gitadmin/devops-infra-helm-charts-gcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added jenkins

Browse Source
This commit is contained in:
Mukul Sharma
2026-08-31 09:41:39 +05:30
parent 5c0e7b04e3
commit 0be12f5fc7
143 changed files with 51 additions and 33325 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm-overrides/k8s-admin-prd-ase1/jenkins-admin/custom-values.yaml
-1009
View File
File diff suppressed because it is too large Load Diff
helm-overrides/k8s-admin-prd-ase1/jenkins/custom-values.yaml
+36 -1230
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins-grn/.helmignore
-26
View File
@@ -1,26 +0,0 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*~
# Various IDEs
.project
.idea/
*.tmproj
ci/
# do not package unittests
unittests/
Tiltfile
.helmignore
helm-templates/jenkins-grn/CHANGELOG.md
-3472
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins-grn/Chart.yaml
-47
View File
@@ -1,47 +0,0 @@
apiVersion: v2
name: jenkins
type: application
home: https://www.jenkins.io/
version: 5.8.58
appVersion: 2.504.2
description: >
Jenkins - Build great things at any scale! As the leading open source automation server, Jenkins provides over 2000 plugins to support building, deploying and automating any project.
sources:
- https://github.com/jenkinsci/jenkins
- https://github.com/jenkinsci/docker-inbound-agent
- https://github.com/maorfr/kube-tasks
- https://github.com/jenkinsci/configuration-as-code-plugin
maintainers:
- name: maorfr
email: maor.friedman@redhat.com
- name: torstenwalter
email: mail@torstenwalter.de
- name: mogaal
email: garridomota@gmail.com
- name: wmcdona89
email: wmcdona89@gmail.com
- name: timja
email: timjacomb1@gmail.com
icon: https://get.jenkins.io/art/jenkins-logo/logo.svg
keywords:
- jenkins
- ci
- devops
annotations:
artifacthub.io/links: |
- name: Chart Source
url: https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins
- name: Jenkins
url: https://www.jenkins.io/
- name: support
url: https://github.com/jenkinsci/helm-charts/issues
artifacthub.io/images: |
- name: jenkins
image: docker.io/jenkins/jenkins:2.504.2-jdk21
- name: k8s-sidecar
image: docker.io/kiwigrid/k8s-sidecar:1.30.3
- name: inbound-agent
image: jenkins/inbound-agent:3309.v27b_9314fd1a_4-4
artifacthub.io/category: "integration-delivery"
artifacthub.io/license: "Apache-2.0"
helm-templates/jenkins-grn/README.md
-723
View File
@@ -1,723 +0,0 @@
# Jenkins
[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/jenkins)](https://artifacthub.io/packages/helm/jenkinsci/jenkins)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
[![Releases downloads](https://img.shields.io/github/downloads/jenkinsci/helm-charts/total.svg)](https://github.com/jenkinsci/helm-charts/releases)
[![Join the chat at https://app.gitter.im/#/room/#jenkins-ci:matrix.org](https://badges.gitter.im/badge.svg)](https://app.gitter.im/#/room/#jenkins-ci:matrix.org)
[Jenkins](https://www.jenkins.io/) is the leading open source automation server, Jenkins provides over 2000 plugins to support building, deploying and automating any project.
This chart installs a Jenkins server which spawns agents on [Kubernetes](http://kubernetes.io) utilizing the [Jenkins Kubernetes plugin](https://plugins.jenkins.io/kubernetes/).
Inspired by the awesome work of [Carlos Sanchez](https://github.com/carlossg).
## Get Repository Info
```console
helm repo add jenkins https://charts.jenkins.io
helm repo update
```
_See [`helm repo`](https://helm.sh/docs/helm/helm_repo/) for command documentation._
## Install Chart
```console
helm install [RELEASE_NAME] jenkins/jenkins [flags]
```
Since version `5.6.0` the chart is available as an OCI image and can be installed using:
```console
helm install [RELEASE_NAME] oci://ghcr.io/jenkinsci/helm-charts/jenkins [flags]
```
_See [configuration](#configuration) below._
_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
## Uninstall Chart
```console
# Helm 3
$ helm uninstall [RELEASE_NAME]
```
This removes all the Kubernetes components associated with the chart and deletes the release.
_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
## Upgrade Chart
```console
# Helm 3
$ helm upgrade [RELEASE_NAME] jenkins/jenkins [flags]
```
_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
Visit the chart's [CHANGELOG](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/CHANGELOG.md) to view the chart's release history.
For migration between major version check [migration guide](#migration-guide).
## Building weekly releases
The default charts target Long-Term-Support (LTS) releases of Jenkins.
To use other versions the easiest way is to update the image tag to the version you want.
You can also rebuild the chart if you want the `appVersion` field to match.
## Configuration
See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing).
To see all configurable options with detailed comments, visit the chart's [values.yaml](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/values.yaml), or run these configuration commands:
```console
# Helm 3
$ helm show values jenkins/jenkins
```
For a summary of all configurable options, see [VALUES.md](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES.md).
### Configure Security Realm and Authorization Strategy
This chart configured a `securityRealm` and `authorizationStrategy` as shown below:
```yaml
controller:
JCasC:
securityRealm: |-
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
authorizationStrategy: |-
loggedInUsersCanDoAnything:
allowAnonymousRead: false
```
With the configuration above there is only a single user.
This is fine for getting started quickly, but it needs to be adjusted for any serious environment.
So you should adjust this to suite your needs.
That could be using LDAP / OIDC / .. as authorization strategy and use globalMatrix as authorization strategy to configure more fine-grained permissions.
### Consider using a custom image
This chart allows the user to specify plugins which should be installed. However, for production use cases one should consider to build a custom Jenkins image which has all required plugins pre-installed.
This way you can be sure which plugins Jenkins is using when starting up and you avoid trouble in case of connectivity issues to the Jenkins update site.
The [docker repository](https://github.com/jenkinsci/docker) for the Jenkins image contains [documentation](https://github.com/jenkinsci/docker#preinstalling-plugins) how to do it.
Here is an example how that can be done:
```Dockerfile
FROM jenkins/jenkins:lts
RUN jenkins-plugin-cli --plugins kubernetes workflow-aggregator git configuration-as-code
```
NOTE: If you want a reproducible build then you should specify a non-floating tag for the image `jenkins/jenkins:2.249.3` and specify plugin versions.
Once you built the image and pushed it to your registry you can specify it in your values file like this:
```yaml
controller:
image: "registry/my-jenkins"
tag: "v1.2.3"
installPlugins: false
```
Notice: `installPlugins` is set to false to disable plugin download. In this case, the image `registry/my-jenkins:v1.2.3` must have the plugins specified as default value for [the `controller.installPlugins` directive](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins) to ensure that the configuration side-car system works as expected.
In case you are using a private registry you can use 'imagePullSecretName' to specify the name of the secret to use when pulling the image:
```yaml
controller:
image: "registry/my-jenkins"
tag: "v1.2.3"
imagePullSecretName: registry-secret
installPlugins: false
```
### External URL Configuration
If you are using the ingress definitions provided by this chart via the `controller.ingress` block the configured hostname will be the ingress hostname starting with `https://` or `http://` depending on the `tls` configuration.
The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`.
If you are not using the provided ingress you can specify `controller.jenkinsUrl` to change the URL definition.
### Configuration as Code
Jenkins Configuration as Code (JCasC) is now a standard component in the Jenkins project.
To allow JCasC's configuration from the helm values, the plugin [`configuration-as-code`](https://plugins.jenkins.io/configuration-as-code/) must be installed in the Jenkins Controller's Docker image (which is the case by default as specified by the [default value of the directive `controller.installPlugins`](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-plugins)).
JCasc configuration is passed through Helm values under the key `controller.JCasC`.
The section ["Jenkins Configuration as Code (JCasC)" of the page "VALUES_SUMMARY.md"](https://github.com/jenkinsci/helm-charts/blob/main/charts/jenkins/VALUES_SUMMARY.md#jenkins-configuration-as-code-jcasc) lists all the possible directives.
In particular, you may specify custom JCasC scripts by adding sub-key under the `controller.JCasC.configScripts` for each configuration area where each corresponds to a plugin or section of the UI.
The sub-keys (prior to `|` character) are only labels used to give the section a meaningful name.
The only restriction is they must conform to RFC 1123 definition of a DNS label, so they may only contain lowercase letters, numbers, and hyphens.
Each key will become the name of a configuration yaml file on the controller in `/var/jenkins_home/casc_configs` (by default) and will be processed by the Configuration as Code Plugin during Jenkins startup.
The lines after each `|` become the content of the configuration yaml file.
The first line after this is a JCasC root element, e.g. jenkins, credentials, etc.
Best reference is the Documentation link here: `https://<jenkins_url>/configuration-as-code`.
The example below sets custom systemMessage:
```yaml
controller:
JCasC:
configScripts:
welcome-message: |
jenkins:
systemMessage: Welcome to our CI\CD server.
```
More complex example that creates ldap settings:
```yaml
controller:
JCasC:
configScripts:
ldap-settings: |
jenkins:
securityRealm:
ldap:
configurations:
- server: ldap.acme.com
rootDN: dc=acme,dc=uk
managerPasswordSecret: ${LDAP_PASSWORD}
groupMembershipStrategy:
fromUserRecord:
attributeName: "memberOf"
```
Keep in mind that default configuration file already contains some values that you won't be able to override under configScripts section.
For example, you can not configure Jenkins URL and System Admin email address like this because of conflicting configuration error.
Incorrect:
```yaml
controller:
JCasC:
configScripts:
jenkins-url: |
unclassified:
location:
url: https://example.com/jenkins
adminAddress: example@mail.com
```
Correct:
```yaml
controller:
jenkinsUrl: https://example.com/jenkins
jenkinsAdminEmail: example@mail.com
```
Further JCasC examples can be found [here](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos).
#### Breaking out large Config as Code scripts
Jenkins Config as Code scripts can become quite large, and maintaining all of your scripts within one yaml file can be difficult. The Config as Code plugin itself suggests updating the `CASC_JENKINS_CONFIG` environment variable to be a comma separated list of paths for the plugin to traverse, picking up the yaml files as needed.
However, under the Jenkins helm chart, this `CASC_JENKINS_CONFIG` value is maintained through the templates. A better solution is to split your `controller.JCasC.configScripts` into separate values files, and provide each file during the helm install.
For example, you can have a values file (e.g values_main.yaml) that defines the values described in the `VALUES_SUMMARY.md` for your Jenkins configuration:
```yaml
jenkins:
controller:
jenkinsUrlProtocol: https
installPlugins: false
...
```
In a second file (e.g values_jenkins_casc.yaml), you can define a section of your config scripts:
```yaml
jenkins:
controller:
JCasC:
configScripts:
jenkinsCasc: |
jenkins:
disableRememberMe: false
mode: NORMAL
...
```
And keep extending your config scripts by creating more files (so not all config scripts are located in one yaml file for better maintenance):
values_jenkins_unclassified.yaml
```yaml
jenkins:
controller:
JCasC:
configScripts:
unclassifiedCasc: |
unclassified:
...
```
When installing, you provide all relevant yaml files (e.g `helm install -f values_main.yaml -f values_jenkins_casc.yaml -f values_jenkins_unclassified.yaml ...`). Instead of updating the `CASC_JENKINS_CONFIG` environment variable to include multiple paths, multiple CasC yaml files will be created in the same path `var/jenkins_home/casc_configs`.
#### Config as Code With or Without Auto-Reload
Config as Code changes (to `controller.JCasC.configScripts`) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly.
If you set `controller.sidecars.configAutoReload.enabled` to `true`, a second, auxiliary container will be installed into the Jenkins controller pod, known as a "sidecar".
This watches for changes to configScripts, copies the content onto the Jenkins file-system and issues a POST to `http://<jenkins_url>/reload-configuration-as-code` with a pre-shared key.
You can monitor this sidecar's logs using command `kubectl logs <controller_pod> -c config-reload -f`.
If you want to enable auto-reload then you also need to configure rbac as the container which triggers the reload needs to watch the config maps:
```yaml
controller:
sidecars:
configAutoReload:
enabled: true
rbac:
create: true
```
### Allow Limited HTML Markup in User-Submitted Text
Some third-party systems (e.g. GitHub) use HTML-formatted data in their payload sent to a Jenkins webhook (e.g. URL of a pull-request being built).
To display such data as processed HTML instead of raw text set `controller.enableRawHtmlMarkupFormatter` to true.
This option requires installation of the [OWASP Markup Formatter Plugin (antisamy-markup-formatter)](https://plugins.jenkins.io/antisamy-markup-formatter/).
This plugin is **not** installed by default but may be added to `controller.additionalPlugins`.
### Change max connections to Kubernetes API
When using agents with containers other than JNLP, The kubernetes plugin will communicate with those containers using the Kubernetes API. this changes the maximum concurrent connections
```yaml
agent:
maxRequestsPerHostStr: "32"
```
This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart.
### Change container cleanup timeout API
For tasks that use very large images, this timeout can be increased to avoid early termination of the task while the Kubernetes pod is still deploying.
```yaml
agent:
retentionTimeout: "32"
```
This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart.
### Change seconds to wait for pod to be running
This will change how long Jenkins will wait (seconds) for pod to be in running state.
```yaml
agent:
waitForPodSec: "32"
```
This will change the configuration of the kubernetes "cloud" (as called by jenkins) that is created automatically as part of this helm chart.
### Mounting Volumes into Agent Pods
Your Jenkins Agents will run as pods, and it's possible to inject volumes where needed:
```yaml
agent:
volumes:
- type: Secret
secretName: jenkins-mysecrets
mountPath: /var/run/secrets/jenkins-mysecrets
```
The supported volume types are: `ConfigMap`, `EmptyDir`, `HostPath`, `Nfs`, `PVC`, `Secret`.
Each type supports a different set of configurable attributes, defined by [the corresponding Java class](https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes).
### NetworkPolicy
To make use of the NetworkPolicy resources created by default, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin).
[Install](#install-chart) helm chart with network policy enabled by setting `networkPolicy.enabled` to `true`.
You can use `controller.networkPolicy.internalAgents` and `controller.networkPolicy.externalAgents` stanzas for fine-grained controls over where internal/external agents can connect from.
Internal ones are allowed based on pod labels and (optionally) namespaces, and external ones are allowed based on IP ranges.
### Script approval list
`controller.scriptApproval` allows to pass function signatures that will be allowed in pipelines.
Example:
```yaml
controller:
scriptApproval:
- "method java.util.Base64$Decoder decode java.lang.String"
- "new java.lang.String byte[]"
- "staticMethod java.util.Base64 getDecoder"
```
### Custom Labels
`controller.serviceLabels` can be used to add custom labels in `jenkins-controller-svc.yaml`.
For example:
```yaml
ServiceLabels:
expose: true
```
### Persistence
The Jenkins image stores persistence under `/var/jenkins_home` path of the container.
A dynamically managed Persistent Volume Claim is used to keep the data across deployments, by default.
This is known to work in GCE, AWS, and minikube. Alternatively, a previously configured Persistent Volume Claim can be used.
It is possible to mount several volumes using `persistence.volumes` and `persistence.mounts` parameters.
See additional `persistence` values using [configuration commands](#configuration).
#### Existing PersistentVolumeClaim
1. Create the PersistentVolume
2. Create the PersistentVolumeClaim
3. [Install](#install-chart) the chart, setting `persistence.existingClaim` to `PVC_NAME`
#### Long Volume Attach-/Mount Times
Certain volume type and filesystem format combinations may experience long
attach/mount times, [10 or more minutes][K8S_VOLUME_TIMEOUT], when using
`fsGroup`. This issue may result in the following entries in the pod's event
history:
```console
Warning FailedMount 38m kubelet, aks-default-41587790-2 Unable to attach or mount volumes: unmounted volumes=[jenkins-home], unattached volumes=[plugins plugin-dir jenkins-token-rmq2g sc-config-volume tmp jenkins-home jenkins-config secrets-dir]: timed out waiting for the condition
```
In these cases, experiment with replacing `fsGroup` with
`supplementalGroups` in the pod's `securityContext`. This can be achieved by
setting the `controller.podSecurityContextOverride` Helm chart value to
something like:
```yaml
controller:
podSecurityContextOverride:
runAsNonRoot: true
runAsUser: 1000
supplementalGroups: [1000]
```
This issue has been reported on [azureDisk with ext4][K8S_VOLUME_TIMEOUT] and
on [Alibaba cloud][K8S_VOLUME_TIMEOUT_ALIBABA].
[K8S_VOLUME_TIMEOUT]: https://github.com/kubernetes/kubernetes/issues/67014
[K8S_VOLUME_TIMEOUT_ALIBABA]: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-698770511
#### Storage Class
It is possible to define which storage class to use, by setting `persistence.storageClass` to `[customStorageClass]`.
If set to a dash (`-`), dynamic provisioning is disabled.
If the storage class is set to null or left undefined (`""`), the default provisioner is used (gp2 on AWS, standard on GKE, AWS & OpenStack).
### Additional Secrets
Additional secrets and Additional Existing Secrets,
can be mounted into the Jenkins controller through the chart or created using `controller.additionalSecrets` or `controller.additionalExistingSecrets`.
A common use case might be identity provider credentials if using an external LDAP or OIDC-based identity provider.
The secret may then be referenced in JCasC configuration (see [JCasC configuration](#configuration-as-code)).
`values.yaml` controller section, referencing mounted secrets:
```yaml
controller:
# the 'name' and 'keyName' are concatenated with a '-' in between, so for example:
# an existing secret "secret-credentials" and a key inside it named "github-password" should be used in Jcasc as ${secret-credentials-github-password}
# 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-',
# and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc')
# existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in Jcasc as ${github-username}
# When using existingSecret no need to specify the keyName under additionalExistingSecrets.
existingSecret: secret-credentials
additionalExistingSecrets:
- name: secret-credentials
keyName: github-username
- name: secret-credentials
keyName: github-password
- name: secret-credentials
keyName: token
additionalSecrets:
- name: client_id
value: abc123
- name: client_secret
value: xyz999
JCasC:
securityRealm: |
oic:
clientId: ${client_id}
clientSecret: ${client_secret}
...
configScripts:
jenkins-casc-configs: |
credentials:
system:
domainCredentials:
- credentials:
- string:
description: "github access token"
id: "github_app_token"
scope: GLOBAL
secret: ${secret-credentials-token}
- usernamePassword:
description: "github access username password"
id: "github_username_pass"
password: ${secret-credentials-github-password}
scope: GLOBAL
username: ${secret-credentials-github-username}
```
For more information, see [JCasC documentation](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets).
### Secret Claims from HashiCorp Vault
It's possible for this chart to generate `SecretClaim` resources in order to automatically create and maintain Kubernetes `Secrets` from HashiCorp [Vault](https://www.vaultproject.io/) via [`kube-vault-controller`](https://github.com/roboll/kube-vault-controller)
These `Secrets` can then be referenced in the same manner as Additional Secrets above.
This can be achieved by defining required Secret Claims within `controller.secretClaims`, as follows:
```yaml
controller:
secretClaims:
- name: jenkins-secret
path: secret/path
- name: jenkins-short-ttl
path: secret/short-ttl-path
renew: 60
```
### RBAC
RBAC is enabled by default. If you want to disable it you will need to set `rbac.create` to `false`.
### Adding Custom Pod Templates
It is possible to add custom pod templates for the default configured kubernetes cloud.
Add a key under `agent.podTemplates` for each pod template. Each key (prior to `|` character) is just a label, and can be any value.
Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers.
There's no need to add the _jnlp_ container since the kubernetes plugin will automatically inject it into the pod.
For this pod templates configuration to be loaded the following values must be set:
```yaml
controller.JCasC.defaultConfig: true
```
The example below creates a python pod template in the kubernetes cloud:
```yaml
agent:
podTemplates:
python: |
- name: python
label: jenkins-python
serviceAccount: jenkins
containers:
- name: python
image: python:3
command: "/bin/sh -c"
args: "cat"
ttyEnabled: true
privileged: true
resourceRequestCpu: "400m"
resourceRequestMemory: "512Mi"
resourceLimitCpu: "1"
resourceLimitMemory: "1024Mi"
```
Best reference is `https://<jenkins_url>/configuration-as-code/reference#Cloud-kubernetes`.
### Adding Pod Templates Using additionalAgents
`additionalAgents` may be used to configure additional kubernetes pod templates.
Each additional agent corresponds to `agent` in terms of the configurable values and inherits all values from `agent` so you only need to specify values which differ.
For example:
```yaml
agent:
podName: default
customJenkinsLabels: default
# set resources for additional agents to inherit
resources:
limits:
cpu: "1"
memory: "2048Mi"
additionalAgents:
maven:
podName: maven
customJenkinsLabels: maven
# An example of overriding the jnlp container
# sideContainerName: jnlp
image: jenkins/jnlp-agent-maven
tag: latest
python:
podName: python
customJenkinsLabels: python
sideContainerName: python
image: python
tag: "3"
command: "/bin/sh -c"
args: "cat"
TTYEnabled: true
```
### Ingress Configuration
This chart provides ingress resources configurable via the `controller.ingress` block.
The simplest configuration looks like the following:
```yaml
controller:
ingress:
enabled: true
paths: []
apiVersion: "extensions/v1beta1"
hostName: jenkins.example.com
```
This snippet configures an ingress rule for exposing jenkins at `jenkins.example.com`
You can define labels and annotations via `controller.ingress.labels` and `controller.ingress.annotations` respectively.
Additionally, you can configure the ingress tls via `controller.ingress.tls`.
By default, this ingress rule exposes all paths.
If needed this can be overwritten by specifying the wanted paths in `controller.ingress.paths`
If you want to configure a secondary ingress e.g. you don't want the jenkins instance exposed but still want to receive webhooks you can configure `controller.secondaryingress`.
The secondaryingress doesn't expose anything by default and has to be configured via `controller.secondaryingress.paths`:
```yaml
controller:
ingress:
enabled: true
apiVersion: "extensions/v1beta1"
hostName: "jenkins.internal.example.com"
annotations:
kubernetes.io/ingress.class: "internal"
secondaryingress:
enabled: true
apiVersion: "extensions/v1beta1"
hostName: "jenkins-scm.example.com"
annotations:
kubernetes.io/ingress.class: "public"
paths:
- /github-webhook
```
## Prometheus Metrics
If you want to expose Prometheus metrics you need to install the [Jenkins Prometheus Metrics Plugin](https://github.com/jenkinsci/prometheus-plugin).
It will expose an endpoint (default `/prometheus`) with metrics where a Prometheus Server can scrape.
If you have implemented [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator), you can set `controller.prometheus.enabled` to `true` to configure a `ServiceMonitor` and `PrometheusRule`.
If you want to further adjust alerting rules you can do so by configuring `controller.prometheus.alertingrules`
If you have implemented Prometheus without using the operator, you can leave `controller.prometheus.enabled` set to `false`.
### Running Behind a Forward Proxy
The controller pod uses an Init Container to install plugins etc. If you are behind a corporate proxy it may be useful to set `controller.initContainerEnv` to add environment variables such as `http_proxy`, so that these can be downloaded.
Additionally, you may want to add env vars for the init container, the Jenkins container, and the JVM (`controller.javaOpts`):
```yaml
controller:
initContainerEnv:
- name: http_proxy
value: "http://192.168.64.1:3128"
- name: https_proxy
value: "http://192.168.64.1:3128"
- name: no_proxy
value: ""
- name: JAVA_OPTS
value: "-Dhttps.proxyHost=proxy_host_name_without_protocol -Dhttps.proxyPort=3128"
containerEnv:
- name: http_proxy
value: "http://192.168.64.1:3128"
- name: https_proxy
value: "http://192.168.64.1:3128"
javaOpts: >-
-Dhttp.proxyHost=192.168.64.1
-Dhttp.proxyPort=3128
-Dhttps.proxyHost=192.168.64.1
-Dhttps.proxyPort=3128
```
### HTTPS Keystore Configuration
[This configuration](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777) enables jenkins to use keystore in order to serve HTTPS.
Here is the [value file section](https://wiki.jenkins.io/pages/viewpage.action?pageId=135468777#RunningJenkinswithnativeSSL/HTTPS-ConfigureJenkinstouseHTTPSandtheJKSkeystore) related to keystore configuration.
Keystore itself should be placed in front of `jenkinsKeyStoreBase64Encoded` key and in base64 encoded format. To achieve that after having `keystore.jks` file simply do this: `cat keystore.jks | base64` and paste the output in front of `jenkinsKeyStoreBase64Encoded`.
After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same, as `targetPort` will serve HTTPS.
Do not set `controller.httpsKeyStore.httpPort` to `-1` because it will cause readiness and liveliness prob to fail.
If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` (or override the key name using `jenkinsHttpsJksSecretKey`)
and `https-jks-password` (or override the key name using `jenkinsHttpsJksPasswordSecretKey`; additionally you can make it get the password from a different secret using `jenkinsHttpsJksPasswordSecretName`). Example:
```yaml
controller:
httpsKeyStore:
enable: true
jenkinsHttpsJksSecretName: ""
httpPort: 8081
path: "/var/jenkins_keystore"
fileName: "keystore.jks"
password: "changeit"
jenkinsKeyStoreBase64Encoded: ""
```
### AWS Security Group Policies
To create SecurityGroupPolicies set `awsSecurityGroupPolicies.enabled` to true and add your policies. Each policy requires a `name`, array of `securityGroupIds` and a `podSelector`. Example:
```yaml
awsSecurityGroupPolicies:
enabled: true
policies:
- name: "jenkins-controller"
securityGroupIds:
- sg-123456789
podSelector:
matchExpressions:
- key: app.kubernetes.io/component
operator: In
values:
- jenkins-controller
```
### Agent Direct Connection
Set `directConnection` to `true` to allow agents to connect directly to a given TCP port without having to negotiate a HTTP(S) connection. This can allow you to have agent connections without an external HTTP(S) port. Example:
```yaml
agent:
jenkinsTunnel: "jenkinsci-agent:50000"
directConnection: true
```
## Migration Guide
### From stable repository
Upgrade an existing release from `stable/jenkins` to `jenkins/jenkins` seamlessly by ensuring you have the latest [repository info](#get-repository-info) and running the [upgrade commands](#upgrade-chart) specifying the `jenkins/jenkins` chart.
### Major Version Upgrades
Chart release versions follow [SemVer](../../CONTRIBUTING.md#versioning), where a MAJOR version change (example `1.0.0` -> `2.0.0`) indicates an incompatible breaking change needing manual actions.
See [UPGRADING.md](./UPGRADING.md) for a list of breaking changes
helm-templates/jenkins-grn/Tiltfile
-5
View File
@@ -1,5 +0,0 @@
# If not using a standard local dev name, specify your k8s context here
#allow_k8s_contexts('jenkins-dev')
k8s_yaml(helm('.', values='values.yaml', set=['controller.admin.password=asdf']))
watch_file('.')
helm-templates/jenkins-grn/UPGRADING.md
-151
View File
@@ -1,151 +0,0 @@
# Upgrade Notes
## To 5.0.0
- `controller.image`, `controller.tag`, and `controller.tagLabel` have been removed. If you want to overwrite the image you now need to configure any or all of:
- `controller.image.registry`
- `controller.image.repository`
- `controller.image.tag`
- `controller.image.tagLabel`
- `controller.imagePullPolicy` has been removed. If you want to overwrite the pull policy you now need to configure `controller.image.pullPolicy`.
