcessNamespace: true - asserts: - - equal: - path: spec.template.spec.shareProcessNamespace - value: true - - it: test false shareProcessNamespace - template: jenkins-controller-statefulset.yaml - set: - controller: - shareProcessNamespace: false - asserts: - - isNull: - path: spec.template.spec.shareProcessNamespace - - it: test false enableServiceLinks - template: jenkins-controller-statefulset.yaml - set: - controller: - enableServiceLinks: false - asserts: - - equal: - path: spec.template.spec.enableServiceLinks - value: false - - it: test true enableServiceLinks - template: jenkins-controller-statefulset.yaml - set: - controller: - enableServiceLinks: true - asserts: - - isNull: - path: spec.template.spec.enableServiceLinks - - it: test disableSecretMount - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: true - password: some-secret-password - path: /some/path - jenkinsHttpsJksSecretName: some-secret-name - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - value: some-secret-password - - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - notContains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - notContains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: jenkins-jks-file - path: some-file-name - - - it: test not disableSecretMount - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - valueFrom: - secretKeyRef: - name: some-secret-name - key: "https-jks-password" - - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - contains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - contains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: jenkins-jks-file - path: some-file-name - - it: test override with jenkinsHttpsJksPasswordSecretName and jenkinsHttpsJksPasswordSecretKey - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksPasswordSecretName: "some-jks-name" - jenkinsHttpsJksPasswordSecretKey: "some-jks-password" - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - valueFrom: - secretKeyRef: - name: "some-jks-name" - key: "some-jks-password" - - it: test jenkinsHttpsJksSecretKey override - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - jenkinsHttpsJksSecretKey: "some.jks" - asserts: - - contains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: "some.jks" - path: some-file-name - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - installPlugins: false - asserts: - - notContains: - path: spec.template.spec.volumes - content: - name: plugins - emptyDir: {} - - notContains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - name: plugins - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: - - https://acme.org/jenkins.yaml - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml" - - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: - - https://acme.org/jenkins.yaml - - https://foobar.org/jenkins.yaml - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml,https://foobar.org/jenkins.yaml" - - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: [] - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs" - - - it: test checksum for config-init-script - template: jenkins-controller-statefulset.yaml - set: - controller: - initScripts: - test: |- - This is a test script - asserts: - - isSubset: - path: spec.template.metadata.annotations - content: - checksum/config-init-scripts: 2ee2c03a600a50a55cf62cbed3f1d558d5322eda7544b4047beeb4df66e8ec11 diff --git a/helm-templates/jenkins-grn/unittests/jenkins-controller-svc-test.yaml b/helm-templates/jenkins-grn/unittests/jenkins-controller-svc-test.yaml deleted file mode 100644 index 2913e15..0000000 --- a/helm-templates/jenkins-grn/unittests/jenkins-controller-svc-test.yaml +++ /dev/null @@ -1,166 +0,0 @@ -suite: Jenkins Controller -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-svc.yaml -tests: - - it: default tests - asserts: - - isKind: - of: Service - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: other values - set: - controller: - serviceLabels: - label: label-value - serviceAnnotations: - key: value - clusterIP: 10.10.10.11 - servicePort: 8888 - targetPort: 7777 - extraPorts: - - name: BuildInfoProxy - port: 9000 - asserts: - - equal: - path: metadata.labels.label - value: label-value - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - clusterIP: 10.10.10.11 - ports: - - name: http - port: 8888 - targetPort: 7777 - - name: BuildInfoProxy - port: 9000 - targetPort: 9000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: extraPort with targetPort - set: - controller: - serviceLabels: - label: label-value - serviceAnnotations: - key: value - clusterIP: 10.10.10.11 - servicePort: 8888 - targetPort: 7777 - extraPorts: - - name: https - port: 443 - targetPort: 8080 - asserts: - - equal: - path: metadata.labels.label - value: label-value - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - clusterIP: 10.10.10.11 - ports: - - name: http - port: 8888 - targetPort: 7777 - - name: https - port: 443 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: node port - set: - controller: - serviceType: NodePort - nodePort: 11111 - asserts: - - equal: - path: spec - value: - ports: - - name: http - port: 8080 - targetPort: 8080 - nodePort: 11111 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: load balancer - set: - controller: - serviceType: LoadBalancer - loadBalancerIP: 10.10.10.10 - asserts: - - equal: - path: spec - value: - loadBalancerIP: 10.10.10.10 - loadBalancerSourceRanges: - - 0.0.0.0/0 - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: LoadBalancer - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: publish not-ready addresses - set: - controller: - publishNotReadyAddresses: true - asserts: - - equal: - path: spec.publishNotReadyAddresses - value: true diff --git a/helm-templates/jenkins-grn/unittests/rbac-test.yaml b/helm-templates/jenkins-grn/unittests/rbac-test.yaml deleted file mode 100644 index 6c954a1..0000000 --- a/helm-templates/jenkins-grn/unittests/rbac-test.yaml +++ /dev/null @@ -1,276 +0,0 @@ -suite: Role Based Access Control -release: - name: my-release - namespace: my-namespace -templates: - - rbac.yaml -tests: - - it: test default number of documents - asserts: - - hasDocuments: - count: 4 - - it: disable auto reload - set: - controller.sidecars.configAutoReload.enabled: false - asserts: - - hasDocuments: - count: 2 - - - it: disable rbac create - set: - rbac.create: false - asserts: - - hasDocuments: - count: 0 - - - it: Role schedule-agents - documentIndex: 0 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-schedule-agents - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: - [ - "pods", - "pods/exec", - "pods/log", - "persistentvolumeclaims", - "events", - ] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["pods", "pods/exec", "persistentvolumeclaims"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] - - - it: RoleBinding schedule-agents - documentIndex: 1 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-schedule-agents - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-schedule-agents - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - - - it: Separate Agent Namespace - set: - agent.namespace: agent-namespace - asserts: - - equal: - path: metadata.namespace - value: agent-namespace - documentIndex: 0 - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - documentIndex: 1 - - - it: Role casc-reload - documentIndex: 2 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-casc-reload - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "watch", "list"] - - - it: RoleBinding casc-reload - documentIndex: 3 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-watch-configmaps - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-casc-reload - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - - - it: enable read secrets - set: - rbac.readSecrets: true - asserts: - - hasDocuments: - count: 6 - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - - it: disable helm.sh label - set: - renderHelmLabels: false - rbac.readSecrets: true - asserts: - - hasDocuments: - count: 6 - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: Role read-secrets - set: - rbac.readSecrets: true - documentIndex: 2 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-read-secrets - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "watch", "list"] - - - it: RoleBinding read-secrets - set: - rbac.readSecrets: true - documentIndex: 3 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-read-secrets - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-read-secrets - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - - - it: Role use-nonroot-scc - set: - rbac.useOpenShiftNonRootSCC: true - documentIndex: 2 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-use-nonroot-scc - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: ["security.openshift.io"] - resources: ["securitycontextconstraints"] - resourceNames: ["nonroot", "nonroot-v2"] - verbs: ["use"] - - - it: RoleBinding use-nonroot-scc - set: - rbac.useOpenShiftNonRootSCC: true - documentIndex: 3 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-use-nonroot-scc - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-use-nonroot-scc - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace diff --git a/helm-templates/jenkins-grn/unittests/secret-additional-test.yaml b/helm-templates/jenkins-grn/unittests/secret-additional-test.yaml deleted file mode 100644 index 1fc23c3..0000000 --- a/helm-templates/jenkins-grn/unittests/secret-additional-test.yaml +++ /dev/null @@ -1,41 +0,0 @@ -suite: Controller Admin Additional Secrets -release: - name: my-release - namespace: my-namespace -templates: - - secret-additional.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: tests 2 additional secrets - set: - controller.additionalSecrets: - - name: something - value: secret - - name: anotherthing - value: anothersecret - asserts: - - isKind: - of: Secret - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-additional-secrets - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: data.something - value: c2VjcmV0 - - equal: - path: data.anotherthing - value: YW5vdGhlcnNlY3JldA== diff --git a/helm-templates/jenkins-grn/unittests/secret-claims-test.yaml b/helm-templates/jenkins-grn/unittests/secret-claims-test.yaml deleted file mode 100644 index ab4301c..0000000 --- a/helm-templates/jenkins-grn/unittests/secret-claims-test.yaml +++ /dev/null @@ -1,82 +0,0 @@ -suite: Controller Secret Claims -release: - name: my-release - namespace: my-namespace -templates: - - secret-claims.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: tests 2 secret claims - set: - controller.secretClaims: - - name: simple-secret - path: secret/path - - name: complex-secret - path: secret/complex - type: kubernetes.io/tls - renew: 60 - asserts: - - hasDocuments: - count: 2 - - documentIndex: 0 - isKind: - of: SecretClaim - - documentIndex: 0 - equal: - path: apiVersion - value: vaultproject.io/v1 - - documentIndex: 0 - equal: - path: metadata.name - value: my-release-jenkins-simple-secret - - documentIndex: 0 - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - documentIndex: 0 - isNull: - path: metadata.annotations - - documentIndex: 0 - equal: - path: spec.type - value: Opaque - - documentIndex: 0 - equal: - path: spec.path - value: secret/path - - documentIndex: 0 - isNull: - path: spec.renew - - documentIndex: 1 - isKind: - of: SecretClaim - - documentIndex: 1 - equal: - path: apiVersion - value: vaultproject.io/v1 - - documentIndex: 1 - equal: - path: metadata.name - value: my-release-jenkins-complex-secret - - documentIndex: 1 - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - documentIndex: 1 - isNull: - path: metadata.annotations - - documentIndex: 1 - equal: - path: spec.type - value: kubernetes.io/tls - - documentIndex: 1 - equal: - path: spec.path - value: secret/complex - - documentIndex: 1 - equal: - path: spec.renew - value: 60 diff --git a/helm-templates/jenkins-grn/unittests/secret-existing-test.yaml b/helm-templates/jenkins-grn/unittests/secret-existing-test.yaml deleted file mode 100644 index 1c56a6e..0000000 --- a/helm-templates/jenkins-grn/unittests/secret-existing-test.yaml +++ /dev/null @@ -1,52 +0,0 @@ -suite: Controller Additional Existing Secrets -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-statefulset.yaml - - config.yaml -tests: - - it: test additional existing secrets StatefulSet - template: jenkins-controller-statefulset.yaml - set: - controller.additionalExistingSecrets: - - name: "{{ .Release.Name }}-secret" - keyName: username - - name: "{{ .Release.Name }}-secret" - keyName: password - controller.existingSecret: my-existing-credentials - - asserts: - - isKind: - of: StatefulSet - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-secret - items: - - key: username - path: my-release-secret-username - - secret: - name: my-release-secret - items: - - key: password - path: my-release-secret-password - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-existing-credentials diff --git a/helm-templates/jenkins-grn/unittests/secret-test.yaml b/helm-templates/jenkins-grn/unittests/secret-test.yaml deleted file mode 100644 index ce0a2d2..0000000 --- a/helm-templates/jenkins-grn/unittests/secret-test.yaml +++ /dev/null @@ -1,63 +0,0 @@ -suite: Controller Admin Credentials -release: - name: my-release - namespace: my-namespace -templates: - - secret.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: Secret - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: data.jenkins-admin-user - value: YWRtaW4= - - isNotNull: - path: data.jenkins-admin-password - - it: set admin password - set: - controller.admin.password: secret - asserts: - - equal: - path: data.jenkins-admin-user - value: YWRtaW4= - - equal: - path: data.jenkins-admin-password - value: c2VjcmV0 - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable - set: - controller.admin.createSecret: false - asserts: - - hasDocuments: - count: 0 - - it: disable - set: - controller.admin.existingSecret: my-secret - asserts: - - hasDocuments: - count: 0 diff --git a/helm-templates/jenkins-grn/unittests/service-account-agent-test.yaml b/helm-templates/jenkins-grn/unittests/service-account-agent-test.yaml deleted file mode 100644 index d147df5..0000000 --- a/helm-templates/jenkins-grn/unittests/service-account-agent-test.yaml +++ /dev/null @@ -1,103 +0,0 @@ -suite: Controller Service Account -release: - name: my-release - namespace: my-namespace -templates: - - service-account-agent.yaml -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: create service account for agents - set: - serviceAccountAgent: - create: true - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - it: agent namespace - set: - serviceAccountAgent: - create: true - annotations: - key: value - agent: - namespace: agents - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: agents - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - equal: - path: metadata.annotations - value: - key: value - - it: disable helm.sh label - set: - renderHelmLabels: false - serviceAccountAgent: - create: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: agent image pull secret - set: - renderHelmLabels: false - serviceAccountAgent: - create: true - imagePullSecretName: ips-name - asserts: - - equal: - path: imagePullSecrets - value: - - name: ips-name - - it: agent service account attach labels - set: - serviceAccountAgent: - create: true - extraLabels: - "this.is.a.test.label": "with a value" - "this.is.another.test.label": "with a different value" - asserts: - - equal: - path: metadata.labels["app.kubernetes.io/name"] - value: "jenkins" - - equal: - path: metadata.labels["app.kubernetes.io/managed-by"] - value: "Helm" - - equal: - path: metadata.labels["this.is.a.test.label"] - value: "with a value" - - equal: - path: metadata.labels["this.is.another.test.label"] - value: "with a different value" diff --git a/helm-templates/jenkins-grn/unittests/service-account-test.yaml b/helm-templates/jenkins-grn/unittests/service-account-test.yaml deleted file mode 100644 index de5a53c..0000000 --- a/helm-templates/jenkins-grn/unittests/service-account-test.yaml +++ /dev/null @@ -1,77 +0,0 @@ -suite: Controller Service Account -release: - name: my-release - namespace: my-namespace -templates: - - service-account.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels["helm.sh/chart"] - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: disabled - set: - serviceAccount: - create: false - asserts: - - hasDocuments: - count: 0 - - - it: controller image pull secret - set: - renderHelmLabels: false - serviceAccount: - create: true - imagePullSecretName: ips-name - asserts: - - equal: - path: imagePullSecrets - value: - - name: ips-name - - - it: service account attach labels - set: - serviceAccount: - extraLabels: - "this.is.a.test.label": "with a value" - "this.is.another.test.label": "with a different value" - asserts: - - equal: - path: metadata.labels["app.kubernetes.io/name"] - value: "jenkins" - - equal: - path: metadata.labels["app.kubernetes.io/managed-by"] - value: "Helm" - - equal: - path: metadata.labels["this.is.a.test.label"] - value: "with a value" - - equal: - path: metadata.labels["this.is.another.test.label"] - value: "with a different value" diff --git a/helm-templates/jenkins-grn/values.yaml b/helm-templates/jenkins-grn/values.yaml deleted file mode 100644 index ed4f783..0000000 --- a/helm-templates/jenkins-grn/values.yaml +++ /dev/null @@ -1,1382 +0,0 @@ -# Default values for jenkins. -# This is a YAML-formatted file. -# Declare name/value pairs to be passed into your templates. -# name: value - -## Overrides for generated resource names -# See templates/_helpers.tpl -# -- Override the resource name prefix -# @default -- `Chart.Name` -nameOverride: -# -- Override the full resource names -# @default -- `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins` -fullnameOverride: -# -- Override the deployment namespace -# @default -- `Release.Namespace` -namespaceOverride: - -# For FQDN resolving of the controller service. Change this value to match your existing configuration. -# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md -# -- Override the cluster name for FQDN resolving -clusterZone: "cluster.local" - -# -- The URL of the Kubernetes API server -kubernetesURL: "https://kubernetes.default" - -# -- The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed. -credentialsId: - -# -- Enables rendering of the helm.sh/chart label to the annotations -renderHelmLabels: true - -controller: - # -- Used for label app.kubernetes.io/component - componentName: "jenkins-controller" - image: - # -- Controller image registry - registry: "docker.io" - # -- Controller image repository - repository: "jenkins/jenkins" - - # -- Controller image tag override; i.e., tag: "2.440.1-jdk21" - tag: - - # -- Controller image tag label - tagLabel: jdk21 - # -- Controller image pull policy - pullPolicy: "Always" - # -- Controller image pull secret - imagePullSecretName: - # -- Lifecycle specification for controller-container - lifecycle: {} - # postStart: - # exec: - # command: - # - "uname" - # - "-a" - - # -- Disable use of remember me - disableRememberMe: false - - # -- Set Number of executors - numExecutors: 0 - - # -- Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE" - executorMode: "NORMAL" - - # -- Append Jenkins labels to the controller - customJenkinsLabels: [] - - hostNetworking: false - - # When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist. - # If you disable the non-Jenkins identity store and instead use the Jenkins internal one, - # you should revert controller.admin.username to your preferred admin user: - admin: - # -- Admin username created as a secret if `controller.admin.createSecret` is true - username: "admin" - # -- Admin password created as a secret if `controller.admin.createSecret` is true - # @default -- - password: - - # -- The key in the existing admin secret containing the username - userKey: jenkins-admin-user - # -- The key in the existing admin secret containing the password - passwordKey: jenkins-admin-password - - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm, then you can disable it - # -- Create secret for admin user - createSecret: true - - # -- The name of an existing secret containing the admin credentials - existingSecret: "" - # -- Email address for the administrator of the Jenkins instance - jenkinsAdminEmail: - - # This value should not be changed unless you use your custom image of jenkins or any derived from. - # If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" - # -- Custom Jenkins home path - jenkinsHome: "/var/jenkins_home" - - # This value should not be changed unless you use your custom image of jenkins or any derived from. - # If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" - # -- Custom Jenkins reference path - jenkinsRef: "/usr/share/jenkins/ref" - - # Path to the jenkins war file which is used by jenkins-plugin-cli. - jenkinsWar: "/usr/share/jenkins/jenkins.war" - # Override the default arguments passed to the war - # overrideArgs: - # - --httpPort=8080 - - # -- Resource allocation (Requests and Limits) - resources: - requests: - cpu: "50m" - memory: "256Mi" - limits: - cpu: "2000m" - memory: "4096Mi" - - # Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod - shareProcessNamespace: false - - # Service links might cause issue if running in a namespace with a large amount of services - # that might cause a slow startup when plugins are copied from ref to volume - # Set to true to keep previous behavior - # See https://github.com/kubernetes/kubernetes/issues/121787 - enableServiceLinks: false - - # Overrides the init container default values - # -- Resources allocation (Requests and Limits) for Init Container - initContainerResources: {} - # initContainerResources: - # requests: - # cpu: "50m" - # memory: "256Mi" - # limits: - # cpu: "2000m" - # memory: "4096Mi" - # -- Environment variable sources for Init Container - initContainerEnvFrom: [] - - # useful for i.e., http_proxy - # -- Environment variables for Init Container - initContainerEnv: [] - # initContainerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - - # -- Environment variable sources for Jenkins Container - containerEnvFrom: [] - - # -- Environment variables for Jenkins Container - containerEnv: [] - # - name: http_proxy - # value: "http://192.168.64.1:3128" - - # Set min/max heap here if needed with "-Xms512m -Xmx512m" - # -- Append to `JAVA_OPTS` env var - javaOpts: - # -- Append to `JENKINS_OPTS` env var - jenkinsOpts: - - # If you are using the ingress definitions provided by this chart via the `controller.ingress` block, - # the configured hostname will be the ingress hostname starting with `https://` - # or `http://` depending on the `tls` configuration. - # The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - # -- Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise - jenkinsUrlProtocol: - - # -- Set Jenkins URL if you are not using the ingress definitions provided by the chart - jenkinsUrl: - - # If you set this prefix and use ingress controller, then you might want to set the ingress path below - # I.e., "/jenkins" - # -- Root URI Jenkins will be served on - jenkinsUriPrefix: - - # -- Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) - usePodSecurityContext: true - - # Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are - # being deprecated and replaced by `podSecurityContextOverride`. - # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins', which exists in 'jenkins/jenkins' docker image. - # When configuring runAsUser to a different value than 0 also set fsGroup to the same value: - # -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. - runAsUser: 1000 - - # -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. - fsGroup: 1000 - - # If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here - # securityContextCapabilities: - # drop: - # - NET_RAW - securityContextCapabilities: {} - - # In the case of mounting an ext4 filesystem, it might be desirable to use `supplementalGroups` instead of `fsGroup` in - # the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496 - # podSecurityContextOverride: - # runAsUser: 1000 - # runAsNonRoot: true - # supplementalGroups: [1000] - # capabilities: {} - # -- Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities` - podSecurityContextOverride: ~ - - # -- Allow controlling the securityContext for the jenkins container - containerSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - - # -- enable or disable the controller k8s service - serviceEnabled: true - - # For minikube, set this to NodePort, elsewhere uses LoadBalancer - # Use ClusterIP if your setup includes ingress controller - # -- k8s service type - serviceType: ClusterIP - - # -- k8s service clusterIP. Only used if serviceType is ClusterIP - clusterIp: - # -- k8s service port - servicePort: 8080 - # -- k8s target port - targetPort: 8080 - # -- k8s node port. Only used if serviceType is NodePort - nodePort: - - # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and NodePort type services, - # but risks potentially imbalanced traffic spreading. - serviceExternalTrafficPolicy: - - # If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and - # auto-reload on restart feature possible. - publishNotReadyAddresses: - - # -- Jenkins controller service annotations - serviceAnnotations: {} - # -- Jenkins controller custom labels for the StatefulSet - statefulSetLabels: {} - # foo: bar - # bar: foo - # -- Labels for the Jenkins controller-service - serviceLabels: {} - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https - - # Put labels on Jenkins controller pod - # -- Custom Pod labels (an object with `label-key: label-value` pairs) - podLabels: {} - - # Enable Kubernetes Startup, Liveness and Readiness Probes - # if Startup Probe is supported, enable it too - # ~ 2 minutes to allow Jenkins to restart when upgrading plugins. Set ReadinessTimeout to be shorter than LivenessTimeout. - # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes - # -- Enable Kubernetes Probes configuration configured in `controller.probes` - healthProbes: true - - probes: - startupProbe: - # -- Set the failure threshold for the startup probe - failureThreshold: 12 - httpGet: - # -- Set the Pod's HTTP path for the startup probe - path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' - # -- Set the Pod's HTTP port to use for the startup probe - port: http - # -- Set the time interval between two startup probes executions in seconds - periodSeconds: 10 - # -- Set the timeout for the startup probe in seconds - timeoutSeconds: 5 - - livenessProbe: - # -- Set the failure threshold for the liveness probe - failureThreshold: 5 - httpGet: - # -- Set the Pod's HTTP path for the liveness probe - path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' - # -- Set the Pod's HTTP port to use for the liveness probe - port: http - # -- Set the time interval between two liveness probes executions in seconds - periodSeconds: 10 - # -- Set the timeout for the liveness probe in seconds - timeoutSeconds: 5 - - # If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead. - # It delays the initial liveness probe while Jenkins is starting - # -- Set the initial delay for the liveness probe in seconds - initialDelaySeconds: - - readinessProbe: - # -- Set the failure threshold for the readiness probe - failureThreshold: 3 - httpGet: - # -- Set the Pod's HTTP path for the liveness probe - path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' - # -- Set the Pod's HTTP port to use for the readiness probe - port: http - # -- Set the time interval between two readiness probes executions in seconds - periodSeconds: 10 - # -- Set the timeout for the readiness probe in seconds - timeoutSeconds: 5 - - # If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead. - # It delays the initial readiness probe while Jenkins is starting - # -- Set the initial delay for the readiness probe in seconds - initialDelaySeconds: - - # PodDisruptionBudget config - podDisruptionBudget: - # ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ - - # -- Enable Kubernetes Pod Disruption Budget configuration - enabled: false - - # For Kubernetes v1.5+, use 'policy/v1beta1' - # For Kubernetes v1.21+, use 'policy/v1' - # -- Policy API version - apiVersion: "policy/v1beta1" - - annotations: {} - labels: {} - # -- Number of pods that can be unavailable. Either an absolute number or a percentage - maxUnavailable: "0" - - # -- Create Agent listener service - agentListenerEnabled: true - # -- Listening port for agents - agentListenerPort: 50000 - # -- Host port to listen for agents - agentListenerHostPort: - # -- Node port to listen for agents - agentListenerNodePort: - - # ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies - # -- Traffic Policy of for the agentListener service - agentListenerExternalTrafficPolicy: - # -- Allowed inbound IP for the agentListener service - agentListenerLoadBalancerSourceRanges: - - 0.0.0.0/0 - # -- Disabled agent protocols - disabledAgentProtocols: - - JNLP-connect - - JNLP2-connect - csrf: - defaultCrumbIssuer: - # -- Enable the default CSRF Crumb issuer - enabled: true - # -- Enable proxy compatibility - proxyCompatability: true - - # Kubernetes service type for the JNLP agent service - # agentListenerServiceType is the Kubernetes Service type for the JNLP agent service, - # either 'LoadBalancer', 'NodePort', or 'ClusterIP' - # Note if you set this to 'LoadBalancer', you *must* define annotations to secure it. By default, - # this will be an external load balancer and allowing inbound 0.0.0.0/0, a HUGE - # security risk: https://github.com/kubernetes/charts/issues/1341 - # -- Defines how to expose the agentListener service - agentListenerServiceType: "ClusterIP" - - # -- Annotations for the agentListener service - agentListenerServiceAnnotations: {} - - # Optionally, assign an IP to the LoadBalancer agentListenerService LoadBalancer - # GKE users: only regional static IPs will work for Service Load balancer. - # -- Static IP for the agentListener LoadBalancer - agentListenerLoadBalancerIP: - - # -- Whether legacy remoting security should be enabled - legacyRemotingSecurityEnabled: false - - # Example of a 'LoadBalancer'-type agent listener with annotations securing it - # agentListenerServiceType: LoadBalancer - # agentListenerServiceAnnotations: - # service.beta.kubernetes.io/aws-load-balancer-internal: "True" - # service.beta.kubernetes.io/load-balancer-source-ranges: "172.0.0.0/8, 10.0.0.0/8" - - # LoadBalancerSourcesRange is a list of allowed CIDR values, which are combined with ServicePort to - # set allowed inbound rules on the security group assigned to the controller load balancer - # -- Allowed inbound IP addresses - loadBalancerSourceRanges: - - 0.0.0.0/0 - - # -- Optionally assign a known public LB IP - loadBalancerIP: - - # Optionally configure a JMX port. This requires additional javaOpts, for example, - # javaOpts: > - # -Dcom.sun.management.jmxremote.port=4000 - # -Dcom.sun.management.jmxremote.authenticate=false - # -Dcom.sun.management.jmxremote.ssl=false - # jmxPort: 4000 - # -- Open a port, for JMX stats - jmxPort: - - # -- Optionally configure other ports to expose in the controller container - extraPorts: [] - # - name: BuildInfoProxy - # port: 9000 - # targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port) - - # Plugins will be installed during Jenkins controller start - # -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false` - installPlugins: - - kubernetes:4353.vb_47977da_9417 - - workflow-aggregator:608.v67378e9d3db_1 - - git:5.7.0 - - configuration-as-code:1971.vf9280461ea_89 - - # If set to false, Jenkins will download the minimum required version of all dependencies. - # -- Download the minimum required version or latest version of all dependencies - installLatestPlugins: true - - # -- Set to true to download the latest version of any plugin that is requested to have the latest version - installLatestSpecifiedPlugins: false - - # -- List of plugins to install in addition to those listed in controller.installPlugins - additionalPlugins: [] - - # Without this; whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates that have the potential to cause breakage. - # Note that for this to work, `persistence.enabled` needs to be set to `true` - # -- Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true` - initializeOnce: false - - # Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment. - # -- Overwrite installed plugins on start - overwritePlugins: false - - # Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment. - # -- Overwrite plugins that are already installed in the controller image - overwritePluginsFromImage: true - - # Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config. - projectNamingStrategy: standard - - # Useful with ghprb plugin. The OWASP plugin is not installed by default, please update controller.installPlugins. - # -- Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter) - enableRawHtmlMarkupFormatter: false - - # This is ignored if enableRawHtmlMarkupFormatter is true - # -- Yaml of the markup formatter to use - markupFormatter: plainText - - # Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval - # -- List of groovy functions to approve - scriptApproval: [] - # - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - # - "new groovy.json.JsonSlurperClassic" - - # -- Map of groovy init scripts to be executed during Jenkins controller start - initScripts: {} - # test: |- - # print 'adding global pipeline libraries, register properties, bootstrap jobs...' - # -- Name of the existing ConfigMap that contains init scripts - initConfigMap: - - # 'name' is a name of an existing secret in the same namespace as jenkins, - # 'keyName' is the name of one of the keys inside the current secret. - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: - - # -- List of additional existing secrets to mount - additionalExistingSecrets: [] - # ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets - # additionalExistingSecrets: - # - name: secret-name-1 - # keyName: username - # - name: secret-name-1 - # keyName: password - - # -- List of additional secrets to create and mount - additionalSecrets: [] - # ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets - # additionalSecrets: - # - name: nameOfSecret - # value: secretText - - # Generate SecretClaim resources to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. - # 'name' is the name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. - # 'path' is the fully qualified path to the secret in Vault - # 'type' is an optional Kubernetes secret type. The default is 'Opaque' - # 'renew' is an optional secret renewal time in seconds - # -- List of `SecretClaim` resources to create - secretClaims: [] - # - name: secretName # required - # path: testPath # required - # type: kubernetes.io/tls # optional - # renew: 60 # optional - - # -- Name of default cloud configuration. - cloudName: "kubernetes" - - # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, - # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in - # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | - # become the content of the configuration yaml file. The first line after this is a JCasC root element, e.g., jenkins, credentials, - # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: - JCasC: - # -- Enables default Jenkins configuration via configuration as code plugin - defaultConfig: true - - # If true, the init container deletes all the plugin config files and Jenkins Config as Code overwrites any existing configuration - # -- Whether Jenkins Config as Code should overwrite any existing configuration - overwriteConfiguration: false - # -- Remote URLs for configuration files. - configUrls: [] - # - https://acme.org/jenkins.yaml - # -- List of Jenkins Config as Code scripts - configScripts: {} - # welcome-message: | - # jenkins: - # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - - # Allows adding to the top-level security JCasC section. For legacy purposes, by default, the chart includes apiToken configurations - # -- Jenkins Config as Code security-section - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - - # Ignored if securityRealm is defined in controller.JCasC.configScripts - # -- Jenkins Config as Code Security Realm-section - securityRealm: |- - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - - # Ignored if authorizationStrategy is defined in controller.JCasC.configScripts - # -- Jenkins Config as Code Authorization Strategy-section - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false - - # -- Annotations for the JCasC ConfigMap - configMapAnnotations: {} - - # -- Custom init-container specification in raw-yaml format - customInitContainers: [] - # - name: custom-init - # image: "alpine:3" - # imagePullPolicy: Always - # command: [ "uname", "-a" ] - - sidecars: - configAutoReload: - # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. - # If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up. - # Auto-reload uses the http:///reload-configuration-as-code endpoint to reapply config when changes to - # the configScripts are detected. - # -- Enable Jenkins Config as Code auto-reload - enabled: true - image: - # -- Registry for the image that triggers the reload - registry: docker.io - # -- Repository of the image that triggers the reload - repository: kiwigrid/k8s-sidecar - # -- Tag for the image that triggers the reload - tag: 1.30.3 - imagePullPolicy: IfNotPresent - resources: - {} - # limits: - # cpu: 100m - # memory: 100Mi - # requests: - # cpu: 50m - # memory: 50Mi - # -- Enables additional volume mounts for the config auto-reload container - additionalVolumeMounts: - [] - # - name: auto-reload-config - # mountPath: /var/config/logger - # - name: auto-reload-logs - # mountPath: /var/log/auto_reload - # -- Config auto-reload logging settings - logging: - # See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py - configuration: - # -- Enables custom log config utilizing using the settings below. - override: false - logLevel: INFO - formatter: JSON - logToConsole: true - logToFile: false - maxBytes: 1024 - backupCount: 3 - - # -- The scheme to use when connecting to the Jenkins configuration as code endpoint - scheme: http - # -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint - skipTlsVerify: false - - # -- How many connection-related errors to retry on - reqRetryConnect: 10 - # -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) - sleepTime: - - # -- Environment variable sources for the Jenkins Config as Code auto-reload container - envFrom: [] - # -- Environment variables for the Jenkins Config as Code auto-reload container - env: [] - # - name: REQ_TIMEOUT - # value: "30" - - # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. - # This is only used to reload JCasC config from the sidecar container running in the Jenkins controller pod. - # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be - # accessible via SSH from outside the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), - # this must be > 1024: - sshTcpPort: 1044 - # folder in the pod that should hold the collected dashboards: - folder: "/var/jenkins_home/casc_configs" - - # If specified, the sidecar will search for JCasC config-maps inside this namespace. - # Otherwise, the namespace in which the sidecar is running will be used. - # It's also possible to specify ALL to search in all namespaces: - # searchNamespace: - # -- Enable container security context - containerSecurityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - - # -- Configures additional sidecar container(s) for the Jenkins controller - additionalSidecarContainers: [] - ## The example below runs the client for https://smee.io as sidecar container next to Jenkins, - ## that allows triggering build behind a secure firewall. - ## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall - ## - ## Note: To use it you should go to https://smee.io/new and update the url to the generated one. - # - name: smee - # image: docker.io/twalter/smee-client:1.0.2 - # args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"] - # resources: - # limits: - # cpu: 50m - # memory: 128Mi - # requests: - # cpu: 10m - # memory: 32Mi - - # -- Name of the Kubernetes scheduler to use - schedulerName: "" - - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - # -- Node labels for pod assignment - nodeSelector: {} - - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature - # -- Toleration labels for pod assignment - tolerations: [] - # -- Set TerminationGracePeriodSeconds - terminationGracePeriodSeconds: - # -- Set the termination message path - terminationMessagePath: - # -- Set the termination message policy - terminationMessagePolicy: - - # -- Affinity settings - affinity: {} - - # Leverage a priorityClass to ensure your pods survive resource shortages - # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - # -- The name of a `priorityClass` to apply to the controller pod - priorityClassName: - - # -- Annotations for controller pod - podAnnotations: {} - # -- Annotations for controller StatefulSet - statefulSetAnnotations: {} - - # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - # -- Update strategy for StatefulSet - updateStrategy: {} - - # -- Topology spread constraints - topologySpreadConstraints: {} - - ingress: - # -- Enables ingress - enabled: false - - # Override for the default paths that map requests to the backend - # -- Override for the default Ingress paths - paths: [] - # - backend: - # serviceName: ssl-redirect - # servicePort: use-annotation - # - backend: - # serviceName: >- - # {{ template "jenkins.fullname" . }} - # # Don't use string here, use only integer value! - # servicePort: 8080 - - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - # -- Ingress API version - apiVersion: "extensions/v1beta1" - # -- Ingress labels - labels: {} - # -- Ingress annotations - annotations: - {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - - # Set this path to jenkinsUriPrefix above or use annotations to rewrite path - # -- Ingress path - path: - - # configures the hostname e.g. jenkins.example.com - # -- Ingress hostname - hostName: - # -- Hostname to serve assets from - resourceRootUrl: - # -- Ingress TLS configuration - tls: [] - # - secretName: jenkins.cluster.local - # hosts: - # - jenkins.cluster.local - - # often you want to have your controller all locked down and private, - # but you still want to get webhooks from your SCM - # A secondary ingress will let you expose different urls - # with a different configuration - secondaryingress: - enabled: false - # paths you want forwarded to the backend - # ex /github-webhook - paths: [] - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - # configures the hostname e.g., jenkins-external.example.com - hostName: - tls: - # - secretName: jenkins-external.example.com - # hosts: - # - jenkins-external.example.com - - # If you're running on GKE and need to configure a backendconfig - # to finish ingress setup, use the following values. - # Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig - backendconfig: - # -- Enables backendconfig - enabled: false - # -- backendconfig API version - apiVersion: "extensions/v1beta1" - # -- backendconfig name - name: - # -- backendconfig labels - labels: {} - # -- backendconfig annotations - annotations: {} - # -- backendconfig spec - spec: {} - - # Openshift route - route: - # -- Enables openshift route - enabled: false - # -- Route labels - labels: {} - # -- Route annotations - annotations: {} - # -- Route path - path: - - # -- Allows for adding entries to Pod /etc/hosts - hostAliases: [] - # ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - # hostAliases: - # - ip: 192.168.50.50 - # hostnames: - # - something.local - # - ip: 10.0.50.50 - # hostnames: - # - other.local - - # Expose Prometheus metrics - prometheus: - # If enabled, add the prometheus plugin to the list of plugins to install - # https://plugins.jenkins.io/prometheus - - # -- Enables prometheus service monitor - enabled: false - # -- Additional labels to add to the service monitor object - serviceMonitorAdditionalLabels: {} - # -- Set a custom namespace where to deploy ServiceMonitor resource - serviceMonitorNamespace: - # -- How often prometheus should scrape metrics - scrapeInterval: 60s - - # Defaults to the default endpoint used by the prometheus plugin - # -- The endpoint prometheus should get metrics from - scrapeEndpoint: /prometheus - - # See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ - # The `groups` root object is added by default, add the rule entries - # -- Array of prometheus alerting rules - alertingrules: [] - # -- Additional labels to add to the PrometheusRule object - alertingRulesAdditionalLabels: {} - # -- Set a custom namespace where to deploy PrometheusRule resource - prometheusRuleNamespace: "" - - # RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds - # relabelings for a few standard Kubernetes fields. The original scrape job’s name - # is available via the __tmp_prometheus_job_name label. - # More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config - relabelings: [] - # MetricRelabelConfigs to apply to samples before ingestion. - metricRelabelings: [] - - googlePodMonitor: - # If enabled, It creates Google Managed Prometheus scraping config - enabled: false - # Set a custom namespace where to deploy PodMonitoring resource - # serviceMonitorNamespace: "" - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - - # -- Can be used to disable rendering controller test resources when using helm template - testEnabled: true - - httpsKeyStore: - # -- Enables HTTPS keystore on jenkins controller - enable: false - # -- Name of the secret that already has ssl keystore - jenkinsHttpsJksSecretName: "" - # -- Name of the key in the secret that already has ssl keystore - jenkinsHttpsJksSecretKey: "jenkins-jks-file" - # -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file - jenkinsHttpsJksPasswordSecretName: "" - # -- Name of the key in the secret that contains the JKS password - jenkinsHttpsJksPasswordSecretKey: "https-jks-password" - disableSecretMount: false - - # When HTTPS keystore is enabled, servicePort and targetPort will be used as HTTPS port - # -- HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port. - httpPort: 8081 - # -- Path of HTTPS keystore file - path: "/var/jenkins_keystore" - # -- Jenkins keystore filename which will appear under controller.httpsKeyStore.path - fileName: "keystore.jks" - # -- Jenkins keystore password - password: "password" - - # -- Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here - jenkinsKeyStoreBase64Encoded: - # Convert keystore.jks files content to base64 > $ cat keystore.jks | base64 -# /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq -# AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z -# gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe -# TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x -# QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy -# 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR -# pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB -# Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l -# Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG -# Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi -# HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI -# OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO -# NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi -# Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg -# UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te -# fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi -# Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT -# EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ -# y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU -# iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl -# t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ -# gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa -# jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H -# bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn -# xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV -# BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p -# bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx -# MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y -# b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb -# BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC -# AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w -# Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF -# 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP -# F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i -# d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe -# 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl -# m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h -# /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q -# 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog -# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= - -agent: - # -- Enable Kubernetes plugin jnlp-agent podTemplate - enabled: true - # -- The name of the pod template to use for providing default values - defaultsProviderTemplate: "" - - # Useful for not including a serviceAccount in the template if `false` - # -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount` - useDefaultServiceAccount: true - - # -- Override the default service account - # @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true` - serviceAccount: - - # For connecting to the Jenkins controller - # -- Overrides the Kubernetes Jenkins URL - jenkinsUrl: - - # connects to the specified host and port, instead of connecting directly to the Jenkins controller - # -- Overrides the Kubernetes Jenkins tunnel - jenkinsTunnel: - # -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI - skipTlsVerify: false - # -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI - usageRestricted: false - # -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5 - kubernetesConnectTimeout: 5 - # -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15 - kubernetesReadTimeout: 15 - # -- The maximum concurrent connections to Kubernetes API - maxRequestsPerHostStr: "32" - # -- Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated - retentionTimeout: 5 - # -- Seconds to wait for pod to be running - waitForPodSec: 600 - # -- Namespace in which the Kubernetes agents should be launched - namespace: - # -- Custom Pod labels (an object with `label-key: label-value` pairs) - podLabels: {} - # -- Custom registry used to pull the agent jnlp image from - jnlpregistry: - image: - # -- Registry to pull the agent jnlp image from - registry: "" - # -- Repository to pull the agent jnlp image from - repository: "jenkins/inbound-agent" - # -- Tag of the image to pull - tag: "3309.v27b_9314fd1a_4-4" - # -- Configure working directory for default agent - workingDir: "/home/jenkins/agent" - nodeUsageMode: "NORMAL" - # -- Append Jenkins labels to the agent - customJenkinsLabels: [] - # -- Name of the secret to be used to pull the image - imagePullSecretName: - componentName: "jenkins-agent" - # -- Enables agent communication via websockets - websocket: false - directConnection: false - # -- Agent privileged container - privileged: false - # -- Configure container user - runAsUser: - # -- Configure container group - runAsGroup: - # -- Enables the agent to use the host network - hostNetworking: false - # -- Resources allocation (Requests and Limits) - resources: - requests: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - limits: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - livenessProbe: {} - # execArgs: "cat /tmp/healthy" - # failureThreshold: 3 - # initialDelaySeconds: 0 - # periodSeconds: 10 - # successThreshold: 1 - # timeoutSeconds: 1 - - # You may want to change this to true while testing a new image - # -- Always pull agent container image before build - alwaysPullImage: false - # When using Pod Security Admission in the Agents namespace with the restricted Pod Security Standard, - # the jnlp container cannot be scheduled without overriding its container definition with a securityContext. - # This option allows to automatically inject in the jnlp container a securityContext - # that is suitable for the use of the restricted Pod Security Standard. - # -- Set a restricted securityContext on jnlp containers - restrictedPssSecurityContext: false - # Controls how agent pods are retained after the Jenkins build completes - # Possible values: Always, Never, OnFailure - podRetention: "Never" - # Disable if you do not want the Yaml the agent pod template to show up - # in the job Console Output. This can be helpful for either security reasons - # or simply to clean up the output to make it easier to read. - showRawYaml: true - - # You can define the volumes that you want to mount for this container - # Allowed types are: ConfigMap, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC, Secret - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes - # -- Additional volumes - volumes: [] - # - type: ConfigMap - # configMapName: myconfigmap - # mountPath: /var/myapp/myconfigmap - # - type: EmptyDir - # mountPath: /var/myapp/myemptydir - # memory: false - # - type: EphemeralVolume - # mountPath: /var/myapp/myephemeralvolume - # accessModes: ReadWriteOnce - # requestsSize: 10Gi - # storageClassName: mystorageclass - # - type: HostPath - # hostPath: /var/lib/containers - # mountPath: /var/myapp/myhostpath - # - type: Nfs - # mountPath: /var/myapp/mynfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - # - type: PVC - # claimName: mypvc - # mountPath: /var/myapp/mypvc - # readOnly: false - # - type: Secret - # defaultMode: "600" - # mountPath: /var/myapp/mysecret - # secretName: mysecret - # Pod-wide environment, these vars are visible to any container in the agent pod - - # You can define the workspaceVolume that you want to mount for this container - # Allowed types are: DynamicPVC, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace - # -- Workspace volume (defaults to EmptyDir) - workspaceVolume: {} - ## DynamicPVC example - # - type: DynamicPVC - # configMapName: myconfigmap - ## EmptyDir example - # - type: EmptyDir - # memory: false - ## EphemeralVolume example - # - type: EphemeralVolume - # accessModes: ReadWriteOnce - # requestsSize: 10Gi - # storageClassName: mystorageclass - ## HostPath example - # - type: HostPath - # hostPath: /var/lib/containers - ## NFS example - # - type: Nfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - ## PVC example - # - type: PVC - # claimName: mypvc - # readOnly: false - - # Pod-wide environment, these vars are visible to any container in the agent pod - # -- Environment variables for the agent Pod - envVars: [] - # - name: PATH - # value: /usr/local/bin - # -- Mount a secret as environment variable - secretEnvVars: [] - # - key: PATH - # optional: false # default: false - # secretKey: MY-K8S-PATH - # secretName: my-k8s-secret - - # -- Node labels for pod assignment - nodeSelector: {} - # Key Value selectors. Ex: - # nodeSelector - # jenkins-agent: v1 - - # -- Command to execute when side container starts - command: - # -- Arguments passed to command to execute - args: "${computer.jnlpmac} ${computer.name}" - # -- Side container name - sideContainerName: "jnlp" - - # Doesn't allocate pseudo TTY by default - # -- Allocate pseudo tty to the side container - TTYEnabled: false - # -- Max number of agents to launch for a whole cluster. - containerCap: 10 - # -- Max number of agents to launch for this type of agent - instanceCap: 2147483647 - # -- Agent Pod base name - podName: "default" - - # Enables garbage collection of orphan pods for this Kubernetes cloud. (beta) - garbageCollection: - # -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them. - enabled: false - # -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line. - namespaces: "" - # namespaces: |- - # namespaceOne - # namespaceTwo - # -- Timeout value for orphaned pods - timeout: 