- `controller.sidecars.configAutoReload.image` has been removed. If you want to overwrite the configAutoReload image you now need to configure any or all of:
- `controller.sidecars.configAutoReload.image.registry`
- `controller.sidecars.configAutoReload.image.repository`
- `controller.sidecars.configAutoReload.image.tag`
- `controller.sidecars.other` has been renamed to `controller.sidecars.additionalSidecarContainers`.
- `agent.image` and `agent.tag` have been removed. If you want to overwrite the agent image you now need to configure any or all of:
- `agent.image.repository`
- `agent.image.tag`
- The registry can still be overwritten by `agent.jnlpregistry`
- `agent.additionalContainers[*].image` has been renamed to `agent.additionalContainers[*].image.repository`
- `agent.additionalContainers[*].tag` has been renamed to `agent.additionalContainers[*].image.tag`
- `additionalAgents.*.image` has been renamed to `additionalAgents.*.image.repository`
- `additionalAgents.*.tag` has been renamed to `additionalAgents.*.image.tag`
- `additionalClouds.*.additionalAgents.*.image` has been renamed to `additionalClouds.*.additionalAgents.*.image.repository`
- `additionalClouds.*.additionalAgents.*.tag` has been renamed to `additionalClouds.*.additionalAgents.*.image.tag`
- `helmtest.bats.image` has been split up to:
- `helmtest.bats.image.registry`
- `helmtest.bats.image.repository`
- `helmtest.bats.image.tag`
- `controller.adminUsername` and `controller.adminPassword` have been renamed to `controller.admin.username` and `controller.admin.password` respectively
- `controller.adminSecret` has been renamed to `controller.admin.createSecret`
- `backup.*` was unmaintained and has thus been removed. See the following page for alternatives: [Kubernetes Backup and Migrations](https://nubenetes.com/kubernetes-backup-migrations/).
## To 4.0.0
Removes automatic `remotingSecurity` setting when using a container tag older than `2.326` (introduced in [`3.11.7`](./CHANGELOG.md#3117)). If you're using a version older than `2.326`, you should explicitly set `.controller.legacyRemotingSecurityEnabled` to `true`.
## To 3.0.0
- Check `securityRealm` and `authorizationStrategy` and adjust it.
Otherwise, your configured users and permissions will be overridden.
- You need to use helm version 3 as the `Chart.yaml` uses `apiVersion: v2`.
- All XML configuration options have been removed.
In case those are still in use you need to migrate to configuration as code.
Upgrade guide to 2.0.0 contains pointers how to do that.
- Jenkins is now using a `StatefulSet` instead of a `Deployment`
- terminology has been adjusted that's also reflected in values.yaml
The following values from `values.yaml` have been renamed:
- `master` => `controller`
- `master.useSecurity` => `controller.adminSecret`
- `master.slaveListenerPort` => `controller.agentListenerPort`
- `master.slaveHostPort` => `controller.agentListenerHostPort`
- `master.slaveKubernetesNamespace` => `agent.namespace`
- `master.slaveDefaultsProviderTemplate` => `agent.defaultsProviderTemplate`
- `master.slaveJenkinsUrl` => `agent.jenkinsUrl`
- `master.slaveJenkinsTunnel` => `agent.jenkinsTunnel`
- `master.slaveConnectTimeout` => `agent.kubernetesConnectTimeout`
- `master.slaveReadTimeout` => `agent.kubernetesReadTimeout`
- `master.slaveListenerServiceAnnotations` => `controller.agentListenerServiceAnnotations`
- `master.slaveListenerServiceType` => `controller.agentListenerServiceType`
- `master.slaveListenerLoadBalancerIP` => `controller.agentListenerLoadBalancerIP`
- `agent.slaveConnectTimeout` => `agent.connectTimeout`
- Removed values:
- `master.imageTag`: use `controller.image` and `controller.tag` instead
- `slave.imageTag`: use `agent.image` and `agent.tag` instead
## To 2.0.0
Configuration as Code is now default + container does not run as root anymore.
### Configuration as Code new default
Configuration is done via [Jenkins Configuration as Code Plugin](https://github.com/jenkinsci/configuration-as-code-plugin) by default.
That means that changes in values which result in a configuration change are always applied.
In contrast, the XML configuration was only applied during the first start and never altered.
:exclamation::exclamation::exclamation:
Attention:
This also means if you manually altered configuration then this will most likely be reset to what was configured by default.
It also applies to `securityRealm` and `authorizationStrategy` as they are also configured using configuration as code.
:exclamation::exclamation::exclamation:
### Image does not run as root anymore
It's not recommended to run containers in Kubernetes as `root`.
❗Attention: If you had not configured a different user before then you need to ensure that your image supports the user and group ID configured and also manually change permissions of all files so that Jenkins is still able to use them.
### Summary of updated values
As version 2.0.0 only updates default values and nothing else it's still possible to migrate to this version and opt out of some or all new defaults.
All you have to do is ensure the old values are set in your installation.
Here we show which values have changed and the previous default values:
```yaml
controller:
runAsUser: 1000 # was unset before
fsGroup: 1000 # was unset before
JCasC:
enabled: true # was false
defaultConfig: true # was false
sidecars:
configAutoReload:
enabled: true # was false
```
### Migration steps
Migration instructions heavily depend on your current setup.
So think of the list below more as a general guideline of what should be done.
- Ensure that the Jenkins image you are using contains a user with ID 1000 and a group with the same ID.
That's the case for `jenkins/jenkins:lts` image, which the chart uses by default
- Make a backup of your existing installation especially the persistent volume
- Ensure that you have the configuration as code plugin installed
- Export your current settings via the plugin:
`Manage Jenkins` -> `Configuration as Code` -> `Download Configuration`
- prepare your values file for the update e.g. add additional configuration as code setting that you need.
The export taken from above might be a good starting point for this.
In addition, the [demos](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) from the plugin itself are quite useful.
- Test drive those setting on a separate installation
- Put Jenkins to Quiet Down mode so that it does not accept new jobs
`<JENKINS_URL>/quietDown`
- Change permissions of all files and folders to the new user and group ID:
```console
kubectl exec -it <jenkins_pod> -c jenkins /bin/bash
chown -R 1000:1000 /var/jenkins_home
```
- Update Jenkins
## To 1.0.0
Breaking changes:
- Values have been renamed to follow [helm recommended naming conventions](https://helm.sh/docs/chart_best_practices/#naming-conventions) so that all variables start with a lowercase letter and words are separated with camelCase
- All resources are now using [helm recommended standard labels](https://helm.sh/docs/chart_best_practices/#standard-labels)
As a result of the label changes also the selectors of the deployment have been updated.
Those are immutable so trying an updated will cause an error like:
```console
Error: Deployment.apps "jenkins" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"app.kubernetes.io/component":"jenkins-controller", "app.kubernetes.io/instance":"jenkins"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: field is immutable
```
In order to upgrade, [uninstall](./README.md#uninstall-chart) the Jenkins Deployment before upgrading:
helm-templates/jenkins-grn/VALUES.md
-324
View File
@@ -1,324 +0,0 @@
# Jenkins
## Configuration
The following tables list the configurable parameters of the Jenkins chart and their default values.
## Values
| Key | Type | Description | Default |
|:----|:-----|:---------|:------------|
| [additionalAgents](./values.yaml#L1207) | object | Configure additional | `{}` |
| [additionalClouds](./values.yaml#L1232) | object | | `{}` |
| [agent.TTYEnabled](./values.yaml#L1112) | bool | Allocate pseudo tty to the side container | `false` |
| [agent.additionalContainers](./values.yaml#L1160) | list | Add additional containers to the agents | `[]` |
| [agent.alwaysPullImage](./values.yaml#L1005) | bool | Always pull agent container image before build | `false` |
| [agent.annotations](./values.yaml#L1156) | object | Annotations to apply to the pod | `{}` |
| [agent.args](./values.yaml#L1106) | string | Arguments passed to command to execute | `"${computer.jnlpmac} ${computer.name}"` |
| [agent.command](./values.yaml#L1104) | string | Command to execute when side container starts | `nil` |
| [agent.componentName](./values.yaml#L973) | string | | `"jenkins-agent"` |
| [agent.connectTimeout](./values.yaml#L1154) | int | Timeout in seconds for an agent to be online | `100` |
| [agent.containerCap](./values.yaml#L1114) | int | Max number of agents to launch for a whole cluster. | `10` |
| [agent.customJenkinsLabels](./values.yaml#L970) | list | Append Jenkins labels to the agent | `[]` |
| [agent.defaultsProviderTemplate](./values.yaml#L922) | string | The name of the pod template to use for providing default values | `""` |
| [agent.directConnection](./values.yaml#L976) | bool | | `false` |
| [agent.disableDefaultAgent](./values.yaml#L1178) | bool | Disable the default Jenkins Agent configuration | `false` |
| [agent.enabled](./values.yaml#L920) | bool | Enable Kubernetes plugin jnlp-agent podTemplate | `true` |
| [agent.envVars](./values.yaml#L1087) | list | Environment variables for the agent Pod | `[]` |
| [agent.garbageCollection.enabled](./values.yaml#L1123) | bool | When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them. | `false` |
| [agent.garbageCollection.namespaces](./values.yaml#L1125) | string | Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line. | `""` |
| [agent.garbageCollection.timeout](./values.yaml#L1130) | int | Timeout value for orphaned pods | `300` |
| [agent.hostNetworking](./values.yaml#L984) | bool | Enables the agent to use the host network | `false` |
| [agent.idleMinutes](./values.yaml#L1133) | int | Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it | `0` |
| [agent.image.registry](./values.yaml#L961) | string | Registry to pull the agent jnlp image from | `""` |
| [agent.image.repository](./values.yaml#L963) | string | Repository to pull the agent jnlp image from | `"jenkins/inbound-agent"` |
| [agent.image.tag](./values.yaml#L965) | string | Tag of the image to pull | `"3309.v27b_9314fd1a_4-4"` |
| [agent.imagePullSecretName](./values.yaml#L972) | string | Name of the secret to be used to pull the image | `nil` |
| [agent.inheritYamlMergeStrategy](./values.yaml#L1152) | bool | Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one | `false` |
| [agent.instanceCap](./values.yaml#L1116) | int | Max number of agents to launch for this type of agent | `2147483647` |
| [agent.jenkinsTunnel](./values.yaml#L938) | string | Overrides the Kubernetes Jenkins tunnel | `nil` |
| [agent.jenkinsUrl](./values.yaml#L934) | string | Overrides the Kubernetes Jenkins URL | `nil` |
| [agent.jnlpregistry](./values.yaml#L958) | string | Custom registry used to pull the agent jnlp image from | `nil` |
| [agent.kubernetesConnectTimeout](./values.yaml#L944) | int | The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5 | `5` |
| [agent.kubernetesReadTimeout](./values.yaml#L946) | int | The read timeout in seconds for connections to Kubernetes API. The minimum value is 15 | `15` |
| [agent.livenessProbe](./values.yaml#L995) | object | | `{}` |
| [agent.maxRequestsPerHostStr](./values.yaml#L948) | string | The maximum concurrent connections to Kubernetes API | `"32"` |
| [agent.namespace](./values.yaml#L954) | string | Namespace in which the Kubernetes agents should be launched | `nil` |
| [agent.nodeSelector](./values.yaml#L1098) | object | Node labels for pod assignment | `{}` |
| [agent.nodeUsageMode](./values.yaml#L968) | string | | `"NORMAL"` |
| [agent.podLabels](./values.yaml#L956) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` |
| [agent.podName](./values.yaml#L1118) | string | Agent Pod base name | `"default"` |
| [agent.podRetention](./values.yaml#L1014) | string | | `"Never"` |
| [agent.podTemplates](./values.yaml#L1188) | object | Configures extra pod templates for the default kubernetes cloud | `{}` |
| [agent.privileged](./values.yaml#L978) | bool | Agent privileged container | `false` |
| [agent.resources](./values.yaml#L986) | object | Resources allocation (Requests and Limits) | `{"limits":{"cpu":"512m","memory":"512Mi"},"requests":{"cpu":"512m","memory":"512Mi"}}` |
| [agent.restrictedPssSecurityContext](./values.yaml#L1011) | bool | Set a restricted securityContext on jnlp containers | `false` |
| [agent.retentionTimeout](./values.yaml#L950) | int | Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated | `5` |
| [agent.runAsGroup](./values.yaml#L982) | string | Configure container group | `nil` |
| [agent.runAsUser](./values.yaml#L980) | string | Configure container user | `nil` |
| [agent.secretEnvVars](./values.yaml#L1091) | list | Mount a secret as environment variable | `[]` |
| [agent.serviceAccount](./values.yaml#L930) | string | Override the default service account | `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true` |
| [agent.showRawYaml](./values.yaml#L1018) | bool | | `true` |
| [agent.sideContainerName](./values.yaml#L1108) | string | Side container name | `"jnlp"` |
| [agent.skipTlsVerify](./values.yaml#L940) | bool | Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI | `false` |
| [agent.usageRestricted](./values.yaml#L942) | bool | Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI | `false` |
| [agent.useDefaultServiceAccount](./values.yaml#L926) | bool | Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount` | `true` |
| [agent.volumes](./values.yaml#L1025) | list | Additional volumes | `[]` |
| [agent.waitForPodSec](./values.yaml#L952) | int | Seconds to wait for pod to be running | `600` |
| [agent.websocket](./values.yaml#L975) | bool | Enables agent communication via websockets | `false` |
| [agent.workingDir](./values.yaml#L967) | string | Configure working directory for default agent | `"/home/jenkins/agent"` |
| [agent.workspaceVolume](./values.yaml#L1060) | object | Workspace volume (defaults to EmptyDir) | `{}` |
| [agent.yamlMergeStrategy](./values.yaml#L1150) | string | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override" | `"override"` |
| [agent.yamlTemplate](./values.yaml#L1139) | string | The raw yaml of a Pod API Object to merge into the agent spec | `""` |
| [awsSecurityGroupPolicies.enabled](./values.yaml#L1365) | bool | | `false` |
| [awsSecurityGroupPolicies.policies[0].name](./values.yaml#L1367) | string | | `""` |
| [awsSecurityGroupPolicies.policies[0].podSelector](./values.yaml#L1369) | object | | `{}` |
| [awsSecurityGroupPolicies.policies[0].securityGroupIds](./values.yaml#L1368) | list | | `[]` |
| [checkDeprecation](./values.yaml#L1362) | bool | Checks if any deprecated values are used | `true` |
| [clusterZone](./values.yaml#L21) | string | Override the cluster name for FQDN resolving | `"cluster.local"` |
| [controller.JCasC.authorizationStrategy](./values.yaml#L545) | string | Jenkins Config as Code Authorization Strategy-section | `"loggedInUsersCanDoAnything:\n allowAnonymousRead: false"` |
| [controller.JCasC.configMapAnnotations](./values.yaml#L550) | object | Annotations for the JCasC ConfigMap | `{}` |
| [controller.JCasC.configScripts](./values.yaml#L519) | object | List of Jenkins Config as Code scripts | `{}` |
| [controller.JCasC.configUrls](./values.yaml#L516) | list | Remote URLs for configuration files. | `[]` |
| [controller.JCasC.defaultConfig](./values.yaml#L510) | bool | Enables default Jenkins configuration via configuration as code plugin | `true` |
| [controller.JCasC.overwriteConfiguration](./values.yaml#L514) | bool | Whether Jenkins Config as Code should overwrite any existing configuration | `false` |
| [controller.JCasC.security](./values.yaml#L526) | object | Jenkins Config as Code security-section | `{"apiToken":{"creationOfLegacyTokenEnabled":false,"tokenGenerationOnCreationEnabled":false,"usageStatisticsEnabled":true}}` |
| [controller.JCasC.securityRealm](./values.yaml#L534) | string | Jenkins Config as Code Security Realm-section | `"local:\n allowsSignup: false\n enableCaptcha: false\n users:\n - id: \"${chart-admin-username}\"\n name: \"Jenkins Admin\"\n password: \"${chart-admin-password}\""` |
| [controller.additionalExistingSecrets](./values.yaml#L471) | list | List of additional existing secrets to mount | `[]` |
| [controller.additionalPlugins](./values.yaml#L421) | list | List of plugins to install in addition to those listed in controller.installPlugins | `[]` |
| [controller.additionalSecrets](./values.yaml#L480) | list | List of additional secrets to create and mount | `[]` |
| [controller.admin.createSecret](./values.yaml#L90) | bool | Create secret for admin user | `true` |
| [controller.admin.existingSecret](./values.yaml#L93) | string | The name of an existing secret containing the admin credentials | `""` |
| [controller.admin.password](./values.yaml#L80) | string | Admin password created as a secret if `controller.admin.createSecret` is true | `<random password>` |
| [controller.admin.passwordKey](./values.yaml#L85) | string | The key in the existing admin secret containing the password | `"jenkins-admin-password"` |
| [controller.admin.userKey](./values.yaml#L83) | string | The key in the existing admin secret containing the username | `"jenkins-admin-user"` |
| [controller.admin.username](./values.yaml#L77) | string | Admin username created as a secret if `controller.admin.createSecret` is true | `"admin"` |
| [controller.affinity](./values.yaml#L674) | object | Affinity settings | `{}` |
| [controller.agentListenerEnabled](./values.yaml#L330) | bool | Create Agent listener service | `true` |
| [controller.agentListenerExternalTrafficPolicy](./values.yaml#L340) | string | Traffic Policy of for the agentListener service | `nil` |
| [controller.agentListenerHostPort](./values.yaml#L334) | string | Host port to listen for agents | `nil` |
| [controller.agentListenerLoadBalancerIP](./values.yaml#L370) | string | Static IP for the agentListener LoadBalancer | `nil` |
| [controller.agentListenerLoadBalancerSourceRanges](./values.yaml#L342) | list | Allowed inbound IP for the agentListener service | `["0.0.0.0/0"]` |
| [controller.agentListenerNodePort](./values.yaml#L336) | string | Node port to listen for agents | `nil` |
| [controller.agentListenerPort](./values.yaml#L332) | int | Listening port for agents | `50000` |
| [controller.agentListenerServiceAnnotations](./values.yaml#L365) | object | Annotations for the agentListener service | `{}` |
| [controller.agentListenerServiceType](./values.yaml#L362) | string | Defines how to expose the agentListener service | `"ClusterIP"` |
| [controller.backendconfig.annotations](./values.yaml#L778) | object | backendconfig annotations | `{}` |
| [controller.backendconfig.apiVersion](./values.yaml#L772) | string | backendconfig API version | `"extensions/v1beta1"` |
| [controller.backendconfig.enabled](./values.yaml#L770) | bool | Enables backendconfig | `false` |
| [controller.backendconfig.labels](./values.yaml#L776) | object | backendconfig labels | `{}` |
| [controller.backendconfig.name](./values.yaml#L774) | string | backendconfig name | `nil` |
| [controller.backendconfig.spec](./values.yaml#L780) | object | backendconfig spec | `{}` |
| [controller.cloudName](./values.yaml#L499) | string | Name of default cloud configuration. | `"kubernetes"` |
| [controller.clusterIp](./values.yaml#L225) | string | k8s service clusterIP. Only used if serviceType is ClusterIP | `nil` |
| [controller.componentName](./values.yaml#L34) | string | Used for label app.kubernetes.io/component | `"jenkins-controller"` |
| [controller.containerEnv](./values.yaml#L155) | list | Environment variables for Jenkins Container | `[]` |
| [controller.containerEnvFrom](./values.yaml#L152) | list | Environment variable sources for Jenkins Container | `[]` |
| [controller.containerSecurityContext](./values.yaml#L210) | object | Allow controlling the securityContext for the jenkins container | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":1000,"runAsUser":1000}` |
| [controller.csrf.defaultCrumbIssuer.enabled](./values.yaml#L351) | bool | Enable the default CSRF Crumb issuer | `true` |
| [controller.csrf.defaultCrumbIssuer.proxyCompatability](./values.yaml#L353) | bool | Enable proxy compatibility | `true` |
| [controller.customInitContainers](./values.yaml#L553) | list | Custom init-container specification in raw-yaml format | `[]` |
| [controller.customJenkinsLabels](./values.yaml#L68) | list | Append Jenkins labels to the controller | `[]` |
| [controller.disableRememberMe](./values.yaml#L59) | bool | Disable use of remember me | `false` |
| [controller.disabledAgentProtocols](./values.yaml#L345) | list | Disabled agent protocols | `["JNLP-connect","JNLP2-connect"]` |
| [controller.enableRawHtmlMarkupFormatter](./values.yaml#L441) | bool | Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter) | `false` |
| [controller.enableServiceLinks](./values.yaml#L129) | bool | | `false` |
| [controller.executorMode](./values.yaml#L65) | string | Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE" | `"NORMAL"` |
| [controller.existingSecret](./values.yaml#L468) | string | | `nil` |
| [controller.extraPorts](./values.yaml#L400) | list | Optionally configure other ports to expose in the controller container | `[]` |
| [controller.fsGroup](./values.yaml#L191) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` |
| [controller.googlePodMonitor.enabled](./values.yaml#L841) | bool | | `false` |
| [controller.googlePodMonitor.scrapeEndpoint](./values.yaml#L846) | string | | `"/prometheus"` |
| [controller.googlePodMonitor.scrapeInterval](./values.yaml#L844) | string | | `"60s"` |
| [controller.healthProbes](./values.yaml#L260) | bool | Enable Kubernetes Probes configuration configured in `controller.probes` | `true` |
| [controller.hostAliases](./values.yaml#L794) | list | Allows for adding entries to Pod /etc/hosts | `[]` |
| [controller.hostNetworking](./values.yaml#L70) | bool | | `false` |
| [controller.httpsKeyStore.disableSecretMount](./values.yaml#L862) | bool | | `false` |
| [controller.httpsKeyStore.enable](./values.yaml#L853) | bool | Enables HTTPS keystore on jenkins controller | `false` |
| [controller.httpsKeyStore.fileName](./values.yaml#L870) | string | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `"keystore.jks"` |
| [controller.httpsKeyStore.httpPort](./values.yaml#L866) | int | HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port. | `8081` |
| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey](./values.yaml#L861) | string | Name of the key in the secret that contains the JKS password | `"https-jks-password"` |
| [controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName](./values.yaml#L859) | string | Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file | `""` |
| [controller.httpsKeyStore.jenkinsHttpsJksSecretKey](./values.yaml#L857) | string | Name of the key in the secret that already has ssl keystore | `"jenkins-jks-file"` |
| [controller.httpsKeyStore.jenkinsHttpsJksSecretName](./values.yaml#L855) | string | Name of the secret that already has ssl keystore | `""` |
| [controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded](./values.yaml#L875) | string | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | `nil` |
| [controller.httpsKeyStore.password](./values.yaml#L872) | string | Jenkins keystore password | `"password"` |
| [controller.httpsKeyStore.path](./values.yaml#L868) | string | Path of HTTPS keystore file | `"/var/jenkins_keystore"` |
| [controller.image.pullPolicy](./values.yaml#L47) | string | Controller image pull policy | `"Always"` |
| [controller.image.registry](./values.yaml#L37) | string | Controller image registry | `"docker.io"` |
| [controller.image.repository](./values.yaml#L39) | string | Controller image repository | `"jenkins/jenkins"` |
| [controller.image.tag](./values.yaml#L42) | string | Controller image tag override; i.e., tag: "2.440.1-jdk21" | `nil` |
| [controller.image.tagLabel](./values.yaml#L45) | string | Controller image tag label | `"jdk21"` |
| [controller.imagePullSecretName](./values.yaml#L49) | string | Controller image pull secret | `nil` |
| [controller.ingress.annotations](./values.yaml#L716) | object | Ingress annotations | `{}` |
| [controller.ingress.apiVersion](./values.yaml#L712) | string | Ingress API version | `"extensions/v1beta1"` |
| [controller.ingress.enabled](./values.yaml#L695) | bool | Enables ingress | `false` |
| [controller.ingress.hostName](./values.yaml#L730) | string | Ingress hostname | `nil` |
| [controller.ingress.labels](./values.yaml#L714) | object | Ingress labels | `{}` |
| [controller.ingress.path](./values.yaml#L726) | string | Ingress path | `nil` |
| [controller.ingress.paths](./values.yaml#L699) | list | Override for the default Ingress paths | `[]` |
| [controller.ingress.resourceRootUrl](./values.yaml#L732) | string | Hostname to serve assets from | `nil` |
| [controller.ingress.tls](./values.yaml#L734) | list | Ingress TLS configuration | `[]` |
| [controller.initConfigMap](./values.yaml#L458) | string | Name of the existing ConfigMap that contains init scripts | `nil` |
| [controller.initContainerEnv](./values.yaml#L146) | list | Environment variables for Init Container | `[]` |
| [controller.initContainerEnvFrom](./values.yaml#L142) | list | Environment variable sources for Init Container | `[]` |
| [controller.initContainerResources](./values.yaml#L133) | object | Resources allocation (Requests and Limits) for Init Container | `{}` |
| [controller.initScripts](./values.yaml#L454) | object | Map of groovy init scripts to be executed during Jenkins controller start | `{}` |
| [controller.initializeOnce](./values.yaml#L426) | bool | Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true` | `false` |
| [controller.installLatestPlugins](./values.yaml#L415) | bool | Download the minimum required version or latest version of all dependencies | `true` |
| [controller.installLatestSpecifiedPlugins](./values.yaml#L418) | bool | Set to true to download the latest version of any plugin that is requested to have the latest version | `false` |
| [controller.installPlugins](./values.yaml#L407) | list | List of Jenkins plugins to install. If you don't want to install plugins, set it to `false` | `["kubernetes:4353.vb_47977da_9417","workflow-aggregator:608.v67378e9d3db_1","git:5.7.0","configuration-as-code:1971.vf9280461ea_89"]` |
| [controller.javaOpts](./values.yaml#L161) | string | Append to `JAVA_OPTS` env var | `nil` |
| [controller.jenkinsAdminEmail](./values.yaml#L95) | string | Email address for the administrator of the Jenkins instance | `nil` |
| [controller.jenkinsHome](./values.yaml#L100) | string | Custom Jenkins home path | `"/var/jenkins_home"` |
| [controller.jenkinsOpts](./values.yaml#L163) | string | Append to `JENKINS_OPTS` env var | `nil` |
| [controller.jenkinsRef](./values.yaml#L105) | string | Custom Jenkins reference path | `"/usr/share/jenkins/ref"` |
| [controller.jenkinsUriPrefix](./values.yaml#L178) | string | Root URI Jenkins will be served on | `nil` |
| [controller.jenkinsUrl](./values.yaml#L173) | string | Set Jenkins URL if you are not using the ingress definitions provided by the chart | `nil` |
| [controller.jenkinsUrlProtocol](./values.yaml#L170) | string | Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise | `nil` |
| [controller.jenkinsWar](./values.yaml#L108) | string | | `"/usr/share/jenkins/jenkins.war"` |
| [controller.jmxPort](./values.yaml#L397) | string | Open a port, for JMX stats | `nil` |
| [controller.legacyRemotingSecurityEnabled](./values.yaml#L373) | bool | Whether legacy remoting security should be enabled | `false` |
| [controller.lifecycle](./values.yaml#L51) | object | Lifecycle specification for controller-container | `{}` |
| [controller.loadBalancerIP](./values.yaml#L388) | string | Optionally assign a known public LB IP | `nil` |
| [controller.loadBalancerSourceRanges](./values.yaml#L384) | list | Allowed inbound IP addresses | `["0.0.0.0/0"]` |
| [controller.markupFormatter](./values.yaml#L445) | string | Yaml of the markup formatter to use | `"plainText"` |
| [controller.nodePort](./values.yaml#L231) | string | k8s node port. Only used if serviceType is NodePort | `nil` |
| [controller.nodeSelector](./values.yaml#L661) | object | Node labels for pod assignment | `{}` |
| [controller.numExecutors](./values.yaml#L62) | int | Set Number of executors | `0` |
| [controller.overwritePlugins](./values.yaml#L430) | bool | Overwrite installed plugins on start | `false` |
| [controller.overwritePluginsFromImage](./values.yaml#L434) | bool | Overwrite plugins that are already installed in the controller image | `true` |
| [controller.podAnnotations](./values.yaml#L682) | object | Annotations for controller pod | `{}` |
| [controller.podDisruptionBudget.annotations](./values.yaml#L324) | object | | `{}` |
| [controller.podDisruptionBudget.apiVersion](./values.yaml#L322) | string | Policy API version | `"policy/v1beta1"` |
| [controller.podDisruptionBudget.enabled](./values.yaml#L317) | bool | Enable Kubernetes Pod Disruption Budget configuration | `false` |
| [controller.podDisruptionBudget.labels](./values.yaml#L325) | object | | `{}` |
| [controller.podDisruptionBudget.maxUnavailable](./values.yaml#L327) | string | Number of pods that can be unavailable. Either an absolute number or a percentage | `"0"` |
| [controller.podLabels](./values.yaml#L253) | object | Custom Pod labels (an object with `label-key: label-value` pairs) | `{}` |
| [controller.podSecurityContextOverride](./values.yaml#L207) | string | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities` | `nil` |
| [controller.priorityClassName](./values.yaml#L679) | string | The name of a `priorityClass` to apply to the controller pod | `nil` |
| [controller.probes.livenessProbe.failureThreshold](./values.yaml#L278) | int | Set the failure threshold for the liveness probe | `5` |
| [controller.probes.livenessProbe.httpGet.path](./values.yaml#L281) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` |
| [controller.probes.livenessProbe.httpGet.port](./values.yaml#L283) | string | Set the Pod's HTTP port to use for the liveness probe | `"http"` |
| [controller.probes.livenessProbe.initialDelaySeconds](./values.yaml#L292) | string | Set the initial delay for the liveness probe in seconds | `nil` |
| [controller.probes.livenessProbe.periodSeconds](./values.yaml#L285) | int | Set the time interval between two liveness probes executions in seconds | `10` |
| [controller.probes.livenessProbe.timeoutSeconds](./values.yaml#L287) | int | Set the timeout for the liveness probe in seconds | `5` |
| [controller.probes.readinessProbe.failureThreshold](./values.yaml#L296) | int | Set the failure threshold for the readiness probe | `3` |
| [controller.probes.readinessProbe.httpGet.path](./values.yaml#L299) | string | Set the Pod's HTTP path for the liveness probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` |
| [controller.probes.readinessProbe.httpGet.port](./values.yaml#L301) | string | Set the Pod's HTTP port to use for the readiness probe | `"http"` |
| [controller.probes.readinessProbe.initialDelaySeconds](./values.yaml#L310) | string | Set the initial delay for the readiness probe in seconds | `nil` |
| [controller.probes.readinessProbe.periodSeconds](./values.yaml#L303) | int | Set the time interval between two readiness probes executions in seconds | `10` |
| [controller.probes.readinessProbe.timeoutSeconds](./values.yaml#L305) | int | Set the timeout for the readiness probe in seconds | `5` |
| [controller.probes.startupProbe.failureThreshold](./values.yaml#L265) | int | Set the failure threshold for the startup probe | `12` |
| [controller.probes.startupProbe.httpGet.path](./values.yaml#L268) | string | Set the Pod's HTTP path for the startup probe | `"{{ default \"\" .Values.controller.jenkinsUriPrefix }}/login"` |
| [controller.probes.startupProbe.httpGet.port](./values.yaml#L270) | string | Set the Pod's HTTP port to use for the startup probe | `"http"` |
| [controller.probes.startupProbe.periodSeconds](./values.yaml#L272) | int | Set the time interval between two startup probes executions in seconds | `10` |
| [controller.probes.startupProbe.timeoutSeconds](./values.yaml#L274) | int | Set the timeout for the startup probe in seconds | `5` |
| [controller.projectNamingStrategy](./values.yaml#L437) | string | | `"standard"` |
| [controller.prometheus.alertingRulesAdditionalLabels](./values.yaml#L827) | object | Additional labels to add to the PrometheusRule object | `{}` |
| [controller.prometheus.alertingrules](./values.yaml#L825) | list | Array of prometheus alerting rules | `[]` |
| [controller.prometheus.enabled](./values.yaml#L810) | bool | Enables prometheus service monitor | `false` |
| [controller.prometheus.metricRelabelings](./values.yaml#L837) | list | | `[]` |
| [controller.prometheus.prometheusRuleNamespace](./values.yaml#L829) | string | Set a custom namespace where to deploy PrometheusRule resource | `""` |
| [controller.prometheus.relabelings](./values.yaml#L835) | list | | `[]` |
| [controller.prometheus.scrapeEndpoint](./values.yaml#L820) | string | The endpoint prometheus should get metrics from | `"/prometheus"` |
| [controller.prometheus.scrapeInterval](./values.yaml#L816) | string | How often prometheus should scrape metrics | `"60s"` |
| [controller.prometheus.serviceMonitorAdditionalLabels](./values.yaml#L812) | object | Additional labels to add to the service monitor object | `{}` |
| [controller.prometheus.serviceMonitorNamespace](./values.yaml#L814) | string | Set a custom namespace where to deploy ServiceMonitor resource | `nil` |
| [controller.publishNotReadyAddresses](./values.yaml#L239) | string | | `nil` |
| [controller.resources](./values.yaml#L114) | object | Resource allocation (Requests and Limits) | `{"limits":{"cpu":"2000m","memory":"4096Mi"},"requests":{"cpu":"50m","memory":"256Mi"}}` |
| [controller.route.annotations](./values.yaml#L789) | object | Route annotations | `{}` |
| [controller.route.enabled](./values.yaml#L785) | bool | Enables openshift route | `false` |
| [controller.route.labels](./values.yaml#L787) | object | Route labels | `{}` |
| [controller.route.path](./values.yaml#L791) | string | Route path | `nil` |
| [controller.runAsUser](./values.yaml#L188) | int | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` |
| [controller.schedulerName](./values.yaml#L657) | string | Name of the Kubernetes scheduler to use | `""` |
| [controller.scriptApproval](./values.yaml#L449) | list | List of groovy functions to approve | `[]` |
| [controller.secondaryingress.annotations](./values.yaml#L752) | object | | `{}` |
| [controller.secondaryingress.apiVersion](./values.yaml#L750) | string | | `"extensions/v1beta1"` |
| [controller.secondaryingress.enabled](./values.yaml#L744) | bool | | `false` |
| [controller.secondaryingress.hostName](./values.yaml#L759) | string | | `nil` |
| [controller.secondaryingress.labels](./values.yaml#L751) | object | | `{}` |
| [controller.secondaryingress.paths](./values.yaml#L747) | list | | `[]` |
| [controller.secondaryingress.tls](./values.yaml#L760) | string | | `nil` |
| [controller.secretClaims](./values.yaml#L492) | list | List of `SecretClaim` resources to create | `[]` |
| [controller.securityContextCapabilities](./values.yaml#L197) | object | | `{}` |
| [controller.serviceAnnotations](./values.yaml#L242) | object | Jenkins controller service annotations | `{}` |
| [controller.serviceEnabled](./values.yaml#L217) | bool | enable or disable the controller k8s service | `true` |
| [controller.serviceExternalTrafficPolicy](./values.yaml#L235) | string | | `nil` |
| [controller.serviceLabels](./values.yaml#L248) | object | Labels for the Jenkins controller-service | `{}` |
| [controller.servicePort](./values.yaml#L227) | int | k8s service port | `8080` |
| [controller.serviceType](./values.yaml#L222) | string | k8s service type | `"ClusterIP"` |
| [controller.shareProcessNamespace](./values.yaml#L123) | bool | | `false` |
| [controller.sidecars.additionalSidecarContainers](./values.yaml#L639) | list | Configures additional sidecar container(s) for the Jenkins controller | `[]` |
| [controller.sidecars.configAutoReload.additionalVolumeMounts](./values.yaml#L584) | list | Enables additional volume mounts for the config auto-reload container | `[]` |
| [controller.sidecars.configAutoReload.containerSecurityContext](./values.yaml#L634) | object | Enable container security context | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true}` |
| [controller.sidecars.configAutoReload.enabled](./values.yaml#L566) | bool | Enable Jenkins Config as Code auto-reload | `true` |
| [controller.sidecars.configAutoReload.env](./values.yaml#L616) | list | Environment variables for the Jenkins Config as Code auto-reload container | `[]` |
| [controller.sidecars.configAutoReload.envFrom](./values.yaml#L614) | list | Environment variable sources for the Jenkins Config as Code auto-reload container | `[]` |
| [controller.sidecars.configAutoReload.folder](./values.yaml#L627) | string | | `"/var/jenkins_home/casc_configs"` |
| [controller.sidecars.configAutoReload.image.registry](./values.yaml#L569) | string | Registry for the image that triggers the reload | `"docker.io"` |
| [controller.sidecars.configAutoReload.image.repository](./values.yaml#L571) | string | Repository of the image that triggers the reload | `"kiwigrid/k8s-sidecar"` |
| [controller.sidecars.configAutoReload.image.tag](./values.yaml#L573) | string | Tag for the image that triggers the reload | `"1.30.3"` |
| [controller.sidecars.configAutoReload.imagePullPolicy](./values.yaml#L574) | string | | `"IfNotPresent"` |
| [controller.sidecars.configAutoReload.logging](./values.yaml#L591) | object | Config auto-reload logging settings | `{"configuration":{"backupCount":3,"formatter":"JSON","logLevel":"INFO","logToConsole":true,"logToFile":false,"maxBytes":1024,"override":false}}` |
| [controller.sidecars.configAutoReload.logging.configuration.override](./values.yaml#L595) | bool | Enables custom log config utilizing using the settings below. | `false` |
| [controller.sidecars.configAutoReload.reqRetryConnect](./values.yaml#L609) | int | How many connection-related errors to retry on | `10` |
| [controller.sidecars.configAutoReload.resources](./values.yaml#L575) | object | | `{}` |
| [controller.sidecars.configAutoReload.scheme](./values.yaml#L604) | string | The scheme to use when connecting to the Jenkins configuration as code endpoint | `"http"` |
| [controller.sidecars.configAutoReload.skipTlsVerify](./values.yaml#L606) | bool | Skip TLS verification when connecting to the Jenkins configuration as code endpoint | `false` |
| [controller.sidecars.configAutoReload.sleepTime](./values.yaml#L611) | string | How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) | `nil` |
| [controller.sidecars.configAutoReload.sshTcpPort](./values.yaml#L625) | int | | `1044` |
| [controller.statefulSetAnnotations](./values.yaml#L684) | object | Annotations for controller StatefulSet | `{}` |
| [controller.statefulSetLabels](./values.yaml#L244) | object | Jenkins controller custom labels for the StatefulSet | `{}` |
| [controller.targetPort](./values.yaml#L229) | int | k8s target port | `8080` |
| [controller.terminationGracePeriodSeconds](./values.yaml#L667) | string | Set TerminationGracePeriodSeconds | `nil` |
| [controller.terminationMessagePath](./values.yaml#L669) | string | Set the termination message path | `nil` |
| [controller.terminationMessagePolicy](./values.yaml#L671) | string | Set the termination message policy | `nil` |
| [controller.testEnabled](./values.yaml#L849) | bool | Can be used to disable rendering controller test resources when using helm template | `true` |
| [controller.tolerations](./values.yaml#L665) | list | Toleration labels for pod assignment | `[]` |
| [controller.topologySpreadConstraints](./values.yaml#L691) | object | Topology spread constraints | `{}` |
| [controller.updateStrategy](./values.yaml#L688) | object | Update strategy for StatefulSet | `{}` |
| [controller.usePodSecurityContext](./values.yaml#L181) | bool | Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set) | `true` |
| [credentialsId](./values.yaml#L27) | string | The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed. | `nil` |
| [fullnameOverride](./values.yaml#L13) | string | Override the full resource names | `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins` |
| [helmtest.bats.image.registry](./values.yaml#L1378) | string | Registry of the image used to test the framework | `"docker.io"` |
| [helmtest.bats.image.repository](./values.yaml#L1380) | string | Repository of the image used to test the framework | `"bats/bats"` |
| [helmtest.bats.image.tag](./values.yaml#L1382) | string | Tag of the image to test the framework | `"1.12.0"` |
| [kubernetesURL](./values.yaml#L24) | string | The URL of the Kubernetes API server | `"https://kubernetes.default"` |
| [nameOverride](./values.yaml#L10) | string | Override the resource name prefix | `Chart.Name` |
| [namespaceOverride](./values.yaml#L16) | string | Override the deployment namespace | `Release.Namespace` |
| [networkPolicy.apiVersion](./values.yaml#L1301) | string | NetworkPolicy ApiVersion | `"networking.k8s.io/v1"` |
| [networkPolicy.enabled](./values.yaml#L1296) | bool | Enable the creation of NetworkPolicy resources | `false` |
| [networkPolicy.externalAgents.except](./values.yaml#L1316) | list | A list of IP sub-ranges to be excluded from the allowlisted IP range | `[]` |
| [networkPolicy.externalAgents.ipCIDR](./values.yaml#L1314) | string | The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16 | `nil` |
| [networkPolicy.internalAgents.allowed](./values.yaml#L1305) | bool | Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels | `true` |
| [networkPolicy.internalAgents.namespaceLabels](./values.yaml#L1309) | object | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller | `{}` |
| [networkPolicy.internalAgents.podLabels](./values.yaml#L1307) | object | A map of labels (keys/values) that agent pods must have to be able to connect to controller | `{}` |
| [persistence.accessMode](./values.yaml#L1271) | string | The PVC access mode | `"ReadWriteOnce"` |
| [persistence.annotations](./values.yaml#L1267) | object | Annotations for the PVC | `{}` |
| [persistence.dataSource](./values.yaml#L1277) | object | Existing data source to clone PVC from | `{}` |
| [persistence.enabled](./values.yaml#L1251) | bool | Enable the use of a Jenkins PVC | `true` |
| [persistence.existingClaim](./values.yaml#L1257) | string | Provide the name of a PVC | `nil` |
| [persistence.labels](./values.yaml#L1269) | object | Labels for the PVC | `{}` |
| [persistence.mounts](./values.yaml#L1289) | list | Additional mounts | `[]` |
| [persistence.size](./values.yaml#L1273) | string | The size of the PVC | `"8Gi"` |
| [persistence.storageClass](./values.yaml#L1265) | string | Storage class for the PVC | `nil` |
| [persistence.subPath](./values.yaml#L1282) | string | SubPath for jenkins-home mount | `nil` |
| [persistence.volumes](./values.yaml#L1284) | list | Additional volumes | `[]` |
| [rbac.create](./values.yaml#L1323) | bool | Whether RBAC resources are created | `true` |
| [rbac.readSecrets](./values.yaml#L1325) | bool | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` |
| [rbac.useOpenShiftNonRootSCC](./values.yaml#L1327) | bool | Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints | `false` |
| [renderHelmLabels](./values.yaml#L30) | bool | Enables rendering of the helm.sh/chart label to the annotations | `true` |
| [serviceAccount.annotations](./values.yaml#L1337) | object | Configures annotations for the ServiceAccount | `{}` |
| [serviceAccount.automountServiceAccountToken](./values.yaml#L1343) | bool | Auto-mount ServiceAccount token | `true` |
| [serviceAccount.create](./values.yaml#L1331) | bool | Configures if a ServiceAccount with this name should be created | `true` |
| [serviceAccount.extraLabels](./values.yaml#L1339) | object | Configures extra labels for the ServiceAccount | `{}` |
| [serviceAccount.imagePullSecretName](./values.yaml#L1341) | string | Controller ServiceAccount image pull secret | `nil` |
| [serviceAccount.name](./values.yaml#L1335) | string | | `nil` |
| [serviceAccountAgent.annotations](./values.yaml#L1353) | object | Configures annotations for the agent ServiceAccount | `{}` |
| [serviceAccountAgent.automountServiceAccountToken](./values.yaml#L1359) | bool | Auto-mount ServiceAccount token | `true` |
| [serviceAccountAgent.create](./values.yaml#L1347) | bool | Configures if an agent ServiceAccount should be created | `false` |
| [serviceAccountAgent.extraLabels](./values.yaml#L1355) | object | Configures extra labels for the agent ServiceAccount | `{}` |
| [serviceAccountAgent.imagePullSecretName](./values.yaml#L1357) | string | Agent ServiceAccount image pull secret | `nil` |
| [serviceAccountAgent.name](./values.yaml#L1351) | string | The name of the agent ServiceAccount to be used by access-controlled resources | `nil` |
helm-templates/jenkins-grn/VALUES.md.gotmpl
-28
View File
@@ -1,28 +0,0 @@
# Jenkins
## Configuration
The following tables list the configurable parameters of the Jenkins chart and their default values.
{{- define "chart.valueDefaultColumnRender" -}}
{{- $defaultValue := (trimAll "`" (default .Default .AutoDefault) | replace "\n" "") -}}
`{{- $defaultValue | replace "\n" "" -}}`
{{- end -}}
{{- define "chart.typeColumnRender" -}}
{{- .Type -}}
{{- end -}}
{{- define "chart.valueDescription" -}}
{{- default .Description .AutoDescription }}
{{- end -}}
{{- define "chart.valuesTable" -}}
| Key | Type | Description | Default |
|:----|:-----|:---------|:------------|
{{- range .Values }}
| [{{ .Key }}](./values.yaml#L{{ .LineNumber }}) | {{ template "chart.typeColumnRender" . }} | {{ template "chart.valueDescription" . }} | {{ template "chart.valueDefaultColumnRender" . }} |
{{- end }}
{{- end }}
{{ template "chart.valuesSection" . }}
helm-templates/jenkins-grn/ci/default-values.yaml
-5
View File
@@ -1,5 +0,0 @@
# this file is empty to check if defaults within values.yaml work as expected
controller:
JCasC:
configScripts:
empty: ""
helm-templates/jenkins-grn/ci/other-values.yaml
-100
View File
@@ -1,100 +0,0 @@
---
controller:
overwritePluginsFromImage: false
containerSecurityContext: ""
runAsUser: 0
fsGroup: 1000
JCasC:
authorizationStrategy: |-
loggedInUsersCanDoAnything:
allowAnonymousRead: true
securityRealm: |-
ldap:
configurations:
- server: ldap.acme.com
rootDN: dc=acme,dc=uk
managerPasswordSecret: ${LDAP_PASSWORD}
groupMembershipStrategy:
fromUserRecord:
attributeName: "memberOf"
additionalPlugins:
- ldap:682.v7b_544c9d1512
scriptApproval:
- "method groovy.json.JsonSlurperClassic parseText java.lang.String"
- "new groovy.json.JsonSlurperClassic"
ingress:
enabled: true
persistence:
enabled: false
agent:
resources:
limits:
cpu: "1"
memory: "2048Mi"
envVars:
- name: HOME
value: /home/jenkins/agent
- name: PATH
value: /usr/local/bin
nodeSelector:
"app.kubernetes.io/component": "{{ .Values.agent.componentName }}"
restrictedPssSecurityContext: true
runAsUser: 1000
runAsGroup: 1000
yamlTemplate: |-
apiVersion: v1
kind: Pod
spec:
tolerations:
- key: "app.kubernetes.io/component"
operator: "Equal"
value: "{{ .Values.agent.componentName }}"
effect: "NoSchedule"
additionalAgents:
maven:
podName: maven
customJenkinsLabels: maven
# An example of overriding the jnlp container
# sideContainerName: jnlp
image:
repository: jenkins/jnlp-agent-maven
tag: latest
python:
podName: python
customJenkinsLabels: python
sideContainerName: python
image:
repository: python
tag: "3"
command: "/bin/sh -c"
args: "cat"
TTYEnabled: true
podTemplates:
python: |
- name: python
label: jenkins-python
containers:
- name: python
image: python:3
command: "/bin/sh -c"
args: "cat"
ttyEnabled: true
privileged: true
resourceRequestCpu: "400m"
resourceRequestMemory: "512Mi"
resourceLimitCpu: "1"
resourceLimitMemory: "1024Mi"
volumes:
- type: EmptyDir
mountPath: /var/myapp/myemptydir
memory: false
serviceAccount:
annotations:
description: "Used by release {{ .Release.Name }} for role-based access control"
serviceAccountAgent:
create: true
annotations:
description: "Used by release {{ .Release.Name }} for role-based access control"
helm-templates/jenkins-grn/ci/with-secrets-values.yaml
-4
View File
@@ -1,4 +0,0 @@
controller:
additionalSecrets:
- name: nameOfSecret
value: secretText
helm-templates/jenkins-grn/templates/NOTES.txt
-68
View File
@@ -1,68 +0,0 @@
{{- $prefix := .Values.controller.jenkinsUriPrefix | default "" -}}
{{- $url := "" -}}
1. Get your '{{ .Values.controller.admin.username }}' user password by running:
kubectl exec --namespace {{ template "jenkins.namespace" . }} -it svc/{{ template "jenkins.fullname" . }} -c jenkins -- /bin/cat /run/secrets/additional/chart-admin-password && echo
{{- if .Values.controller.ingress.hostName -}}
{{- if .Values.controller.ingress.tls -}}
{{- $url = print "https://" .Values.controller.ingress.hostName $prefix -}}
{{- else -}}
{{- $url = print "http://" .Values.controller.ingress.hostName $prefix -}}
{{- end }}
2. Visit {{ $url }}
{{- else }}
2. Get the Jenkins URL to visit by running these commands in the same shell:
{{- if contains "NodePort" .Values.controller.serviceType }}
export NODE_PORT=$(kubectl get --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "jenkins.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://$NODE_IP:$NODE_PORT" $prefix -}}
{{- else -}}
{{- $url = print "http://$NODE_IP:$NODE_PORT" $prefix -}}
{{- end }}
echo {{ $url }}
{{- else if contains "LoadBalancer" .Values.controller.serviceType }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc --namespace {{ template "jenkins.namespace" . }} -w {{ template "jenkins.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ template "jenkins.namespace" . }} {{ template "jenkins.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://$SERVICE_IP:" .Values.controller.servicePort $prefix -}}
{{- else -}}
{{- $url = print "http://$SERVICE_IP:" .Values.controller.servicePort $prefix -}}
{{- end }}
echo {{ $url }}
{{- else if contains "ClusterIP" .Values.controller.serviceType -}}
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://127.0.0.1:" .Values.controller.servicePort $prefix -}}
{{- else -}}
{{- $url = print "http://127.0.0.1:" .Values.controller.servicePort $prefix -}}
{{- end }}
echo {{ $url }}
kubectl --namespace {{ template "jenkins.namespace" . }} port-forward svc/{{template "jenkins.fullname" . }} {{ .Values.controller.servicePort }}:{{ .Values.controller.servicePort }}
{{- end }}
{{- end }}
3. Login with the password from step 1 and the username: {{ .Values.controller.admin.username }}
4. Configure security realm and authorization strategy
5. Use Jenkins Configuration as Code by specifying configScripts in your values.yaml file, see documentation: {{ $url }}/configuration-as-code and examples: https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos
For more information on running Jenkins on Kubernetes, visit:
https://cloud.google.com/solutions/jenkins-on-container-engine
For more information about Jenkins Configuration as Code, visit:
https://jenkins.io/projects/jcasc/
{{ if and (eq .Values.controller.image.repository "jenkins/jenkins") (eq .Values.controller.image.registry "docker.io") }}
NOTE: Consider using a custom image with pre-installed plugins
{{- else if .Values.controller.installPlugins }}
NOTE: Consider disabling `installPlugins` if your image already contains plugins.
{{- end }}
{{- if .Values.persistence.enabled }}
{{- else }}
#################################################################################
###### WARNING: Persistence is disabled!!! You will lose your data when #####
###### the Jenkins pod is terminated. #####
#################################################################################
{{- end }}
helm-templates/jenkins-grn/templates/_helpers.tpl
-697
View File
@@ -1,697 +0,0 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "jenkins.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Expand the label of the chart.