300 - - # -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it - idleMinutes: 0 - - # The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods. - # https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates - # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - # -- The raw yaml of a Pod API Object to merge into the agent spec - yamlTemplate: "" - # yamlTemplate: |- - # apiVersion: v1 - # kind: Pod - # spec: - # tolerations: - # - key: "key" - # operator: "Equal" - # value: "value" - - # -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override" - yamlMergeStrategy: "override" - # -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one - inheritYamlMergeStrategy: false - # -- Timeout in seconds for an agent to be online - connectTimeout: 100 - # -- Annotations to apply to the pod - annotations: {} - - # Containers specified here are added to all agents. Set key empty to remove container from additional agents. - # -- Add additional containers to the agents - additionalContainers: [] - # - sideContainerName: dind - # image: - # repository: docker - # tag: dind - # command: dockerd-entrypoint.sh - # args: "" - # privileged: true - # resources: - # requests: - # cpu: 500m - # memory: 1Gi - # limits: - # cpu: 1 - # memory: 2Gi - - # Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template. - # -- Disable the default Jenkins Agent configuration - disableDefaultAgent: false - - # Below is the implementation of custom pod templates for the default configured kubernetes cloud. - # Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. - # For this pod templates configuration to be loaded, the following values must be set: - # controller.JCasC.defaultConfig: true - # Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template. - # -- Configures extra pod templates for the default kubernetes cloud - podTemplates: {} - # python: | - # - name: python - # label: jenkins-python - # serviceAccount: jenkins - # containers: - # - name: python - # image: python:3 - # command: "/bin/sh -c" - # args: "cat" - # ttyEnabled: true - # privileged: true - # resourceRequestCpu: "400m" - # resourceRequestMemory: "512Mi" - # resourceLimitCpu: "1" - # resourceLimitMemory: "1024Mi" - -# Inherits all values from `agent` so you only need to specify values which differ -# -- Configure additional -additionalAgents: {} -# maven: -# podName: maven -# customJenkinsLabels: maven -# # An example of overriding the jnlp container -# # sideContainerName: jnlp -# image: -# repository: jenkins/jnlp-agent-maven -# tag: latest -# python: -# podName: python -# customJenkinsLabels: python -# sideContainerName: python -# image: -# repository: python -# tag: "3" -# command: "/bin/sh -c" -# args: "cat" -# TTYEnabled: true - -# Here you can add additional clouds -# They inherit all values from the default cloud (including the main agent), so -# you only need to specify values which differ. If you want to override -# default additionalAgents with the additionalClouds.additionalAgents set -# additionalAgentsOverride to `true`. -additionalClouds: {} -# remote-cloud-1: -# kubernetesURL: https://api.remote-cloud.com -# additionalAgentsOverride: true -# additionalAgents: -# maven-2: -# podName: maven-2 -# customJenkinsLabels: maven -# # An example of overriding the jnlp container -# # sideContainerName: jnlp -# image: -# repository: jenkins/jnlp-agent-maven -# tag: latest -# namespace: my-other-maven-namespace -# remote-cloud-2: -# kubernetesURL: https://api.remote-cloud.com - -persistence: - # -- Enable the use of a Jenkins PVC - enabled: true - - # A manually managed Persistent Volume and Claim - # Requires persistence.enabled: true - # If defined, PVC must be created manually before volume will be bound - # -- Provide the name of a PVC - existingClaim: - - # jenkins data Persistent Volume Storage Class - # If defined, storageClassName: - # If set to "-", storageClassName: "", which disables dynamic provisioning - # If undefined (the default) or set to null, no storageClassName spec is - # set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack) - # -- Storage class for the PVC - storageClass: - # -- Annotations for the PVC - annotations: {} - # -- Labels for the PVC - labels: {} - # -- The PVC access mode - accessMode: "ReadWriteOnce" - # -- The size of the PVC - size: "8Gi" - - # ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/ - # -- Existing data source to clone PVC from - dataSource: {} - # name: PVC-NAME - # kind: PersistentVolumeClaim - - # -- SubPath for jenkins-home mount - subPath: - # -- Additional volumes - volumes: [] - # - name: nothing - # emptyDir: {} - - # -- Additional mounts - mounts: [] - # - mountPath: /var/nothing - # name: nothing - # readOnly: true - -networkPolicy: - # -- Enable the creation of NetworkPolicy resources - enabled: false - - # For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' - # For Kubernetes v1.7, use 'networking.k8s.io/v1' - # -- NetworkPolicy ApiVersion - apiVersion: networking.k8s.io/v1 - # You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range - internalAgents: - # -- Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels - allowed: true - # -- A map of labels (keys/values) that agent pods must have to be able to connect to controller - podLabels: {} - # -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller - namespaceLabels: - {} - # project: myproject - externalAgents: - # -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16 - ipCIDR: - # -- A list of IP sub-ranges to be excluded from the allowlisted IP range - except: - [] - # - 172.17.1.0/24 - -## Install Default RBAC roles and bindings -rbac: - # -- Whether RBAC resources are created - create: true - # -- Whether the Jenkins service account should be able to read Kubernetes secrets - readSecrets: false - # -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints - useOpenShiftNonRootSCC: false - -serviceAccount: - # -- Configures if a ServiceAccount with this name should be created - create: true - - # The name of the ServiceAccount is autogenerated by default - # -- The name of the ServiceAccount to be used by access-controlled resources - name: - # -- Configures annotations for the ServiceAccount - annotations: {} - # -- Configures extra labels for the ServiceAccount - extraLabels: {} - # -- Controller ServiceAccount image pull secret - imagePullSecretName: - # -- Auto-mount ServiceAccount token - automountServiceAccountToken: true - -serviceAccountAgent: - # -- Configures if an agent ServiceAccount should be created - create: false - - # If not set and create is true, a name is generated using the fullname template - # -- The name of the agent ServiceAccount to be used by access-controlled resources - name: - # -- Configures annotations for the agent ServiceAccount - annotations: {} - # -- Configures extra labels for the agent ServiceAccount - extraLabels: {} - # -- Agent ServiceAccount image pull secret - imagePullSecretName: - # -- Auto-mount ServiceAccount token - automountServiceAccountToken: true - -# -- Checks if any deprecated values are used -checkDeprecation: true - -awsSecurityGroupPolicies: - enabled: false - policies: - - name: "" - securityGroupIds: [] - podSelector: {} - -# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md -helmtest: - # A testing framework for bash - bats: - # Bash Automated Testing System (BATS) - image: - # -- Registry of the image used to test the framework - registry: "docker.io" - # -- Repository of the image used to test the framework - repository: "bats/bats" - # -- Tag of the image to test the framework - tag: "1.12.0" diff --git a/helm-templates/jenkins/CHANGELOG.md b/helm-templates/jenkins/CHANGELOG.md deleted file mode 100644 index 32114a5..0000000 --- a/helm-templates/jenkins/CHANGELOG.md +++ /dev/null @@ -1,2708 +0,0 @@ -# Changelog - -This file documents all notable changes to the Jenkins Helm Chart. -The release numbering uses [semantic versioning](http://semver.org). - -Use the following links to reference issues, PRs, and commits prior to v2.6.0. - -* Issue: `https://github.com/helm/charts/issues/[issue#]` -* PR: `https://github.com/helm/charts/pull/[pr#]` -* Commit: `https://github.com/helm/charts/commit/[commit]/stable/jenkins` - -The changelog until v1.5.7 was auto-generated based on git commits. -Those entries include a reference to the git commit to be able to get more details. - -## 4.8.4 - -Add `artifacthub.io/changes` changelog annotation to the released chart. - -## 4.8.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.426.1 - -## 4.8.2 - -Add the ability to modify `retentionTimeout` and `waitForPodSec` default value in JCasC - -## 4.8.1 - -Reintroduces changes from 4.7.0 (reverted in 4.7.1), with additional fixes: - -- METHOD is now allowed in `env` and is not duplicated anymore -- No calls to JCasC reload endpoint from the init container - -## 4.8.0 - -Adds support for ephemeralStorage request and limit in Kubernetes plugin JCasC template - -## 4.7.4 - -Add the config-init-script checksum into the controller statefullset pod annotations to trigger restart of the pod in case of updated init scripts. - -## 4.7.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.3 - -## 4.7.1 - -Changes in 4.7.0 were reverted. - -## 4.7.0 - -Runs `config-reload` as an init container, in addition to the sidecar container, to ensure that JCasC YAMLS are present before the main Jenkins container starts. This should fix some race conditions and crashes on startup. - -## 4.6.7 - -Change jenkins-test image label to match the other jenkins images - -## 4.6.5 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.2 - -## 4.6.4 - -Introducing TPL function on variables related to hostname in `./charts/jenkins/templates/jenkins-controller-ingress.yaml` - -## 4.6.3 - -Add values to documentation - -## 4.6.2 - -Update word from hundreds to over 1800 to align with blurb at . - -## 4.6.1 - -Update `configuration-as-code` plugin to fix dependency issues with `azure-ad` plugin - -## 4.6.0 - -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey` to allow overriding the default secret key containing the JKS file. -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName` to allow getting the JKS password from a different secret. -Added `.Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey` to allow overriding the default secret key containing the JKS password. - -## 4.5.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.414.1 - - -## 4.5.0 - -Added `.Values.persistence.dataSource` to allow cloning home PVC from existing dataSource. - -## 4.4.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.3 - - -## 4.4.1 - -Added `.Values.agent.jnlpregistry` to allow agents to be configured with private registry. - -## 4.4.0 - -Add config keys for liveness probes on agent containers. - - -## 4.3.30 - -Update Jenkins version in controller test matching LTS version - -## 4.3.29 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.2 - - -## 4.3.28 - -Allow the kubernetes API server URL to be configurable. - -## 4.3.27 - -Bump kiwigrid/k8s-sidecar from 1.23.1 to 1.24.4 and jenkins/inbound-agent from 3107.v665000b_51092-5 to 3107.v665000b_51092-15. - -## 4.3.26 - -Fix various typos in the chart documentation. - -## 4.3.25 - -| plugin | old version | new version | -|-----------------------|----------------------|-----------------------| -| kubernetes | 3900.va_dce992317b_4 | 3937.vd7b_82db_e347b_ | -| configuration-as-code | 1625.v27444588cc3d | 1647.ve39ca_b_829b_42 | -| git | 5.0.0 | 5.1.0 | -| ldap | 671.v2a_9192a_7419d | 682.v7b_544c9d1512 | - -## 4.3.24 - -Update Jenkins image and appVersion to jenkins lts release version 2.401.1 - - -## 4.3.23 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.3 - - -## 4.3.22 - - -Bump chart version. - -## 4.3.21 - - -Document building charts for weekly releases. - -## 4.3.20 - - -Enhance repository appearance and miscellaneous cleanup. - -## 4.3.19 - - -Comply with superlinter rules and address ShellCheck issues. - -## 4.3.18 - - -Bump kiwigrid/k8s-sidecar from 1.15.0 to 1.23.1. - -## 4.3.17 - - -Bump jenkins/inbound-agent from 4.11.2-4 to 3107.v665000b_51092-5. - -## 4.3.16 - - -Update bundled plugins: -- [ldap](https://plugins.jenkins.io/ldap/): From 2.5 to 671.v2a_9192a_7419d -- [kubernetes](https://plugins.jenkins.io/kubernetes/): From 3734.v562b_b_a_627ea_c to 3900.va_dce992317b_4 -- [workflow-aggregator](https://plugins.jenkins.io/workflow-aggregator/): From 590.v6a_d052e5a_a_b_5 to 590.v6a_d052e5a_a_b_5 -- [configuration-as-code](https://plugins.jenkins.io/configuration-as-code/): From 1569.vb_72405b_80249 to 1625.v27444588cc3d - -## 4.3.15 - - -Update bats from 1.2.1 to 1.9.0. - -## 4.3.14 - - -Update various GH actions, typo fixes, and miscellaneous chores. - -## 4.3.13 - - -Bump helm-unittest from 0.2.8 to 0.2.11. - -## 4.3.12 - - -Update wording in values.yml. - -## 4.3.11 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.2 - - -## 4.3.10 - -Correct incorrect env var definition -Disable volume mount if disableSecretMount enabled - -## 4.3.9 - -Document `.Values.agent.directConnection` in README. -Add default value for `.Values.agent.directConnection` to `values.yaml` - -## 4.3.8 - -Added `.Values.agent.directConnection` to allow agents to be configured to connect direct to the JNLP port on the -controller, preventing the need for an external HTTP endpoint for this purpose. - -## 4.3.7 - -Added `.Values.controller.shareProcessNamespace` and `.Values.controller.httpsKeyStore.disableSecretMount` to enable sourcing TLS certs from external issuers - -## 4.3.6 - -Update Jenkins image and appVersion to jenkins lts release version 2.387.1 - -## 4.3.5 - -Added `.Values.helmtest.bats.image` and `.Values.helmtest.bats.image` to allow unit tests to be configurable. Fixes [https://github.com/jenkinsci/helm-charts/issues/683] - -## 4.3.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.3 - - -## 4.3.3 - -Removed hardcoding of chart version in tests to make maintenance easier - -## 4.3.2 - -Added `.Values.serviceAccount.extraLabels` on Service Account -Added `.Values.serviceAccountAgent.extraLabels` on Agent's Service Account - - -## 4.3.0 - -Moved use of `.Values.containerEnv` within `jenkins` Container to top of `env` block to allow for subsequent Environment Variables to reference these additional ones. - -## 4.2.21 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.2 - - -## 4.2.20 - -Fixed the `controller.prometheus.metricRelabelings` being unable to convert the value to the ServiceMonitor. -Added `controller.prometheus.relabelings` to allow relabling before scrape. -Added default values for `controller.prometheus.relabelings` and `controller.prometheus.metricRelabelings`. - -## 4.2.19 - -CronJob API version upgraded to batch/v1 - -## 4.2.18 - -Added option to set secretEnvVars. - -## 4.2.17 - -Update Jenkins image and appVersion to jenkins lts release version 2.375.1 - - -## 4.2.16 - -Fixed chart notes not rendering Jenkins URL with prefix when `controller.jenkinsUriPrefix` is set. -Fixed chart notes not rendering Jenkins URL with `https` when `controller.ingress.tls` or `controller.controller.httpsKeyStore.enable` is set. -Fixed chart notes rendering wrong JCasC URL when not using `controller.ingress`. - -## 4.2.15 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.4 - -## 4.2.14 - -Added option to mount all keys from an existing k8s secret - -## 4.2.13 - -Adding `tpl` to `controller.additionalExistingSecrets` - -## 4.2.12 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.3 - - -## 4.2.11 - -Update default plugin versions - -| plugin | old version | new version | -|-----------------------|-----------------------|------------------------| -| kubernetes | 3706.vdfb_d599579f3 | 3734.v562b_b_a_627ea_c | -| git | 4.11.5 | 4.13.0 | -| configuration-as-code | 1512.vb_79d418d5fc8 | 1569.vb_72405b_80249 | - -## 4.2.10 -Fix grammar and typos - -## 4.2.9 -Update Jenkins image and appVersion to jenkins lts release version 2.361.2 - -## 4.2.8 -Modify the condition to trigger copying jenkins_config files when configAutoReload option is disabled during Jenkins initialization - -## 4.2.7 -Support for remote URL for configuration - -## 4.2.6 -Add option to set hostnetwork for agents - -## 4.2.5 -Add an extra optional argument to extraPorts in order to specify targetPort - -## 4.2.4 -Remove k8s capibility requirements when setting priority class for controller - -## 4.2.3 Update plugin versions - -| plugin | old version | new version | -| --------------------- | --------------------- | --------------------- | -| kubernetes | 3600.v144b_cd192ca_a_ | 3706.vdfb_d599579f3 | -| workflow-aggregator | 581.v0c46fa_697ffd | 590.v6a_d052e5a_a_b_5 | -| configuration-as-code | 1429.v09b_044a_c93de | 1512.vb_79d418d5fc8 | -| git | 4.11.3 | 4.11.5 | - -Resolve version conflict between default install of plugins. - -## 4.2.2 - -Support Google Managed Prometheus - -## 4.2.1 - -Remove option to provide command and args of agent as YAML. This feature was never supported by the Jenkins Kubernetes -plugin. - -## 4.2.0 - -Add option to provide additional containers to agents - -## 4.1.18 - -Update Jenkins image and appVersion to jenkins lts release version 2.361.1 - - -## 4.1.17 - -Update Jenkins casc default settings to allow `security` configs to be provided - - -## 4.1.16 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.3 - - -## 4.1.15 - -`projectNamingStrategy` is configurable in default config. - -## 4.1.14 - -If `installPlugins` is disabled, don't create unused plugins volume. - -## 4.1.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.2 - - -## 4.1.12 - -If keystore is defined, it is now also made available in the initContainer. - -## 4.1.11 - -JCasC ConfigMaps now generate their name from the `jenkins.casc.configName` helper - -## 4.1.10 - -Update Jenkins image and appVersion to jenkins lts release version 2.346.1 - - -## 4.1.9 - -Allow setting `imagePullSecret` for backup job via `backup.imagePullSecretName` - -## 4.1.8 - -Fix path of projected secrets from `additionalExistingSecrets`. - -## 4.1.7 - -Update README with explanation on the required environmental variable `AWS_REGION` in case of using an S3 bucket. - -## 4.1.6 - -project adminSecret, additionalSecrets and additionalExistingSecrets instead of mount with subPath - -## 4.1.5 - -Update README to fix `JAVA_OPTS` name. - -## 4.1.4 -Update plugins - -## 4.1.3 -Update jenkins-controller-statefulset projected volumes definition - -## 4.1.1 -Added 'controller.prometheus.metricRelabelings' to allow relabling and dropping unused prometheus metrics - -## 4.1.0 - -Added `controller.sidecars.configAutoReload.envFrom`, `controller.initContainerEnvFrom`, `controller.containerEnvFrom` - -## 4.0.1 - -No code changes - CI updated to run unit tests using Helm 3.8.2. - -## 4.0.0 - -Removes automatic `remotingSecurity` setting when using a container tag older than `2.326` (introduced in [`3.11.7`](#3117)). If you're using a version older than `2.326`, you should explicitly set `.controller.legacyRemotingSecurityEnabled` to `true`. - -## 3.12.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.3 - -## 3.12.1 - -Make namespace configurable for agents and additional agents. - -## 3.12.0 - -Added a flag for disabling the default Jenkins Agent configuration. - -## 3.11.10 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.2 - -## 3.11.9 Bump configuration-as-code plugin version - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| configuration-as-code | 1.51 | 1414.v878271fc496f | - -## 3.11.8 - -Make [externalTrafficPolicy](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies) and `loadBalancerSourceRanges` fields customizable for Agent listener service via `controller.agentListenerExternalTrafficPolicy` and `controller.loadBalancerSourceRanges`. - -## 3.11.7 - -Removed Configuration as Code `remotingSecurity` section for Jenkins 2.326 or newer. See [Documentation](https://www.jenkins.io/redirect/AdminWhitelistRule) to learn more. - -## 3.11.6 - -Update Jenkins image and appVersion to jenkins lts release version 2.332.1 - - -## 3.11.5 - -Change Backup Role name function call to match the RoleDef function call in the Backup RoleBinding - -## 3.11.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.3 - - -## 3.11.3 - -Update kiwigrid/k8s-sidecar:1.15.0 -Update jenkins/inbound-agent:4.11.2-4 - -## 3.11.2 - -Improve example for workspaceVolume. Clarify that this is not a list. - -## 3.11.1 - -Update configuration-as-code plugin to 1.55.1 - - -## 3.11.0 - -Update default plugin versions - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.31.1 | 1.31.3 | -| git | 4.10.1 | 4.10.2 | - -## 3.10.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.2 - - -## 3.10.2 - -Fix definition of startupProbe when deploying on a Kubernetes cluster < 1.16 - -## 3.10.1 - -correct VALUES_SUMMARY.md for installLatestPlugins - -## 3.10.0 - -Update default plugin versions - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.30.11 | 1.31.1 | -| git | 4.10.0 | 4.10.1 | -| configuration-as-code | 1.54 | 1.55 | - -## 3.9.4 - -Add JAVA_OPTIONS to the README so proxy settings get picked by jenkins-plugin-cli - -## 3.9.3 - -Fix config reload request URL when httpsKeystore in use - -## 3.9.2 - -Update Jenkins image and appVersion to jenkins lts release version 2.319.1 -Update following plugins: - -* kubernetes:1.30.11 -* git:4.10.0 -* configuration-as-code:1.54 - -## 3.9.1 - -Adding `tpl` to `controller.overrideArgs` - -## 3.9.0 - -Added containerSecurityContext - -## 3.8.9 - -Fix mounting of HTTPS keystore secret when httpsKeyStore is enabled - -## 3.8.8 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.3 - -## 3.8.7 - -Adding `tpl` to `initScripts` - -## 3.8.6 - -Add `controller.tagLabel` to specify the label for the image tag, for example `jdk11` or `alpine` - -## 3.8.5 - -Move jenkins web root outside of home dir - -## 3.8.4 - -Add `controller.initConfigMap` to pass pre-existing `init.groovy.d` ConfigMaps to the controller - -## 3.8.3 - -Update missed reference to jenkins/inbound-agent:4.11-1 - -## 3.8.2 - -Update jenkins/inbound-agent:4.11-1 - -## 3.8.1 - -Update jenkins/inbound-agent:4.10-3 - -## 3.8.0 - -Update kiwigrid/k8s-sidecar:1.14.2 - -## 3.7.1 - -Update git and casc plugins versions - -## 3.7.0 - -Added the option to create AWS SecurityGroupPolicy resources - -## 3.6.2 - -Fix httpsKeyStore mount when `controller.httpsKeyStore.enable` is `true` - -## 3.6.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.2 - - -## 3.6.0 -Support custom agent pod labels - -## 3.5.20 -Disallow ingress on port 50000 when agent listener is disabled - -## 3.5.19 -Add support for specifying termination-log behaviour for Jenkins controller - -## 3.5.18 -Add support for creating a Pod Disruption Budget for Jenkins controller - -## 3.5.17 -Update workdingDir to `/home/jenkins/agent` - -## 3.5.16 -Update location of icon (wiki.jenkins.io is down) - -## 3.5.15 -Add support for adding labels to the Jenkins home Persistent Volume Claim (pvc) - -## 3.5.14 - -* Updated versions of default plugins -* Use verbose logging during plugin installation -* download the latest version of all plugin dependencies (Fixes #442) - -## 3.5.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.303.1 - -## 3.5.12 - -Added extended documentation for Backup and Restore. - -## 3.5.11 - -Sanitized the Jenkins Label - -## 3.5.10 - -Fixed `controller.customJenkinsLabels` not getting templated into the controller `labelString:` field in JCasC - -## 3.5.9 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.3 - - -## 3.5.8 - -Add parameter `backup.serviceAccount.create` to disable service account creation for backup service and `backup.serviceAccount.name` to allow change of the SA name. -`backup.annotations` was moved to `backup.serviceAccount.annotations` - -## 3.5.7 - -Enable setting `controller.serviceExternalTrafficPolicy` to set [the standard Service option](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip). `externalTrafficPolicy` denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. - -## 3.5.6 - -Add optional `controller.initContainerResources`, if set, it will change resources allocation for init controller, overwise the `controller.resources` will be used - -## 3.5.5 - -Allow to configure nodeUsageMode via `agent.nodeUsageMode` - -## 3.5.4 - -Update tests to work with unittest 0.2.6 - -## 3.5.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.2 - -## 3.5.2 - -Enable setting `controller.installLatestSpecifiedPlugins` to set whether to download the latest dependencies of any plugin that is requested to have the latest version. - -## 3.5.1 -Fix activeDeadlineSeconds wrong type bug in jenkins-backup-cronjob template - -## 3.5.0 - -Allow `controller.podAnnotations` to be render as a template - -## 3.4.1 - -Allow showRawYaml for the default agent's pod template to be customized. - -## 3.4.0 - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.275` to `kiwigrid/k8s-sidecar:1.12.2` - -## 3.3.23 - -Make `controller.ingress.resourceRootUrl` compatible with API version networking.k8s.io/v1 on k8s >= 1.19.x - -## 3.3.22 - -Update Jenkins image and appVersion to jenkins lts release version 2.289.1 - -## 3.3.21 -`persistence.mounts` additionally mount to init container to allow custom CA certificate keystore - -## 3.3.18 -Added `controller.overrideArgs` so any cli argument can be passed to the WAR. - -## 3.3.17 -Correct docs on disabling plugin installation - -## 3.3.16 -Support generating `SecretClaim` resources in order to read secrets from HashiCorp Vault into Kubernetes using `kube-vault-controller`. - -## 3.3.15 -Prevent `controller.httpsKeyStore` from improperly being quoted, leading to an invalid location on disk - -## 3.3.14 -Correct docs on disabling plugin installation - -## 3.3.13 -Update plugins - -## 3.3.12 -Add `controller.additionalExistingSecrets` property - -## 3.3.11 -Add support for disabling the Agent listener service via `controller.agentListenerEnabled`. - -## 3.3.10 -Update Jenkins image and appVersion to jenkins lts release version 2.277.4 - -## 3.3.9 -* Change helper template so user defined `agent.jenkinsUrl` value will always be used, if set -* Simplify logic for `jenkinsUrl` and `jenkinsTunnel` generation: always use fully qualified address - -## 3.3.8 -Update Jenkins image and appVersion to jenkins lts release version 2.277.3 - -## 3.3.7 -fix controller-ingress line feed bug - -## 3.3.6 - -Update Git plugin version to v4.7.1 -Update ldap plugin version to v2.5 - -## 3.3.5 - -Use tpl function for environment vars. Fixes [https://github.com/jenkinsci/helm-charts/issues/324] - -## 3.3.4 - -Update Jenkins image and appVersion to jenkins lts release version 2.277.2 - - -## 3.3.3 - -Enable setting `controller.installLatestPlugins` to set whether to download the minimum required version of all dependencies. - -## 3.3.2 - -Add `controller.additionalSecrets` documentation - -## 3.3.1 - -Add `controller.additionalSecrets` property - -## 3.3.0 - -Change default Jenkins image to `jdk11` variant - -## 3.2.6 - -Add missing `controller.jenkinsUrlProtocol` property - -## 3.2.5 - -Add additional metadata `artifacthub.io/images` for artifacthub - -## 3.2.4 -Update Jenkins image and appVersion to jenkins lts release version 2.277.1 -Update Git plugin version to v4.6.0 -Update kubernetes plugin version to v1.29.2 - -## 3.2.3 - -Fix rendering `controller.ingress.path` - -## 3.2.2 - -Added description for `controller.jenkinsUrl` value - -## 3.2.1 - -Enable setting ImagePullSecrets to controller and agent service accounts. - -## 3.2.0 - -Calculate consistent unique agent IDs to be used in pod templates. Fixes [https://github.com/jenkinsci/helm-charts/issues/270] - -## 3.1.15 - -Fix documentation for the kubernetes probes - -## 3.1.14 - -Typo in documentation - -## 3.1.13 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.4 - -## 3.1.12 - -Added GitHub action to automate the updating of LTS releases. - -## 3.1.11 - -Enable setting controller.updateStrategy to change the update strategy for StatefulSet - -## 3.1.10 - -Fixed issue for the AgentListener where it was not possible to attribute a NodePort - -## 3.1.9 - -Upgrade kubernetes plugin to 1.29.0 and CasC plugin to 1.47 - -## 3.1.8 - -Fix init scripts config map name - -## 3.1.7 - -Fix missing newline when `httpsKeyStore` is enabled - -## 3.1.6 - -Mount controller init scripts from ConfigMap - -## 3.1.5 - -Fix `namespaceOverride` not applied when loading JCasC - -## 3.1.4 - -Update Git plugin version to v4.5.2 - -## 3.1.3 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.3 - -## 3.1.2 - -Enable setting maxRequestsPerHostStr to change the max concurrent connections to Kubernetes API - -## 3.1.1 - -Update Jenkins image and appVersion to jenkins lts release version 2.263.2 - -## 3.1.0 - -* Added `.Values.controller.podSecurityContextOverride` and `.Values.backup.podSecurityContextOverride`. -* Added simple default values tests for `jenkins-backup-cronjob.yaml`. - -## 3.0.14 - -Enable to only backup job folder instead of whole jenkins - -## 3.0.13 - -Improve Documentation around JCasc and Custom Image - -## 3.0.12 - -Added GitHub Action testing on Kind 1.16, 1.17, 1.18, 1.19 & 1.20 - -## 3.0.11 - -Fixes & unit tests for Ingress resources on Kubernetes 1.19 and above - -## 3.0.10 - -Ingress resources on Kubernetes 1.19 (or above) are created with the version `networking.k8s.io/v1` - -## 3.0.9 - -Added support for backing up to Azure Blob Storage. - -## 3.0.8 - -* Typo in documentation - -## 3.0.7 - -* Add support for setting default agent workspaceVolume - -## 3.0.6 - -Use 2.263.1 image - -## 3.0.5 - -* Update appVersion to reflect new jenkins lts release version 2.263.1 - -## 3.0.4 - -* Fix documentation for additional secret mounts - -## 3.0.3 - -* Update `README.md` with explanation on how to mount additional secrets - -## 3.0.2 - -* Fix `.Values.controller.tolerations` and `.Values.controller.nodeSelector` variable names in templates\jenkins-backup-cronjob.yaml - -## 3.0.1 - -* added 'runAsNonroot' to security context - -## 3.0.0 - -* Chart uses StatefulSet instead of Deployment -* XML configuration was removed in favor of JCasC -* chart migrated to helm 3.0.0 (apiVersion v2) -* offending terms have been removed -* values have been renamed and re-ordered to make it easier to use -* already deprecated items have been removed -* componentName for the controller is now `jenkins-controller` -* componentName for the agent is now `jenkins-agent` -* container names are now - * `init` for the init container which downloads Jenkins plugins - * `jenkins` for the Jenkins controller - * `config-reload` for the sidecar container which automatically reloads JCasC -* Updated UI tests to use official `bats/bats` image instead of `dduportal/bats` - -For migration instructions from previous versions and additional information check README.md. - -## 2.19.0 - -* Use lts version 2.249.3 -* Update kubernetes, workflow-aggregator, git and configuration-as-code plugins. -* Fail apply_config.sh script if an error occurs. - -## 2.18.2 - -Fix: `master.javaOpts` issue with quoted values - -## 2.18.1 - -Recommend installing plugins in custom image - -## 2.18.0 - -Removed /tmp volume. Making /tmp a volume causes permission issues with jmap/jstack on certain Kubernetes clusters - -## 2.17.1 - -Fix location of jenkins.war file. -It is located in `/usr/share/jenkins/jenkins.war` and can be fonfigured via `master.jenkinsWar`. - -## 2.17.0 - -Add support for plugin-installation-manager-tool - -## 2.16.0 - -Added Startup probe for Jenkins pod when Kubernetes cluster is 1.16 or newer - -## 2.15.5 - -scriptApproval is taken into account when enableXmlConfig is false. - -## 2.15.4 - -Add Tilt support for easier helm chart development. - -## 2.15.3 - -Fix error on missing `ingress.paths` value - -## 2.15.2 - -Added documentation for ingress and jenkins URL - -## 2.15.1 - -Fix priorityClassName entry in values.yaml file - -## 2.15.0 - -Added support for disabling the helm.sh/chart annotation - -## 2.14.0 - -Added support for annotations in podTemplates - -## 2.13.2 - -Add nodeSelector in the backup pod -Fix tolerations in the backup pod - -## 2.13.1 - -Update list of maintainers - -## 2.13.0 - -Added Support for websockets in the default Jcasc config -Added trailing slash to JENKINS_URL env var - -## 2.12.2 - -Added unit tests for most resources in the Helm chart. - -## 2.12.1 - -Helm chart README update - -## 2.12.0 - -Add option to configure securityContext capabilities - -## 2.11.0 - -Added configurable security context for jenkins backup CronJob and annotations to its serviceaccount. - -## 2.10.0 - -Make activeDeadlineSeconds for backup job configurable - -## 2.9.0 - -Make namespace of PrometheusRule configurable - -## 2.8.2 - -Bumped configuration-as-code plugin version from 1.41 to 1.43. -See [configuration-as-code plugin issue #1478](https://github.com/jenkinsci/configuration-as-code-plugin/issues/1478) - -## 2.8.1 - -Fix indentation of JAVA_OPTS - -## 2.8.0 - -Add support for helm unittest and include first tests - -## 2.7.2 - -Target port of container `jenkins-sc-config` taken the value from values.yaml. - -## 2.7.0 - -Add a secondary ingress template for those who want a second ingress with different labels or annotations or whatever else. - -Example: You want /github-webhook to be on a public ingress, while the main Jenkins intance to be on a private locked down ingress. - -## 2.6.5 - -Update configScripts example - -## 2.6.4 - -Add timja as a maintainer - -## 2.6.3 - -Update k8s-sidecar image to 0.1.193 - -## 2.6.2 - -Only mount empty dir secrets-dir if either `master.enableXmlConfig` or `master.secretsFilesSecret` is set -Fixes #19 - -## 2.6.1 Do not render empty JCasC templates - -## 2.6.0 First release in jenkinsci GitHub org - -Updated README for new location - -## 2.5.2 - -Fix as per JENKINS-47112 - -## 2.5.1 - -Support Jenkins Resource Root URL - -## 2.5.0 - -Add an option to specify that Jenkins master should be initialized only once, during first install. - -## 2.4.1 - -Reorder README parameters into sections to facilitate chart usage and maintenance - -## 2.4.0 Update default agent image - -`jenkins/jnlp-slave` is deprected and `jenkins/inbound-agent` should be used instead. -Also updated it to newest version (4.3-4). - -## 2.3.3 correct templating of master.slaveJenkinsUrl - -Fixes #22708 - -## 2.3.2 Fix wrong value for overwritePluginsFromImage - -Fixes #23003 -Fixes #22633 - -Also fixes indentation for #23114 - -## 2.3.1 - -Always mount {{ .Values.master.jenkinsRef }}/secrets/ directory. Previous it -was mounted only when `master.enableXmlConfig` was enabled. - -## 2.3.0 - -Add an option to specify pod based on labels that can connect to master if NetworkPolicy is enabled - -## 2.2.0 increase retry for config auto reload - -Configure `REQ_RETRY_CONNECT` to `10` to give Jenkins more time to start up. - - -Value can be configured via `master.sidecars.configAutoReload.reqRetryConnect` - -## 2.1.2 updated README - -## 2.1.1 update credentials-binding plugin to 1.23 - -## 2.1.0 - -Add support to set `runAsUser` and `runAsGroup` for `agent`. - -## 2.0.1 - -Only render authorizationStrategy and securityRealm when values are set. - -## 2.0.0 Configuration as Code now default + container does not run as root anymore - -The README contains more details for this update. -Please note that the updated values contain breaking changes. - -## 1.27.0 Update plugin versions & sidecar container - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.25.3 | 1.25.7 | -| workflow-job | 2.38 | 2.39 | -| credentials-binding | 1.21 | 1.22 | -| configuration-as-code | 1.39 | 1.41 | - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.132` to `kiwigrid/k8s-sidecar:0.1.144` - -## 1.26.0 - -Add support to override `workingDir` for default pod template - -## 1.25.0 - -Add support for installing plugins in addition to the chart's default plugins via `master.additionalPlugins` - -## 1.24.0 - -Allow configuration of yamlMergeStrategy via `agent.yamlMergeStrategy` - -## 1.23.2 - -In the `jenkins.xml.podTemplate` helper function, allow templating of all string values under `agent.volumes` except `type` by rendering them with the `tpl` function - -## 1.23.1 - -Added auto detection for Ingress API version - -## 1.23.0 - -Allow to use an existing secret for the jenkins admin credentials - -## 1.22.0 - -Add support for UI security in the default JCasC via `master.JCasC.securityRealm` and `master.JCasC.authorizationStrategy` which deny anonymous access by default - -## 1.21.3 - -Render `agent.envVars` in kubernetes pod template JCasC - -## 1.21.2 - -Cleanup `agent.yamlTemplate` rendering in kubernetes pod template XML configuration - -## 1.21.1 - -Render `agent.nodeSelector` in the kubernetes pod template JCasC - -## 1.21.0 - -Add support for overriding Ingress paths via `master.ingress.paths` - -## 1.20.0 - -Add the following options for configuring the Kubernetes plugin. - -- master.slaveDefaultsProviderTemplate -- master.slaveJenkinsUrl -- master.slaveJenkinsTunnel -- master.slaveConnectTimeout -- master.slaveReadTimeout - -## 1.19.0 - -Add support for disabling remember me via `master.disableRememberMe` -Add support for using a different markup formatter via `master.markupFormatter` - -## 1.18.1 - -Add support for executor mode configuraton with `master.executorMode`. - -## 1.18.0 Make installation of configuration-as-code plugin explicit - -Instead of configuring the configuration-as-code plugin version via -`master.JCasC.pluginVersion` it is now installed via `master.installPlugins` - -## 1.17.2 - -Allow templating of `serviceAccount.annotations` and `serviceAccountAgent.annotations` by rendering them with the `tpl` function - -## 1.17.1 - -Add support for Persistent Volume Claim (PVC) in `agent.volumes` - -## 1.17.0 - -Render `agent.volumes` in kubernetes pod template JCasC - -## 1.16.2 - -Reverts 1.16.1 as it introduced an error #22047 - -## 1.16.1 - -Fixed a bug with master.runAsUser variable due to use wrong type for comparison. - -## 1.16.0 - -Add `master.overwritePluginsFromImage` to allow support for jenkins plugins installed in the master image to persist. - -## 1.15.0 Update plugin versions & sidecar container - -| plugin | old version | new version | -| --------------------- | ----------- | ----------- | -| kubernetes | 1.25.1 | 1.25.3 | -| workflow-job | 2.36 | 2.38 | -| git | 4.2.0 | 4.2.2 | -| configuration-as-code | 1.36 | 1.39 | - -configAutoReload container updated from `kiwigrid/k8s-sidecar:0.1.20` to `kiwigrid/k8s-sidecar:0.1.132` - -## 1.14.0 - -support auto-reload container environment variables configuration - -## 1.13.3 - -Fix wrong indent in tolerations - -## 1.13.2 - -Add support for custom ClusterIP - -## 1.13.1 - -Fix `agent.yamlTemplate` rendering in kubernetes pod template JCasC - -## 1.13.0 - -Add `master.networkPolicy.internalAgents` and `master.networkPolicy.externalAgents` stanzas to fine grained controls over where internal/external agents can connect from. Internal ones are allowed based on pod labels and (optionally) namespaces, and external ones are allowed based on IP ranges. - -## 1.12.0 Support additional agents - -Add support for easy configuration of additional agents which inherit values from `agent`. - -## 1.11.3 - -Update the kubernetes plugin from 1.24.1 to 1.25.1 and grant 'watch' permission to 'events' which is required since this plugin version. - -## 1.11.2 Configure agent.args in values.yaml - -## 1.11.1 Support for master.additionalConfig - -Fixed a bug with jenkinsHome variable in range block when master.additionalConfig is set - Helm cannot evaluate field Values in type interface {}. - -## 1.11.0 Add support for configuring custom pod templates - -Add `agent.podTemplates` option for declaring custom pod templates in the default configured kubernetes cloud. - -## 1.10.1 Only copy JCasC files if there are any - -The chart always tried to copy Configuration as Code configs even if there are none. That resulted in an error which is resolved with this. - -## 1.10.0 Remove configuration-as-code-support plugins - -In recent version of configuration-as-code-plugin this is no longer necessary. - -## 1.9.24 - -Update JCasC auto-reload docs and remove stale ssh key references from version "1.8.0 JCasC auto reload works without ssh keys" - -## 1.9.23 Support jenkinsUriPrefix when JCasC is enabled - -Fixed a bug in the configuration as code reload URL, where it wouldn't work with a jenkinsUriPrefix set. - -## 1.9.22 - -Add `master.jenkinsHome` and `master.jenkinsRef` options to use docker images derivates from Jenkins - -## 1.9.21 - -Add `master.terminationGracePeriodSeconds` option - -## 1.9.20 - -Update default plugins - -- kubernetes:1.24.1 -- workflow-job:2.36 -- workflow-aggregator:2.6 -- credentials-binding:1.21 -- git:4.2.0 -- configuration-as-code:1.36 - -## 1.9.19 - -Update docs for Helm 3 - -## 1.9.18 - -Make `jenkins-home` attachable to Azure Disks without pvc - -```yaml - volumes: - - name: jenkins-home - azureDisk: - kind: Managed - diskName: myAKSDisk - diskURI: /subscriptions//resourceGroups/MC_myAKSCluster_myAKSCluster_eastus/providers/Microsoft.Compute/disks/myAKSDisk -``` - -## 1.9.16 - -Fix PodLabel for NetworkPolicy to work if enabled - -## 1.9.14 - -Properly fix case sense in `Values.master.overwriteConfig` in `config.yaml` - -## 1.9.13 - -Fix case sense in `Values.master.overwriteConfig` in `config.yaml` - -## 1.9.12 - -Scriptapprovals are overwritten when overwriteConfig is enabled - -## 1.9.10 - -Added documentation for `persistence.storageClass`. - -## 1.9.9 -Make `master.deploymentAnnotation` configurable. - -## 1.9.8 - -Make `agent.slaveConnectTimeout` configurable: by increasing this value Jenkins will not cancel&ask k8s for a pod again, while it's on `ContainerCreating`. Useful when you have big images or autoscaling takes some time. - -## 1.9.7 Update plugin versions - -plugin | old version | new version ---------------------- | ----------- | ---------- -kubernetes | 1.18.2 | 1.21.2 -workflow-job | 2.33 | 2.36 -credentials-binding | 1.19 | 1.20 -git | 3.11.0 | 4.0.0 -configuration-as-code | 1.27 | 1.32 - -## 1.9.6 - -Enables jenkins to use keystore inorder to have native ssl support #17790 - -## 1.9.5 Enable remoting security - -`Manage Jenkins` -> `Configure Global Security` -> `Enable Agent → Master Access Control` is now enabled via configuration as code plugin - -## 1.9.4 Option to set existing secret with Google Application Default Credentials - -Google application credentials are kept in a file, which has to be mounted to a pod. You can set `gcpcredentials` in `existingSecret` as follows: - -```yaml - existingSecret: - jenkins-service-account: - gcpcredentials: application_default_credentials.json -``` - -Helm template then creates the necessary volume mounts and `GOOGLE_APPLICATION_CREDENTIALS` environmental variable. - -## 1.9.3 Fix `JAVA_OPTS` when config auto-reload is enabled - -## 1.9.2 Add support for kubernetes-credentials-provider-plugin - -[kubernetes-credentials-provider-plugin](https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/) needs permissions to get/watch/list kubernetes secrets in the namespaces where Jenkins is running. - -The necessary role binding can be created using `rbac.readSecrets` when `rbac.create` is `true`. - -To quote from the plugin documentation: - -> Because granting these permissions for secrets is not something that should be done lightly it is highly advised for security reasons that you both create a unique service account to run Jenkins as, and run Jenkins in a unique namespace. - -Therefor this is disabled by default. - -## 1.9.1 Update kubernetes plugin URL - -## 1.9.0 Change default serviceType to ClusterIP - -## 1.8.2 - -Revert fix in `1.7.10` since direct connection is now disabled by default. - -## 1.8.1 - -Add `master.schedulerName` to allow setting a Kubernetes custom scheduler - -## 1.8.0 JCasC auto reload works without ssh keys - -We make use of the fact that the Jenkins Configuration as Code Plugin can be triggered via http `POST` to `JENKINS_URL/configuration-as-code/reload`and a pre-shared key. -The sidecar container responsible for reloading config changes is now `kiwigrid/k8s-sidecar:0.1.20` instead of it's fork `shadwell/k8s-sidecar`. - -References: - -- [Triggering Configuration Reload](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md) -- [kiwigrid/k8s-sidecar](https://hub.docker.com/r/kiwigrid/k8s-sidecar) - -`master.sidecars.configAutoReload.enabled` now works using `casc.reload.token` - -## 1.7.10 - -Disable direct connection in default configuration (when kubernetes plugin version >= 1.20.2). -Note: In case direct connection is going to be used `jenkins/jnlp-slave` needs to be version `3.35-5` or newer. - -## 1.7.9 - -Prevented Jenkins Setup Wizard on new installations - -## 1.7.8 - -Extend extraPorts to be opened on the Service object, not just the container. - -## 1.7.7 - -Add persistentvolumeclaim permission to the role to support new dynamic pvc workspaces. - -## 1.7.6 - -Updated `master.slaveKubernetesNamespace` to parse helm templates. -Defined an sensible empty value to the following variables, to silence invalid warnings: - -- master.extraPorts -- master.scriptApproval -- master.initScripts -- master.JCasC.configScripts -- master.sidecars.other -- agent.envVars -- agent.volumes - -## 1.7.5 - -Fixed an issue where the JCasC won't run if JCasC auto-reload is enabled [issue #17135](https://github.com/helm/charts/issues/17135) - -## 1.7.4 - -Comments out JCasC example of jenkins.systemMessage so that it can be used by end users. Previously, an attempt to set systemMessage causes Jenkins to startup, citing duplicate JCasC settings for systemMessage [issue #13333](https://github.com/helm/charts/issues/13333) - -## 1.7.2 - -Update kubernetes-plugin to version 1.18.2 which fixes frequently encountered [JENKINS-59000](https://issues.jenkins-ci.org/plugins/servlet/mobile#issue/JENKINS-59000) - -## 1.7.1 - -Update the default requirements for jenkins-agent to 512Mi which fixes frequently encountered [issue #3723](https://github.com/helm/charts/issues/3723) - -## 1.7.0 - -[Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) default configuration can now be enabled via `master.JCasC.defaultConfig`. - -JCasC default configuration includes: - -- Jenkins URL -- Admin email `master.jenkinsAdminEmail` -- crumbIssuer -- disableRememberMe: false -- mode: NORMAL -- numExecutors: {{ .Values.master.numExecutors }} -- projectNamingStrategy: "standard" -- kubernetes plugin - - containerCapStr via `agent.containerCap` - - jenkinsTunnel - - jenkinsUrl - - maxRequestsPerHostStr: "32" - - name: "kubernetes" - - namespace - - serverUrl: "https://kubernetes.default" - - template - - containers - - alwaysPullImage: `agent.alwaysPullImage` - - args - - command - - envVars - - image: `agent.image:agent.imageTag` - - name: `.agent.sideContainerName` - - privileged: `.agent.privileged` - - resourceLimitCpu: `agent.resources.limits.cpu` - - resourceLimitMemory: `agent.resources.limits.memory` - - resourceRequestCpu: `agent.resources.requests.cpu` - - resourceRequestMemory: `agent.resources.requests.memory` - - ttyEnabled: `agent.TTYEnabled` - - workingDir: "/home/jenkins" - - idleMinutes: `agent.idleMinutes` - - instanceCap: 2147483647 - - imagePullSecrets: - - name: `.agent.imagePullSecretName` - - label - - name - - nodeUsageMode: "NORMAL" - - podRetention: `agent.podRetention` - - serviceAccount - - showRawYaml: true - - slaveConnectTimeoutStr: "100" - - yaml: `agent.yamlTemplate` - - yamlMergeStrategy: "override" -- security: - - apiToken: - - creationOfLegacyTokenEnabled: false - - tokenGenerationOnCreationEnabled: false - - usageStatisticsEnabled: true - -Example `values.yaml` which enables JCasC, it's default config and configAutoReload: - -```yaml -master: - JCasC: - enabled: true - defaultConfig: true - sidecars: - configAutoReload: - enabled: true -``` - -add master.JCasC.defaultConfig and configure location - -- JCasC configuration is stored in template `jenkins.casc.defaults` - so that it can be used in `config.yaml` and `jcasc-config.yaml` - depending on if configAutoReload is enabled or not - -- Jenkins Location (URL) is configured to provide a startin point - for the config - -## 1.6.1 - -Print error message when `master.sidecars.configAutoReload.enabled` is `true`, but the admin user can't be found to configure the SSH key. - -## 1.6.0 - -Add support for Google Cloud Storage for backup CronJob (migrating from nuvo/kube-tasks to maorfr/kube-tasks) - -## 1.5.9 - -Fixed a warning when sidecar resources are provided through a parent chart or override values - -## 1.5.8 - -Fixed an issue when master.enableXmlConfig is set to false: Always mount jenkins-secrets volume if secretsFilesSecret is set (#16512) - -## 1.5.7 - -added initial changelog (#16324) -commit: cee2ebf98 - -## 1.5.6 - -enable xml config misspelling (#16477) -commit: a125b99f9 - -## 1.5.5 - -Jenkins master label (#16469) -commit: 4802d14c9 - -## 1.5.4 - -add option enableXmlConfig (#16346) -commit: 387d97a4c - -## 1.5.3 - -extracted "jenkins.URL" into template (#16347) -commit: f2fdf5332 - -## 1.5.2 - -Fix backups when deployment has custom name (#16279) -commit: 16b89bfff - -## 1.5.1 - -Ability to set custom namespace for ServiceMonitor (#16145) -commit: 18ee6cf01 - -## 1.5.0 - -update Jenkins plugins to fix security issue (#16069) -commit: 603cf2d2b - -## 1.4.3 - -Use fixed container name (#16068) -commit: b3e4b4a49 - -## 1.4.2 - -Provide default job value (#15963) -commit: c462e2017 - -## 1.4.1 - -Add Jenkins backendconfig values (#15471) -commit: 7cc9b54c7 - -## 1.4.0 - -Change the value name for docker image tags - standartise to helm preferred value name - tag; this also allows auto-deployments using weaveworks flux (#15565) -commit: 5c3d920e7 - -## 1.3.6 - -jenkins deployment port should be target port (#15503) -commit: 83909ebe3 - -## 1.3.5 - -Add support for namespace specification (#15202) -commit: e773201a6 - -## 1.3.4 - -Adding sub-path option for scraping (#14833) -commit: e04021154 - -## 1.3.3 - -Add existingSecret to Jenkins backup AWS credentials (#13392) -commit: d9374f57d - -## 1.3.2 - -Fix JCasC version (#14992) -commit: 26a6d2b99 - -## 1.3.1 - -Update affinity for a backup cronjob (#14886) -commit: c21ed8331 - -## 1.3.0 - -only install casc support plugin when needed (#14862) -commit: a56fc0540 - -## 1.2.2 - -DNS Zone customization (#14775) -commit: da2910073 - -## 1.2.1 - -only render comment if configAutoReload is enabled (#14754) -commit: e07ead283 - -## 1.2.0 - -update plugins to latest version (#14744) -commit: 84336558e - -## 1.1.24 - -add example for EmptyDir volume (#14499) -commit: cafb60209 - -## 1.1.23 - -check if installPlugins is set before using it (#14168) -commit: 1218f0359 - -## 1.1.22 - -Support servicemonitor and alerting rules (#14124) -commit: e15a27f48 - -## 1.1.21 - -Fix: healthProbe timeouts mapping to initial delay (#13875) -commit: 825b32ece - -## 1.1.20 - -Properly handle overwrite config for additional configs (#13915) -commit: 18ce9b558 - -## 1.1.18 - -update maintainer (#13897) -commit: 223002b27 - -## 1.1.17 - -add apiVersion (#13795) -commit: cd1e5c35a - -## 1.1.16 - -allow changing of the target port to support TLS termination sidecar (#13576) -commit: a34d3bbcc - -## 1.1.15 - -fix wrong pod selector in jenkins-backup (#13542) -commit: b5df4fd7e - -## 1.1.14 - -allow templating of customInitContainers (#13536) -commit: d1e1421f4 - -## 1.1.13 - -fix #13467 (wrong deprecation message) (#13511) -commit: fbe28fa1c - -## 1.1.12 - -Correct customInitContainers Name example. (#13405) -commit: 6c6e40405 - -## 1.1.11 - -fix master.runAsUser, master.fsGroup examples (#13389) -commit: 2d7e5bf72 - -## 1.1.10 - -Ability to specify raw yaml template (#13319) -commit: 77aaa9a5f - -## 1.1.9 - -correct NOTES.txt - use master.ingress.hostname (#13318) -commit: b08ef6280 - -## 1.1.8 - -explain how to upgrade major versions (#13273) -commit: e7617a97e - -## 1.1.7 - -Add support for idleMinutes and serviceAccount (#13263) -commit: 4595ee033 - -## 1.1.6 - -Use same JENKINS_URL no matter if slaves use different namespace (#12564) -commit: 94c90339f - -## 1.1.5 - -fix deprecation checks (#13224) -commit: c7d2f8105 - -## 1.1.4 - -Fix issue introduced in #13136 (#13232) -commit: 0dbcded2e - -## 1.1.3 - -fix chart errors (#13197) -commit: 692a1e3da - -## 1.1.2 - -correct selector for jenkins pod (#13200) -commit: 4537e7fda - -## 1.1.1 - -Fix rendering of customInitContainers and lifecycle for Jenkins helm chart (#13189) -commit: e8f6b0ada - -## 1.1.0 - -Add support for openshift route in jenkins (#12973) -commit: 48c58a430 - -## 1.0.0 - -helm chart best practices (#13136) -commit: b02ae3f48 - -### Breaking changes - -- values have been renamed to follow helm chart best practices for naming conventions so - that all variables start with a lowercase letter and words are separated with camelcase - -- all resources are now using recommended standard labels - - -As a result of the label changes also the selectors of the deployment have been updated. -Those are immutable so trying an updated will cause an error like: - -```text -Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-master", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable -``` - -In order to upgrade, delete the Jenkins Deployment before upgrading: - -```console -kubectl delete deploy jenkins -``` - -## 0.40.0 - -Allow to override jenkins location protocol (#12257) -commit: 18a830626 - -## 0.39.0 - -Add possibility to add custom init-container and lifecycle for master-container (#13062) -commit: 14d043593 - -## 0.38.0 - -Support `priorityClassName` on Master Deployment (#13069) -commit: e896c62bc - -## 0.37.3 - -Add support for service account annotations in jenkins (#12969) -commit: b22774e2f - -## 0.37.2 - -fix: add hostName to ingress in values.yaml (#12946) -commit: 041045e9b - -## 0.37.1 - -Update to match actual defaults in value.yaml (#12904) -commit: 73b6d37eb - -## 0.37.0 - -Support multiple Jenkins instances in same namespace (#12748) -commit: 32ff2f343 - -## 0.36.5 - -Fix wrong comment in values.yaml (#12761) -commit: 9db8ced23 - -## 0.36.4 - -Re-add value for Ingress API Version (#12753) -commit: ecb7791b5 - -## 0.36.3 - -allow templating of volumes (#12734) -commit: adbda2ca6 - -## 0.36.2 - -Fix self-introduced whitespace bug (#12528) -commit: eec1678eb - -## 0.36.1 - -Add flag to overwrite jobs definition from values.yaml (#12427) -commit: fd349b2fc - -## 0.36.0 - -Replace OwnSshKey with AdminSshKey (#12140) (#12466) -commit: 80a8c9eb6 - -## 0.35.2 - -add note for breaking changes (#12203) -commit: e779c5a54 - -## 0.35.1 - -Allow Jenkins to run with READONLYROOTFS psp (#12338) -commit: 7c419e191 - -## 0.35.0 - -Jenkins OverwriteConfig setting also overwrites init scripts (#9468) -commit: 501335b76 - -## 0.34.1 - -Fix typo on hostname variable (#12156) -commit: 3d337d8dd - -## 0.34.0 - -Allow ingress without host rule (#11960) -commit: ddc966d1e - -## 0.33.2 - -Improve documentation - clarify that rbac is needed for autoreload (#11739) -commit: 9d75a5c34 - -## 0.33.1 - -use object for rollingUpdate (#11909) -commit: cb9cf21e8 - -## 0.33.0 - -Add hostAliases (#11701) -commit: 0b89e1094 - -## 0.32.10 - -Fix slave jnlp port always being reset when container is restarted (#11685) -commit: d7d51797b - -## 0.32.9 - -add ingress Hostname an ApiVersion to docs (#11576) -commit: 4d3e77137 - -## 0.32.8 - -Support custom master pod labels in deployment (#9714) (#11511) -commit: 9de96faa0 - -## 0.32.7 - -Fix Markdown syntax in README (#11496) -commit: a32221a95 - -## 0.32.6 - -Added custom labels on jenkins ingress (#11466) -commit: c875d2b9b - -## 0.32.5 - -fix typo in default jenkins agent image fixes #11356 (#11463) -commit: 30adb9a91 - -## 0.32.4 - -fix incorrect Deployment when using sidecars (#11413) -commit: 362b4cef8 - -## 0.32.3 - -[]: #10131 (#11411) -commit: 49cb72055 - -## 0.32.2 - -Option to expose the slave listener port as host port (#11187) -commit: 2f85a9663 - -## 0.32.1 - -Updating Jenkins deployment fails appears rollingUpdate needs to be (#11166) -commit: 07fc9dbde - -## 0.32.0 - -Merge Sidecard configs (#11339) -commit: 3696090b9 - -## 0.31.0 - -Add option to overwrite plugins (#11231) -commit: 0e9aa00a5 - -## 0.30.0 - -Added slave Pod env vars (#8743) -commit: 1499f6608 - -## 0.29.3 - -revert indentation to previous working version (#11293) -commit: 61662f17a - -## 0.29.2 - -allow running sidecar containers for Jenkins master (#10950) -commit: 9084ce54a - -## 0.29.1 - -Indent lines related to EnableRawHtmlMarkupFormatter (#11252) -commit: 20b310c08 - -## 0.29.0 - -Jenkins Configuration as Code (#9057) -commit: c3e8c0b17 - -## 0.28.11 - -Allow to enable OWASP Markup Formatter Plugin (#10851) -commit: 9486e5ddf - -## 0.28.10 - -Fixes #1341 -- update Jenkins chart documentation (#10290) -commit: 411c81cd0 - -## 0.28.9 - -Quoted JavaOpts values (#10671) -commit: 926a843a8 - -## 0.28.8 - -Support custom labels in deployment (#9714) (#10533) -commit: 3e00b47fa - -## 0.28.7 - -separate test resources (#10597) -commit: 7b7ae2d11 - -## 0.28.6 - -allow customizing livenessProbe periodSeconds (#10534) -commit: 3c94d250d - -## 0.28.5 - -Add role kind option (#8498) -commit: e791ad124 - -## 0.28.4 - -workaround for busybox's cp (Closes: #10471) (#10497) -commit: 0d51a4187 - -## 0.28.3 - -fix parsing java options (#10140) -commit: 9448d0293 - -## 0.28.2 - -Fix job definitions in standard values.yaml (#10184) -commit: 6b6355ae7 - -## 0.28.1 - -add numExecutors as a variable in values file (#10236) -commit: d5ea2050f - -## 0.28.0 - -various (#10223) -commit: e17d2a65d - -## 0.27.0 - -add backup cronjob (#10095) -commit: 863ead8db - -## 0.26.2 - -add namespace flag for port-forwarding in jenkins notes (#10399) -commit: 846b589a9 - -## 0.26.1 - -- fixes #10267 when executed with helm template - otherwise produces an invalid template. (#10403) - commit: 266f9d839 - -## 0.26.0 - -Add subPath for jenkins-home mount (#9671) -commit: a9c76ac9b - -## 0.25.1 - -update readme to indicate the correct image that is used by default (#9915) -commit: 6aba9631c - -## 0.25.0 - -Add ability to manually set Jenkins URL (#7405) -commit: a0178fcb4 - -## 0.24.0 - -Make AuthorizationStrategy configurable (#9567) -commit: 06545b226 - -## 0.23.0 - -Update Jenkins public chart (#9296) -commit: 4e5f5918b - -## 0.22.0 - -allow to override jobs (#9004) -commit: dca9f9ab9 - -## 0.21.0 - -Simple implementation of the option to define the ingress path to the jenkins service (#8101) -commit: 013159609 - -## 0.20.2 - -Cosmetic change to remove necessity of changing "appVersion" for every new LTS release (#8866) -commit: f52af042a - -## 0.20.1 - -Added ExtraPorts to open in the master pod (#7759) -commit: 78858a2fb - -## 0.19.1 - -Fix component label in NOTES.txt ... (#8300) -commit: c5494dbfe - -## 0.19.0 - -Kubernetes 1.9 support as well as automatic apiVersion detection (#7988) -commit: 6853ad364 - -## 0.18.1 - -Respect SlaveListenerPort value in config.xml (#7220) -commit: 0a5ddac35 - -## 0.18.0 - -Allow replacement of Jenkins config with configMap. (#7450) -commit: c766da3de - -## 0.17.0 - -Add option to allow host networking (#7530) -commit: dc2eeff32 - -## 0.16.25 - -add custom jenkins labels to the build agent (#7167) -commit: 3ecde5dbf - -## 0.16.24 - -Move kubernetes and job plugins to latest versions (#7438) -commit: 019e39456 - -## 0.16.23 - -Add different Deployment Strategies based on persistence (#6132) -commit: e0a20b0b9 - -## 0.16.22 - -avoid lint errors when adding Values.Ingress.Annotations (#7425) -commit: 99eacc854 - -## 0.16.21 - -bump appVersion to reflect new jenkins lts release version 2.121.3 (#7217) -commit: 296df165d - -## 0.16.20 - -Configure kubernetes plugin for including namespace value (#7164) -commit: c0dc6cc48 - -## 0.16.19 - -make pod retention policy setting configurable (#6962) -commit: e614c1033 - -## 0.16.18 - -Update plugins version (#6988) -commit: bf8180018 - -## 0.16.17 - -Add Master.AdminPassword in README (#6987) -commit: 13e754ad7 - -## 0.16.16 - -Added jenkins location configuration (#6573) -commit: 79de7026c - -## 0.16.15 - -use generic env var, not oracle specific env var (#6116) -commit: 6084ab4a4 - -## 0.16.14 - -Allow to specify resource requests and limits on initContainers (#6723) -commit: 942a33b1a - -## 0.16.13 - -Added support for NodePort service type for jenkens agent svc (#6571) -commit: 89a213c2b - -## 0.16.12 - -Added ability to configure multiple LoadBalancerSourceRanges (#6243) -commit: 01604ddbc - -## 0.16.11 - -Removing ContainerPort configuration as at the moment it does not work when you change this setting (#6411) -commit: e1c0468bd - -## 0.16.9 - -Fix jobs parsing for configmap by adding toYaml to jobs.yaml template (#3747) -commit: b2542a123 - -## 0.16.8 - -add jenkinsuriprefix in healthprobes (#5737) -commit: 435d7a7b9 - -## 0.16.7 - -Added the ability to switch from ClusterRoleBinding to RoleBinding. (#6190) -commit: dde03ede0 - -## 0.16.6 - -Make jenkins master pod security context optional (#6122) -commit: 63653fd59 - -## 0.16.5 - -Rework resources requests and limits (#6077) (#6077) -commit: e738f99d0 - -## 0.16.4 - -Add jenkins master pod annotations (#6313) -commit: 5e7325721 - -## 0.16.3 - -Split Jenkins readiness and liveness probe periods (#5704) -commit: fc6100c38 - -## 0.16.1 - -fix typo in jenkins README (#5228) -commit: 3cd3f4b8b - -## 0.16.0 - -Inherit existing plugins from Jenkins image (#5409) -commit: fd93bff82 - -## 0.15.1 - -Allow NetworkPolicy.ApiVersion and Master.Ingress.ApiVersion to Differ (#5103) -commit: 78ee4ba15 - -## 0.15.0 - -Secure Defaults (#5026) -commit: 0fe90b520 - -## 0.14.6 - -Wait for up to 2 minutes before failing liveness check (#5161) -commit: 2cd3fc481 - -## 0.14.5 - -correct ImageTag setting (#4371) -commit: 8ea04174d - -## 0.14.4 - -Update jenkins/README.md (#4559) -commit: d4e6352dd - -## 0.14.3 - -Bump appVersion (#4177) -commit: 605d3d441 - -## 0.14.2 - -Master.InitContainerEnv: Init Container Env Vars (#3495) -commit: c64abe27d - -## 0.14.1 - -Allow more configuration of Jenkins agent service (#4028) -commit: fc82f39b2 - -## 0.14.0 - -Add affinity settings (#3839) -commit: 64e82fa6a - -## 0.13.5 - -bump test timeouts (#3886) -commit: cd05dd99c - -## 0.13.4 - -Add OWNERS to jenkins chart (#3881) -commit: 1c106b9c8 - -## 0.13.3 - -Add fullnameOverride support (#3705) -commit: ec8080839 - -## 0.13.2 - -Update README.md (#3638) -commit: f6d274c37 - -## 0.13.1 - -Lower initial healthcheck delay (#3463) -commit: 9b99db67c - -## 0.13.0 - -Provision credentials.xml, secrets files and jobs (#3316) -commit: d305c5961 - -## 0.12.1 - -fix the default value for nodeUsageMode. (#3299) -commit: b68d19516 - -## 0.12.0 - -Recreate pods when CustomConfigMap is true and there are changes to the ConfigMap (which is how the vanilla chart works) (#3181) -commit: 86d29f804 - -## 0.11.1 - -Optionally adds liveness and readiness probes to jenkins (#3245) -commit: 8b9aa73ee - -## 0.11.0 - -Feature/run jenkins as non root user (#2899) -commit: 8918f4175 - -## 0.10.3 - -template the version to keep them synced (#3084) -commit: 35e7fa49a - -## 0.10.2 - -Update Chart.yaml -commit: e3e617a0b - -## 0.10.1 - -Merge branch 'master' into jenkins-test-timeout -commit: 9a230a6b1 - -Double retry count for Jenkins test -commit: 129c8e824 - -Jenkins: Update README | Master.ServiceAnnotations (#2757) -commit: 6571810bc - -## 0.10.0 - -Update Jenkins images and plugins (#2496) -commit: 2e2622682 - -## 0.9.4 - -Updating to remove the `.lock` directory as well (#2747) -commit: 6e676808f - -## 0.9.3 - -Use variable for service port when testing (#2666) -commit: d044f99be - -## 0.9.2 - -Review jenkins networkpolicy docs (#2618) -commit: 49911e458 - -Add image pull secrets to jenkins templates (#1389) -commit: 4dfae21fd - -## 0.9.1 - -Added persistent volume claim annotations (#2619) -commit: ac9e5306e - -Fix failing CI lint (#2758) -commit: 26f709f0e - -## 0.9.0 - -namespace defined templates with chart name (#2140) -commit: 408ae0b3f - -## 0.8.9 - -added useSecurity and adminUser to params (#1903) -commit: 39d2a03cd - -Use storageClassName for jenkins. (#1997) -commit: 802f6449b - -## 0.8.8 - -Remove old plugin locks before installing plugins (#1746) -commit: 6cd7b8ff4 - -promote initContainrs to podspec (#1740) -commit: fecc804fc - -## 0.8.7 - -add optional LoadBalancerIP option. (#1568) -commit: d39f11408 - -## 0.8.6 - -Fix bad key in values.yaml (#1633) -commit: dc27e5af3 - -## 0.8.5 - -Update Jenkins to support node selectors for agents. (#1532) -commit: 4af5810ff - -## 0.8.4 - -Add support for supplying JENKINS_OPTS and/or uri prefix (#1405) -commit: 6a331901a - -## 0.8.3 - -Add serviceAccountName to deployment (#1477) -commit: 0dc349b44 - -## 0.8.2 - -Remove path from ingress specification to allow other paths (#1599) -commit: e727f6b32 - -Update git plugin to 3.4.0 for CVE-2017-1000084 (#1505) -commit: 03482f995 - -## 0.8.1 - -Use consistent whitespace in template placeholders (#1437) -commit: 912f50c71 - -add configurable service annotations #1234 (#1244) -commit: 286861ca8 - -## 0.8.0 - -Jenkins v0.8.0 (#1385) -commit: 0009a2393 - -## 0.7.4 - -Use imageTag as version in config map (#1333) -commit: e8bb6ebb4 - -## 0.7.3 - -Add NetworkPolicy to Jenkins (#1228) -commit: 572b36c6d - -## 0.7.2 - -- Workflow plugin pin (#1178) - commit: ac3a0c7bc - -## 0.7.1 - -copy over plugins.txt in case of update (#1222) -commit: 75b5b1174 - -## 0.7.0 - -add jmx option (#964) -commit: 6ae8d1945 - -## 0.6.4 - -update jenkins to latest LTS 2.46.3 (#1182) -commit: ad90b4c27 - -## 0.6.3 - -Update chart maints to gh u/n (#1107) -commit: f357b77ed - -## 0.6.2 - -Add Agent.Privileged option (#957) -commit: 2cf4aced2 - -## 0.6.1 - -Upgrade jenkins to 2.46.2 (#971) -commit: 41bd742b4 - -## 0.6.0 - -Smoke test for Jenkins Chart (#944) -commit: 110441054 - -## 0.5.1 - -removed extra space from hardcoded password (#925) -commit: 85a9b9123 - -## 0.5.0 - -move config to init-container allowing use of upstream containers (#921) -commit: 1803c3d33 - -## 0.4.1 - -add ability to toggle jnlp-agent podTemplate generation (#918) -commit: accd53203 - -## 0.4.0 - -Jenkins add script approval (#916) -commit: c1746656e - -## 0.3.1 - -Update Jenkins to Latest LTS fixes #731 (#733) -commit: e9a3aed8b - -## 0.3.0 - -Added option to add Jenkins init scripts (#617) -commit: b889623d0 - -## 0.2.0 - -Add existing PVC (#716) -commit: 05271f145 - -## 0.1.15 - -use Master.ServicePort in config.xml (#769) -commit: f351f4b16 - -## 0.1.14 - -Added option to disable security on master node (#403) -commit: 3a6113d18 - -## 0.1.13 - -Added: extra mount points support for jenkins master (#474) -commit: fab0f7eb1 - -## 0.1.12 - -fix storageclass config typo (#548) -commit: 6fc0ff242 - -## 0.1.10 - -Changed default value of Kubernetes Cloud name to match one in kubernetes plugin (#404) -commit: 68351304a - -Add support for overriding the Jenkins ConfigMap (#524) -commit: f97ca53b1 - -## 0.1.9 - -Added jenkins-master ingress support (#402) -commit: d76a09588 - -## 0.1.8 - -Change description (#553) -commit: 91f5c24e1 - -Removed default Persistence.StorageClass: generic (#530) -commit: c87494c10 - -Update to the recommended pvc patterns. (#448) -commit: a7fc595aa - -Remove helm.sh/created annotations (#505) -commit: f380da2fb - -## 0.1.7 - -add support for explicit NodePort on jenkins chart (#342) -commit: f63c188da - -Add configurable loadBalancerSourceRanges for jenkins chart (#360) -commit: 44007c50e - -Update Jenkins version to current LTS (2.19.4) and Kubernetes Plugin to 0.10 (#341) -commit: 6c8678167 - -## 0.1.6 - -Add imagePullPolicy to init container (#295) -commit: 103ee1952 - -## 0.1.5 - -bump chart version with PVC metadata label additions -commit: 4aa9cf5b1 - -## 0.1.4 - -removed `*` from `jenkins/templates/NOTES.txt` -commit: 76212230b - -apply standard metadata labels to PVC's -commit: 58b730836 - -specify namespace in `kubectl get svc` commands in NOTES.txt -commit: 7d3287e81 - -Update Jenkins version to current LTS (#194) -commit: 2c0404049 - -## 0.1.1 - -escape fixed -commit: 2026e1d15 - -.status.loadBalancer.ingress[0].ip is empty in AWS -commit: 1810e37f4 - -.status.loadBalancer.ingress[0].ip is empty in AWS -commit: 3cbd3ced6 - -Remove 'Getting Started:' from various NOTES.txt. (#181) -commit: 2f63fd524 - -docs(\*): update READMEs to reference chart repos (#119) -commit: c7d1bff05 - -## 0.1.0 - -Move first batch of PVC charts to stable -commit: d745f4879 diff --git a/helm-templates/jenkins/Chart.lock b/helm-templates/jenkins/Chart.lock new file mode 100644 index 0000000..a4350b8 --- /dev/null +++ b/helm-templates/jenkins/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: jenkins + repository: https://charts.jenkins.io + version: 5.8.58 +digest: sha256:e5017c12e31225014e22d5551445f56a3ac80d3fc4106a3aed053c4f9b2b5dbd +generated: "2026-08-31T09:31:32.006387+05:30" diff --git a/helm-templates/jenkins/Chart.yaml b/helm-templates/jenkins/Chart.yaml index dbaa73e..bfbfd4c 100644 --- a/helm-templates/jenkins/Chart.yaml +++ b/helm-templates/jenkins/Chart.yaml @@ -1,46 +1,11 @@ apiVersion: v2 name: jenkins -home: https://jenkins.io/ -version: 4.8.4 -appVersion: 2.426.1 -description: Jenkins - Build great things at any scale! The leading open source automation server, Jenkins provides over 1800 plugins to support building, deploying and automating any project. -sources: - - https://github.com/jenkinsci/jenkins - - https://github.com/jenkinsci/docker-inbound-agent - - https://github.com/maorfr/kube-tasks - - https://github.com/jenkinsci/configuration-as-code-plugin -maintainers: - - name: maorfr - email: maor.friedman@redhat.com - - name: torstenwalter - email: mail@torstenwalter.de - - name: mogaal - email: garridomota@gmail.com - - name: wmcdona89 - email: wmcdona89@gmail.com - - name: timja - email: timjacomb1@gmail.com -icon: https://get.jenkins.io/art/jenkins-logo/logo.svg -keywords: - - jenkins - - ci - - devops -annotations: - artifacthub.io/links: | - - name: Chart Source - url: https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins - - name: Jenkins - url: https://www.jenkins.io/ - - name: support - url: https://github.com/jenkinsci/helm-charts/issues - artifacthub.io/images: | - - name: jenkins - image: jenkins/jenkins:2.426.1-jdk11 - - name: k8s-sidecar - image: kiwigrid/k8s-sidecar:1.24.4 - - name: inbound-agent - image: jenkins/inbound-agent:3107.v665000b_51092-15 - - name: backup - image: maorfr/kube-tasks:0.2.0 - artifacthub.io/category: "integration-delivery" - artifacthub.io/license: "Apache-2.0" +version: 1.0.0 +dependencies: + - name: jenkins + # Was a fully-vendored chart at v4.8.4 — converted to a thin wrapper + # like every other app in this repo, at the version the fleet's own + # jenkins-grn versioned sibling already targeted as the vetted + # upgrade candidate (appVersion 2.504.2, vs. 2.426.1 on the old one). + version: 5.8.58 + repository: https://charts.jenkins.io diff --git a/helm-templates/jenkins/README.md b/helm-templates/jenkins/README.md deleted file mode 100644 index 32172e1..0000000 --- a/helm-templates/jenkins/README.md +++ /dev/null @@ -1,1127 +0,0 @@ -# Jenkins - -[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/jenkins)](https://artifacthub.io/packages/helm/jenkinsci/jenkins) -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) -[![Releases downloads](https://img.shields.io/github/downloads/jenkinsci/helm-charts/total.svg)](https://github.com/jenkinsci/helm-charts/releases) -[![Join the chat at https://app.gitter.im/#/room/#jenkins-ci:matrix.org](https://badges.gitter.im/badge.svg)](https://app.gitter.im/#/room/#jenkins-ci:matrix.org) - -[Jenkins](https://www.jenkins.io/) is the leading open source automation server, Jenkins provides over 1800 plugins to support building, deploying and automating any project. - -This chart installs a Jenkins server which spawns agents on [Kubernetes](http://kubernetes.io) utilizing the [Jenkins Kubernetes plugin](https://plugins.jenkins.io/kubernetes/). - -Inspired by the awesome work of [Carlos Sanchez](https://github.com/carlossg). - -## Get Repository Info - -```console -helm repo add jenkins https://charts.jenkins.io -helm repo update -``` - -_See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentation._ - -## Install Chart - -```console -# Helm 3 -$ helm install [RELEASE_NAME] jenkins/jenkins [flags] -``` - -_See [configuration](#configuration) below._ - -_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ - -## Uninstall Chart - -```console -# Helm 3 -$ helm uninstall [RELEASE_NAME] -``` - -This removes all the Kubernetes components associated with the chart and deletes the release. - -_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ - -## Upgrade Chart - -```console -# Helm 3 -$ helm upgrade [RELEASE_NAME] jenkins/jenkins [flags] -``` - -_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ - -Visit the chart's [CHANGELOG](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/CHANGELOG.md) to view the chart's release history. -For migration between major version check [migration guide](#migration-guide). - -## Building weekly releases - -The default charts target Long-Term-Support (LTS) releases of Jenkins. -To use other versions the easiest way is to update the image tag to the version you want. -You can also rebuild the chart if you want the `appVersion` field to match. - -## Configuration - -See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). -To see all configurable options with detailed comments, visit the chart's [values.yaml](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/values.yaml), or run these configuration commands: - -```console -# Helm 3 -$ helm show values jenkins/jenkins -``` - -For a summary of all configurable options, see [VALUES_SUMMARY.md](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md). - -### Configure Security Realm and Authorization Strategy - -This chart configured a `securityRealm` and `authorizationStrategy` as shown below: - -```yaml -controller: - JCasC: - securityRealm: |- - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false -``` - -With the configuration above there is only a single user. -This is fine for getting started quickly, but it needs to be adjusted for any serious environment. - -So you should adjust this to suite your needs. -That could be using LDAP / OIDC / .. as authorization strategy and use globalMatrix as authorization strategy to configure more fine-grained permissions. - -### Consider using a custom image - -This chart allows the user to specify plugins which should be installed. However, for production use cases one should consider to build a custom Jenkins image which has all required plugins pre-installed. -This way you can be sure which plugins Jenkins is using when starting up and you avoid trouble in case of connectivity issues to the Jenkins update site. - -The [docker repository](https://github.com/jenkinsci/docker) for the Jenkins image contains [documentation](https://github.com/jenkinsci/docker#preinstalling-plugins) how to do it. - -Here is an example how that can be done: - -```Dockerfile -FROM jenkins/jenkins:lts -RUN jenkins-plugin-cli --plugins kubernetes workflow-aggregator git configuration-as-code -``` - -NOTE: If you want a reproducible build then you should specify a non-floating tag for the image `jenkins/jenkins:2.249.3` and specify plugin versions. - -Once you built the image and pushed it to your registry you can specify it in your values file like this: - -```yaml -controller: - image: "registry/my-jenkins" - tag: "v1.2.3" - installPlugins: false -``` - -Notice: `installPlugins` is set to false to disable plugin download. In this case, the image `registry/my-jenkins:v1.2.3` must have the plugins specified as default value for [the `controller.installPlugins` directive](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins) to ensure that the configuration side-car system works as expected. - -In case you are using a private registry you can use 'imagePullSecretName' to specify the name of the secret to use when pulling the image: - -```yaml -controller: - image: "registry/my-jenkins" - tag: "v1.2.3" - imagePullSecretName: registry-secret - installPlugins: false -``` - -### External URL Configuration - -If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. -The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - -If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the URL definition. - -### Configuration as Code - -Jenkins Configuration as Code (JCasC) is now a standard component in the Jenkins project. -To allow JCasC's configuration from the helm values, the plugin [`configuration-as-code`](https://plugins.jenkins.io/configuration-as-code/) must be installed in the Jenkins Controller's Docker image (which is the case by default as specified by the [default value of the directive `controller.installPlugins`](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins)). - -JCasc configuration is passed through Helm values under the key `controller.JCasC`. -The section ["Jenkins Configuration as Code (JCasC)" of the page "VALUES_SUMMARY.md"](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-configuration-as-code-jcasc) lists all the possible directives. - -In particular, you may specify custom JCasC scripts by adding sub-key under the `controller.JCasC.configScripts` for each configuration area where each corresponds to a plugin or section of the UI. - -The sub-keys (prior to `|` character) are only labels used to give the section a meaningful name. -The only restriction is they must conform to RFC 1123 definition of a DNS label, so they may only contain lowercase letters, numbers, and hyphens. - -Each key will become the name of a configuration yaml file on the controller in `/var/jenkins_home/casc_configs` (by default) and will be processed by the Configuration as Code Plugin during Jenkins startup. - -The lines after each `|` become the content of the configuration yaml file. - -The first line after this is a JCasC root element, e.g. jenkins, credentials, etc. - -Best reference is the Documentation link here: `https:///configuration-as-code`. - -The example below sets custom systemMessage: - -```yaml -controller: - JCasC: - configScripts: - welcome-message: | - jenkins: - systemMessage: Welcome to our CI\CD server. -``` - -More complex example that creates ldap settings: - -```yaml -controller: - JCasC: - configScripts: - ldap-settings: | - jenkins: - securityRealm: - ldap: - configurations: - - server: ldap.acme.com - rootDN: dc=acme,dc=uk - managerPasswordSecret: ${LDAP_PASSWORD} - groupMembershipStrategy: - fromUserRecord: - attributeName: "memberOf" -``` - -Keep in mind that default configuration file already contains some values that you won't be able to override under configScripts section. - -For example, you can not configure Jenkins URL and System Admin email address like this because of conflicting configuration error. - -Incorrect: - -```yaml -controller: - JCasC: - configScripts: - jenkins-url: | - unclassified: - location: - url: https://example.com/jenkins - adminAddress: example@mail.com -``` - -Correct: - -```yaml -controller: - jenkinsUrl: https://example.com/jenkins - jenkinsAdminEmail: example@mail.com -``` - -Further JCasC examples can be found [here](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos). - -#### Breaking out large Config as Code scripts - -Jenkins Config as Code scripts can become quite large, and maintaining all of your scripts within one yaml file can be difficult. The Config as Code plugin itself suggests updating the `CASC_JENKINS_CONFIG` environment variable to be a comma separated list of paths for the plugin to traverse, picking up the yaml files as needed. -However, under the Jenkins helm chart, this `CASC_JENKINS_CONFIG` value is maintained through the templates. A better solution is to split your `controller.JCasC.configScripts` into separate values files, and provide each file during the helm install. - -For example, you can have a values file (e.g values_main.yaml) that defines the values described in the `VALUES_SUMMARY.md` for your Jenkins configuration: - -```yaml -jenkins: - controller: - jenkinsUrlProtocol: https - installPlugins: false - ... -``` - -In a second file (e.g values_jenkins_casc.yaml), you can define a section of your config scripts: - -```yaml -jenkins: - controller: - JCasC: - configScripts: - jenkinsCasc: | - jenkins: - disableRememberMe: false - mode: NORMAL - ... -``` - -And keep extending your config scripts by creating more files (so not all config scripts are located in one yaml file for better maintenance): - -values_jenkins_unclassified.yaml - -```yaml -jenkins: - controller: - JCasC: - configScripts: - unclassifiedCasc: | - unclassified: - ... -``` - -When installing, you provide all relevant yaml files (e.g `helm install -f values_main.yaml -f values_jenkins_casc.yaml -f values_jenkins_unclassified.yaml ...`). Instead of updating the `CASC_JENKINS_CONFIG` environment variable to include multiple paths, multiple CasC yaml files will be created in the same path `var/jenkins_home/casc_configs`. - -#### Config as Code With or Without Auto-Reload - -Config as Code changes (to `controller.JCasC.configScripts`) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. -If you set `controller.sidecars.configAutoReload.enabled` to `true`, a second, auxiliary container will be installed into the Jenkins controller pod, known as a "sidecar". -This watches for changes to configScripts, copies the content onto the Jenkins file-system and issues a POST to `http:///reload-configuration-as-code` with a pre-shared key. -You can monitor this sidecar's logs using command `kubectl logs -c config-reload -f`. -If you want to enable auto-reload then you also need to configure rbac as the container which triggers the reload needs to watch the config maps: - -```yaml -controller: - sidecars: - configAutoReload: - enabled: true -rbac: - create: true -``` - -### Allow Limited HTML Markup in User-Submitted Text - -Some third-party systems (e.g. GitHub) use HTML-formatted data in their payload sent to a Jenkins webhook (e.g. URL of a pull-request being built). -To display such data as processed HTML instead of raw text set `controller.enableRawHtmlMarkupFormatter` to true. -This option requires installation of the [OWASP Markup Formatter Plugin (antisamy-markup-formatter)](https://plugins.jenkins.io/antisamy-markup-formatter/). -This plugin is **not** installed by default but may be added to `controller.additionalPlugins`. - -### Change max connections to Kubernetes API -When using agents with containers other than JNLP, The kubernetes plugin will communicate with those containers using the Kubernetes API. this changes the maximum concurrent connections -```yaml -agent: - maxRequestsPerHostStr: "32" -``` -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Change container cleanup timeout API -For tasks that use very large images, this timeout can be increased to avoid early termination of the task while the Kubernetes pod is still deploying. -```yaml -agent: - retentionTimeout: "32" -``` -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Change seconds to wait for pod to be running -This will change how long Jenkins will wait (seconds) for pod to be in running state. -```yaml -agent: - waitForPodSec: "32" -``` -This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart. - -### Mounting Volumes into Agent Pods - -Your Jenkins Agents will run as pods, and it's possible to inject volumes where needed: - -```yaml -agent: - volumes: - - type: Secret - secretName: jenkins-mysecrets - mountPath: /var/run/secrets/jenkins-mysecrets -``` - -The supported volume types are: `ConfigMap`, `EmptyDir`, `HostPath`, `Nfs`, `PVC`, `Secret`. -Each type supports a different set of configurable attributes, defined by [the corresponding Java class](https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes). - -### NetworkPolicy - -To make use of the NetworkPolicy resources created by default, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin). - -[Install](#install-chart) helm chart with network policy enabled by setting `networkPolicy.enabled` to `true`. - -You can use `controller.networkPolicy.internalAgents` and `controller.networkPolicy.externalAgents` stanzas for fine-grained controls over where internal/external agents can connect from. -Internal ones are allowed based on pod labels and (optionally) namespaces, and external ones are allowed based on IP ranges. - -### Script approval list - -`controller.scriptApproval` allows to pass function signatures that will be allowed in pipelines. -Example: - -```yaml -controller: - scriptApproval: - - "method java.util.Base64$Decoder decode java.lang.String" - - "new java.lang.String byte[]" - - "staticMethod java.util.Base64 getDecoder" -``` - -### Custom Labels - -`controller.serviceLabels` can be used to add custom labels in `jenkins-controller-svc.yaml`. -For example: - -```yaml -ServiceLabels: - expose: true -``` - -### Persistence - -The Jenkins image stores persistence under `/var/jenkins_home` path of the container. -A dynamically managed Persistent Volume Claim is used to keep the data across deployments, by default. -This is known to work in GCE, AWS, and minikube. Alternatively, a previously configured Persistent Volume Claim can be used. - -It is possible to mount several volumes using `persistence.volumes` and `persistence.mounts` parameters. -See additional `persistence` values using [configuration commands](#configuration). - -#### Existing PersistentVolumeClaim - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. [Install](#install-chart) the chart, setting `persistence.existingClaim` to `PVC_NAME` - -#### Long Volume Attach/Mount Times - -Certain volume type and filesystem format combinations may experience long -attach/mount times, [10 or more minutes][K8S_VOLUME_TIMEOUT], when using -`fsGroup`. This issue may result in the following entries in the pod's event -history: - -```console -Warning FailedMount 38m kubelet, aks-default-41587790-2 Unable to attach or mount volumes: unmounted volumes=[jenkins-home], unattached volumes=[plugins plugin-dir jenkins-token-rmq2g sc-config-volume tmp jenkins-home jenkins-config secrets-dir]: timed out waiting for the condition -``` - -In these cases, experiment with replacing `fsGroup` with -`supplementalGroups` in the pod's `securityContext`. This can be achieved by -setting the `controller.podSecurityContextOverride` Helm chart value to -something like: - -```yaml -controller: - podSecurityContextOverride: - runAsNonRoot: true - runAsUser: 1000 - supplementalGroups: [1000] -``` - -This issue has been reported on [azureDisk with ext4][K8S_VOLUME_TIMEOUT] and -on [Alibaba cloud][K8S_VOLUME_TIMEOUT_ALIBABA]. - -[K8S_VOLUME_TIMEOUT]: https://github.com/kubernetes/kubernetes/issues/67014 -[K8S_VOLUME_TIMEOUT_ALIBABA]: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-698770511 - -#### Storage Class - -It is possible to define which storage class to use, by setting `persistence.storageClass` to `[customStorageClass]`. -If set to a dash (`-`), dynamic provisioning is disabled. -If the storage class is set to null or left undefined (`""`), the default provisioner is used (gp2 on AWS, standard on GKE, AWS & OpenStack). - -### Additional Secrets - -Additional secrets and Additional Existing Secrets, -can be mounted into the Jenkins controller through the chart or created using `controller.additionalSecrets` or `controller.additionalExistingSecrets`. -A common use case might be identity provider credentials if using an external LDAP or OIDC-based identity provider. -The secret may then be referenced in JCasC configuration (see [JCasC configuration](#configuration-as-code)). - -`values.yaml` controller section, referencing mounted secrets: -```yaml -controller: - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: secret-credentials - - additionalExistingSecrets: - - name: secret-credentials - keyName: github-username - - name: secret-credentials - keyName: github-password - - name: secret-credentials - keyName: token - - additionalSecrets: - - name: client_id - value: abc123 - - name: client_secret - value: xyz999 - JCasC: - securityRealm: | - oic: - clientId: ${client_id} - clientSecret: ${client_secret} - ... - configScripts: - jenkins-casc-configs: | - credentials: - system: - domainCredentials: - - credentials: - - string: - description: "github access token" - id: "github_app_token" - scope: GLOBAL - secret: ${secret-credentials-token} - - usernamePassword: - description: "github access username password" - id: "github_username_pass" - password: ${secret-credentials-github-password} - scope: GLOBAL - username: ${secret-credentials-github-username} -``` - -For more information, see [JCasC documentation](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets). - -### Secret Claims from HashiCorp Vault - -It's possible for this chart to generate `SecretClaim` resources in order to automatically create and maintain Kubernetes `Secrets` from HashiCorp [Vault](https://www.vaultproject.io/) via [`kube-vault-controller`](https://github.com/roboll/kube-vault-controller) - -These `Secrets` can then be referenced in the same manner as Additional Secrets above. - -This can be achieved by defining required Secret Claims within `controller.secretClaims`, as follows: -```yaml -controller: - secretClaims: - - name: jenkins-secret - path: secret/path - - name: jenkins-short-ttl - path: secret/short-ttl-path - renew: 60 -``` - -### RBAC - -RBAC is enabled by default. If you want to disable it you will need to set `rbac.create` to `false`. - -### Backup - -Adds a backup CronJob for jenkins, along with required RBAC resources. See additional `backup` values using [configuration commands](#configuration). - -#### Example: Backup to Google Cloud Storage Bucket - -Let's look at a quick example. Let's pretend we are backing up Jenkins to a **Google Cloud Storage (GCS) Bucket**. Here is what the process would look like: - -##### 1. Create a Google Cloud Platform Account - -If you don't have a GCP account, you can create a Free Account with the link below: - -- - -##### 2. Create a GCS bucket with a unique name - -You need to create a GCS bucket with a unique name, which you can do by following the guide below: - -- - -##### 3. Create a GCP Service Account - -In order for the backup job to upload Jenkins data to the GCS bucket, you need to provide it with a Google Service Account, which you can create by following the guide below: - -- - -##### 4. Bind `roles/storage.admin` role to Service Account - -Now you need to provide your GCP Service Account with the `roles/storage.admin` role, which has permissions to read/write content to a GCS bucket. You can do this by following the guide below: - -- - -##### 5. Create a Service Account Key - -Now that you have a Service Account (SA), you need to create a Service Account Key, which is a file that represents the GCP Service Account that will get passed to the Backup Job (and later on to the Recovery Job). You can create it by following the guide below: - -- - -##### 6. Create a Kubernetes Secret from the Service Account key - -In order for the Backup Job to access the GCP Service Account Key you need to create Kubernetes Secret, which you can create using the command below: - -```bash -# Replace with the path to the SA Key -kubectl -n jenkins create secret generic jenkinsgcp --from-file=sa-credentials.json=/path/to/sa_key.json -``` - -**NOTE**: This assumes that you will deploy the Jenkins chart in the `jenkins` namespace. - -##### 7. Deploy the Jenkins Helm Chart using a modified values file - -Rather than using a long command to pass on all the new Chart values, create a values file called `values.yaml`, then put the following content on it, then save it: - -```yaml -backup: - enabled: true - schedule: "0 2 * * *" # Runs every day at 2 am, change it to whatever interval works for you - existingSecret: - jenkinsgcp: # This is the secret name - gcpcredentials: sa-credentials.json # The service account file in the secret - destination: "gcs://BUCKET_NAME/jenkins-k8s-backup" # Replace with Bucket Name from previous step -controller: - initializeOnce: true # Installs latest plugins as soon as Jenkins starts - installLatestPlugins: true -persistence: - enabled: true # So that we have a PVC that we can backup -``` - -**NOTE**: The [`gcpcredentials`](https://github.com/fabiogomezdiaz/helm-charts-1/blob/main/charts/jenkins/values.yaml#L829) key in the [`jenkinsgcp`](https://github.com/fabiogomezdiaz/helm-charts-1/blob/main/charts/jenkins/values.yaml#L827) field tells the Helm chart that we will be using a GCS bucket as our backup. - -##### 8. Deploy Jenkins Chart with new values - -Now that we have everything in place, let's deploy the Jenkins Chart with the new values file: - -```bash -helm upgrade --install jenkins --namespace jenkins \ - -f values.yaml \ - jenkinsci/jenkins; -``` - -**NOTE**: Save the password from this installation as it will be needed in the [Restore from Backup in Google Cloud Storage Bucket](#example-restore-from-backup-in-google-cloud-storage-bucket) section. - -##### 9. Create resources to backup in Jenkins - -Once Jenkins is available, go to Jenkins and create jobs, download plugins, and create credentials so that we have something to backup other than the default Jenkins installation. - -##### 10. Trigger the backup job - -The values file we used to deploy Jenkins runs the backup job every day at 2 AM. - -If you don't want to wait that long for the job to start running, then patch the CronJob to run in the next minute with the following commands: - -```bash -# Update CronJob to run every minute -kubectl -n jenkins patch cronjob.batch/jenkins-backup --patch '{"spec": {"schedule": "* * * * *"}}' - -# Run this command until the "jenkins-backup-*" container is running -kubectl get pods | grep backup; - -# To prevent multiple jobs from spanning every minute, change the CronJob back to original schedule -kubectl -n jenkins patch cronjob.batch/jenkins-backup --patch '{"spec": {"schedule": "0 2 * * *"}}' -``` - -##### 11. Verify that the backup job completed successfully - -Once the job is running, then query the backup pod logs to monitor progress as follows: - -```bash -# Get backup container name -BACKUP_CONTAINER=$(kubectl get pods | grep backup | awk '{print $1}'); - -# Stream logs of backup container until job is finished -kubectl logs -f ${BACKUP_CONTAINER}; -``` - -**NOTE**: The backup job will create a time-stamped folder in the GCS bucket each time the backup job runs. - -If you can see a success message from the backup job and can see the contents of the backup on your GCS bucket, then the backup was successful! - -A similar process would work for AWS S3. See additional `backup` values using [configuration commands](#configuration). - -**NOTE**: If an environmental variable `AWS_REGION` is not provided, the region of the AWS S3 bucket will be assumed to be `eu-central-1`. If you want to use an S3 bucket in another region, you need to provide the bucket's region as an environmental variable as below: - -```yaml -backup: - env: # The region of your S3 bucket. - - name: AWS_REGION - value: us-east-1 -``` - -### Restore From Backup - -To restore a backup, you can use the `kube-tasks` underlying tool called [skbn](https://github.com/maorfr/skbn), which copies files from cloud storage to Kubernetes. -The best way to do it would be using a `Job` to copy files from the desired backup tag to the Jenkins pod. - -See the following example for more details. - -#### Example: Restore from Backup in Google Cloud Storage Bucket - -**NOTE**: This section assumes that you ran the steps in [Example: Backup to Google Cloud Storage Bucket](#example-backup-to-google-cloud-storage-bucket) beforehand and that you **saved the password** for that Jenkins installation, which you will need at the end of this section. - -Let's pretend you are restoring a backup from a Google Cloud Storage Bucket because you completely lost your Jenkins installation and you are starting from scratch. - -In the following steps, we will explain what this process would look like: - -##### 1. Reinstall the Jenkins Helm Chart - -First, we need to remove the old Jenkins installation that we backed up previously, then we can install a clean Jenkins instance to restore from GCS backup. - -To do so, run the following commands: - -```bash -# Delete old Jenkins installation -helm delete jenkins - -# Install Jenkins Chart -helm upgrade --install jenkins --namespace jenkins \ - -f values.yaml \ - jenkinsci/jenkins; -``` - -**NOTE**: This Command uses the same values file that was created in the [7. Deploy the Jenkins Helm Chart using a modified values file](#7-deploy-the-jenkins-helm-chart-using-a-modified-values-file) section. - -Now verify that Jenkins is up and running and it DOES NOT have any of the resources you created earlier. - -##### 2. Create a Kubernetes Service Account for the Restore Job - -In order for the Restore job to pull backup data from the GCS bucket and put it in the jenkins `/var/jenkins_home` folder in the Jenkins pod, you need to create the following: - -- A [Kubernetes Service Account](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/) (not to be confused with a GCP Service Account) for the Restore job. -- A [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) that lists the necessary permissions to update the data in the volumes of other pods. -- A [Kubernetes ClusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) that binds the above ClusterRole to the Service Account. - -To do so, create a file called `restore-rbac.yaml` and enter the following content, then save it: - -```yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app: skbn - name: skbn - namespace: jenkins ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app: skbn - name: skbn -rules: -- apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["pods/exec"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: skbn - name: skbn -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: skbn -subjects: -- kind: ServiceAccount - name: skbn - namespace: jenkins -``` - -To apply the above manifest, run the following command: - -```bash -kubectl apply -f restore-rbac.yaml -``` - -##### 3. Create a Kubernetes Job to restore Jenkins - -The logic that will execute the Jenkins restoration from a GCS backup will be done through a -[Kubernetes Job](https://kubernetes.io/docs/concepts/workloads/controllers/job/), which will run only once as needed. - -To create the job, create a manifest file called `restore.yaml` with the following content, then save it: - -```yaml -apiVersion: batch/v1 -kind: Job -metadata: - labels: - app: skbn - name: skbn - namespace: jenkins -spec: - template: - metadata: - labels: - app: skbn - spec: - restartPolicy: OnFailure - serviceAccountName: skbn - containers: - - name: skbn - image: maorfr/skbn - command: ["skbn"] - args: - - "cp" - - "--src" - - "gcs://BUCKET_NAME/jenkins-k8s-backup/BACKUP_NAME" - - "--dst" - - "k8s://jenkins/jenkins-0/jenkins/var/jenkins_home" - imagePullPolicy: IfNotPresent - env: - - name: GOOGLE_APPLICATION_CREDENTIALS - value: /var/run/secrets/jenkinsgcp/sa-credentials.json - volumeMounts: - - mountPath: /var/run/secrets/jenkinsgcp - name: jenkinsgcp - volumes: - - name: jenkinsgcp - secret: - secretName: jenkinsgcp -``` - -While the above Job manifest is mostly complete, you need to replace a couple of things, as follows: - -- Replace `BUCKET_NAME` with the GCS Bucket name created in [Create a GCS bucket with a unique name](#2-create-a-gcs-bucket-with-a-unique-name). -- Go to your GCS bucket and find the name of the latest timestamped folder (i.e. `20210717154947`), then replace `BACKUP_NAME` with it, then save the file. - -Notice that we are using the `jenkinsgcp` Kubernetes Secret that holds the `sa-credentials.json` key file for the GCP Service Account that we created in [Create a Service Account Key](#5-create-a-service-account-key). - -Having the Kubernetes Secret provide the GCP Service Account Key to the Restore Kubernetes Job is what will allow the Job to download the contents of the backup from the GCS bucket and put it into the `/var/jenkins_home` folder in the Persistent Volume Claim of the `jenkins-0` pod. - -##### 4. Deploy the Restore Job - -Deploy the Restore Job using the following command: - -```bash -kubectl apply -f restore.yaml -``` - -Wait about a minute for the Job to start, then query the logs using the following commands: - -```bash -# Get restore container name -RESTORE_CONTAINER=$(kubectl get pods | grep skbn | awk '{print $1}'); - -# Stream logs of restore container until job is finished -kubectl logs -f ${RESTORE_CONTAINER}; -``` - -Watch the logs until the job is done. This usually takes a few minutes. - -##### 5. Verify that Jenkins was restored from GCS Backup - -Login to Jenkins, then click on `Manage Jenkins-> Reload Configuration from Disk`, then press `OK`. - -Jenkins is now going to reload the backup content from disk and restart. Now, if you performed this on a new Jenkins installation, you will **not be able to login** using the password for the new installation of Jenkins. - -Because we are restoring from the backup of a previous installation, we need to login using the password for the old Jenkins installation. - -So, refresh your browser and login to Jenkins using the password from the backup. - -Now, verify that all your jobs, plugins, and credentials from that backup are showing up, and if they are, then CONGRATULATIONS on successfully restoring Jenkins from a GCS Backup! - -A similar process would work for AWS S3. See additional `backup` values using [configuration commands](#configuration) to figure out how what fields to put in the Restore Job manifest. - -### Adding Custom Pod Templates - -It is possible to add custom pod templates for the default configured kubernetes cloud. -Add a key under `agent.podTemplates` for each pod template. Each key (prior to `|` character) is just a label, and can be any value. -Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. -There's no need to add the _jnlp_ container since the kubernetes plugin will automatically inject it into the pod. -For this pod templates configuration to be loaded the following values must be set: - -```yaml -controller.JCasC.defaultConfig: true -``` - -The example below creates a python pod template in the kubernetes cloud: - -```yaml -agent: - podTemplates: - python: | - - name: python - label: jenkins-python - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" -``` - -Best reference is `https:///configuration-as-code/reference#Cloud-kubernetes`. - -### Adding Pod Templates Using additionalAgents - -`additionalAgents` may be used to configure additional kubernetes pod templates. -Each additional agent corresponds to `agent` in terms of the configurable values and inherits all values from `agent` so you only need to specify values which differ. -For example: - -```yaml -agent: - podName: default - customJenkinsLabels: default - # set resources for additional agents to inherit - resources: - limits: - cpu: "1" - memory: "2048Mi" - -additionalAgents: - maven: - podName: maven - customJenkinsLabels: maven - # An example of overriding the jnlp container - # sideContainerName: jnlp - image: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: python - tag: "3" - command: "/bin/sh -c" - args: "cat" - TTYEnabled: true -``` - -### Ingress Configuration - -This chart provides ingress resources configurable via the `controller.ingress` block. - -The simplest configuration looks like the following: - -```yaml -controller: - ingress: - enabled: true - paths: [] - apiVersion: "extensions/v1beta1" - hostName: jenkins.example.com -``` - -This snippet configures an ingress rule for exposing jenkins at `jenkins.example.com` - -You can define labels and annotations via `controller.ingress.labels` and `controller.ingress.annotations` respectively. -Additionally, you can configure the ingress tls via `controller.ingress.tls`. -By default, this ingress rule exposes all paths. -If needed this can be overwritten by specifying the wanted paths in `controller.ingress.paths` - -If you want to configure a secondary ingress e.g. you don't want the jenkins instance exposed but still want to receive webhooks you can configure `controller.secondaryingress`. -The secondaryingress doesn't expose anything by default and has to be configured via `controller.secondaryingress.paths`: - -```yaml -controller: - ingress: - enabled: true - apiVersion: "extensions/v1beta1" - hostName: "jenkins.internal.example.com" - annotations: - kubernetes.io/ingress.class: "internal" - secondaryingress: - enabled: true - apiVersion: "extensions/v1beta1" - hostName: "jenkins-scm.example.com" - annotations: - kubernetes.io/ingress.class: "public" - paths: - - /github-webhook -``` - -## Prometheus Metrics - -If you want to expose Prometheus metrics you need to install the [Jenkins Prometheus Metrics Plugin](https://github.com/jenkinsci/prometheus-plugin). -It will expose an endpoint (default `/prometheus`) with metrics where a Prometheus Server can scrape. - -If you have implemented [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), you can set `master.prometheus.enabled` to `true` to configure a `ServiceMonitor` and `PrometheusRule`. -If you want to further adjust alerting rules you can do so by configuring `master.prometheus.alertingrules` - -If you have implemented Prometheus without using the operator, you can leave `master.prometheus.enabled` set to `false`. - -### Running Behind a Forward Proxy - -The controller pod uses an Init Container to install plugins etc. If you are behind a corporate proxy it may be useful to set `controller.initContainerEnv` to add environment variables such as `http_proxy`, so that these can be downloaded. - -Additionally, you may want to add env vars for the init container, the Jenkins container, and the JVM (`controller.javaOpts`): - -```yaml -controller: - initContainerEnv: - - name: http_proxy - value: "http://192.168.64.1:3128" - - name: https_proxy - value: "http://192.168.64.1:3128" - - name: no_proxy - value: "" - - name: JAVA_OPTS - value: "-Dhttps.proxyHost=proxy_host_name_without_protocol -Dhttps.proxyPort=3128" - containerEnv: - - name: http_proxy - value: "http://192.168.64.1:3128" - - name: https_proxy - value: "http://192.168.64.1:3128" - javaOpts: >- - -Dhttp.proxyHost=192.168.64.1 - -Dhttp.proxyPort=3128 - -Dhttps.proxyHost=192.168.64.1 - -Dhttps.proxyPort=3128 -``` - -### HTTPS Keystore Configuration - -[This configuration](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777) enables jenkins to use keystore in order to serve https. -Here is the [value file section](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777#RunningJenkinswithnativeSSL/HTTPS-ConfigureJenkinstouseHTTPSandtheJKSkeystore) related to keystore configuration. -Keystore itself should be placed in front of `jenkinsKeyStoreBase64Encoded` key and in base64 encoded format. To achieve that after having `keystore.jks` file simply do this: `cat keystore.jks | base64` and paste the output in front of `jenkinsKeyStoreBase64Encoded`. -After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same, as `targetPort` will serve https. -Do not set `controller.httpsKeyStore.httpPort` to `-1` because it will cause readiness and liveliness prob to fail. -If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` (or override the key name using `jenkinsHttpsJksSecretKey`) -and `https-jks-password` (or override the key name using `jenkinsHttpsJksPasswordSecretKey`; additionally you can make it get the password from a different secret using `jenkinsHttpsJksPasswordSecretName`). Example: - -```yaml -controller: - httpsKeyStore: - enable: true - jenkinsHttpsJksSecretName: '' - httpPort: 8081 - path: "/var/jenkins_keystore" - fileName: "keystore.jks" - password: "changeit" - jenkinsKeyStoreBase64Encoded: '' -``` -### AWS Security Group Policies - -To create SecurityGroupPolicies set `awsSecurityGroupPolicies.enabled` to true and add your policies. Each policy requires a `name`, array of `securityGroupIds` and a `podSelector`. Example: - -```yaml -awsSecurityGroupPolicies: - enabled: true - policies: - - name: "jenkins-controller" - securityGroupIds: - - sg-123456789 - podSelector: - matchExpressions: - - key: app.kubernetes.io/component - operator: In - values: - - jenkins-controller -``` - -### Agent Direct Connection - -Set `directConnection` to `true` to allow agents to connect directly to a given TCP port without having to negotiate a HTTP(S) connection. This can allow you to have agent connections without an external HTTP(S) port. Example: - -```yaml -agent: - jenkinsTunnel: "jenkinsci-agent:50000" - directConnection: true -``` - -## Migration Guide - -### From stable repository - -Upgrade an existing release from `stable/jenkins` to `jenkins/jenkins` seamlessly by ensuring you have the latest [repository info](#get-repository-info) and running the [upgrade commands](#upgrade-chart) specifying the `jenkins/jenkins` chart. - -### Major Version Upgrades - -Chart release versions follow [SemVer](../../CONTRIBUTING.md#versioning), where a MAJOR version change (example `1.0.0` -> `2.0.0`) indicates an incompatible breaking change needing manual actions. - -### To 3.0.0 - -* Check `securityRealm` and `authorizationStrategy` and adjust it. - Otherwise, your configured users and permissions will be overridden. -* You need to use helm version 3 as the `Chart.yaml` uses `apiVersion: v2`. -* All XML configuration options have been removed. - In case those are still in use you need to migrate to configuration as code. - Upgrade guide to 2.0.0 contains pointers how to do that. -* Jenkins is now using a `StatefulSet` instead of a `Deployment` -* terminology has been adjusted that's also reflected in values.yaml - The following values from `values.yaml` have been renamed: - - * `master` => `controller` - * `master.useSecurity` => `controller.adminSecret` - * `master.slaveListenerPort` => `controller.agentListenerPort` - * `master.slaveHostPort` => `controller.agentListenerHostPort` - * `master.slaveKubernetesNamespace` => `agent.namespace` - * `master.slaveDefaultsProviderTemplate` => `agent.defaultsProviderTemplate` - * `master.slaveJenkinsUrl` => `agent.jenkinsUrl` - * `master.slaveJenkinsTunnel` => `agent.jenkinsTunnel` - * `master.slaveConnectTimeout` => `agent.kubernetesConnectTimeout` - * `master.slaveReadTimeout` => `agent.kubernetesReadTimeout` - * `master.slaveListenerServiceAnnotations` => `controller.agentListenerServiceAnnotations` - * `master.slaveListenerServiceType` => `controller.agentListenerServiceType` - * `master.slaveListenerLoadBalancerIP` => `controller.agentListenerLoadBalancerIP` - * `agent.slaveConnectTimeout` => `agent.connectTimeout` -* Removed values: - - * `master.imageTag`: use `controller.image` and `controller.tag` instead - * `slave.imageTag`: use `agent.image` and `agent.tag` instead - -### To 2.0.0 - -Configuration as Code is now default + container does not run as root anymore. - -#### Configuration as Code new default - -Configuration is done via [Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) by default. -That means that changes in values which result in a configuration change are always applied. -In contrast, the XML configuration was only applied during the first start and never altered. - -:exclamation::exclamation::exclamation: -Attention: -This also means if you manually altered configuration then this will most likely be reset to what was configured by default. -It also applies to `securityRealm` and `authorizationStrategy` as they are also configured using configuration as code. -:exclamation::exclamation::exclamation: - -#### Image does not run as root anymore - -It's not recommended to run containers in Kubernetes as `root`. - -❗Attention: If you had not configured a different user before then you need to ensure that your image supports the user and group ID configured and also manually change permissions of all files