*/}}
{{- define "jenkins.label" -}}
{{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
*/}}
{{- define "jenkins.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.agent.namespace" -}}
{{- if .Values.agent.namespace -}}
{{- tpl .Values.agent.namespace . -}}
{{- else -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "jenkins.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Returns the admin password
https://github.com/helm/charts/issues/5167#issuecomment-619137759
*/}}
{{- define "jenkins.password" -}}
{{- if .Values.controller.admin.password -}}
{{- .Values.controller.admin.password | b64enc | quote }}
{{- else -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (include "jenkins.fullname" .)).data -}}
{{- if $secret -}}
{{/*
Reusing current password since secret exists
*/}}
{{- index $secret ( .Values.controller.admin.passwordKey | default "jenkins-admin-password" ) -}}
{{- else -}}
{{/*
Generate new password
*/}}
{{- randAlphaNum 22 | b64enc | quote }}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Returns the Jenkins URL
*/}}
{{- define "jenkins.url" -}}
{{- if .Values.controller.jenkinsUrl }}
{{- .Values.controller.jenkinsUrl }}
{{- else }}
{{- if .Values.controller.ingress.hostName }}
{{- if .Values.controller.ingress.tls }}
{{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- else }}
{{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- end }}
{{- else }}
{{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ template "jenkins.fullname" . }}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- end}}
{{- end}}
{{- end -}}
{{/*
Returns configuration as code default config
*/}}
{{- define "jenkins.casc.defaults" -}}
jenkins:
{{- $configScripts := toYaml .Values.controller.JCasC.configScripts }}
{{- if and (.Values.controller.JCasC.authorizationStrategy) (not (contains "authorizationStrategy:" $configScripts)) }}
authorizationStrategy:
{{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 4 }}
{{- end }}
{{- if and (.Values.controller.JCasC.securityRealm) (not (contains "securityRealm:" $configScripts)) }}
securityRealm:
{{- tpl .Values.controller.JCasC.securityRealm . | nindent 4 }}
{{- end }}
disableRememberMe: {{ .Values.controller.disableRememberMe }}
{{- if .Values.controller.legacyRemotingSecurityEnabled }}
remotingSecurity:
enabled: true
{{- end }}
mode: {{ .Values.controller.executorMode }}
numExecutors: {{ .Values.controller.numExecutors }}
{{- if not (kindIs "invalid" .Values.controller.customJenkinsLabels) }}
labelString: "{{ join " " .Values.controller.customJenkinsLabels }}"
{{- end }}
{{- if .Values.controller.projectNamingStrategy }}
{{- if kindIs "string" .Values.controller.projectNamingStrategy }}
projectNamingStrategy: "{{ .Values.controller.projectNamingStrategy }}"
{{- else }}
projectNamingStrategy:
{{- toYaml .Values.controller.projectNamingStrategy | nindent 4 }}
{{- end }}
{{- end }}
markupFormatter:
{{- if .Values.controller.enableRawHtmlMarkupFormatter }}
rawHtml:
disableSyntaxHighlighting: true
{{- else }}
{{- toYaml .Values.controller.markupFormatter | nindent 4 }}
{{- end }}
clouds:
- kubernetes:
containerCapStr: "{{ .Values.agent.containerCap }}"
{{- if .Values.agent.garbageCollection.enabled }}
garbageCollection:
{{- if .Values.agent.garbageCollection.namespaces }}
namespaces: |-
{{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
{{- end }}
timeout: "{{ .Values.agent.garbageCollection.timeout }}"
{{- end }}
{{- if .Values.agent.jnlpregistry }}
jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
{{- end }}
defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}"
connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}"
readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}"
{{- if .Values.agent.directConnection }}
directConnection: true
{{- else }}
{{- if .Values.agent.jenkinsUrl }}
jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}"
{{- else }}
jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- if not .Values.agent.websocket }}
{{- if .Values.agent.jenkinsTunnel }}
jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}"
{{- else }}
jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}"
{{- end }}
{{- else }}
webSocket: true
{{- end }}
{{- end }}
skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
usageRestricted: {{ .Values.agent.usageRestricted | default false}}
maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
name: "{{ .Values.controller.cloudName }}"
namespace: "{{ template "jenkins.agent.namespace" . }}"
restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }}
serverUrl: "{{ .Values.kubernetesURL }}"
credentialsId: "{{ .Values.credentialsId }}"
{{- if .Values.agent.enabled }}
podLabels:
- key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}"
value: "true"
{{- range $key, $val := .Values.agent.podLabels }}
- key: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
templates:
{{- if not .Values.agent.disableDefaultAgent }}
{{- include "jenkins.casc.podTemplate" . | nindent 8 }}
{{- end }}
{{- if .Values.additionalAgents }}
{{- /* save .Values.agent */}}
{{- $agent := .Values.agent }}
{{- range $name, $additionalAgent := .Values.additionalAgents }}
{{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }}
{{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
{{- $additionalAgent := merge $additionalAgent $agent }}
{{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
{{- if $additionalContainersEmpty }}
{{- $_ := set $additionalAgent "additionalContainers" list }}
{{- end }}
{{- /* set .Values.agent to $additionalAgent */}}
{{- $_ := set $.Values "agent" $additionalAgent }}
{{- include "jenkins.casc.podTemplate" $ | nindent 8 }}
{{- end }}
{{- /* restore .Values.agent */}}
{{- $_ := set .Values "agent" $agent }}
{{- end }}
{{- if .Values.agent.podTemplates }}
{{- range $key, $val := .Values.agent.podTemplates }}
{{- tpl $val $ | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.additionalClouds }}
{{- /* save root */}}
{{- $oldRoot := deepCopy $ }}
{{- range $name, $additionalCloud := .Values.additionalClouds }}
{{- $newRoot := deepCopy $ }}
{{- /* clear additionalAgents from the copy if override set to `true` */}}
{{- if .additionalAgentsOverride }}
{{- $_ := set $newRoot.Values "additionalAgents" list}}
{{- end}}
{{- $newValues := merge $additionalCloud $newRoot.Values }}
{{- $_ := set $newRoot "Values" $newValues }}
{{- /* clear additionalClouds from the copy */}}
{{- $_ := set $newRoot.Values "additionalClouds" list }}
{{- with $newRoot}}
- kubernetes:
containerCapStr: "{{ .Values.agent.containerCap }}"
{{- if .Values.agent.garbageCollection.enabled }}
garbageCollection:
{{- if .Values.agent.garbageCollection.namespaces }}
namespaces: |-
{{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
{{- end }}
timeout: "{{ .Values.agent.garbageCollection.timeout }}"
{{- end }}
{{- if .Values.agent.jnlpregistry }}
jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
{{- end }}
defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}"
connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}"
readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}"
{{- if .Values.agent.directConnection }}
directConnection: true
{{- else }}
{{- if .Values.agent.jenkinsUrl }}
jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}"
{{- else }}
jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- if not .Values.agent.websocket }}
{{- if .Values.agent.jenkinsTunnel }}
jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}"
{{- else }}
jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}"
{{- end }}
{{- else }}
webSocket: true
{{- end }}
{{- end }}
skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
usageRestricted: {{ .Values.agent.usageRestricted | default false}}
maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
name: {{ $name | quote }}
namespace: "{{ template "jenkins.agent.namespace" . }}"
restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }}
serverUrl: "{{ .Values.kubernetesURL }}"
credentialsId: "{{ .Values.credentialsId }}"
{{- if .Values.agent.enabled }}
podLabels:
- key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}"
value: "true"
{{- range $key, $val := .Values.agent.podLabels }}
- key: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
templates:
{{- if not .Values.agent.disableDefaultAgent }}
{{- include "jenkins.casc.podTemplate" . | nindent 8 }}
{{- end }}
{{- if .Values.additionalAgents }}
{{- /* save .Values.agent */}}
{{- $agent := .Values.agent }}
{{- range $name, $additionalAgent := .Values.additionalAgents }}
{{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }}
{{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
{{- $additionalAgent := merge $additionalAgent $agent }}
{{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
{{- if $additionalContainersEmpty }}
{{- $_ := set $additionalAgent "additionalContainers" list }}
{{- end }}
{{- /* set .Values.agent to $additionalAgent */}}
{{- $_ := set $.Values "agent" $additionalAgent }}
{{- include "jenkins.casc.podTemplate" $ | nindent 8 }}
{{- end }}
{{- /* restore .Values.agent */}}
{{- $_ := set .Values "agent" $agent }}
{{- end }}
{{- with .Values.agent.podTemplates }}
{{- range $key, $val := . }}
{{- tpl $val $ | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- /* restore root */}}
{{- $_ := set $ "Values" $oldRoot.Values }}
{{- end }}
slaveAgentPort: {{ .Values.controller.agentListenerPort }}
{{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }}
crumbIssuer:
standard:
excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }}
{{- end }}
{{- include "jenkins.casc.security" . }}
{{- with .Values.controller.scriptApproval }}
scriptApproval:
approvedSignatures:
{{- range $key, $val := . }}
- "{{ $val }}"
{{- end }}
{{- end }}
unclassified:
location:
{{- with .Values.controller.jenkinsAdminEmail }}
adminAddress: {{ . }}
{{- end }}
url: {{ template "jenkins.url" . }}
{{- end -}}
{{/*
Returns a name template to be used for jcasc configmaps, using
suffix passed in at call as index 0
*/}}
{{- define "jenkins.casc.configName" -}}
{{- $name := index . 0 -}}
{{- $root := index . 1 -}}
"{{- include "jenkins.fullname" $root -}}-jenkins-{{ $name }}"
{{- end -}}
{{/*
Returns kubernetes pod template configuration as code
*/}}
{{- define "jenkins.casc.podTemplate" -}}
- name: "{{ .Values.agent.podName }}"
namespace: "{{ template "jenkins.agent.namespace" . }}"
{{- if .Values.agent.annotations }}
annotations:
{{- range $key, $value := .Values.agent.annotations }}
- key: {{ $key }}
value: {{ $value | quote }}
{{- end }}
{{- end }}
id: {{ sha256sum (toYaml .Values.agent) }}
containers:
- name: "{{ .Values.agent.sideContainerName }}"
alwaysPullImage: {{ .Values.agent.alwaysPullImage }}
args: "{{ .Values.agent.args | replace "$" "^$" }}"
{{- with .Values.agent.command }}
command: {{ . }}
{{- end }}
envVars:
- envVar:
{{- if .Values.agent.directConnection }}
key: "JENKINS_DIRECT_CONNECTION"
{{- if .Values.agent.jenkinsTunnel }}
value: "{{ tpl .Values.agent.jenkinsTunnel . }}"
{{- else }}
value: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}"
{{- end }}
{{- else }}
key: "JENKINS_URL"
{{- if .Values.agent.jenkinsUrl }}
value: {{ tpl .Values.agent.jenkinsUrl . }}
{{- else }}
value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- end }}
{{- if ne .Values.agent.image.registry "" }}
image: "{{ .Values.agent.image.registry}}/{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
{{- else }}
image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
{{- end }}
{{- if .Values.agent.livenessProbe }}
livenessProbe:
execArgs: {{.Values.agent.livenessProbe.execArgs | quote}}
failureThreshold: {{.Values.agent.livenessProbe.failureThreshold}}
initialDelaySeconds: {{.Values.agent.livenessProbe.initialDelaySeconds}}
periodSeconds: {{.Values.agent.livenessProbe.periodSeconds}}
successThreshold: {{.Values.agent.livenessProbe.successThreshold}}
timeoutSeconds: {{.Values.agent.livenessProbe.timeoutSeconds}}
{{- end }}
privileged: "{{- if .Values.agent.privileged }}true{{- else }}false{{- end }}"
resourceLimitCpu: {{.Values.agent.resources.limits.cpu}}
resourceLimitMemory: {{.Values.agent.resources.limits.memory}}
{{- with .Values.agent.resources.limits.ephemeralStorage }}
resourceLimitEphemeralStorage: {{.}}
{{- end }}
resourceRequestCpu: {{.Values.agent.resources.requests.cpu}}
resourceRequestMemory: {{.Values.agent.resources.requests.memory}}
{{- with .Values.agent.resources.requests.ephemeralStorage }}
resourceRequestEphemeralStorage: {{.}}
{{- end }}
{{- with .Values.agent.runAsUser }}
runAsUser: {{ . }}
{{- end }}
{{- with .Values.agent.runAsGroup }}
runAsGroup: {{ . }}
{{- end }}
ttyEnabled: {{ .Values.agent.TTYEnabled }}
workingDir: {{ .Values.agent.workingDir }}
{{- range $additionalContainers := .Values.agent.additionalContainers }}
- name: "{{ $additionalContainers.sideContainerName }}"
alwaysPullImage: {{ $additionalContainers.alwaysPullImage | default $.Values.agent.alwaysPullImage }}
args: "{{ $additionalContainers.args | replace "$" "^$" }}"
{{- with $additionalContainers.command }}
command: {{ . }}
{{- end }}
envVars:
- envVar:
key: "JENKINS_URL"
{{- if $additionalContainers.jenkinsUrl }}
value: {{ tpl ($additionalContainers.jenkinsUrl) . }}
{{- else }}
value: "http://{{ template "jenkins.fullname" $ }}.{{ template "jenkins.namespace" $ }}.svc.{{ $.Values.clusterZone }}:{{ $.Values.controller.servicePort }}{{ default "/" $.Values.controller.jenkinsUriPrefix }}"
{{- end }}
image: "{{ $additionalContainers.image.repository }}:{{ $additionalContainers.image.tag }}"
{{- if $additionalContainers.livenessProbe }}
livenessProbe:
execArgs: {{$additionalContainers.livenessProbe.execArgs | quote}}
failureThreshold: {{$additionalContainers.livenessProbe.failureThreshold}}
initialDelaySeconds: {{$additionalContainers.livenessProbe.initialDelaySeconds}}
periodSeconds: {{$additionalContainers.livenessProbe.periodSeconds}}
successThreshold: {{$additionalContainers.livenessProbe.successThreshold}}
timeoutSeconds: {{$additionalContainers.livenessProbe.timeoutSeconds}}
{{- end }}
privileged: "{{- if $additionalContainers.privileged }}true{{- else }}false{{- end }}"
resourceLimitCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.cpu }}{{ else }}{{ $.Values.agent.resources.limits.cpu }}{{ end }}
resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }}
resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }}
resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }}
{{- if or $additionalContainers.runAsUser $.Values.agent.runAsUser }}
runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }}
{{- end }}
{{- if or $additionalContainers.runAsGroup $.Values.agent.runAsGroup }}
runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }}
{{- end }}
ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }}
workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }}
{{- end }}
{{- if or .Values.agent.envVars .Values.agent.secretEnvVars }}
envVars:
{{- range $index, $var := .Values.agent.envVars }}
- envVar:
key: {{ $var.name }}
value: {{ tpl $var.value $ }}
{{- end }}
{{- range $index, $var := .Values.agent.secretEnvVars }}
- secretEnvVar:
key: {{ $var.key }}
secretName: {{ $var.secretName }}
secretKey: {{ $var.secretKey }}
optional: {{ $var.optional | default false }}
{{- end }}
{{- end }}
idleMinutes: {{ .Values.agent.idleMinutes }}
instanceCap: {{ int .Values.agent.instanceCap }}
{{- if .Values.agent.hostNetworking }}
hostNetwork: {{ .Values.agent.hostNetworking }}
{{- end }}
{{- if .Values.agent.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.agent.imagePullSecretName }}
{{- end }}
label: "{{ .Release.Name }}-{{ .Values.agent.componentName }} {{ .Values.agent.customJenkinsLabels | join " " }}"
{{- if .Values.agent.nodeSelector }}
nodeSelector:
{{- $local := dict "first" true }}
{{- range $key, $value := .Values.agent.nodeSelector }}
{{- if $local.first }} {{ else }},{{ end }}
{{- $key }}={{ tpl $value $ }}
{{- $_ := set $local "first" false }}
{{- end }}
{{- end }}
nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }}
podRetention: {{ .Values.agent.podRetention }}
showRawYaml: {{ .Values.agent.showRawYaml }}
{{- $asaname := default (include "jenkins.serviceAccountAgentName" .) .Values.agent.serviceAccount -}}
{{- if or (.Values.agent.useDefaultServiceAccount) (.Values.agent.serviceAccount) }}
serviceAccount: "{{ $asaname }}"
{{- end }}
slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}"
{{- if .Values.agent.volumes }}
volumes:
{{- range $index, $volume := .Values.agent.volumes }}
-{{- if (eq $volume.type "ConfigMap") }} configMapVolume:
{{- else if (eq $volume.type "EmptyDir") }} emptyDirVolume:
{{- else if (eq $volume.type "EphemeralVolume") }} genericEphemeralVolume:
{{- else if (eq $volume.type "HostPath") }} hostPathVolume:
{{- else if (eq $volume.type "Nfs") }} nfsVolume:
{{- else if (eq $volume.type "PVC") }} persistentVolumeClaim:
{{- else if (eq $volume.type "Secret") }} secretVolume:
{{- else }} {{ $volume.type }}:
{{- end }}
{{- range $key, $value := $volume }}
{{- if not (eq $key "type") }}
{{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.agent.workspaceVolume }}
workspaceVolume:
{{- if (eq .Values.agent.workspaceVolume.type "DynamicPVC") }}
dynamicPVC:
{{- else if (eq .Values.agent.workspaceVolume.type "EmptyDir") }}
emptyDirWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "EphemeralVolume") }}
genericEphemeralVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "HostPath") }}
hostPathWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "Nfs") }}
nfsWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "PVC") }}
persistentVolumeClaimWorkspaceVolume:
{{- else }}
{{ .Values.agent.workspaceVolume.type }}:
{{- end }}
{{- range $key, $value := .Values.agent.workspaceVolume }}
{{- if not (eq $key "type") }}
{{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.agent.yamlTemplate }}
yaml: |-
{{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }}
{{- end }}
yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }}
inheritYamlMergeStrategy: {{ .Values.agent.inheritYamlMergeStrategy }}
{{- end -}}
{{- define "jenkins.kubernetes-version" -}}
{{- if .Values.controller.installPlugins -}}
{{- range .Values.controller.installPlugins -}}
{{- if hasPrefix "kubernetes:" . }}
{{- $split := splitList ":" . }}
{{- printf "%s" (index $split 1 ) -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.casc.security" }}
security:
{{- with .Values.controller.JCasC }}
{{- if .security }}
{{- .security | toYaml | nindent 2 }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "jenkins.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "jenkins.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account for Jenkins agents to use
*/}}
{{- define "jenkins.serviceAccountAgentName" -}}
{{- if .Values.serviceAccountAgent.create -}}
{{ default (printf "%s-%s" (include "jenkins.fullname" .) "agent") .Values.serviceAccountAgent.name }}
{{- else -}}
{{ default "default" .Values.serviceAccountAgent.name }}
{{- end -}}
{{- end -}}
{{/*
Create a full tag name for controller image
*/}}
{{- define "controller.image.tag" -}}
{{- if .Values.controller.image.tagLabel -}}
{{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.image.tagLabel) .Values.controller.image.tag -}}
{{- else -}}
{{- default .Chart.AppVersion .Values.controller.image.tag -}}
{{- end -}}
{{- end -}}
{{/*
Create the HTTP port for interacting with the controller
*/}}
{{- define "controller.httpPort" -}}
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- .Values.controller.httpsKeyStore.httpPort -}}
{{- else -}}
{{- .Values.controller.targetPort -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.configReloadContainer" -}}
{{- $root := index . 0 -}}
{{- $containerName := index . 1 -}}
{{- $containerType := index . 2 -}}
- name: {{ $containerName }}
image: "{{ $root.Values.controller.sidecars.configAutoReload.image.registry }}/{{ $root.Values.controller.sidecars.configAutoReload.image.repository }}:{{ $root.Values.controller.sidecars.configAutoReload.image.tag }}"
imagePullPolicy: {{ $root.Values.controller.sidecars.configAutoReload.imagePullPolicy }}
{{- if $root.Values.controller.sidecars.configAutoReload.containerSecurityContext }}
securityContext: {{- toYaml $root.Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 4 }}
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.envFrom }}
envFrom:
{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.envFrom) $root) | indent 4 }}
{{- end }}
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: "{{ template "jenkins.fullname" $root }}-jenkins-config"
- name: FOLDER
value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}"
- name: NAMESPACE
value: '{{ $root.Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" $root) }}'
{{- if eq $containerType "init" }}
- name: METHOD
value: "LIST"
{{- else if $root.Values.controller.sidecars.configAutoReload.sleepTime }}
- name: METHOD
value: "SLEEP"
- name: SLEEP_TIME
value: "{{ $root.Values.controller.sidecars.configAutoReload.sleepTime }}"
{{- end }}
{{- if eq $containerType "sidecar" }}
- name: REQ_URL
value: "{{- default "http" $root.Values.controller.sidecars.configAutoReload.scheme }}://localhost:{{- include "controller.httpPort" $root -}}{{- $root.Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)"
- name: REQ_METHOD
value: "POST"
- name: REQ_RETRY_CONNECT
value: "{{ $root.Values.controller.sidecars.configAutoReload.reqRetryConnect }}"
{{- if $root.Values.controller.sidecars.configAutoReload.skipTlsVerify }}
- name: REQ_SKIP_TLS_VERIFY
value: "true"
{{- end }}
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.env }}
{{- range $envVarItem := $root.Values.controller.sidecars.configAutoReload.env -}}
{{- if or (ne $containerType "init") (ne .name "METHOD") }}
{{- (tpl (toYaml (list $envVarItem)) $root) | nindent 4 }}
{{- end -}}
{{- end -}}
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
- name: LOG_CONFIG
value: "{{ $root.Values.controller.jenkinsHome }}/auto-reload/auto-reload-config.yaml"
{{- end }}
resources:
{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }}
volumeMounts:
- name: sc-config-volume
mountPath: {{ $root.Values.controller.sidecars.configAutoReload.folder | quote }}
- name: jenkins-home
mountPath: {{ $root.Values.controller.jenkinsHome }}
{{- if $root.Values.persistence.subPath }}
subPath: {{ $root.Values.persistence.subPath }}
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
- name: auto-reload-config
mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload
- name: auto-reload-config-logs
mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload-logs
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts }}
{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts) $root) | indent 4 }}
{{- end }}
{{- end -}}
helm-templates/jenkins-grn/templates/auto-reload-config.yaml
-60
View File
@@ -1,60 +0,0 @@
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}-auto-reload-config
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": {{ template "jenkins.name" . }}
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
data:
auto-reload-config.yaml: |-
version: 1
disable_existing_loggers: false
root:
level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
handlers:
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
- console
{{- end }}
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
- file
{{- end }}
handlers:
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
console:
class: logging.StreamHandler
level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
{{- end }}
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
file:
class : logging.handlers.RotatingFileHandler
formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
filename: {{ .Values.controller.jenkinsHome }}/auto-reload-logs/file.log
maxBytes: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.maxBytes }}
backupCount: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.backupCount }}
{{- end }}
formatters:
JSON:
"()": logger.JsonFormatter
format: "%(levelname)s %(message)s"
rename_fields:
message: msg
levelname: level
LOGFMT:
"()": logger.LogfmtFormatter
keys:
- time
- level
- msg
mapping:
time: asctime
level: levelname
msg: message
{{- end }}
helm-templates/jenkins-grn/templates/config-init-scripts.yaml
-18
View File
@@ -1,18 +0,0 @@
{{- if .Values.controller.initScripts -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}-init-scripts
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
data:
{{- range $key, $val := .Values.controller.initScripts }}
init{{ $key }}.groovy: |-
{{ tpl $val $ | indent 4 }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/config.yaml
-92
View File
@@ -1,92 +0,0 @@
{{- $jenkinsHome := .Values.controller.jenkinsHome -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
data:
apply_config.sh: |-
set -e
{{- if .Values.controller.initializeOnce }}
if [ -f {{ .Values.controller.jenkinsHome }}/initialization-completed ]; then
echo "controller was previously initialized, refusing to re-initialize"
exit 0
fi
{{- end }}
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.InstallUtil.lastExecVersion
{{- if .Values.controller.overwritePlugins }}
echo "remove all plugins from shared volume"
# remove all plugins from shared volume
rm -rf {{ .Values.controller.jenkinsHome }}/plugins/*
{{- end }}
{{- if .Values.controller.JCasC.overwriteConfiguration }}
echo "deleting all XML config files"
rm -f {{ .Values.controller.jenkinsHome }}/config.xml
rm -f {{ .Values.controller.jenkinsHome }}/*plugins*.xml
find {{ .Values.controller.jenkinsHome }} -maxdepth 1 -type f -iname '*configuration*.xml' -exec rm -f {} \;
{{- end }}
{{- if .Values.controller.installPlugins }}
echo "download plugins"
# Install missing plugins
cp /var/jenkins_config/plugins.txt {{ .Values.controller.jenkinsHome }};
rm -rf {{ .Values.controller.jenkinsRef }}/plugins/*.lock
version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
if [ -f "{{ .Values.controller.jenkinsWar }}" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then
jenkins-plugin-cli --verbose --war "{{ .Values.controller.jenkinsWar }}" --plugin-file "{{ .Values.controller.jenkinsHome }}/plugins.txt" --latest {{ .Values.controller.installLatestPlugins }}{{- if .Values.controller.installLatestSpecifiedPlugins }} --latest-specified{{- end }};
else
/usr/local/bin/install-plugins.sh `echo $(cat {{ .Values.controller.jenkinsHome }}/plugins.txt)`;
fi
echo "copy plugins to shared volume"
# Copy plugins to shared volume
yes n | cp -i {{ .Values.controller.jenkinsRef }}/plugins/* /var/jenkins_plugins/;
{{- end }}
{{- if not .Values.controller.sidecars.configAutoReload.enabled }}
echo "copy configuration as code files"
mkdir -p {{ .Values.controller.jenkinsHome }}/casc_configs;
rm -rf {{ .Values.controller.jenkinsHome }}/casc_configs/*
{{- if or .Values.controller.JCasC.defaultConfig .Values.controller.JCasC.configScripts }}
cp -v /var/jenkins_config/*.yaml {{ .Values.controller.jenkinsHome }}/casc_configs
{{- end }}
{{- end }}
echo "finished initialization"
{{- if .Values.controller.initializeOnce }}
touch {{ .Values.controller.jenkinsHome }}/initialization-completed
{{- end }}
{{- if not .Values.controller.sidecars.configAutoReload.enabled }}
# Only add config to this script if we aren't auto-reloading otherwise the pod will restart upon each config change:
{{- if .Values.controller.JCasC.defaultConfig }}
jcasc-default-config.yaml: |-
{{- include "jenkins.casc.defaults" . |nindent 4}}
{{- end }}
{{- range $key, $val := .Values.controller.JCasC.configScripts }}
{{ $key }}.yaml: |-
{{ tpl $val $| indent 4 }}
{{- end }}
{{- end }}
plugins.txt: |-
{{- if .Values.controller.installPlugins }}
{{- range $installPlugin := .Values.controller.installPlugins }}
{{- $installPlugin | nindent 4 }}
{{- end }}
{{- range $addlPlugin := .Values.controller.additionalPlugins }}
{{- /* duplicate plugin check */}}
{{- range $installPlugin := $.Values.controller.installPlugins }}
{{- if eq (splitList ":" $addlPlugin | first) (splitList ":" $installPlugin | first) }}
{{- $message := print "[PLUGIN CONFLICT] controller.additionalPlugins contains '" $addlPlugin "'" }}
{{- $message := print $message " but controller.installPlugins already contains '" $installPlugin "'." }}
{{- $message := print $message " Override controller.installPlugins to use '" $addlPlugin "' plugin." }}
{{- fail $message }}
{{- end }}
{{- end }}
{{- $addlPlugin | nindent 4 }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/deprecation.yaml
-151
View File
@@ -1,151 +0,0 @@
{{- if .Values.checkDeprecation }}
{{- if .Values.master }}
{{ fail "`master` does no longer exist. It has been renamed to `controller`" }}
{{- end }}
{{- if .Values.controller.imageTag }}
{{ fail "`controller.imageTag` does no longer exist. Please use `controller.image.tag` instead" }}
{{- end }}
{{- if .Values.controller.slaveListenerPort }}
{{ fail "`controller.slaveListenerPort` does no longer exist. It has been renamed to `controller.agentListenerPort`" }}
{{- end }}
{{- if .Values.controller.slaveHostPort }}
{{ fail "`controller.slaveHostPort` does no longer exist. It has been renamed to `controller.agentListenerHostPort`" }}
{{- end }}
{{- if .Values.controller.slaveKubernetesNamespace }}
{{ fail "`controller.slaveKubernetesNamespace` does no longer exist. It has been renamed to `agent.namespace`" }}
{{- end }}
{{- if .Values.controller.slaveDefaultsProviderTemplate }}
{{ fail "`controller.slaveDefaultsProviderTemplate` does no longer exist. It has been renamed to `agent.defaultsProviderTemplate`" }}
{{- end }}
{{- if .Values.controller.useSecurity }}
{{ fail "`controller.useSecurity` does no longer exist. It has been renamed to `controller.adminSecret`" }}
{{- end }}
{{- if .Values.controller.slaveJenkinsUrl }}
{{ fail "`controller.slaveJenkinsUrl` does no longer exist. It has been renamed to `agent.jenkinsUrl`" }}
{{- end }}
{{- if .Values.controller.slaveJenkinsTunnel }}
{{ fail "`controller.slaveJenkinsTunnel` does no longer exist. It has been renamed to `agent.jenkinsTunnel`" }}
{{- end }}
{{- if .Values.controller.slaveConnectTimeout }}
{{ fail "`controller.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.kubernetesConnectTimeout`" }}
{{- end }}
{{- if .Values.controller.slaveReadTimeout }}
{{ fail "`controller.slaveReadTimeout` does no longer exist. It has been renamed to `agent.kubernetesReadTimeout`" }}
{{- end }}
{{- if .Values.controller.slaveListenerServiceType }}
{{ fail "`controller.slaveListenerServiceType` does no longer exist. It has been renamed to `controller.agentListenerServiceType`" }}
{{- end }}
{{- if .Values.controller.slaveListenerLoadBalancerIP }}
{{ fail "`controller.slaveListenerLoadBalancerIP` does no longer exist. It has been renamed to `controller.agentListenerLoadBalancerIP`" }}
{{- end }}
{{- if .Values.controller.slaveListenerServiceAnnotations }}
{{ fail "`controller.slaveListenerServiceAnnotations` does no longer exist. It has been renamed to `controller.agentListenerServiceAnnotations`" }}
{{- end }}
{{- if .Values.agent.slaveConnectTimeout }}
{{ fail "`agent.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.connectTimeout`" }}
{{- end }}
{{- if .Values.NetworkPolicy }}
{{- if .Values.NetworkPolicy.Enabled }}
{{ fail "`NetworkPolicy.Enabled` does no longer exist. It has been renamed to `networkPolicy.enabled`" }}
{{- end }}
{{- if .Values.NetworkPolicy.ApiVersion }}
{{ fail "`NetworkPolicy.ApiVersion` does no longer exist. It has been renamed to `networkPolicy.apiVersion`" }}
{{- end }}
{{ fail "NetworkPolicy.* values have been renamed, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.install }}
{{ fail "`rbac.install` does no longer exist. It has been renamed to `rbac.create` and is enabled by default!" }}
{{- end }}
{{- if .Values.rbac.serviceAccountName }}
{{ fail "`rbac.serviceAccountName` does no longer exist. It has been renamed to `serviceAccount.name`" }}
{{- end }}
{{- if .Values.rbac.serviceAccountAnnotations }}
{{ fail "`rbac.serviceAccountAnnotations` does no longer exist. It has been renamed to `serviceAccount.annotations`" }}
{{- end }}
{{- if .Values.rbac.roleRef }}
{{ fail "`rbac.roleRef` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.roleKind }}
{{ fail "`rbac.roleKind` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.roleBindingKind }}
{{ fail "`rbac.roleBindingKind` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.controller.JCasC.pluginVersion }}
{{ fail "controller.JCasC.pluginVersion has been deprecated, please use controller.installPlugins instead" }}
{{- end }}
{{- if .Values.controller.deploymentLabels }}
{{ fail "`controller.deploymentLabels` does no longer exist. It has been renamed to `controller.statefulSetLabels`" }}
{{- end }}
{{- if .Values.controller.deploymentAnnotations }}
{{ fail "`controller.deploymentAnnotations` does no longer exist. It has been renamed to `controller.statefulSetAnnotations`" }}
{{- end }}
{{- if .Values.controller.rollingUpdate }}
{{ fail "`controller.rollingUpdate` does no longer exist. It is no longer relevant, since a StatefulSet is used for the Jenkins controller" }}
{{- end }}
{{- if .Values.controller.tag }}
{{ fail "`controller.tag` no longer exists. It has been renamed to `controller.image.tag'" }}
{{- end }}
{{- if .Values.controller.tagLabel }}
{{ fail "`controller.tagLabel` no longer exists. It has been renamed to `controller.image.tagLabel`" }}
{{- end }}
{{- if .Values.controller.adminSecret }}
{{ fail "`controller.adminSecret` no longer exists. It has been renamed to `controller.admin.createSecret`" }}
{{- end }}
{{- if .Values.controller.adminUser }}
{{ fail "`controller.adminUser` no longer exists. It has been renamed to `controller.admin.username`" }}
{{- end }}
{{- if .Values.controller.adminPassword }}
{{ fail "`controller.adminPassword` no longer exists. It has been renamed to `controller.admin.password`" }}
{{- end }}
{{- if .Values.controller.sidecars.other }}
{{ fail "`controller.sidecars.other` no longer exists. It has been renamed to `controller.sidecars.additionalSidecarContainers`" }}
{{- end }}
{{- if .Values.agent.tag }}
{{ fail "`controller.agent.tag` no longer exists. It has been renamed to `controller.agent.image.tag`" }}
{{- end }}
{{- if .Values.backup }}
{{ fail "`controller.backup` no longer exists." }}
{{- end }}
{{- if .Values.helmtest.bats.tag }}
{{ fail "`helmtest.bats.tag` no longer exists. It has been renamed to `helmtest.bats.image.tag`" }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/home-pvc.yaml
-41
View File
@@ -1,41 +0,0 @@
{{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }}
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
{{- if .Values.persistence.annotations }}
annotations:
{{ toYaml .Values.persistence.annotations | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.persistence.labels }}
{{ toYaml .Values.persistence.labels | indent 4 }}
{{- end }}
spec:
{{- if .Values.persistence.dataSource }}
dataSource:
{{ toYaml .Values.persistence.dataSource | indent 4 }}
{{- end }}
accessModes:
- {{ .Values.persistence.accessMode | quote }}
resources:
requests:
storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
storageClassName: ""
{{- else }}
storageClassName: "{{ tpl .Values.persistence.storageClass . }}"
{{- end }}
{{- end }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/jcasc-config.yaml
-53
View File
@@ -1,53 +0,0 @@
{{- $root := . }}
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
{{- range $key, $val := .Values.controller.JCasC.configScripts }}
{{- if $val }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
"app.kubernetes.io/name": {{ template "jenkins.name" $root}}
{{- if $root.Values.renderHelmLabels }}
"helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
{{- if $root.Values.controller.JCasC.configMapAnnotations }}
annotations:
{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
{{- end }}
data:
{{ $key }}.yaml: |-
{{ tpl $val $| indent 4 }}
{{- end }}
{{- end }}
{{- if .Values.controller.JCasC.defaultConfig }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
"app.kubernetes.io/name": {{ template "jenkins.name" $root}}
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
{{- if $root.Values.controller.JCasC.configMapAnnotations }}
annotations:
{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
{{- end }}
data:
jcasc-default-config.yaml: |-
{{- include "jenkins.casc.defaults" . | nindent 4 }}
{{- end}}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-agent-svc.yaml
-43
View File
@@ -1,43 +0,0 @@
{{- if .Values.controller.agentListenerEnabled }}
apiVersion: v1
kind: Service
metadata:
name: {{ template "jenkins.fullname" . }}-agent
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.agentListenerServiceAnnotations }}
annotations:
{{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }}
{{- end }}
spec:
{{- if .Values.controller.agentListenerExternalTrafficPolicy }}
externalTrafficPolicy: {{.Values.controller.agentListenerExternalTrafficPolicy}}
{{- end }}
ports:
- port: {{ .Values.controller.agentListenerPort }}
targetPort: {{ .Values.controller.agentListenerPort }}
{{- if (and (eq .Values.controller.agentListenerServiceType "NodePort") (not (empty .Values.controller.agentListenerNodePort))) }}
nodePort: {{ .Values.controller.agentListenerNodePort }}
{{- end }}
name: agent-listener
selector:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
type: {{ .Values.controller.agentListenerServiceType }}
{{if eq .Values.controller.agentListenerServiceType "LoadBalancer"}}
{{- if .Values.controller.agentListenerLoadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.agentListenerLoadBalancerSourceRanges | indent 4 }}
{{- end }}
{{- end }}
{{- if and (eq .Values.controller.agentListenerServiceType "LoadBalancer") (.Values.controller.agentListenerLoadBalancerIP) }}
loadBalancerIP: {{ .Values.controller.agentListenerLoadBalancerIP }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-aws-security-group-policies.yaml
-16
View File
@@ -1,16 +0,0 @@
{{- if .Values.awsSecurityGroupPolicies.enabled -}}
{{- range .Values.awsSecurityGroupPolicies.policies -}}
apiVersion: vpcresources.k8s.aws/v1beta1
kind: SecurityGroupPolicy
metadata:
name: {{ .name }}
namespace: {{ template "jenkins.namespace" $ }}
spec:
podSelector:
{{- toYaml .podSelector | nindent 6}}
securityGroups:
groupIds:
{{- toYaml .securityGroupIds | nindent 6}}
---
{{- end -}}
{{- end -}}
helm-templates/jenkins-grn/templates/jenkins-controller-alerting-rules.yaml
-26
View File
@@ -1,26 +0,0 @@
{{- if and .Values.controller.prometheus.enabled .Values.controller.prometheus.alertingrules }}
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: {{ template "jenkins.fullname" . }}
{{- if .Values.controller.prometheus.prometheusRuleNamespace }}
namespace: {{ .Values.controller.prometheus.prometheusRuleNamespace }}
{{- else }}
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
spec:
groups:
{{ toYaml .Values.controller.prometheus.alertingrules | indent 2 }}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-backendconfig.yaml
-24
View File
@@ -1,24 +0,0 @@
{{- if .Values.controller.backendconfig.enabled }}
apiVersion: {{ .Values.controller.backendconfig.apiVersion }}
kind: BackendConfig
metadata:
name: {{ .Values.controller.backendconfig.name }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.backendconfig.labels }}
{{ toYaml .Values.controller.backendconfig.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.backendconfig.annotations }}
annotations:
{{ toYaml .Values.controller.backendconfig.annotations | indent 4 }}
{{- end }}
spec:
{{ toYaml .Values.controller.backendconfig.spec | indent 2 }}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-ingress.yaml
-77
View File
@@ -1,77 +0,0 @@
{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }}
{{- if .Values.controller.ingress.enabled }}
{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: {{ .Values.controller.ingress.apiVersion }}
{{- end }}
kind: Ingress
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.ingress.labels }}
{{ toYaml .Values.controller.ingress.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.ingress.annotations }}
annotations:
{{ tpl (toYaml .Values.controller.ingress.annotations) . | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}
spec:
{{- if .Values.controller.ingress.ingressClassName }}
ingressClassName: {{ tpl .Values.controller.ingress.ingressClassName . | quote }}
{{- end }}
rules:
- http:
paths:
{{- if empty (.Values.controller.ingress.paths) }}
- backend:
{{- if semverCompare ">=1.19-0" $kubeTargetVersion }}
service:
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
pathType: ImplementationSpecific
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
{{- end }}
{{- if .Values.controller.ingress.path }}
path: {{ .Values.controller.ingress.path }}
{{- end -}}
{{- else }}
{{ tpl (toYaml .Values.controller.ingress.paths | indent 6) . }}
{{- end -}}
{{- if .Values.controller.ingress.hostName }}
host: {{ tpl .Values.controller.ingress.hostName . | quote }}
{{- end }}
{{- if .Values.controller.ingress.resourceRootUrl }}
- http:
paths:
- backend:
{{- if semverCompare ">=1.19-0" $kubeTargetVersion }}
service:
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
pathType: ImplementationSpecific
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
{{- end }}
host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }}
{{- end }}
{{- if .Values.controller.ingress.tls }}
tls:
{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }}
{{- end -}}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-networkpolicy.yaml
-76
View File
@@ -1,76 +0,0 @@
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ .Values.networkPolicy.apiVersion }}
metadata:
name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
spec:
podSelector:
matchLabels:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
ingress:
# Allow web access to the UI
- ports:
- port: {{ .Values.controller.targetPort }}
{{- if .Values.controller.agentListenerEnabled }}
# Allow inbound connections from agents
- from:
{{- if .Values.networkPolicy.internalAgents.allowed }}
- podSelector:
matchLabels:
"jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true"
{{- range $k,$v:= .Values.networkPolicy.internalAgents.podLabels }}
{{ $k }}: {{ $v }}
{{- end }}
{{- if .Values.networkPolicy.internalAgents.namespaceLabels }}
namespaceSelector:
matchLabels:
{{- range $k,$v:= .Values.networkPolicy.internalAgents.namespaceLabels }}
{{ $k }}: {{ $v }}
{{- end }}
{{- end }}
{{- end }}
{{- if or .Values.networkPolicy.externalAgents.ipCIDR .Values.networkPolicy.externalAgents.except }}
- ipBlock:
cidr: {{ required "ipCIDR is required if you wish to allow external agents to connect to Jenkins Controller." .Values.networkPolicy.externalAgents.ipCIDR }}
{{- if .Values.networkPolicy.externalAgents.except }}
except:
{{- range .Values.networkPolicy.externalAgents.except }}
- {{ . }}
{{- end }}
{{- end }}
{{- end }}
ports:
- port: {{ .Values.controller.agentListenerPort }}
{{- end }}
{{- if .Values.agent.enabled }}
---
kind: NetworkPolicy
apiVersion: {{ .Values.networkPolicy.apiVersion }}
metadata:
name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
spec:
podSelector:
matchLabels:
# DefaultDeny
"jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true"
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-pdb.yaml
-34
View File
@@ -1,34 +0,0 @@
{{- if .Values.controller.podDisruptionBudget.enabled }}
{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }}
{{- if semverCompare ">=1.21-0" $kubeTargetVersion -}}
apiVersion: policy/v1
{{- else if semverCompare ">=1.5-0" $kubeTargetVersion -}}
apiVersion: policy/v1beta1
{{- else -}}
apiVersion: {{ .Values.controller.podDisruptionBudget.apiVersion }}
{{- end }}
kind: PodDisruptionBudget
metadata:
name: {{ template "jenkins.fullname" . }}-pdb
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.podDisruptionBudget.labels -}}
{{ toYaml .Values.controller.podDisruptionBudget.labels | nindent 4 }}
{{- end }}
{{- if .Values.controller.podDisruptionBudget.annotations }}
annotations: {{ toYaml .Values.controller.podDisruptionBudget.annotations | nindent 4 }}
{{- end }}
spec:
maxUnavailable: {{ .Values.controller.podDisruptionBudget.maxUnavailable }}
selector:
matchLabels:
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-podmonitor.yaml
-30
View File
@@ -1,30 +0,0 @@
{{- if .Values.controller.googlePodMonitor.enabled }}
apiVersion: monitoring.googleapis.com/v1
kind: PodMonitoring
metadata:
name: {{ template "jenkins.fullname" . }}
{{- if .Values.controller.googlePodMonitor.serviceMonitorNamespace }}
namespace: {{ .Values.controller.googlePodMonitor.serviceMonitorNamespace }}
{{- else }}
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
spec:
endpoints:
- interval: {{ .Values.controller.googlePodMonitor.scrapeInterval }}
port: http
path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.googlePodMonitor.scrapeEndpoint }}
selector:
matchLabels:
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-route.yaml
-34
View File
@@ -1,34 +0,0 @@
{{- if .Values.controller.route.enabled }}
apiVersion: route.openshift.io/v1
kind: Route
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
app: {{ template "jenkins.fullname" . }}
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
component: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
{{- if .Values.controller.route.labels }}
{{ toYaml .Values.controller.route.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.route.annotations }}
annotations:
{{ toYaml .Values.controller.route.annotations | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}
spec:
host: {{ .Values.controller.route.path }}
port:
targetPort: http
tls:
insecureEdgeTerminationPolicy: Redirect
termination: edge
to:
kind: Service
name: {{ template "jenkins.fullname" . }}
weight: 100
wildcardPolicy: None
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-secondary-ingress.yaml
-56
View File
@@ -1,56 +0,0 @@
{{- if .Values.controller.secondaryingress.enabled }}
{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }}
{{- $serviceName := include "jenkins.fullname" . -}}
{{- $servicePort := .Values.controller.servicePort -}}
{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: {{ .Values.controller.secondaryingress.apiVersion }}
{{- end }}
kind: Ingress
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.secondaryingress.labels -}}
{{ toYaml .Values.controller.secondaryingress.labels | nindent 4 }}
{{- end }}
{{- if .Values.controller.secondaryingress.annotations }}
annotations: {{ toYaml .Values.controller.secondaryingress.annotations | nindent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}-secondary
spec:
{{- if .Values.controller.secondaryingress.ingressClassName }}
ingressClassName: {{ .Values.controller.secondaryingress.ingressClassName | quote }}
{{- end }}
rules:
- host: {{ .Values.controller.secondaryingress.hostName }}
http:
paths:
{{- range .Values.controller.secondaryingress.paths }}
- path: {{ . | quote }}
backend:
{{ if semverCompare ">=1.19-0" $kubeTargetVersion }}
service:
name: {{ $serviceName }}
port:
number: {{ $servicePort }}
pathType: ImplementationSpecific
{{ else }}
serviceName: {{ $serviceName }}
servicePort: {{ $servicePort }}
{{ end }}
{{- end}}
{{- if .Values.controller.secondaryingress.tls }}
tls:
{{ toYaml .Values.controller.secondaryingress.tls | indent 4 }}
{{- end -}}
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-servicemonitor.yaml
-45
View File
@@ -1,45 +0,0 @@
{{- if and .Values.controller.prometheus.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ template "jenkins.fullname" . }}
{{- if .Values.controller.prometheus.serviceMonitorNamespace }}
namespace: {{ .Values.controller.prometheus.serviceMonitorNamespace }}
{{- else }}
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- range $key, $val := .Values.controller.prometheus.serviceMonitorAdditionalLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
spec:
endpoints:
- interval: {{ .Values.controller.prometheus.scrapeInterval }}
port: http
path: {{ .Values.controller.jenkinsUriPrefix }}{{ .Values.controller.prometheus.scrapeEndpoint }}
{{- with .Values.controller.prometheus.relabelings }}
relabelings:
{{- toYaml . | nindent 6 }}
{{- end }}
{{- with .Values.controller.prometheus.metricRelabelings }}
metricRelabelings:
{{- toYaml . | nindent 6 }}
{{- end }}
jobLabel: {{ template "jenkins.fullname" . }}
namespaceSelector:
matchNames:
- "{{ template "jenkins.namespace" $ }}"
selector:
matchLabels:
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- end }}
helm-templates/jenkins-grn/templates/jenkins-controller-statefulset.yaml
-434
View File
@@ -1,434 +0,0 @@
{{- if .Capabilities.APIVersions.Has "apps/v1" }}
apiVersion: apps/v1
{{- else }}
apiVersion: apps/v1beta1
{{- end }}
kind: StatefulSet
metadata:
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- range $key, $val := .Values.controller.statefulSetLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
{{- with .Values.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if .Values.controller.statefulSetAnnotations }}
annotations:
{{ toYaml .Values.controller.statefulSetAnnotations | indent 4 }}
{{- end }}
spec:
serviceName: {{ template "jenkins.fullname" . }}
replicas: 1
selector:
matchLabels:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
{{- if .Values.controller.updateStrategy }}
updateStrategy:
{{ toYaml .Values.controller.updateStrategy | indent 4 }}
{{- end }}
template:
metadata:
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- range $key, $val := .Values.controller.podLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
{{- with .Values.labels }}
{{- toYaml . | nindent 8 }}
{{- end }}
annotations:
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
{{- if .Values.controller.initScripts }}
checksum/config-init-scripts: {{ include (print $.Template.BasePath "/config-init-scripts.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.controller.podAnnotations }}
{{ tpl (toYaml .Values.controller.podAnnotations | indent 8) . }}
{{- end }}
spec:
{{- if .Values.controller.schedulerName }}
schedulerName: {{ .Values.controller.schedulerName }}
{{- end }}
{{- if .Values.controller.nodeSelector }}
nodeSelector:
{{ toYaml .Values.controller.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.controller.tolerations }}
tolerations:
{{ toYaml .Values.controller.tolerations | indent 8 }}
{{- end }}
{{- if .Values.controller.affinity }}
affinity:
{{ toYaml .Values.controller.affinity | indent 8 }}
{{- end }}
{{- if .Values.controller.topologySpreadConstraints }}
topologySpreadConstraints:
{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }}
{{- end }}
{{- if quote .Values.controller.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- end }}
{{- if .Values.controller.priorityClassName }}
priorityClassName: {{ .Values.controller.priorityClassName }}
{{- end }}
{{- if .Values.controller.shareProcessNamespace }}
shareProcessNamespace: true
{{- end }}
{{- if not .Values.controller.enableServiceLinks }}
enableServiceLinks: false
{{- end }}
{{- if .Values.controller.usePodSecurityContext }}
securityContext:
{{- if kindIs "map" .Values.controller.podSecurityContextOverride }}
{{- tpl (toYaml .Values.controller.podSecurityContextOverride | nindent 8) . -}}
{{- else }}
{{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed:
runAsUser: 1000
fsGroup: 1000
runAsNonRoot: true
*/}}
runAsUser: {{ default 0 .Values.controller.runAsUser }}
{{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }}
{{- if not (eq (int .Values.controller.runAsUser) 0) }}
fsGroup: {{ .Values.controller.fsGroup }}
runAsNonRoot: true
{{- end }}
{{- if .Values.controller.securityContextCapabilities }}
capabilities:
{{- toYaml .Values.controller.securityContextCapabilities | nindent 10 }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}"
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.hostNetworking }}
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
{{- end }}
{{- if .Values.controller.hostAliases }}
hostAliases:
{{- toYaml .Values.controller.hostAliases | nindent 8 }}
{{- end }}
initContainers:
{{- if .Values.controller.customInitContainers }}
{{ tpl (toYaml .Values.controller.customInitContainers) . | indent 8 }}
{{- end }}
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
{{- include "jenkins.configReloadContainer" (list $ "config-reload-init" "init") | nindent 8 }}
{{- end}}
- name: "init"
image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}"
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
{{- if .Values.controller.containerSecurityContext }}
securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }}
{{- end }}
command: [ "sh", "/var/jenkins_config/apply_config.sh" ]
{{- if .Values.controller.initContainerEnvFrom }}
envFrom:
{{ (tpl (toYaml .Values.controller.initContainerEnvFrom) .) | indent 12 }}
{{- end }}
{{- if .Values.controller.initContainerEnv }}
env:
{{ (tpl (toYaml .Values.controller.initContainerEnv) .) | indent 12 }}
{{- end }}
resources:
{{- if .Values.controller.initContainerResources }}
{{ toYaml .Values.controller.initContainerResources | indent 12 }}
{{- else }}
{{ toYaml .Values.controller.resources | indent 12 }}
{{- end }}
volumeMounts:
{{- if .Values.persistence.mounts }}
{{ toYaml .Values.persistence.mounts | indent 12 }}
{{- end }}
- mountPath: {{ .Values.controller.jenkinsHome }}
name: jenkins-home
{{- if .Values.persistence.subPath }}
subPath: {{ .Values.persistence.subPath }}
{{- end }}
- mountPath: /var/jenkins_config
name: jenkins-config
{{- if .Values.controller.installPlugins }}
{{- if .Values.controller.overwritePluginsFromImage }}
- mountPath: {{ .Values.controller.jenkinsRef }}/plugins
name: plugins
{{- end }}
- mountPath: /var/jenkins_plugins
name: plugin-dir
- mountPath: /tmp
name: tmp-volume
{{- end }}
{{- if or .Values.controller.initScripts .Values.controller.initConfigMap }}
- mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d
name: init-scripts
{{- end }}
{{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }}
{{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }}
- mountPath: {{ $httpsJKSDirPath }}
name: jenkins-https-keystore
{{- end }}
containers:
- name: jenkins
image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}"
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
{{- if .Values.controller.containerSecurityContext }}
securityContext: {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }}
{{- end }}
{{- if .Values.controller.overrideArgs }}
args: [
{{- range $overrideArg := .Values.controller.overrideArgs }}
"{{- tpl $overrideArg $ }}",
{{- end }}
]
{{- else if .Values.controller.httpsKeyStore.enable }}
{{- $httpsJKSFilePath := printf "%s/%s" .Values.controller.httpsKeyStore.path .Values.controller.httpsKeyStore.fileName }}
args: [ "--httpPort={{.Values.controller.httpsKeyStore.httpPort}}", "--httpsPort={{.Values.controller.targetPort}}", '--httpsKeyStore={{ $httpsJKSFilePath }}', "--httpsKeyStorePassword=$(JENKINS_HTTPS_KEYSTORE_PASSWORD)" ]
{{- else }}
args: [ "--httpPort={{.Values.controller.targetPort}}"]
{{- end }}
{{- if .Values.controller.lifecycle }}
lifecycle:
{{ toYaml .Values.controller.lifecycle | indent 12 }}
{{- end }}
{{- if .Values.controller.terminationMessagePath }}
terminationMessagePath: {{ .Values.controller.terminationMessagePath }}
{{- end }}
{{- if .Values.controller.terminationMessagePolicy }}
terminationMessagePolicy: {{ .Values.controller.terminationMessagePolicy }}
{{- end }}
{{- if .Values.controller.containerEnvFrom }}
envFrom:
{{ (tpl ( toYaml .Values.controller.containerEnvFrom) .) | indent 12 }}
{{- end }}
env:
{{- if .Values.controller.containerEnv }}
{{ (tpl ( toYaml .Values.controller.containerEnv) .) | indent 12 }}
{{- end }}
{{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }}
- name: SECRETS
value: /run/secrets/additional
{{- end }}
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: JAVA_OPTS
value: >-
{{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ default "" .Values.controller.javaOpts }}
- name: JENKINS_OPTS
value: >-
{{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ default "" .Values.controller.jenkinsOpts}}
- name: JENKINS_SLAVE_AGENT_PORT
value: "{{ .Values.controller.agentListenerPort }}"
{{- if .Values.controller.httpsKeyStore.enable }}
- name: JENKINS_HTTPS_KEYSTORE_PASSWORD
{{- if not .Values.controller.httpsKeyStore.disableSecretMount }}
valueFrom:
secretKeyRef:
name: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName }} {{ else if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }}
key: "{{ .Values.controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey }}"
{{- else }}
value: {{ .Values.controller.httpsKeyStore.password }}
{{- end }}
{{- end }}
- name: CASC_JENKINS_CONFIG
value: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }}{{- if .Values.controller.JCasC.configUrls }},{{ join "," .Values.controller.JCasC.configUrls }}{{- end }}
ports:
{{- if .Values.controller.httpsKeyStore.enable }}
- containerPort: {{.Values.controller.httpsKeyStore.httpPort}}
{{- else }}
- containerPort: {{.Values.controller.targetPort}}
{{- end }}
name: http
- containerPort: {{ .Values.controller.agentListenerPort }}
name: agent-listener
{{- if .Values.controller.agentListenerHostPort }}
hostPort: {{ .Values.controller.agentListenerHostPort }}
{{- end }}
{{- if .Values.controller.jmxPort }}
- containerPort: {{ .Values.controller.jmxPort }}
name: jmx
{{- end }}