so that Jenkins is still able to use them. - -#### Summary of updated values - -As version 2.0.0 only updates default values and nothing else it's still possible to migrate to this version and opt out of some or all new defaults. -All you have to do is ensure the old values are set in your installation. - -Here we show which values have changed and the previous default values: - -```yaml -controller: - runAsUser: 1000 # was unset before - fsGroup: 1000 # was unset before - JCasC: - enabled: true # was false - defaultConfig: true # was false - sidecars: - configAutoReload: - enabled: true # was false -``` - -#### Migration steps - -Migration instructions heavily depend on your current setup. -So think of the list below more as a general guideline of what should be done. - -- Ensure that the Jenkins image you are using contains a user with ID 1000 and a group with the same ID. - That's the case for `jenkins/jenkins:lts` image, which the chart uses by default -- Make a backup of your existing installation especially the persistent volume -- Ensure that you have the configuration as code plugin installed -- Export your current settings via the plugin: - `Manage Jenkins` -> `Configuration as Code` -> `Download Configuration` -- prepare your values file for the update e.g. add additional configuration as code setting that you need. - The export taken from above might be a good starting point for this. - In addition, the [demos](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) from the plugin itself are quite useful. -- Test drive those setting on a separate installation -- Put Jenkins to Quiet Down mode so that it does not accept new jobs - `/quietDown` -- Change permissions of all files and folders to the new user and group id: - - ```console - kubectl exec -it -c jenkins /bin/bash - chown -R 1000:1000 /var/jenkins_home - ``` - -- Update Jenkins - -### To 1.0.0 - -Breaking changes: - -- Values have been renamed to follow [helm recommended naming conventions](https://helm.sh/docs/chart_best_practices/#naming-conventions) so that all variables start with a lowercase letter and words are separated with camelcase -- All resources are now using [helm recommended standard labels](https://helm.sh/docs/chart_best_practices/#standard-labels) - -As a result of the label changes also the selectors of the deployment have been updated. -Those are immutable so trying an updated will cause an error like: - -```console -Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-controller", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable -``` - -In order to upgrade, [uninstall](#uninstall-chart) the Jenkins Deployment before upgrading: diff --git a/helm-templates/jenkins/Tiltfile b/helm-templates/jenkins/Tiltfile deleted file mode 100644 index 4537cfe..0000000 --- a/helm-templates/jenkins/Tiltfile +++ /dev/null @@ -1,5 +0,0 @@ - -# If not using a standard local dev name, specify your k8s context here -#allow_k8s_contexts('jenkins-dev') -k8s_yaml(helm('.', values='values.yaml', set=['controller.adminPassword=asdf'])) -watch_file('.') diff --git a/helm-templates/jenkins/VALUES_SUMMARY.md b/helm-templates/jenkins/VALUES_SUMMARY.md deleted file mode 100644 index 593fcb0..0000000 --- a/helm-templates/jenkins/VALUES_SUMMARY.md +++ /dev/null @@ -1,421 +0,0 @@ -# Jenkins - -## Configuration - -The following tables list the configurable parameters of the Jenkins chart and their default values. - -### Jenkins Controller - -| Parameter | Description | Default | -|---------------------------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------| -| `checkDeprecation` | Checks for deprecated values used | `true` | -| `clusterZone` | Override the cluster name for FQDN resolving | `cluster.local` | -| `kubernetesURL` | Override the Kubernetes API server URL | `https://kubernetes.default` | -| `nameOverride` | Override the resource name prefix | `jenkins` | -| `renderHelmLabels` | Enables rendering of the helm.sh/chart label to the annotations | `true` | -| `fullnameOverride` | Override the full resource names | `jenkins-{release-name}` (or `jenkins` if release-name is `jenkins`) | -| `namespaceOverride` | Override the deployment namespace | Not set (`Release.Namespace`) | -| `controller.componentName` | Jenkins controller name | `jenkins-controller` | -| `controller.testEnabled` | Can be used to disable rendering test resources when using helm template | `true` | -| `controller.cloudName` | Name of default cloud configuration | `kubernetes` | -| `controller.legacyRemotingSecurityEnabled` | Is remoting security enabled? | Not set (i.e. not enabled) | - -#### Jenkins Configuration as Code (JCasC) - -| Parameter | Description | Default | -|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------| -| `controller.JCasC.defaultConfig` | Enables default Jenkins configuration via configuration as code plugin | `true` | -| `controller.JCasC.configScripts` | List of Jenkins Config as Code scripts | `{}` | -| `controller.JCasC.security` | Jenkins Config as Code for Security section | `legacy` | -| `controller.JCasC.securityRealm` | Jenkins Config as Code for Security Realm | `legacy` | -| `controller.JCasC.authorizationStrategy` | Jenkins Config as Code for Authorization Strategy | `loggedInUsersCanDoAnything` | -| `controller.sidecars.configAutoReload` | Jenkins Config as Code auto-reload settings | | -| `controller.sidecars.configAutoReload.enabled` | Jenkins Config as Code auto-reload settings (Attention: rbac needs to be enabled otherwise the sidecar can't read the config map) | `true` | -| `controller.sidecars.configAutoReload.image` | Image which triggers the reload | `kiwigrid/k8s-sidecar:1.24.4` | -| `controller.sidecars.configAutoReload.reqRetryConnect` | How many connection-related errors to retry on | `10` | -| `controller.sidecars.configAutoReload.sleepTime` | How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) | Not set | -| `controller.sidecars.configAutoReload.envFrom` | Environment variable sources for the Jenkins Config as Code auto-reload container | Not set | -| `controller.sidecars.configAutoReload.env` | Environment variables for the Jenkins Config as Code auto-reload container | Not set | -| `controller.sidecars.configAutoReload.containerSecurityContext` | Enable container security context | `{readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` | - -#### Jenkins Configuration Files & Scripts - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.initScripts` | List of Jenkins init scripts | `[]` | -| `controller.initConfigMap` | Pre-existing init scripts | Not set | - -#### Jenkins Global Security - -| Parameter | Description | Default | -| --------------------------------- | ---------------------------------------- | ----------------------------------------- | -| `controller.adminSecret` | Create secret for admin user | `true` | -| `controller.disableRememberMe` | Disable use of remember me | `false` | -| `controller.enableRawHtmlMarkupFormatter` | Enable HTML parsing using | false | -| `controller.markupFormatter` | Yaml of the markup formatter to use | `plainText` | -| `controller.disabledAgentProtocols` | Disabled agent protocols | `JNLP-connect JNLP2-connect` | -| `controller.csrf.defaultCrumbIssuer.enabled` | Enable the default CSRF Crumb issuer | `true` | -| `controller.csrf.defaultCrumbIssuer.proxyCompatability` | Enable proxy compatibility | `true` | - -#### Jenkins Global Settings - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.numExecutors` | Set Number of executors | 0 | -| `controller.executorMode` | Set executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE | NORMAL | -| `controller.customJenkinsLabels` | Append Jenkins labels to the controller | `[]` | -| `controller.jenkinsHome` | Custom Jenkins home path | `/var/jenkins_home` | -| `controller.jenkinsRef` | Custom Jenkins reference path | `/usr/share/jenkins/ref` | -| `controller.jenkinsAdminEmail` | Email address for the administrator of the Jenkins instance | Not set | -| `controller.jenkinsUrl` | Set Jenkins URL if you are not using the ingress definitions provided by the chart | Not set | -| `controller.jenkinsUrlProtocol` | Set protocol for Jenkins URL | Set to `https` if `controller.ingress.tls`, `http` otherwise | -| `controller.jenkinsUriPrefix` | Root Uri Jenkins will be served on | Not set | -| `controller.jenkinsOpts` | Append to `JENKINS_OPTS` env var | Not set | -| `controller.javaOpts` | Append to `JAVA_OPTS` env var | Not set | - -#### Jenkins In-Process Script Approval - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.scriptApproval` | List of groovy functions to approve | `[]` | - -#### Jenkins Plugins - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.installPlugins` | List of Jenkins plugins to install. If you don't want to install plugins set it to `false` | `kubernetes:1.31.3 workflow-aggregator:2.6 git:4.10.2 configuration-as-code:1414.v878271fc496f` | -| `controller.additionalPlugins` | List of Jenkins plugins to install in addition to those listed in controller.installPlugins | `[]` | -| `controller.initializeOnce` | Initialize only on first install. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`. | `false` | -| `controller.overwritePlugins` | Overwrite installed plugins on start.| `false` | -| `controller.overwritePluginsFromImage` | Keep plugins that are already installed in the controller image.| `true` | -| `controller.installLatestPlugins` | Set to false to download the minimum required version of all dependencies. | `true` | -| `controller.installLatestSpecifiedPlugins` | Set to true to download latest dependencies of any plugin that is requested to have the latest version. | `false` | - -#### Jenkins Agent Listener - -| Parameter | Description | Default | -| -------------------------------------------- | ----------------------------------------------- | ------------ | -| `controller.agentListenerEnabled` | Create Agent listener service | `true` | -| `controller.agentListenerPort` | Listening port for agents | `50000` | -| `controller.agentListenerHostPort` | Host port to listen for agents | Not set | -| `controller.agentListenerNodePort` | Node port to listen for agents | Not set | -| `controller.agentListenerServiceType` | Defines how to expose the agentListener service | `ClusterIP` | -| `controller.agentListenerServiceAnnotations` | Annotations for the agentListener service | `{}` | -| `controller.agentListenerLoadBalancerIP` | Static IP for the agentListener LoadBalancer | Not set | -| `controller.agentListenerExternalTrafficPolicy` | [Traffic Policy](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies) of for the agentListener service | Not set | -| `controller.agentListenerLoadBalancerSourceRanges` | Allowed inbound IP for the agentListener service | `0.0.0.0/0` | - -#### Kubernetes StatefulSet & Service - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.image` | Controller image name | `jenkins/jenkins` | -| `controller.tagLabel` | Controller image tag label | `jdk11` | -| `controller.tag` | Controller image tag override | Not set | -| `controller.imagePullPolicy` | Controller image pull policy | `Always` | -| `controller.imagePullSecretName` | Controller image pull secret | Not set | -| `controller.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 50m, memory: 256Mi}, limits: {cpu: 2000m, memory: 4096Mi}}`| -| `controller.initContainerResources` | Resources allocation (Requests and Limits) for Init Container | Not set | -| `controller.initContainerEnvFrom` | Environment variable sources for Init Container | Not set | -| `controller.initContainerEnv` | Environment variables for Init Container | Not set | -| `controller.containerEnvFrom` | Environment variable sources for Jenkins Container | Not set | -| `controller.containerEnv` | Environment variables for Jenkins Container | Not set | -| `controller.usePodSecurityContext` | Enable pod security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` | -| `controller.runAsUser` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | -| `controller.fsGroup` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | -| `controller.podSecurityContextOverride` | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set | -| `controller.containerSecurityContext` | Allow to control securityContext for the jenkins container. | `{runAsUser: 1000, runAsGroup: 1000, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` | -| `controller.hostAliases` | Aliases for IPs in `/etc/hosts` | `[]` | -| `controller.serviceAnnotations` | Service annotations | `{}` | -| `controller.serviceType` | k8s service type | `ClusterIP` | -| `controller.clusterIP` | k8s service clusterIP | Not set | -| `controller.servicePort` | k8s service port | `8080` | -| `controller.targetPort` | k8s target port | `8080` | -| `controller.nodePort` | k8s node port | Not set | -| `controller.jmxPort` | Open a port, for JMX stats | Not set | -| `controller.extraPorts` | Open extra ports, for other uses | `[]` | -| `controller.loadBalancerSourceRanges` | Allowed inbound IP addresses | `0.0.0.0/0` | -| `controller.loadBalancerIP` | Optional fixed external IP | Not set | -| `controller.statefulSetLabels` | Custom StatefulSet labels | Not set | -| `controller.serviceLabels` | Custom Service labels | Not set | -| `controller.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set | -| `controller.nodeSelector` | Node labels for pod assignment | `{}` | -| `controller.affinity` | Affinity settings | `{}` | -| `controller.schedulerName` | Kubernetes scheduler name | Not set | -| `controller.terminationGracePeriodSeconds` | Set TerminationGracePeriodSeconds | Not set | -| `controller.terminationMessagePath` | Set the termination message path | Not set | -| `controller.terminationMessagePolicy` | Set the termination message policy | Not set | -| `controller.tolerations` | Toleration labels for pod assignment | `[]` | -| `controller.podAnnotations` | Annotations for controller pod | `{}` | -| `controller.statefulSetAnnotations` | Annotations for controller StatefulSet | `{}` | -| `controller.updateStrategy` | Update strategy for StatefulSet | `{}` | -| `controller.lifecycle` | Lifecycle specification for controller-container | Not set | -| `controller.priorityClassName` | The name of a `priorityClass` to apply to the controller pod | Not set | -| `controller.admin.existingSecret` | The name of an existing secret containing the admin credentials. | `""`| -| `controller.admin.userKey` | The key in the existing admin secret containing the username. | `jenkins-admin-user` | -| `controller.admin.passwordKey` | The key in the existing admin secret containing the password. | `jenkins-admin-password` | -| `controller.customInitContainers` | Custom init-container specification in raw-yaml format | Not set | -| `controller.sidecars.other` | Configures additional sidecar container(s) for Jenkins controller | `[]` | - -#### Kubernetes Pod Disruption Budget - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.podDisruptionBudget.enabled` | Enable [Kubernetes Pod Disruption Budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) configuration from `controller.podDisruptionBudget` (see below) | `false` | -| `controller.podDisruptionBudget.apiVersion` | Policy API version | `policy/v1beta1` | -| `controller.podDisruptionBudget.maxUnavailable` | Number of pods that can be unavailable. Either an absolute number or a percentage. | Not set | - -#### Kubernetes Health Probes - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.healthProbes` | Enable [Kubernetes Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes) configuration from `controller.probes` (see below) | `true` | -| `controller.probes.livenessProbe.timeoutSeconds` | Set the timeout for the liveness probe in seconds | `5` | -| `controller.probes.livenessProbe.periodSeconds` | Set the time interval (in seconds) between two liveness probes executions | `10` | -| `controller.probes.livenessProbe.failureThreshold` | Set the failure threshold for the liveness probe | `5` | -| `controller.probes.livenessProbe.initialDelaySeconds` | Set the initial delay for the liveness probe | Not set | -| `controller.probes.livenessProbe.httpGet.port` | Set the Pod's HTTP port to use for the liveness probe | `http` | -| `controller.probes.livenessProbe.httpGet.path` | Set the HTTP's path for the liveness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | -| `controller.probes.readinessProbe.timeoutSeconds` | Set the timeout for the readiness probe in seconds | `5` | -| `controller.probes.readinessProbe.periodSeconds` | Set the time interval (in seconds) between two readiness probes executions | `10` | -| `controller.probes.readinessProbe.failureThreshold` | Set the failure threshold for the readiness probe | `3` | -| `controller.probes.readinessProbe.initialDelaySeconds` | Set the initial delay for the readiness probe | Not set | -| `controller.probes.readinessProbe.httpGet.port` | Set the Pod's HTTP port to use for the readiness probe | `http` | -| `controller.probes.readinessProbe.httpGet.path` | Set the HTTP's path for the readiness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | -| `controller.probes.startupProbe.timeoutSeconds` | Set the timeout for the startup probe in seconds | `5` | -| `controller.probes.startupProbe.periodSeconds` | Set the time interval (in seconds) between two startup probes executions | `10` | -| `controller.probes.startupProbe.failureThreshold` | Set the failure threshold for the startup probe | `12` | -| `controller.probes.startupProbe.initialDelaySeconds` | Set the initial delay for the startup probe | Not set | -| `controller.probes.startupProbe.httpGet.port` | Set the Pod's HTTP port to use for the startup probe | `http` | -| `controller.probes.startupProbe.httpGet.path` | Set the HTTP's path for the startup probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) | - -#### Kubernetes Ingress - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.ingress.enabled` | Enables ingress | `false` | -| `controller.ingress.apiVersion` | Ingress API version | `extensions/v1beta1` | -| `controller.ingress.hostName` | Ingress hostname | Not set | -| `controller.ingress.resourceRootUrl` | Hostname to serve assets from | Not set | -| `controller.ingress.annotations` | Ingress annotations | `{}` | -| `controller.ingress.labels` | Ingress labels | `{}` | -| `controller.ingress.path` | Ingress path | Not set | -| `controller.ingress.paths` | Override for the default Ingress paths | `[]` | -| `controller.ingress.tls` | Ingress TLS configuration | `[]` | - -#### GKE BackendConfig - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.backendconfig.enabled` | Enables backendconfig | `false` | -| `controller.backendconfig.apiVersion` | backendconfig API version | `extensions/v1beta1` | -| `controller.backendconfig.name` | backendconfig name | Not set | -| `controller.backendconfig.annotations` | backendconfig annotations | `{}` | -| `controller.backendconfig.labels` | backendconfig labels | `{}` | -| `controller.backendconfig.spec` | backendconfig spec | `{}` | - -#### OpenShift Route - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.route.enabled` | Enables openshift route | `false` | -| `controller.route.annotations` | Route annotations | `{}` | -| `controller.route.labels` | Route labels | `{}` | -| `controller.route.path` | Route path | Not set | - -#### Prometheus - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.prometheus.enabled` | Enables prometheus service monitor | `false` | -| `controller.prometheus.serviceMonitorAdditionalLabels` | Additional labels to add to the service monitor object | `{}` | -| `controller.prometheus.serviceMonitorNamespace` | Custom namespace for serviceMonitor | Not set (same ns where is Jenkins being deployed) | -| `controller.prometheus.scrapeInterval` | How often prometheus should scrape metrics | `60s` | -| `controller.prometheus.scrapeEndpoint` | The endpoint prometheus should get metrics from | `/prometheus` | -| `controller.prometheus.alertingrules` | Array of prometheus alerting rules | `[]` | -| `controller.prometheus.alertingRulesAdditionalLabels` | Additional labels to add to the prometheus rule object | `{}` | -| `controller.prometheus.prometheusRuleNamespace` | Custom namespace for PrometheusRule | `""` (same ns where Jenkins being deployed) | - -#### HTTPS Keystore - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `controller.httpsKeyStore.enable` | Enables HTTPS keystore on jenkins controller | `false` | -| `controller.httpsKeyStore.jenkinsHttpsJksSecretName` | Name of the secret that already has ssl keystore | `` | -| `controller.httpsKeyStore.jenkinsHttpsJksSecretKey` | Name of the key in the secret that already has ssl keystore | `jenkins-jks-file` | -| `controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName` | Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file | `` | -| `controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey` | Name of the key in the secret that contains the JKS password | `https-jks-password` | -| `controller.httpsKeyStore.httpPort` | HTTP Port that Jenkins should listen on along with HTTPS, it also serves liveness and readiness probs port. When HTTPS keystore is enabled servicePort and targetPort will be used as HTTPS port | `8081` | -| `controller.httpsKeyStore.path` | Path of HTTPS keystore file | `/var/jenkins_keystore` | -| `controller.httpsKeyStore.fileName` | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `keystore.jks` | -| `controller.httpsKeyStore.password` | Jenkins keystore password | `password` | -| `controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded` | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | a self signed cert | - -#### Kubernetes Secret - -| Parameter | Description | Default | -|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ----------------------------------------- | -| `controller.adminUser` | Admin username (and password) created as a secret if adminSecret is true | `admin` | -| `controller.adminPassword` | Admin password (and user) created as a secret if adminSecret is true | Random value | -| `controller.existingSecret` | The name of an existing secret containing keys credentials. | `""`| -| `controller.additionalSecrets` | List of additional secrets to create and mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` | -| `controller.additionalExistingSecrets` | List of additional existing secrets to mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` | -| `controller.secretClaims` | List of `SecretClaim` resources to create | `[]` | - -#### Kubernetes NetworkPolicy - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources. | `false` | -| `networkPolicy.apiVersion` | NetworkPolicy ApiVersion | `networking.k8s.io/v1` | -| `networkPolicy.internalAgents.allowed` | Allow internal agents (from the same cluster) to connect to controller. Agent pods would be filtered based on PodLabels. | `false` | -| `networkPolicy.internalAgents.podLabels` | A map of labels (keys/values) that agents pods must have to be able to connect to controller. | `{}` | -| `networkPolicy.internalAgents.namespaceLabels` | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller. | `{}` | -| `networkPolicy.externalAgents.ipCIDR` | The IP range from which external agents are allowed to connect to controller. | `` | -| `networkPolicy.externalAgents.except` | A list of IP sub-ranges to be excluded from the whitelisted IP range. | `[]` | - -#### Kubernetes RBAC - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `rbac.create` | Whether RBAC resources are created | `true` | -| `rbac.readSecrets` | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` | - -#### Kubernetes ServiceAccount - Controller - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `serviceAccount.name` | name of the ServiceAccount to be used by access-controlled resources | autogenerated | -| `serviceAccount.create` | Configures if a ServiceAccount with this name should be created | `true` | -| `serviceAccount.annotations` | Configures annotation for the ServiceAccount | `{}` | -| `serviceAccount.extraLabels` | Configures extra labels for the ServiceAccount | `{}` | -| `serviceAccount.imagePullSecretName` | Controller ServiceAccount image pull secret | Not set | - -#### Kubernetes ServiceAccount - Agent - -| Parameter | Description | Default | -| --------------------------------- | ------------------------------------ | ----------------------------------------- | -| `serviceAccountAgent.name` | name of the agent ServiceAccount to be used by access-controlled resources | autogenerated | -| `serviceAccountAgent.create` | Configures if an agent ServiceAccount with this name should be created | `false` | -| `serviceAccountAgent.annotations` | Configures annotation for the agent ServiceAccount | `{}` | -| `serviceAccountAgent.extraLabels` | Configures extra labels for the agent ServiceAccount | `{}` | -| `serviceAccountAgent.imagePullSecretName` | Agent ServiceAccount image pull secret | Not set | - -### Jenkins Agent(s) - -| Parameter | Description | Default | -| -------------------------- |------------------------------------------------------------------------------------------| ---------------------- | -| `agent.enabled` | Enable Kubernetes plugin jnlp-agent podTemplate | `true` | -| `agent.namespace` | Namespace in which the Kubernetes agents should be launched | Not set | -| `agent.containerCap` | Maximum number of agent | 10 | -| `agent.defaultsProviderTemplate` | The name of the pod template to use for providing default values | Not set | -| `agent.jenkinsUrl` | Overrides the Kubernetes Jenkins URL | Not set | -| `agent.jenkinsTunnel` | Overrides the Kubernetes Jenkins tunnel | Not set | -| `agent.kubernetesConnectTimeout` | The connection timeout in seconds for connections to Kubernetes API. Minimum value is 5. | 5 | -| `agent.kubernetesReadTimeout` | The read timeout in seconds for connections to Kubernetes API. Minimum value is 15. | 15 | -| `agent.maxRequestsPerHostStr` | The maximum concurrent connections to Kubernetes API | 32 | -| `agent.retentionTimeout` | Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated | 5 | -| `agent.waitForPodSec` | Seconds to wait for pod to be running | 600 | -| `agent.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set | -| `agent.jnlpregistry` | Custom docker registry used for to get agent jnlp image | Not set | - -#### Pod Configuration - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- | ---------------------- | -| `agent.websocket` | Enables agent communication via websockets | false | -| `agent.podName` | Agent Pod base name | Not set | -| `agent.customJenkinsLabels`| Append Jenkins labels to the agent | `[]` | -| `agent.envVars` | Environment variables for the agent Pod | `[]` | -| `agent.idleMinutes` | Allows the Pod to remain active for reuse | 0 | -| `agent.imagePullSecretName` | Agent image pull secret | Not set | -| `agent.hostNetworking` | Enabled agent to use hostnetwork | false | -| `agent.nodeSelector` | Node labels for pod assignment | `{}` | -| `agent.connectTimeout` | Timeout in seconds for an agent to be online | 100 | -| `agent.volumes` | Additional volumes | `[]` | -| `agent.workspaceVolume` | Workspace volume (defaults to EmptyDir) | `{}` | -| `agent.yamlTemplate` | The raw yaml of a Pod API Object to merge into the agent spec | Not set | -| `agent.yamlMergeStrategy` | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates | `override` | -| `agent.annotations` | Annotations to apply to the pod | `{}` | -| `agent.additionalContainers` | Add additional containers to the agents. | `[]` | - -#### Side Container Configuration - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- |--------------------------------------------------------------------------------| -| `agent.sideContainerName` | Side container name in agent | jnlp | -| `agent.image` | Agent image name | `jenkins/inbound-agent` | -| `agent.tag` | Agent image tag | `3107.v665000b_51092-5` | -| `agent.alwaysPullImage` | Always pull agent container image before build | `false` | -| `agent.privileged` | Agent privileged container | `false` | -| `agent.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 512m, memory: 512Mi}, limits: {cpu: 512m, memory: 512Mi}}` | -| `agent.runAsUser` | Configure container user | Not set | -| `agent.runAsGroup` | Configure container group | Not set | -| `agent.command` | Executed command when side container starts | Not set | -| `agent.args` | Arguments passed to executed command | `${computer.jnlpmac} ${computer.name}` | -| `agent.TTYEnabled` | Allocate pseudo tty to the side container | false | -| `agent.workingDir` | Configure working directory for default agent | `/home/jenkins/agent` | - -#### Other - -| Parameter | Description | Default | -| -------------------------- | ----------------------------------------------- | ---------------------- | -| `agent.disableDefaultAgent` | Ignore the default Jenkins Agent configuration | false | -| `agent.podTemplates` | Configures extra pod templates for the default kubernetes cloud | `{}` | -| `additionalAgents` | Configure additional agents which inherit values from `agent` | `{}` | - -### Persistence - -| Parameter | Description | Default | -| --------------------------- | -------------------------------------- | --------------- | -| `persistence.enabled` | Enable the use of a Jenkins PVC | `true` | -| `persistence.existingClaim` | Provide the name of a PVC | `nil` | -| `persistence.storageClass` | Storage class for the PVC | `nil` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `persistence.labels` | Labels for the PVC | `{}` | -| `persistence.accessMode` | The PVC access mode | `ReadWriteOnce` | -| `persistence.size` | The size of the PVC | `8Gi` | -| `persistence.dataSource` | Existing data source to clone PVC from | `nil` | -| `persistence.subPath` | SubPath for jenkins-home mount | `nil` | -| `persistence.volumes` | Additional volumes | `nil` | -| `persistence.mounts` | Additional mounts | `nil` | - -### Backup - -| Parameter | Description | Default | -| ---------------------------------------- | ----------------------------------------------------------------- | --------------------------------- | -| `backup.enabled` | Enable the use of a backup CronJob | `false` | -| `backup.schedule` | Schedule to run jobs | `0 2 * * *` | -| `backup.labels` | Backup pod labels | `{}` | -| `backup.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `backup.serviceAccount.name` | name of the backup ServiceAccount | autogenerated | -| `backup.serviceAccount.annotations` | Backup pod annotations | `{}` | -| `backup.image.repo` | Backup image repository | `maorfr/kube-tasks` | -| `backup.image.tag` | Backup image tag | `0.2.0` | -| `backup.image.imagePullSecretName` | Backup image pull secret | Not set | -| `backup.extraArgs` | Additional arguments for kube-tasks | `[]` | -| `backup.existingSecret` | Environment variables to add to the cronjob container | `{}` | -| `backup.existingSecret.*` | Specify the secret name containing the AWS or GCP credentials | `jenkinsaws` | -| `backup.existingSecret.*.awsaccesskey` | `secretKeyRef.key` used for `AWS_ACCESS_KEY_ID` | `jenkins_aws_access_key` | -| `backup.existingSecret.*.awssecretkey` | `secretKeyRef.key` used for `AWS_SECRET_ACCESS_KEY` | `jenkins_aws_secret_key` | -| `backup.existingSecret.*.azstorageaccount`| `secretKeyRef.key` used for `AZURE_STORAGE_ACCOUNT` | `""` | -| `backup.existingSecret.*.azstoragekey` | `secretKeyRef.key` used for `AZURE_STORAGE_ACCESS_KEY` | `""` | -| `backup.existingSecret.*.gcpcredentials` | Mounts secret as volume and sets `GOOGLE_APPLICATION_CREDENTIALS` | `credentials.json` | -| `backup.env` | Backup environment variables | `[]` | -| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` | -| `backup.destination` | Destination to store backup artifacts | `s3://jenkins-data/backup` | -| `backup.onlyJobs` | Only backup the job folder | `false` | -| `backup.usePodSecurityContext` | Enable backup pod's security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` | -| `backup.runAsUser` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that jenkins runs with. | `1000` | -| `backup.fsGroup` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` | -| `backup.podSecurityContextOverride` | Completely overwrites the contents of the backup pod's security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set | -| `cronJob.apiVersion` | CronJob API version | 'batch/v1' | -| `awsSecurityGroupPolicies.enabled` | Enable the creation of SecurityGroupPolicy resources | `false` | -| `awsSecurityGroupPolicies.policies` | Security Group Policy definitions. `awsSecurityGroupPolicies.enabled` must be `true` | Not set | - -### Helm Tests - -| Parameter | Description | Default | -| --------------------- | --------------------------------- | --------------- | -| `helmtest.bats.image` | Image used to test the framework | `bats/bats` | -| `helmtest.bats.tag` | Test framework image tag override | `1.2.1` | diff --git a/helm-templates/jenkins/charts/jenkins-5.8.58.tgz b/helm-templates/jenkins/charts/jenkins-5.8.58.tgz new file mode 100644 index 0000000000000000000000000000000000000000..56aa533467138dbb6d2b955122d1006b3f24035d GIT binary patch literal 80241 zcmV()K;OR~iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%cH26ZAY8xo6lnQOCn;N3%QwxOS}n`6Eyt2&OOBKD^hzKS zl4y|xO^}l1RAzmz@x9*nB;Ufug&;-QPEM+;d)9HSIJ}v9I^UpF2LQv}ZVs z$}8--fBEG<)oQi6-)O+U)oL~S?{2l;_)BfCTHmeJ_Urrmf2r2$`@6e;LDgSBl=YvO zML7IR^$+)zo!ozuAME=y!jVIL)+``|!^oLnE1JdQvO_Btj>wdTt0r>%h)hGMSh9)h zEJ(P@sXxR1l&~iHdjTPYN~mSqhz7hBiYQ_Mv7E^YMKgl%l=u;HJUk^RBvXe)c>tl@ zfahb6G?7GF_=W_GCbFqDCn0a7a9aM`te5wyjdHzoZ_n$s6rlMbD>26=77jN7n>$Nq z8aj5xsN1ZScdO;y6e!0Z)7ZC5Ft0Q)HJ((J=I(CwsJy5jjK3W1)*2JLhQBmQjrApP z9gFykG*K(S){KFW?~1f66T{*o0Z30|?keZ{$!>2_46dYolpMaD<|n<4+mF5yJioF$=roUr>ty zmbwJnjz2{-AUTuFSCB+zDGnpGk|mc; zX@&o%%ofwaoUE2Kv{|!I(x<9~ET>RHHd)Ys75Mf?*zrjSm57HOw~0JV!}26_i0xtj z-$G)~aKtyPfaLb_3X{-m;JE)5(U3*NUt%{RVc90ScB&w0G{s@)*wmvD{>guwjdgOTb*rMLJmQx=J3u$U2wjWmESximV@!4vE#FWx>Be#uM z%gQ_+lTw7){6)|f^(W3WmgE| z#vzJ`7q~bg09_DRXjLd|ZK10L;S^sEV@iAyV%}Lu1o4FitgwZKgd~tEUuMJ&NXW`j z;1;$}siXnHC7x=Hf{;v{$HEr+H(SoUR6<|H`=^gR@)gLw0?^EXH;G+$eMl*A>b89w z5|>~`O1##)uZV`a>??96a(GDXRla%D>7kwXj<(2za9zLAN)TYU=Oxpipbjl^kCo8S3rLWfK+EY?AL~xdkRz z#U@%Iv56l!*oA|FEsHR=xwkUxjM#3mt!kQ1#8Jkl5%LMKiCr!jpu2Wc_TBOE*d+{w z#J5Rk>?>!h%WNhXeB|OWaruDYg_b-G3!>dQalK1kg*8zW@-v&D1%Ew4SGWAU^Mx0{ za1fM@HQ|p$>IKvnuO$6@A1Falotp%1v7p{j@Kk^<+6gkQJs^?(qlt?88CQI^aX^_9 zQQchqnT$vAR>i_Ia3VYfuAigg|3prily~^ICMwp;jYhRx6Aw@^6khNWFjzoU8`iyv zk~eIAyMWWCfVz$)X2bs;z@JT2Y`IIkV#UI7_Fv*2;1T zN*zhq_hj#28{zFxK*&{1n&{hifP(_cqG5!?NWeu1kw;?bKL9;E?Aykd5-P_0XctqT zN*HzqhIZmGj_W99gd=%KJmQT>h&=w>utnjG{MaK+G{G(-y7iDms2@WEI)UND{Bgn` z2C>&se>PFoY#~mrs*F5p6Lr4Sf%mCR%4k3tbNJxoWy>$lV*l!<*Sak7yP??m*uK0S zc0Y9Z{1m_*wfWhQ^>oLrARxZ2djM=<>hLC;z)xAsBI?PC>Hz=ye{e`M%A!7rmNc9@ z{xr23cQfK6!U+eb7ndik0UsjvX*A>XmHH*swF3kvTFDpk4vc`maifysBW!#8zm`Q~ zKSE2#b&*ezOZ_R4cSITb>rVK!p|%KMA$XZC@PA>^_5d`AgLe?k+7Pm2vv*O&Nx@a-|fGmvox>pze4QW)YCouO;8c} zmr1htbv7p}a}_1}oA8AUT3K@EP2IL2aRJCg|sIqSxV6^9(T zLxNoo4v-H3EbQwO;Y0@Ehy7H;;bb>61argHZJklqUy zgw8gKeV6ygSB)<(oMA!vZOR#68o^p98lY(u{|b)>Cv9> zX*lB;a6|AIJ0^)?BvL({gVe5AS>Ui@DL^HKhqeJIxt7J4RcABGA1yeVC2L~>m7l)w zYQ_J~D|N%)1jS0s!U~(=ki4*5m5@v}Eg2AQ;#=8uTkArxcK{234RAD5cc@x|B@W@a ziaG2kldR{MaC}xm(&50~$uZA65?&F6Bl&SFy|AIvV$V($t_ zKW$l4GQ^@*Q_AYCAa0`KUezng4<7LZw_M-b?>XYD3((R{>eXsaqek@zTER$%e4$Vf zQg{#PM=HFLT$e79)W9IkSpvrc7e2N)cM;80bHd3A65NVWUEU-NWC4_460kc1(MUg$ zQ>@TXJb4kQS&-*UXA!b6M|n_1@GCcreIS^e)iDMR1H#C~;glfk0SiPY>J7~RI@}B< zP>dMNm9xfifR_9+P+A1OJ{Aoec@{aY^A%W7H->w43s_i=E1`Ih&j|@QFSBrH%+Q$3 z@WP>?tVv#Yg&V&LrAwt&uN@p7aPAbIlyYS*h5pG{vP6`_SKINODA@#!#MjEL-B=wKsMoX z2U(XO`ClWKea#9Z72`h$X+$mR0>?cjaJ?==CyI#ArzcGpI5cxwa`A3MSGE6IHbn`6 zf@-4L?ak%?lq3I|eXYs)mibV3M5V9d4qH0RV2_O+n}9IM zG4K`f})PX$1jVNI!lQNz&;+9i9qX3aK;oKS;6PGSUM?k-diSSL`6O=~i_NJ@n zst^W*r8c6zIc#SD<7*nU0O(0T?c~|T2TL9!^wx_Ru*zTg^$EKZPAt=lZqJ`tTj(wV_T?CBO>nquNoHLcM0q34lL_emWI&A0UkT9 z6FG!^<^2JyG2z>5lOQCP5DNG<3Q6E%OYG{`%~O$B%MmDgc^?tJ>xny`A0=M-h!}q?C4*~JkC?~Qebu#%hQll_m%2LrV!#=7a>@tBx zYV9SD49uON$yzL!tc&BL30{atsCo9DTOJfU@(F*RECT}~#Al#~+k_=6{PJEEipNU2 z9*~eZEP^Eg-j5GME`vD;d0J<9L6CuqAQN_gJHrt$KTb%H9nv6>+5yWzGQQs|o=ypi z1S++=L-hWTvy;9x^KdxdK|u_M*@HU`x_$<0CA+};(|l72^*f_4H?2F)l0Vaw^K)Wq zf~;FuNP2;}7KSs3JVp(8v#}M6h_{0r#bJ;63yV3SkTHsP>sJ;BflD}dfL&NYPMD=| zk#Cnej>z%#&6Pcr@@jiYueHum?;liajV<`Yq8=YaY47mpsJ7QQ+K1jYV~A#6Gw5f0 z?NguA%cc_e@q+c~HqpQHhKkd%vg@ri243Kjh`1|#KS~B42q=H7O2JMZb=^VE)Tg1k zgrp2y-#Z+uf0_yw&~wX#{!bz`hi9ZZe`+il&{}Av4!f1d9cJmecrCAOh5TloO!2J7 z_Lc9h`0ku)Ol>BDS$OacLTBN)WJ)^B!Y&quY-yE+c!=>E$P}F$3fuW1Qx8r!TJW2= z1#R;(I;A1!P92V-JIVbXQPih48PG7=LBwTb30y14L@z0}kFkq=i-;%XEr@|YH`yIX z1|;OL;s80m<;FHV%d;$knu{@16s-bdydyAM(x3}@Ei6@9Mto%jv2-RT2;?vW2+~c0 zW*$Ikp(y|4E6_wBRx#>E{AnMls^YKwnm)A!$mfTr7Q29;1;8rk#l55!1{G}(65w~F z*4qIwvXJp~2f~(cK^;Mqk+%%}DdW0p{vI)VYkK+i14x2L+&`8LC-4$}Y zu>fGBD8!SAV<8rV!dS9wAlai(#Ee88sfg4UlfYbiCyTHSLwJE5S0ZyrZ8xFW7B-(@}yyS&JAJXO#DfPKtkd|R?ZP3*mFj5{XwR(yk4I>=! z_x%twv@H2cY4wz96-_8@qOp_}BK}*Gf71%wG~D$8l-4N5S{KR?WK1HQ(edLYEAbUB zNi+#dV{FZdZKaFCrqs_{4I!vAWxWGxt0r%;kLdWGDEZ%4_+FZmRZ~0DZFwfs=1H)j6q+;rdjvO*QX`YODm&UmQ$BVTLS)fMsCR^+-mJM`#>Liz_zc zy@rBCRzsIn1hbv8zDe&JSlNJ$sWu`drGVOrCg1q(O5mkXjie;c9N*<}BG_ABTd{T- zEt??=aQrln4AuE1KO@+UW}caHv?+FVd#7`8i;r8bDbcl(nN2*ebchhViA=;2&>FI zfrEV3qVL};E}c65o0mrc6kc$=FAN5*FFw7z^@|*j2#Naw^EXMf}stAFmKZ6mf?F%Te_lGbdx08Pw zN^Ba)tq)T#)J2~sA2bnxOgQy zEvm<4Iq5n=Hm{MWM;z>C=dzqRuAw7mTKJi_E(!*Kef8?(j8+p7RKOub{yMNqHKx;`B3d#3@{u4S#j631w z2;xtv@`-)@>MWy<1BL_GM|jMr8%G5BvT2AgKW`TCBRm!7+{2HzN$VymRugTeG}UT> z!>bE2+vJ&8K*AIDQhra1Wz=I03gH33=?++X@kT7$TF4#ts!9e}Dxq`AB2BJD@6Q0> zwS~YzEtis6ysCLWEw6Y9nJwyDB#2l=i5yD4Hbqt6DqB*(Pzt2TS`AGK6%@+QNn&bd zj%njc=gTHcF(Euez&#Ij2R{bgl(7g8+#BHuCbPt7*#-I+*Ja#W#ss&&lXXBf18Lm;cp^S@c(-icLw4gof0L zLC{r3$1AlbN_*}knoptf5Jt}+*&3VjJrFMl<0OI28vAw-M(4L@os_-?@jbyFaJwh|1&~Nx;%-8JE*2krLq=Uze5;YBElb&FB&YYys6sVlN+g1Q#yEIE9i|KU)dH7 z6HNw+s66$NhN0*~7`ucivl)#GQ(@i!rz5dPHKepD%Ja-kij^RpBh#xdN(C@Es`{j& zxlfnAkk?!2@)&_`$IU}}qqSkdk1l#2rD_JOr=>!i@u51Rfi|w%f%8WMY71Jd?XJ+@ zl&#o_MZGeM{j!IBJOyQI`QCek6GqCstKS=ms`iEIIF4q-k2t$eei!HKRqYsajq3N_ zqhJsl27h=J5Wau`X!pQMsrL~m6yF@xB5&=J)e|PRLIaZ!d}(KEsx%BGDtU}T%waQa zV5iLMAT~$WpU{C}VkaKaN6CtringO_t%}~Nu{A+YCI-Se#>icXOIWwyS94-f0%o)v z{yX_}la{vXZUx^2m$PQJphbB~pGX)>X?C5TOdS&>2>>EtmDBzq>J2PQRRf`e1+4-4 z3fuSlFXxQAZ z9+nsT2fGJ{0t9 z5*dcRleX5f>Cy*s!EwZMe8-DDb?R*O^poUGTJjN}bN~7}Jb4|25P^?)^c>7&RWG5g zT3drHRkDJ_t~xb?oId=O+(+@olte{X&_q-i&fHj?;hz6B1c7wM=nf<49Q~>E+Q{XYjcK^Z0Q{@LZdYB_?!&EfSnI$MhZa zRa;3}q%0YjuV8Ge;uA;|73O|wQM*E{<2(_;xltcYoRCFoX@%)1>i8_?cZ6Ddn}P&v zN+LNIzRuWQkdRNoU6s*|x>oWBmOms%kLJqH_$8?K8bugfd$m)D6ly8L6=;$c%}m=H zIzewX;=vm}Z=rhx>ynTpu?F-hyi#UBIlWO|(?xA9l!wM`b(1i#x0J2Nv2VMIZ%LWR zdU#5{8l0(Vs{4roMjZ!Dw?<;54LOSHuTPsEn}^GH^u{I#%-3 z@v#R|AQ2Tx>VW~}=VZmvz>i&*&xCkE1RvPk2_Q&-pAH`Y9hHUZl*8%+a zzHz>dg>NJno=jp_Ebep`gk!lDWiXw-x@!#w>J&>caIz%hzI@N9U%p_}AG&cEkg)A?M&5!gCVb|=P?ufoPs_uI z^ISy@$tTMfz$B7_9uACAgAbAzqoV#oqw*@wj<+6)#)%0GzoDDx?HGwjD62^|ZZH?S3v5FB{ll-}&f z)vyH!VO_-kB)(cte**~gmXxPu^u}93h$1QRtkri*cx=6SC&Z*FXYgOO?Hnsjc8 zlk~b!f9vs+q>&@5$kCLsO|7lu?O2lE1+r`$o+8FFlBd{P{zs{%D4|@&RtjOV3XElJLnj(S8-Be~gM*W+e$#Mq_*3 z?GirAuwTglB=dGmT)I>n?s&>uC6dAw!)e#BAI1EGP0A2;THGvxn2Ww8_a=A*Y|S#( zr#K{7+>*k-K~@Pv!UDdJ!Vyira%jl6K@Eow^0r$>9o~d@`!)z23OxSblY8_XpU*wN zeX+RBgKEVFUMEUoeVd9Jr)t&+oMN>ygMO5b)c?A28KjqIejvfMmrM^kO9_31| zkcU^IP;!e2fAPQ3Nq?wAj%^tnMAKkLT*BWdY)9HcFfoPMDwq*po^D|E#>Ao?Nf8R1 zS??8p9YI(Py8dVuZdPjnPAV2=))xVXp|{D?@*Rvr(H<25Li@7j;)#4LicyO<6P|E> z2X_AN!uuhahxBkV0wU&3MnDtNB4GLj$Vi9L6nqOfP7;CDJBagFJDRCBBkf2fbYzv$ zF=3Gr*~DS`7W-dniQ>@xTmJP`(GA4_C66qeZ6)2|qgxUeChQT$WXwGna5HOC#Psnt z-b}`VES&6qV_wBpQk0Z60@O&2N1?v+r;0m>Xi##=g1CuJ zQyfQ0PDPkasS6L{FrWR(MRVW3c)QNF9X5igURB5&fiW#bL?W4TR2 z!LG-*M;NhW)eEr3X4AUjVX#cSgr zvSxUF5g^vR`m=-_yNQaweS>W`g4DrVvsg%YAsMny&8U@x?vsX3DvDkfnwAU{a~2uL z(Ts-96YQH3(Ei%RZkb&m)kkX4b4QU{{OOd~UH_IZUK{%-wB@fLvqEM^T0Zqx9*x-z z!CC9l4aPmR_2&Grr9_4=yT| zICRM%%UmBt>;{fcn!82w`@o38DuS@eQWfA7{kw{5x&zTn5op_Fuq%m-V#=*JqBr2Z z*fediQ|5R(&ojuHPZC~`V5(h;W~4N6S0D?bG3QZ3GNv>to4vqpapu>jQHd$l*F8;1oOvs6gtx>#6X*=-PDbfFvvOzau%=(bgX#VS3^!BBmM z8WG!0JyBHcT$9!u1Wrl$SZK-VmV;Hog{8Q6Lq~U$Z?&gM2{&R^Ky9b z8Y>&Xs19I}W>H|qmzWEPKOV0l z0$xS+hEXua);tc{d_$XPw_tAF2=tCK;^`PGOBvzE=S)SylIOo3)mu?fYzbOG%<-j~ zI{_M94$*>y$?g72dYn7K$Ymcm+*OKOLCU>i$zLHW-4XRUu7c>3gdq*3J2xlbl9dAb zal^l~MVqX5o-5{w*=Gz)2>^g`@Ca}76Na%%*N7*Y9N=U2=9DW+-5^wVuU8mkM)28YG=As^HTBJK`jYc z&?J z$oOyq6)T6Kw@Li4e^pVj-t8D{ox`-U^>0Ae6b)x=HnIX?SIT!$x0z7a2GOLRKJ1~C z|A6U)f#gvz&!DgG=3(Lp|4lUsiYa#_kB* zTCcr95!%|y5#d5KIwKMg??-Vv%p;`iPzd6-MjU+d2sG^?G3kIVgpr$&qDfwzZ$4x$ zL}M~@KzlF!lO|3`me_U6s-3UR2 zzJCWPK`Fq|jQ=LtS+!0TQ5uIX|0QRx#sARVXWmTWLNuRAQf8Ze+Nh8Eg;YP3FPkmJ z-x%+s6o}de5WDrBv!+4JIPP)w&yHQwcus$kip1g%I-aJOz>07ufp|AQwMk`*|CbR? z&uN(Qh&948@tZ(2^u$|~HyX-DiAd^K4T&Gyh?TH!mm=y)!7e`<5iUtv1nnTJ%by*u z0Va`i33K-m2|dS$va=9dWMD=a;7y+^Z>9|AXT+?n6ig~WzfmL=1MozA6$F*+C&^8tqFv?U762EEWaf?#otvShl~-Zarp(}VkUfBz~o!zhoLq@EDjgW!pJcP;g|4K zx+(wUuJi3yeV2le5D%2>l>*Ai-+{iShWS+*WxA^z4=oW#D^*|Qb=u@yx!#uA8-kcU z({y9lvRvuys~2ra!#U@K;gjr(RTOweqRN&a=_Mv4)`s`^t)TTx3Dm*=GBr%mG?8^1 z!sQVSs7t3S8T1Y;@}dw?*eg$_;T*Yp4(xNj!t{{17ns#rPPtqvskMp)%AyJsT^7JVwOlzq2G>#u@~1JHYq6 zkQu64I-+4ZRYG?71b{KpMdBbSx11=o2boosVf>TkcJTDf+Z zN+x4ibISeCYnW-pnrRuV6%`dbHA>DLNcKm=J6osf&xO+YoHYTS%|LgoaBT+KIP#`WhmS zDD!y9y>I>r6!uj_G(#-&LJ+;04*p36Urz;JCP~_wuB5`EtP!U)35wi=9m^vSo8df9 zC-U1V2k8}!--JX<)~F9bLpVWD9tviR0(o|{o^A`As~z8AGkxSC()Nzdh&iDu^ovaJ zUJyKx#S#u13~|d-N~dCU#*UW=UvQFPyR+j+{hhvb<{w~e(s1;x&Be8DSq(}SM|D{h*!9N zx2spVHeQMiyY{ucPDTVO0@Y@HP@J2TBT5)-F|3Yk)kHbl4x9lANpeh+I{KIy`KDi1348?{+<02+|2Zq!p$I6W~8qyYGcwH0yAh!w+T}`$bctd z%CZ0ufKxM*09^${JS1ZzY1KZbQGbXGj%{w zCJx9w9shs-&;QGk>v}7l2tskLU%o^hf4>Cmf6Z(fxHT~C? zoaq;XmoX-9U{DXv*6UZ^@u!3-*C-^9=1m540U^Pr4X7=NQQl3^jkHI{8B|9-X(w;& zs@iJw5?l6K9MwaDBW9xL)oTu32;XbTc)-JzPO>xBTPu8F z(l3A)YhzX+`7JP z9e2B({p)f20kZ`?A6A3m^3%g`VXy37`}io@{?MN+XQy4qiCe_Im|X3#A*m0^_+lI_ z&!?Bx%~S1j0(IJp?xt76Q`_Ag-wmHy2aE8oe%U$MtIxLYKVE(s-Yq^q#V7IXaQ5ly zaL=n%o%!kh_06_DavJv`t}bWY)04%+ZtzGFs3X5KeC)9P_Q_)Wxwm`Y+I?X6*B3+5 z9rlBh`>X2Fk^OMJI1l``UpsVH^Mi}V=U0q*~Yn@*G>7+GjT@4>vmB$3?bv)>t zx(AID_tW;?Nq4^AIbHto`34>Eu!J1f3@$Pezv;9)qA=Z zj80vvbr46@)5p61`S5IZKJs_#?SR}Z`_|`Uzc#%|pa!2mMEfU?A3n@yqt?84IlF0u zm-XdY*QwO*ZdiTy^VQ|q`)GC2U!0u#*Q*ofxZKW)#3+w5j^`ZS4;+KofIH@`mL z#ru=pyWkp6`B)8qpn{UY%cd6R1~DoxAsKY>iJRAI>}5gTM~0Mf=0&-pSJ`opvAg zIuB=~tIwn!&_Qtgp|f3E9eIhZ8lO7h-oe1{ecYR#joQ1D`e$eMvE98mY2UQ%>m&Bz`0BoUJ-%u`J)VA?f9Q^A z^||44f|kxFxlIW zZ~MOAIq**X`!nzCy1(69wD;@5WI0(}j7AC6&U{pJJ|E5Rdq<~1I6A%iIBMK_SGyla z3&PGwXRpdW9DN#i2eprlllJw}YP|0pE>`jKzRLD#uiv_DweRX}_x9-eI)S>XMmGUI ztwm3)(QnkR_nzG9=;`ip+-~2uqV{gQ|2WyU4twphFg!SU>d(AJ{qpMCIUnIhZ~3wD zc(ng;P~Y97PU|*->RdkzyOr7MbZ>PT+$|dPUOnwLLNYbzKva7eUhmrN+oO~H*7@c1cwdd}`A_XD|!@ME{$^)C?VX7uUqB5G8xKkS__ z_hN3jR(Ocp_12mD6kqg4c4zujBM%>{+vf??aqHvR(fQ4JzfvU^BfnOGTfEac{xFUE zqt;%l)jGL>lx7q`8cJkg&pgxXT{p0EU zVK#Tpj+WKq)-^kAowSdqqt0coH9u?BZac@bUi(wM^Vm6QT^&#RAC6no-f{gXw$Dyi z`0h}DH%>vz>K*UiEG&=LI($4mX$?h7+H2PXckD&M*zZ?Af9zL#H}mD`^3%zO>+6$~ zvhi3t8(eN@n`Sw@qE-88|!N9RQtMfcj9wMH!ZbRutMGLarZvEtDVzU>#E(l zK5X&w_Vj(*;NGq~t!n*YcdvdiIzL<7T=kA;!}G;(vAyu=)#&8?aP(Bim)CwZ`V@9= z9&YIN;dtWp?mxz}`SSB%=(mH#?ODHdvAs;7UW8G_e(2FpxA*Pi`Tfd0sXUx}{>T1a zXF04{y=m>_ezw0ib@nbUE>ABGNZ+DE7FMdQi|x^pbg^5zzZed7qus%20`=&2QLjzC z{YTq7IQRSS_xJCD+uM(qC!_bc%PRK~o__dL8(&`0Bii{uF8d9CRBwN}dy0bI!fvlR zC$~@2j(sxr!a)M{bkBc(J9xi03r`4sq{svG3QheZ7b; zx3_O^dY$pdkH@pet8la*wxdr^W9w#bGG7jljJv?zJq{atZF+Zg9nxz3qD2CFTkT!H z|FpOLc-=UDIJ!QFj*pI8%kD|*x^>)ZRnOYPhqGaKynAxpIc_g+TdhX-xOLq!?ybh7 zwe1ZT@8{wB>e%lSC#qXepI3JD>^@2 zd_3&$VO+Z!KGi?4(4ep0;rza9?a!Rn!T9~tXx|-IJFENK;q3JE^WMF8_F>Q%9#m!v z=VUQG-dlC9AFl>M?9J_)!Cr0mlixYJuh63bescC^#%rUu3~nAD@e{T2QP|jA}l+&1nn@zTGza6a!Y9-QF{A6GxEZZEexVa>R= z_WS-rbkmr2j!&zfKe*T4d}W<3P8ywdeM|>Oja~clp?|xe!FJz-z4*`> zeT>fS%7=cVx9qJ}wPi#NE@Sqo^>lSYYZuYpQD8khyuavRR&7_@(~HjW?j&3`x?cZr zZ_;-!K3xTm+s^&unjLw&M{Tk=d8qzgC_q|-W+uR@A)%EzqkG>CN-`A4J_0!v-Q9c&NHejJjnI+KF&Km+?0s-@DGPYgsh* zwa`b8z?m5F(}ndXWPMMyg6ukFK8vqPG?5x4bZl$wjDnqk!h47rky@N#sw@*v{K|~g zoVcpW?7^Z5)crSASSmd?Xg*8WvGS$?d_@jR;!39>HIp3R&-zSe5_YRetYz6zO>S>4 z3n;Nqb7eoW53T0XUQVDV6*f_jlE6sAZ;VS=mL?|7e_()7?E4V&N{(>^f9n$>^D>F% zDgV+W5R^`EK*C6r6OmdPV)!JUp)#J$#Klu1vY47fQFbMy#3^9bj9BxcXz2KcrI0$V zx81@9XH~S8*-7|kLEH!jDL9&9hn<3>T$k#A*EKoASc zKq8Rvp95nr&I<;mfST$FO?#3h);SK70DQ_AUDg1UGw`4_=n8$5${`?5yTc%>YceG1 ztSd7qi=3}|0AL0F3%jnR`@SLA)*aVUJ$v{Onp)IXL3N+)5F$=L-bm~4fk^o_jKU@= z?$(PMvW#J|i z0WspuCH4Y(VRT#}Sx0Sp;%=3v=%S`xQm?eiD4=7a7+R_VgcJ&>Pkg1eQpzEGlRSb3Q!>iKAwYbKEccp4&9;5@y!QzgO_~x=7X7^bUqH5 zCly{}5a~+#JeqDd5MwGy2W8$pTRIQC4X8hmK)AR|JdN)Dh5xl?%93kYev4}@r zFzs@4qtzS6`Z7d)6cSg*b#3fK6tu9HXxX{!a-2U)>Gis{=Co_@*mkrHF*yj7rBC$-sP9T zs@e;)wuoNCSwq%D{Hb;qIuRu6(!tZkwLf&82*2yj99h7`^=mk|cq{o0kRdfxg@1-U zxfw^z8COzt?YVjIwt)hr;P)plHS={16+p#YQY54HwnTQ%CMwpB>g8&=Ual5X6`mip z8qVNDTcMDP9ZxM!u&`bjWl|$=lnQ(*$%1?nNbY{Wst3HO4`#MD-Gx#`18SF+4n!5x zQLZ4`4&$Uh6nDqM(a~~b95Kau_-XRJkq&Y`6?h1N!+)F}o~(TAITld3A0mkVmlDE? zUSUNN@6-nsvGJ{K*zKz|dnccl#^xx-ddpa370M@tpGonn2Na=wfuoF@tg;*H?RzRu0bsmL; z!fYYOkrLcA(V~`Etc$48BF8aguoIT(5bwN>~_H?Z%(u$z;5)=@JuomoICI@_!Sxg{`j(CnoRLXp%AIoyaA4AI5 zzhK0cYvVwREnWvr2qjhl(KS@EU*94Cu3l>#G!A$78wY7Q8h`eVF(Ya*1F90|$b~7I z>0lX};&6{}o?8-O8Ck7;h%r9l_ax7yUCQ@|s-!WP>7czlMaNn;^S)# zy66ftD(S5IQa>pslPE2dfM;-gwUDO#6YS#_Nbw*!Kq;anvG?Frti&iR1@-mOy&!~J zCW2ckwAXX%0Q@`&rvy2^sbNsQ<-A?Wc7nrAf7JO(O^5o0O2apIe7h;{_buhBE`Lu4 zi_;(FJzSg1pDjf%#sMvXkv1^v8pu6yIlCkv!R$0i{B6B4~xC%%s4zrg@E1@hA zVamWLjz1%u2engDFIHX`ycGdh5z!D8Rj}=%T*V$QO2U7o%9RE}NCcNMMUbQ#KqFve zVxx47G38#9jL(@M?1K}yZkQ6(rBmL3$2K%g!u=|xF9n(*i$ARoKdm#**HmLaQH_it z9+m@8t&HlsmMB$Q>Ci%{xO0M~%*GPX!c@T)o0cCWBqFc2EhENYC6Sk@uIFTxq_z%; zM;9im0c&CeV3jQmF_u}HaONpZT{``JP6`lI%4241$5#g?QM*cHHx-~FHfT}?DowMo z&IlrEijW2?a9=Dl^~_O>nLbgbN=+MPW#fD5;Ur2ZZCEDbdqQ;1#NJND_tY=8l+G#L zxR%$le&(bzh|i2XNuZ7qoDzgy(;5)N;!Ng&+%YZ}9q=xxg#sGHBIx>frBc6pLTFBG z84OFEKJo~On{={v;pj<{Q>QUTN!ZO^b#|X=UZf=HoF}cXT7q*o9&9hT5{xee-rs&&$vHXRd?83klRbO80MowTxpq9ktRB_Yk zjZ0@35HwXJ+}X(u&ZFJ*7?Bp5Yk8gWGUf@q`X$K$x7r+wjEGIoXA2Bg(Tw_OOfoJ< z6`hGZMj?Iysk4|YUO5_V6MeMkvnlg48sYs#fkCG@DkSlnvc(zeM^!JWkZf{_)@|x8 zA^d8HyXitr*o&31<5$=Wm8@dA3f6k|OhFW_I%{^f`ezgISL9ws%@bt54MqZuYSk+~ zTd%ifI*?Nr3>^f-+H+Mjuv)d=;Lr+Ns4G|%k;YLT0Jy=05$jjPC%+lc*ol&TT?4L~ zn`au^3CrA`d9OU6hfBOyXq6p~|-nVUq~&66`LQ;+K2Y>BBIy!J4fVdI*vY zT(X5)$isdNLOqprb)aBJNGgpuGX+`8p~;QNHO`PRi1NDsNOz*%zMw-)f)&UN^15GX zg(Wp^ik$~LQZ+T{J)$$3NC}FVluXJC1C(wED!ht~Bb+lIX#S{ZK+c3pk-zsyg6 zQw?O+pkk?**QQw9(F8=g8rVYjC){P2L#1gm0OKsZ5EQ&MDA_xaksSK*W7pk5K3(ez z$QE*#)^kKV$eK~A6OrkcmFky-=SvFBIrLruV4Vm+# ztU!#txZ5h0(qsL(WIDKDD@X(NW!YyfcZLa1V)>qw2VrNz31w2U_o27pjTB_L2Yv{zE_ zCm5$Ojb^~9D8mh*6+>^KR2C>tp-MWz(>v7apH!}Hq>N6gcT{X#)E%G@`@*W-7vB`e zfRL%V(8X$yZ8e=BZ6a(d#AtU;MiHwmS zN{k2+EzpT}|Co~%s|cR(os5W;bOzTND7}Ov085>G?l23IC&~*N_}Xp_?G7HA-DJ&go%&>#R-Hc1->xPzQBDes`#LA_i% zC|AqXN^Kvya)NgEl!^hzRwWI<3&VIRjbii4l)Nx4}7p8(N|i$3*3N~2<8 z&aI5J+o@bCF(bNFpZYhHM#FYn6Wy#2>$>pC;S6Bf4OTt3WL`XDz#EoXD=1AL=L}4T zfi--REG%QTkmn|y0b%(2j8~FJNkX^VsoO_|vd&Hy=kQVKZZ@-2Ya%;0&10>>fm%8K zYewRq%p!p|1vpx0Gsz8ZOycmy5iJSp#kIAX6S&^uh(d*Q`G^;*-OF*A-h?Si0ha0Q zISetb|Lz0~8aN*g;&G?}vTI1nj>YCX%t$GhWC2z=Ys?^$xz6>uBm76u>7sJtVkV%j&5WeC0kzZl=Q3imB&R^^I}vzBu|$*wd>OIgNFgRfHsv)T z_^D+6+E@M2P51bA)a{>@J-fgw@$#k=7ASYCNr*kdnNGlgF$NXp7$=;;F=jK^BoCHy zB-;%kBPV)$+!_r<#^O|N{Iol3%3)L~oM5zYu+$I=N`Rx?T6LzzVj6CKV*FP?HauPV zBrE(sDcE`btsCJ9(P^z*11rNG&Fi8pRXRdEWPHxqabwr zC`t5Md{u91&lN1VmcIB{G+vji8U zb-UCfv2=jv8FAgFT16d!x!9*Rggefig5(ZItAL1Hf#eZlmGrMpI$s7?H>2Nwd#jLd zN}`{@J&Nub^#dHuelLD2vw&D--UIvh>VK4dIkfLZ^^Rh%Non{lGtTZHGfK!@`-jKs zM8tz(vIs{pXruUc6Zj_o_+EVX4BnfF| z5h=WNjm1?o3sv8t@89{|B>oYoP~`vr)d-y|O!GOUfuQO?f#`n-{0|<0wh*v(2SxM} z`agf6{lq%f>LBVX*ZvW!_(yuH}KF3oge}x0$5dr-PA7 zV+143Uar?cE`U7$RhxK}6$+;`M4n1)6M9lja=EPZ;la0mJ8qd)jtvL29Ar`mWgsR7HpZhNpf<=`bx^r7dgjN3_$y~^ z?7~0$egD$Wy8P$MjJO=sX7MW;fLlApa;AWWACKOp)Sj5;>6)9hKYA3}gn1 zLh+i~kn!&*3S-|w`@8U~;|=2pXS#}|Vv6x92~w9HAE+H(J3y$M00p*if{OoxmHr1S zD&x?#36-2avcwA6L^wHu zQ$oq~Q4L(W65id8k1Xnq!CDMffxWO#k^?OP@0z(k67N*CMWULh_)@JD6RsQGh&h&% z(40nXxiFcHULQEtF_51dex_Dx98utItXF<+0$VXRhZfabEDQO zyy`Tk-kC7`=I^g3dd4{QN(d+^EJ((h`uf8I%#gY?G|}&mkg#V?ZRM|p8xqB#%!dar zza-aL&J$@yTu+GBS;b*2Cakho+dtTX-!1BK0$19v9o2RZ4)%^V*Zw;i?>C5Vp}(Vtm_}0emrFB#lfh1!zoWMzuZh}NFRx@95&msAmz9#=N+n{(#t*72cIK8<-vt*2ekVe#^e5}n1XyJ@2 z_gQ_C5Y8GJ$JeMRv-q=l;Qw{Ut%QpIh)KL4No;=m_PmVnr{^YTmK>&MkCl}bCV_Y@ z?FYU2tXY^@%3+p?Qzwg>awNZ{rGU-fQA8nZYR-Iw|82T~dDuW;wXt1FaH)bayhCq& z8lks|bUn9PvzQs^yLY1J{Mxx(?dt}F%INRN=XBkVP$RWtKQLD%x4j|Q_15Q@D&9D^ zbgkFTDb?o1xk$;=4e^LKCSh-*n0l?^OGMTsQ*5nnh({yGpDK&5P9k%Yj$KA!GabrE z8uzBg>w&jQ{t$)177cs+d_ZkK_B!$-+tkXelbRFk*xd2$E<;7fUtrg-?WNnQizyVP%0y4) zsb2XJemr-kGuN5UBESdjMv=YSo}YAP%n49Vv@Ut0U)T)c82>A_ zBv-`1fnS0~k%ZEI;n`(Q&u2--Lz&tpi~MU1%@3JeYima}Rc=TUS<7s;1}9Tv zBcu&Ez1HC6*2{`O@)B{aLCRKH2a-v}wFV(ozTR9qJmhaX-0f0=Q7mNc!A*F%rYR_= zXzz1*Kys$Pxw?TS5EEKcLIolf!oj>mLc;G~2fM6mXXb7ey+rfZSdYY&RDMt)8a`Kt`MNkeDq_&9UZiIAz;2$2x-+GlYHswNyEehNgQ!nGu@%v|ubMbHZ< z2C-K1TV^x#pe>i+P&+E;2dQ*?1R?C4C=(S_teB4IEc$pWhT!oxm+Tce^#d$-;=JN1`O z^>06Lsw;nm`-FxsomV~L^#QLR+?StBsZfu3hyHm=oYOXuyFsfTS%l|4Y$SamR+U*z z5x$U8WBp+DsB7Qwub^WkL7N6Eki5Tw*g-$}#4bGq*_BV0FLk94@*3StqV@7-jt)>o zRLmX`vujPmHbHANSnG;6;E@_=f=?L$;v8o8Wo@#uc^)wnOPB5Fh4G-Gs8=+hzqEXE zC(_He@d!OLbpa?#f_QVV=Tt4BJg^ zDgRS8^rvj-6|$k96Ak?_*-&;+ua*qGPBip7+0d^O4*l1Y4*gTaLw{U8^j}Co^kWjD zUnC;RdrtfTA<-X^68%9jQO-stF{;4@hQo%;l3LvI+#KZGTej!;9S=MDB?SiUI#H~QFp(Vs|1;*iUoJNacH(99 ztaYpmCuk=1S1vLT$C>X5(n*5Zj__wLFyX)nsFkxC|=$|uj7_=TyaC_C?} zl%tl`8 zaD8u|#U6V5|Fiez-EAAmqWJ&(6#Zz=jg(_R0KrxBGVdv}k|^<_pCo7Q9N+xNCeS1i zfoKE(DQoO}_jh`4tOO{=Sw=i(CNkMwUAV!OIlasb17VeFk}(VQ>#0 zlB-P+T(YV=g}%8K@^-Q^BgN+NGSOo=pLap`|9{@ikdG2BD(dEP=(4^^&9xU*ljW0! zeX&EqTdkTSANFGV{^HFKmv3&SFE6hz&TpsZZ{NJRIKRDo`=*;y^fpxqX~&_hItY}i zQ1Sr(u0m`?RfM}st7`#LQe7IqyOLxI4 z>7sOBw6JtTK$*r$jklr6mK#qk-(KmVm};~kGTGMUj7BdE*Dd!KkS*jRz^Hfyuya+c z{FX;kW|}rxrBKt2HXNVQns7V&vs$9s3`@9hp%aQ$XpLeRh)OhNC|u+kQDn-OvaE_; zHRhtkYRTMl<@FlCXg7b^ZPyBLL|Uvt)!3WxEP0n`fgs|GS}CXw8ck}Q0Y|^7g{Rj@ zED%UlN=`KAg-}=-nu4)G{wTy;E?$>utxDwVvQ}K+R+4Thu$B^UIgGsItL#9}TZ+gP z@SBRt<=uY^k-3=+R*p|IS?p+6=i}c(Dtq2UDtoS^GPT2+T*hUF=k=l)D9C1I9oh+J znpji5d==tNUE{o%Q@OAE$u|vPwUcw20BkGoG=bSl?r8$Bx%|@vS_?U-3Alabp>o&< zk&CLqtKvTN&h2QV2~s>&Eki`V($%t;p53-i3Oh8mOl)b3aHiKT@#|nH>+)J-j7vII zBK#XHb51^Nk9NgU^Lv5gDh#B!mmi{D4%`K;Qb;MlEq~kABg`bqGRSqZ=1ze1NM}IT zi>u`$X<}>TNION_a?qNHTM4=-2J1E;y5xD^5-O(UmAEuR&;|dEBB{x9nsiMK1XO(; z7lmr1_b(Fxr7C+1V>8r}+Z1Iv+Jx!0pO=^do1#=QF@l)>bp?8wwjHoyKB8`sY@)s^ zw){bdCBM?!;fU?HY9_wPdxh=N>IdjGOI2U;PSSqm&BG*xp^MHTyFh-JccRf+l$uUi zE1E|~R;y$UweLz$DeF<#)WSF=m81AXvOi?Z6y@r-GAJ1YXi5yO;%n_rRUEV|X$JVD z@@!OElS1qvQ6Gw7rhg-I;{@1cHdW7eQ_x-baguha-(%sD)Eb?N!zrgHF(Vm%t@@E%K}|n^$o%vK8wXVeeXaHgcB4$6E%)vp4_=P-f!RD#8fa3xjl-pEX)IkJ_hgJxt1`cdAcRQS7PtD_y~ z8z#A**;KRT8TmVq&qlZ6Di4gTyL)x4McyaA^r-WS#0l6!RTLGb;0$!gwzb~|#q@d^j7ZzpC|)9!EUmC} zg*M^|u|lz*{;L6ms-`7=b4C9yK-vw{iNq<6Kr({9$7 zK*hi$3ViBFNB?-`Cn@NbHB@PxyP^;l?`vzxb=9$HnNGaYSx)(X{`zYtk(mwad?;z+ zM*XnLqCXM`_0=bl8%~|PUdfry{iz%Tc?R@+0fT(~a#pas+A%OI)V`@oFrIB@@?y|x zt!qSiJ-KrgJfYx_1hNEjm;cdi1f(*{al>_6;8-R>hAbqc-BN0AmYwU#;y!8?b!Qoe z%p!AN`l{7Flg^rtUGfr0yVjj2yHDYgC)&p`P*;d)DvC>7sCtyb<*wAzvLRI`WavWG zy7H9vXHg`|VC;l@T-&6WsXmWFyCEB7rq|B*cel4!wDuZZWj{<&3|(4~T9!OhgVZki zDorC+b9B!-cw*W+`-qXMSFQv^3gab8v)vjKd-}A!MgfMN)F^kW{k=6;a5v-GQ1A)Q zwxLx7wKlzs2R4z7+?=CCCu?zzRlrBa=IwjPg|V2(*(SwoGI<9<=I^&Zn7mPYPe97x zEftNlay-`o?*~;u$*4!$Lz8<@8t9r7gJork*8`5#C~bB7@ld$^CdO-NvmpN<0u4A~ zLh`=z;Gm9K*JJPr)L@Uo?J2h`u#be1r9uF3d{~b z*5l^t?EE4-#us~yksuhmD^-5uQ;n>qyWz0SWHoW+sUvU2EJ^G7p`Uh@y@<`=^~LRX zZ(rt?=+))TZMX2|-eX1qLeZ_SUbD5M-n_cFxXP|C{c3u9`TF7zo2a8x=dWC{b{uG7 z`K~Yizv;W{;@K^fO4tKicZDdbrza=WuCT&MdiqfhUn*t%GJ;8R#U}n##;?Dg#B^Yz zv^wa?{~?bpgEvX>9SXmCek5qZaksE4rCWUURvaw7>Gj3!^}j^e$RRd5M!#I6G=AV( z{bFu{J$56LETiNU-28BPHNAaxGyU=6`tqB9<))F(LQt+#={yQW6mCm&#>`%QnW8mS z8Se$v$UXJB%_cJjAF{eVB_1)TosvF&Y+5uiJ z{cve!E`y14Y0xACd;2Xpzu#Pb+x+>#_=D+YI7Mh#Gr!RuW-u&v&&sW4)lt( z$!1Of1I_JlUOrN7uixiT7EjS57EC{rJ4P`Ayi5)>l!A4rHB@d%KWZnNQK!cW*yXS* z@gIxXJQExDMs{i{rKGlk;#}Gdl`CK=5 z3buCV&JVp)ARQz+;{AEr(Gqv<4h1fwqFS7Nlh{?^hQ%3Z7eSewa;m9y+}e-^D2DEI%`RZY0!sZ=tDH4NbrdB*&KkM>+T zoN+H639O{I@X#yt%|s)Wbd)}8vS;yB71M-?gHSj;&U7(I6#^J zZUC2kR}jgIkAy>E@r@s3+))i$GQ0|b{G$BEOTw2!Z2`^fatZ{9n>0pn{T)L}Hu{YZ z1^^3LWa~hKEb^7NN_PG?-FLF*xm5;gnZ>S~*EHEkxFntPtNu9_g&|t-*=;WFo{;`z zJPB|OKYaa=_l150)&ic6^c=c(o9LW*Ode(!4P@n+kqaoV>-RTr->7Zw9vyetCZpK= zKEa_Z#FpFCQ_%g}5xrGp>5miex1%*m61YUii3$~r>BdZ1)o@);&D)-Wb+XjHmHNK^=$=~ukdoQPK$Wnp@+!&f0{8hc$o4_oUEk!Bta=KP@VH1OBdn)8@&x(m6vP*-UDON?ENG` zFoQKgGC(Qvz)yb%=?aBh_C@Xr>n3w>4-*i@XzSxm5|Zst??EC7z7~Vztb8`$qL5EhVbs{_oeXcqAXyCGhtv!LuQn{33o>2W@+P$!GYb?7Z+puTfuM ztl<7u%3sM|>X!7bkP_r|B`8Z9!1$qcZ2r>mR6(J}bQ zXY~C4cEKkA@9%)|jS0T^$OA2ox_|TjW;ybI{}Xm!fams$=e-xtofpsh$A1UEe(`sZ zrKc5ioulowre#)dc(dJy5)?266>pRbnfe|$%*f4Q9-AS6$k+R+=U+PvuEmul`Er~4s zjL}p!V{kKXc1kjhZ7J3KlD^^E<6Sf|mI_r1KlGCoO(CyKeT7K;og!w6H}2|j0_MTb z*fa1p3?2aVJi-1`%&Mm_T@`_Uj{uBO_(iIlE(u4&=?ca7e!@aZBJ6>CKL}{O3K*wg z6X6gb=&l54cLl>GI^8L~WRD4*Doyfl@E=OerXMTIHHbQev?h^s@hhry8tRiO�zT zl9**QN=+0>0B8h|gJ>g_eAF{OXg^mf$I1j7`dH3(-yL|MGKba=sa%#yMm_lwc$+Bj zUGjcqD*@aUa__PQajRxnW{EGKqV9Tql#Mghr|=2T%qqu)Hu=@z&GMnF-0DGaqe2wu zzQ20)?%T^Z;QZ~IZ(d!V-~I$@*M@t$Cg6)KV%;ygy9blsbisU+g6c(qL5!gHkR2^M z#qJkoyAfpp-|Asm*ko~PeCLY;E}$Q%F&gE3;FxCiwE8GNsdoROpQ8TPLs5)a4V(ih zfp_SC`=gPS)Bg^w(Ubq*XZhs0DB&qD)d}FVBG+mSlbrVnqd?sm`(*|^Ox_U~1UOux z7*HoI6I`;gd2@t9ZvXda@pDB9XI*VXEf!-(%>DG2a zxe8Bv;{UR`n)uF1RQ26&CRKIK+fQthpqosdkIHFiEgy59ytN;)gkXE_!uKU9;;YwP zwcc-~RZjWGp_{Mfv=d|2;ZaC)5c}a>sCB;+@obO%Ft4h$zvm>f<@R^ZKx_V3^mR~= z<5S$adCQV%HD*^@w?mPC9pvNY^a?}oYZ$=LMe*fTn`vcx9%^Pes0Z1wvwVfWR{N&) zKJfPGkef}EXBBNm6)GF=cca{W$N*11ta56UdtzsrnHTwD?3rnmwrxA5Faw0^IA`5b zEkP5M&!p!^Bdk^P$04p9PIlqW@yMd_r6|x%OI_<@y#NuD{h28T# z#*h@yBn|!mcz*4No*yoEqN}z0{je_BNSGG4Ktv_}J37ddDl~N(qMM{nue`4c!$VPk zAIP*bk&UHtMZWDL1PSU8wb%qVNWgjo=0&=(1O3AYL)skL%Rm|&@*h83zKcBd_Ai}4 zreO`@zW#NL0rp&S9FAu0f$in+3>ruAO~}6}M>rTj4b_qOE(l z2#_7|f4!mYIK}Eb;0n$1{3eRLDv0{^>)&ycDQ?q37+|)wj}R=}#2yl7C#a zNncU~P7$Nf_s&xChmEbNIZ%OItNO#k+f|;MBtmZO$t6eohGvFiORE08>)dKRYmP0X z)mUF+56R?m+VW)Xfoz#g4W}i*12n*&)tMAQ@`>`R&X>aoAoSY9n-)5k4rtqwXS<)Hh`)wW zK?zwQe(nLTlC_JAaS%8B)*%YN`R(oM{Hps0ys}TX_35^@zpV!g>?tkM_6HC=pFV$x zPl^1`uMX9w8p#0^fji`XXE-e6|FxYb{oiN#)L2GzH!jUjsg#>@Zn1A>UozB_I_%G) z4y(1N)jR){@KLckISp0|n00|`Ot01$$I2s6eira% z`*FASX;cs|^~0qRZ-Umhf4BdKWn20C?>JBK-=F1E;|H2opf-6Zww3lAx|P!Jf~_8c9aOG|G&Wiw(|_k-Y(Bjmd3aw;AsL^w9lX z9=ZUuuxFOs19BviGwD8=U14RBVKvzZ{;x<8=gM1iJtD$~NtZVRg%p&g+Yyc<)p zwYAlotO9ud5x|-DN{*24QkANj%{|K|wM)%7<|S)Z;FV8&?@!G4#NIdLc)8|#@H%C0AVqup%5iw^Z!ccd^S%0TQ+7?JBtD&GarZ`r$L|533PYpO6jnINBz__PZgN>dOgQ^(*J#yPwwKCCW}*# zkW5ass<%y5-ZlcJsOc*czm4Vwnx`kwpW+Er=4U|%Si{s^z0$Viu-3bMXU@3?L+Kef z3j%x(?$MlwNwaD&2)w)0{53UkrOtg*`DlXjK%oXc*g95zILDii)~N}R%bs+!z8>wI za0JOWr&&kO^84zC%v<%0_BJ6ILr+j?6!(yQN_LX(fZ#DZZo0_5ncGJhyraX^t+Fqk zZ#8>t?QA0KWv`}!2cF+4Lu~QqoJ(oDMU+ISIJo?&)spTx{Te*>Uj&rR!B_G{w)$0$ z#eB$M=tt+5FRz=mMIT%grTWSAqpt((-sx-Q`W_RF}%-_CZy5( zFY@M(2?E^Z|2gXA?SGa%e9HgvSw1zslGuCcC-EjCBIVZ`Z;8^peeN?G4oj4NJ-eZ~ zj_EEM7yt)t0q$k=D_h(h2EeOgmp#KRBX9o1jQ%XlsARQvoFi@>G?bTVjiYFF|3Xw{ zd6ZSt!(C@^Y>y*s8UDG3AKry<3;lo)ur{|c+Y|7ZkM=5zMu+B6_i8U0p&9?j9{1bd zOAOe>|9jRT@BcHjp5nhg%cuGlFEL&Q=n8wU`PNssfNBvPtP70%d{l=7;)l!5!J|3~ zm~z_{|7Y9SjyB+)B0T=w+*L9N6nYW%!<74WP{r962F=fi8^Z`)@@`^nn4V*mrV;yR zjhBF|`Q~56XyJbVzy8{4=nFo9--AQ#?G^POYj*v^d>Zlp7;jRvzXo7u{Ku&9{vQmV z`2T15RC86f=@m?${fHwJCM$oDa^G6U?XSsi2lP{gQPkYO<+HNBm{G_&dbvWepVG9) zwR}*L$445(cWq}wN7GE>J={!L|3`#U6agI2wN!IosvKH5_$fCpJ-ZI)>8UuRen=zx z(S^4}w=y~LgZ}p&EARi~SpBE?|IhNNzQc0UD}pmVr}Fo? z=IcmCDdfG>Z-SBQL~V%W5!-qT<3B0rq_DY9(IC^txO#b7=;1iVYV+E|2|N2A6Dfs`4hEMw6&+-wnLq=VD zc6G@Gyu|ztCiLsV3TaQ08uAHp0hW&>3Xi_4j}z1mz47fHOl9%44eo6I-jYwDND%qBE9BlK zoArq(?Dz4bGzPLduHdGvRUVmsLDg)r&^KP z3WN;O%t%o*7*f=_^eP}qy+sMUp~NW7;P~<5$(P`Eg+Ppw6yOC& zSAIe!MGhxOR(KP5V2(sdVvnii(iH*(37SShbaL@}O-92Zq7C9rc$U0NQ2YWc5?UVT z1vN|LR!o1W0`k@Z^i>76bgp0pw+PG;3PFt4c#AwGJIDd3cbp}^=cDDmrLEuK@EYS( zJ8)l~Xq-=j`0=B3eX>fu3PsbLqbe;@R@c6~1{ufsxb)Z`pN> zwq)-+A#TG>ir3_)n@q!7e222mTvu@wmR>PBsz(P(2^g|RUb)Gx!CQ0%7 zGSj}92wm1QlZ-;%gLO=oPYN7m9+@4y>`nL)6cI4!ZpH z5z_|r5z+-+`k&+cT58rSu`h;5i$Z&7m(yP>zxR^&6#3PR(b7-Sm`I!__3a{@_$j6> zPcySDv`yiXyMY$4x!MGQIJ~uZMY18tf~h$rVr46Ne;NPZajYwWYV@m@9iil1NaG9E zF!WBrd(cf*-4~#HvW2nG^-tLeIDt_VJWNHUfmIj$l<^y?e;mt`brEjAiSas%0AgQK zA^m7)>dqpxV_+VuYm=XI#jM+)TtIg(RQEzt7DBAgdaaFgEqZ|6DZ@*<XOG8{8 zmr)BLKd~(iHf!{nFrtzKX4*U>6el#}lZ#Bs#VRIN(yslPFaYg(wc9NI9WHa8W8_Yl z$yRucat&%Gmu%)&xzy3@!+*#i)Tm>VNtWF8+BuapsXLfS3WMM(*ew09B&S?eKfFcp zee9=*_awLck`Ukh_v;!h2qTFYz|tv}{nmO3cMo8Aep~}AT}P#z({*I9OVfh5X}R?( z^p(|gVc{=d!|2gB-t)6JczK71@WscOsc$u7n_k|*Uqwg=?