{{- range $index, $port := .Values.controller.extraPorts }}
- containerPort: {{ $port.port }}
name: {{ $port.name }}
{{- end }}
{{- if and .Values.controller.healthProbes .Values.controller.probes}}
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion }}
startupProbe:
{{ tpl (toYaml .Values.controller.probes.startupProbe | indent 12) .}}
{{- end }}
livenessProbe:
{{ tpl (toYaml .Values.controller.probes.livenessProbe | indent 12) .}}
readinessProbe:
{{ tpl (toYaml .Values.controller.probes.readinessProbe | indent 12) .}}
{{- end }}
resources:
{{ toYaml .Values.controller.resources | indent 12 }}
volumeMounts:
{{- if .Values.persistence.mounts }}
{{ toYaml .Values.persistence.mounts | indent 12 }}
{{- end }}
{{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }}
{{- $httpsJKSDirPath := printf "%s" .Values.controller.httpsKeyStore.path }}
- mountPath: {{ $httpsJKSDirPath }}
name: jenkins-https-keystore
{{- end }}
- mountPath: {{ .Values.controller.jenkinsHome }}
name: jenkins-home
readOnly: false
{{- if .Values.persistence.subPath }}
subPath: {{ .Values.persistence.subPath }}
{{- end }}
- mountPath: /var/jenkins_config
name: jenkins-config
readOnly: true
{{- if .Values.controller.installPlugins }}
- mountPath: {{ .Values.controller.jenkinsRef }}/plugins/
name: plugin-dir
readOnly: false
{{- end }}
{{- if or .Values.controller.initScripts .Values.controller.initConfigMap }}
- mountPath: {{ .Values.controller.jenkinsHome }}/init.groovy.d
name: init-scripts
{{- end }}
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
- name: sc-config-volume
mountPath: {{ .Values.controller.sidecars.configAutoReload.folder | default (printf "%s/casc_configs" (.Values.controller.jenkinsRef)) }}
{{- end }}
{{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }}
- name: jenkins-secrets
mountPath: /run/secrets/additional
readOnly: true
{{- end }}
- name: jenkins-cache
mountPath: /var/jenkins_cache
- mountPath: /tmp
name: tmp-volume
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
{{- include "jenkins.configReloadContainer" (list $ "config-reload" "sidecar") | nindent 8 }}
{{- end}}
{{- if .Values.controller.sidecars.additionalSidecarContainers}}
{{ tpl (toYaml .Values.controller.sidecars.additionalSidecarContainers | indent 8) .}}
{{- end }}
volumes:
{{- if .Values.persistence.volumes }}
{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }}
{{- end }}
{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
- name: auto-reload-config
configMap:
name: {{ template "jenkins.fullname" . }}-auto-reload-config
- name: auto-reload-config-logs
emptyDir: {}
{{- end }}
{{- if .Values.controller.installPlugins }}
{{- if .Values.controller.overwritePluginsFromImage }}
- name: plugins
emptyDir: {}
{{- end }}
{{- end }}
{{- if and .Values.controller.initScripts .Values.controller.initConfigMap }}
- name: init-scripts
projected:
sources:
- configMap:
name: {{ template "jenkins.fullname" . }}-init-scripts
- configMap:
name: {{ .Values.controller.initConfigMap }}
{{- else if .Values.controller.initConfigMap }}
- name: init-scripts
configMap:
name: {{ .Values.controller.initConfigMap }}
{{- else if .Values.controller.initScripts }}
- name: init-scripts
configMap:
name: {{ template "jenkins.fullname" . }}-init-scripts
{{- end }}
- name: jenkins-config
configMap:
name: {{ template "jenkins.fullname" . }}
{{- if .Values.controller.installPlugins }}
- name: plugin-dir
emptyDir: {}
{{- end }}
{{- if or .Values.controller.additionalSecrets .Values.controller.existingSecret .Values.controller.additionalExistingSecrets .Values.controller.admin.createSecret }}
- name: jenkins-secrets
projected:
sources:
{{- if .Values.controller.additionalSecrets }}
- secret:
name: {{ template "jenkins.fullname" . }}-additional-secrets
{{- end }}
{{- if .Values.controller.additionalExistingSecrets }}
{{- range $key, $value := .Values.controller.additionalExistingSecrets }}
- secret:
name: {{ tpl $value.name $ }}
items:
- key: {{ tpl $value.keyName $ }}
path: {{ tpl $value.name $ }}-{{ tpl $value.keyName $ }}
{{- end }}
{{- end }}
{{- if .Values.controller.admin.createSecret }}
- secret:
name: {{ .Values.controller.admin.existingSecret | default (include "jenkins.fullname" .) }}
items:
- key: {{ .Values.controller.admin.userKey | default "jenkins-admin-user" }}
path: chart-admin-username
- key: {{ .Values.controller.admin.passwordKey | default "jenkins-admin-password" }}
path: chart-admin-password
{{- end }}
{{- if .Values.controller.existingSecret }}
- secret:
name: {{ .Values.controller.existingSecret }}
{{- end }}
{{- end }}
- name: jenkins-cache
emptyDir: {}
{{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }}
- name: jenkins-home
{{- if .Values.persistence.enabled }}
persistentVolumeClaim:
claimName: {{ .Values.persistence.existingClaim | default (include "jenkins.fullname" .) }}
{{- else }}
emptyDir: {}
{{- end -}}
{{- end }}
- name: sc-config-volume
emptyDir: {}
- name: tmp-volume
emptyDir: {}
{{- if and .Values.controller.httpsKeyStore.enable (not .Values.controller.httpsKeyStore.disableSecretMount) }}
- name: jenkins-https-keystore
secret:
secretName: {{ if .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName }} {{ else }} {{ template "jenkins.fullname" . }}-https-jks {{ end }}
items:
- key: {{ .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretKey }}
path: {{ .Values.controller.httpsKeyStore.fileName }}
{{- end }}
{{- if .Values.controller.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.controller.imagePullSecretName }}
{{- end -}}
helm-templates/jenkins-grn/templates/jenkins-controller-svc.yaml
-64
View File
@@ -1,64 +0,0 @@
{{- if .Values.controller.serviceEnabled }}
apiVersion: v1
kind: Service
metadata:
name: {{template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.serviceLabels }}
{{ toYaml .Values.controller.serviceLabels | indent 4 }}
{{- end }}
{{- with .Values.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if .Values.controller.serviceAnnotations }}
annotations:
{{ toYaml .Values.controller.serviceAnnotations | indent 4 }}
{{- end }}
spec:
{{- if .Values.controller.serviceExternalTrafficPolicy }}
externalTrafficPolicy: {{.Values.controller.serviceExternalTrafficPolicy}}
{{- end }}
{{- if (and (eq .Values.controller.serviceType "ClusterIP") (not (empty .Values.controller.clusterIP))) }}
clusterIP: {{.Values.controller.clusterIP}}
{{- end }}
ports:
- port: {{.Values.controller.servicePort}}
name: http
targetPort: {{ .Values.controller.targetPort }}
{{- if (and (eq .Values.controller.serviceType "NodePort") (not (empty .Values.controller.nodePort))) }}
nodePort: {{.Values.controller.nodePort}}
{{- end }}
{{- range $index, $port := .Values.controller.extraPorts }}
- port: {{ $port.port }}
name: {{ $port.name }}
{{- if $port.targetPort }}
targetPort: {{ $port.targetPort }}
{{- else }}
targetPort: {{ $port.port }}
{{- end -}}
{{- end }}
{{- if .Values.controller.publishNotReadyAddresses }}
publishNotReadyAddresses: true
{{- end }}
selector:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
type: {{.Values.controller.serviceType}}
{{if eq .Values.controller.serviceType "LoadBalancer"}}
{{- if .Values.controller.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.loadBalancerSourceRanges | indent 4 }}
{{- end }}
{{if .Values.controller.loadBalancerIP}}
loadBalancerIP: {{.Values.controller.loadBalancerIP}}
{{end}}
{{end}}
{{- end }}
helm-templates/jenkins-grn/templates/rbac.yaml
-198
View File
@@ -1,198 +0,0 @@
{{ if .Values.rbac.create }}
{{- $serviceName := include "jenkins.fullname" . -}}
# This role is used to allow Jenkins scheduling of agents via Kubernetes plugin.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ $serviceName }}-schedule-agents
namespace: {{ template "jenkins.agent.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: [""]
resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/exec", "persistentvolumeclaims"]
verbs: ["create", "delete", "deletecollection", "patch", "update"]
---
# We bind the role to the Jenkins service account. The role binding is created in the namespace
# where the agents are supposed to run.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ $serviceName }}-schedule-agents
namespace: {{ template "jenkins.agent.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ $serviceName }}-schedule-agents
subjects:
- kind: ServiceAccount
name: {{ template "jenkins.serviceAccountName" .}}
namespace: {{ template "jenkins.namespace" . }}
---
{{- if .Values.rbac.readSecrets }}
# This is needed if you want to use https://jenkinsci.github.io/kubernetes-credentials-provider-plugin/
# as it needs permissions to get/watch/list Secrets
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "jenkins.fullname" . }}-read-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ $serviceName }}-read-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "jenkins.fullname" . }}-read-secrets
subjects:
- kind: ServiceAccount
name: {{ template "jenkins.serviceAccountName" . }}
namespace: {{ template "jenkins.namespace" . }}
---
{{- end}}
{{- if .Values.rbac.useOpenShiftNonRootSCC }}
# This is needed if you are running on OpenShift and using the default
# containerSecurityContext in the chart. It grants the Jenkins service account
# permission to use the "nonroot" and "nonroot-v2" SecurityContextConstraints.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ $serviceName }}-use-nonroot-scc
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
resourceNames: ["nonroot", "nonroot-v2"]
verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ $serviceName }}-use-nonroot-scc
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "jenkins.fullname" . }}-use-nonroot-scc
subjects:
- kind: ServiceAccount
name: {{ template "jenkins.serviceAccountName" . }}
namespace: {{ template "jenkins.namespace" . }}
---
{{- end}}
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
# The sidecar container which is responsible for reloading configuration changes
# needs permissions to watch ConfigMaps
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "jenkins.fullname" . }}-casc-reload
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ $serviceName }}-watch-configmaps
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "jenkins.fullname" . }}-casc-reload
subjects:
- kind: ServiceAccount
name: {{ template "jenkins.serviceAccountName" . }}
namespace: {{ template "jenkins.namespace" . }}
{{- end}}
{{ end }}
helm-templates/jenkins-grn/templates/secret-additional.yaml
-21
View File
@@ -1,21 +0,0 @@
{{- if .Values.controller.additionalSecrets -}}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "jenkins.fullname" . }}-additional-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
type: Opaque
data:
{{- range .Values.controller.additionalSecrets }}
{{ .name }}: {{ .value | b64enc }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/secret-claims.yaml
-29
View File
@@ -1,29 +0,0 @@
{{- if .Values.controller.secretClaims -}}
{{- $r := .Release -}}
{{- $v := .Values -}}
{{- $chart := printf "%s-%s" .Chart.Name .Chart.Version -}}
{{- $namespace := include "jenkins.namespace" . -}}
{{- $serviceName := include "jenkins.fullname" . -}}
{{ range .Values.controller.secretClaims }}
---
kind: SecretClaim
apiVersion: vaultproject.io/v1
metadata:
name: {{ $serviceName }}-{{ .name | default .path | lower }}
namespace: {{ $namespace }}
labels:
"app.kubernetes.io/name": '{{ $serviceName }}'
{{- if $v.renderHelmLabels }}
"helm.sh/chart": "{{ $chart }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $r.Service }}"
"app.kubernetes.io/instance": "{{ $r.Name }}"
"app.kubernetes.io/component": "{{ $v.controller.componentName }}"
spec:
type: {{ .type | default "Opaque" }}
path: {{ .path }}
{{- if .renew }}
renew: {{ .renew }}
{{- end }}
{{- end }}
{{- end }}
helm-templates/jenkins-grn/templates/secret-https-jks.yaml
-20
View File
@@ -1,20 +0,0 @@
{{- if and .Values.controller.httpsKeyStore.enable ( not .Values.controller.httpsKeyStore.jenkinsHttpsJksSecretName ) (not .Values.controller.httpsKeyStore.disableSecretMount) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "jenkins.fullname" . }}-https-jks
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
type: Opaque
data:
jenkins-jks-file: |
{{ .Values.controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded | indent 4 }}
https-jks-password: {{ .Values.controller.httpsKeyStore.password | b64enc }}
{{- end }}
helm-templates/jenkins-grn/templates/secret.yaml
-20
View File
@@ -1,20 +0,0 @@
{{- if and (not .Values.controller.admin.existingSecret) (.Values.controller.admin.createSecret) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
type: Opaque
data:
jenkins-admin-password: {{ template "jenkins.password" . }}
jenkins-admin-user: {{ .Values.controller.admin.username | b64enc | quote }}
{{- end }}
helm-templates/jenkins-grn/templates/service-account-agent.yaml
-27
View File
@@ -1,27 +0,0 @@
{{ if .Values.serviceAccountAgent.create }}
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: {{ .Values.serviceAccountAgent.automountServiceAccountToken }}
metadata:
name: {{ include "jenkins.serviceAccountAgentName" . }}
namespace: {{ template "jenkins.agent.namespace" . }}
{{- if .Values.serviceAccountAgent.annotations }}
annotations:
{{ tpl (toYaml .Values.serviceAccountAgent.annotations) . | indent 4 }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.serviceAccountAgent.extraLabels }}
{{ tpl (toYaml .Values.serviceAccountAgent.extraLabels) . | indent 4 }}
{{- end }}
{{- if .Values.serviceAccountAgent.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.serviceAccountAgent.imagePullSecretName }}
{{- end -}}
{{ end }}
helm-templates/jenkins-grn/templates/service-account.yaml
-27
View File
@@ -1,27 +0,0 @@
{{ if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
metadata:
name: {{ include "jenkins.serviceAccountName" . }}
namespace: {{ template "jenkins.namespace" . }}
{{- if .Values.serviceAccount.annotations }}
annotations:
{{ tpl (toYaml .Values.serviceAccount.annotations) . | indent 4 }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.serviceAccount.extraLabels }}
{{ tpl (toYaml .Values.serviceAccount.extraLabels) . | indent 4 }}
{{- end }}
{{- if .Values.serviceAccount.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.serviceAccount.imagePullSecretName }}
{{- end -}}
{{ end }}
helm-templates/jenkins-grn/templates/tests/jenkins-test.yaml
-49
View File
@@ -1,49 +0,0 @@
{{- if .Values.controller.testEnabled }}
apiVersion: v1
kind: Pod
metadata:
name: "{{ .Release.Name }}-ui-test-{{ randAlphaNum 5 | lower }}"
namespace: {{ template "jenkins.namespace" . }}
annotations:
"helm.sh/hook": test-success
spec:
{{- if .Values.controller.nodeSelector }}
nodeSelector:
{{ toYaml .Values.controller.nodeSelector | indent 4 }}
{{- end }}
{{- if .Values.controller.tolerations }}
tolerations:
{{ toYaml .Values.controller.tolerations | indent 4 }}
{{- end }}
initContainers:
- name: "test-framework"
image: "{{ .Values.helmtest.bats.image.registry }}/{{ .Values.helmtest.bats.image.repository }}:{{ .Values.helmtest.bats.image.tag }}"
command:
- "bash"
- "-c"
args:
- |
# copy bats to tools dir
set -ex
cp -R /opt/bats /tools/bats/
volumeMounts:
- mountPath: /tools
name: tools
containers:
- name: {{ .Release.Name }}-ui-test
image: "{{ .Values.controller.image.registry }}/{{ .Values.controller.image.repository }}:{{- include "controller.image.tag" . -}}"
command: ["/tools/bats/bin/bats", "-t", "/tests/run.sh"]
volumeMounts:
- mountPath: /tests
name: tests
readOnly: true
- mountPath: /tools
name: tools
volumes:
- name: tests
configMap:
name: {{ template "jenkins.fullname" . }}-tests
- name: tools
emptyDir: {}
restartPolicy: Never
{{- end }}
helm-templates/jenkins-grn/templates/tests/test-config.yaml
-14
View File
@@ -1,14 +0,0 @@
{{- if .Values.controller.testEnabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}-tests
namespace: {{ template "jenkins.namespace" . }}
annotations:
"helm.sh/hook": test
data:
run.sh: |-
@test "Testing Jenkins UI is accessible" {
curl --retry 48 --retry-delay 10 {{ template "jenkins.fullname" . }}:{{ .Values.controller.servicePort }}{{ default "" .Values.controller.jenkinsUriPrefix }}/login
}
{{- end }}
helm-templates/jenkins-grn/unittests/__snapshot__/config-test.yaml.snap
-15
View File
@@ -1,15 +0,0 @@
additional plugins config:
1: |
|-
kubernetes:4353.vb_47977da_9417
workflow-aggregator:608.v67378e9d3db_1
git:5.7.0
configuration-as-code:1971.vf9280461ea_89
kubernetes-credentials-provider
default config:
1: |
|-
kubernetes:4353.vb_47977da_9417
workflow-aggregator:608.v67378e9d3db_1
git:5.7.0
configuration-as-code:1971.vf9280461ea_89
helm-templates/jenkins-grn/unittests/__snapshot__/garbage-collect-test.yaml.snap
-316
View File
@@ -1,316 +0,0 @@
namespaces:
1: |
|-
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
disableRememberMe: false
mode: NORMAL
numExecutors: 0
labelString: ""
projectNamingStrategy: "standard"
markupFormatter:
plainText
clouds:
- kubernetes:
containerCapStr: "10"
garbageCollection:
namespaces: |-
namespace1
namespace2
timeout: "300"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "kubernetes"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: c1b261d31fc5fd6a3d1f677587cb3d33ed080e32dc72853e981f95d526cb35a0
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 2147483647
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
slaveAgentPort: 50000
crumbIssuer:
standard:
excludeClientIPFromCrumb: true
security:
apiToken:
creationOfLegacyTokenEnabled: false
tokenGenerationOnCreationEnabled: false
usageStatisticsEnabled: true
unclassified:
location:
url: http://my-release-jenkins:8080
one cloud:
1: |
|-
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
disableRememberMe: false
mode: NORMAL
numExecutors: 0
labelString: ""
projectNamingStrategy: "standard"
markupFormatter:
plainText
clouds:
- kubernetes:
containerCapStr: "10"
garbageCollection:
timeout: "300"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "kubernetes"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: 21e0459a6eaf68defd393abec10ed1cfe90336673940ff4d25ad9cdbb1f4e68e
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 2147483647
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
slaveAgentPort: 50000
crumbIssuer:
standard:
excludeClientIPFromCrumb: true
security:
apiToken:
creationOfLegacyTokenEnabled: false
tokenGenerationOnCreationEnabled: false
usageStatisticsEnabled: true
unclassified:
location:
url: http://my-release-jenkins:8080
second cloud:
1: |
|-
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
disableRememberMe: false
mode: NORMAL
numExecutors: 0
labelString: ""
projectNamingStrategy: "standard"
markupFormatter:
plainText
clouds:
- kubernetes:
containerCapStr: "10"
garbageCollection:
timeout: "300"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "kubernetes"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: 21e0459a6eaf68defd393abec10ed1cfe90336673940ff4d25ad9cdbb1f4e68e
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 2147483647
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
- kubernetes:
containerCapStr: "5"
garbageCollection:
timeout: "300"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "second"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: 62ee705db3e7c29e425499fa11beb4807dc8322e9ad84f83da0571623bcf02ac
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 2147483647
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
slaveAgentPort: 50000
crumbIssuer:
standard:
excludeClientIPFromCrumb: true
security:
apiToken:
creationOfLegacyTokenEnabled: false
tokenGenerationOnCreationEnabled: false
usageStatisticsEnabled: true
unclassified:
location:
url: http://my-release-jenkins:8080
helm-templates/jenkins-grn/unittests/__snapshot__/instance-cap-test.yaml.snap
-170
View File
@@ -1,170 +0,0 @@
default-cap:
1: |
|-
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
disableRememberMe: false
mode: NORMAL
numExecutors: 0
labelString: ""
projectNamingStrategy: "standard"
markupFormatter:
plainText
clouds:
- kubernetes:
containerCapStr: "10"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "kubernetes"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: 9173832a12680ee427b59f8d4a9219e974706d2a807007958c0f5eeedeee0d82
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 2147483647
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
slaveAgentPort: 50000
crumbIssuer:
standard:
excludeClientIPFromCrumb: true
security:
apiToken:
creationOfLegacyTokenEnabled: false
tokenGenerationOnCreationEnabled: false
usageStatisticsEnabled: true
unclassified:
location:
url: http://my-release-jenkins:8080
limited-cap:
1: |
|-
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
enableCaptcha: false
users:
- id: "${chart-admin-username}"
name: "Jenkins Admin"
password: "${chart-admin-password}"
disableRememberMe: false
mode: NORMAL
numExecutors: 0
labelString: ""
projectNamingStrategy: "standard"
markupFormatter:
plainText
clouds:
- kubernetes:
containerCapStr: "10"
defaultsProviderTemplate: ""
connectTimeout: "5"
readTimeout: "15"
jenkinsUrl: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080"
jenkinsTunnel: "my-release-jenkins-agent.my-namespace.svc.cluster.local:50000"
skipTlsVerify: false
usageRestricted: false
maxRequestsPerHostStr: "32"
retentionTimeout: "5"
waitForPodSec: "600"
name: "kubernetes"
namespace: "my-namespace"
restrictedPssSecurityContext: false
serverUrl: "https://kubernetes.default"
credentialsId: ""
podLabels:
- key: "jenkins/my-release-jenkins-agent"
value: "true"
templates:
- name: "default"
namespace: "my-namespace"
id: bb8d2dd40188d32e71b3a4b8fc4988a3461c0cf05afba398e1b181248d0281cd
containers:
- name: "jnlp"
alwaysPullImage: false
args: "^${computer.jnlpmac} ^${computer.name}"
envVars:
- envVar:
key: "JENKINS_URL"
value: "http://my-release-jenkins.my-namespace.svc.cluster.local:8080/"
image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-4"
privileged: "false"
resourceLimitCpu: 512m
resourceLimitMemory: 512Mi
resourceRequestCpu: 512m
resourceRequestMemory: 512Mi
ttyEnabled: false
workingDir: /home/jenkins/agent
idleMinutes: 0
instanceCap: 5
label: "my-release-jenkins-agent "
nodeUsageMode: "NORMAL"
podRetention: Never
showRawYaml: true
serviceAccount: "default"
slaveConnectTimeoutStr: "100"
yamlMergeStrategy: override
inheritYamlMergeStrategy: false
slaveAgentPort: 50000
crumbIssuer:
standard:
excludeClientIPFromCrumb: true
security:
apiToken:
creationOfLegacyTokenEnabled: false
tokenGenerationOnCreationEnabled: false
usageStatisticsEnabled: true
unclassified:
location:
url: http://my-release-jenkins:8080
helm-templates/jenkins-grn/unittests/__snapshot__/jcasc-config-test.yaml.snap
-3508
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins-grn/unittests/__snapshot__/jenkins-controller-statefulset-test.yaml.snap
-443
View File
@@ -1,443 +0,0 @@
configure empty image tag label:
1: |
docker.io/jenkins/jenkins:2.504.2
configure image tag label:
1: |
docker.io/jenkins/jenkins:2.504.2-alpine
default values:
1: |
replicas: 1
selector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
serviceName: my-release-jenkins
template:
metadata:
annotations:
checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff
labels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
spec:
automountServiceAccountToken: true
containers:
- args:
- --httpPort=8080
env:
- name: SECRETS
value: /run/secrets/additional
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: JAVA_OPTS
value: '-Dcasc.reload.token=$(POD_NAME) '
- name: JENKINS_OPTS
value: '--webroot=/var/jenkins_cache/war '
- name: JENKINS_SLAVE_AGENT_PORT
value: "50000"
- name: CASC_JENKINS_CONFIG
value: /var/jenkins_home/casc_configs
image: docker.io/jenkins/jenkins:2.504.2-jdk21
imagePullPolicy: Always
livenessProbe:
failureThreshold: 5
httpGet:
path: /login
port: http
initialDelaySeconds: null
periodSeconds: 10
timeoutSeconds: 5
name: jenkins
ports:
- containerPort: 8080
name: http
- containerPort: 50000
name: agent-listener
readinessProbe:
failureThreshold: 3
httpGet:
path: /login
port: http
initialDelaySeconds: null
periodSeconds: 10
timeoutSeconds: 5
resources:
limits:
cpu: 2000m
memory: 4096Mi
requests:
cpu: 50m
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsUser: 1000
startupProbe:
failureThreshold: 12
httpGet:
path: /login
port: http
periodSeconds: 10
timeoutSeconds: 5
volumeMounts:
- mountPath: /var/jenkins_home
name: jenkins-home
readOnly: false
- mountPath: /var/jenkins_config
name: jenkins-config
readOnly: true
- mountPath: /usr/share/jenkins/ref/plugins/
name: plugin-dir
readOnly: false
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- mountPath: /var/jenkins_cache
name: jenkins-cache
- mountPath: /tmp
name: tmp-volume
- env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: my-release-jenkins-jenkins-config
- name: FOLDER
value: /var/jenkins_home/casc_configs
- name: NAMESPACE
value: my-namespace
- name: REQ_URL
value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
- name: REQ_METHOD
value: POST
- name: REQ_RETRY_CONNECT
value: "10"
image: docker.io/kiwigrid/k8s-sidecar:1.30.3
imagePullPolicy: IfNotPresent
name: config-reload
resources: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /var/jenkins_home
name: jenkins-home
enableServiceLinks: false
initContainers:
- env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: my-release-jenkins-jenkins-config
- name: FOLDER
value: /var/jenkins_home/casc_configs
- name: NAMESPACE
value: my-namespace
- name: METHOD
value: LIST
image: docker.io/kiwigrid/k8s-sidecar:1.30.3
imagePullPolicy: IfNotPresent
name: config-reload-init
resources: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /var/jenkins_home
name: jenkins-home
- command:
- sh
- /var/jenkins_config/apply_config.sh
image: docker.io/jenkins/jenkins:2.504.2-jdk21
imagePullPolicy: Always
name: init
resources:
limits:
cpu: 2000m
memory: 4096Mi
requests:
cpu: 50m
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsUser: 1000
volumeMounts:
- mountPath: /var/jenkins_home
name: jenkins-home
- mountPath: /var/jenkins_config
name: jenkins-config
- mountPath: /usr/share/jenkins/ref/plugins
name: plugins
- mountPath: /var/jenkins_plugins
name: plugin-dir
- mountPath: /tmp
name: tmp-volume
securityContext:
fsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
serviceAccountName: my-release-jenkins
volumes:
- emptyDir: {}
name: plugins
- configMap:
name: my-release-jenkins
name: jenkins-config
- emptyDir: {}
name: plugin-dir
- name: jenkins-secrets
projected:
sources:
- secret:
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
name: my-release-jenkins
- emptyDir: {}
name: jenkins-cache
- name: jenkins-home
persistentVolumeClaim:
claimName: my-release-jenkins
- emptyDir: {}
name: sc-config-volume
- emptyDir: {}
name: tmp-volume
render pod annotations:
1: |
checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff
fixed-annotation: some-fixed-annotation
templated-annotations: my-release
test scheme for config-reload:
1: |
replicas: 1
selector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
serviceName: my-release-jenkins
template:
metadata:
annotations:
checksum/config: 3f2b0a1e7e353f17d9c7ed6fe2264976cf626aaf9c81c6cfe1682277c81713ff
labels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
spec:
automountServiceAccountToken: true
containers:
- args:
- --httpPort=8080
env:
- name: SECRETS
value: /run/secrets/additional
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: JAVA_OPTS
value: '-Dcasc.reload.token=$(POD_NAME) '
- name: JENKINS_OPTS
value: '--webroot=/var/jenkins_cache/war '
- name: JENKINS_SLAVE_AGENT_PORT
value: "50000"
- name: CASC_JENKINS_CONFIG
value: /var/jenkins_home/casc_configs
image: docker.io/jenkins/jenkins:2.504.2-jdk21
imagePullPolicy: Always
livenessProbe:
failureThreshold: 5
httpGet:
path: /login
port: http
initialDelaySeconds: null
periodSeconds: 10
timeoutSeconds: 5
name: jenkins
ports:
- containerPort: 8080
name: http
- containerPort: 50000
name: agent-listener
readinessProbe:
failureThreshold: 3
httpGet:
path: /login
port: http
initialDelaySeconds: null
periodSeconds: 10
timeoutSeconds: 5
resources:
limits:
cpu: 2000m
memory: 4096Mi
requests:
cpu: 50m
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsUser: 1000
startupProbe:
failureThreshold: 12
httpGet:
path: /login
port: http
periodSeconds: 10
timeoutSeconds: 5
volumeMounts:
- mountPath: /var/jenkins_home
name: jenkins-home
readOnly: false
- mountPath: /var/jenkins_config
name: jenkins-config
readOnly: true
- mountPath: /usr/share/jenkins/ref/plugins/
name: plugin-dir
readOnly: false
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- mountPath: /var/jenkins_cache
name: jenkins-cache
- mountPath: /tmp
name: tmp-volume
- env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: my-release-jenkins-jenkins-config