{BZf^ zX8PUj?bXfnhl_vR+`hfOm|mUT-2C(H^~>XK`F`y;{mcvsaGRg}z+WKu!Ob5A`SlL< zzv^BoFg8-}YP$H>C`kyFDv<5+HVw4z6_gC*vC8z z>Eo_F>ikL43dhGiTgxRoD4ma)3{xuKp$~qN`r(o_sRwhBXLTVLACRz;3VFJCkY$oL?O^j8fWmY-oBi^IeUFkHo!Mpl5_Q0_$ctM z(V{Fai~h!Lr*I3Q{v4%4e}DGl+4SvI)#UzR6b4{1X?rU3fbr6WiEA>woSEV~6n^#m zNG!lHkWpHi@u6GF_I`$2_%`RckeM0h2#1+miBq{@MD)+E8oQyZ*#X12NAnot^sDSc z7P>2Rat~v$d;Y8oS%MuaaP#Wy$BXINw-;}2r&n*UZ_8JsLK-bgU0uvuzpva=M7Dx~ zmyNjR)2Jv2)?74pv421h6_-u=bv9W6@xY|Q&0QkI7ls=b$10fDet;Uwq&a|(#;6<< z_UF#{WA-5Y`7QyV7__NAcc}Ue)nd7RK=~I|m3*jOmL{V{e3%yeQCLjMF39=W&G}T^ zlJmE3zPbFi4Q|!cd4U5D#o&{qH%Ho=gHUU(UQ4>AW?QAFIzFa!yNVioe-4v#KK#3w z`qRDm_!0b!{Sb6tl+w78E~TrNNyVR`5qnc5De;Ja;ug=KMrWzn5c*T2$te;PNk&T5 z4A+$0mkvN18Ub%vuPv^E{~b=!@-bHYmqut-gJ~_+|GfTC2C3oVRrHn$ul0wjE!4Cc zM6Uku0z8kZQ@o%LX$;9oCBjb;Q3}b7Y7mo+MEUvRE3HariC~bfu3|h#r80Izf04ch z70C>ShShDBT_>x_N@1LCB074L@_7syQ}3p~V~&AYbh7}JKx)4hpTOUu5G6_5!7}~I zMiZYHLC@c3glxy+5WCHD``E@5sH{QkH#34gsnmZXm3sMz2R9&+WBN7>9-NM2 z<{G@}U1*}`+j-?{lz@_wKzCJh7>eqm$Jyk6fA735=<<DIT~{tC9-1a|Z3?l9Kxvq<%){-CH8;x!+E*gpGF zIFSYZbx4A+_l-5GCEOMy;?E(_>=I>~Uf~+8U17!bmqJR&?bZyUzuTwuo>!fIEGMK$13*!zwyr}>K^ekCr!y1i1Rjz%j z4XGE#cdl9`%-ki@UOaW#v!&p?*yi8P<@>s#=Lw%`}2Z7p?cfF`ryXXr>>hR9vMu+4%O zr9XFOsW^z-k6NAh+GjyINc|4|-pSSe1fOR4|F-ULSpU1wMz2hJN@W{lO!0_Z1;j))*5xt#;p* z4=H(+1h+9q0>gI<$E$rrZj*ImI_RX}TsJkqJ{fW?VU_N$7eE9v*~qskkrYTf*` zvy~U+|9B1`CG8hK_42UN8sg1Z;f>evssm+oQ~E;bDRy+@vcU`~POPcU5Ll z)E^GYpCkFAScXU>YOwJeJV$85r$@;j<59v3*%<&vKFv;-oPzgV8f2_|cES5@guSHu z0?_}SpbyBE{|NAs{w+1cOg%~!!n6z8l7m4(Zc#j^;Fc&QKLvh5|9cNpch&uAUo^^x z&J4&dBx&uT0O^0ZWNB#bMGA{z@&a^OZtU()osMA`=gEYBjjmno)y%iG9z z7V>OzEX5;fNV<_r>L-Aq;Q>FSedQ(SJOlSD6tgUj{3gQ~fn*a!m|y;Qv)?`bnhpPS zo&OWAGY$}s927UH=A3jyt!zr}TbznyGyfU6DJ2{k6&6pKSYLpmG=Jk>nk;rV^T&fs zH%8FYOy-=Q`UwaT^2h~TfCsz*_b^P!-P$CGK8%yo6QR6yeRJujtIeEjhT0m#jS&&A zeHbK06yvS$q1a$-_N4O+zy$ay9VGz~ir0QZYk-hJmMA@;l32}AmB3xVuSy#+Q2`I<<9 z+&`l8OodqHQ(|!`k{(hMT&7?dLn1lWh^3up8dnmWkF@WGIE*n)yA%!aFJs&5g50oL z-v8h5UAak+A&^L1_la=)X$VIJyApZeOdO#wAqU>{aRm>f4PAEJTy@-XtyzIb@LnF> z7nyULP--?J=R`D+-4i}qjkp4Fm^9&HTX;s0qn z1^e&F9zOYhewI(0I5y+gUnzg6@B<}{_7p)%L)xBL!k>aAF!!Xl5&UI?I&ABe?^^Tt zNHQGvLSqhnEX42=m=F6XbU`uG)?b4D{@$NT`p*o}2XO@2MgNEPC`bQ?j$=R3|IhKM z^JpgLfJVF}(iQW0OdU`;K~Z0CHNRB#Evw9U`jwXC%b z7iqcr$vuiui0)Y<`X_58zb$8B>d()9|10Ug3`=}G3)oHn`+51_vIbA||8soy3HGH? z-j4~AJ$^*Muu&a|_J{|FJnc{Kjz96c1IXy{pYIZ5;RomxeCo7_lotQ~8YXDizX)CI zA+HdkCJ&2D_|P)RdBvmV_qhL6^#70%0K4dazd-*7)?oNV|3Ak^qyJSjxh#E5c~$aa z@)}034^Ob4$n;-=OlQ;PRBWV5!^8Knm@{a1+9CeH;&k^DV5w++fBO4-f6C}TJwOI` zx?*nAk75Tq=zq_4oV@%$dZPcI=aY^9${Neg=+3Kfu)6#Y!WIWNDW+L{lKXlB4*g=j z52NAUYdvfCz5x;y8IsDYUTPXBbDo&5g*55Zmh-x^qX`_J&n{{MMC zb^QPHu>RkK>p#lRr&T@WlT=%ct7^gY5jS_^x{j=(x$oby1QuNaYt|58dz_U|fLEzS)u5D$_Y{IBJ;8EX4tebqPcJ zV#n}$*V@r}Q4L#rv}n?^YCQ%oD5?r5CCrB-{`#p^W;wJHq;=+0rX>grz@uJ|X6mx2ds%9C{S z@7#*bskvL#`;MdyzlDkGxtOKNB0Hj8Z-=rGo5%7 zn#qa>KQ>xG(k;J$neR$#j5Xf{S)EGDqAuYV%C$82HxNLK+<1lj?J=SySVgwbH)xCE zL)t8=_&+59Y=XbF|GzaV>i?ho|3A~`ar|G#EAHubBd)=3#Pp@Tkr9?t@X4TU|1bFw zbZ-&0Xv=g1?=FF#07&Hoe;%MN_$Ub3CJumM#E6j0{#g8Jcqo7mz_yx9_OzljrAl^7 zE4C|-!_s=V9QM1|zlzbq|3CPJDqnt zvBv@j0lp^?0zbT?1IK8AVidXv_(`%s$qR6GoxGq9EJWP!(*#7Zk7Lqy+cSrzWp+9S zxFn5F!AvB|;_0zmygng>gDJa`69)6-J^k;qpJp8cTwU+(7HxvyzF%DvPK0tV0*m725+gVd@89Ynuae1nyzN>N_q`NF;vbfjLZ&2XF|Mek#_2 zYzR&eKw%pDD3Q_|)Yg&jrs_q$nIk~AoTdH(YaAosp%nT-Vs<*uo`HcmHV5NQ=gji} zj#8eHg}ko(#e+%($fQvqnJ7EOQH|R&VTh$nu8XPy^r;XC%%<21?HySbei+{OsNJY^{G!_0QxWFkoW1 z*h5(;_GDz6+r^|ew)#UG!RdIS!Lpl7rav*a;{_Todh;nllZB3q)d;|dtcGj33)^*i z3umkV^e2zsUq=HsR^UAB-jUY}=FbwC<`A<@yJuQj=TWEgjsF3VMFdIuK-1SQa14@7 zgkmG`!xY6}1UAt!hMqd3{b8d;u*|K~A2`Fl=h$%CgHvtf!Q)q)|X{d5IFLKw(DXNu(XotB4tNRQTJI7aqh;aP*ZzN)<@`{E4E?O@KsM{v%n{;mB~a} z&TG5?2)Zj8d8CfH)ApDXj%4@8i}A=C_2*L?X_M_W-pBr=XF7#_EIH%5`s)nQvD%&k z+uZh@q2qb33#WZF(g}EPQbxe<{Cj^H``*djI59ZQ%F}YkGIcm5r@JLq+TrZAKI;W& z+KTsD$~3*n#N1k*!Gi5MKM&yTJwqkBu_nCS;;_a2-%N0&l+BKb81a)X)k|E?NO73 zvHRwBFrSY5LwC`iOpwk^?cpP4qOV9J5!`ktU!PC=3)F*C3ptt;Z}(en(%3P#lb&l^ z17t16_QcR+VB29AXhwU!qS@L}e1+q5MkC?oh(2-Ya5OtQKk(*D-=@u!PbZD zrOYp$g0IduOT`SBeO@(aDP$C9qe(1w$@#50CwBgvv=uO%p1Ba6NwxdC7L|d()xpgNtnhb0N zr)WO)Gzg8<8&==k5+Q!#^%s+I&(? z>d&Xc(a0Vs2zFcAYB}cCvija&;Ecx$M_XiF8mK|WGPmBi=MILG9({2k4Z^6MqQutM zf`|g-wxm(O%7DZv)hy^WwUZRb1o=WY6TJW{oTMRKqhkW8q|7bvP6t<0DWT*wBq%3WjWVK0Qm^ z#D+Q%Ya?`wCV8P_)K=&ij~sK0;B+vy`!1YL+=+&F%XeRo!0NjTG#F3j(}g#74DFyd z5t@6Gfw>(m;M5`%(VDmu?auSZ*@_5;!fxWBD8LVE6sAlMwg@&KK#aCN1sEe2hpr#^ zbOj`!X2+~&Zf$!!8M}+|0#1k8F>`8nbD*9Yqc%)=SkMQI%*W7M?M!ioeEs#=d4|TQ zEc7#;rg%mv$xNl!o`G3)UieuivAtm0L$e9z>`g3lJ8=-4_6ZB_4dHYsPs>o>qtZ3j zn(o>TOEqnx#O#g7=GGqBlf}fd-0`5Vy4#)3OK$CB$^kgXn-sh~zXVi+6$JW08=nokF#p$1^U&X0a{bj3GIcEaWBSAKZMfD0>? zC{4iZlA@S_lKCR+nQE+(=V;B1$?=duh6S{|G9y!;b6fJytW*Q_XimU z&cFhp1K(G7W1w?`(x#Sb$_jQG`9^?!qpy=s`vm0R}|YnwdH}dAKF3 zUpWp{o2X@K`@kOB=62!^M;4s+NBuFJP7LixwY#8p{({z1Yezqk&8RgI%qR9_0jGoB z*c~D5qBQA0BofDXKK1%=YP;iMU%zTrr*lc@l(%saaA5@Je&DAM057PXD!KEc+aUQ7 z#s1=f*L8tQbd8cU_T7|_?Eo$*%~Pp7&vlbXUt3PyujmE1zBqgN`hxyR0KdEX_WJDQ zbC@?L|A%mWJY4+CTO6#x42h>f~e@2C7uwqmwYfZx8pIKE{15*>)C^zy5ml>o7W$k+Xb9X z2KHz)7!e^(T^)yPJ(1RL{UBv-QYea%OZC3Yd@j9eWEU=`&N5E=5f1S3;U8Y4rxx}=t-=FC3A&hKm8Y62d`1QL^o*+Q?z`Tsk*-6 zdNLC3Cz77yEbCxSK{{a}rd^&a(_5z`yoU~0Xjrqm?{v0OfrgYUl zQwjkMdx5MT+sP59{k6gz3f=uJk-d>pWZ4-@WNSE%2B(qa(C?eu{(>BA%bHC3a5}Lx z5RIg2XKZf!)JO=Y!})YPafbcL z$kRYH(Jb~H%iOvMEo|GJPhB{5Mhe3IM#kPqz5MNrTCvg6SR-?5*`opS;FJjbJ?*gB zEp6tMHV+5Lolkp%zT2CO6?L~W55i`s4a}|G9}E`G#I^eFLIc%8J4=S9`oMQ*Q8e~m-aGS+vuFyeRI38Eov^Tc`xDV!TG_3T-m(ujEaoSWv&Mj$YfZ=3b@*%U&MKMiPqUm|NTP`hCK% zZFiw9bCcs{PbTITPVHfTL~zn`lOQ6#)4J;FfpmpES$GoMq%ibg>~X}c z3^{Lo(B04bxSqm}Q8uqK@)^fGHiEKdMT0S%kmMB232y+WSmQZL-%sckAo zTOV%{iO_trjuO?q#Z#tl<(Y!@7@9s%(xOFaI`cs;`siwG5(PO*yvz<;8CFD?#4Ufr}rU#@CfXEAF? zoy7*8yBIl(A)HQ>@1v!2$m)wZ9uk^6w)%sS?F~Hb=(H5xMx%kb9ov@YP6pO|IL8rr_!ctxo43 z;QjwPKYMq3`S#6EoqvEEv_&xtz`{p?mw*-AA}~iNWTXLkfL5=ht8RiDgur`UKljs- zd7}UOS&EH;WgW99B^3fjYewUH=?|CXL|Y$%_tz-ITbLrHLnmy@jQQ7doYGJ!=1kN# zZC#ro?jZ{+qO>fEMDdUm%ZQ;MO{6_lEK<+x_o!t}fVGMyp!bwl`Yu2bA!B5{xTAu? zRtx7+)+%)&4aS&QP?+5xPpH2Ems5B^IX6i%A8_*?$9FWm^+)>a%MqymiE*vAD=+q>P^h;U}X1tj^(=Z>0(U2wMTt(OP-sa z<+|QvV1rL$MX6NCcx*g(6J^BMKPwK&*Acv2m_1)vxEeMoS~#+fFBTw01kr(aCUQk zc}cCn&`pViaTH>J*7#>XIqn$XZ75GgA1Rnrh(1b=!4ZYagf&7f=MSL!sZ08Q z4c)ucckdDaV-$Xo0+z3gS(meOR#TAMU=s#HE-sR7!D=%HAzjY^yV4I{r`@u4WxgK#MV>K(W@Af$0#k7 z4T6i2P@)dp6>{&A4H44#vC+L@Q<$Q~CI}M53<0{*oivaAEH*!0{18;Yst=sLcr>Dt~X&K1Z`f*b_QTVo)p=A zd!d_B#XT!LTV9Y~P?&6D#MBXNXa05e`V}RSgp4GFfz8nZ$L#&HhGYk|7;5$aqU)NN zfQI`gE4&FjDzYYcjX(@tx?Kz%?zj`fWQC|nB=fB9n?v#vV2c9ulyQ8$X_82KWodbH zf)h?xD3;64D60fEIN-kZB-FmrlMo(rd-Vz|HX)1d!y(wh*eCpm0-}d1#nM-l-dpn| z>xQId%h};ZI+I8^?8Yz!4D}?^B_!EQ$q%$r487{BP3XnQqrLDJ#lRk07BgP?%aBo` zd9aD+0H)x7*Gj4XP#d?~dxw(%{-E(tL^yEhKJYgUe?-B5Z(?MS!_C^u0W1*~Ioq#P z)DK8EFp`PKzL$3qVbyBD9eNN4T(tQ9ha0L5GWW&eir1Y`=`l5QmYTZ?8A;amp*seF z=P#%wSYUV{EDo?H0#k7k28VlH*?q~o2PNCDdw+W{g*UWJy>3JfXi^aB1`e)%JZFn3 zD$fAbN8sK+oV;z>lG4*z*uXD;7XZDjS4CsWK(QWGP?W-iUS*lxEL< z{95)D*s%y-qAEEhVVqrEQa4HzgLl`ja;pcmr=3Gh+vL>-%G5^el-Op^F{xZ`o4vl- zr&yQj+^U~={DoKc_S0|~GQpg%4ZKM}`Ve8|0ZLUMC5m<0bC7%2YoGEbe)$`}@XX)! zwy*rU@aoTC(i1wh0t+KD};@1>V;K8U2 z&~Rj%+a8=w>`4z!M}2$Z(XYqkaX+69`h9oe*#o=B0LdNfAMlFU3hbfeRcAbsRLr4{ z4D{BpQ^}iY=TUS02J?*{P)@=`9ZHGr5xNT=#5fw&=~10$4F-^$gk@h0F-<06O1%?bsv+Qj%11S_v$5Z<~4}3%Jh6>6_cZu*V$ShP@GjQd508Yv6r}HfRfs9^CSZc>F?IAI+2SXYqIqLPT!F)Qldi@DK90fw9Hg=%t zgwjMZ9l>)ZG|`x7tmuSb6W@LZpvwc%2+Lp!gBN8NWrgF+@pkwL&1yv{0+!h`#{>cL zhpiv$>_dWDB0>>*{;&?TmWLAm2=P&D-?qr@j$>wKcllo^+>#X`qAGa=6Y=9EkEmdp zapwLC`~@f$e+4WiL+!~#qhC2m&GX54=iHcwL+ZmGBj~N!gP<(!(JlxnF3Flf@EBK! zi=`myMaC2h3nXB@g+k!_H?OV$bJwS$Mn}nZFR1Mrh4MiXBE4FG)t7n{jCixz*&xGHZL8j0?UYbO5}seYWeNP&`H9aP0gf zkv^1I;*18G{NN}n>y3BMPD(yHN0bLrxb-$4nQ#RrE1dQ3SE75tLtRY zKs-?zL=>5+?Omv#MM2PSzeoz81Ws0`^O{bQJM&}?GJS7dgxeXFQT$Na@n_&%_b5nl zMEg<|?>xZnojL$4L)<(;zibGlx(K&^j6+Jbew4bWOlr$?g%YG|mvN{#LQnT8ef)m+ z6j)1G?`ZU-c8??Ji)OA-8vE`wqN+VVTqZM-03{R&BV8PBQJhjJjJ$Fh#&_T~4vD-d zRU+jB#rhC(E$O#3?;h84CTew7>D2EIepEFh2{DG zC^esxC-=$LR-Gib(9&iip|!aPw?D#I+iT66>hXK6VKLOaq2iPq#zHLYY?-{s*RO;s zgZf`kKbcugQsNn40RU$EAz04TS#b=ZRZZ!w&Ti|DiuHBqC{*raOc0`4b&3wbfMCl4 zic4_OPr{)z*Upf7bqcWk;#pw=5)1;aF{1j$P-)5T#tA=53Jg;|(`lqpz$BSWnOs3= zE;3b~lbHf>C`B8YprgPlN+yH;n0|!!NZP7Qsx&5TRVGy$lN~CPku@~8-eNxW29wEP zG+8+G+tTM&ou-36IR_=*Iu)9ZO5MxA?$M{t#OvE*Z?JI3^xKjLkkWMYsQCVk{{bvx zxL(7U<>GjVa3WhAN?S+{gyKPC!i+tULRi|Nbi<&FqX%-7IoK)JpEA!+;lr2l5frz_ zPsFRj1KuV>faq%k2L8Wwb4-s2!#A20HAZWkB1#@q5FTH1*=JZtii}cbPeLhq7Bk75 z%Kx$t4@PJ5dJK7I7yuYA+53hF%H*djOeAAJ1UUA%Go#444C5tA$?p%~@iLKFQvpn<;hUSV7YL@C7}1>QA=;u?cs?Kx%pWqT z>Xm~-hvBWzE++WmXlP=%vcOP@RKLTS;Hbw_L|cI^3V<$5T+P}?FK(h_L;1^FQH^&COmDT0@LqwE*D_N58D+x zXfvIRzW^Q%zeoYERJsW_iPE@om68VVV0!lcQ1UDmW_7us;u!TfBlw|(9}@KZR5=1A zn7J{+E%XC1dEv(+Uy~ZTcBhjMKc%2#JV&}hK8p!bPC?>=}j=8J}J z?=Q*}0c4H57)KG)LNE%Tg69|zH3j9D&@|2cH!)t%UgTbY+Ks&^ZQ|yC<`_`F{x_Hv z5fI*n1~|WzK5Z!m@g~&uhU_p=Cws>nn>|y)vIPH3l&3wIQ8|?z6wV05Wu&qmKbv|? z3|tcVjQq8NG>FOR4QJrUSMgeA~}p^KOH@DYwS{r>)5H|fTRS;S7x2+#cI%1;qlj_XZ;Xtj|5 z!8oLqiZr|rCg3_fF5^(J1L^hpHIrkmae%lWCR|Hh@<7V?zLG{S(IVG`3xOJ-ul>*y zX^`k}2ea?k6Ghx~ZeHd&amt(~atuG~A8{&NBNR{~46n&c0|E2_t|NYab1_aPI1eC; z*j&MsnIgGYJfx>wr*sm{TB1bF@PmQAO;$_oVjbD4i>%83D<4W_n~rVTk|dFTIf@Eu z&-YI(NXgFpt0&**Y+lyE{M*TS=qa!~v{*@MG$$DI_`ZtqoJaMtJdZrN57dJO++dTW zCockh_;M2Pt!jbY$R;EoJL*D{fbuo7uO5e6ClG$z6)k{}KywAmBW7NAto zK;837ZP_W`rH(;%7%1(OJCYrW1z+lQF?hircyT6uc#^ ztw2^(WYZ_Nk42wL)dF|z&aCW>P&(-DF;1qs!XsDLawOLnbN`U+8fXEXGud!hlKBiS zsbPKwaWZ1mLl0}KOs-l zOaaDf=4#jyL@)pNu5WJdZf+TBU#*?OKwt6-J&7}+YAm~N;wsIXB+R_MyaY4`Na|R* z-tO$5H!@+$w=v#COjHFiqFzBrz!?e_l|B1h`H?pnSK5Nv<59vqm^X#x$Q7dDFG3B@ zgn2FZ9X;-1QUmIE@zPJ2VngJ$$02j~8d#QPvB|;g8$i>8N>KKs7}L%#8hvJ>c`;tku`uQwiHBfDUZbRWe#LQ`J) z)TA{#A$L`VTd`Cbs-F_-Wh5_N0N=$SIJ)=meC^dh7YW~o$EtTp;%CSR8rv3-D{sr9 zQAF%Y3YY*({Wisiv4LS|V zV;RAuPM}iPvY;LTyrT@&@=*egn1k7~e!r(7dN2vna-_h`5=^sePTtd@SDFZbKXk}Q zJVx780PIfZ1`^@(-<(zm^eEp@?WC(xM&(BD8Sf!Hz{rzAMr-l7J+Cw}bw>C9CMA1t z%3tEyfMF+-efn`L*Bh(1m`qeHi&;p8c+NkL5zNw5;*&);1*e_8Ab2GxrM9bkKM2H8kj$8#5LcZs8O|)+k!dwopV#o#hm;^@ z4Dy_2P*dD%AVbBla*C!?ewV-{dQDzFRO7|`t1~~SQ>C;e(l3?zT~Oq(X#et>bSp9@q@G zsDy)PB$!E9&`tdFW(;t6I4HAD z>$V>3 zWk}gZgjt3e7fXd>i>BWlu*Xo9_$hf3b(_IY~WnXQ%zi!+Uc>JD5nf;kiRcQ9G`=QxhQkKElR#k!u2yQC7X zW^73d%?vx!X2TMpZE1W=)x&7U^Qo;Pn!F}>;QrjdY;cOa7a%~;Q`zwRa0>(9(*$q2 zKzC}){@yF-l$xC#9?g`0saIS10h>wsp!(ZInLlfL+snMd?UCAoAIc`z8;#7q1Un(G z3T|&;P8^D=C77_#Sa_TW)+k-FgBkb1rwkVc_wXSRd{?mgjsb4`brkrE2l5p0UFJBi z!=QpA|KfHNhA5cHV~)d90eF)ju-K5h{>ugil%I(RPC1)HsinvoITGrq(^+KFVv0N* zH1!l%AmkC2CEKev>cvs^!h)^(GF!2BCFVwP@U!iOH(;z?T7w)vsR8Yxi_mWz^I#4d*S6pFXm8jSe1qb zeG5dwk~Y1(A)f0avD83P@1Ia8Zl%lb+D{6x0_qZ7@eHYjp_TiuRs{s5(1R%~Wa(lV zbC?g6_LBs4$a7)uydpzoA1qc)(wox4u04q*w;ibHi!w1Ng6V1|yGYf7hgiNRalgt} zo0C1+-7cK$%dD$e!XF(%8vtcWz}y2{o>J=5aSj7_6L90CP!VlH|CbHo-7jAX|4Ztc z%) z%oR#u?#RTRDOCFA#*kOHH@Rd44tJBxZLM}9nDj3EPw5`BOD=&UkceN&dfjj@wi}eH zA*8yAuDx8>GhG}Y6fj2g)eM;>JHkog^Po7Grm;UKuX+gHU=K+@eMh9er!iwC*N7!8 zn3xvJH4BsT%rE_s1Tz+u{#8yiVV+yVh-z?T+Yz@lagr6Hd&(!75)mtvLGesTM!yu2LL0E_{VzMNJ{%*!SP)6;;J?w|d2xgZ& z?AP$aHG5|#S1A4tC+STZ=Z@PNQUS%?#4-2m;(_6mK>UzNjib)q0VklA#p3C{E8@H( znmkcAQmTE*gg$d+Url>c4wU%RjF*eiWI7sM;LPa~Sg^gg?<^Dhg$y>Oxkxo<;stX% z)LdilS2&P1Fa^a?ek!^8moZHTOHQ53t{i)nUdkNP4$s40O21Gd>K^^zhaPo=ctQSu zME`$G|9=Ah3$VH_0vgl0palGv?)OPn<&ulB>g|X#i5e+5dKl(-tKmnhjWy_cL<9-a z^_Zp+WLi(2yNX8eiWJjjiiVjSZz7gMe`Aq-p2T*%BhP z29-fF^wsY49!DUFna=@vMZnBfWPLF>Vys<_RtL? zi-F^ra)PJSoFxL_QqBL=++}q}2|g@k?HBPTJWJlN61`urHw7=C;by!fEJnImuJKKR z5}je|*Z!rfqTDgSf4_c}D-=O^G|zTU5MRJ8j!8GhYz!VGy!Mx|ObN-{uPxI8M=AhK9NjG*_R z7oPJ|R56~5*AWg;NTVpE%%U@F7EUrN`tr{zyYqbext`oYYiLS6b|xUz-`{rtFqq%O zOnG@^m4Npv-(AV4V~}y6-NP zMS&%YSop3F12EIF@-yzN9mJXEZ3w-B0c+9ee1l_tvRM9%B#k#*4xnOFz7$Epx!eyI zI9{{vG}*2yNWe&H&$K7(q7ZsVXq85z`V-Sp#6=05FUo=&UnmEU8t2P|aQSbbA5aPI zfyd;U$%@N^z+ced);K1&%yl;+#X--s$K0vo6wKBzNy#e?ZsFUAE+!SXDa~X0NPdY_ zUm8H@;`JJZp3p05zF#yXhw*Pk?P*6#c{HD->qrEPf!C0-EczW3S&3XoNlk=eDlpSn zVwD5+=QWH@eoj*8-Vt)_qL>`6630l1_ehvobO#3EwQvt(p1Jgr-Za{Vr;t9`B=HH& z!gG?VLPNUE^g7!Ml~stUF~#Dt=Kq93Q%un*DTTmY{&Zcfv8Iunv5{gNh|XH3*Bj<5 z${v{+_Yd;qr9yp)x2R7g5#<#w08@J)J3nU;k<@4sAdtd46f%{#FnLqR?1}Q<>wvvF zNYe!jL~0`nk2`$b`azn_j?KvIO4T*@&=v(aBJ4x!&(#+E7>7#XqpK_uUG+e_Db+y3%WuFI-WnQASiyri(Ueplg2imw+nM{_|dy^@f$%-X7)>3f` zApLS6dd_a9(6|+xU-XnZJY8lG&hA`bkFZB)r^y~AEhIqo6bk%=W(KFJhFCl`i{dU0 zBi{#+=7z;%XA-viX(Ci){65NgQDKdmIm^w-xj;}ID-L2JA*cu}ywD=auQvfI>qxl@ zuk_I*mPsV^>+^hmeaGz3;FQ|Vj6XfI`=jxW`Y@$nM5!3A(Ia5~AAA3{9l4RL3Bvmt zPvJjVejlfbZ$ z;ko+pAevQ;(u%rxlv;(M_O>zHvJO(4;`DlaNFVY$*#ZE7LcaeBBZp_=Z`B4#)8Y&s z)#9$I?#VCpux z7)habp<>`QJ)<|j$qUt(v~EOMB0I)mIJKV-#mkBTKT!v|r6n5MIuPH$CNKU@%2b`0xKBKsBygFXlc0!;(E>D78z$JG9Mmu~;!>uX z@54qTCE1t@88DwE9*ACQO{bumD|J{F>p@e<2Q&wx{@If5`c!Q@H*WHLfKKFlXGK%F z3LX#5Al6YAJsE?UatzDFJ|1_0|`cMkCBy52GzNWoz~j+U%b?w7NN2@7;7hw}Z8)zJMA( zRcS+_^{&=>g#jl88wE=5OYs&hgA}yi^A<#Y{_gGDSLg3Bx+)Cd-?#aLQ~p;_@Fb^#lu$Khv-Z7xr7-pdXMN>) zupUNnO7|;HPh$ks>R+z(un6gOZp0ryvb!7)u6+<1*Hc<6y?Jt3G=l}EeRlmmv3;j^ z&y(AI4u-Q2jUwd_|Ar(AG<#q`h}HGL>IRpA3A5X@cU4WmSJqFaNg28DO37k{yNpa& z5+u&n(F~r*3NEWh%UJ#+6DzXHKml%`F{J948c0x4kT@N^LTj9Ejn7h zW^YA)Jn8&3<$3x0b|p~{J711EZ#|i*$f%=;?J^br{=myHj-Cm;gcb>vF2xeVJLkwm z4vINBI9}%UoQe%o+6MF38%o1{lJ|ZKRKL0tT+A<;epX0_-8gffiL@~vPFyf;*QQ-9 zg_ghHsQT77odX_dM4oq!#T@v?a@)i$qIm9g`M5AJgjVz*(YGP>nuyxqG#v@hMw+$OEg9ys_B428VlP_O+DZ91|7Ne zB`#8PiSTT-naN%=Cf@FSfMJ=vXC#tPg~Z;&DMI>-)`GpesX*lAIzw{Kh;pD}WaNK5g|$rJEKkZW%|3sHi%c z6^^ML?`pUiYwL1M)D=8HgP9uqT=J z0P@VZz_N3;hegky$<0F6vkzCj)9Ux~YxH>Z*X_xy%F7?l_f<`H#DYGLu=mOr^05%C zB3Dqk5&aK-s3lP-glR#qtk3E&iUNwX!nP(LOhO_I44ziQ3gpf|o*@RhzHC?q4RVXs zTGn}EGH^oYPqEAUq=L%Q_4us*-1VHYO+&2HXl}+_M2Q==2gCny1>tb7Sp2*oJbFSb zeipJLvN+86SM+6q@QC-93*G;S45Z+5a&R2kBLqUE*)>{%B40WCY%g$~3Ki_Tw8PlA z#&CP1MFh5+^X#~`(Vkp#%KSl>;KikD9GW`Fe^k=wocg$bxJquj@S*xtDGT6uO;--< zwluk!re)L0@?Rxd;PO(5+gd_C1_dTGSh!6vTVhRN7<%#FSrB0t;7pRjcQ() zt~4%5p~pnE zj5AM=B)hyAkmnKZaiMe{!T$nj?r4yN6RWQ#*r7|AD)Gy209Zh$zih<8PW&Agc<2mw zqT5ZWahM+NCY~G1BdXbHA)lnt*P)nw?w&^zRGZB9HSj|LR<5*K8&?A#A#g2M1x z_1mJkiTvMar)}%plww+MpRjBhWM#dDx-`qGRK9qBC&Bl-DJXQqiV|$I0ot~WwagpV z{lL`9-|sjyYhW|wE=p0W6j-&(uX)bt$S~JLQI)r<7Nyd9qck;2Lx0+-cnFiouL{WT z!{9aOsunYpxW4`lYR_7L8#>jdUk9PDC2mK~U`IjJCQL@PX$_g?!1X1zC#YX>1P=g` zd^Q+^UZx zB4$;3Z^W}k=nL)vjseW#_biSXJ{WdC$Piw>t!1h%Rh>g{c2#Ef(7Cstf>vvGFtapo z^#&a|YNmxJ{+kOMn?=5Uvd569NjdDT=vnBkcw~DTI@}G|cA9M&{4`DNa)y|#WxJ#Rjr1H&dwVg`YP`U0H^PS4Zw8Wg?OG-e(OaQAtc%?!{z z{g&m;{abi{wLSamwQkOye7L%piPL7Yu-Qz_=|A&7FJ69iYJx|=p5L6lIsXWxNKESf zp=8r;no|OKubb01d0JOZwQT+KYPH_9>QsNXId#36&*yITsIKj0mA$rTTwTwO0aD19 z9S;w@op|1*Ng#$qOxY;Ws1hBx^RC0oYBa`4m6s-DlaS~5swnX2MH$mSj}1R&fCE@XKt^U}mc>kw#CzTx*|XX4b20b|wl9hB-xk$E7Q*2d>&HY5;Q{{J|M`E3 zH)uOKLlgTsYIk#EpCcXt*17$H25wv1-$cCY)CuZ4B0%V%GAd^dq)3p>Se$d01hr#e zMtnB`qq|pY(90!A!zUz+-bs_9Y61(|3J<*xp;KBf1!wbZx@HuS(W(yo!d#COE#uA1 zU8>zi`qs38WoT*~Q0yRHsNL_(_>ex5pz@J5@PBTq5^pn*2^{7Nl!JnlriMzRl8D=> zH;Yp2{M&c$zJ2}bx=WV_ZRQpemuW=_43u*_ZMfcujfycfN<<8#^f4SSAmtI z>PXIeu9Ij-w{l!(z?p)%;0IhRR6qn_Z@UU}kReK65 z_9;Z>GJe_ES`|3|)*wM*whgOmM7=4?yu9^MBXcWNSB1VkkQJI34N6lZB$Rp~Q@>U+ zv+4a96a&8-%ruMqsJ~EQLV>HBVzBf0T|V=?uf*31qW{s7K<4g7b!GrF(P*F;*w8?L zDmIrb3x&$6Qi&qJy=#jtS@!Sp+q+^bWcH9ZRJqss5A}@=ldP%eyL3^tcLq08noRRP z1{{@;Fq13E{KJ0(CP1&-Rl&Khl?|}qCDWWg(QWx~H;u&1q=}e=+SsB8tw0@qzg>e+ z-naWroN*qcNzG?Mf9!|BoJ=!R9ogm38W#LacdhTphV-O&D%%vQe%l4VGg*aQaBDP8 z*mo?^FV|%~??;8XT~uop+=w!5UC@eIp8Zw_^Z=McKo#-mzR{;!%rDLSjj#yXwOk+)bCNRkN;2%xcGqcqU7mxSXkIVlu>@wN|q%DUc_ZTDzDx zcQSiaMZsUuXZFe(6tI^5dmO(0cz3qYfd2OcWG{+paf+J+(E_Q)Skrxt;=fkeG1TMV zGgQ|J-2>F@p(FL)P_$#u`+T^WGIdb&1mi|CHA-cp*&wuPt9w-%&1VeSiYc|e=j`;W zaG9w*0zUdQwg(`LMS&k3``+8CRWorxHIVim(A$cjq)bfc-T+g)Vz8A>KaTx)I2g`d z?Fc)xsYSU`nLR((s@<%`kNLmK8qC^S5#ava#=buByjOr$$_p$~boW}7XccGWi$%5g zS*7g>u=$@iO>5ICS^X|ecubg{*2#$?M+z>^t|b}}*()?q7!g4CINO$Tm8W9;kh-Mi z#(iSsqM+y8v+vjztI`f&)^&qPKMa7xdr8<)Am!2F#u)8R`DPdIV7);n(BZrQ9BYFO z_9$z8kK-w|o_8~~EC!*I+U0&{XyWcibc}aG=NTn)R;u<+)!smKVq5IrWZAK^H?#&q zlgWWH3GiWH>5oudPG6h(a*qMjiE-k_q=JmYc(|AK=vhDQLbyQVW7{8qPFrD7PJM0Q z2Mzo=%Mfg~O{-RKw0v|65MT)PXc6w>c&M77h5d~2-)iOw^5{Bf|Tv} zy;JL`2*imNFUe zy{xh7dZ8x+WFxpQZ%h`za2f=G>lJ?9w+Yd?U)8s#WDFn$bzKZR@8(Oyjlbg}J$~X^(fd^2 zUJKPxnY&Ri^eP$kd{Yc@KSfG#LZ-vYiUVfEDldgv$-L;B-{H|K{REQN>&fgdUK{fP;OSQD6*)T?TPQ_&&6-Qc>}SxIOa?o7$D<=j`iIb z4TN9`_UCea-PSz3lRuh6;|^dS|K&rCf9^%CnTdlqI$-AS1J@PzGh8b0mp&G%{!kY) zF+bRYxJ(OnfPJ!Iv|7(+<7vn?J|HjL<)$bg%4KH8*ZY0$UZ`)~+f+5y{%tM+^LO5% ziGQ*GelKqwVI2P4Co5~7DQoS-%9N(zy3QZ+Lfxv&HFv+ccE+CnI$!1O`FdmfVY5X2 zLO*K!biH}vwKr;2)!V1vT*33*muaE*f0ZzTpZG4l`sA1G+x>61wrZb!>;3z`8Q@IY z%!OUg#6bu9|A4kho)zj%UT#{|xV3Y?%}p~c;gzX6m+P5`!epFG;!!g8*wQn^x7ia5 zy|)M{HiSS6&%I>+lOs{j!~wDf)A@CkT`4U90#v4RhT9(v^={am`OyI#&qP~q%s2NK z{qgXIL14bTg_ril&aeiZknou}FyZi;2^l*Cdc)*8f3MYwnK`@!HUDn;8Y(uzL%ZO} zEomd@C*NAY(0AoIy}GwGq^w=Hvdx<|PaE3?MsKn@#his%m`G?vCTX}TPEf1tUKk9^ z!s%4ZQi(iUj}U0!P*tY~`j^h-WPdk;D89A(72I!KYGAgMStg#o{5tp>ie)$sNdD^G zg^d6Me8wSpdWC_BKAfB<1jxP@jdK0;>w}JWO%RAD;a=s--3t6nQq~Gw)$(ilwE@96 z`f&C7n3sq~OSG-TjdCae4&-n?7^n>d&wykD(V3TZUbYl*u_95llPLEE`n5F}o`}T; z)jUiD0L0x?YTW>EE;eP>O~(gy5sf~+?bV*hYO>g$7u6;+pjbRB-lW|h5nN1piw4Vb z^MEGX0hBSobiArw*6c?k=nbi^6a+$$Zbmi#$-Kjm{cBexT(oy}wYj|$Qmc&sSO-Be zE`nZhG?oynSnMiPHZW-qK!?^nAZN8`)J$~JB%OZ%?W$z22gKrj?y(_tbQq3?VdO?W zhLZ(*84_>FJXKV;&^C^eV^0eVc{>xSQjuCLrxW}3$n&tz;?t_INQ!yWtQDsCXd20Q z>}bd^8ZM^O<%+gZ?KYMV`ik)=gR)VMDjUI-B4L+_+DkU|wq zO)(m?;f15cWV%=`mzHAad1nAou{ByKBY;Q`fX9h<;+v|>+o}e_VKQWdCrXXdWe{4z zf#+?yh>0c=nkrwrsY$GP4NJT+7w(pbK`g?}Sp~{RlBt=eYGRZh}WX5Sa zT?~`dk#Pve4!of>;9flHNVM{{(IN(_BQ4bOAOy5E#C6psuM!Ci^c(*PT?SC-9_;8? zlX~E`i7`|@D*2$$a=9!vpP=u<5nI$@8fVieP^RyI*KOR)Y})}Nb-tCB!B_yzfKBTp zo(5C3P_d=CrxKLgdzcPw{HU5*6hw}i8js^B2<6C9OKf4hX0sSzk$M;6*rc^w6VFH{ zG3%EKk{}90Dl-@&3b*c8*JlbSG+j`ZvmdWJ4&I}~Fpj6Jli4&LC(GeDv!v-5QyQAd zwm%G$DSs~-$x#+9rc?W#GiS&pR0rKsUfbcNk%Q#jtizbe+<3o)9^a^(YnS_yJIvEuTj=w=L=>vN%&l`Z6+!x2hC&e_5! zoGgQQ$f!mRID@p86>(~CD;25+sioc&$fJ^w-?=Ir%4obyCXQf8U~qRz7VRCDoo!LQ z(N`#z`KKBp`bN)GA-AygCw!eJ(Qpw*DrNH+un@I7S!RWc`!W(_ADh!e`D*ghuygCA zYPuK>UB|C8!Acz*x*u98CieQ+M`mOPleJ;&HHB957bZ?D3k5%fT z%r4E>ITK{=g!iwndHFvp{ONBE$Lz$)ILYG0B2C@5hFDwylRMT`CK`t4)kXS5dI>wO zi($4*mf6^?M3|Vqck|Nl=w9%;R5^OJNP?lG7-IkW31TPamn8x= z7^1|q023`4y&^v1R2ugiNxQpYE(Hf7Xlv6oeT3S(_ph$~ z_EQULxDvf|*t@D}jnoszA(wiBiCT`LNnoi?wD`F$WNr~^Hw1FNl0R3qODfZ}qA|Y` z$D?p8r)#$1bmv~u^KNK znXq5%;i;ppSFy;KD&3|<7e109GeW=l(NL4+Xc0*E!F@U3YgIOP`Ld^W;eV%crHXS2 zb~ziOX&@sZE&@9EQFrj8?cnJl_HMv>_Z5H_7d=x$Sv``pQ5y_bmAPt;R3`WLecQY} zz_-8hyt76~O2sjEBvdzb_5&@Wk%N5(%-%Phorw!_yu+@V ziHFdK2z~>Z@XH(7rgvBmb+(f08-(Zh3IFxWfn2ZsZh=e-{d_Pp9T?z6aBw2_v^QpV z*ZknO69J!n^=Yjy4!s9vH$U~ecIEt`M`d0d|28vaR~t8{Xd%5|71QV*InlzOA{VP+ z6>bKtJPWP!@)oB%t;(h z%%w#+iGxuzB9gI%S-=t@_7>N2pn)qcb1dtIg5)l5#06nZG$RVQq7)`ski*Gn+=F+u^v=Q96nisi8YIDr*;-zZ;X-!;I~)Urv1yMdNXzqNSrA z!TmLZ>CqAhNMN7?Abdv;1s6zi(^!y%K{8a+g(J!Q^KjdzcS5G^1{4akj9aRVXu$63 zal9C1@mMjUY<5?hqRq9s=He~!i~wB_Il4l`IAOw694(j8GEVHujZEbflx?k&x;yak zh)K88Y%xhy7BM=B=Uu6Ro=FFR$Ki6A4ib%rTqsKy~d_zZ_3-Hb^37Qzo-T zCZkl290@W=G^$t*n0WJem$x)Ii_I-cSrMBcrP6RTp18>$86(-UkhkWXqH6bZwP>(D z9)d9S@k)Vu5^?iq7AMn1v`ig!0GwDCxi2|9A|c$y9+nTmjjt%u5@b?Ob_o?N{;d-?9|>%U#S zd-wjEYq4%XJ&WRa!p($9I91^^bTk8JvwqjhgR+sa`pUFZ+;nUI934&*ZZ;SOVH^(^ zV>|Z5$b{{7U10?aQY&nNGtA_Wo42z#9%qv*b3`m#<~Xs{rUi0fa?oVL>4=G^S(Z*m zqbyX03_@Q~C75m|*FZp8vO)E%7czyoR!St8L@syvv@lX!aIB{PJJr4qZ zA%GC$XDjd|5G#V-2HcFZn5N4pR1-&oE)G4!vm%!b?vrpFuwx%ACQ}s#Q~T-2l(0f| zM*LhBYqSv9ijXLUQ6;~U8M!f2SqqV9_6kQ6ZciI$!*DzuFWjf5xUbEkd}r2Hmg3CW zIG|2oik`t8_b(FNI+r~KUi9WA8{9Ca#% z^+wkB0NvYc%T_|nIe`#rBFVI4B8j3Xl+&RjGP2Ox*g=C)>@GSpA3%+>hIBF>X3=8G zrjS&|))d4sP6HFq?=V^^NbE2SALpdFdVz$}oa);_+yIzAOfJn;qTIun1k06gdhEMU83dYNHnk_Qr zJ{5Q##7~H8oUe@A48xc+gm^R^1=C6F>T83lk zs76LOpuC>lY=Wkv@5`(Vlq{FFjnMBK7QA( ziZ@*lG3@q`J34|z90n<$40ieL4~jfGoCaLDPh&MngGFfgRW!kR!$x5s7xKFw&#o^8 z_DHxcQAURz^<>ETR5BTn4}t~(1;(7W6QDr%h^)}6RQGI&Rh;%KE&Woy14e-xo9O4uu ze2hUh3}q5d*d8OB-dfhcu78#f(gI27_q7>3J7=^)NS5)$a* z8D<1vJQj);6iooZWsOZsFyhS7;k4sa8_9*7j^Z$NUot@D&P1}3xha0m95(yZJB$Dpq7Wns7Cts^tLs=+}aEK0y@p#C+Uz5pjBBP~Q zhHz?>QET-i^Kf1=Z@0j;9lLp^PTOSZ49aY-CgQtXbkJ%n6e$HHCeBICflIOUI*8CSxljyW(PQL*k|fnch_u)s%)Y zSJl%x1$8%RK?R|IAWB^D(d`(Ow}T`ldFb7`8m`WadbEexmQmGG71(> zd(iatmGw~NnHGaV*&*K^+$<77jm6#I?9%zySVk20$%=M55ylt8>GbsM&)j46GS%-xfeDKvUHTD$;5pi zoO&MQUTdyUo6vi)MrZK2)rq|YEQ-5Tl180#yjV`cNf3m* zPvqA|qq`5L#7o&Uk5!#@3=pF!S9!x&jfaWM#*C6RKdKtZkqapWpj;EO#2hk{H zw1#M>y45TtPmL~#8Lw3>)53+vnTN1n!x0anoFsCQNVb{6gsDX~V8N8xF-auk>R9D1 zm{0P4ILK(sMZjqi$v9qwl6@xLSF+9&UANbq#o*NwrmR(^c}Q`N*bO+D$|#J}Xu&>W zi@q`0#07v`^Z)BgW?#!fmZ_?*F`32~cSjM|%Y$$fBw4oL>kv|nN=k9ZIe(5L$t5#Q4i79u4DVHe@3h>Ma0E=v3f+C*|mH6pY8m=HE;kjVH_LG-F+*3S)bE zDm$0MDCSnbp&G~0a2$n>Q0#fv>mqkzxMo**Y3f-Tg`3KOqQ;HO#zos@ItqgzjX7KF znm>PL=p`FF_2@9}BrtXFO3VS;%ncKBh%`y=j!ed4gFBB5sOYs%fwo zMs{5jy#;@iIic-C#q~(6C_su_;Y+G(X_p2gLUot8+c45InkJLb5g)o(pbN^AWc(wE zJM2=)APL7w=3aL&q6YB6RxH-954nV%C2AB8ql~>CV=YH6g&Z9wA>ZhuV3@^OlCVBU z`b^S-uuJ4s`7jgu7spe@tMWnofacOT=|o zc9~A1WjtL(j;_&lO@Oscsy{l6C)|)cO4KA;%8|YEAe0@%G>}nkxU7D$6O5e&!z`Ol zQ}-e6iCQjZi+%nW$%n0Yc5~S@wr~E(n&B0 zoM8e1!D)B!T@jDCe7ziH(Kt!1TL_`SUssQ+wz0r?J>Z@;alvuNA2MA`r`cjOW-|~_ zaz@j`OVfJOiG_7S@LkXFsbCATwp-c*rYkp+Gh#^7~vO>zdC?qXE zIc$h*M(uFi6TfI*cYAL);+q>sb(-)FR?Ou=7C>+aR;o67BVYH}ancj&Pc>lh@lq_S9 z)8}|V=h$st8O4DdEke(GS#1#Iu&uRRu_@b*FGauZ&TKSICu*YgTzWn;s9kiU{%S5R zO1A1MiP4z5JG5jx2?Hmm273%)g!8Ev-ubbjjt@0b(I|>W_Kuy}JAx!IvL-=E5x=O? z`?;%#Xss!_cU+ttsnK{e2_{QRl~T8?37Ur{0e^yXq$doovS`H3Pg#&8%jtBXEIkA! z%bDU!CJa&}$*CQUcyM$wora-Gh7;tKD0QqiMPd01I}Q%`9J2?wYkVnH6fQH{8*2-5 zC_}bpJ>U#=MY?Fj1HolFRl_(KVWmqe9GqW(Jposq4I&yX$H8C≠=p$NI| zqp1iO3B`;@9j`a9(guOv+-iG zTqd5kuB%nmDz4DhuG@S&AjY67GI;+zkxN>=MNx#F`hCKczi>J#l zOstm^9Aucy31Dw~!pKJ4L6@b`SPkVew(k#jPCN&$sxlr*3vn_~@&S9sjarFZ4kux- zbUPr~6G*sOuL}sNH9`9CF5h44ZE;%F;=|R2AO-R0FzjYx$T$wCfwc`xY?xvvRlr0O zc6^m#C$Bfi(m0telEhMq?Ct0Os zMMjA?30JSDVYD0u>6pBHy%O>i>&dvyVHm{;2Ewr$G@6ViqcD|jFEWSw1N@C_kB=w_ z^wnp*mw=R|M`RFN^mSmaaclP$D~Z`ion*_&Vlh$+>lCt)t2;>N-?R8sF1QcJ(IOtD zqs&r>JZ~U=B(P_*W@~inhvNx%%E>gAK{~dVC&Zybl?f;hLtF$L4msiIRZHXLhn}#* zGafF6i!dC!v5@og=hY|YoSt&C=twFpSSDs~fH7dxQOuaF`}O;45&6jo47g!9;W?Pu zG*~2QG`56Xi5BGekOYU|uyEL;$Y(q$r3 zl|}Y_2>ZbdBQ_WqL4@H4JPKlwjg!c31h5%guc~_rIN;LMx$)=mjU0wSl7xXZmV=1^ zWfnpb6y!$Mtl>`9Sz5tGZOpqzhf{8RpA6-6F?EJ8umZ3OASUOL$AlX^zKz)@On+0oYD z!1z#Mp!eZ@uAS;=qeVZ&90f(ZgY}5eGD;Ykr#0jwd5GR2&7Wdg^pqU zRjK;r!A#6m!tIcwNjwbWAd$~j4Bf@(1wHz3$kX_i({U1tshb?*tDuf**f9NDaXrnI2}r9MJAKRWl+4kN=iqXS;mtfNq_};fvd2o4>1i?5RY7ME!x0sP3 z-PGU<)(q?@^24d09D|O-_VJ|^{Ir4%oe#NEF&T{~;mDf8DEim|oH;QD_!`dCl}tV@SmDnQnt7rxCV z@zjP|%$L}-R+HTu>8X`H45wV|O@l=LZ|Yc@=cy)@YeJQAErV#J!c1Ql ze$&c!)A)QtnoR7Q;3q!^dmke8=A}6M@tWQ9VW8r%);s?WDsj5V;#6fLdvafVOE&*& zObD30FzGZHqGx9gbUkh}jFzK#nGK`F^Rg;!j{fVPk7uG2Mb=Pc0fKzf4y@I>!XRj# z7BSAk#c~aBtEJa$xjZ>(i{54C;(w%DNyn-_KWUgxPQ8}($*@T=5naJH7|o%;VrLF5O6 zMX^zS^Ki>L0FVH1y#vT|fv+{E_}(D$1Ni6_hBP%Is~$_uLz^eRkMPK+wjmpa9@T)r znA@tAMXxh^k(K#N6j_B6@qJ~A8A7^$E9|7M*ZytZ0%FJN^zgK~N*s`;U*0ysi_VJVGYE!txOiy-ATkCO)z%30wHYMc5*Y z8kN(Hf*{~AdPXLM2*A9&Jt3POrsHRpF#NeSD9ljwBsU@*8Fd>W?MJZ_gfQBy<)iWL zLV(hZliP5(UG(F;Iu@HYFE9x~57~ll|Fy4@xal&MAU0)==IOByRp-}Gs&=u(=$1zX z71SVBq*{ubb6FQvBd%qc-l>1xyVX)?(%c>+NaeSx6<7Amii>htbu#85I$a-X!Qyl5 z-ouT`dd%A6J&#HCAFq`XH*@=N&T3?Ecn4qv`u{%aR;S0NUb>djx;ZZXN9g_q0g8dS zX1C)8Z|vsk)$3Ph*RMXlJ$v)&CmWAohI6wlc&e@hJ0#c5zPNW)n(HOIOKZIa_Oph)J;zz@1SkA-blCa( zSS(agJ?h!R*1RL1T@-5f1?%#m%%5DDLsP`_Pni3#DfdqV4hoJbDiaOBiRhK!C3;K* zcOzueRB7&@Ox&75Hv#jZAw3p2tKXRg+mFxAgKhaGGeOqLFPH~v`Fl1i?>@f%`Oagz z&vpHWyvbWPg)bU$bN=1g+izdJe)sL~xWlNbPF|jNckZbr=C872sOXTZ$IkamVDVkv zXx`*|-&D0AP~1u%vG!2`(kug(qTr?**X(wa>q$AZzYO3PVt-%Ltsx$jx(7f&ymGM~ znMIK%bplb=URUMq;JvC>1Cs)G^!okvv3-{X1o_^3tdEF(AR9=ohpA+ftELr?atjxu z;h31SVIVn;<;9F|TW!RnEL-0*MfxBuzg8Fl&)C$`wncxsi=&zo;EFMq;Z&S=i~PgJ zI%m0b5Jdu{zeZQ+g>{8KvF8BW;S{*vN7#RdEH`h^-YMK919YtpoNM(M=B-gss=jNe zG3jn_z%$j#ya0GsETM8D9(K1ab94S9HZCJ~d?KnEpck+{T(95-Sr=x{p8DpldNc`g zy`zpt{2RdBY&NTvtRcPTsW~};8N2!6?DdCN*Z%5r#jw6;u$CB}mqS+m-umjVlq^=j zVmmojCfi}#5w#e~w-j?@xCRmgHZJ!iYC(xfJyj)MU<|xH#d@5@4uE@y_)PpdASm{t zN@Zbi*#*JYUgx*vX3Zh#9cufzT({|+>_3DmJC4pk8o-TmtHp7!HL-G>zUN(6z~cxE7+=CLcTf!SR_W(8lGa_4dIJ)0 zFhU-@etC8&PQ|;6m*?VC_&()ov2EO#TtSJImBcL+jeP^U&oj-txd9M~o0n>ETT2L; zVYMXP(Q5Kc)zmX-QK9r*&^bhew5-=4m{0E7PxTJhiJTiCkn}! zw^*f6LXidxd#ng>D>iFb6iowjqS_i`-uHL=r-#fFSZM>@wZ>{4BKRQT@TntPPxO2@`y_UDPwYrt9KJIzD zzt%J|mbdTTznX~)CZtF`+prs<7@d`8N`A)8HkYET%E7XzD0Gmrww>rS?~f_+qh#vG zc*%56i0t)<`3#0 zC)j+v{_y6_+120tRd(3j?9DOacr;krL$-TvLCqKksWjE^s4k~$g!;5rDZoW~rZgt- zC=0YLp?Va$L3$fVbKw_zsu8{5T;7ybHhJHTg^Sm(1Cv~DFiO!b**|Q@?e=YEhe4$~ zp5K`IvU~NZ)sj&GY5YCagSdj5E}q5Cfh%m;60nEa>+vC%Vs|sa>vORvs`S3Im@0Ev zWPsYa=;qDahxXn9kEh-k5~ z%BvfRE9Yk3pZlFTDv1D5kyEFBQhk4?2; z={&qH8J|qu%mR!?+xI4}5@@_=dI!=L_6E%g`R)m?^nEkmdnL`EHNx&MqljeZ zoE;OPU<0MvTtCghkxb(EfTHvUsNpq^Oc0I=-`EWskG@t0iX5u|R*M zunqu>X)AG?llWjrOR-Y2%*)&5rhv;2_XgGRXxcirC8ygvwZ-G92UOK7$nO2-T!dj1 zb6C)7DWrJ$_8LEaf>qJU5FlUanYss{P`FCc zYNa~&wd~C@gx`a3NcV+XEr?ngDmILLTx`WKq7|m8k!_gY{^t0X-`9HmqK`( z6QTTD-)JHyJX!BVs5bRI?`s4LGchE@R9|)w(Tcph7kVep+`awJW>PnG@zs7VKc_Am zl?rT6T6ngVuR4W~zr-rlIeNwp^Qa0vmjkLDXuL)gnOxiC(?2{6O=V!Id}a_G>l}N4WV*kI?v`r$ zPhCmc8NBVwbfq*`-)SdccfEW&6IuEf-RdMu|FXH?({3e8d8=vz&4JSHO#JDW*Dud5 zKVF_)U;p^->g8{H-n^}=&H4>g5N_`BwYALcX(~Ww`Ov8PN~Kku?QbK5Y}-0tY+8ll z_5s!>ez!cp1^%m2Yt1ZHIpl!K_KAwgz-DAoE17MbRRVm-bRombpp#cr>Jaoo4pz0H znn`Q}7$)tbxtg}viIp|ANa~DX9KlO7tZP)Cc+F;+Wgx6teOYrGxv?glWudt}$8N!b zd39aYaD!6f`XAoP<}%;Z1>eY<5+a#FG~;V!fLFTf2QM3TW2(n6S)0?oKi6r#|`3rUu_tr!akER2Hm*d80Y&-%&FBw5^po#qj9U zOs%Sh+zqUfMzv{0A?sUnjoJH)B%r?9(SJ@o22S}eU>XK$czv7dO$c*c=uHNu8}qJK z__Ux?Dt28Pvs%7fYEiBA#rwOR-jRruw~Z>6qS@Tu0*c4RCcSF;?ELKd{G&;9JAe1~ zn~QJf+|=zdS;;((z9m+=LyMKV*O+N$OkpmUtgYpPsvC78)_HnQwo~224hIvf0p{8l z!m~zVCr0iTW;wy5xxfDeN!Ga1SWX3inpGwY*cWGFft5*`s@PZ|t`ZF(jlfELR)&RC zY6~FBY;Gi>nS!z)zQFpC#AEeEQk$OQVPMaaT`WuGn_7$?^(fIPXc;gFO}6Y}L(%&S zrzp;Mln9i?VZ>bwHaa-$;iWkx^oecu+|(7P+G%4~O}Mr?wb z!sG@ulSHtCk}Cu-8cO|W443_qVK5&31edl$)ru$Q(|bh@@pOIv&c)9w{qqNQdd|uW zaRbz+mTWzH2C2nvtd?Eg8V3**`f4h;5S<^_z9CJeXWS!Qeghb?cuwF*sZy4yI-Yr6 zZ(;Z)h1dlDsM+R}cc=WR%aP68k9PprXxtgNacr$;a2yrtL6$9NOtAUposg-)a_8K! z-*$HBo@YCgq&qo3_93i6$;>8U{xL3%uyqU+3^?w)IN?A<@$z^!Wdx4uHpHf=S)(v}8$&$hKSD72RT8Gd^V$6e(h8!Rgb;RI;Fb(PUA z8gg6SiPoaJ+7FYm;L_gkdqrasuZR)gkF)+)o= zhI2_rFMikYp@y43qF`HQf&;HrX(8qO^eI*9QCP>RF2Ftl!O$<=7km+po zo%0VuoV0Axb*e*g4(Vo&mJm#UF-#_4)Yj{hQYYBt9>NRt5*xo5d<`_0#w2Q|o!xXlcpoY_OJfyCoX{ z@7RTWI(c}h80-MhSq)Z_*$!oEeTbPPQ;jFuW=SQ`;tEzh`x zFE%aM7$MXp!+p)?!S>h{F9o;hTHfYkgcUu_^|-K5X4 z!MI}x{nn>wB|lve{^6ynzpI+|x~*s8AdU`LkT7=CxvX|j+S=~;4$`99WC!9%YUR)@ zkx4$W2@wi137~q&1CJHuq$B*&vSYmNZ?2 zR3a_Qyl2D9b;rn9j?phl*2T6{@Yj|HZtgW-EL4Ai^lh!Vd#mTpCQkT!*1)3YzQ=z2 zk1_oX6?*`tPdJHALZK=pdj@b2H#X01epGTO1pt11VA0)vdS7y3kpt6Ju^&33-KEeh}Km`%6HzrXq>YP#A7Ij zWva%ZlL@U4vpw@h?eMN00F3WUT$@k>f#zfzj9~Naw}iCi8O3f>wwJQKn+b5L)SL2@ zTAc2_L+fHe4OM1Pw)E#gSDT5s#RHh1h`A}zuK!zeDg7<|-*100dd9o6%mkAo~0PT2MZ~#zlGUw{PccFM3?5)|m?(RHsX)}@| z$s1c2YzhIZJFw>jt9DU2jyxcF`sYJ}claoXVp&%4HJ1;v(w7dF^?^*F(&n}lK zy07LX#^2zvrO@jqTdPmq)=ewRf0d}%bfQ{`0_E!Au{NJNHB^j1qI*dfKe$1B?}D0& zs-$wk5bmKT!Q$n+@^8A&N0mjOJa*~+#CGflpC)&4DQb{RXscfL@M?;@X+5u_ZbFMQ zYB0CKxD~`Xh~=hCDLU-71oTR}+l^{zx&VMtYXz=V-+P7T#;28#&Q}d1JXopruF9Yi zkiTj3!v9(}YLxuxrP3;1Ei(8wJ}+c>>t90w-~;nMfcf_xip927H$T}n`ZmkcH~YUN zZdFSkJ8%jP=8XufKir!>guuZ^b0f_duRkmF;0j93S!4x~88i=Q*_r#?TFa*Intw;n z7Z#lBt6~fr1-X4Ua<^$Ky@0$(0~*A4-STrZ(>ND6%6-0fCbDfQS9I^9TQPGVZs~#* z=K$WAyATKiO-hO`FVculU3yv#MH^Tk;K zr=!guRIxolLjaV1E4Dl~?x~KlmGeFC0z?gd#UqqZqaIW(3wzU}nlNV*>eD0QLHr4j zXyyq1s9IGwKIA1i^{CT+Zlj9eBRBigaduK7jpgi>MRu|y#sR~4JumddIb!kZHR(6< zqGul?jo24YUk5g6>BRASJ{tyk3P>T(zx?4GvIOTegx8go*Th-d%Jgn<3UZv#QhVch z=cgigL8qt8Rsy?k%ox>5(lCdX&{wXfAR!*7|aT5ljs?pd@ zFyueo{B?5u@rQS>KfHPM@%_b{SMNT&|LKHPo%H6*=G(g3tmnRh>iOl(T{!AgtGUv7B8t)EWBro@+d6PqT1k@i{c z%5=5Wy($Ow>R+N;(WGR{8<+)Lt-JNSx`n#F?$-W-5Cu`pEu55P6YmdWOPonvJLv+BnBo8IN>0i+(! zoPvG~+Zxm-PQ(C^&oQ`=!hpd6*;Zat>1z@(@b90#VxK09*KNHi&ziSYc~w;{T_g7A z4~?p4A`F56Q_ps0VW!VU5b&gC+~;?)5eubC$Ta~iqbkLX{MSvbUglbD*YmADwaMOt zqz|vBUpOoBg1Z5;$v#^4 zQ-6@=A^br(orBSIG9Cv*to5iRG(<2H0AaT8;vpX-Wk6AD1fatJ`IC-F%~>qR4@M4q zgVG3xP5TLr*OWpbMJAg&aWo&yk59}^k1nkyuYm33jd46?@Fw_mI{k7P8Re!ZG*>Cq zvIS8Cb-bhb!GWgFk>%|-uwXMt4M(@@NN*sx?rmUoRf=!_ib8<+58~ZgmDjCI?~QtP z=C0FgQhq)5n}Mr_3{Us7y)NmU6OWFt;eXG0PIw>yp4O_i${xuGd+nk0F^sw2+rsqA zwDg7W&fxZEIc{Q=-`-*LHiQ$lTjPbSd5EFNm&S%#I&A`S2CEv91_!7~>`<|R%e6vN zFE}$6$^|Nd27pmDy=qO6#=GZ9Uve>?9EiQ1v%KUvpK9{NpV%*>I~v!B*7ixBcnB-> zqJ#t#y#Zd_t1YIZNGybr%2t&Qb3uw1gBN;al%5YUwM#CcYoailw0&rf4)EUtHv0z% z;6iZKO`a*p6P5ZBJ3x+NQ(_NTt|OcTJ-MlDz(Mqyf~rR$dCkhLs4@r&3u+mkRV6Ri`8}j zeFhimi!h1@a*@6`2EwXy6#h|DZgQGGGv&S3IKRv*(d%64JbXOMi57vht|w2q4+E6Qw*NYvPM^=Mr#GrRb%7s9@*}n*3#;w)z%}!I|MO9r zde@Q2+lf17Q@9&I-3tw>Rx&To_rIX$=?Pl+umQ`-zUW;B**Y^vNXRr*AdcLtPUgS) z2ap7??MJy@e|)lGlU8dr6W_jm_jNB=iJsf(-2o0b@yEjffoea1c_7S=Hj&T2cU0zm zi(~M)5tKFDkc7O<9%E^E4Jee*${{_d(EHcLmi$b8%4A(5Xy?;-(_p|Y_l!b(* z=PGSZmsl95G5!l*W>tE~O!@S?5%Gx0g6V+Dp?xQtyZpSW*Ww2)PHIV-J870C@&m=Q zwlXN-%6Kry4&jXTkP1Xt0bOSk)iC0rw%jT|w^CiNXE)HbE~4Cn{>fwn0<7FaF2xPR zpbX$4vlH%5eygiRRTQUt-#7*{V53;4v|PJie6tZ+D_H_Md$UKFMzjozIJcwcQbJOB z>rfNA%SF-0T`Q_xfo6Upz!VR5=%)?H?2YavVVG!#_piZChCiL^KlZMd78}((C2?KP$SDj=gX>j)1Qa8qS(oeNe8F$ixLhfUgH{tT~=HLVI z8OlD-!{ZQ!B4VNnQI_gn={JAXFA6Z~V1Au?+ z)4?xYUPi8K0C*q;cU@)Zh5&}y-6dV!4nqYfwy|r}B-^!7HX5}*&4Z#bY15(mnL9Oh z)74ClmlW%5dq*xbJC(%6`a5=?7oKlcWFbhkW|14`}!=kN5dq>c|7I4 z;Y&Hq_26_e@@Q8!IL<+P}(dz;6}?z^YqXplHgzS`lqkVi2S zH$UNw*lNo&aRAvk0OWM~5H3_JY17_SO*b;kXE~9~A=8xkdaals2XI<;em0~PK_G$N zjJ6_aYeN(`<++Q+A(sS;TjAwT^c3%zUcaCiiGFO3dCq8n8n#9ViDK(B^L?>(*;$T* za(tV%c)AO1p}G0jEcyzQ_4%A&Ul+XUl0kGfM#P#A)GAe4N~R$BX3vcF zv@`63IVjc}(D@na_3JL-hqa`RZc2^?qXl7Ua1oh`(O)sJA;gi{t#kI~{1`nLrn49fD0!c*5o90GsM1=ll>@SZY+D=0sWNfH-g~!JwQQ?; z?t-7u5m=B7}xhc2~mcF1|%wXe5H}%$%@;5GSy4-~a@q2r+WIm$L4e z*%I_U{T*jp>X!04*>R`S&s6$deE-86anu2HlMnJ8^fwTRuk*@fRkwdJeM=?9|CcYp&iJ48e_v#O3FBchnvBQe zW4iqtUiWp=fX5j7z}*o54uqZbEmkgEl>|VV7Zz#k@9o(kF+Mt{dXHh0?e+ERQ|Q9L zqNr1ww%Rlb9?3Fm@6`8yy*9&ux&jbi0TID8wjP?Kop*yXVjc5P-Whxq%eq2@E~Bgb zRc){JOBl%gs)Sm#b1*ccsRN?qM~P7Qh$2IM@xC(d3*>l+;&mq<;CeEB^nbo@<}|VT z0@~{944`ktJe95B?ZmJ2ExbP0vY{~AYSXSa?eFNm@0}q^ncf`GA6QJ&n69ijCZITQ zS7@cTHQnD>>VbYBOiknL0e4HM1;|C6E%p*29{Lwew=eFS`tBTra|?2mldOe*)le@< zD-61Cg;w$K&vjib5XLtztcYRYod~al8ORJutRAq|DeP{-6s^Y9Dc(ghZeAdO-M*Fh zPLJyQ`^Evn&QHYOm~2`T-iAe&s!d;Lqe5TTwH7}x*j;Zz$mVdt|3BY11HGH(;>eX} zRTeuEdPk9Cd;9fQwVfY(u)44eK+uf%_Y>{nf@$LaiJ9372j~ksEpMUfB!W`XB!k_s zoA3p5@+IGcNj~<)=h8+x8;&bYOlNv>741c9HtI}Ff=OuAo0&N1WI>qygfHo}A}ai- z8|}!JIKYI*oJ?BJ9d784OQQer+SQLMhx z^t9hKd*;N8gWcqr1D7+|=@qYK(cBKgC{Bi>@nmY8yRNUUB@~c(^=Ym3;65_nK%b$R zkn6SI)tfEQZ^va}l#iLX==yWeZoV6IvpX`jJHXoi5@1!eG(y?so_DQR9^qEq&prJP zF@~L`+$5>tYsD7hesA*!Rf_lLmja3a8EuO0!L|~mx~IJ!P&iS8`!9lxg; zMq3fzzU^hjTk<>*)ezO+-@AK^7lCH#{iZBc;r2wDqaA!U41yrg+oC@)UAwY)W6LUi zyU8{fdwgPz zDR0ice|N=-UqSBpk@20(LqG6?xfpyU<`MkovB=8|U>wM{t&gH?vEqV(+9NXh_J&wt zS#D$@P}*&LDh>7F^4qJkm)N(Tj{H;pH>So*i%Qp{-26{meD~kMKW6Ll75hhj-({c&ddS z*3*x0Z2M-%)!v`;WUen6`Fc|nMt*#H{JZ^GyHEPPE$~lq>F-lScRLAzTDrj>?)PUYJUx`>Uj35Meg4yC zz;~)xX??(7$hO%T7=j9K)}pQGB}5RA-rqb=&v%9{9w@S}X9Q35S%!yn(aJ*aXmSgg-f!0apXcIHHeypU^k*B(aJT8- zL0YBghQmVb7EmJ`Ohq%}mDk1B@F^f`6;pV&{;7HdCd(Nx6x6 z)0nDHG&iw92AzY}O?k24V4m|Rk%tIw<+Gv?|NEQQeatngHoSW)dqSAfZU}`aYen~A zj%mg`I0Ltu;+L{5!je{*(&UU#4&|wJOVHR|l?Dj4(39gTKel(W)tzT$GWGp$w#odu zm91KCifaWSt`>(=iup?mBco3(Vg^=4b-Q)v-WFlipLx-kLet9vYTM~yvXo;_fOxPI z&W?tjPHyrJN1J)bKQX~+F8=ZrXEbyEQ1dx=0J{x4?5p!qQ^*JP8j}1~jUJc&tNJGC zwAdv8h;E;K*|ypx;8@pN15|~yP~@=aReN52i2*jvC8d{}cxwKB_Eei)a^JH$Z;k+~ z{`TZ6XhPic7CqQ~k&KB18_C~vEV$YJ*yU(_vtc<@G{z8(2BUAiAnp9>`Klm)qrD`5GtY4lq|Qas#ed{ zGz4UG6Jp={Y~Da+UCcs!zCPU-#oj%a2zuN@{E{tXX%WJl!PvE&nNkfLj8eb$7+HD| z8ShbU8w1epL*Y`rh_Y!h>}dCP)B+xs{w7p+R#5|sd^tdaQavb=qpEy2#tFh(0LAslnQq!_AlgNUX`yq|HUg|pVetF9`jJ$A1UkG@tEy7mYVeX`-Q z2%qbV7C((c#oUqKSG^vx*BeIHp5&H^LDwvJ2uMLGKw%R9og; zPcYQh5*IH!U()g=>DYjr@^_bvXw@rojB;&RVUV{fAkgE5`E&<6&&i9hb`z9x^Nw-nf}oT6M6Usv+CZ)~n`#>ZY>zBNT*xB!)sS0&$$`%!VKu5W(Ki zpNvrG!Dop>(i?S;aL0H;5XjhbO&B;u$1zT=U743XnUlRXe*o~mL%}+sox8MY)w=OK z_k*6~dPBb5J0&0TVoRliMMVo?z|k88l^CyKGnDrxM-9AdnBoa21WniuM4Ls0@98Zxe*-|EX3o(`yH{+$M=vRoxGP#{ z5iocXq&b^DoS5pytLk$=)xWcXoT~=it-+?J3JbttK)6<*->aq-S&fPCTAMdB zP+=h~sw&1el{XNV8+U`WmH024T(v^46O@p$mrUNeD_N$gTDQQgf36md-Ut6|N(z0r zdi~Yuzi1+w#vDv7&tGGJ+zCdYMo=ocro3}mf(*~_FforMZ4043sZBytBw(iB_<`Lkebb`} zk^mzQmt9J^BL4J%LJ8YPy0PEfA!Z72l8+13v>(^COxrwF&FLY&K47mO+m*v4UmNz{ zTBL5d173iYcdI%x_o=DOhgCP^N)_j_QDkXyxt17QYHT*Uqq7)(m<;&4hGyO!;Je2l ztVp8{m|Mi)GJxs;ViZ2GgTB(g&xA8l`EtE(Y~0d;fE>gJS>)LaLUVl6-MYe(HDc3d0EXn2*Z5 zIR0%WmbogRN{5|V3({)i+bLS(! zr0M>D9j@@d{`m+0)2(3tZxHtM)qXbroshatSas4D&8vjU5NiglwlStZ(bYvenC|IohJ zg*~4f1^Sb)w!ezA9lgLMHly2V2)$Za=$8qO#FdQQU0fBzMxjSLs;z0McLinqoRw6HLoi1?r zm$Weu^PnohjPa|Ohe6Q)7!L1TuJ;`&_Nh1W6M>6?24y4r3%M!NI|^5RysHW&sKk$t zU+jKx7xrb(jCGFH8Z0`7F%kd>KT>;6)KiYU-ET!vXLU65hLk1Z#~q+AvT8!nG9awq z>Deds>UI~jpAfKTyd!qH_n%h+>?3XtTzSuWjVFxIOTzf$0DGNMV?EQw-tVd>*zGh5 z*r$*wcdFu{!N36pap*JsDa;hgRH0fjqwimz-9fnuPW#3+?Cf^yM8}g{Rrf-oor&m*)Dk`c?-$)~ z=KPs`Wj|_5s@bv_0NyCxm5Mc5E3LAY%HMNbc1P4c$qM6OmlaYrvRwt0;X3>(=5dev z0g8#Of3~~FC&|tpZ`d|-P7c6BvBk&sE>xZs>J8O%*)x#X4dnl2@7kN&Hj;e)_NPE$ zw`%Pwi6TJorMMYaBsMP!r8Fy2ux&F{29~1hmu1vvPX0J7)VFq2W$=0 zn8pxXBs=iB^Mel@=Lu}6`bg;+efCI=0&QN+MT%>cGc%kaz9rdhzRyzd$z3PFDeM_68x>5TMOK(@=2`V%UqH#1CjH0n7Sxe@zKjdJdeMrHNW6>;1uQ;@WeZV@`2$2#! zPs;WD92KFYpW8x)dRI6auuN~arlNB}nqpm9O|}Y=Y74V{kXu>uI5kY;M$Tsj(7R1C zAXjE5Nm6=4s^rk2qLMa+=r_{!D@eThJv9qJwLsS`rRD@FsquS@Y$elS+cg^{i$*#( zu}tS?UTV8rY?BQ24N=+&$drq4`-P5W9q?4sF4%gmBe!f>lNC1avV28^7a6fbrxR`9 zF7lPcBNRNwaakrCW}Mo?N}Inf;|+P2uaLftCiXq?;&T4(Lor*AP{?fuA2jkvaP-Gn~}J0hfebs%V$E$!PUyF4(b= zkq;tdXvhO8tX3pSE~4OMg1fA!`BN2f3pTk4?~IL&gfK=9aP?}&#-@I}%^f9!U5JgU zfAV=97GoYTphFU?87>uoXUxB?&wy(E2fH7HWt?2%F=}2%dSi8|j-kB=tbb4)V=I!+|Ayuk|!y zacg9clgUCzv;Ed)Auf)z%52a#&MW*hP_FQdJTexBE4_XomwMy|ufv=pR!<+bdbDNC z+wfx62$iBYdm_)E8)~TX6xw|$d@l>_=^Ft3wwxK|UH&+aAE|MT&GL!i@3G%E(T_1V zroP`Uba$oPZ|Mrrx5@H8*lq9eg$(o$`1u|fX%uV^S&f`-S@#U%h z$Lo?bEeT!{qY8}(@H*r)}QKXWYJ;7beC@>Xv`7f{-6zkVa=G3k*~u-U()XQ zS-c>4kzdyHA@|;Fch%GDq`(Zyr!Ec%ePe$OP6J-XMQ>H{BlA44JdX_>RB%G@+#&cK zqX=U65V&~O{s^7+z?+FQVxD*F`Oui}<%Q=9fHNNkQvS>8k~88E1cRw{Z<0NL(lTl^ z)63B%8{I1BE)~g^!oDQkadiJ#3mTWL%V0EY3O%^m6F6DF^#2RC1+3w*ZL+uOskWymkKbn=L-{(%^6Y7w@4@qO%o4_( z9bkUMck%9|A>ch6_MP!=aSdd2bf=;@ZNfREa;8OFT%b?hbB^)k7&ey8QFf7dT_9e8 zA@g?fc|2!U+4cNfdYzOQASA{1^ts;1n}kTS1B0a%f7GSY^RO{V+*lT-MiS5CRENj4 zREzYe9(bT#qs}}=HB<;)xiUAtF>-3@C-xd!qfo!SyL932t4rmhAMcVYAho17@`8XW zm+Nz=N{3(YR2lymlsoW&tnxcXK}es?PWfBrgJ9t<=n5#SWLe5z({J$EIR&*^F1xFS zOWM&@2}cR77<tY+?MU{__dc>8Iazb9p^C=pZCUINN@|h8LJTI> zR@`Q>gL(GIAtqBm#VhFXRuDKZSse|lXV)O%;SDaaT{Y)$O#02kp^SpclG!{U zCh~@DWvlzxDQlN|EEpfumZ20B?%jz=(MgpNuZ1%K1>yMS7kp78%Cu1F)>S*p31MO> zVYq%^!q+gnf>j>Mqqri;x(&(%@WG2ccp?6+h_h9`l}-M8n}$CUd$*hnt&w6R+b|Sz zq}Z6?<0ZSKC1Gi+*Ex9fTcc{(AMm+qNxolOE&8iQl~DV8JVw5!l=Ai8(}&+ zWslNm9O*U|f3Pm_a@aRomA)(cb1*gUco;~p^)r<|=m{qh>o?o0Wa4SNFdYZM7CF{C3|7L@JDWK= zsy6q01s06W5ejRNu@6-T5w!{641$~vw?@j)|Kj(1@V}$Jj~x=~dl&hNI6i`&)Cyt2 zulxuOL5ly1J;`bVi^>oHSi~(NY+Mdo;Aq%-Epm=+>rz%AJP^sD+uqIr?mflCVjLB)!kNq?6g1EMcd;Lx{QBWV@U| z<1uz))5W`QIJ%4!4@{58qlQuBvFT0&=s4}7hM^M&E4u9T*2^8@Hy%&=4ay5A9Hu&i z2hr$FG@YXPT#^VI0*g9D34Hh3{f~Ta?$bH5Lx!P|_<27mNFKXGsM6jR zxqap3d20w~_wV?i2v?PpAGpa7O_FqksEbexojm$*q!kcm#vubYX zJt#=Lq7!MJ=hfRJCFN6DkuCEc9Qbuy+lTUJ{*!BJ=E4uKbyOB>>2@mi+uO6U+>^q& zqYZ`u9@Z1f>vS=H>p@Fi0!_J%LYHh{aXJO)_m~9=5j6(38jMm+V8*iuqgyy6@SLgi zVwm@GpiDEK^FwXxL#23y2PXw`hF8Rohb&|Qj6}|<)}dTObCWk#Ybdc|hdf^9Fz0MH z@9b@4I7Lbv_9g6|k|bwqWrf-@R&YI-aoRG>yj1rKE@{O>FM{oixi$PBF3x9%JkaeQ zz&}IzZ={=S;?Cp8@2hS4E-vo(ySMNiDkLu>ijdj-{nfj3ZxDSytCBL_J{@l1iNm#c;#I>~F-5tlcAjMSSl!;VA%vv11v%z-ZsuG-!>j z62j@~5g~$2H$88kFmOwm<-Hf@x&;x#%fYal$tKS?DVgOfP66uN*(cgsXqaqPi;Nxh z4d+`$8Xnp4N`>?knJx|yXIVvxhuF^hnM6nyF-h*ZlX+Md%L+)|RG zT~!)Bzs?fJcYL<4-=R4$6D?lbxn(v_5l^Lk@|T?8QBua`nPy_u2V*D6f*Z`1ZFp$J zW+~;;H{njiQW|05#=9Mf3vZvT_|AgL+{M)$yM?H1WNn%X>N8}_mF##rINl80CMv8P z55sXk3J^=>*@mTcz<3^b3C9%#_P|mkD2XI^##AKf|JZEjbWfkWn@N8Xv~{43whrl7 z;H=hBT*E4vpu`4)^XqVm8IR$Ovmuc!4Yr7B=8|y~>y6S^60V4Z`uF|(U zbLo!?Zz?_1d-YGYdqB}+_)!JtS>?p109AQQ7#uwW34wOYWjdMrjVoMb_{yw3PFp>l z*9_g?kj1QHIJm-I;Qfd1^* z^TS>g^?SkLudDko@SQVNr!}(W58LH4&lmI*WI2Sil!itvg9_7x?lQJZVwt-9tp*EBvWDTf5JWHN3yp4Q z(Xz{b9z^KaH+#-Sqv*Ca4o9e}!p3V>>jwF@L8br2BWCrq%2~N7oeRA?g>8MxFfPXH;6NZ`u@xJI14DImW+0^4wW4$DtO!q+kx$1z&kd z<;wnyhWc8j-!)%*n1ILE{!M-#yT+Ie$k~mHNNiH*_rZ&>5KhEUC z422tVLW{D}A+0&qZz&VRR*bBDLn;YVnPl+_%)zWmpL*V0kUQT<$Iy~!G|{&VL%XIC zZrX@JnRDQ*b*8ih>Mk$Ae=DVqnlnzXYC51o5aG(7Ftk{PD@`(>zIM7wG`$wg=T25` z1t&(eqae!$xN${aM5pXYB*!v@+|uI}n#}w*d3}{Lw0TUO%J#=d7M_@kcA}sp-CO0^ zUn)txC(;P{3kM7~oqcton0NDw66ZXQ2E#$`;r2r`o{q<>_`@^`#{Pl-m>2i!G=Dsd zH=BZNfcARSpY$F^4%e_PCi`Dt`;{Q$sXwb=G>{dnG3mEZ?^W|!=Dj1AGQZ)qnYYg$PBdVc;_?*=aGH)f`yV!PcOu!n9~5alr`TPOO@F^2SjATc0c zp8vP^7-Pu@zixlS)3~Pkefx4pGA{;?3ZcpKqXMk9R&Jp*k;6|vvG;Spry zzN*y&SKft0ff7+?_*_W5QdR{yttBlV`BD}UNwy1VF#)p)-$xy*%#=p&R5(yA~K z(mVs7G7u;+zjCdQ9blHoVYsck%U4awqoYaKm^`WoG9hGjA+M9N*uy&hcE8$?X6V{M z7`f|0+uC(|rv?T}C{OP;om0#i+u)eO#5$9hf^l=0H(z;mV;*a*b72~$iNpCc2pa&S zTAJL(zg=hXL!6{&oOBQx5gWMzYv{~noIzee-AvDWlfW4kXI^|;=IOp762h&ZXDKO` zB&+!J_51jjaHKPZL)}5}`+_KS%B!$->YG0L?Jgx1p%-+q$V<6?Aq`x?ua!spl8HI+ zl1-LNo;jX2Bdt4N7LrMM)TZK@BsT|)pv_1aJdJlO11{ld1n6eJE0P>uO5?Ibou{L* zT^BDap}ZTdfg1~l+TKqbYUH=1)FIM(>o`gG1-ZH_NO_m1_F4>?v0fh)z|Y6t@+$F~ zyn@NtGf49kY@aqwsP+0Csc@HVI0-CsnWKdMg=H78i;7zf|KmsLhJEk9_q`s&knc6z zT)fYpkJ5aDR{J#f0ktP4_Jzdk1FxMBP|J?4P%&Lq;x4e)B#oaq@`tV2G(2#~^$xuKH)b%hgG*DpX!8dN=wROr@k zjO&;0t8OFZUKcWDqw5l#j-Inbjf@bg%b=?+&5P8??EgQrNL`&k@2LIuod#K@$e^|? zQ$wjP>vRy? z${GaCad(-7IxCNYnpRh0#48CyHUpNttC!uXV z#2zcdQ3wf+AZSH-i5$7=)HS8fnKYvr2ry7SW2^=g=i z2Ig|diMY_3*CrxvZ0&E;q`bSxt2v2RPbb1pjyR&H-KuZgSjmBrMI}-{z7Q%o?DzW` z0CLoyj+|i0`lI1+q+%tj>gW54G$-Osboj72eWObn9&6fJ20p=(;_@BI%DZG;dGL0_ z{>fT*C9qA#h|bOFYpg*$d2MR&jX-mascUZBV~z{{JJ&;r(vD&evE1seq5P>_-jUTl zbs+tY8q(Sof3R#sjrkyZ6iY5T+3kuP+ZUr~isX6l?4D^7fscKkCW|2({1>o7`Srcq@f5P7$nvML5HOLS!e{q;N3o`sG>Wu_IIy>EJBq zb$D3gQmqpVS^#SJuklEDs5m>-A=&X5_oP3;_Vxyto6ra=s;yRx%(WTE2J%s6MZP2~ zrh=PtI-6b7E|sjvGA>FLl#l(W0e)aKP!9}+R6|ARW3ALR%P)C4E&iFDYg6dQqMRrD zDxZ@yk5`Jq46quCJQ1h_El)#2beq`X3_Gx%NCNF=U*(4d2yCyucI&$A3g0mr==Lg) z0oS6f~$C>MK4qaU{Tx zg6KI3@c(*68O;EaA%i%stjx}%Wn3;lur{$x;aa6{J)c2s%ki^UVeW2pCRvYxmUNy7{X*@T8s@ zPVeov@$!DZJEbRqe>^zwWlo)c?EkR1yzmeFG~b+)2a@{7{@KObOZJni{4~$XJS770 z2!2NQS-Amk`5V!pkyObOXtCD;%Lf#uqTSyURNFPtVHDwb+g z_rqB7eD~(+`^(pVTb#dnGov#NRs&P*mHYDI*1f#DTH>G>qfiNsvKbvk zNZVChk@Y@Zkg7QgGwPa!xu{!oPWJi{=Z!3CyT*#GM!&0dkY2^bhTuTBVK~+AX6)IP ztC^r*OY-cyB3_bNV{mh1Fq%+JubNtL&I?8EJ5rYP*uFo{&euv4Dj$=PCs527I1iWGcRin#-&Y_&57HXU|6-H~)# zGfz1$5>=jZ_5uUga`sERnjE~F#FT)E5M&(4A#qQc)Vt3roHO0`1U24S$=QCm5xBwVJWEIO92|fKU4xKzYf3p zfhWE9US4=S9TgJUOH#cuKX;9We}<)UTF0;4q!bwaD)-{$l9U!>^2zLsm1Gq?@2yeU zE_iop44jOR6^wq4PJfmz2U?r7RINUUyHz|f5%-V(uSm7N)gI*B!WR7}W_Yk5W5BsZ}Ws~AlB68qPJstPM^G+)4RB+dKW+%C?$Y{(k*7>7Q^Dp zu*=TF|voK5DQbbktI3`CBdbWLHRz)W_$P~Y@Up7;AJ+o!&Ae*7piRJ{_Ju7Bn^>$S* zZXo=x{O~&9_&&in>;+>eybDJ9maOXx*=n`UynSrusCQ|Gt}Naa3ci#B2S8~2hq)!f{yd!Jx0F7MyrnhE5?WU+&3M$=`X! ztI1e5Wz!{t17r9DFooFsc63*>HyV|9SL_6X{`ia3W`q3Y`l?74%vwOPZG+ITtLfyP z{d6iU41l(!o6DTUtDlRc0-z2b6VhKBwgrWiM_=N; zY8a?A&zKaEu!V|p?~N|xZjSIAOJj}qM49@U0Inaze=#w-6*yzHPavr-IpQMfT|$-M zh_(lz!AxnyB%40K77tnl;Y5wFDVbqBOr>tVYI|k!PxMpTd_^VTy{uIY{mFL;HU-Nn zFX9b>DlDw`297g(+FR1c%|XBiw%p&M*Wn;EOsoZa5Ly-HFJMqe<}X};lW{oItGJsP zhl|^I$@!6x4JpJ*?&sg0oGM2-J-P%FlRlH7ZF>K6QKALBCesk0dfZH&^SZ2G>~CE_Wnb+$HPkBG2Y|UM)^fF}=oLt=FDYyGVhapXFJR=apa60}8T& zQ~iRhDGnZl?@79KoErlycewUD@by5i0KM|=h@o9D%sxTGt7l>;Ur=YhZr-;CgE11a zU?Fs53)jiKwavtoy03Cr3;HX-4T-1`sdM&ZU*(5vAsGUJMY6fO&Sf!BcXy?q3EgfD zIZ#>)6zi}f*YgBlGlmL)!S1vd22| zHFv-019Y3lh7omwNqW`{X2KoQcxcM_LCX(;PknD;^uZuA+*x()m*D@I{Xm` zKtG+FU%y%OwyWMIueQ6i%e!6w^!xq(D2m{}{eIv4Z!jE2-vq;cI0%AKI2wJ^r%QA6 zjo1G@m2mypmsMPR)BkE&X6OE&{P~kGXI{Mc)1N$zb^65%Iy2XKn&yuX2xVpk7?pJ{ z*}h<|@wkY$q#{LW0<|$~BhCQ-FDaypnJr4A1|Ww*rNV-tphOmsOE$Ptw%$Z+!2ikkNZB{z5lX{tvqN3bIS%CGq_CneX}j zD`@z}ZrOU0K6nEvkZc8SA^KNOJA&)o14tq9uZAZ05U>>YB+u$5l)lN|ivHC<=qRDQ zqF;|S{>l51JkkA#~0dFBl{q*9~@!{d&A^U&vALFm|Um%e=y?8mP2Qq&7_|fZ8 zL7zWcTO<9|d6E$hp7QxK{Zt=6*3mHM`1ZWdpYdnyfoy#inRo0RIi$+yvcbihDidZ!089k{(ea~F literal 0 HcmV?d00001 diff --git a/helm-templates/jenkins/ci/default-values.yaml b/helm-templates/jenkins/ci/default-values.yaml deleted file mode 100644 index 37c37f4..0000000 --- a/helm-templates/jenkins/ci/default-values.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# this file is empty to check if defaults within values.yaml work as expected -controller: - JCasC: - configScripts: - empty: "" diff --git a/helm-templates/jenkins/ci/other-values.yaml b/helm-templates/jenkins/ci/other-values.yaml deleted file mode 100644 index 5899980..0000000 --- a/helm-templates/jenkins/ci/other-values.yaml +++ /dev/null @@ -1,95 +0,0 @@ ---- -controller: - overwritePluginsFromImage: false - containerSecurityContext: "" - runAsUser: 0 - fsGroup: 1000 - JCasC: - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: true - securityRealm: |- - ldap: - configurations: - - server: ldap.acme.com - rootDN: dc=acme,dc=uk - managerPasswordSecret: ${LDAP_PASSWORD} - groupMembershipStrategy: - fromUserRecord: - attributeName: "memberOf" - additionalPlugins: - - ldap:682.v7b_544c9d1512 - scriptApproval: - - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - - "new groovy.json.JsonSlurperClassic" - - ingress: - enabled: true - -persistence: - enabled: false - -agent: - resources: - limits: - cpu: "1" - memory: "2048Mi" - envVars: - - name: HOME - value: /home/jenkins/agent - - name: PATH - value: /usr/local/bin - nodeSelector: - "app.kubernetes.io/component": "{{ .Values.agent.componentName }}" - yamlTemplate: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "app.kubernetes.io/component" - operator: "Equal" - value: "{{ .Values.agent.componentName }}" - effect: "NoSchedule" - additionalAgents: - maven: - podName: maven - customJenkinsLabels: maven - # An example of overriding the jnlp container - # sideContainerName: jnlp - image: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: python - tag: "3" - command: "/bin/sh -c" - args: "cat" - TTYEnabled: true - podTemplates: - python: | - - name: python - label: jenkins-python - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - volumes: - - type: EmptyDir - mountPath: /var/myapp/myemptydir - memory: false -serviceAccount: - annotations: - description: "Used by release {{ .Release.Name }} for role-based access control" -serviceAccountAgent: - create: true - annotations: - description: "Used by release {{ .Release.Name }} for role-based access control" diff --git a/helm-templates/jenkins/ci/with-secrets-values.yaml b/helm-templates/jenkins/ci/with-secrets-values.yaml deleted file mode 100644 index a1b8169..0000000 --- a/helm-templates/jenkins/ci/with-secrets-values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -controller: - additionalSecrets: - - name: nameOfSecret - value: secretText diff --git a/helm-templates/jenkins/templates/NOTES.txt b/helm-templates/jenkins/templates/NOTES.txt deleted file mode 100644 index 0d2df0b..0000000 --- a/helm-templates/jenkins/templates/NOTES.txt +++ /dev/null @@ -1,68 +0,0 @@ -{{- $prefix := .Values.controller.jenkinsUriPrefix | default "" -}} -{{- $url := "" -}} -1. Get your '{{ .Values.controller.adminUser }}' user password by running: - kubectl exec --namespace {{ template "jenkins.namespace" . }} -it svc/{{ template "jenkins.fullname" . }} -c jenkins -- /bin/cat /run/secrets/additional/chart-admin-password && echo -{{- if .Values.controller.ingress.hostName -}} -{{- if .Values.controller.ingress.tls -}} -{{- $url = print "https://" .Values.controller.ingress.hostName $prefix -}} -{{- else -}} -{{- $url = print "http://" .Values.controller.ingress.hostName $prefix -}} -{{- end }} -2. Visit {{ $url }} -{{- else }} -2. Get the Jenkins URL to visit by running these commands in the same shell: -{{- if contains "NodePort" .Values.controller.serviceType }} - export NODE_PORT=$(kubectl get --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "jenkins.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}") -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://$NODE_IP:$NODE_PORT" $prefix -}} -{{- else -}} -{{- $url = print "http://$NODE_IP:$NODE_PORT" $prefix -}} -{{- end }} - echo {{ $url }} - -{{- else if contains "LoadBalancer" .Values.controller.serviceType }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get svc --namespace {{ template "jenkins.namespace" . }} -w {{ template "jenkins.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ template "jenkins.namespace" . }} {{ template "jenkins.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://$SERVICE_IP:" .Values.controller.servicePort $prefix -}} -{{- else -}} -{{- $url = print "http://$SERVICE_IP:" .Values.controller.servicePort $prefix -}} -{{- end }} - echo {{ $url }} - -{{- else if contains "ClusterIP" .Values.controller.serviceType -}} -{{- if .Values.controller.httpsKeyStore.enable -}} -{{- $url = print "https://127.0.0.1:" .Values.controller.servicePort $prefix -}} -{{- else -}} -{{- $url = print "http://127.0.0.1:" .Values.controller.servicePort $prefix -}} -{{- end }} - echo {{ $url }} - kubectl --namespace {{ template "jenkins.namespace" . }} port-forward svc/{{template "jenkins.fullname" . }} {{ .Values.controller.servicePort }}:{{ .Values.controller.servicePort }} -{{- end }} -{{- end }} - -3. Login with the password from step 1 and the username: {{ .Values.controller.adminUser }} -4. Configure security realm and authorization strategy -5. Use Jenkins Configuration as Code by specifying configScripts in your values.yaml file, see documentation: {{ $url }}/configuration-as-code and examples: https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos - -For more information on running Jenkins on Kubernetes, visit: -https://cloud.google.com/solutions/jenkins-on-container-engine - -For more information about Jenkins Configuration as Code, visit: -https://jenkins.io/projects/jcasc/ - -{{ if (eq .Values.controller.image "jenkins/jenkins") }} -NOTE: Consider using a custom image with pre-installed plugins -{{- else if .Values.controller.installPlugins }} -NOTE: Consider disabling `installPlugins` if your image already contains plugins. -{{- end }} - -{{- if .Values.persistence.enabled }} -{{- else }} -################################################################################# -###### WARNING: Persistence is disabled!!! You will lose your data when ##### -###### the Jenkins pod is terminated. ##### -################################################################################# -{{- end }} diff --git a/helm-templates/jenkins/templates/_helpers.tpl b/helm-templates/jenkins/templates/_helpers.tpl deleted file mode 100644 index fd68ee7..0000000 --- a/helm-templates/jenkins/templates/_helpers.tpl +++ /dev/null @@ -1,554 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "jenkins.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Expand the label of the chart. -*/}} -{{- define "jenkins.label" -}} -{{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{/* -Allow the release namespace to be overridden for multi-namespace deployments in combined charts. -*/}} -{{- define "jenkins.namespace" -}} - {{- if .Values.namespaceOverride -}} - {{- .Values.namespaceOverride -}} - {{- else -}} - {{- .Release.Namespace -}} - {{- end -}} -{{- end -}} - -{{- define "jenkins.agent.namespace" -}} - {{- if .Values.agent.namespace -}} - {{- tpl .Values.agent.namespace . -}} - {{- else -}} - {{- if .Values.namespaceOverride -}} - {{- .Values.namespaceOverride -}} - {{- else -}} - {{- .Release.Namespace -}} - {{- end -}} - {{- end -}} -{{- end -}} - - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "jenkins.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Returns the admin password -https://github.com/helm/charts/issues/5167#issuecomment-619137759 -*/}} -{{- define "jenkins.password" -}} - {{ if .Values.controller.adminPassword -}} - {{- .Values.controller.adminPassword | b64enc | quote }} - {{- else -}} - {{- $secret := (lookup "v1" "Secret" .Release.Namespace (include "jenkins.fullname" .)).data -}} - {{- if $secret -}} - {{/* - Reusing current password since secret exists - */}} - {{- index $secret ( .Values.controller.admin.passwordKey | default "jenkins-admin-password" ) -}} - {{- else -}} - {{/* - Generate new password - */}} - {{- randAlphaNum 22 | b64enc | quote }} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Returns the Jenkins URL -*/}} -{{- define "jenkins.url" -}} -{{- if .Values.controller.jenkinsUrl }} - {{- .Values.controller.jenkinsUrl }} -{{- else }} - {{- if .Values.controller.ingress.hostName }} - {{- if .Values.controller.ingress.tls }} - {{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- else }} - {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- end }} - {{- else }} - {{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ template "jenkins.fullname" . }}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }} - {{- end}} -{{- end}} -{{- end -}} - -{{/* -Returns configuration as code default config -*/}} -{{- define "jenkins.casc.defaults" -}} -jenkins: - {{- $configScripts := toYaml .Values.controller.JCasC.configScripts }} - {{- if and (.Values.controller.JCasC.authorizationStrategy) (not (contains "authorizationStrategy:" $configScripts)) }} - authorizationStrategy: - {{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 4 }} - {{- end }} - {{- if and (.Values.controller.JCasC.securityRealm) (not (contains "securityRealm:" $configScripts)) }} - securityRealm: - {{- tpl .Values.controller.JCasC.securityRealm . | nindent 4 }} - {{- end }} - disableRememberMe: {{ .Values.controller.disableRememberMe }} - {{- if .Values.controller.legacyRemotingSecurityEnabled }} - remotingSecurity: - enabled: true - {{- end }} - mode: {{ .Values.controller.executorMode }} - numExecutors: {{ .Values.controller.numExecutors }} - {{- if not (kindIs "invalid" .Values.controller.customJenkinsLabels) }} - labelString: "{{ join " " .Values.controller.customJenkinsLabels }}" - {{- end }} - {{- if .Values.controller.projectNamingStrategy }} - {{- if kindIs "string" .Values.controller.projectNamingStrategy }} - projectNamingStrategy: "{{ .Values.controller.projectNamingStrategy }}" - {{- else }} - projectNamingStrategy: - {{- toYaml .Values.controller.projectNamingStrategy | nindent 4 }} - {{- end }} - {{- end }} - markupFormatter: - {{- if .Values.controller.enableRawHtmlMarkupFormatter }} - rawHtml: - disableSyntaxHighlighting: true - {{- else }} - {{- toYaml .Values.controller.markupFormatter | nindent 4 }} - {{- end }} - clouds: - - kubernetes: - containerCapStr: "{{ .Values.agent.containerCap }}" - {{- if .Values.agent.jnlpregistry }} - jnlpregistry: "{{ .Values.agent.jnlpregistry }}" - {{- end }} - defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}" - connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}" - readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}" - {{- if .Values.agent.directConnection }} - directConnection: true - {{- else }} - {{- if .Values.agent.jenkinsUrl }} - jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}" - {{- else }} - jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}" - {{- end }} - {{- if not .Values.agent.websocket }} - {{- if .Values.agent.jenkinsTunnel }} - jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}" - {{- else }} - jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" - {{- end }} - {{- else }} - webSocket: true - {{- end }} - {{- end }} - maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }} - retentionTimeout: {{ .Values.agent.retentionTimeout | quote }} - waitForPodSec: {{ .Values.agent.waitForPodSec | quote }} - name: "{{ .Values.controller.cloudName }}" - namespace: "{{ template "jenkins.agent.namespace" . }}" - serverUrl: "{{ .Values.kubernetesURL }}" - {{- if .Values.agent.enabled }} - podLabels: - - key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}" - value: "true" - {{- range $key, $val := .Values.agent.podLabels }} - - key: {{ $key | quote }} - value: {{ $val | quote }} - {{- end }} - templates: - {{- if not .Values.agent.disableDefaultAgent }} - {{- include "jenkins.casc.podTemplate" . | nindent 8 }} - {{- end }} - {{- if .Values.additionalAgents }} - {{- /* save .Values.agent */}} - {{- $agent := .Values.agent }} - {{- range $name, $additionalAgent := .Values.additionalAgents }} - {{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }} - {{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}} - {{- $additionalAgent := merge $additionalAgent $agent }} - {{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}} - {{- if $additionalContainersEmpty }} - {{- $_ := set $additionalAgent "additionalContainers" list }} - {{- end }} - {{- /* set .Values.agent to $additionalAgent */}} - {{- $_ := set $.Values "agent" $additionalAgent }} - {{- include "jenkins.casc.podTemplate" $ | nindent 8 }} - {{- end }} - {{- /* restore .Values.agent */}} - {{- $_ := set .Values "agent" $agent }} - {{- end }} - {{- if .Values.agent.podTemplates }} - {{- range $key, $val := .Values.agent.podTemplates }} - {{- tpl $val $ | nindent 8 }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }} - crumbIssuer: - standard: - excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }} - {{- end }} -{{- include "jenkins.casc.security" . }} -{{- if .Values.controller.scriptApproval }} - scriptApproval: - approvedSignatures: -{{- range $key, $val := .Values.controller.scriptApproval }} - - "{{ $val }}" -{{- end }} -{{- end }} -unclassified: - location: - adminAddress: {{ default "" .Values.controller.jenkinsAdminEmail }} - url: {{ template "jenkins.url" . }} -{{- end -}} - -{{/* -Returns a name template to be used for jcasc configmaps, using -suffix passed in at call as index 0 -*/}} -{{- define "jenkins.casc.configName" -}} -{{- $name := index . 0 -}} -{{- $root := index . 1 -}} -"{{- include "jenkins.fullname" $root -}}-jenkins-{{ $name }}" -{{- end -}} - -{{/* -Returns kubernetes pod template configuration as code -*/}} -{{- define "jenkins.casc.podTemplate" -}} -- name: "{{ .Values.agent.podName }}" - namespace: "{{ template "jenkins.agent.namespace" . }}" -{{- if .Values.agent.annotations }} - annotations: - {{- range $key, $value := .Values.agent.annotations }} - - key: {{ $key }} - value: {{ $value | quote }} - {{- end }} -{{- end }} - id: {{ sha256sum (toYaml .Values.agent) }} - containers: - - name: "{{ .Values.agent.sideContainerName }}" - alwaysPullImage: {{ .Values.agent.alwaysPullImage }} - args: "{{ .Values.agent.args | replace "$" "^$" }}" - command: {{ .Values.agent.command }} - envVars: - - envVar: - {{- if .Values.agent.directConnection }} - key: "JENKINS_DIRECT_CONNECTION" - {{- if .Values.agent.jenkinsTunnel }} - value: "{{ tpl .Values.agent.jenkinsTunnel . }}" - {{- else }} - value: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}" - {{- end }} - {{- else }} - key: "JENKINS_URL" - {{- if .Values.agent.jenkinsUrl }} - value: {{ tpl .Values.agent.jenkinsUrl . }} - {{- else }} - value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}" - {{- end }} - {{- end }} - image: "{{ .Values.agent.image }}:{{ .Values.agent.tag }}" - {{- if .Values.agent.livenessProbe }} - livenessProbe: - execArgs: {{.Values.agent.livenessProbe.execArgs | quote}} - failureThreshold: {{.Values.agent.livenessProbe.failureThreshold}} - initialDelaySeconds: {{.Values.agent.livenessProbe.initialDelaySeconds}} - periodSeconds: {{.Values.agent.livenessProbe.periodSeconds}} - successThreshold: {{.Values.agent.livenessProbe.successThreshold}} - timeoutSeconds: {{.Values.agent.livenessProbe.timeoutSeconds}} - {{- end }} - privileged: "{{- if .Values.agent.privileged }}true{{- else }}false{{- end }}" - resourceLimitCpu: {{.Values.agent.resources.limits.cpu}} - resourceLimitMemory: {{.Values.agent.resources.limits.memory}} - {{- if .Values.agent.resources.limits.ephemeralStorage }} - resourceLimitEphemeralStorage: {{.Values.agent.resources.limits.ephemeralStorage}} - {{- end }} - resourceRequestCpu: {{.Values.agent.resources.requests.cpu}} - resourceRequestMemory: {{.Values.agent.resources.requests.memory}} - {{- if .Values.agent.resources.requests.ephemeralStorage }} - resourceRequestEphemeralStorage: {{.Values.agent.resources.requests.ephemeralStorage}} - {{- end }} - runAsUser: {{ .Values.agent.runAsUser }} - runAsGroup: {{ .Values.agent.runAsGroup }} - ttyEnabled: {{ .Values.agent.TTYEnabled }} - workingDir: {{ .Values.agent.workingDir }} -{{- range $additionalContainers := .Values.agent.additionalContainers }} - - name: "{{ $additionalContainers.sideContainerName }}" - alwaysPullImage: {{ $additionalContainers.alwaysPullImage | default $.Values.agent.alwaysPullImage }} - args: "{{ $additionalContainers.args | replace "$" "^$" }}" - command: {{ $additionalContainers.command }} - envVars: - - envVar: - key: "JENKINS_URL" - {{- if $additionalContainers.jenkinsUrl }} - value: {{ tpl ($additionalContainers.jenkinsUrl) . }} - {{- else }} - value: "http://{{ template "jenkins.fullname" $ }}.{{ template "jenkins.namespace" $ }}.svc.{{ $.Values.clusterZone }}:{{ $.Values.controller.servicePort }}{{ default "/" $.Values.controller.jenkinsUriPrefix }}" - {{- end }} - image: "{{ $additionalContainers.image }}:{{ $additionalContainers.tag }}" - {{- if $additionalContainers.livenessProbe }} - livenessProbe: - execArgs: {{$additionalContainers.livenessProbe.execArgs | quote}} - failureThreshold: {{$additionalContainers.livenessProbe.failureThreshold}} - initialDelaySeconds: {{$additionalContainers.livenessProbe.initialDelaySeconds}} - periodSeconds: {{$additionalContainers.livenessProbe.periodSeconds}} - successThreshold: {{$additionalContainers.livenessProbe.successThreshold}} - timeoutSeconds: {{$additionalContainers.livenessProbe.timeoutSeconds}} - {{- end }} - privileged: "{{- if $additionalContainers.privileged }}true{{- else }}false{{- end }}" - resourceLimitCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.cpu }}{{ else }}{{ $.Values.agent.resources.limits.cpu }}{{ end }} - resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }} - resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }} - resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }} - runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }} - runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }} - ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }} - workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }} -{{- end }} -{{- if or .Values.agent.envVars .Values.agent.secretEnvVars }} - envVars: - {{- range $index, $var := .Values.agent.envVars }} - - envVar: - key: {{ $var.name }} - value: {{ tpl $var.value $ }} - {{- end }} - {{- range $index, $var := .Values.agent.secretEnvVars }} - - secretEnvVar: - key: {{ $var.key }} - secretName: {{ $var.secretName }} - secretKey: {{ $var.secretKey }} - optional: {{ $var.optional | default false }} - {{- end }} -{{- end }} - idleMinutes: {{ .Values.agent.idleMinutes }} - instanceCap: 2147483647 - {{- if .Values.agent.hostNetworking }} - hostNetwork: {{ .Values.agent.hostNetworking }} - {{- end }} - {{- if .Values.agent.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.agent.imagePullSecretName }} - {{- end }} - label: "{{ .Release.Name }}-{{ .Values.agent.componentName }} {{ .Values.agent.customJenkinsLabels | join " " }}" -{{- if .Values.agent.nodeSelector }} - nodeSelector: - {{- $local := dict "first" true }} - {{- range $key, $value := .Values.agent.nodeSelector }} - {{- if $local.first }} {{ else }},{{ end }} - {{- $key }}={{ tpl $value $ }} - {{- $_ := set $local "first" false }} - {{- end }} -{{- end }} - nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }} - podRetention: {{ .Values.agent.podRetention }} - showRawYaml: {{ .Values.agent.showRawYaml }} - serviceAccount: "{{ include "jenkins.serviceAccountAgentName" . }}" - slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}" -{{- if .Values.agent.volumes }} - volumes: - {{- range $index, $volume := .Values.agent.volumes }} - -{{- if (eq $volume.type "ConfigMap") }} configMapVolume: - {{- else if (eq $volume.type "EmptyDir") }} emptyDirVolume: - {{- else if (eq $volume.type "HostPath") }} hostPathVolume: - {{- else if (eq $volume.type "Nfs") }} nfsVolume: - {{- else if (eq $volume.type "PVC") }} persistentVolumeClaim: - {{- else if (eq $volume.type "Secret") }} secretVolume: - {{- else }} {{ $volume.type }}: - {{- end }} - {{- range $key, $value := $volume }} - {{- if not (eq $key "type") }} - {{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} -{{- if .Values.agent.workspaceVolume }} - workspaceVolume: - {{- if (eq .Values.agent.workspaceVolume.type "DynamicPVC") }} - dynamicPVC: - {{- else if (eq .Values.agent.workspaceVolume.type "EmptyDir") }} - emptyDirWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "HostPath") }} - hostPathWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "Nfs") }} - nfsWorkspaceVolume: - {{- else if (eq .Values.agent.workspaceVolume.type "PVC") }} - persistentVolumeClaimWorkspaceVolume: - {{- else }} - {{ .Values.agent.workspaceVolume.type }}: - {{- end }} - {{- range $key, $value := .Values.agent.workspaceVolume }} - {{- if not (eq $key "type") }} - {{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }} - {{- end }} - {{- end }} -{{- end }} -{{- if .Values.agent.yamlTemplate }} - yaml: |- - {{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }} -{{- end }} - yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }} -{{- end -}} - -{{- define "jenkins.kubernetes-version" -}} - {{- if .Values.controller.installPlugins -}} - {{- range .Values.controller.installPlugins -}} - {{ if hasPrefix "kubernetes:" . }} - {{- $split := splitList ":" . }} - {{- printf "%s" (index $split 1 ) -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{- define "jenkins.casc.security" }} -security: -{{- with .Values.controller.JCasC }} -{{- if .security }} - {{- .security | toYaml | nindent 2 }} -{{- end }} -{{- end }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "jenkins.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "jenkins.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the service account for Jenkins agents to use -*/}} -{{- define "jenkins.serviceAccountAgentName" -}} -{{- if .Values.serviceAccountAgent.create -}} - {{ default (printf "%s-%s" (include "jenkins.fullname" .) "agent") .Values.serviceAccountAgent.name }} -{{- else -}} - {{ default "default" .Values.serviceAccountAgent.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the service account for Jenkins backup to use -*/}} -{{- define "backup.serviceAccountBackupName" -}} -{{- if .Values.backup.serviceAccount.create -}} - {{ default (printf "%s-%s" (include "jenkins.fullname" .) "backup") .Values.backup.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.backup.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create a full tag name for controller image -*/}} -{{- define "controller.tag" -}} -{{- if .Values.controller.tagLabel -}} - {{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.tagLabel) .Values.controller.tag -}} -{{- else -}} - {{- default .Chart.AppVersion .Values.controller.tag -}} -{{- end -}} -{{- end -}} - -{{/* -Create the HTTP port for interacting with the controller -*/}} -{{- define "controller.httpPort" -}} -{{- if .Values.controller.httpsKeyStore.enable -}} - {{- .Values.controller.httpsKeyStore.httpPort -}} -{{- else -}} - {{- .Values.controller.targetPort -}} -{{- end -}} -{{- end -}} - -{{- define "jenkins.configReloadContainer" -}} -{{- $root := index . 0 -}} -{{- $containerName := index . 1 -}} -{{- $containerType := index . 2 -}} -- name: {{ $containerName }} - image: "{{ $root.Values.controller.sidecars.configAutoReload.image }}" - imagePullPolicy: {{ $root.Values.controller.sidecars.configAutoReload.imagePullPolicy }} - {{- if $root.Values.controller.sidecars.configAutoReload.containerSecurityContext }} - securityContext: {{- toYaml $root.Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 4 }} - {{- end }} - {{- if $root.Values.controller.sidecars.configAutoReload.envFrom }} - envFrom: -{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.envFrom) $root) | indent 4 }} - {{- end }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: "{{ template "jenkins.fullname" $root }}-jenkins-config" - - name: FOLDER - value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}" - - name: NAMESPACE - value: '{{ $root.Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" $root) }}' - {{- if eq $containerType "init" }} - - name: METHOD - value: "LIST" - {{- else if $root.Values.controller.sidecars.configAutoReload.sleepTime }} - - name: METHOD - value: "SLEEP" - - name: SLEEP_TIME - value: "{{ $root.Values.controller.sidecars.configAutoReload.sleepTime }}" - {{- end }} - {{- if eq $containerType "sidecar" }} - - name: REQ_URL - value: "http://localhost:{{- include "controller.httpPort" $root -}}{{- $root.Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" - - name: REQ_METHOD - value: "POST" - - name: REQ_RETRY_CONNECT - value: "{{ $root.Values.controller.sidecars.configAutoReload.reqRetryConnect }}" - {{- end }} - - {{- if $root.Values.controller.sidecars.configAutoReload.env }} - {{- range $envVarItem := $root.Values.controller.sidecars.configAutoReload.env -}} - {{- if or (ne $containerType "init") (ne .name "METHOD") }} -{{- (tpl (toYaml (list $envVarItem)) $root) | nindent 4 }} - {{- end -}} - {{- end -}} - {{- end }} - - resources: -{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }} - volumeMounts: - - name: sc-config-volume - mountPath: {{ $root.Values.controller.sidecars.configAutoReload.folder | quote }} - - name: jenkins-home - mountPath: {{ $root.Values.controller.jenkinsHome }} - {{- if $root.Values.persistence.subPath }} - subPath: {{ $root.Values.persistence.subPath }} - {{- end }} - -{{- end -}} diff --git a/helm-templates/jenkins/templates/config-init-scripts.yaml b/helm-templates/jenkins/templates/config-init-scripts.yaml deleted file mode 100644 index 7dd253c..0000000 --- a/helm-templates/jenkins/templates/config-init-scripts.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.controller.initScripts -}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }}-init-scripts - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -data: -{{- range $key, $val := .Values.controller.initScripts }} - init{{ $key }}.groovy: |- -{{ tpl $val $ | indent 4 }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/config.yaml b/helm-templates/jenkins/templates/config.yaml deleted file mode 100644 index b94c79f..0000000 --- a/helm-templates/jenkins/templates/config.yaml +++ /dev/null @@ -1,86 +0,0 @@ -{{- $jenkinsHome := .Values.controller.jenkinsHome -}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -data: - apply_config.sh: |- - set -e -{{- if .Values.controller.initializeOnce }} - if [ -f {{ .Values.controller.jenkinsHome }}/initialization-completed ]; then - echo "controller was previously initialized, refusing to re-initialize" - exit 0 - fi -{{- end }} - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.InstallUtil.lastExecVersion -{{- if .Values.controller.overwritePlugins }} - echo "remove all plugins from shared volume" - # remove all plugins from shared volume - rm -rf {{ .Values.controller.jenkinsHome }}/plugins/* -{{- end }} -{{- if .Values.controller.installPlugins }} - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt {{ .Values.controller.jenkinsHome }}; - rm -rf {{ .Values.controller.jenkinsRef }}/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "{{ .Values.controller.jenkinsWar }}" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "{{ .Values.controller.jenkinsWar }}" --plugin-file "{{ .Values.controller.jenkinsHome }}/plugins.txt" --latest {{ .Values.controller.installLatestPlugins }}{{- if .Values.controller.installLatestSpecifiedPlugins }} --latest-specified{{- end }}; - else - /usr/local/bin/install-plugins.sh `echo $(cat {{ .Values.controller.jenkinsHome }}/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i {{ .Values.controller.jenkinsRef }}/plugins/* /var/jenkins_plugins/; -{{- end }} - {{- if not .Values.controller.sidecars.configAutoReload.enabled }} - echo "copy configuration as code files" - mkdir -p {{ .Values.controller.jenkinsHome }}/casc_configs; - rm -rf {{ .Values.controller.jenkinsHome }}/casc_configs/* - {{- if or .Values.controller.JCasC.defaultConfig .Values.controller.JCasC.configScripts }} - cp -v /var/jenkins_config/*.yaml {{ .Values.controller.jenkinsHome }}/casc_configs - {{- end }} - {{- end }} - echo "finished initialization" -{{- if .Values.controller.initializeOnce }} - touch {{ .Values.controller.jenkinsHome }}/initialization-completed -{{- end }} - {{- if not .Values.controller.sidecars.configAutoReload.enabled }} -# Only add config to this script if we aren't auto-reloading otherwise the pod will restart upon each config change: -{{- if .Values.controller.JCasC.defaultConfig }} - jcasc-default-config.yaml: |- - {{- include "jenkins.casc.defaults" . |nindent 4}} -{{- end }} -{{- range $key, $val := .Values.controller.JCasC.configScripts }} - {{ $key }}.yaml: |- -{{ tpl $val $| indent 4 }} -{{- end }} -{{- end }} - plugins.txt: |- -{{- if .Values.controller.installPlugins }} - {{- range $installPlugin := .Values.controller.installPlugins }} - {{- $installPlugin | nindent 4 }} - {{- end }} - {{- range $addlPlugin := .Values.controller.additionalPlugins }} - {{- /* duplicate plugin check */}} - {{- range $installPlugin := $.Values.controller.installPlugins }} - {{- if eq (splitList ":" $addlPlugin | first) (splitList ":" $installPlugin | first) }} - {{- $message := print "[PLUGIN CONFLICT] controller.additionalPlugins contains '" $addlPlugin "'" }} - {{- $message := print $message " but controller.installPlugins already contains '" $installPlugin "'." }} - {{- $message := print $message " Override controller.installPlugins to use '" $addlPlugin "' plugin." }} - {{- fail $message }} - {{- end }} - {{- end }} - {{- $addlPlugin | nindent 4 }} - {{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/deprecation.yaml b/helm-templates/jenkins/templates/deprecation.yaml deleted file mode 100644 index 43a798d..0000000 --- a/helm-templates/jenkins/templates/deprecation.yaml +++ /dev/null @@ -1,115 +0,0 @@ -{{- if .Values.checkDeprecation }} - {{- if .Values.master }} - {{ fail "`master` does no longer exist. It has been renamed to `controller`" }} - {{- end }} - - {{- if .Values.controller.imageTag }} - {{ fail "`controller.imageTag` does no longer exist. Please use `controller.tag` instead" }} - {{- end }} - - {{- if .Values.controller.slaveListenerPort }} - {{ fail "`controller.slaveListenerPort` does no longer exist. It has been renamed to `controller.agentListenerPort`" }} - {{- end }} - - {{- if .Values.controller.slaveHostPort }} - {{ fail "`controller.slaveHostPort` does no longer exist. It has been renamed to `controller.agentListenerHostPort`" }} - {{- end }} - - {{- if .Values.controller.slaveKubernetesNamespace }} - {{ fail "`controller.slaveKubernetesNamespace` does no longer exist. It has been renamed to `agent.namespace`" }} - {{- end }} - - {{- if .Values.controller.slaveDefaultsProviderTemplate }} - {{ fail "`controller.slaveDefaultsProviderTemplate` does no longer exist. It has been renamed to `agent.defaultsProviderTemplate`" }} - {{- end }} - - {{- if .Values.controller.useSecurity }} - {{ fail "`controller.useSecurity` does no longer exist. It has been renamed to `controller.adminSecret`" }} - {{- end }} - - {{- if .Values.controller.slaveJenkinsUrl }} - {{ fail "`controller.slaveJenkinsUrl` does no longer exist. It has been renamed to `agent.jenkinsUrl`" }} - {{- end }} - - {{- if .Values.controller.slaveJenkinsTunnel }} - {{ fail "`controller.slaveJenkinsTunnel` does no longer exist. It has been renamed to `agent.jenkinsTunnel`" }} - {{- end }} - - {{- if .Values.controller.slaveConnectTimeout }} - {{ fail "`controller.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.kubernetesConnectTimeout`" }} - {{- end }} - - {{- if .Values.controller.slaveReadTimeout }} - {{ fail "`controller.slaveReadTimeout` does no longer exist. It has been renamed to `agent.kubernetesReadTimeout`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerServiceType }} - {{ fail "`controller.slaveListenerServiceType` does no longer exist. It has been renamed to `controller.agentListenerServiceType`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerLoadBalancerIP }} - {{ fail "`controller.slaveListenerLoadBalancerIP` does no longer exist. It has been renamed to `controller.agentListenerLoadBalancerIP`" }} - {{- end }} - - {{- if .Values.controller.slaveListenerServiceAnnotations }} - {{ fail "`controller.slaveListenerServiceAnnotations` does no longer exist. It has been renamed to `controller.agentListenerServiceAnnotations`" }} - {{- end }} - - {{- if .Values.agent.slaveConnectTimeout }} - {{ fail "`agent.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.connectTimeout`" }} - {{- end }} - - {{- if .Values.NetworkPolicy }} - - {{- if .Values.NetworkPolicy.Enabled }} - {{ fail "`NetworkPolicy.Enabled` does no longer exist. It has been renamed to `networkPolicy.enabled`" }} - {{- end }} - - {{- if .Values.NetworkPolicy.ApiVersion }} - {{ fail "`NetworkPolicy.ApiVersion` does no longer exist. It has been renamed to `networkPolicy.apiVersion`" }} - {{- end }} - - {{ fail "NetworkPolicy.* values have been renamed, please check the documentation" }} - {{- end }} - - - {{- if .Values.rbac.install }} - {{ fail "`rbac.install` does no longer exist. It has been renamed to `rbac.create` and is enabled by default!" }} - {{- end }} - - {{- if .Values.rbac.serviceAccountName }} - {{ fail "`rbac.serviceAccountName` does no longer exist. It has been renamed to `serviceAccount.name`" }} - {{- end }} - - {{- if .Values.rbac.serviceAccountAnnotations }} - {{ fail "`rbac.serviceAccountAnnotations` does no longer exist. It has been renamed to `serviceAccount.annotations`" }} - {{- end }} - - {{- if .Values.rbac.roleRef }} - {{ fail "`rbac.roleRef` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.rbac.roleKind }} - {{ fail "`rbac.roleKind` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.rbac.roleBindingKind }} - {{ fail "`rbac.roleBindingKind` does no longer exist. RBAC roles are now generated, please check the documentation" }} - {{- end }} - - {{- if .Values.controller.JCasC.pluginVersion }} - {{ fail "controller.JCasC.pluginVersion has been deprecated, please use controller.installPlugins instead" }} - {{- end }} - - {{- if .Values.controller.deploymentLabels }} - {{ fail "`controller.deploymentLabels` does no longer exist. It has been renamed to `controller.statefulSetLabels`" }} - {{- end }} - - {{- if .Values.controller.deploymentAnnotations }} - {{ fail "`controller.deploymentAnnotations` does no longer exist. It has been renamed to `controller.statefulSetAnnotations`" }} - {{- end }} - - {{- if .Values.controller.rollingUpdate }} - {{ fail "`controller.rollingUpdate` does no longer exist. It is no longer relevant, since a StatefulSet is used for the Jenkins controller" }} - {{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/home-pvc.yaml b/helm-templates/jenkins/templates/home-pvc.yaml deleted file mode 100644 index d3bfc5f..0000000 --- a/helm-templates/jenkins/templates/home-pvc.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}} -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: -{{- if .Values.persistence.annotations }} - annotations: -{{ toYaml .Values.persistence.annotations | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }}-tmp - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.persistence.labels }} -{{ toYaml .Values.persistence.labels | indent 4 }} -{{- end }} -spec: -{{- if .Values.persistence.dataSource }} - dataSource: -{{ toYaml .Values.persistence.dataSource | indent 4 }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- if .Values.persistence.volumeName }} - volumeName: "{{ .Values.persistence.volumeName }}" -{{- end }} -{{- end }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/jcasc-config.yaml b/helm-templates/jenkins/templates/jcasc-config.yaml deleted file mode 100644 index 684c985..0000000 --- a/helm-templates/jenkins/templates/jcasc-config.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- $root := . }} -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- range $key, $val := .Values.controller.JCasC.configScripts }} -{{- if $val }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}} - namespace: {{ template "jenkins.namespace" $root }} - labels: - "app.kubernetes.io/name": {{ template "jenkins.name" $root}} - {{- if $root.Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" - "app.kubernetes.io/instance": "{{ $.Release.Name }}" - "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" - {{ template "jenkins.fullname" $root }}-jenkins-config: "true" -data: - {{ $key }}.yaml: |- -{{ tpl $val $| indent 4 }} -{{- end }} -{{- end }} -{{- if .Values.controller.JCasC.defaultConfig }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}} - namespace: {{ template "jenkins.namespace" $root }} - labels: - "app.kubernetes.io/name": {{ template "jenkins.name" $root}} - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $.Release.Service }}" - "app.kubernetes.io/instance": "{{ $.Release.Name }}" - "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}" - {{ template "jenkins.fullname" $root }}-jenkins-config: "true" -data: - jcasc-default-config.yaml: |- - {{- include "jenkins.casc.defaults" . |nindent 4 }} -{{- end}} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-agent-svc.yaml b/helm-templates/jenkins/templates/jenkins-agent-svc.yaml deleted file mode 100644 index 4440b91..0000000 --- a/helm-templates/jenkins/templates/jenkins-agent-svc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if .Values.controller.agentListenerEnabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jenkins.fullname" . }}-agent - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.agentListenerServiceAnnotations }} - annotations: - {{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }} - {{- end }} -spec: - {{- if .Values.controller.agentListenerExternalTrafficPolicy }} - externalTrafficPolicy: {{.Values.controller.agentListenerExternalTrafficPolicy}} - {{- end }} - ports: - - port: {{ .Values.controller.agentListenerPort }} - targetPort: {{ .Values.controller.agentListenerPort }} - {{- if (and (eq .Values.controller.agentListenerServiceType "NodePort") (not (empty .Values.controller.agentListenerNodePort))) }} - nodePort: {{ .Values.controller.agentListenerNodePort }} - {{- end }} - name: agent-listener - selector: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - type: {{ .Values.controller.agentListenerServiceType }} - {{if eq .Values.controller.agentListenerServiceType "LoadBalancer"}} -{{- if .Values.controller.agentListenerLoadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml .Values.controller.agentListenerLoadBalancerSourceRanges | indent 4 }} -{{- end }} - {{- end }} - {{- if and (eq .Values.controller.agentListenerServiceType "LoadBalancer") (.Values.controller.agentListenerLoadBalancerIP) }} - loadBalancerIP: {{ .Values.controller.agentListenerLoadBalancerIP }} - {{- end }} - {{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-aws-security-group-policies.yaml b/helm-templates/jenkins/templates/jenkins-aws-security-group-policies.yaml deleted file mode 100644 index 2f6e7a1..0000000 --- a/helm-templates/jenkins/templates/jenkins-aws-security-group-policies.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.awsSecurityGroupPolicies.enabled -}} -{{- range .Values.awsSecurityGroupPolicies.policies -}} -apiVersion: vpcresources.k8s.aws/v1beta1 -kind: SecurityGroupPolicy -metadata: - name: {{ .name }} - namespace: {{ template "jenkins.namespace" $ }} -spec: - podSelector: - {{- toYaml .podSelector | nindent 6}} - securityGroups: - groupIds: - {{- toYaml .securityGroupIds | nindent 6}} ---- -{{- end -}} -{{- end -}} diff --git a/helm-templates/jenkins/templates/jenkins-backup-cronjob.yaml b/helm-templates/jenkins/templates/jenkins-backup-cronjob.yaml deleted file mode 100644 index d710dd5..0000000 --- a/helm-templates/jenkins/templates/jenkins-backup-cronjob.yaml +++ /dev/null @@ -1,168 +0,0 @@ -{{- if .Values.backup.enabled }} -apiVersion: {{ .Values.cronJob.apiVersion }} -kind: CronJob -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.backup.componentName }}" -spec: - schedule: {{ .Values.backup.schedule | quote }} - concurrencyPolicy: Forbid - startingDeadlineSeconds: 120 - jobTemplate: - spec: -{{- if .Values.backup.activeDeadlineSeconds }} - activeDeadlineSeconds: {{ .Values.backup.activeDeadlineSeconds }} -{{- end }} - template: - metadata: - {{- if .Values.backup.labels }} - labels: - {{- toYaml .Values.backup.labels | trim | nindent 12 }} - {{- end }} - {{- if .Values.backup.annotations }} - annotations: - {{- toYaml .Values.backup.annotations | trim | nindent 12 }} - {{- end }} - spec: - restartPolicy: OnFailure - serviceAccountName: {{ include "backup.serviceAccountBackupName" . }} - {{- if .Values.backup.usePodSecurityContext }} - securityContext: - {{- if hasKey .Values.backup "podSecurityContextOverride" }} - {{- tpl (toYaml .Values.backup.podSecurityContextOverride | nindent 12) . }} - {{- else }} - runAsUser: {{ default 0 .Values.backup.runAsUser }} - {{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }} - {{- if not (eq (int .Values.backup.runAsUser) 0) }} - fsGroup: {{ .Values.backup.fsGroup }} - {{- end }} - {{- end }} - {{- if .Values.backup.securityContextCapabilities }} - capabilities: - {{- toYaml .Values.backup.securityContextCapabilities | nindent 12 }} - {{- end }} - {{- end }} - {{- end }} - containers: - - name: jenkins-backup - image: "{{ .Values.backup.image.repository }}:{{ .Values.backup.image.tag }}" - command: ["kube-tasks"] - args: - - simple-backup - - -n - - {{ template "jenkins.namespace" . }} - - -l - - app.kubernetes.io/instance={{ .Release.Name }} - - --container - - jenkins - - --path - {{- if .Values.backup.onlyJobs }} - - {{ .Values.controller.jenkinsHome }}/jobs - {{- else}} - - {{ .Values.controller.jenkinsHome }} - {{- end}} - - --dst - - {{ .Values.backup.destination }} - {{- with .Values.backup.extraArgs }} - {{- toYaml . | nindent 12 }} - {{- end }} - env: - {{- with .Values.backup.env }} - {{- toYaml . | trim | nindent 12 }} - {{- end }} - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.awsaccesskey }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.awsaccesskey | quote }} - {{- end }} - {{- if $value.awssecretkey }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.awssecretkey | quote}} - {{- end }} - {{- if $value.azstorageaccount }} - - name: AZURE_STORAGE_ACCOUNT - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.azstorageaccount | quote}} - {{- end }} - {{- if $value.azstoragekey }} - - name: AZURE_STORAGE_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ $key }} - key: {{ $value.azstoragekey | quote}} - {{- end }} - {{- if $value.gcpcredentials }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/var/run/secrets/{{ $key }}/{{ $value.gcpcredentials }}" - {{- end }} - {{- end }} - {{- end }} - {{- with .Values.backup.resources }} - resources: - {{- toYaml . | trim | nindent 14 }} - {{- end }} - volumeMounts: - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.gcpcredentials }} - - mountPath: /var/run/secrets/{{ $key }} - name: {{ $key }} - {{- end }} - {{- end }} - {{- end }} - volumes: - {{- if .Values.backup.existingSecret }} - {{- range $key,$value := .Values.backup.existingSecret }} - {{- if $value.gcpcredentials }} - - name: {{ $key }} - secret: - secretName: {{ $key }} - {{- end }} - {{- end }} - {{- end }} - affinity: - podAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - topologyKey: "kubernetes.io/hostname" - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - {{ template "jenkins.fullname" . }} - - key: release - operator: In - values: - - {{ .Release.Name }} - {{- with .Values.controller.tolerations }} - tolerations: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.controller.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if .Values.backup.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.backup.imagePullSecretName }} - {{- end -}} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-backup-rbac.yaml b/helm-templates/jenkins/templates/jenkins-backup-rbac.yaml deleted file mode 100644 index 0f94fa8..0000000 --- a/helm-templates/jenkins/templates/jenkins-backup-rbac.yaml +++ /dev/null @@ -1,64 +0,0 @@ -{{- if .Values.backup.enabled }} -{{- if .Values.backup.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "backup.serviceAccountBackupName" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.backup.serviceAccount.annotations }} - annotations: - {{- toYaml .Values.backup.serviceAccount.annotations | nindent 4 }} - {{- end }} -{{- end }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["pods/exec"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "jenkins.fullname" . }}-backup - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-backup -subjects: -- kind: ServiceAccount - name: {{ include "backup.serviceAccountBackupName" . }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-alerting-rules.yaml b/helm-templates/jenkins/templates/jenkins-controller-alerting-rules.yaml deleted file mode 100644 index 3fd8061..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-alerting-rules.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and .Values.controller.prometheus.enabled .Values.controller.prometheus.alertingrules }} ---- -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.prometheus.prometheusRuleNamespace }} - namespace: {{ .Values.controller.prometheus.prometheusRuleNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} -spec: - groups: -{{ toYaml .Values.controller.prometheus.alertingrules | indent 2 }} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-backendconfig.yaml b/helm-templates/jenkins/templates/jenkins-controller-backendconfig.yaml deleted file mode 100644 index 0e8a566..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-backendconfig.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if .Values.controller.backendconfig.enabled }} -apiVersion: {{ .Values.controller.backendconfig.apiVersion }} -kind: BackendConfig -metadata: - name: {{ .Values.controller.backendconfig.name }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.controller.backendconfig.labels }} -{{ toYaml .Values.controller.backendconfig.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.backendconfig.annotations }} - annotations: -{{ toYaml .Values.controller.backendconfig.annotations | indent 4 }} -{{- end }} -spec: -{{ toYaml .Values.controller.backendconfig.spec | indent 2 }} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-ingress.yaml b/helm-templates/jenkins/templates/jenkins-controller-ingress.yaml deleted file mode 100644 index b3b344f..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-ingress.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if .Values.controller.ingress.enabled }} -{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.ingress.apiVersion }} -{{- end }} -kind: Ingress -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.controller.ingress.labels }} -{{ toYaml .Values.controller.ingress.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.ingress.annotations }} - annotations: -{{ toYaml .Values.controller.ingress.annotations | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }} -spec: -{{- if .Values.controller.ingress.ingressClassName }} - ingressClassName: {{ .Values.controller.ingress.ingressClassName | quote }} -{{- end }} - rules: - - http: - paths: -{{- if empty (.Values.controller.ingress.paths) }} - - backend: -{{- if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ template "jenkins.fullname" . }} - port: - number: {{ .Values.controller.servicePort }} - pathType: ImplementationSpecific -{{- else }} - serviceName: {{ template "jenkins.fullname" . }} - servicePort: {{ .Values.controller.servicePort }} -{{- end }} -{{- if .Values.controller.ingress.path }} - path: {{ .Values.controller.ingress.path }} -{{- end -}} -{{- else }} -{{ tpl (toYaml .Values.controller.ingress.paths | indent 6) . }} -{{- end -}} -{{- if .Values.controller.ingress.hostName }} - host: {{ tpl .Values.controller.ingress.hostName . | quote }} -{{- end }} -{{- if .Values.controller.ingress.resourceRootUrl }} - - http: - paths: - - backend: -{{- if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ template "jenkins.fullname" . }} - port: - number: {{ .Values.controller.servicePort }} - pathType: ImplementationSpecific -{{- else }} - serviceName: {{ template "jenkins.fullname" . }} - servicePort: {{ .Values.controller.servicePort }} -{{- end }} - host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }} -{{- end }} -{{- if .Values.controller.ingress.tls }} - tls: -{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }} -{{- end -}} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-networkpolicy.yaml b/helm-templates/jenkins/templates/jenkins-controller-networkpolicy.yaml deleted file mode 100644 index 91cf6db..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-networkpolicy.yaml +++ /dev/null @@ -1,76 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ .Values.networkPolicy.apiVersion }} -metadata: - name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}" - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -spec: - podSelector: - matchLabels: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - ingress: - # Allow web access to the UI - - ports: - - port: {{ .Values.controller.targetPort }} - {{- if .Values.controller.agentListenerEnabled }} - # Allow inbound connections from agents - - from: - {{- if .Values.networkPolicy.internalAgents.allowed }} - - podSelector: - matchLabels: - "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true" - {{- range $k,$v:= .Values.networkPolicy.internalAgents.podLabels }} - {{ $k }}: {{ $v }} - {{- end }} - {{- if .Values.networkPolicy.internalAgents.namespaceLabels }} - namespaceSelector: - matchLabels: - {{- range $k,$v:= .Values.networkPolicy.internalAgents.namespaceLabels }} - {{ $k }}: {{ $v }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.networkPolicy.externalAgents }} - - ipBlock: - cidr: {{ required "ipCIDR is required if you wish to allow external agents to connect to Jenkins Controller." .Values.networkPolicy.externalAgents.ipCIDR }} - {{- if .Values.networkPolicy.externalAgents.except }} - except: - {{- range .Values.networkPolicy.externalAgents.except }} - - {{ . }} - {{- end }} - {{- end }} - {{- end }} - ports: - - port: {{ .Values.controller.agentListenerPort }} - {{- end }} -{{- if .Values.agent.enabled }} ---- -kind: NetworkPolicy -apiVersion: {{ .Values.networkPolicy.apiVersion }} -metadata: - name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}" - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -spec: - podSelector: - matchLabels: - # DefaultDeny - "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true" -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-pdb.yaml b/helm-templates/jenkins/templates/jenkins-controller-pdb.yaml deleted file mode 100644 index 9dc1faf..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-pdb.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.controller.podDisruptionBudget.enabled }} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if semverCompare ">=1.21-0" $kubeTargetVersion -}} -apiVersion: policy/v1 -{{- else if semverCompare ">=1.5-0" $kubeTargetVersion -}} -apiVersion: policy/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.podDisruptionBudget.apiVersion }} -{{- end }} -kind: PodDisruptionBudget -metadata: - name: {{ template "jenkins.fullname" . }}-pdb - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.podDisruptionBudget.labels -}} - {{ toYaml .Values.controller.podDisruptionBudget.labels | nindent 4 }} - {{- end }} - {{- if .Values.controller.podDisruptionBudget.annotations }} - annotations: {{ toYaml .Values.controller.podDisruptionBudget.annotations | nindent 4 }} - {{- end }} -spec: - maxUnavailable: {{ .Values.controller.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-podmonitor.yaml b/helm-templates/jenkins/templates/jenkins-controller-podmonitor.yaml deleted file mode 100644 index 9a04019..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-podmonitor.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if .Values.controller.googlePodMonitor.enabled }} -apiVersion: monitoring.googleapis.com/v1 -kind: PodMonitoring - -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.googlePodMonitor.serviceMonitorNamespace }} - namespace: {{ .Values.controller.googlePodMonitor.serviceMonitorNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - -spec: - endpoints: - - interval: {{ .Values.controller.googlePodMonitor.scrapeInterval }} - port: http - path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.googlePodMonitor.scrapeEndpoint }} - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-route.yaml b/helm-templates/jenkins/templates/jenkins-controller-route.yaml deleted file mode 100644 index 3550380..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-route.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.controller.route.enabled }} -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - app: {{ template "jenkins.fullname" . }} - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" - component: "{{ .Release.Name }}-{{ .Values.controller.componentName }}" -{{- if .Values.controller.route.labels }} -{{ toYaml .Values.controller.route.labels | indent 4 }} -{{- end }} -{{- if .Values.controller.route.annotations }} - annotations: -{{ toYaml .Values.controller.route.annotations | indent 4 }} -{{- end }} - name: {{ template "jenkins.fullname" . }} -spec: - host: {{ .Values.controller.route.path }} - port: - targetPort: http - tls: - insecureEdgeTerminationPolicy: Redirect - termination: edge - to: - kind: Service - name: {{ template "jenkins.fullname" . }} - weight: 100 - wildcardPolicy: None -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-secondary-ingress.yaml b/helm-templates/jenkins/templates/jenkins-controller-secondary-ingress.yaml deleted file mode 100644 index c63e482..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-secondary-ingress.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- if .Values.controller.secondaryingress.enabled }} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- $serviceName := include "jenkins.fullname" . -}} -{{- $servicePort := .Values.controller.servicePort -}} -{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: {{ .Values.controller.secondaryingress.apiVersion }} -{{- end }} -kind: Ingress -metadata: - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.secondaryingress.labels -}} - {{ toYaml .Values.controller.secondaryingress.labels | nindent 4 }} - {{- end }} - {{- if .Values.controller.secondaryingress.annotations }} - annotations: {{ toYaml .Values.controller.secondaryingress.annotations | nindent 4 }} - {{- end }} - name: {{ template "jenkins.fullname" . }}-secondary -spec: -{{- if .Values.controller.secondaryingress.ingressClassName }} - ingressClassName: {{ .Values.controller.secondaryingress.ingressClassName | quote }} -{{- end }} - rules: - - host: {{ .Values.controller.secondaryingress.hostName }} - http: - paths: - {{- range .Values.controller.secondaryingress.paths }} - - path: {{ . | quote }} - backend: -{{ if semverCompare ">=1.19-0" $kubeTargetVersion }} - service: - name: {{ $serviceName }} - port: - number: {{ $servicePort }} - pathType: ImplementationSpecific -{{ else }} - serviceName: {{ $serviceName }} - servicePort: {{ $servicePort }} -{{ end }} - {{- end}} -{{- if .Values.controller.secondaryingress.tls }} - tls: -{{ toYaml .Values.controller.secondaryingress.tls | indent 4 }} -{{- end -}} -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-servicemonitor.yaml b/helm-templates/jenkins/templates/jenkins-controller-servicemonitor.yaml deleted file mode 100644 index 8710b2b..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-servicemonitor.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if and .Values.controller.prometheus.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor - -metadata: - name: {{ template "jenkins.fullname" . }} -{{- if .Values.controller.prometheus.serviceMonitorNamespace }} - namespace: {{ .Values.controller.prometheus.serviceMonitorNamespace }} -{{- else }} - namespace: {{ template "jenkins.namespace" . }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.prometheus.serviceMonitorAdditionalLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - -spec: - endpoints: - - interval: {{ .Values.controller.prometheus.scrapeInterval }} - port: http - path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.prometheus.scrapeEndpoint }} - {{- with .Values.controller.prometheus.relabelings }} - relabelings: - {{- toYaml . | nindent 6 }} - {{- end }} - {{- with .Values.controller.prometheus.metricRelabelings }} - metricRelabelings: - {{- toYaml . | nindent 6 }} - {{- end }} - jobLabel: {{ template "jenkins.fullname" . }} - namespaceSelector: - matchNames: - - "{{ template "jenkins.namespace" $ }}" - selector: - matchLabels: - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- end }} diff --git a/helm-templates/jenkins/templates/jenkins-controller-statefulset.yaml b/helm-templates/jenkins/templates/jenkins-controller-statefulset.yaml deleted file mode 100644 index 251bfc1..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-statefulset.yaml +++ /dev/null @@ -1,419 +0,0 @@ -{{- if .Capabilities.APIVersions.Has "apps/v1" }} -apiVersion: apps/v1 -{{- else }} -apiVersion: apps/v1beta1 -{{- end }} -kind: StatefulSet -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.statefulSetLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - {{- with .Values.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.controller.statefulSetAnnotations }} - annotations: -{{ toYaml .Values.controller.statefulSetAnnotations | indent 4 }} - {{- end }} -spec: - serviceName: {{ template "jenkins.fullname" . }} - replicas: {{ .Values.controller.replicas }} - selector: - matchLabels: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - {{- if .Values.controller.updateStrategy }} - updateStrategy: -{{ toYaml .Values.controller.updateStrategy | indent 4 }} - {{- end }} - template: - metadata: - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- range $key, $val := .Values.controller.podLabels }} - {{ $key }}: {{ $val | quote }} - {{- end}} - {{- with .Values.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - annotations: - checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }} - {{- if .Values.controller.initScripts }} - checksum/config-init-scripts: {{ include (print $.Template.BasePath "/config-init-scripts.yaml") . | sha256sum }} - {{- end }} - {{- if .Values.controller.podAnnotations }} -{{ tpl (toYaml .Values.controller.podAnnotations | indent 8) . }} - {{- end }} - spec: - {{- if .Values.controller.schedulerName }} - schedulerName: {{ .Values.controller.schedulerName }} - {{- end }} - {{- if .Values.controller.nodeSelector }} - nodeSelector: -{{ toYaml .Values.controller.nodeSelector | indent 8 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: -{{ toYaml .Values.controller.tolerations | indent 8 }} - {{- end }} - {{- if .Values.controller.affinity }} - affinity: -{{ toYaml .Values.controller.affinity | indent 8 }} - {{- end }} - {{- if quote .Values.controller.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} - {{- end }} - {{- if .Values.controller.shareProcessNamespace }} - shareProcessNamespace: true - {{- end }} -{{- if .Values.controller.usePodSecurityContext }} - securityContext: - {{- if hasKey .Values.controller "podSecurityContextOverride" }} - {{- tpl (toYaml .Values.controller.podSecurityContextOverride | nindent 8) . -}} - {{- else }} - {{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed: - runAsUser: 1000 - fsGroup: 1000 - runAsNonRoot: true - */}} - runAsUser: {{ default 0 .Values.controller.runAsUser }} - {{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }} - {{- if not (eq (int .Values.controller.runAsUser) 0) }} - fsGroup: {{ .Values.controller.fsGroup }} - runAsNonRoot: true - {{- end }} - {{- if .Values.controller.securityContextCapabilities }} - capabilities: - {{- toYaml .Values.controller.securityContextCapabilities | nindent 10 }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} - serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}" -{{- if .Values.controller.hostNetworking }} - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet -{{- end }} - {{- if .Values.controller.hostAliases }} - hostAliases: - {{- toYaml .Values.controller.hostAliases | nindent 8 }} - {{- end }} - initContainers: -{{- if .Values.controller.customInitContainers }} -{{ tpl (toYaml .Values.controller.customInitContainers) . | indent 8 }} -{{- end }} - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- include "jenkins.configReloadContainer" (list $ "config-reload-init" "init") | nindent 8 }} -{{- end}} - - - name: "init" - image: "{{ .Values.controller.image }}:{{- include "controller.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.imagePullPolicy }}" - {{- if .Values.controller.containerSecurityContext }} - securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} - {{- end }} - command: [ "sh", "/var/jenkins_config/apply_config.sh" ] - {{- if .Values.controller.initContainerEnvFrom }} - envFrom: -{{ (tpl (toYaml .Values.controller.initContainerEnvFrom) .) | indent 12 }} - {{- end }} - {{- if .Values.controller.initContainerEnv }} - env: -{{ (tpl (toYaml .Values.controller.initContainerEnv) .) | indent 12 }} - {{- end }} - resources: -{{- if .Values.controller.initContainerResources }} -{{ toYaml .Values.controller.initContainerResources | indent 12 }} -{{- else }} -{{ toYaml .Values.controller.resources | indent 12 }} -{{- end }} - volumeMounts: - {{- if .Values.persistence.mounts }} -{{ toYaml .Values.persistence.mounts | indent 12 }} - {{- end }} - - mountPath: {{ .Values.controller.jenkinsHome }} - name: jenkins-home - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - mountPath: /var/jenkins_config - name: jenkins-config - {{- if .Values.controller.installPlugins }} - {{- if .Values.controller.overwritePluginsFromImage }} - - mountPath: {{ .Values.controller.jenkinsRef }}/plugins - name: plugins - {{- end }} - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - {{- end }} - {{- if or .Values.controller.initScripts .Values.controller.initConfigMap }} - - mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d - name: init-scripts - {{- end }} - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - {{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }} - - mountPath: {{ $httpsJKSDirPath }} - name: jenkins-https-keystore - {{- end }} - containers: - - name: jenkins - image: "{{ .Values.controller.image }}:{{- include "controller.tag" . -}}" - imagePullPolicy: "{{ .Values.controller.imagePullPolicy }}" - {{- if .Values.controller.containerSecurityContext }} - securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }} - {{- end }} - {{- if .Values.controller.overrideArgs }} - args: [ - {{- range $overrideArg := .Values.controller.overrideArgs }} - "{{- tpl $overrideArg $ }}", - {{- end }} - ] - {{- else if .Values.controller.httpsKeyStore.enable }} - {{- $httpsJKSFilePath := printf "%s/%s" .Values.controller.httpsKeyStore.path .Values.controller.httpsKeyStore.fileName }} - args: [ "--httpPort={{.Values.controller.httpsKeyStore.httpPort}}", "--httpsPort={{.Values.controller.targetPort}}", '--httpsKeyStore={{ $httpsJKSFilePath }}', "--httpsKeyStorePassword=$(JENKINS_HTTPS_KEYSTORE_PASSWORD)" ] - {{- else }} - args: [ "--httpPort={{.Values.controller.targetPort}}"] - {{- end }} - {{- if .Values.controller.lifecycle }} - lifecycle: -{{ toYaml .Values.controller.lifecycle | indent 12 }} - {{- end }} -{{- if .Values.controller.terminationMessagePath }} - terminationMessagePath: {{ .Values.controller.terminationMessagePath }} -{{- end }} -{{- if .Values.controller.terminationMessagePolicy }} - terminationMessagePolicy: {{ .Values.controller.terminationMessagePolicy }} -{{- end }} - {{- if .Values.controller.containerEnvFrom }} - envFrom: -{{ (tpl ( toYaml .Values.controller.containerEnvFrom) .) | indent 12 }} - {{- end }} - env: - {{- if .Values.controller.containerEnv }} -{{ (tpl ( toYaml .Values.controller.containerEnv) .) | indent 12 }} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} - - name: SECRETS - value: /run/secrets/additional - {{- end }} - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: >- - {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ default "" .Values.controller.javaOpts }} - - name: JENKINS_OPTS - value: >- - {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ default "" .Values.controller.jenkinsOpts}} - - name: JENKINS_SLAVE_AGENT_PORT - value: "{{ .Values.controller.agentListenerPort }}" - {{- if .Values.controller.httpsKeyStore.enable }} - - name: JENKINS_HTTPS_KEYSTORE_PASSWORD - {{- if not .Values.controller.httpsKeyStore.disableSecretMount }} - valueFrom: - secretKeyRef: - name: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ else if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} - key: "{{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey }}" - {{- else }} - value: {{ .Values.controller.httpsKeyStore.password }} - {{- end }} - {{- end }} - - - name: CASC_JENKINS_CONFIG - value: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }}{{- if .Values.controller.JCasC.configUrls }},{{ join "," .Values.controller.JCasC.configUrls }}{{- end }} - ports: - {{- if .Values.controller.httpsKeyStore.enable }} - - containerPort: {{.Values.controller.httpsKeyStore.httpPort}} - {{- else }} - - containerPort: {{.Values.controller.targetPort}} - {{- end }} - name: http - - containerPort: {{ .Values.controller.agentListenerPort }} - name: agent-listener - {{- if .Values.controller.agentListenerHostPort }} - hostPort: {{ .Values.controller.agentListenerHostPort }} - {{- end }} - {{- if .Values.controller.jmxPort }} - - containerPort: {{ .Values.controller.jmxPort }} - name: jmx - {{- end }} -{{- range $index, $port := .Values.controller.extraPorts }} - - containerPort: {{ $port.port }} - name: {{ $port.name }} -{{- end }} -{{- if and .Values.controller.healthProbes .Values.controller.probes}} - {{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion }} - startupProbe: -{{ tpl (toYaml .Values.controller.probes.startupProbe | indent 12) .}} - {{- end }} - livenessProbe: -{{ tpl (toYaml .Values.controller.probes.livenessProbe | indent 12) .}} - readinessProbe: -{{ tpl (toYaml .Values.controller.probes.readinessProbe | indent 12) .}} -{{- end }} - resources: -{{ toYaml .Values.controller.resources | indent 12 }} - volumeMounts: -{{- if .Values.persistence.mounts }} -{{ toYaml .Values.persistence.mounts | indent 12 }} -{{- end }} - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - {{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }} - - mountPath: {{ $httpsJKSDirPath }} - name: jenkins-https-keystore - {{- end }} - - mountPath: {{ .Values.controller.jenkinsHome }} - name: jenkins-home - readOnly: false - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - {{- if .Values.controller.installPlugins }} - - mountPath: {{ .Values.controller.jenkinsRef }}/plugins/ - name: plugin-dir - readOnly: false - {{- end }} - {{- if or .Values.controller.initScripts .Values.controller.initConfigMap }} - - mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d - name: init-scripts - {{- end }} - {{- if .Values.controller.sidecars.configAutoReload.enabled }} - - name: sc-config-volume - mountPath: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} - - name: jenkins-secrets - mountPath: /run/secrets/additional - readOnly: true - {{- end }} - - name: jenkins-cache - mountPath: /var/jenkins_cache - - mountPath: /tmp - name: tmp-volume - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -{{- include "jenkins.configReloadContainer" (list $ "config-reload" "sidecar") | nindent 8 }} -{{- end}} - - -{{- if .Values.controller.sidecars.other}} -{{ tpl (toYaml .Values.controller.sidecars.other | indent 8) .}} -{{- end }} - - volumes: -{{- if .Values.persistence.volumes }} -{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }} -{{- end }} - {{- if .Values.controller.installPlugins }} - {{- if .Values.controller.overwritePluginsFromImage }} - - name: plugins - emptyDir: {} - {{- end }} - {{- end }} - {{- if and .Values.controller.initScripts .Values.controller.initConfigMap }} - - name: init-scripts - projected: - sources: - - configMap: - name: {{ template "jenkins.fullname" . }}-init-scripts - - configMap: - name: {{ .Values.controller.initConfigMap }} - {{- else if .Values.controller.initConfigMap }} - - name: init-scripts - configMap: - name: {{ .Values.controller.initConfigMap }} - {{- else if .Values.controller.initScripts }} - - name: init-scripts - configMap: - name: {{ template "jenkins.fullname" . }}-init-scripts - {{- end }} - - name: jenkins-config - configMap: - name: {{ template "jenkins.fullname" . }} - {{- if .Values.controller.installPlugins }} - - name: plugin-dir - emptyDir: {} - {{- end }} - {{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.adminSecret }} - - name: jenkins-secrets - projected: - sources: - {{- if .Values.controller.additionalSecrets }} - - secret: - name: {{ template "jenkins.fullname" . }}-additional-secrets - {{- end }} - {{- if .Values.controller.additionalExistingSecrets }} - {{- range $key, $value := .Values.controller.additionalExistingSecrets }} - - secret: - name: {{ tpl $value.name $ }} - items: - - key: {{ tpl $value.keyName $ }} - path: {{ tpl $value.name $ }}-{{ tpl $value.keyName $ }} - {{- end }} - {{- end }} - {{- if .Values.controller.adminSecret }} - - secret: - name: {{ .Values.controller.admin.existingSecret | default (include "jenkins.fullname" .) }} - items: - - key: {{ .Values.controller.admin.userKey | default "jenkins-admin-user" }} - path: chart-admin-username - - key: {{ .Values.controller.admin.passwordKey | default "jenkins-admin-password" }} - path: chart-admin-password - {{- end }} - {{- if .Values.controller.existingSecret }} - - secret: - name: {{ .Values.controller.existingSecret }} - {{- end }} - {{- end }} - - name: jenkins-cache - emptyDir: {} - {{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }} - - name: jenkins-home - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "jenkins.fullname" .) }}-tmp - {{- else }} - emptyDir: {} - {{- end -}} - {{- end }} - - name: sc-config-volume - emptyDir: {} - - name: tmp-volume - emptyDir: {} - - {{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }} - - name: jenkins-https-keystore - secret: - secretName: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }} - items: - - key: {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey }} - path: {{ .Values.controller.httpsKeyStore.fileName }} - {{- end }} - -{{- if .Values.controller.imagePullSecretName }} - imagePullSecrets: - - name: {{ .Values.controller.imagePullSecretName }} -{{- end -}} diff --git a/helm-templates/jenkins/templates/jenkins-controller-svc.yaml b/helm-templates/jenkins/templates/jenkins-controller-svc.yaml deleted file mode 100644 index 236e12b..0000000 --- a/helm-templates/jenkins/templates/jenkins-controller-svc.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - {{- if .Values.controller.serviceLabels }} -{{ toYaml .Values.controller.serviceLabels | indent 4 }} - {{- end }} - {{- with .Values.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -{{- if .Values.controller.serviceAnnotations }} - annotations: -{{ toYaml .Values.controller.serviceAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.controller.serviceExternalTrafficPolicy }} - externalTrafficPolicy: {{.Values.controller.serviceExternalTrafficPolicy}} - {{- end }} - {{- if (and (eq .Values.controller.serviceType "ClusterIP") (not (empty .Values.controller.clusterIP))) }} - clusterIP: {{.Values.controller.clusterIP}} - {{- end }} - ports: - - port: {{.Values.controller.servicePort}} - name: http - targetPort: {{ .Values.controller.targetPort }} - {{- if (and (eq .Values.controller.serviceType "NodePort") (not (empty .Values.controller.nodePort))) }} - nodePort: {{.Values.controller.nodePort}} - {{- end }} -{{- range $index, $port := .Values.controller.extraPorts }} - - port: {{ $port.port }} - name: {{ $port.name }} - {{- if $port.targetPort }} - targetPort: {{ $port.targetPort }} - {{- else }} - targetPort: {{ $port.port }} - {{- end -}} -{{- end }} - selector: - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - type: {{.Values.controller.serviceType}} - {{if eq .Values.controller.serviceType "LoadBalancer"}} -{{- if .Values.controller.loadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml .Values.controller.loadBalancerSourceRanges | indent 4 }} -{{- end }} - {{if .Values.controller.loadBalancerIP}} - loadBalancerIP: {{.Values.controller.loadBalancerIP}} - {{end}} - {{end}} diff --git a/helm-templates/jenkins/templates/rbac.yaml b/helm-templates/jenkins/templates/rbac.yaml deleted file mode 100644 index 581cb8d..0000000 --- a/helm-templates/jenkins/templates/rbac.yaml +++ /dev/null @@ -1,149 +0,0 @@ -{{ if .Values.rbac.create }} -{{- $serviceName := include "jenkins.fullname" . -}} - -# This role is used to allow Jenkins scheduling of agents via Kubernetes plugin. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $serviceName }}-schedule-agents - namespace: {{ template "jenkins.agent.