- name: FOLDER
value: /var/jenkins_home/casc_configs
- name: NAMESPACE
value: my-namespace
- name: REQ_URL
value: https://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
- name: REQ_METHOD
value: POST
- name: REQ_RETRY_CONNECT
value: "10"
image: docker.io/kiwigrid/k8s-sidecar:1.30.3
imagePullPolicy: IfNotPresent
name: config-reload
resources: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /var/jenkins_home
name: jenkins-home
enableServiceLinks: false
initContainers:
- env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: my-release-jenkins-jenkins-config
- name: FOLDER
value: /var/jenkins_home/casc_configs
- name: NAMESPACE
value: my-namespace
- name: METHOD
value: LIST
image: docker.io/kiwigrid/k8s-sidecar:1.30.3
imagePullPolicy: IfNotPresent
name: config-reload-init
resources: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /var/jenkins_home/casc_configs
name: sc-config-volume
- mountPath: /var/jenkins_home
name: jenkins-home
- command:
- sh
- /var/jenkins_config/apply_config.sh
image: docker.io/jenkins/jenkins:2.504.2-jdk21
imagePullPolicy: Always
name: init
resources:
limits:
cpu: 2000m
memory: 4096Mi
requests:
cpu: 50m
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsUser: 1000
volumeMounts:
- mountPath: /var/jenkins_home
name: jenkins-home
- mountPath: /var/jenkins_config
name: jenkins-config
- mountPath: /usr/share/jenkins/ref/plugins
name: plugins
- mountPath: /var/jenkins_plugins
name: plugin-dir
- mountPath: /tmp
name: tmp-volume
securityContext:
fsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
serviceAccountName: my-release-jenkins
volumes:
- emptyDir: {}
name: plugins
- configMap:
name: my-release-jenkins
name: jenkins-config
- emptyDir: {}
name: plugin-dir
- name: jenkins-secrets
projected:
sources:
- secret:
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
name: my-release-jenkins
- emptyDir: {}
name: jenkins-cache
- name: jenkins-home
persistentVolumeClaim:
claimName: my-release-jenkins
- emptyDir: {}
name: sc-config-volume
- emptyDir: {}
name: tmp-volume
helm-templates/jenkins-grn/unittests/config-init-scripts-test.yaml
-19
View File
@@ -1,19 +0,0 @@
suite: ConfigMap
templates:
- config-init-scripts.yaml
tests:
- it: config templates
set:
some.val: val here
controller.initScripts:
test: |-
my script here {{ .Values.some.val }}
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- equal:
path: data["inittest.groovy"]
value: |-
my script here val here
helm-templates/jenkins-grn/unittests/config-test.yaml
-117
View File
@@ -1,117 +0,0 @@
suite: ConfigMap
templates:
- config.yaml
tests:
- it: default config
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- equal:
path: data["apply_config.sh"]
value: |-
set -e
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion
echo "download plugins"
# Install missing plugins
cp /var/jenkins_config/plugins.txt /var/jenkins_home;
rm -rf /usr/share/jenkins/ref/plugins/*.lock
version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then
jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true;
else
/usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`;
fi
echo "copy plugins to shared volume"
# Copy plugins to shared volume
yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/;
echo "finished initialization"
- matchSnapshot:
path: data["plugins.txt"]
- it: no plugins
set:
controller.installPlugins: []
asserts:
- equal:
path: data["apply_config.sh"]
value: |-
set -e
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion
echo "finished initialization"
- equal:
path: data["plugins.txt"]
value: ""
- it: additional plugins config
set:
controller:
additionalPlugins:
- kubernetes-credentials-provider
asserts:
- matchSnapshot:
path: data["plugins.txt"]
- it: install latest plugins
set:
controller.installLatestPlugins: false
asserts:
- equal:
path: data["apply_config.sh"]
value: |-
set -e
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion
echo "download plugins"
# Install missing plugins
cp /var/jenkins_config/plugins.txt /var/jenkins_home;
rm -rf /usr/share/jenkins/ref/plugins/*.lock
version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then
jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest false;
else
/usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`;
fi
echo "copy plugins to shared volume"
# Copy plugins to shared volume
yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/;
echo "finished initialization"
- it: install latest specified plugins
set:
controller.installLatestSpecifiedPlugins: true
asserts:
- equal:
path: data["apply_config.sh"]
value: |-
set -e
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > /var/jenkins_home/jenkins.install.InstallUtil.lastExecVersion
echo "download plugins"
# Install missing plugins
cp /var/jenkins_config/plugins.txt /var/jenkins_home;
rm -rf /usr/share/jenkins/ref/plugins/*.lock
version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
if [ -f "/usr/share/jenkins/jenkins.war" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then
jenkins-plugin-cli --verbose --war "/usr/share/jenkins/jenkins.war" --plugin-file "/var/jenkins_home/plugins.txt" --latest true --latest-specified;
else
/usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`;
fi
echo "copy plugins to shared volume"
# Copy plugins to shared volume
yes n | cp -i /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins/;
echo "finished initialization"
helm-templates/jenkins-grn/unittests/garbage-collect-test.yaml
-67
View File
@@ -1,67 +0,0 @@
suite: Garbage collection of pods
release:
name: my-release
namespace: my-namespace
templates:
- jcasc-config.yaml
tests:
- it: one cloud
set:
agent.garbageCollection.enabled: true
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- equal:
path: metadata.namespace
value: my-namespace
- it: second cloud
set:
agent.garbageCollection.enabled: true
additionalClouds.second.agent.containerCap: 5
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- equal:
path: metadata.namespace
value: my-namespace
- it: namespaces
set:
agent.garbageCollection.enabled: true
agent.garbageCollection.namespaces: |-
namespace1
namespace2
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- equal:
path: metadata.namespace
value: my-namespace
helm-templates/jenkins-grn/unittests/home-pvc-test.yaml
-110
View File
@@ -1,110 +0,0 @@
suite: PersistentVolumeClaim
release:
name: my-release
namespace: my-namespace
templates:
- home-pvc.yaml
tests:
- it: tests defaults
asserts:
- isKind:
of: PersistentVolumeClaim
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- contains:
path: spec.accessModes
content: ReadWriteOnce
- equal:
path: spec.resources.requests
value:
storage: 8Gi
- isNull:
path: spec.dataSource
- isNull:
path: spec.storageClassName
- it: test different values
set:
persistence:
annotations:
my-annotation: value
accessMode: ReadWriteMany
size: 20Gi
storageClass: gp2
asserts:
- equal:
path: metadata.annotations
value:
my-annotation: value
- contains:
path: spec.accessModes
content: ReadWriteMany
- equal:
path: spec.resources.requests
value:
storage: 20Gi
- equal:
path: spec.storageClassName
value: gp2
- it: existing claim
set:
persistence:
existingClaim: my-pvc
asserts:
- hasDocuments:
count: 0
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: add label
set:
renderHelmLabels: false
persistence:
labels:
test-label: test-value
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
test-label: test-value
- it: clone from dataSource
set:
persistence:
dataSource:
name: PVC-NAME
kind: PersistentVolumeClaim
asserts:
- equal:
path: spec.dataSource.name
value: PVC-NAME
- equal:
path: spec.dataSource.kind
value: PersistentVolumeClaim
helm-templates/jenkins-grn/unittests/instance-cap-test.yaml
-42
View File
@@ -1,42 +0,0 @@
suite: Instance cap tests
release:
name: my-release
namespace: my-namespace
templates:
- jcasc-config.yaml
tests:
- it: default-cap
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- equal:
path: metadata.namespace
value: my-namespace
- it: limited-cap
set:
agent.instanceCap: 5
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- equal:
path: metadata.namespace
value: my-namespace
helm-templates/jenkins-grn/unittests/jcasc-config-test.yaml
-843
View File
@@ -1,843 +0,0 @@
suite: Configuration as Code
templates:
- jcasc-config.yaml
tests:
- it: default config
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: agent namespace and templates
release:
namespace: controller-namespace
set:
additionalAgents:
maven:
namespace: maven
podName: maven
customJenkinsLabels: maven
image:
repository: jenkins/jnlp-agent-maven
tag: latest
python:
podName: python
customJenkinsLabels: python
sideContainerName: python
image:
repository: python
tag: "3"
command: /bin/sh -c
args: "cat"
TTYEnabled: true
agent:
namespace: jenkins-agents
podTemplates:
python3: |-
- name: python3
label: jenkins-python3
serviceAccount: jenkins
containers:
- name: python
image: python:3
command: "/bin/sh -c"
args: "cat"
ttyEnabled: true
privileged: true
resourceRequestCpu: "400m"
resourceRequestMemory: "512Mi"
resourceRequestEphemeralStorage: "1Gi"
resourceLimitCpu: "1"
resourceLimitMemory: "1024Mi"
resourceLimitEphemeralStorage: "2Gi"
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: customized config
set:
controller:
disableRememberMe: true
executorMode: EXCLUSIVE
numExecutors: 1
enableRawHtmlMarkupFormatter: true
JCasC:
authorizationStrategy: |-
globalMatrix:
permissions:
- "Overall/Read:anonymous"
configScripts:
welcome-message: |
jenkins:
systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.
securityRealm: local
jenkinsAdminEmail: admin@example.org
ingress:
hostName: jenkins.example.com
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
agent:
namespace: default
containerCap: 22
jnlpregistry: private.registry.com
defaultsProviderTemplate: my-defaults
kubernetesConnectTimeout: 11
kubernetesReadTimeout: 12
podName: my-agent
sideContainerName: sideContainer
alwaysPullImage: true
command: /bin/command
image:
repository: my-image/jnlp
tag: v1.2.3
privileged: true
resources:
limits:
cpu: 1024m
memory: 1Gi
ephemeralStorage: 1Gi
requests:
cpu: 756m
memory: 768Mi
ephemeralStorage: 512Mi
runAsUser: 2000
runAsGroup: 2000
TTYEnabled: true
workingDir: /workdir
envVars:
- name: VAR
value: value
idleMinutes: 30
imagePullSecretName: pullSecret
nodeSelector:
jenkins-agent: v1
selector: abc
podRetention: onFailure
connectTimeout: 111
volumes:
- type: ConfigMap
configMapName: myconfigmap
mountPath: /var/myapp/myconfigmap
- type: EmptyDir
mountPath: /var/myapp/myemptydir
memory: false
- type: HostPath
hostPath: /var/lib/containers
mountPath: /var/myapp/myhostpath
- type: Nfs
mountPath: /var/myapp/mynfs
readOnly: false
serverAddress: "192.0.2.0"
serverPath: /var/lib/containers
- type: PVC
claimName: mypvc
mountPath: /var/myapp/mypvc
readOnly: false
- type: Secret
defaultMode: "600"
mountPath: /var/myapp/mysecret
secretName: mysecret
- type: EphemeralVolume
mountPath: /var/myapp/myephemeralvolume
accessModes: ReadWriteOnce
requestsSize: 2Gi
storageClassName: test-storageclass
annotations:
ci.jenkins-agent/test: "custom"
yamlTemplate: |-
apiVersion: v1
kind: Pod
spec:
tolerations:
- key: "key"
operator: "Equal"
value: "value"
yamlMergeStrategy: merge
serviceAccountAgent:
name: agent-serviceaccount
release:
name: my-release
namespace: other
asserts:
- hasDocuments:
count: 2
- documentIndex: 0
isKind:
of: ConfigMap
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- documentIndex: 0
equal:
path: metadata.name
value: my-release-jenkins-jenkins-config-welcome-message
- documentIndex: 0
equal:
path: metadata.namespace
value: other
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- documentIndex: 1
isKind:
of: ConfigMap
- documentIndex: 1
equal:
path: metadata.name
value: my-release-jenkins-jenkins-jcasc-config
- documentIndex: 1
equal:
path: metadata.namespace
value: other
- documentIndex: 0
equal:
path: metadata.labels.my-release-jenkins-jenkins-config
value: "true"
- documentIndex: 1
equal:
path: metadata.labels.my-release-jenkins-jenkins-config
value: "true"
- documentIndex: 0
equal:
path: data
value:
welcome-message.yaml: |-
jenkins:
systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.
- documentIndex: 1
matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom dynamic pvc workspace volume
set:
agent:
workspaceVolume:
type: "DynamicPVC"
accessModes: "ReadWriteOnce"
requestsSize: "2Gi"
storageClassName: "gp2"
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom emptyDir workspace volume
set:
agent:
workspaceVolume:
type: "EmptyDir"
memory: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom hostPath workspace volume
set:
agent:
workspaceVolume:
type: "HostPath"
hostPath: "/data"
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom nfs workspace volume
set:
agent:
workspaceVolume:
type: "Nfs"
readOnly: false
serverAddress: "1.1.1.1"
serverPath: "/data"
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom pvc workspace volume
set:
agent:
workspaceVolume:
type: "PVC"
claimName: "my-claim"
readOnly: false
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom other workspace volume
set:
agent:
workspaceVolume:
type: "persistentVolumeClaimWorkspaceVolume"
claimName: "my-claim"
readOnly: false
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
RELEASE-NAME-jenkins-jenkins-config: "true"
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: RELEASE-NAME
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: disable agents
release:
namespace: controller-namespace
set:
agent.enabled: false
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: disable default config
set:
controller.JCasC.defaultConfig: false
asserts:
- hasDocuments:
count: 0
- it: custom jenkins label
set:
controller:
customJenkinsLabels: ["testlabel"]
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: adds custom labels on agent pods
set:
agent:
podLabels:
label-one: value-one
label-two: true
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: disable useDefaultServiceAccount
set:
agent:
useDefaultServiceAccount: false
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: set agent.serviceAccount
set:
agent:
serviceAccount: "testing"
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: legacyRemotingSecurityEnabled = false
release:
namespace: default
set:
controller:
legacyRemotingSecurityEnabled: false
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: legacyRemotingSecurityEnabled = true
release:
namespace: default
set:
controller:
legacyRemotingSecurityEnabled: true
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: empty projectNamingStrategy
release:
namespace: default
set:
controller:
projectNamingStrategy:
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: non-string projectNamingStrategy
release:
namespace: default
set:
controller:
projectNamingStrategy:
myConfiguration:
mySetting1: true
mySetting2: something
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: specify security settings without apiToken override
release:
namespace: default
set:
controller:
JCasC:
security:
gitHostKeyVerificationConfiguration:
sshHostKeyVerificationStrategy: "acceptFirstConnectionStrategy"
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: specify security settings with apiToken override
release:
namespace: default
set:
controller:
JCasC:
security:
apiToken: overridden
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: specify additional container
release:
namespace: default
set:
agent:
additionalContainers:
- sideContainerName: dind
image:
repository: docker
tag: dind
command: dockerd-entrypoint.sh
args: ""
privileged: true
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: specify additional container and overwrite in additional agent
release:
namespace: default
set:
agent:
additionalContainers:
- sideContainerName: dind
image:
repository: docker
tag: dind
command: dockerd-entrypoint.sh
args: ""
privileged: true
additionalAgents:
additional-agent:
podName: additional-agent
additionalContainers:
- sideContainerName: additional
image:
repository: my-additional-container-image
tag: latest
command: entrypoint.sh
args: arg1 arg2
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: specify additional container and clear in additional agent
release:
namespace: default
set:
agent:
additionalContainers:
- sideContainerName: dind
image:
repository: docker
tag: dind
command: dockerd-entrypoint.sh
args: ""
privileged: true
additionalAgents:
additional-agent:
podName: additional-agent
additionalContainers: []
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: configure hostnetworking to agent
release:
namespace: default
set:
agent:
hostNetworking: true
asserts:
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: set secretEnvVars
set:
agent:
secretEnvVars:
- key: UNITTEST_PATH
secretKey: UNITTEST_K8S_PATH
secretName: k8s-unittest-secret-name
envVars:
- name: UNITTEST_ENV
value: testvalue
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: set directConnection
set:
agent:
directConnection: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: set restrictedPssSecurityContext
set:
agent:
restrictedPssSecurityContext: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: agent with liveness probe
set:
agent:
livenessProbe:
execArgs: "cat /tmp/healthy"
failureThreshold: 3
initialDelaySeconds: 0
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: agents with liveness probe
set:
agent:
additionalContainers:
- sideContainerName: side-container
image:
repository: REPOSITORY
tag: TAG
args: ""
command: ""
livenessProbe:
execArgs: "cat /tmp/healthy"
failureThreshold: 3
initialDelaySeconds: 0
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: additional clouds
set:
additionalClouds:
remote-cloud-1:
kubernetesURL: https://api.remote-cloud.com
credentialsId: "remote-cloud-token"
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: additional clouds inheriting additional agents
set:
additionalAgents:
maven:
namespace: maven
podName: maven
customJenkinsLabels: maven
image:
repository: jenkins/jnlp-agent-maven
tag: latest
additionalClouds:
remote-cloud-1:
kubernetesURL: https://api.remote-cloud.com
credentialsId: "remote-cloud-token"
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: additional clouds overriding additional agents
set:
additionalAgents:
maven:
namespace: maven
podName: maven
customJenkinsLabels: maven
image:
repository: jenkins/jnlp-agent-maven
tag: latest
additionalClouds:
remote-cloud-1:
kubernetesURL: https://api.remote-cloud.com
credentialsId: "remote-cloud-token"
additionalAgentsOverride: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: custom configmap annotations
set:
controller:
JCasC:
configMapAnnotations:
jenkins.example.com/anno1: "custom-annotation"
jenkins.example.com/anno2: "another-annotation"
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- equal:
path: metadata.annotations
value:
jenkins.example.com/anno1: "custom-annotation"
jenkins.example.com/anno2: "another-annotation"
- it: additional clouds set skipTlsVerify
set:
additionalClouds:
remote-cloud-1:
kubernetesURL: https://api.remote-cloud.com
credentialsId: "remote-cloud-token"
agent:
skipTlsVerify: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
- it: additional clouds set usageRestricted
set:
additionalClouds:
remote-cloud-1:
kubernetesURL: https://api.remote-cloud.com
credentialsId: "remote-cloud-token"
agent:
usageRestricted: true
release:
namespace: default
asserts:
- isKind:
of: ConfigMap
- hasDocuments:
count: 1
- isNotEmpty:
path: data["jcasc-default-config.yaml"]
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- matchSnapshot:
path: data["jcasc-default-config.yaml"]
helm-templates/jenkins-grn/unittests/jenkins-agent-svc-test.yaml
-130
View File
@@ -1,130 +0,0 @@
suite: Jenkins Agent Service
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-agent-svc.yaml
tests:
- it: default tests
asserts:
- isKind:
of: Service
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins-agent
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ports:
- name: agent-listener
port: 50000
targetPort: 50000
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: ClusterIP
- it: other values
set:
controller:
agentListenerServiceAnnotations:
key: value
agentListenerPort: 55555
asserts:
- equal:
path: metadata.annotations
value:
key: value
- equal:
path: spec
value:
ports:
- name: agent-listener
port: 55555
targetPort: 55555
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: ClusterIP
- it: node port random
set:
controller:
agentListenerServiceType: NodePort
asserts:
- equal:
path: spec
value:
ports:
- name: agent-listener
port: 50000
targetPort: 50000
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: NodePort
- it: node port defined
set:
controller:
agentListenerServiceType: NodePort
agentListenerNodePort: 32123
asserts:
- equal:
path: spec
value:
ports:
- name: agent-listener
port: 50000
targetPort: 50000
nodePort: 32123
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: NodePort
- it: load balancer
set:
controller:
agentListenerServiceType: LoadBalancer
agentListenerLoadBalancerIP: 10.10.10.10
asserts:
- equal:
path: spec
value:
ports:
- name: agent-listener
port: 50000
targetPort: 50000
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: LoadBalancer
loadBalancerIP: 10.10.10.10
loadBalancerSourceRanges:
- 0.0.0.0/0
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: disable agent service
set:
controller:
agentListenerEnabled: false
asserts:
- hasDocuments:
count: 0
helm-templates/jenkins-grn/unittests/jenkins-controller-alerting-rules-test.yaml
-79
View File
@@ -1,79 +0,0 @@
suite: Controller Prometheus PrometheusRule
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-alerting-rules.yaml
tests:
- it: defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.prometheus:
enabled: true
alertingrules:
- name: ./jenkins.rules
rules:
- alert: JenkinsFailedPlugins
expr: jenkins_plugins_failed > 0
for: 10m
labels:
severity: warning
annotations:
message: Some Jenkins plugins failed to load
asserts:
- isKind:
of: PrometheusRule
- equal:
path: apiVersion
value: monitoring.coreos.com/v1
- equal:
path: metadata.name
value: my-release-jenkins
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- equal:
path: spec
value:
groups:
- name: ./jenkins.rules
rules:
- alert: JenkinsFailedPlugins
expr: jenkins_plugins_failed > 0
for: 10m
labels:
severity: warning
annotations:
message: Some Jenkins plugins failed to load
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.prometheus:
enabled: true
alertingrules:
- name: ./jenkins.rules
rules:
- alert: JenkinsFailedPlugins
expr: jenkins_plugins_failed > 0
for: 10m
labels:
severity: warning
annotations:
message: Some Jenkins plugins failed to load
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-1.19-test.yaml
-148
View File
@@ -1,148 +0,0 @@
suite: Controller Primary Ingress
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-ingress.yaml
capabilities:
majorVersion: 1
minorVersion: 19
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- isKind:
of: Ingress
- equal:
path: apiVersion
value: networking.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
service:
name: my-release-jenkins
port:
number: 8080
pathType: ImplementationSpecific
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: other values
set:
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
paths:
- backend:
service:
name: ssl-redirect
port:
number: use-annotation
pathType: ImplementationSpecific
- backend:
service:
name: >-
{{ template "jenkins.fullname" . }}
port:
number: 8080
pathType: ImplementationSpecific
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- equal:
path: metadata.annotations
value:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
service:
name: ssl-redirect
port:
number: use-annotation
pathType: ImplementationSpecific
- backend:
service:
name: my-release-jenkins
port:
number: 8080
pathType: ImplementationSpecific
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: empty paths
set:
controller.ingress:
enabled: true
paths:
asserts:
- equal:
path: spec.rules
value:
- http:
paths:
- backend:
service:
name: my-release-jenkins
port:
number: 8080
pathType: ImplementationSpecific
helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-DRY-test.yaml
-26
View File
@@ -1,26 +0,0 @@
suite: Controller Ingress - DRY Support
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-ingress.yaml
- jcasc-config.yaml
tests:
- it: controller-ingress
template: jenkins-controller-ingress.yaml
set:
global.jenkinsHostname: "jenkins.example.com"
controller.ingress:
enabled: true
hostName: "{{ .Values.global.jenkinsHostname }}"
resourceRootUrl: "{{ .Values.global.jenkinsHostname }}"
tls:
- hosts:
- "{{ .Values.global.jenkinsHostname }}"
asserts:
- equal:
path: spec.rules[0].host
value: "jenkins.example.com"
- equal:
path: spec.tls[0].hosts[0]
value: "jenkins.example.com"
helm-templates/jenkins-grn/unittests/jenkins-controller-ingress-test.yaml
-145
View File
@@ -1,145 +0,0 @@
suite: Controller Primary Ingress
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-ingress.yaml
capabilities:
majorVersion: 1
minorVersion: 18
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- isKind:
of: Ingress
- equal:
path: apiVersion
value: networking.k8s.io/v1beta1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
serviceName: my-release-jenkins
servicePort: 8080
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: other values
set:
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
paths:
- backend:
serviceName: ssl-redirect
servicePort: use-annotation
- backend:
serviceName: >-
{{ template "jenkins.fullname" . }}
servicePort: 8080
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- equal:
path: metadata.annotations
value:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
serviceName: ssl-redirect
servicePort: use-annotation
- backend:
serviceName: my-release-jenkins
servicePort: 8080
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.ingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: empty paths
set:
controller.ingress:
enabled: true
paths:
asserts:
- equal:
path: spec.rules
value:
- http:
paths:
- backend:
serviceName: my-release-jenkins
servicePort: 8080
- it: single path
set:
controller.ingress:
enabled: true
path: /jenkins/
asserts:
- equal:
path: spec.rules
value:
- http:
paths:
- path: /jenkins/
backend:
serviceName: my-release-jenkins
servicePort: 8080
helm-templates/jenkins-grn/unittests/jenkins-controller-networkpolicy-test.yaml
-94
View File
@@ -1,94 +0,0 @@
suite: Network Policy
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-networkpolicy.yaml
tests:
- it: tests defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
networkPolicy.enabled: true
asserts:
- hasDocuments:
count: 2
- isKind:
of: NetworkPolicy
- equal:
path: apiVersion
value: networking.k8s.io/v1
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: metadata.name
value: my-release-jenkins-controller
documentIndex: 0
- equal:
path: spec
value:
ingress:
- ports:
- port: 8080
- from:
- podSelector:
matchLabels:
jenkins/my-release-jenkins-agent: "true"
ports:
- port: 50000
podSelector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
documentIndex: 0
- equal:
path: spec
value:
podSelector:
matchLabels:
jenkins/my-release-jenkins-agent: "true"
documentIndex: 1
- equal:
path: metadata.name
value: my-release-jenkins-agent
documentIndex: 1
- it: disable helm.sh label
set:
renderHelmLabels: false
networkPolicy.enabled: true
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: disable agent listener
set:
networkPolicy.enabled: true
controller.agentListenerEnabled: false
asserts:
- hasDocuments:
count: 2
- isKind:
of: NetworkPolicy
- equal:
path: spec
value:
ingress:
- ports:
- port: 8080
podSelector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
documentIndex: 0
helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-1.21-test.yaml
-44
View File
@@ -1,44 +0,0 @@
suite: Controller Pod Disruption Budget
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-pdb.yaml
capabilities:
majorVersion: 1
minorVersion: 21
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.podDisruptionBudget:
enabled: true
maxUnavailable: "0"
asserts:
- isKind:
of: PodDisruptionBudget
- equal:
path: apiVersion
value: policy/v1
- equal:
path: metadata.name
value: my-release-jenkins-pdb
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
maxUnavailable: 0
selector:
matchLabels:
"app.kubernetes.io/instance": "my-release"
"app.kubernetes.io/name": "jenkins"
helm-templates/jenkins-grn/unittests/jenkins-controller-pdb-test.yaml
-57
View File
@@ -1,57 +0,0 @@
suite: Controller Pod Disruption Budget
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-pdb.yaml
capabilities:
majorVersion: 1
minorVersion: 18