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["pods", "pods/exec", "persistentvolumeclaims"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] - ---- - -# We bind the role to the Jenkins service account. The role binding is created in the namespace -# where the agents are supposed to run. -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-schedule-agents - namespace: {{ template "jenkins.agent.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $serviceName }}-schedule-agents -subjects: -- kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" .}} - namespace: {{ template "jenkins.namespace" . }} - ---- - -{{- if .Values.rbac.readSecrets }} -# This is needed if you want to use https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/ -# as it needs permissions to get/watch/list Secrets -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-read-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "watch", "list"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-read-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-read-secrets -subjects: - - kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} - ---- -{{- end}} - -{{- if .Values.controller.sidecars.configAutoReload.enabled }} -# The sidecar container which is responsible for reloading configuration changes -# needs permissions to watch ConfigMaps -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "jenkins.fullname" . }}-casc-reload - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "watch", "list"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $serviceName }}-watch-configmaps - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "jenkins.fullname" . }}-casc-reload -subjects: -- kind: ServiceAccount - name: {{ template "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} - -{{- end}} - -{{ end }} diff --git a/helm-templates/jenkins/templates/secret-additional.yaml b/helm-templates/jenkins/templates/secret-additional.yaml deleted file mode 100644 index d1908aa..0000000 --- a/helm-templates/jenkins/templates/secret-additional.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.controller.additionalSecrets -}} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }}-additional-secrets - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: -{{- range .Values.controller.additionalSecrets }} - {{ .name }}: {{ .value | b64enc }} -{{- end }} -{{- end }} diff --git a/helm-templates/jenkins/templates/secret-claims.yaml b/helm-templates/jenkins/templates/secret-claims.yaml deleted file mode 100644 index e8b6d6c..0000000 --- a/helm-templates/jenkins/templates/secret-claims.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if .Values.controller.secretClaims -}} -{{- $r := .Release -}} -{{- $v := .Values -}} -{{- $chart := printf "%s-%s" .Chart.Name .Chart.Version -}} -{{- $namespace := include "jenkins.namespace" . -}} -{{- $serviceName := include "jenkins.fullname" . -}} -{{ range .Values.controller.secretClaims }} ---- -kind: SecretClaim -apiVersion: vaultproject.io/v1 -metadata: - name: {{ $serviceName }}-{{ .name | default .path | lower }} - namespace: {{ $namespace }} - labels: - "app.kubernetes.io/name": '{{ $serviceName }}' - {{- if $v.renderHelmLabels }} - "helm.sh/chart": "{{ $chart }}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ $r.Service }}" - "app.kubernetes.io/instance": "{{ $r.Name }}" - "app.kubernetes.io/component": "{{ $v.controller.componentName }}" -spec: - type: {{ .type | default "Opaque" }} - path: {{ .path }} -{{- if .renew }} - renew: {{ .renew }} -{{- end }} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/helm-templates/jenkins/templates/secret-https-jks.yaml b/helm-templates/jenkins/templates/secret-https-jks.yaml deleted file mode 100644 index 5348de4..0000000 --- a/helm-templates/jenkins/templates/secret-https-jks.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.controller.httpsKeyStore.enable ( not .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName ) (not .Values.controller.httpsKeyStore.disableSecretMount) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }}-https-jks - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: - jenkins-jks-file: | -{{ .Values.controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded | indent 4 }} - https-jks-password: {{ .Values.controller.httpsKeyStore.password | b64enc }} -{{- end }} diff --git a/helm-templates/jenkins/templates/secret.yaml b/helm-templates/jenkins/templates/secret.yaml deleted file mode 100644 index 4feb52f..0000000 --- a/helm-templates/jenkins/templates/secret.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and (not .Values.controller.admin.existingSecret) (.Values.controller.adminSecret) -}} - -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "jenkins.fullname" . }} - namespace: {{ template "jenkins.namespace" . }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -type: Opaque -data: - jenkins-admin-password: {{ template "jenkins.password" . }} - jenkins-admin-user: {{ .Values.controller.adminUser | b64enc | quote }} -{{- end }} diff --git a/helm-templates/jenkins/templates/service-account-agent.yaml b/helm-templates/jenkins/templates/service-account-agent.yaml deleted file mode 100644 index 48f08ba..0000000 --- a/helm-templates/jenkins/templates/service-account-agent.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{ if .Values.serviceAccountAgent.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "jenkins.serviceAccountAgentName" . }} - namespace: {{ template "jenkins.agent.namespace" . }} -{{- if .Values.serviceAccountAgent.annotations }} - annotations: -{{ tpl (toYaml .Values.serviceAccountAgent.annotations) . | indent 4 }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.serviceAccountAgent.extraLabels }} -{{ tpl (toYaml .Values.serviceAccountAgent.extraLabels) . | indent 4 }} -{{- end }} -{{- if .Values.serviceAccountAgent.imagePullSecretName }} -imagePullSecrets: - - name: {{ .Values.serviceAccountAgent.imagePullSecretName }} -{{- end -}} -{{ end }} diff --git a/helm-templates/jenkins/templates/service-account.yaml b/helm-templates/jenkins/templates/service-account.yaml deleted file mode 100644 index b44eb48..0000000 --- a/helm-templates/jenkins/templates/service-account.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{ if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "jenkins.serviceAccountName" . }} - namespace: {{ template "jenkins.namespace" . }} -{{- if .Values.serviceAccount.annotations }} - annotations: -{{ tpl (toYaml .Values.serviceAccount.annotations) . | indent 4 }} -{{- end }} - labels: - "app.kubernetes.io/name": '{{ template "jenkins.name" .}}' - {{- if .Values.renderHelmLabels }} - "helm.sh/chart": "{{ template "jenkins.label" .}}" - {{- end }} - "app.kubernetes.io/managed-by": "{{ .Release.Service }}" - "app.kubernetes.io/instance": "{{ .Release.Name }}" - "app.kubernetes.io/component": "{{ .Values.controller.componentName }}" -{{- if .Values.serviceAccount.extraLabels }} -{{ tpl (toYaml .Values.serviceAccount.extraLabels) . | indent 4 }} -{{- end }} -{{- if .Values.serviceAccount.imagePullSecretName }} -imagePullSecrets: - - name: {{ .Values.serviceAccount.imagePullSecretName }} -{{- end -}} -{{ end }} diff --git a/helm-templates/jenkins/templates/tests/jenkins-test.yaml b/helm-templates/jenkins/templates/tests/jenkins-test.yaml deleted file mode 100644 index 20e06b5..0000000 --- a/helm-templates/jenkins/templates/tests/jenkins-test.yaml +++ /dev/null @@ -1,49 +0,0 @@ -{{- if .Values.controller.testEnabled }} -apiVersion: v1 -kind: Pod -metadata: - name: "{{ .Release.Name }}-ui-test-{{ randAlphaNum 5 | lower }}" - namespace: {{ template "jenkins.namespace" . }} - annotations: - "helm.sh/hook": test-success -spec: - {{- if .Values.controller.nodeSelector }} - nodeSelector: -{{ toYaml .Values.controller.nodeSelector | indent 4 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: -{{ toYaml .Values.controller.tolerations | indent 4 }} - {{- end }} - initContainers: - - name: "test-framework" - image: {{ .Values.helmtest.bats.image }}:{{ .Values.helmtest.bats.tag }} - command: - - "bash" - - "-c" - args: - - | - # copy bats to tools dir - set -ex - cp -R /opt/bats /tools/bats/ - volumeMounts: - - mountPath: /tools - name: tools - containers: - - name: {{ .Release.Name }}-ui-test - image: "{{ .Values.controller.image }}:{{- include "controller.tag" . -}}" - command: ["/tools/bats/bin/bats", "-t", "/tests/run.sh"] - volumeMounts: - - mountPath: /tests - name: tests - readOnly: true - - mountPath: /tools - name: tools - volumes: - - name: tests - configMap: - name: {{ template "jenkins.fullname" . }}-tests - - name: tools - emptyDir: {} - restartPolicy: Never -{{- end }} diff --git a/helm-templates/jenkins/templates/tests/test-config.yaml b/helm-templates/jenkins/templates/tests/test-config.yaml deleted file mode 100644 index 12c5b3a..0000000 --- a/helm-templates/jenkins/templates/tests/test-config.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.controller.testEnabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "jenkins.fullname" . }}-tests - namespace: {{ template "jenkins.namespace" . }} - annotations: - "helm.sh/hook": test -data: - run.sh: |- - @test "Testing Jenkins UI is accessible" { - curl --retry 48 --retry-delay 10 {{ template "jenkins.fullname" . }}:{{ .Values.controller.servicePort }}{{ default "" .Values.controller.jenkinsUriPrefix }}/login - } -{{- end }} diff --git a/helm-templates/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap b/helm-templates/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap deleted file mode 100644 index f1479a8..0000000 --- a/helm-templates/jenkins/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap +++ /dev/null @@ -1,5 +0,0 @@ -render pod annotations: - 1: | - checksum/config: ce69b63eb27efd6e89b22eeaf52dbe7fe3a319b4178f4de5a66077e50ccf50df - fixed-annotation: some-fixed-annotation - templated-annotations: my-release diff --git a/helm-templates/jenkins/unittests/config-init-scripts-test.yaml b/helm-templates/jenkins/unittests/config-init-scripts-test.yaml deleted file mode 100644 index b524460..0000000 --- a/helm-templates/jenkins/unittests/config-init-scripts-test.yaml +++ /dev/null @@ -1,19 +0,0 @@ -suite: ConfigMap -templates: - - config-init-scripts.yaml -tests: - - it: config templates - set: - some.val: val here - controller.initScripts: - test: |- - my script here {{ .Values.some.val }} - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - equal: - path: data.inittest\.groovy - value: |- - my script here val here diff --git a/helm-templates/jenkins/unittests/config-test.yaml b/helm-templates/jenkins/unittests/config-test.yaml deleted file mode 100644 index 36b8ce6..0000000 --- a/helm-templates/jenkins/unittests/config-test.yaml +++ /dev/null @@ -1,128 +0,0 @@ -suite: ConfigMap -templates: - - config.yaml -tests: - - it: default config - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - equal: - path: data.apply_config\.sh - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" - - equal: - path: data.plugins\.txt - value: |- - kubernetes:4029.v5712230ccb_f8 - workflow-aggregator:596.v8c21c963d92d - git:5.1.0 - configuration-as-code:1670.v564dc8b_982d0 - - it: no plugins - set: - controller.installPlugins: [] - asserts: - - equal: - path: data.apply_config\.sh - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "finished initialization" - - equal: - path: data.plugins\.txt - value: "" - - it: additional plugins config - set: - controller: - additionalPlugins: - - kubernetes-credentials-provider - asserts: - - equal: - path: data.plugins\.txt - value: |- - kubernetes:4029.v5712230ccb_f8 - workflow-aggregator:596.v8c21c963d92d - git:5.1.0 - configuration-as-code:1670.v564dc8b_982d0 - kubernetes-credentials-provider - - it: install latest plugins - set: - controller.installLatestPlugins: false - asserts: - - equal: - path: data.apply_config\.sh - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest false; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" - - it: install latest specified plugins - set: - controller.installLatestSpecifiedPlugins: true - asserts: - - equal: - path: data.apply_config\.sh - value: |- - set -e - echo "disable Setup Wizard" - # Prevent Setup Wizard when JCasC is enabled - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state - echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion - echo "download plugins" - # Install missing plugins - cp /var/jenkins_config/plugins.txt /var/jenkins_home; - rm -rf /usr/share/jenkins/ref/plugins/*.lock - version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; } - if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then - jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true --latest-specified; - else - /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; - fi - echo "copy plugins to shared volume" - # Copy plugins to shared volume - yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/; - echo "finished initialization" diff --git a/helm-templates/jenkins/unittests/home-pvc-test.yaml b/helm-templates/jenkins/unittests/home-pvc-test.yaml deleted file mode 100644 index 1445524..0000000 --- a/helm-templates/jenkins/unittests/home-pvc-test.yaml +++ /dev/null @@ -1,111 +0,0 @@ -suite: PersistentVolumeClaim -release: - name: my-release - namespace: my-namespace -templates: - - home-pvc.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: PersistentVolumeClaim - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - contains: - path: spec.accessModes - content: ReadWriteOnce - - equal: - path: spec.resources.requests - value: - storage: 8Gi - - isNull: - path: spec.dataSource - - isNull: - path: spec.storageClassName - - - it: test different values - set: - persistence: - annotations: - my-annotation: value - accessMode: ReadWriteMany - size: 20Gi - storageClass: gp2 - asserts: - - equal: - path: metadata.annotations - value: - my-annotation: value - - contains: - path: spec.accessModes - content: ReadWriteMany - - equal: - path: spec.resources.requests - value: - storage: 20Gi - - equal: - path: spec.storageClassName - value: gp2 - - - it: existing claim - set: - persistence: - existingClaim: my-pvc - asserts: - - hasDocuments: - count: 0 - - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: add label - set: - renderHelmLabels: false - persistence: - labels: - test-label: test-value - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - test-label: test-value - - - it: clone from dataSource - set: - persistence: - dataSource: - name: PVC-NAME - kind: PersistentVolumeClaim - asserts: - - equal: - path: spec.dataSource.name - value: PVC-NAME - - equal: - path: spec.dataSource.kind - value: PersistentVolumeClaim - diff --git a/helm-templates/jenkins/unittests/jcasc-config-test.yaml b/helm-templates/jenkins/unittests/jcasc-config-test.yaml deleted file mode 100644 index 893202f..0000000 --- a/helm-templates/jenkins/unittests/jcasc-config-test.yaml +++ /dev/null @@ -1,3039 +0,0 @@ -suite: Configuration as Code -templates: - - jcasc-config.yaml -tests: - - it: default config - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: agent namespace and templates - release: - namespace: controller-namespace - set: - additionalAgents: - maven: - namespace: maven - podName: maven - customJenkinsLabels: maven - image: jenkins/jnlp-agent-maven - tag: latest - python: - podName: python - customJenkinsLabels: python - sideContainerName: python - image: python - tag: "3" - command: /bin/sh -c - args: "cat" - TTYEnabled: true - agent: - namespace: jenkins-agents - podTemplates: - python3: | - - name: python3 - label: jenkins-python3 - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceRequestEphemeralStorage: "1Gi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - resourceLimitEphemeralStorage: "2Gi" - - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "jenkins-agents" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "jenkins-agents" - id: 186b2bbf658c751353ddfc48c46e44942c2886ad195e13f74ab45b3e9495ca9d - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "maven" - namespace: "maven" - id: 519c05520c082e7b03f4b618fc9e8b5596b85ed6db1fb608a3b7f8985a130b84 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "jenkins/jnlp-agent-maven:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent maven" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "python" - namespace: "jenkins-agents" - id: 91cce14f8699291c0af8cf24e8761f2421aee625985fce2f874de0cb959c3294 - containers: - - name: "python" - alwaysPullImage: false - args: "cat" - command: /bin/sh -c - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080/" - image: "python:3" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: true - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent python" - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: python3 - label: jenkins-python3 - serviceAccount: jenkins - containers: - - name: python - image: python:3 - command: "/bin/sh -c" - args: "cat" - ttyEnabled: true - privileged: true - resourceRequestCpu: "400m" - resourceRequestMemory: "512Mi" - resourceRequestEphemeralStorage: "1Gi" - resourceLimitCpu: "1" - resourceLimitMemory: "1024Mi" - resourceLimitEphemeralStorage: "2Gi" - - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: customized config - set: - controller: - disableRememberMe: true - executorMode: EXCLUSIVE - numExecutors: 1 - enableRawHtmlMarkupFormatter: true - JCasC: - authorizationStrategy: |- - globalMatrix: - permissions: - - "Overall/Read:anonymous" - configScripts: - welcome-message: | - jenkins: - systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - securityRealm: local - jenkinsAdminEmail: admin@example.org - ingress: - hostName: jenkins.example.com - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - agent: - namespace: default - containerCap: 22 - jnlpregistry: private.registry.com - defaultsProviderTemplate: my-defaults - kubernetesConnectTimeout: 11 - kubernetesReadTimeout: 12 - podName: my-agent - sideContainerName: sideContainer - alwaysPullImage: true - command: /bin/command - image: my-image/jnlp - tag: v1.2.3 - privileged: true - resources: - limits: - cpu: 1024m - memory: 1Gi - ephemeralStorage: 1Gi - requests: - cpu: 756m - memory: 768Mi - ephemeralStorage: 512Mi - runAsUser: 2000 - runAsGroup: 2000 - TTYEnabled: true - workingDir: /workdir - envVars: - - name: VAR - value: value - idleMinutes: 30 - imagePullSecretName: pullSecret - nodeSelector: - jenkins-agent: v1 - selector: abc - podRetention: onFailure - connectTimeout: 111 - volumes: - - type: ConfigMap - configMapName: myconfigmap - mountPath: /var/myapp/myconfigmap - - type: EmptyDir - mountPath: /var/myapp/myemptydir - memory: false - - type: HostPath - hostPath: /var/lib/containers - mountPath: /var/myapp/myhostpath - - type: Nfs - mountPath: /var/myapp/mynfs - readOnly: false - serverAddress: "192.0.2.0" - serverPath: /var/lib/containers - - type: PVC - claimName: mypvc - mountPath: /var/myapp/mypvc - readOnly: false - - type: Secret - defaultMode: "600" - mountPath: /var/myapp/mysecret - secretName: mysecret - annotations: - ci.jenkins-agent/test: "custom" - yamlTemplate: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "key" - operator: "Equal" - value: "value" - yamlMergeStrategy: merge - serviceAccountAgent: - name: agent-serviceaccount - release: - name: my-release - namespace: other - asserts: - - hasDocuments: - count: 2 - - documentIndex: 0 - isKind: - of: ConfigMap - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - documentIndex: 0 - equal: - path: metadata.name - value: my-release-jenkins-jenkins-config-welcome-message - - documentIndex: 0 - equal: - path: metadata.namespace - value: other - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - documentIndex: 1 - isKind: - of: ConfigMap - - documentIndex: 1 - equal: - path: metadata.name - value: my-release-jenkins-jenkins-jcasc-config - - documentIndex: 1 - equal: - path: metadata.namespace - value: other - - documentIndex: 0 - equal: - path: metadata.labels.my-release-jenkins-jenkins-config - value: "true" - - documentIndex: 1 - equal: - path: metadata.labels.my-release-jenkins-jenkins-config - value: "true" - - documentIndex: 0 - equal: - path: data - value: - welcome-message.yaml: |- - jenkins: - systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - - documentIndex: 1 - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - globalMatrix: - permissions: - - "Overall/Read:anonymous" - securityRealm: - local - disableRememberMe: true - mode: EXCLUSIVE - numExecutors: 1 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - rawHtml: - disableSyntaxHighlighting: true - clouds: - - kubernetes: - containerCapStr: "22" - jnlpregistry: "private.registry.com" - defaultsProviderTemplate: "my-defaults" - connectTimeout: "11" - readTimeout: "12" - jenkinsUrl: "http://my-release-jenkins.other.svc.cluster.local:8080" - jenkinsTunnel: "my-release-jenkins-agent.other.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/my-release-jenkins-agent" - value: "true" - templates: - - name: "my-agent" - namespace: "default" - annotations: - - key: ci.jenkins-agent/test - value: "custom" - id: 6de9914dfb9678a4f580464e046eea7dabd8ade25357bdbe43447cf3be2264ae - containers: - - name: "sideContainer" - alwaysPullImage: true - args: "^${computer.jnlpmac} ^${computer.name}" - command: /bin/command - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://my-release-jenkins.other.svc.cluster.local:8080/" - image: "my-image/jnlp:v1.2.3" - privileged: "true" - resourceLimitCpu: 1024m - resourceLimitMemory: 1Gi - resourceLimitEphemeralStorage: 1Gi - resourceRequestCpu: 756m - resourceRequestMemory: 768Mi - resourceRequestEphemeralStorage: 512Mi - runAsUser: 2000 - runAsGroup: 2000 - ttyEnabled: true - workingDir: /workdir - envVars: - - envVar: - key: VAR - value: value - idleMinutes: 30 - instanceCap: 2147483647 - imagePullSecrets: - - name: pullSecret - label: "my-release-jenkins-agent " - nodeSelector: jenkins-agent=v1,selector=abc - nodeUsageMode: "NORMAL" - podRetention: onFailure - showRawYaml: true - serviceAccount: "agent-serviceaccount" - slaveConnectTimeoutStr: "111" - volumes: - - configMapVolume: - configMapName: "myconfigmap" - mountPath: "/var/myapp/myconfigmap" - - emptyDirVolume: - memory: false - mountPath: "/var/myapp/myemptydir" - - hostPathVolume: - hostPath: "/var/lib/containers" - mountPath: "/var/myapp/myhostpath" - - nfsVolume: - mountPath: "/var/myapp/mynfs" - readOnly: false - serverAddress: "192.0.2.0" - serverPath: "/var/lib/containers" - - persistentVolumeClaim: - claimName: "mypvc" - mountPath: "/var/myapp/mypvc" - readOnly: false - - secretVolume: - defaultMode: "600" - mountPath: "/var/myapp/mysecret" - secretName: "mysecret" - yaml: |- - apiVersion: v1 - kind: Pod - spec: - tolerations: - - key: "key" - operator: "Equal" - value: "value" - yamlMergeStrategy: merge - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: admin@example.org - url: https://jenkins.example.com - - it: custom dynamic pvc workspace volume - set: - agent: - workspaceVolume: - type: "DynamicPVC" - accessModes: "ReadWriteOnce" - requestsSize: "2Gi" - storageClassName: "gp2" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 45b7fe5158a172b4005f91db5e6287b9aed3e93e12a2769b9af29e7643d14f99 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - dynamicPVC: - accessModes: "ReadWriteOnce" - requestsSize: "2Gi" - storageClassName: "gp2" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: custom emptyDir workspace volume - set: - agent: - workspaceVolume: - type: "EmptyDir" - memory: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: d473935e87fe5cbb42fab54f56a563c01ee15dbeb9e48e8d47105165b6c302e0 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - emptyDirWorkspaceVolume: - memory: true - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: custom hostPath workspace volume - set: - agent: - workspaceVolume: - type: "HostPath" - hostPath: "/data" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 0983fad483bcd94cbd12ceac92ba7572c79dffdb313ac23013a2c189728a27d3 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - hostPathWorkspaceVolume: - hostPath: "/data" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: custom nfs workspace volume - set: - agent: - workspaceVolume: - type: "Nfs" - readOnly: false - serverAddress: "1.1.1.1" - serverPath: "/data" - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 7794e8b1ffc547ef8131701584dd03bd2a56bc00f08974a43ec7e6d160f8c955 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - nfsWorkspaceVolume: - readOnly: false - serverAddress: "1.1.1.1" - serverPath: "/data" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: custom pvc workspace volume - set: - agent: - workspaceVolume: - type: "PVC" - claimName: "my-claim" - readOnly: false - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 0c4cbe2dd2ae59fdf47908143a6dd42fff6412c9b17c33dc4f968e173dc03a23 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: custom other workspace volume - set: - agent: - workspaceVolume: - type: "persistentVolumeClaimWorkspaceVolume" - claimName: "my-claim" - readOnly: false - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 32a9f67e339344ada0dbb53022c31c597f9de68884bbbbf5ea4dd96ff75b9684 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - workspaceVolume: - persistentVolumeClaimWorkspaceVolume: - claimName: "my-claim" - readOnly: false - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - RELEASE-NAME-jenkins-jenkins-config: "true" - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agents - release: - namespace: controller-namespace - set: - agent.enabled: false - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.controller-namespace.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.controller-namespace.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "controller-namespace" - serverUrl: "https://kubernetes.default" - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: disable default config - set: - controller.JCasC.defaultConfig: false - asserts: - - hasDocuments: - count: 0 - - it: custom jenkins label - set: - controller: - customJenkinsLabels: ["testlabel"] - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "testlabel" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: adds custom labels on agent pods - set: - agent: - podLabels: - label-one: value-one - label-two: true - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.NAMESPACE.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "NAMESPACE" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - - key: "label-one" - value: "value-one" - - key: "label-two" - value: "true" - templates: - - name: "default" - namespace: "NAMESPACE" - id: 70792017be7696b4857b112ea4481cbfe657e919f30192463b23985f244943d3 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.NAMESPACE.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: legacyRemotingSecurityEnabled = false - release: - namespace: default - set: - controller: - legacyRemotingSecurityEnabled: false - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: legacyRemotingSecurityEnabled = true - release: - namespace: default - set: - controller: - legacyRemotingSecurityEnabled: true - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - remotingSecurity: - enabled: true - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: empty projectNamingStrategy - release: - namespace: default - set: - controller: - projectNamingStrategy: - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: non-string projectNamingStrategy - release: - namespace: default - set: - controller: - projectNamingStrategy: - myConfiguration: - mySetting1: true - mySetting2: something - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: - myConfiguration: - mySetting1: true - mySetting2: something - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify security settings without apiToken override - release: - namespace: default - set: - controller: - JCasC: - security: - gitHostKeyVerificationConfiguration: - sshHostKeyVerificationStrategy: "acceptFirstConnectionStrategy" - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - gitHostKeyVerificationConfiguration: - sshHostKeyVerificationStrategy: acceptFirstConnectionStrategy - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify security settings without apiToken override - release: - namespace: default - set: - controller: - JCasC: - security: - apiToken: overridden - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e4c9c2dfb0f00a1c4759b687084b28e89b79bf351943087cc8afd93c45d8748f - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: overridden - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify additional container - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 3853681aec1b8ff8555381b409633586eb512d5af46277ab15c516fdf7ed8394 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify additional container and overwrite in additional agent - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - additionalAgents: - additional-agent: - podName: additional-agent - additionalContainers: - - sideContainerName: additional - image: my-additional-container-image - tag: latest - command: entrypoint.sh - args: arg1 arg2 - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 3853681aec1b8ff8555381b409633586eb512d5af46277ab15c516fdf7ed8394 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "additional-agent" - namespace: "default" - id: c6035fe36b1b6249706e5dd49bf52f5d2fec2ca087f59a93e1065c82d74df1c8 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "additional" - alwaysPullImage: false - args: "arg1 arg2" - command: entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "my-additional-container-image:latest" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: specify additional container and clear in additional agent - release: - namespace: default - set: - agent: - additionalContainers: - - sideContainerName: dind - image: docker - tag: dind - command: dockerd-entrypoint.sh - args: "" - privileged: true - additionalAgents: - additional-agent: - podName: additional-agent - additionalContainers: [] - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 3853681aec1b8ff8555381b409633586eb512d5af46277ab15c516fdf7ed8394 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "dind" - alwaysPullImage: false - args: "" - command: dockerd-entrypoint.sh - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "docker:dind" - privileged: "true" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - - name: "additional-agent" - namespace: "default" - id: 4b8b997f7cba014243d6d632aed5160b06d6b9f1033d2a23c79b6695e7afe8c3 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: configure hostnetworking to agent - release: - namespace: default - set: - agent: - hostNetworking: true - asserts: - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 2048237b34082ff159b26dd060105c7ba457324a2bfb969d66fbf1efe3e2bf30 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - hostNetwork: true - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: set secretEnvVars - set: - agent: - secretEnvVars: - - key: UNITTEST_PATH - secretKey: UNITTEST_K8S_PATH - secretName: k8s-unittest-secret-name - envVars: - - name: UNITTEST_ENV - value: testvalue - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 8af276287b26db243b896d1348a8e9d6be19c3b9437bdf805756cdb18bda1750 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - envVars: - - envVar: - key: UNITTEST_ENV - value: testvalue - - secretEnvVar: - key: UNITTEST_PATH - secretName: k8s-unittest-secret-name - secretKey: UNITTEST_K8S_PATH - optional: false - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: set directConnection - set: - agent: - directConnection: true - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - directConnection: true - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e1767e1268c2735cd367b6c774eb45051cf77e0fd2ad4e32814c0cc6e8592608 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_DIRECT_CONNECTION" - value: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: agents with liveness probe - set: - agent: - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: e3208947ed99664372dabfc85ef04c19f37dc5a898dd51d268bfd194ed7ad37d - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 - - it: agents with liveness probe - set: - agent: - additionalContainers: - - sideContainerName: side-container - image: IMAGE - tag: TAG - args: "" - command: "" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - release: - namespace: default - asserts: - - isKind: - of: ConfigMap - - hasDocuments: - count: 1 - - isNotEmpty: - path: data.jcasc-default-config\.yaml - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: data.jcasc-default-config\.yaml - value: |- - jenkins: - authorizationStrategy: - loggedInUsersCanDoAnything: - allowAnonymousRead: false - securityRealm: - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - disableRememberMe: false - mode: NORMAL - numExecutors: 0 - labelString: "" - projectNamingStrategy: "standard" - markupFormatter: - plainText - clouds: - - kubernetes: - containerCapStr: "10" - defaultsProviderTemplate: "" - connectTimeout: "5" - readTimeout: "15" - jenkinsUrl: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080" - jenkinsTunnel: "RELEASE-NAME-jenkins-agent.default.svc.cluster.local:50000" - maxRequestsPerHostStr: "32" - retentionTimeout: "5" - waitForPodSec: "600" - name: "kubernetes" - namespace: "default" - serverUrl: "https://kubernetes.default" - podLabels: - - key: "jenkins/RELEASE-NAME-jenkins-agent" - value: "true" - templates: - - name: "default" - namespace: "default" - id: 4e58f703c4b642cf0757775a101aee69cc7d65dc1374749a78bb181e9dcffe63 - containers: - - name: "jnlp" - alwaysPullImage: false - args: "^${computer.jnlpmac} ^${computer.name}" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "jenkins/inbound-agent:3107.v665000b_51092-15" - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - - name: "side-container" - alwaysPullImage: false - args: "" - command: - envVars: - - envVar: - key: "JENKINS_URL" - value: "http://RELEASE-NAME-jenkins.default.svc.cluster.local:8080/" - image: "IMAGE:TAG" - livenessProbe: - execArgs: "cat /tmp/healthy" - failureThreshold: 3 - initialDelaySeconds: 0 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - privileged: "false" - resourceLimitCpu: 512m - resourceLimitMemory: 512Mi - resourceRequestCpu: 512m - resourceRequestMemory: 512Mi - runAsUser: - runAsGroup: - ttyEnabled: false - workingDir: /home/jenkins/agent - idleMinutes: 0 - instanceCap: 2147483647 - label: "RELEASE-NAME-jenkins-agent " - nodeUsageMode: "NORMAL" - podRetention: Never - showRawYaml: true - serviceAccount: "default" - slaveConnectTimeoutStr: "100" - yamlMergeStrategy: override - crumbIssuer: - standard: - excludeClientIPFromCrumb: true - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - unclassified: - location: - adminAddress: - url: http://RELEASE-NAME-jenkins:8080 diff --git a/helm-templates/jenkins/unittests/jenkins-agent-svc-test.yaml b/helm-templates/jenkins/unittests/jenkins-agent-svc-test.yaml deleted file mode 100644 index ec1048a..0000000 --- a/helm-templates/jenkins/unittests/jenkins-agent-svc-test.yaml +++ /dev/null @@ -1,130 +0,0 @@ -suite: Jenkins Agent Service -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-agent-svc.yaml -tests: - - it: default tests - asserts: - - isKind: - of: Service - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: other values - set: - controller: - agentListenerServiceAnnotations: - key: value - agentListenerPort: 55555 - asserts: - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 55555 - targetPort: 55555 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: node port random - set: - controller: - agentListenerServiceType: NodePort - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: node port defined - set: - controller: - agentListenerServiceType: NodePort - agentListenerNodePort: 32123 - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - nodePort: 32123 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: load balancer - set: - controller: - agentListenerServiceType: LoadBalancer - agentListenerLoadBalancerIP: 10.10.10.10 - asserts: - - equal: - path: spec - value: - ports: - - name: agent-listener - port: 50000 - targetPort: 50000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: LoadBalancer - loadBalancerIP: 10.10.10.10 - loadBalancerSourceRanges: - - 0.0.0.0/0 - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agent service - set: - controller: - agentListenerEnabled: false - asserts: - - hasDocuments: - count: 0 \ No newline at end of file diff --git a/helm-templates/jenkins/unittests/jenkins-backup-cronjob-test.yaml b/helm-templates/jenkins/unittests/jenkins-backup-cronjob-test.yaml deleted file mode 100644 index e1dd18f..0000000 --- a/helm-templates/jenkins/unittests/jenkins-backup-cronjob-test.yaml +++ /dev/null @@ -1,62 +0,0 @@ -suite: Jenkins Backup Cronjob -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-backup-cronjob.yaml -tests: - - it: test default values - set: - backup: - enabled: true - asserts: - - isKind: - of: CronJob - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: - fsGroup: 1000 - runAsUser: 1000 - - it: test empty backup.podSecurityContextOverride - set: - backup: - enabled: true - podSecurityContextOverride: {} - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: {} - - it: test backup.podSecurityContextOverride - set: - backup: - enabled: true - podSecurityContextOverride: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: [5555] - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.securityContext - value: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: - - 5555 - - it: test empty backup.imagePullSecretName - set: - backup: - enabled: true - imagePullSecretName: - asserts: - - isNull: - path: spec.jobTemplate.spec.template.spec.imagePullSecrets - - it: test backup.imagePullSecretName - set: - backup: - enabled: true - imagePullSecretName: my-secret - asserts: - - equal: - path: spec.jobTemplate.spec.template.spec.imagePullSecrets - value: - - name: my-secret diff --git a/helm-templates/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml deleted file mode 100644 index bdeece8..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-alerting-rules-test.yaml +++ /dev/null @@ -1,79 +0,0 @@ -suite: Controller Prometheus PrometheusRule -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-alerting-rules.yaml -tests: - - it: defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.prometheus: - enabled: true - alertingrules: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - asserts: - - isKind: - of: PrometheusRule - - equal: - path: apiVersion - value: monitoring.coreos.com/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: spec - value: - groups: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.prometheus: - enabled: true - alertingrules: - - name: ./jenkins.rules - rules: - - alert: JenkinsFailedPlugins - expr: jenkins_plugins_failed > 0 - for: 10m - labels: - severity: warning - annotations: - message: Some Jenkins plugins failed to load - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins \ No newline at end of file diff --git a/helm-templates/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml deleted file mode 100644 index 0183331..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-ingress-1.19-test.yaml +++ /dev/null @@ -1,148 +0,0 @@ -suite: Controller Primary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 19 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: other values - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - annotations: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - paths: - - backend: - service: - name: ssl-redirect - port: - number: use-annotation - pathType: ImplementationSpecific - - backend: - service: - name: >- - {{ template "jenkins.fullname" . }} - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - equal: - path: metadata.annotations - value: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: ssl-redirect - port: - number: use-annotation - pathType: ImplementationSpecific - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: empty paths - set: - controller.ingress: - enabled: true - paths: - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - pathType: ImplementationSpecific diff --git a/helm-templates/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml deleted file mode 100644 index a57e667..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-ingress-DRY-test.yaml +++ /dev/null @@ -1,26 +0,0 @@ -suite: Controller Ingress - DRY Support -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml - - jcasc-config.yaml -tests: - - it: controller-ingress - template: jenkins-controller-ingress.yaml - set: - global.jenkinsHostname: "jenkins.example.com" - controller.ingress: - enabled: true - hostName: "{{ .Values.global.jenkinsHostname }}" - resourceRootUrl: "{{ .Values.global.jenkinsHostname }}" - tls: - - hosts: - - "{{ .Values.global.jenkinsHostname }}" - asserts: - - equal: - path: spec.rules[0].host - value: "jenkins.example.com" - - equal: - path: spec.tls[0].hosts[0] - value: "jenkins.example.com" diff --git a/helm-templates/jenkins/unittests/jenkins-controller-ingress-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-ingress-test.yaml deleted file mode 100644 index 6508d7e..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-ingress-test.yaml +++ /dev/null @@ -1,145 +0,0 @@ -suite: Controller Primary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: other values - set: - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - annotations: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - paths: - - backend: - serviceName: ssl-redirect - servicePort: use-annotation - - backend: - serviceName: >- - {{ template "jenkins.fullname" . }} - servicePort: 8080 - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - equal: - path: metadata.annotations - value: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: ssl-redirect - servicePort: use-annotation - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.ingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: empty paths - set: - controller.ingress: - enabled: true - paths: - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - - it: single path - set: - controller.ingress: - enabled: true - path: /jenkins/ - asserts: - - equal: - path: spec.rules - value: - - http: - paths: - - path: /jenkins/ - backend: - serviceName: my-release-jenkins - servicePort: 8080 diff --git a/helm-templates/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml deleted file mode 100644 index 09047ff..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-networkpolicy-test.yaml +++ /dev/null @@ -1,94 +0,0 @@ -suite: Network Policy -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-networkpolicy.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - networkPolicy.enabled: true - asserts: - - hasDocuments: - count: 2 - - isKind: - of: NetworkPolicy - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: metadata.name - value: my-release-jenkins-controller - documentIndex: 0 - - equal: - path: spec - value: - ingress: - - ports: - - port: 8080 - - from: - - podSelector: - matchLabels: - jenkins/my-release-jenkins-agent: "true" - ports: - - port: 50000 - podSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - documentIndex: 0 - - equal: - path: spec - value: - podSelector: - matchLabels: - jenkins/my-release-jenkins-agent: "true" - documentIndex: 1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - documentIndex: 1 - - it: disable helm.sh label - set: - renderHelmLabels: false - networkPolicy.enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable agent listener - set: - networkPolicy.enabled: true - controller.agentListenerEnabled: false - asserts: - - hasDocuments: - count: 2 - - isKind: - of: NetworkPolicy - - equal: - path: spec - value: - ingress: - - ports: - - port: 8080 - podSelector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - documentIndex: 0 diff --git a/helm-templates/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml deleted file mode 100644 index c9b6bb7..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-pdb-1.21-test.yaml +++ /dev/null @@ -1,44 +0,0 @@ -suite: Controller Pod Disruption Budget -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-pdb.yaml -capabilities: - majorVersion: 1 - minorVersion: 21 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.podDisruptionBudget: - enabled: true - maxUnavailable: "0" - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: apiVersion - value: policy/v1 - - equal: - path: metadata.name - value: my-release-jenkins-pdb - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - maxUnavailable: 0 - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/name": "jenkins" diff --git a/helm-templates/jenkins/unittests/jenkins-controller-pdb-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-pdb-test.yaml deleted file mode 100644 index 7a43bfc..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-pdb-test.yaml +++ /dev/null @@ -1,57 +0,0 @@ -suite: Controller Pod Disruption Budget -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-pdb.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.podDisruptionBudget: - enabled: true - maxUnavailable: "0" - asserts: - - isKind: - of: PodDisruptionBudget - - equal: - path: apiVersion - value: policy/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins-pdb - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - maxUnavailable: 0 - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/name": "jenkins" - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.podDisruptionBudget: - enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml deleted file mode 100644 index 8df3a34..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml +++ /dev/null @@ -1,78 +0,0 @@ -suite: Controller Secondary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-secondary-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 19 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-secondary - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - service: - name: my-release-jenkins - port: - number: 8080 - path: /github-webhook - pathType: ImplementationSpecific - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - paths: - - /github-webhook - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml deleted file mode 100644 index b5aed8c..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-secondary-ingress-test.yaml +++ /dev/null @@ -1,76 +0,0 @@ -suite: Controller Secondary Ingress -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-secondary-ingress.yaml -capabilities: - majorVersion: 1 - minorVersion: 18 -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - tls: - - secretName: tlsSecret - hosts: - - jenkins.example.com - asserts: - - isKind: - of: Ingress - - equal: - path: apiVersion - value: networking.k8s.io/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins-secondary - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ingressClassName: nginx - rules: - - host: jenkins.example.com - http: - paths: - - backend: - serviceName: my-release-jenkins - servicePort: 8080 - path: /github-webhook - tls: - - hosts: - - jenkins.example.com - secretName: tlsSecret - - it: disable helm.sh label - set: - renderHelmLabels: false - controller.secondaryingress: - enabled: true - hostName: jenkins.example.com - ingressClassName: nginx - paths: - - /github-webhook - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml deleted file mode 100644 index a847061..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-servicemonitor_test.yaml +++ /dev/null @@ -1,114 +0,0 @@ -suite: Controller Prometheus ServiceMonitor -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-servicemonitor.yaml -tests: - - it: defaults - asserts: - - hasDocuments: - count: 0 - - it: enabled - set: - controller.prometheus.enabled: true - asserts: - - isKind: - of: ServiceMonitor - - equal: - path: apiVersion - value: monitoring.coreos.com/v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: spec - value: - endpoints: - - interval: 60s - port: http - path: /prometheus - jobLabel: my-release-jenkins - namespaceSelector: - matchNames: - - "my-namespace" - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/component": "jenkins-controller" - - it: custom values - set: - controller: - jenkinsUriPrefix: /prefix - prometheus: - enabled: true - scrapeInterval: 120s - scrapeEndpoint: /monitoring - asserts: - - equal: - path: spec - value: - endpoints: - - interval: 120s - port: http - path: /prefix/monitoring - jobLabel: my-release-jenkins - namespaceSelector: - matchNames: - - "my-namespace" - selector: - matchLabels: - "app.kubernetes.io/instance": "my-release" - "app.kubernetes.io/component": "jenkins-controller" - - it: disable helm.sh label - set: - renderHelmLabels: false - controller: - prometheus: - enabled: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: set relabling - set: - controller: - prometheus: - enabled: true - relabelings: - - sourceLabels: [metric] - regex: "(.*)" - action: drop - asserts: - - equal: - path: spec.endpoints[0].relabelings - value: - - sourceLabels: [metric] - regex: "(.*)" - action: drop - - it: set metricRelabelings - set: - controller: - prometheus: - enabled: true - metricRelabelings: - - sourceLabels: [__name__] - regex: "kubernetes_cloud_(.*)_provision_request_total" - action: drop - asserts: - - equal: - path: spec.endpoints[0].metricRelabelings - value: - - sourceLabels: [__name__] - regex: "kubernetes_cloud_(.*)_provision_request_total" - action: drop diff --git a/helm-templates/jenkins/unittests/jenkins-controller-statefulset-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-statefulset-test.yaml deleted file mode 100644 index 61cd084..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-statefulset-test.yaml +++ /dev/null @@ -1,933 +0,0 @@ -suite: Jenkins Controller -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-statefulset.yaml - - config.yaml - - config-init-scripts.yaml -tests: - - it: default values - template: jenkins-controller-statefulset.yaml - asserts: - - isKind: - of: StatefulSet - - equal: - path: apiVersion - value: apps/v1beta1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec.replicas - value: 1 - - equal: - path: spec.selector - value: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - - equal: - path: spec - value: - serviceName: my-release-jenkins - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - template: - metadata: - annotations: - checksum/config: ce69b63eb27efd6e89b22eeaf52dbe7fe3a319b4178f4de5a66077e50ccf50df - labels: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - spec: - containers: - - args: - - --httpPort=8080 - env: - - name: SECRETS - value: /run/secrets/additional - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: JAVA_OPTS - value: "-Dcasc.reload.token=$(POD_NAME) " - - name: JENKINS_OPTS - value: "--webroot=/var/jenkins_cache/war " - - name: JENKINS_SLAVE_AGENT_PORT - value: "50000" - - name: CASC_JENKINS_CONFIG - value: /var/jenkins_home/casc_configs - image: jenkins/jenkins:2.426.1-jdk11 - imagePullPolicy: Always - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - livenessProbe: - failureThreshold: 5 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - name: jenkins - ports: - - containerPort: 8080 - name: http - - containerPort: 50000 - name: agent-listener - readinessProbe: - failureThreshold: 3 - httpGet: - path: /login - port: http - periodSeconds: 10 - timeoutSeconds: 5 - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - startupProbe: - httpGet: - path: "/login" - port: http - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 12 - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - readOnly: false - - mountPath: /var/jenkins_config - name: jenkins-config - readOnly: true - - mountPath: /usr/share/jenkins/ref/plugins/ - name: plugin-dir - readOnly: false - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - mountPath: /var/jenkins_cache - name: jenkins-cache - - mountPath: /tmp - name: tmp-volume - - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: REQ_URL - value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME) - - name: REQ_METHOD - value: POST - - name: REQ_RETRY_CONNECT - value: "10" - image: kiwigrid/k8s-sidecar:1.24.4 - imagePullPolicy: IfNotPresent - securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - name: config-reload - resources: {} - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - initContainers: - - name: config-reload-init - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: LABEL - value: my-release-jenkins-jenkins-config - - name: FOLDER - value: /var/jenkins_home/casc_configs - - name: NAMESPACE - value: my-namespace - - name: METHOD - value: LIST - image: kiwigrid/k8s-sidecar:1.24.4 - imagePullPolicy: IfNotPresent - resources: {} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /var/jenkins_home/casc_configs - name: sc-config-volume - - mountPath: /var/jenkins_home - name: jenkins-home - - name: init - command: - - sh - - /var/jenkins_config/apply_config.sh - image: jenkins/jenkins:2.426.1-jdk11 - imagePullPolicy: Always - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - resources: - limits: - cpu: 2000m - memory: 4096Mi - requests: - cpu: 50m - memory: 256Mi - volumeMounts: - - mountPath: /var/jenkins_home - name: jenkins-home - - mountPath: /var/jenkins_config - name: jenkins-config - - mountPath: /usr/share/jenkins/ref/plugins - name: plugins - - mountPath: /var/jenkins_plugins - name: plugin-dir - - mountPath: /tmp - name: tmp-volume - securityContext: - fsGroup: 1000 - runAsUser: 1000 - runAsNonRoot: true - serviceAccountName: my-release-jenkins - volumes: - - emptyDir: {} - name: plugins - - configMap: - name: my-release-jenkins - name: jenkins-config - - emptyDir: {} - name: plugin-dir - - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - emptyDir: {} - name: jenkins-cache - - name: jenkins-home - persistentVolumeClaim: - claimName: my-release-jenkins - - emptyDir: {} - name: sc-config-volume - - emptyDir: {} - name: tmp-volume - - it: test different values - template: jenkins-controller-statefulset.yaml - capabilities: - apiVersions: - - scheduling.k8s.io/v1beta1 - set: - controller: - statefulSetAnnotations: - my-annotation: value - schedulerName: my-scheduler - nodeSelector: - nodeLabel: value - tolerations: - - key: "key" - operator: "Equal" - value: "value" - effect: "NoSchedule" - affinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: security - operator: In - values: - - S1 - topologyKey: failure-domain.beta.kubernetes.io/zone - terminationGracePeriodSeconds: 120 - priorityClassName: important - runAsUser: 2000 - fsGroup: 4000 - securityContextCapabilities: - drop: - - NET_RAW - hostNetworking: true - terminationMessagePath: /tmp/termination-log-diff - terminationMessagePolicy: FallbackToLogsOnError - hostAliases: - - ip: 192.168.50.50 - hostnames: - - something.local - updateStrategy: - type: OnDelete - serviceAccount.name: my-serviceaccount - asserts: - - equal: - path: metadata.annotations - value: - my-annotation: value - - equal: - path: spec.template.spec.schedulerName - value: my-scheduler - - equal: - path: spec.template.spec.nodeSelector - value: - nodeLabel: value - - equal: - path: spec.template.spec.tolerations - value: - - key: "key" - operator: "Equal" - value: "value" - effect: "NoSchedule" - - equal: - path: spec.template.spec.affinity - value: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: security - operator: In - values: - - S1 - topologyKey: failure-domain.beta.kubernetes.io/zone - - equal: - path: spec.template.spec.terminationGracePeriodSeconds - value: 120 - - equal: - path: spec.template.spec.priorityClassName - value: important - - equal: - path: spec.template.spec.securityContext - value: - runAsUser: 2000 - fsGroup: 4000 - runAsNonRoot: true - capabilities: - drop: - - NET_RAW - - equal: - path: spec.template.spec.serviceAccountName - value: my-serviceaccount - - equal: - path: spec.template.spec.hostNetwork - value: true - - equal: - path: spec.template.spec.containers[0].terminationMessagePath - value: /tmp/termination-log-diff - - equal: - path: spec.template.spec.containers[0].terminationMessagePolicy - value: FallbackToLogsOnError - - equal: - path: spec.template.spec.dnsPolicy - value: ClusterFirstWithHostNet - - equal: - path: spec.template.spec.hostAliases - value: - - ip: 192.168.50.50 - hostnames: - - something.local - - equal: - path: spec.updateStrategy.type - value: OnDelete - - it: configure image tag - template: jenkins-controller-statefulset.yaml - set: - controller.tag: 2.426.1-slim - controller.imagePullPolicy: IfNotPresent - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.426.1-slim - - equal: - path: spec.template.spec.containers[0].imagePullPolicy - value: IfNotPresent - - it: configure image tag label - template: jenkins-controller-statefulset.yaml - set: - controller.tagLabel: alpine - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.426.1-alpine - - it: configure empty image tag label - template: jenkins-controller-statefulset.yaml - set: - controller.tagLabel: - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: jenkins/jenkins:2.426.1 - - it: custom image - template: jenkins-controller-statefulset.yaml - set: - controller: - image: registry/image - tag: my-tag - javaOpts: -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry/image:my-tag - - contains: - path: spec.template.spec.containers[0].env - content: - name: JAVA_OPTS - value: >- - -Dcasc.reload.token=$(POD_NAME) -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true - - it: disable helm.sh label - template: jenkins-controller-statefulset.yaml - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: java & jenkins opts with quotes - template: jenkins-controller-statefulset.yaml - set: - controller: - javaOpts: >- - -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';" - jenkinsOpts: >- - -Dtest="custom: 'true'" - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: JAVA_OPTS - value: >- - -Dcasc.reload.token=$(POD_NAME) -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';" - - contains: - path: spec.template.spec.containers[0].env - content: - name: JENKINS_OPTS - value: >- - --webroot=/var/jenkins_cache/war -Dtest="custom: 'true'" - - it: test empty controller.podSecurityContextOverride - template: jenkins-controller-statefulset.yaml - set: - controller: - podSecurityContextOverride: {} - asserts: - - equal: - path: spec.template.spec.securityContext - value: {} - - it: test controller.podSecurityContextOverride - template: jenkins-controller-statefulset.yaml - set: - controller: - podSecurityContextOverride: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: [5555] - asserts: - - equal: - path: spec.template.spec.securityContext - value: - runAsNonRoot: true - runAsUser: 4444 - supplementalGroups: - - 5555 - - it: test 2 additional secrets - template: jenkins-controller-statefulset.yaml - set: - controller.additionalSecrets: - - name: something - value: secret - - name: anotherthing - value: anothersecret - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins-additional-secrets - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - it: test existing secret without additionalExistingSecrets - template: jenkins-controller-statefulset.yaml - set: - controller.existingSecret: my-exisiting-credentials - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-exisiting-credentials - - it: test existing secret with additionalExistingSecrets - template: jenkins-controller-statefulset.yaml - set: - controller.existingSecret: my-exisiting-credentials - controller.additionalExistingSecrets: - - name: my-exisiting-credentials - keyName: github-username - - name: my-exisiting-credentials - keyName: github-password - asserts: - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - items: - - key: github-username - path: my-exisiting-credentials-github-username - name: my-exisiting-credentials - - secret: - items: - - key: github-password - path: my-exisiting-credentials-github-password - name: my-exisiting-credentials - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-exisiting-credentials - - it: test templated environment variables - template: jenkins-controller-statefulset.yaml - set: - testValue: some-value - controller.initContainerEnv: - - name: "TEST_ENV_VAR_INIT" - value: "test-env-var-init" - - name: "TEST_ENV_VAR_INIT_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.sidecars.configAutoReload.env: - - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.containerEnv: - - name: "TEST_ENV_VAR_CONTAINER" - value: "test-env-var-container" - - name: "TEST_ENV_VAR__CONTAINER_TEMPLATED" - value: "{{ .Values.testValue }}" - controller.initContainerEnvFrom: - - configMapRef: - name: special-config - controller.sidecars.configAutoReload.envFrom: - - configMapRef: - name: special-config-auto-reload - controller.containerEnvFrom: - - configMapRef: - name: special-config - asserts: - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.initContainers[1].env - content: - name: "TEST_ENV_VAR_INIT" - value: "test-env-var-init" - - contains: - path: spec.template.spec.initContainers[1].env - content: - name: "TEST_ENV_VAR_INIT_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "TEST_ENV_VAR_CONFIG" - value: "test-env-var-config" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "TEST_ENV_VAR_CONFIG_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.containers[0].env - content: - name: "TEST_ENV_VAR_CONTAINER" - value: "test-env-var-container" - - contains: - path: spec.template.spec.containers[0].env - content: - name: "TEST_ENV_VAR__CONTAINER_TEMPLATED" - value: "some-value" - - contains: - path: spec.template.spec.initContainers[0].envFrom - content: - configMapRef: - name: special-config-auto-reload - - contains: - path: spec.template.spec.initContainers[1].envFrom - content: - configMapRef: - name: special-config - - contains: - path: spec.template.spec.containers[0].envFrom - content: - configMapRef: - name: special-config - - contains: - path: spec.template.spec.containers[1].envFrom - content: - configMapRef: - name: special-config-auto-reload - - it: test sleep time for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.sleepTime: 60 - asserts: - - contains: - # METHOD remains LIST on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "LIST" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "METHOD" - value: "SLEEP" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "SLEEP_TIME" - value: "60" - - it: test METHOD env var for config-reload - template: jenkins-controller-statefulset.yaml - set: - controller.sidecars.configAutoReload.env: - - name: "METHOD" - value: "SLEEP" - asserts: - - contains: - # METHOD remains LIST on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "LIST" - - notContains: - # only one METHOD on the config-reload init container - path: spec.template.spec.initContainers[0].env - content: - name: "METHOD" - value: "SLEEP" - - contains: - path: spec.template.spec.containers[1].env - content: - name: "METHOD" - value: "SLEEP" - - it: overrides container args - template: jenkins-controller-statefulset.yaml - set: - controller.overrideArgs: - - --httpPort=8080 - - --requestHeaderSize=32768 - asserts: - - equal: - path: spec.template.spec.containers[0].args - value: - - --httpPort=8080 - - --requestHeaderSize=32768 - - it: allows templating in container args overrides - template: jenkins-controller-statefulset.yaml - set: - controller.overrideArgs: - - --httpPort={{.Values.controller.targetPort}} - - --requestHeaderSize=32768 - asserts: - - equal: - path: spec.template.spec.containers[0].args - value: - - --httpPort=8080 - - --requestHeaderSize=32768 - - it: render pod annotations - template: jenkins-controller-statefulset.yaml - set: - controller: - podAnnotations: - templated-annotations: "{{ .Release.Name }}" - fixed-annotation: some-fixed-annotation - asserts: - - matchSnapshot: - path: spec.template.metadata.annotations - - it: test true shareProcessNamespace - template: jenkins-controller-statefulset.yaml - set: - controller: - shareProcessNamespace: true - asserts: - - equal: - path: spec.template.spec.shareProcessNamespace - value: true - - it: test false shareProcessNamespace - template: jenkins-controller-statefulset.yaml - set: - controller: - shareProcessNamespace: false - asserts: - - isNull: - path: spec.template.spec.shareProcessNamespace - - it: test disableSecretMount - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: true - password: some-secret-password - path: /some/path - jenkinsHttpsJksSecretName: some-secret-name - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - value: some-secret-password - - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - notContains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - notContains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: jenkins-jks-file - path: some-file-name - - - it: test not disableSecretMount - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - valueFrom: - secretKeyRef: - name: some-secret-name - key: "https-jks-password" - - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - contains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - mountPath: /some/path - name: jenkins-https-keystore - - contains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: jenkins-jks-file - path: some-file-name - - it: test override with jenkinsHttpsJksPasswordSecretName and jenkinsHttpsJksPasswordSecretKey - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksPasswordSecretName: "some-jks-name" - jenkinsHttpsJksPasswordSecretKey: "some-jks-password" - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "JENKINS_HTTPS_KEYSTORE_PASSWORD" - valueFrom: - secretKeyRef: - name: "some-jks-name" - key: "some-jks-password" - - it: test jenkinsHttpsJksSecretKey override - template: jenkins-controller-statefulset.yaml - set: - controller: - httpsKeyStore: - enable: true - disableSecretMount: false - jenkinsHttpsJksSecretName: some-secret-name - path: /some/path - fileName: some-file-name - jenkinsHttpsJksSecretKey: "some.jks" - asserts: - - contains: - path: spec.template.spec.volumes - content: - name: jenkins-https-keystore - secret: - secretName: some-secret-name - items: - - key: "some.jks" - path: some-file-name - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - installPlugins: false - asserts: - - notContains: - path: spec.template.spec.volumes - content: - name: plugins - emptyDir: {} - - notContains: - path: spec.template.spec.initContainers[1].volumeMounts - content: - name: plugins - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: - - https://acme.org/jenkins.yaml - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml" - - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: - - https://acme.org/jenkins.yaml - - https://foobar.org/jenkins.yaml - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml,https://foobar.org/jenkins.yaml" - - - it: - template: jenkins-controller-statefulset.yaml - set: - controller: - JCasC: - configUrls: [] - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: "CASC_JENKINS_CONFIG" - value: "/var/jenkins_home/casc_configs" - - - it: test checksum for config-init-script - template: jenkins-controller-statefulset.yaml - set: - controller: - initScripts: - test: |- - This is a test script - asserts: - - isSubset: - path: spec.template.metadata.annotations - content: - checksum/config-init-scripts: 2ee2c03a600a50a55cf62cbed3f1d558d5322eda7544b4047beeb4df66e8ec11 diff --git a/helm-templates/jenkins/unittests/jenkins-controller-svc-test.yaml b/helm-templates/jenkins/unittests/jenkins-controller-svc-test.yaml deleted file mode 100644 index f1349ee..0000000 --- a/helm-templates/jenkins/unittests/jenkins-controller-svc-test.yaml +++ /dev/null @@ -1,158 +0,0 @@ -suite: Jenkins Controller -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-svc.yaml -tests: - - it: default tests - asserts: - - isKind: - of: Service - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: spec - value: - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: other values - set: - controller: - serviceLabels: - label: label-value - serviceAnnotations: - key: value - clusterIP: 10.10.10.11 - servicePort: 8888 - targetPort: 7777 - extraPorts: - - name: BuildInfoProxy - port: 9000 - asserts: - - equal: - path: metadata.labels.label - value: label-value - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - clusterIP: 10.10.10.11 - ports: - - name: http - port: 8888 - targetPort: 7777 - - name: BuildInfoProxy - port: 9000 - targetPort: 9000 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: extraPort with targetPort - set: - controller: - serviceLabels: - label: label-value - serviceAnnotations: - key: value - clusterIP: 10.10.10.11 - servicePort: 8888 - targetPort: 7777 - extraPorts: - - name: https - port: 443 - targetPort: 8080 - asserts: - - equal: - path: metadata.labels.label - value: label-value - - equal: - path: metadata.annotations - value: - key: value - - equal: - path: spec - value: - clusterIP: 10.10.10.11 - ports: - - name: http - port: 8888 - targetPort: 7777 - - name: https - port: 443 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: ClusterIP - - it: node port - set: - controller: - serviceType: NodePort - nodePort: 11111 - asserts: - - equal: - path: spec - value: - ports: - - name: http - port: 8080 - targetPort: 8080 - nodePort: 11111 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: NodePort - - it: load balancer - set: - controller: - serviceType: LoadBalancer - loadBalancerIP: 10.10.10.10 - asserts: - - equal: - path: spec - value: - loadBalancerIP: 10.10.10.10 - loadBalancerSourceRanges: - - 0.0.0.0/0 - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - type: LoadBalancer - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins diff --git a/helm-templates/jenkins/unittests/rbac-test.yaml b/helm-templates/jenkins/unittests/rbac-test.yaml deleted file mode 100644 index 592373e..0000000 --- a/helm-templates/jenkins/unittests/rbac-test.yaml +++ /dev/null @@ -1,217 +0,0 @@ -suite: Role Based Access Control -release: - name: my-release - namespace: my-namespace -templates: - - rbac.yaml -tests: - - it: test default number of documents - asserts: - - hasDocuments: - count: 4 - - it: disable auto reload - set: - controller.sidecars.configAutoReload.enabled: false - asserts: - - hasDocuments: - count: 2 - - - it: disable rbac create - set: - rbac.create: false - asserts: - - hasDocuments: - count: 0 - - - it: Role schedule-agents - documentIndex: 0 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-schedule-agents - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["pods", "pods/exec", "persistentvolumeclaims"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] - - - it: RoleBinding schedule-agents - documentIndex: 1 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-schedule-agents - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-schedule-agents - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - - - it: Separate Agent Namespace - set: - agent.namespace: agent-namespace - asserts: - - equal: - path: metadata.namespace - value: agent-namespace - documentIndex: 0 - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - documentIndex: 1 - - - it: Role casc-reload - documentIndex: 2 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-casc-reload - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "watch", "list"] - - - it: RoleBinding casc-reload - documentIndex: 3 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-watch-configmaps - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-casc-reload - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - - - it: enable read secrets - set: - rbac.readSecrets: true - asserts: - - hasDocuments: - count: 6 - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - - it: disable helm.sh label - set: - renderHelmLabels: false - rbac.readSecrets: true - asserts: - - hasDocuments: - count: 6 - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: Role read-secrets - set: - rbac.readSecrets: true - documentIndex: 2 - asserts: - - isKind: - of: Role - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-read-secrets - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: rules - value: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "watch", "list"] - - - it: RoleBinding read-secrets - set: - rbac.readSecrets: true - documentIndex: 3 - asserts: - - isKind: - of: RoleBinding - - equal: - path: apiVersion - value: rbac.authorization.k8s.io/v1 - - equal: - path: metadata.name - value: my-release-jenkins-read-secrets - - equal: - path: metadata.namespace - value: my-namespace - - equal: - path: roleRef - value: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: my-release-jenkins-read-secrets - - equal: - path: subjects - value: - - kind: ServiceAccount - name: my-release-jenkins - namespace: my-namespace - diff --git a/helm-templates/jenkins/unittests/secret-additional-test.yaml b/helm-templates/jenkins/unittests/secret-additional-test.yaml deleted file mode 100644 index 99d4456..0000000 --- a/helm-templates/jenkins/unittests/secret-additional-test.yaml +++ /dev/null @@ -1,41 +0,0 @@ -suite: Controller Admin Additional Secrets -release: - name: my-release - namespace: my-namespace -templates: - - secret-additional.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: tests 2 additional secrets - set: - controller.additionalSecrets: - - name: something - value: secret - - name: anotherthing - value: anothersecret - asserts: - - isKind: - of: Secret - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-additional-secrets - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: data.something - value: c2VjcmV0 - - equal: - path: data.anotherthing - value: YW5vdGhlcnNlY3JldA== diff --git a/helm-templates/jenkins/unittests/secret-claims-test.yaml b/helm-templates/jenkins/unittests/secret-claims-test.yaml deleted file mode 100644 index d7ca286..0000000 --- a/helm-templates/jenkins/unittests/secret-claims-test.yaml +++ /dev/null @@ -1,82 +0,0 @@ -suite: Controller Secret Claims -release: - name: my-release - namespace: my-namespace -templates: - - secret-claims.yaml -tests: - - it: tests defaults - asserts: - - hasDocuments: - count: 0 - - it: tests 2 secret claims - set: - controller.secretClaims: - - name: simple-secret - path: secret/path - - name: complex-secret - path: secret/complex - type: kubernetes.io/tls - renew: 60 - asserts: - - hasDocuments: - count: 2 - - documentIndex: 0 - isKind: - of: SecretClaim - - documentIndex: 0 - equal: - path: apiVersion - value: vaultproject.io/v1 - - documentIndex: 0 - equal: - path: metadata.name - value: my-release-jenkins-simple-secret - - documentIndex: 0 - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - documentIndex: 0 - isNull: - path: metadata.annotations - - documentIndex: 0 - equal: - path: spec.type - value: Opaque - - documentIndex: 0 - equal: - path: spec.path - value: secret/path - - documentIndex: 0 - isNull: - path: spec.renew - - documentIndex: 1 - isKind: - of: SecretClaim - - documentIndex: 1 - equal: - path: apiVersion - value: vaultproject.io/v1 - - documentIndex: 1 - equal: - path: metadata.name - value: my-release-jenkins-complex-secret - - documentIndex: 1 - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - documentIndex: 1 - isNull: - path: metadata.annotations - - documentIndex: 1 - equal: - path: spec.type - value: kubernetes.io/tls - - documentIndex: 1 - equal: - path: spec.path - value: secret/complex - - documentIndex: 1 - equal: - path: spec.renew - value: 60 \ No newline at end of file diff --git a/helm-templates/jenkins/unittests/secret-existing-test.yaml b/helm-templates/jenkins/unittests/secret-existing-test.yaml deleted file mode 100644 index 1c56a6e..0000000 --- a/helm-templates/jenkins/unittests/secret-existing-test.yaml +++ /dev/null @@ -1,52 +0,0 @@ -suite: Controller Additional Existing Secrets -release: - name: my-release - namespace: my-namespace -templates: - - jenkins-controller-statefulset.yaml - - config.yaml -tests: - - it: test additional existing secrets StatefulSet - template: jenkins-controller-statefulset.yaml - set: - controller.additionalExistingSecrets: - - name: "{{ .Release.Name }}-secret" - keyName: username - - name: "{{ .Release.Name }}-secret" - keyName: password - controller.existingSecret: my-existing-credentials - - asserts: - - isKind: - of: StatefulSet - - equal: - path: spec.template.spec.containers[0].volumeMounts[4] - value: - mountPath: /run/secrets/additional - name: jenkins-secrets - readOnly: true - - equal: - path: spec.template.spec.volumes[3] - value: - name: jenkins-secrets - projected: - sources: - - secret: - name: my-release-secret - items: - - key: username - path: my-release-secret-username - - secret: - name: my-release-secret - items: - - key: password - path: my-release-secret-password - - secret: - name: my-release-jenkins - items: - - key: jenkins-admin-user - path: chart-admin-username - - key: jenkins-admin-password - path: chart-admin-password - - secret: - name: my-existing-credentials diff --git a/helm-templates/jenkins/unittests/secret-test.yaml b/helm-templates/jenkins/unittests/secret-test.yaml deleted file mode 100644 index 12ea5c1..0000000 --- a/helm-templates/jenkins/unittests/secret-test.yaml +++ /dev/null @@ -1,65 +0,0 @@ -suite: Controller Admin Credentials -release: - name: my-release - namespace: my-namespace -templates: - - secret.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: Secret - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - equal: - path: data.jenkins-admin-user - value: YWRtaW4= - - isNotNull: - path: data.jenkins-admin-password - - it: set admin password - set: - controller.adminPassword: secret - asserts: - - equal: - path: data.jenkins-admin-user - value: YWRtaW4= - - equal: - path: data.jenkins-admin-password - value: c2VjcmV0 - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: disable - set: - controller: - adminSecret: false - asserts: - - hasDocuments: - count: 0 - - it: disable - set: - controller.admin.existingSecret: my-secret - asserts: - - hasDocuments: - count: 0 - diff --git a/helm-templates/jenkins/unittests/service-account-agent-test.yaml b/helm-templates/jenkins/unittests/service-account-agent-test.yaml deleted file mode 100644 index 26d26e0..0000000 --- a/helm-templates/jenkins/unittests/service-account-agent-test.yaml +++ /dev/null @@ -1,103 +0,0 @@ -suite: Controller Service Account -release: - name: my-release - namespace: my-namespace -templates: - - service-account-agent.yaml -tests: - - it: test defaults - asserts: - - hasDocuments: - count: 0 - - it: create service account for agents - set: - serviceAccountAgent: - create: true - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - it: agent namespace - set: - serviceAccountAgent: - create: true - annotations: - key: value - agent: - namespace: agents - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins-agent - - equal: - path: metadata.namespace - value: agents - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - equal: - path: metadata.annotations - value: - key: value - - it: disable helm.sh label - set: - renderHelmLabels: false - serviceAccountAgent: - create: true - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - it: agent image pull secret - set: - renderHelmLabels: false - serviceAccountAgent: - create: true - imagePullSecretName: ips-name - asserts: - - equal: - path: imagePullSecrets - value: - - name: ips-name - - it: agent service account attach labels - set: - serviceAccountAgent: - create: true - extraLabels: - "this.is.a.test.label": "with a value" - "this.is.another.test.label": "with a different value" - asserts: - - equal: - path: metadata.labels.\app\.kubernetes\.io/name - value: "jenkins" - - equal: - path: metadata.labels.app\.kubernetes\.io/managed-by - value: "Helm" - - equal: - path: metadata.labels.this\.\is\.a\.test\.label - value: "with a value" - - equal: - path: metadata.labels.this\.is\.another\.test\.label - value: "with a different value" diff --git a/helm-templates/jenkins/unittests/service-account-test.yaml b/helm-templates/jenkins/unittests/service-account-test.yaml deleted file mode 100644 index 4aa20fe..0000000 --- a/helm-templates/jenkins/unittests/service-account-test.yaml +++ /dev/null @@ -1,77 +0,0 @@ -suite: Controller Service Account -release: - name: my-release - namespace: my-namespace -templates: - - service-account.yaml -tests: - - it: tests defaults - asserts: - - isKind: - of: ServiceAccount - - equal: - path: apiVersion - value: v1 - - equal: - path: metadata.name - value: my-release-jenkins - - equal: - path: metadata.namespace - value: my-namespace - - matchRegex: - path: metadata.labels.helm\.sh/chart - pattern: ^jenkins- - - isNull: - path: metadata.annotations - - - it: disable helm.sh label - set: - renderHelmLabels: false - asserts: - - equal: - path: metadata.labels - value: - app.kubernetes.io/component: jenkins-controller - app.kubernetes.io/instance: my-release - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/name: jenkins - - - it: disabled - set: - serviceAccount: - create: false - asserts: - - hasDocuments: - count: 0 - - - it: controller image pull secret - set: - renderHelmLabels: false - serviceAccount: - create: true - imagePullSecretName: ips-name - asserts: - - equal: - path: imagePullSecrets - value: - - name: ips-name - - - it: service account attach labels - set: - serviceAccount: - extraLabels: - "this.is.a.test.label": "with a value" - "this.is.another.test.label": "with a different value" - asserts: - - equal: - path: metadata.labels.\app\.kubernetes\.io/name - value: "jenkins" - - equal: - path: metadata.labels.app\.kubernetes\.io/managed-by - value: "Helm" - - equal: - path: metadata.labels.this\.\is\.a\.test\.label - value: "with a value" - - equal: - path: metadata.labels.this\.is\.another\.test\.label - value: "with a different value" diff --git a/helm-templates/jenkins/values.yaml b/helm-templates/jenkins/values.yaml deleted file mode 100644 index 0dffad3..0000000 --- a/helm-templates/jenkins/values.yaml +++ /dev/null @@ -1,999 +0,0 @@ -# Default values for jenkins. -# This is a YAML-formatted file. -# Declare name/value pairs to be passed into your templates. -# name: value - -## Overrides for generated resource names -# See templates/_helpers.tpl -# nameOverride: -# fullnameOverride: -# namespaceOverride: - -# For FQDN resolving of the controller service. Change this value to match your existing configuration. -# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md -clusterZone: "cluster.local" - -# The URL of the Kubernetes API server -kubernetesURL: "https://kubernetes.default" - -renderHelmLabels: true - -controller: - # Used for label app.kubernetes.io/component - componentName: "jenkins-controller" - image: "jenkins/jenkins" - # tag: "2.426.1-jdk17" - tagLabel: jdk17 - imagePullPolicy: "Always" - imagePullSecretName: - # Optionally configure lifetime for controller-container - lifecycle: - # postStart: - # exec: - # command: - # - "uname" - # - "-a" - disableRememberMe: false - numExecutors: 0 - # configures the executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE - executorMode: "NORMAL" - # This is ignored if enableRawHtmlMarkupFormatter is true - markupFormatter: plainText - customJenkinsLabels: [] - # The default configuration uses this secret to configure an admin user - # If you don't need that user or use a different security realm then you can disable it - adminSecret: true - - hostNetworking: false - # When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist. - # If you disable the non-Jenkins identity store and instead use the Jenkins internal one, - # you should revert controller.adminUser to your preferred admin user: - adminUser: "admin" - # adminPassword: - admin: - existingSecret: "" - userKey: jenkins-admin-user - passwordKey: jenkins-admin-password - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution" - jenkinsHome: "/var/jenkins_home" - # This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use - # Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref" - jenkinsRef: "/usr/share/jenkins/ref" - # Path to the jenkins war file which is used by jenkins-plugin-cli. - jenkinsWar: "/usr/share/jenkins/jenkins.war" - # Overrides the default arguments passed to the war - # overrideArgs: - # - --httpPort=8080 - resources: - requests: - cpu: "50m" - memory: "256Mi" - limits: - cpu: "2000m" - memory: "4096Mi" - # Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod - shareProcessNamespace: false - # Overrides the init container default values - # initContainerResources: - # requests: - # cpu: "50m" - # memory: "256Mi" - # limits: - # cpu: "2000m" - # memory: "4096Mi" - # Environment variables that get added to the init container (useful for e.g. http_proxy) - # initContainerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - # containerEnv: - # - name: http_proxy - # value: "http://192.168.64.1:3128" - # Set min/max heap here if needed with: - # javaOpts: "-Xms512m -Xmx512m" - # jenkinsOpts: "" - # If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration. - # The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`. - # jenkinsUrlProtocol: "https" - # If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the url definition. - # jenkinsUrl: "" - # If you set this prefix and use ingress controller then you might want to set the ingress path below - # jenkinsUriPrefix: "/jenkins" - # Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) - usePodSecurityContext: true - # Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are - # being deprecated and replaced by `podSecurityContextOverride`. - # Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 1000 - fsGroup: 1000 - # If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here - securityContextCapabilities: {} - # drop: - # - NET_RAW - # Completely overwrites the contents of the `securityContext`, ignoring the - # values provided for the deprecated fields: `runAsUser`, `fsGroup`, and - # `securityContextCapabilities`. In the case of mounting an ext4 filesystem, - # it might be desirable to use `supplementalGroups` instead of `fsGroup` in - # the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496 - # podSecurityContextOverride: - # runAsUser: 1000 - # runAsNonRoot: true - # supplementalGroups: [1000] - # # capabilities: {} - # Container securityContext - containerSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - servicePort: 8080 - targetPort: 8080 - # For minikube, set this to NodePort, elsewhere use LoadBalancer - # Use ClusterIP if your setup includes ingress controller - serviceType: ClusterIP - # Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, - # but risks potentially imbalanced traffic spreading. - serviceExternalTrafficPolicy: - # Jenkins controller service annotations - serviceAnnotations: {} - # Jenkins controller custom labels - statefulSetLabels: {} - # foo: bar - # bar: foo - # Jenkins controller service labels - serviceLabels: {} - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https - # Put labels on Jenkins controller pod - podLabels: {} - # Used to create Ingress record (should be used with ServiceType: ClusterIP) - # nodePort: - # -Dcom.sun.management.jmxremote.port=4000 - # -Dcom.sun.management.jmxremote.authenticate=false - # -Dcom.sun.management.jmxremote.ssl=false - # jmxPort: 4000 - # Optionally configure other ports to expose in the controller container - extraPorts: [] - # - name: BuildInfoProxy - # port: 9000 - # targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port) - - # List of plugins to be install during Jenkins controller start - installPlugins: - - kubernetes:4029.v5712230ccb_f8 - - workflow-aggregator:596.v8c21c963d92d - - git:5.1.0 - - configuration-as-code:1670.v564dc8b_982d0 - - # Set to false to download the minimum required version of all dependencies. - installLatestPlugins: true - - # Set to true to download latest dependencies of any plugin that is requested to have the latest version. - installLatestSpecifiedPlugins: false - - # List of plugins to install in addition to those listed in controller.installPlugins - additionalPlugins: [] - - # Enable to initialize the Jenkins controller only once on initial installation. - # Without this, whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates which has the potential to cause breakage. - # Note that for this to work, `persistence.enabled` needs to be set to `true` - initializeOnce: false - - # Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment. - # overwritePlugins: true - - # Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment. - overwritePluginsFromImage: true - - # Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config. - projectNamingStrategy: standard - - # Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter), useful with ghprb plugin. - # The plugin is not installed by default, please update controller.installPlugins. - enableRawHtmlMarkupFormatter: false - # Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval - scriptApproval: [] - # - "method groovy.json.JsonSlurperClassic parseText java.lang.String" - # - "new groovy.json.JsonSlurperClassic" - # List of groovy init scripts to be executed during Jenkins controller start - initScripts: [] - # - | - # print 'adding global pipeline libraries, register properties, bootstrap jobs...' - - # 'name' is a name of an existing secret in same namespace as jenkins, - # 'keyName' is the name of one of the keys inside current secret. - # the 'name' and 'keyName' are concatenated with a '-' in between, so for example: - # an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password} - # 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', - # and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc') - # existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username} - # When using existingSecret no need to specify the keyName under additionalExistingSecrets. - existingSecret: - - additionalExistingSecrets: [] - # - name: secret-name-1 - # keyName: username - # - name: secret-name-1 - # keyName: password - - additionalSecrets: [] - # - name: nameOfSecret - # value: secretText - - # Generate SecretClaim resources in order to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller. - # 'name' is name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value. - # 'path' is the fully qualified path to the secret in Vault - # 'type' is an optional Kubernetes secret type. Defaults to 'Opaque' - # 'renew' is an optional secret renewal time in seconds - secretClaims: [] - # - name: secretName # required - # path: testPath # required - # type: kubernetes.io/tls # optional - # renew: 60 # optional - - # Name of default cloud configuration. - cloudName: "kubernetes" - - # Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area, - # where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in - # /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each | - # become the content of the configuration yaml file. The first line after this is a JCasC root element, eg jenkins, credentials, - # etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message: - JCasC: - defaultConfig: true - configUrls: [] - # - https://acme.org/jenkins.yaml - # Remote URL:s for configuration files. - configScripts: {} - # welcome-message: | - # jenkins: - # systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'. - # Allows adding to the top-level security JCasC section. For legacy, default the chart includes apiToken configurations - security: - apiToken: - creationOfLegacyTokenEnabled: false - tokenGenerationOnCreationEnabled: false - usageStatisticsEnabled: true - # Ignored if securityRealm is defined in controller.JCasC.configScripts - securityRealm: |- - local: - allowsSignup: false - enableCaptcha: false - users: - - id: "${chart-admin-username}" - name: "Jenkins Admin" - password: "${chart-admin-password}" - # Ignored if authorizationStrategy is defined in controller.JCasC.configScripts - authorizationStrategy: |- - loggedInUsersCanDoAnything: - allowAnonymousRead: false - # Optionally specify additional init-containers - customInitContainers: [] - # - name: custom-init - # image: "alpine:3.7" - # imagePullPolicy: Always - # command: [ "uname", "-a" ] - - sidecars: - configAutoReload: - # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified, - # jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the - # http:///reload-configuration-as-code endpoint to reapply config when changes to the configScripts are detected. - enabled: true - image: kiwigrid/k8s-sidecar:1.24.4 - imagePullPolicy: IfNotPresent - resources: {} - # limits: - # cpu: 100m - # memory: 100Mi - # requests: - # cpu: 50m - # memory: 50Mi - # How many connection-related errors to retry on - reqRetryConnect: 10 - # env: - # - name: REQ_TIMEOUT - # value: "30" - # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. - # Is only used to reload jcasc config from the sidecar container running in the Jenkins controller pod. - # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be - # accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), - # this must be > 1024: - sshTcpPort: 1044 - # folder in the pod that should hold the collected dashboards: - folder: "/var/jenkins_home/casc_configs" - # If specified, the sidecar will search for JCasC config-maps inside this namespace. - # Otherwise the namespace in which the sidecar is running will be used. - # It's also possible to specify ALL to search in all namespaces: - # searchNamespace: - containerSecurityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - - # Allows you to inject additional/other sidecars - other: [] - ## The example below runs the client for https://smee.io as sidecar container next to Jenkins, - ## that allows to trigger build behind a secure firewall. - ## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall - ## - ## Note: To use it you should go to https://smee.io/new and update the url to the generete one. - # - name: smee - # image: docker.io/twalter/smee-client:1.0.2 - # args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"] - # resources: - # limits: - # cpu: 50m - # memory: 128Mi - # requests: - # cpu: 10m - # memory: 32Mi - # Name of the Kubernetes scheduler to use - schedulerName: "" - # Node labels and tolerations for pod assignment - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature - nodeSelector: {} - - terminationGracePeriodSeconds: - - terminationMessagePath: - terminationMessagePolicy: - - tolerations: [] - - affinity: {} - # Leverage a priorityClass to ensure your pods survive resource shortages - # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - priorityClassName: - - podAnnotations: {} - # Add StatefulSet annotations - statefulSetAnnotations: {} - - # StatefulSet updateStrategy - # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - updateStrategy: {} - - ingress: - enabled: false - # Override for the default paths that map requests to the backend - paths: [] - # - backend: - # serviceName: ssl-redirect - # servicePort: use-annotation - # - backend: - # serviceName: >- - # {{ template "jenkins.fullname" . }} - # # Don't use string here, use only integer value! - # servicePort: 8080 - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - # Set this path to jenkinsUriPrefix above or use annotations to rewrite path - # path: "/jenkins" - # configures the hostname e.g. jenkins.example.com - hostName: - tls: - # - secretName: jenkins.cluster.local - # hosts: - # - jenkins.cluster.local - - # often you want to have your controller all locked down and private - # but you still want to get webhooks from your SCM - # A secondary ingress will let you expose different urls - # with a differnt configuration - secondaryingress: - enabled: false - # paths you want forwarded to the backend - # ex /github-webhook - paths: [] - # For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1' - # For Kubernetes v1.19+, use 'networking.k8s.io/v1' - apiVersion: "extensions/v1beta1" - labels: {} - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName - # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress - # ingressClassName: nginx - # configures the hostname e.g. jenkins-external.example.com - hostName: - tls: - # - secretName: jenkins-external.example.com - # hosts: - # - jenkins-external.example.com - - # If you're running on GKE and need to configure a backendconfig - # to finish ingress setup, use the following values. - # Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig - backendconfig: - enabled: false - apiVersion: "extensions/v1beta1" - name: - labels: {} - annotations: {} - spec: {} - - # Openshift route - route: - enabled: false - labels: {} - annotations: {} - # path: "/jenkins" - - # controller.hostAliases allows for adding entries to Pod /etc/hosts: - # https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - hostAliases: [] - # - ip: 192.168.50.50 - # hostnames: - # - something.local - # - ip: 10.0.50.50 - # hostnames: - # - other.local - - # Expose Prometheus metrics - prometheus: - # If enabled, add the prometheus plugin to the list of plugins to install - # https://plugins.jenkins.io/prometheus - enabled: false - # Additional labels to add to the ServiceMonitor object - serviceMonitorAdditionalLabels: {} - # Set a custom namespace where to deploy ServiceMonitor resource - # serviceMonitorNamespace: monitoring - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - # Additional labels to add to the PrometheusRule object - alertingRulesAdditionalLabels: {} - # An array of prometheus alerting rules - # See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ - # The `groups` root object is added by default, simply add the rule entries - alertingrules: [] - # Set a custom namespace where to deploy PrometheusRule resource - prometheusRuleNamespace: "" - - # RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds - # relabelings for a few standard Kubernetes fields. The original scrape job’s name - # is available via the __tmp_prometheus_job_name label. - # More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config - relabelings: [] - # MetricRelabelConfigs to apply to samples before ingestion. - metricRelabelings: [] - - googlePodMonitor: - # If enabled, It creates Google Managed Prometheus scraping config - enabled: false - # Set a custom namespace where to deploy PodMonitoring resource - # serviceMonitorNamespace: "" - scrapeInterval: 60s - # This is the default endpoint used by the prometheus plugin - scrapeEndpoint: /prometheus - - # Can be used to disable rendering controller test resources when using helm template - testEnabled: true - - httpsKeyStore: - jenkinsHttpsJksSecretName: '' - jenkinsHttpsJksSecretKey: "jenkins-jks-file" - jenkinsHttpsJksPasswordSecretName: "" - jenkinsHttpsJksPasswordSecretKey: "https-jks-password" - enable: false - disableSecretMount: false - httpPort: 8081 - path: "/var/jenkins_keystore" - fileName: "keystore.jks" - password: "password" - # Convert keystore.jks files content to base64 ( cat keystore.jks | base64 ) and put the output here - jenkinsKeyStoreBase64Encoded: | - /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq - AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z - gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe - TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x - QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy - 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR - pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB - Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l - Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG - Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi - HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI - OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO - NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi - Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg - UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te - fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi - Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT - EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ - y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU - iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl - t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ - gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa - jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H - bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn - xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV - BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p - bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx - MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y - b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb - BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC - AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w - Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF - 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP - F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i - d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe - 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl - m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h - /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q - 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog - hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0= - -agent: - enabled: true - defaultsProviderTemplate: "" - # URL for connecting to the Jenkins controller - jenkinsUrl: - # connect to the specified host and port, instead of connecting directly to the Jenkins controller - jenkinsTunnel: - kubernetesConnectTimeout: 5 - kubernetesReadTimeout: 15 - maxRequestsPerHostStr: "32" - retentionTimeout: 5 - waitForPodSec: 600 - namespace: - # private registry for agent image - jnlpregistry: - image: "jenkins/inbound-agent" - tag: "3107.v665000b_51092-15" - workingDir: "/home/jenkins/agent" - nodeUsageMode: "NORMAL" - customJenkinsLabels: [] - # name of the secret to be used for image pulling - imagePullSecretName: - componentName: "jenkins-agent" - websocket: false - directConnection: false - privileged: false - runAsUser: - runAsGroup: - hostNetworking: false - resources: - requests: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - limits: - cpu: "512m" - memory: "512Mi" - # ephemeralStorage: - livenessProbe: {} -# execArgs: "cat /tmp/healthy" -# failureThreshold: 3 -# initialDelaySeconds: 0 -# periodSeconds: 10 -# successThreshold: 1 -# timeoutSeconds: 1 - # You may want to change this to true while testing a new image - alwaysPullImage: false - # Controls how agent pods are retained after the Jenkins build completes - # Possible values: Always, Never, OnFailure - podRetention: "Never" - # Disable if you do not want the Yaml the agent pod template to show up - # in the job Console Output. This can be helpful for either security reasons - # or simply to clean up the output to make it easier to read. - showRawYaml: true - # You can define the volumes that you want to mount for this container - # Allowed types are: ConfigMap, EmptyDir, HostPath, Nfs, PVC, Secret - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes - volumes: [] - # - type: ConfigMap - # configMapName: myconfigmap - # mountPath: /var/myapp/myconfigmap - # - type: EmptyDir - # mountPath: /var/myapp/myemptydir - # memory: false - # - type: HostPath - # hostPath: /var/lib/containers - # mountPath: /var/myapp/myhostpath - # - type: Nfs - # mountPath: /var/myapp/mynfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - # - type: PVC - # claimName: mypvc - # mountPath: /var/myapp/mypvc - # readOnly: false - # - type: Secret - # defaultMode: "600" - # mountPath: /var/myapp/mysecret - # secretName: mysecret - # Pod-wide environment, these vars are visible to any container in the agent pod - - # You can define the workspaceVolume that you want to mount for this container - # Allowed types are: DynamicPVC, EmptyDir, HostPath, Nfs, PVC - # Configure the attributes as they appear in the corresponding Java class for that type - # https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace - workspaceVolume: {} - ## DynamicPVC example - # type: DynamicPVC - # configMapName: myconfigmap - ## EmptyDir example - # type: EmptyDir - # memory: false - ## HostPath example - # type: HostPath - # hostPath: /var/lib/containers - ## NFS example - # type: Nfs - # readOnly: false - # serverAddress: "192.0.2.0" - # serverPath: /var/lib/containers - ## PVC example - # type: PVC - # claimName: mypvc - # readOnly: false - # - # Pod-wide environment, these vars are visible to any container in the agent pod - envVars: [] - # - name: PATH - # value: /usr/local/bin - # Mount a secret as environment variable - secretEnvVars: [] - # - key: PATH - # optional: false # default: false - # secretKey: MY-K8S-PATH - # secretName: my-k8s-secret - nodeSelector: {} - # Key Value selectors. Ex: - # jenkins-agent: v1 - - # Executed command when side container gets started - command: - args: "${computer.jnlpmac} ${computer.name}" - # Side container name - sideContainerName: "jnlp" - # Doesn't allocate pseudo TTY by default - TTYEnabled: false - # Max number of spawned agent - containerCap: 10 - # Pod name - podName: "default" - # Allows the Pod to remain active for reuse until the configured number of - # minutes has passed since the last step was executed on it. - idleMinutes: 0 - # Raw yaml template for the Pod. For example this allows usage of toleration for agent pods. - # https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates - # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - yamlTemplate: "" - # yamlTemplate: |- - # apiVersion: v1 - # kind: Pod - # spec: - # tolerations: - # - key: "key" - # operator: "Equal" - # value: "value" - # Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates: merge or override - yamlMergeStrategy: "override" - # Timeout in seconds for an agent to be online - connectTimeout: 100 - # Annotations to apply to the pod. - annotations: {} - - # Add additional containers to the agents. - # Containers specified here are added to all agents. Set key empty to remove container from additional agents. - additionalContainers: [] - # - sideContainerName: dind - # image: docker - # tag: dind - # command: dockerd-entrypoint.sh - # args: "" - # privileged: true - # resources: - # requests: - # cpu: 500m - # memory: 1Gi - # limits: - # cpu: 1 - # memory: 2Gi - - # Disable the default Jenkins Agent configuration. - # Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template. - disableDefaultAgent: false - - # Below is the implementation of custom pod templates for the default configured kubernetes cloud. - # Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value. - # Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label - # characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers. - # For this pod templates configuration to be loaded the following values must be set: - # controller.JCasC.defaultConfig: true - # Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template. - podTemplates: {} - # python: | - # - name: python - # label: jenkins-python - # serviceAccount: jenkins - # containers: - # - name: python - # image: python:3 - # command: "/bin/sh -c" - # args: "cat" - # ttyEnabled: true - # privileged: true - # resourceRequestCpu: "400m" - # resourceRequestMemory: "512Mi" - # resourceLimitCpu: "1" - # resourceLimitMemory: "1024Mi" - -# Here you can add additional agents -# They inherit all values from `agent` so you only need to specify values which differ -additionalAgents: {} -# maven: -# podName: maven -# customJenkinsLabels: maven -# # An example of overriding the jnlp container -# # sideContainerName: jnlp -# image: jenkins/jnlp-agent-maven -# tag: latest -# python: -# podName: python -# customJenkinsLabels: python -# sideContainerName: python -# image: python -# tag: "3" -# command: "/bin/sh -c" -# args: "cat" -# TTYEnabled: true - -persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: - ## jenkins data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - storageClass: - annotations: {} - labels: {} - accessMode: "ReadWriteOnce" - size: "8Gi" - # Existing data source to clone PVC from - # ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/ - dataSource: - # name: PVC-NAME - # kind: PersistentVolumeClaim - volumes: - # - name: nothing - # emptyDir: {} - mounts: - # - mountPath: /var/nothing - # name: nothing - # readOnly: true - -networkPolicy: - # Enable creation of NetworkPolicy resources. - enabled: false - # For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' - # For Kubernetes v1.7, use 'networking.k8s.io/v1' - apiVersion: networking.k8s.io/v1 - # You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range - internalAgents: - allowed: true - podLabels: {} - namespaceLabels: {} - # project: myproject - externalAgents: {} - # ipCIDR: 172.17.0.0/16 - # except: - # - 172.17.1.0/24 - -## Install Default RBAC roles and bindings -rbac: - create: true - readSecrets: false - -serviceAccount: - create: true - # The name of the service account is autogenerated by default - name: - annotations: {} - extraLabels: {} - imagePullSecretName: - - -serviceAccountAgent: - # Specifies whether a ServiceAccount should be created - create: false - # The name of the ServiceAccount to use. - # If not set and create is true, a name is generated using the fullname template - name: - annotations: {} - extraLabels: {} - imagePullSecretName: - -## Backup cronjob configuration -## Ref: https://github.com/maorfr/kube-tasks -backup: - # Backup must use RBAC - # So by enabling backup you are enabling RBAC specific for backup - enabled: false - # Used for label app.kubernetes.io/component - componentName: "backup" - # Schedule to run jobs. Must be in cron time format - # Ref: https://crontab.guru/ - schedule: "0 2 * * *" - labels: {} - serviceAccount: - create: true - name: - annotations: {} - # Example for authorization to AWS S3 using kube2iam or IRSA - # Can also be done using environment variables - # iam.amazonaws.com/role: "jenkins" - # "eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/jenkins-backup" - # Set this to terminate the job that is running/failing continously and set the job status to "Failed" - activeDeadlineSeconds: "" - image: - repository: "maorfr/kube-tasks" - tag: "0.2.0" - imagePullSecretName: - # Additional arguments for kube-tasks - # Ref: https://github.com/maorfr/kube-tasks#simple-backup - extraArgs: [] - # Add existingSecret for AWS credentials - existingSecret: {} - ## Example for using an existing secret - # jenkinsaws: - ## Use this key for AWS access key ID - # awsaccesskey: jenkins_aws_access_key - ## Use this key for AWS secret access key - # awssecretkey: jenkins_aws_secret_key - # Add additional environment variables - # jenkinsgcp: - ## Use this key for GCP credentials - # gcpcredentials: credentials.json - env: [] - # Example environment variable required for AWS credentials chain - # - name: "AWS_REGION" - # value: "us-east-1" - resources: - requests: - memory: 1Gi - cpu: 1 - limits: - memory: 1Gi - cpu: 1 - # Destination to store the backup artifacts - # Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage, Google Cloud Storage - # Additional support can added. Visit this repository for details - # Ref: https://github.com/maorfr/skbn - destination: "s3://jenkins-data/backup" - # By enabling only the jenkins_home/jobs folder gets backed up, not the whole jenkins instance - onlyJobs: false - # Enable backup pod security context (must be `true` if runAsUser or fsGroup are set) - usePodSecurityContext: true - # When setting runAsUser to a different value than 0 also set fsGroup to the same value: - runAsUser: 1000 - fsGroup: 1000 - securityContextCapabilities: {} - # drop: - # - NET_RAW -cronJob: - apiVersion: batch/v1 - -checkDeprecation: true - -awsSecurityGroupPolicies: - enabled: false - policies: - - name: "" - securityGroupIds: [] - podSelector: {} - -# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md -helmtest: - # A testing framework for bash - bats: - # Bash Automated Testing System (BATS) - image: "bats/bats" - tag: "1.9.0"