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.podDisruptionBudget:
enabled: true
maxUnavailable: "0"
asserts:
- isKind:
of: PodDisruptionBudget
- equal:
path: apiVersion
value: policy/v1beta1
- equal:
path: metadata.name
value: my-release-jenkins-pdb
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
maxUnavailable: 0
selector:
matchLabels:
"app.kubernetes.io/instance": "my-release"
"app.kubernetes.io/name": "jenkins"
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.podDisruptionBudget:
enabled: true
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-1.19-test.yaml
-78
View File
@@ -1,78 +0,0 @@
suite: Controller Secondary Ingress
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-secondary-ingress.yaml
capabilities:
majorVersion: 1
minorVersion: 19
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.secondaryingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
paths:
- /github-webhook
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- isKind:
of: Ingress
- equal:
path: apiVersion
value: networking.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-secondary
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
service:
name: my-release-jenkins
port:
number: 8080
path: /github-webhook
pathType: ImplementationSpecific
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.secondaryingress:
enabled: true
hostName: jenkins.example.com
paths:
- /github-webhook
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
helm-templates/jenkins-grn/unittests/jenkins-controller-secondary-ingress-test.yaml
-76
View File
@@ -1,76 +0,0 @@
suite: Controller Secondary Ingress
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-secondary-ingress.yaml
capabilities:
majorVersion: 1
minorVersion: 18
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
"controller.secondaryingress":
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
paths:
- /github-webhook
tls:
- secretName: tlsSecret
hosts:
- jenkins.example.com
asserts:
- isKind:
of: Ingress
- equal:
path: apiVersion
value: networking.k8s.io/v1beta1
- equal:
path: metadata.name
value: my-release-jenkins-secondary
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ingressClassName: nginx
rules:
- host: jenkins.example.com
http:
paths:
- backend:
serviceName: my-release-jenkins
servicePort: 8080
path: /github-webhook
tls:
- hosts:
- jenkins.example.com
secretName: tlsSecret
- it: disable helm.sh label
set:
renderHelmLabels: false
controller.secondaryingress:
enabled: true
hostName: jenkins.example.com
ingressClassName: nginx
paths:
- /github-webhook
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
helm-templates/jenkins-grn/unittests/jenkins-controller-servicemonitor_test.yaml
-114
View File
@@ -1,114 +0,0 @@
suite: Controller Prometheus ServiceMonitor
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-servicemonitor.yaml
tests:
- it: defaults
asserts:
- hasDocuments:
count: 0
- it: enabled
set:
controller.prometheus.enabled: true
asserts:
- isKind:
of: ServiceMonitor
- equal:
path: apiVersion
value: monitoring.coreos.com/v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- equal:
path: spec
value:
endpoints:
- interval: 60s
port: http
path: /prometheus
jobLabel: my-release-jenkins
namespaceSelector:
matchNames:
- "my-namespace"
selector:
matchLabels:
"app.kubernetes.io/instance": "my-release"
"app.kubernetes.io/component": "jenkins-controller"
- it: custom values
set:
controller:
jenkinsUriPrefix: /prefix
prometheus:
enabled: true
scrapeInterval: 120s
scrapeEndpoint: /monitoring
asserts:
- equal:
path: spec
value:
endpoints:
- interval: 120s
port: http
path: /prefix/monitoring
jobLabel: my-release-jenkins
namespaceSelector:
matchNames:
- "my-namespace"
selector:
matchLabels:
"app.kubernetes.io/instance": "my-release"
"app.kubernetes.io/component": "jenkins-controller"
- it: disable helm.sh label
set:
renderHelmLabels: false
controller:
prometheus:
enabled: true
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: set relabling
set:
controller:
prometheus:
enabled: true
relabelings:
- sourceLabels: [metric]
regex: "(.*)"
action: drop
asserts:
- equal:
path: spec.endpoints[0].relabelings
value:
- sourceLabels: [metric]
regex: "(.*)"
action: drop
- it: set metricRelabelings
set:
controller:
prometheus:
enabled: true
metricRelabelings:
- sourceLabels: [__name__]
regex: "kubernetes_cloud_(.*)_provision_request_total"
action: drop
asserts:
- equal:
path: spec.endpoints[0].metricRelabelings
value:
- sourceLabels: [__name__]
regex: "kubernetes_cloud_(.*)_provision_request_total"
action: drop
helm-templates/jenkins-grn/unittests/jenkins-controller-statefulset-test.yaml
-828
View File
@@ -1,828 +0,0 @@
suite: Jenkins Controller
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-statefulset.yaml
- config.yaml
- config-init-scripts.yaml
- auto-reload-config.yaml
tests:
- it: default values
template: jenkins-controller-statefulset.yaml
asserts:
- isKind:
of: StatefulSet
- equal:
path: apiVersion
value: apps/v1beta1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec.replicas
value: 1
- equal:
path: spec.selector
value:
matchLabels:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
- matchSnapshot:
path: spec
- it: test different values
template: jenkins-controller-statefulset.yaml
capabilities:
apiVersions:
- scheduling.k8s.io/v1beta1
set:
controller:
statefulSetAnnotations:
my-annotation: value
schedulerName: my-scheduler
nodeSelector:
nodeLabel: value
tolerations:
- key: "key"
operator: "Equal"
value: "value"
effect: "NoSchedule"
affinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: security
operator: In
values:
- S1
topologyKey: failure-domain.beta.kubernetes.io/zone
topologySpreadConstraints:
- maxSkew: 1
topologyKey: "topology.kubernetes.io/zone"
whenUnsatisfiable: ScheduleAnyway
labelSelector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
terminationGracePeriodSeconds: 120
priorityClassName: important
runAsUser: 2000
fsGroup: 4000
securityContextCapabilities:
drop:
- NET_RAW
hostNetworking: true
terminationMessagePath: /tmp/termination-log-diff
terminationMessagePolicy: FallbackToLogsOnError
hostAliases:
- ip: 192.168.50.50
hostnames:
- something.local
updateStrategy:
type: OnDelete
serviceAccount.name: my-serviceaccount
asserts:
- equal:
path: metadata.annotations
value:
my-annotation: value
- equal:
path: spec.template.spec.schedulerName
value: my-scheduler
- equal:
path: spec.template.spec.nodeSelector
value:
nodeLabel: value
- equal:
path: spec.template.spec.tolerations
value:
- key: "key"
operator: "Equal"
value: "value"
effect: "NoSchedule"
- equal:
path: spec.template.spec.affinity
value:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: security
operator: In
values:
- S1
topologyKey: failure-domain.beta.kubernetes.io/zone
- equal:
path: spec.template.spec.topologySpreadConstraints
value:
- maxSkew: 1
topologyKey: "topology.kubernetes.io/zone"
whenUnsatisfiable: ScheduleAnyway
labelSelector:
matchLabels:
app.kubernetes.io/component: jenkins-controller
- equal:
path: spec.template.spec.terminationGracePeriodSeconds
value: 120
- equal:
path: spec.template.spec.priorityClassName
value: important
- equal:
path: spec.template.spec.securityContext
value:
runAsUser: 2000
fsGroup: 4000
runAsNonRoot: true
capabilities:
drop:
- NET_RAW
- equal:
path: spec.template.spec.serviceAccountName
value: my-serviceaccount
- equal:
path: spec.template.spec.hostNetwork
value: true
- equal:
path: spec.template.spec.containers[0].terminationMessagePath
value: /tmp/termination-log-diff
- equal:
path: spec.template.spec.containers[0].terminationMessagePolicy
value: FallbackToLogsOnError
- equal:
path: spec.template.spec.dnsPolicy
value: ClusterFirstWithHostNet
- equal:
path: spec.template.spec.hostAliases
value:
- ip: 192.168.50.50
hostnames:
- something.local
- equal:
path: spec.updateStrategy.type
value: OnDelete
- it: configure image tag
template: jenkins-controller-statefulset.yaml
set:
controller.image.tag: slim
controller.image.pullPolicy: IfNotPresent
asserts:
- equal:
path: spec.template.spec.containers[0].image
value: docker.io/jenkins/jenkins:slim
- equal:
path: spec.template.spec.containers[0].imagePullPolicy
value: IfNotPresent
- it: configure image tag label
template: jenkins-controller-statefulset.yaml
set:
controller.image.tagLabel: alpine
asserts:
- matchSnapshot:
path: spec.template.spec.containers[0].image
- it: configure empty image tag label
template: jenkins-controller-statefulset.yaml
set:
controller.image.tagLabel:
asserts:
- matchSnapshot:
path: spec.template.spec.containers[0].image
- it: custom image
template: jenkins-controller-statefulset.yaml
set:
controller:
image:
repository: registry/image
tag: my-tag
javaOpts: -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true
asserts:
- equal:
path: spec.template.spec.containers[0].image
value: docker.io/registry/image:my-tag
- contains:
path: spec.template.spec.containers[0].env
content:
name: JAVA_OPTS
value: >-
-Dcasc.reload.token=$(POD_NAME) -Dio.jenkins.plugins.kubernetes.disableNoDelayProvisioning=true
- it: disable helm.sh label
template: jenkins-controller-statefulset.yaml
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: java & jenkins opts with quotes
template: jenkins-controller-statefulset.yaml
set:
controller:
javaOpts: >-
-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';"
jenkinsOpts: >-
-Dtest="custom: 'true'"
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: JAVA_OPTS
value: >-
-Dcasc.reload.token=$(POD_NAME) -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self';"
- contains:
path: spec.template.spec.containers[0].env
content:
name: JENKINS_OPTS
value: >-
--webroot=/var/jenkins_cache/war -Dtest="custom: 'true'"
- it: test empty controller.podSecurityContextOverride
template: jenkins-controller-statefulset.yaml
set:
controller:
podSecurityContextOverride: {}
asserts:
- equal:
path: spec.template.spec.securityContext
value: {}
- it: test controller.podSecurityContextOverride
template: jenkins-controller-statefulset.yaml
set:
controller:
podSecurityContextOverride: &expected
runAsNonRoot: true
runAsUser: 4444
supplementalGroups: [5555]
asserts:
- equal:
path: spec.template.spec.securityContext
value: *expected
- it: test controller.sidecars.additionalSidecarContainers
template: jenkins-controller-statefulset.yaml
set:
controller:
sidecars:
additionalSidecarContainers:
- name: otel-collector
image: opentelemetry-collector:0.93.0
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 100m
memory: 128Mi
asserts:
- equal:
path: spec.template.spec.containers[2]
value:
name: otel-collector
image: opentelemetry-collector:0.93.0
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 100m
memory: 128Mi
- it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 1)
template: jenkins-controller-statefulset.yaml
set:
controller.sidecars.configAutoReload.enabled: true
controller.sidecars.configAutoReload.logging.configuration.override: true
asserts:
- equal:
path: spec.template.spec.volumes[0]
value:
name: auto-reload-config
configMap:
name: my-release-jenkins-auto-reload-config
- equal:
path: spec.template.spec.initContainers[0].env[5]
value:
name: LOG_CONFIG
value: /var/jenkins_home/auto-reload/auto-reload-config.yaml
- equal:
path: spec.template.spec.containers[1].env[7]
value:
name: LOG_CONFIG
value: /var/jenkins_home/auto-reload/auto-reload-config.yaml
- it: test controller.sidecars.configAutoReload.logging.configuration.override (Part 2)
template: auto-reload-config.yaml
set:
controller.sidecars.configAutoReload.enabled: true
controller.sidecars.configAutoReload.logging.configuration.override: true
asserts:
- isKind:
of: ConfigMap
- it: test 2 additional secrets
template: jenkins-controller-statefulset.yaml
set:
controller.additionalSecrets:
- name: something
value: secret
- name: anotherthing
value: anothersecret
asserts:
- equal:
path: spec.template.spec.containers[0].volumeMounts[4]
value:
mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- equal:
path: spec.template.spec.volumes[3]
value:
name: jenkins-secrets
projected:
sources:
- secret:
name: my-release-jenkins-additional-secrets
- secret:
name: my-release-jenkins
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
- it: test existing secret without additionalExistingSecrets
template: jenkins-controller-statefulset.yaml
set:
controller.existingSecret: my-exisiting-credentials
asserts:
- equal:
path: spec.template.spec.containers[0].volumeMounts[4]
value:
mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- equal:
path: spec.template.spec.volumes[3]
value:
name: jenkins-secrets
projected:
sources:
- secret:
name: my-release-jenkins
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
- secret:
name: my-exisiting-credentials
- it: test existing secret with additionalExistingSecrets
template: jenkins-controller-statefulset.yaml
set:
controller.existingSecret: my-exisiting-credentials
controller.additionalExistingSecrets:
- name: my-exisiting-credentials
keyName: github-username
- name: my-exisiting-credentials
keyName: github-password
asserts:
- equal:
path: spec.template.spec.containers[0].volumeMounts[4]
value:
mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- equal:
path: spec.template.spec.volumes[3]
value:
name: jenkins-secrets
projected:
sources:
- secret:
items:
- key: github-username
path: my-exisiting-credentials-github-username
name: my-exisiting-credentials
- secret:
items:
- key: github-password
path: my-exisiting-credentials-github-password
name: my-exisiting-credentials
- secret:
name: my-release-jenkins
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
- secret:
name: my-exisiting-credentials
- it: test templated environment variables
template: jenkins-controller-statefulset.yaml
set:
testValue: some-value
controller.initContainerEnv:
- name: "TEST_ENV_VAR_INIT"
value: "test-env-var-init"
- name: "TEST_ENV_VAR_INIT_TEMPLATED"
value: "{{ .Values.testValue }}"
controller.sidecars.configAutoReload.env:
- name: "TEST_ENV_VAR_CONFIG"
value: "test-env-var-config"
- name: "TEST_ENV_VAR_CONFIG_TEMPLATED"
value: "{{ .Values.testValue }}"
controller.containerEnv:
- name: "TEST_ENV_VAR_CONTAINER"
value: "test-env-var-container"
- name: "TEST_ENV_VAR__CONTAINER_TEMPLATED"
value: "{{ .Values.testValue }}"
controller.initContainerEnvFrom:
- configMapRef:
name: special-config
controller.sidecars.configAutoReload.envFrom:
- configMapRef:
name: special-config-auto-reload
controller.containerEnvFrom:
- configMapRef:
name: special-config
asserts:
- contains:
path: spec.template.spec.initContainers[0].env
content:
name: "TEST_ENV_VAR_CONFIG"
value: "test-env-var-config"
- contains:
path: spec.template.spec.initContainers[0].env
content:
name: "TEST_ENV_VAR_CONFIG_TEMPLATED"
value: "some-value"
- contains:
path: spec.template.spec.initContainers[1].env
content:
name: "TEST_ENV_VAR_INIT"
value: "test-env-var-init"
- contains:
path: spec.template.spec.initContainers[1].env
content:
name: "TEST_ENV_VAR_INIT_TEMPLATED"
value: "some-value"
- contains:
path: spec.template.spec.containers[1].env
content:
name: "TEST_ENV_VAR_CONFIG"
value: "test-env-var-config"
- contains:
path: spec.template.spec.containers[1].env
content:
name: "TEST_ENV_VAR_CONFIG_TEMPLATED"
value: "some-value"
- contains:
path: spec.template.spec.containers[0].env
content:
name: "TEST_ENV_VAR_CONTAINER"
value: "test-env-var-container"
- contains:
path: spec.template.spec.containers[0].env
content:
name: "TEST_ENV_VAR__CONTAINER_TEMPLATED"
value: "some-value"
- contains:
path: spec.template.spec.initContainers[0].envFrom
content:
configMapRef:
name: special-config-auto-reload
- contains:
path: spec.template.spec.initContainers[1].envFrom
content:
configMapRef:
name: special-config
- contains:
path: spec.template.spec.containers[0].envFrom
content:
configMapRef:
name: special-config
- contains:
path: spec.template.spec.containers[1].envFrom
content:
configMapRef:
name: special-config-auto-reload
- it: test sleep time for config-reload
template: jenkins-controller-statefulset.yaml
set:
controller.sidecars.configAutoReload.sleepTime: 60
asserts:
- contains:
# METHOD remains LIST on the config-reload init container
path: spec.template.spec.initContainers[0].env
content:
name: "METHOD"
value: "LIST"
- contains:
path: spec.template.spec.containers[1].env
content:
name: "METHOD"
value: "SLEEP"
- contains:
path: spec.template.spec.containers[1].env
content:
name: "SLEEP_TIME"
value: "60"
- it: test METHOD env var for config-reload
template: jenkins-controller-statefulset.yaml
set:
controller.sidecars.configAutoReload.env:
- name: "METHOD"
value: "SLEEP"
asserts:
- contains:
# METHOD remains LIST on the config-reload init container
path: spec.template.spec.initContainers[0].env
content:
name: "METHOD"
value: "LIST"
- notContains:
# only one METHOD on the config-reload init container
path: spec.template.spec.initContainers[0].env
content:
name: "METHOD"
value: "SLEEP"
- contains:
path: spec.template.spec.containers[1].env
content:
name: "METHOD"
value: "SLEEP"
- it: test scheme for config-reload
template: jenkins-controller-statefulset.yaml
set:
controller.sidecars.configAutoReload.scheme: "https"
asserts:
- matchSnapshot:
path: spec
- it: test skip tls verify for config-reload
template: jenkins-controller-statefulset.yaml
set:
controller.sidecars.configAutoReload.skipTlsVerify: true
asserts:
- contains:
path: spec.template.spec.containers[1].env
content:
name: "REQ_SKIP_TLS_VERIFY"
value: "true"
- it: overrides container args
template: jenkins-controller-statefulset.yaml
set:
controller.overrideArgs:
- --httpPort=8080
- --requestHeaderSize=32768
asserts:
- equal:
path: spec.template.spec.containers[0].args
value:
- --httpPort=8080
- --requestHeaderSize=32768
- it: allows templating in container args overrides
template: jenkins-controller-statefulset.yaml
set:
controller.overrideArgs:
- --httpPort={{.Values.controller.targetPort}}
- --requestHeaderSize=32768
asserts:
- equal:
path: spec.template.spec.containers[0].args
value:
- --httpPort=8080
- --requestHeaderSize=32768
- it: render pod annotations
template: jenkins-controller-statefulset.yaml
set:
controller:
podAnnotations:
templated-annotations: "{{ .Release.Name }}"
fixed-annotation: some-fixed-annotation
asserts:
- matchSnapshot:
path: spec.template.metadata.annotations
- it: test true shareProcessNamespace
template: jenkins-controller-statefulset.yaml
set:
controller:
shareProcessNamespace: true
asserts:
- equal:
path: spec.template.spec.shareProcessNamespace
value: true
- it: test false shareProcessNamespace
template: jenkins-controller-statefulset.yaml
set:
controller:
shareProcessNamespace: false
asserts:
- isNull:
path: spec.template.spec.shareProcessNamespace
- it: test false enableServiceLinks
template: jenkins-controller-statefulset.yaml
set:
controller:
enableServiceLinks: false
asserts:
- equal:
path: spec.template.spec.enableServiceLinks
value: false
- it: test true enableServiceLinks
template: jenkins-controller-statefulset.yaml
set:
controller:
enableServiceLinks: true
asserts:
- isNull:
path: spec.template.spec.enableServiceLinks
- it: test disableSecretMount
template: jenkins-controller-statefulset.yaml
set:
controller:
httpsKeyStore:
enable: true
disableSecretMount: true
password: some-secret-password
path: /some/path
jenkinsHttpsJksSecretName: some-secret-name
fileName: some-file-name
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "JENKINS_HTTPS_KEYSTORE_PASSWORD"
value: some-secret-password
- notContains:
path: spec.template.spec.containers[0].volumeMounts
content:
mountPath: /some/path
name: jenkins-https-keystore
- notContains:
path: spec.template.spec.initContainers[1].volumeMounts
content:
mountPath: /some/path
name: jenkins-https-keystore
- notContains:
path: spec.template.spec.volumes
content:
name: jenkins-https-keystore
secret:
secretName: some-secret-name
items:
- key: jenkins-jks-file
path: some-file-name
- it: test not disableSecretMount
template: jenkins-controller-statefulset.yaml
set:
controller:
httpsKeyStore:
enable: true
disableSecretMount: false
jenkinsHttpsJksSecretName: some-secret-name
path: /some/path
fileName: some-file-name
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "JENKINS_HTTPS_KEYSTORE_PASSWORD"
valueFrom:
secretKeyRef:
name: some-secret-name
key: "https-jks-password"
- contains:
path: spec.template.spec.containers[0].volumeMounts
content:
mountPath: /some/path
name: jenkins-https-keystore
- contains:
path: spec.template.spec.initContainers[1].volumeMounts
content:
mountPath: /some/path
name: jenkins-https-keystore
- contains:
path: spec.template.spec.volumes
content:
name: jenkins-https-keystore
secret:
secretName: some-secret-name
items:
- key: jenkins-jks-file
path: some-file-name
- it: test override with jenkinsHttpsJksPasswordSecretName and jenkinsHttpsJksPasswordSecretKey
template: jenkins-controller-statefulset.yaml
set:
controller:
httpsKeyStore:
enable: true
disableSecretMount: false
jenkinsHttpsJksPasswordSecretName: "some-jks-name"
jenkinsHttpsJksPasswordSecretKey: "some-jks-password"
jenkinsHttpsJksSecretName: some-secret-name
path: /some/path
fileName: some-file-name
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "JENKINS_HTTPS_KEYSTORE_PASSWORD"
valueFrom:
secretKeyRef:
name: "some-jks-name"
key: "some-jks-password"
- it: test jenkinsHttpsJksSecretKey override
template: jenkins-controller-statefulset.yaml
set:
controller:
httpsKeyStore:
enable: true
disableSecretMount: false
jenkinsHttpsJksSecretName: some-secret-name
path: /some/path
fileName: some-file-name
jenkinsHttpsJksSecretKey: "some.jks"
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: jenkins-https-keystore
secret:
secretName: some-secret-name
items:
- key: "some.jks"
path: some-file-name
- it:
template: jenkins-controller-statefulset.yaml
set:
controller:
installPlugins: false
asserts:
- notContains:
path: spec.template.spec.volumes
content:
name: plugins
emptyDir: {}
- notContains:
path: spec.template.spec.initContainers[1].volumeMounts
content:
name: plugins
- it:
template: jenkins-controller-statefulset.yaml
set:
controller:
JCasC:
configUrls:
- https://acme.org/jenkins.yaml
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "CASC_JENKINS_CONFIG"
value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml"
- it:
template: jenkins-controller-statefulset.yaml
set:
controller:
JCasC:
configUrls:
- https://acme.org/jenkins.yaml
- https://foobar.org/jenkins.yaml
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "CASC_JENKINS_CONFIG"
value: "/var/jenkins_home/casc_configs,https://acme.org/jenkins.yaml,https://foobar.org/jenkins.yaml"
- it:
template: jenkins-controller-statefulset.yaml
set:
controller:
JCasC:
configUrls: []
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: "CASC_JENKINS_CONFIG"
value: "/var/jenkins_home/casc_configs"
- it: test checksum for config-init-script
template: jenkins-controller-statefulset.yaml
set:
controller:
initScripts:
test: |-
This is a test script
asserts:
- isSubset:
path: spec.template.metadata.annotations
content:
checksum/config-init-scripts: 2ee2c03a600a50a55cf62cbed3f1d558d5322eda7544b4047beeb4df66e8ec11
helm-templates/jenkins-grn/unittests/jenkins-controller-svc-test.yaml
-166
View File
@@ -1,166 +0,0 @@
suite: Jenkins Controller
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-svc.yaml
tests:
- it: default tests
asserts:
- isKind:
of: Service
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: spec
value:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: ClusterIP
- it: other values
set:
controller:
serviceLabels:
label: label-value
serviceAnnotations:
key: value
clusterIP: 10.10.10.11
servicePort: 8888
targetPort: 7777
extraPorts:
- name: BuildInfoProxy
port: 9000
asserts:
- equal:
path: metadata.labels.label
value: label-value
- equal:
path: metadata.annotations
value:
key: value
- equal:
path: spec
value:
clusterIP: 10.10.10.11
ports:
- name: http
port: 8888
targetPort: 7777
- name: BuildInfoProxy
port: 9000
targetPort: 9000
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: ClusterIP
- it: extraPort with targetPort
set:
controller:
serviceLabels:
label: label-value
serviceAnnotations:
key: value
clusterIP: 10.10.10.11
servicePort: 8888
targetPort: 7777
extraPorts:
- name: https
port: 443
targetPort: 8080
asserts:
- equal:
path: metadata.labels.label
value: label-value
- equal:
path: metadata.annotations
value:
key: value
- equal:
path: spec
value:
clusterIP: 10.10.10.11
ports:
- name: http
port: 8888
targetPort: 7777
- name: https
port: 443
targetPort: 8080
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: ClusterIP
- it: node port
set:
controller:
serviceType: NodePort
nodePort: 11111
asserts:
- equal:
path: spec
value:
ports:
- name: http
port: 8080
targetPort: 8080
nodePort: 11111
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: NodePort
- it: load balancer
set:
controller:
serviceType: LoadBalancer
loadBalancerIP: 10.10.10.10
asserts:
- equal:
path: spec
value:
loadBalancerIP: 10.10.10.10
loadBalancerSourceRanges:
- 0.0.0.0/0
ports:
- name: http
port: 8080
targetPort: 8080
selector:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
type: LoadBalancer
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: publish not-ready addresses
set:
controller:
publishNotReadyAddresses: true
asserts:
- equal:
path: spec.publishNotReadyAddresses
value: true
helm-templates/jenkins-grn/unittests/rbac-test.yaml
-276
View File
@@ -1,276 +0,0 @@
suite: Role Based Access Control
release:
name: my-release
namespace: my-namespace
templates:
- rbac.yaml
tests:
- it: test default number of documents
asserts:
- hasDocuments:
count: 4
- it: disable auto reload
set:
controller.sidecars.configAutoReload.enabled: false
asserts:
- hasDocuments:
count: 2
- it: disable rbac create
set:
rbac.create: false
asserts:
- hasDocuments:
count: 0
- it: Role schedule-agents
documentIndex: 0
asserts:
- isKind:
of: Role
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-schedule-agents
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: rules
value:
- apiGroups: [""]
resources:
[
"pods",
"pods/exec",
"pods/log",
"persistentvolumeclaims",
"events",
]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "pods/exec", "persistentvolumeclaims"]
verbs: ["create", "delete", "deletecollection", "patch", "update"]
- it: RoleBinding schedule-agents
documentIndex: 1
asserts:
- isKind:
of: RoleBinding
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-schedule-agents
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: roleRef
value:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: my-release-jenkins-schedule-agents
- equal:
path: subjects
value:
- kind: ServiceAccount
name: my-release-jenkins
namespace: my-namespace
- it: Separate Agent Namespace
set:
agent.namespace: agent-namespace
asserts:
- equal:
path: metadata.namespace
value: agent-namespace
documentIndex: 0
- equal:
path: subjects
value:
- kind: ServiceAccount
name: my-release-jenkins
namespace: my-namespace
documentIndex: 1
- it: Role casc-reload
documentIndex: 2
asserts:
- isKind:
of: Role
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-casc-reload
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: rules
value:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "watch", "list"]
- it: RoleBinding casc-reload
documentIndex: 3
asserts:
- isKind:
of: RoleBinding
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-watch-configmaps
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: roleRef
value:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: my-release-jenkins-casc-reload
- equal:
path: subjects
value:
- kind: ServiceAccount
name: my-release-jenkins
namespace: my-namespace
- it: enable read secrets
set:
rbac.readSecrets: true
asserts:
- hasDocuments:
count: 6
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- it: disable helm.sh label
set:
renderHelmLabels: false
rbac.readSecrets: true
asserts:
- hasDocuments:
count: 6
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: Role read-secrets
set:
rbac.readSecrets: true
documentIndex: 2
asserts:
- isKind:
of: Role
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-read-secrets
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: rules
value:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch", "list"]
- it: RoleBinding read-secrets
set:
rbac.readSecrets: true
documentIndex: 3
asserts:
- isKind:
of: RoleBinding
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-read-secrets
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: roleRef
value:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: my-release-jenkins-read-secrets
- equal:
path: subjects
value:
- kind: ServiceAccount
name: my-release-jenkins
namespace: my-namespace
- it: Role use-nonroot-scc
set:
rbac.useOpenShiftNonRootSCC: true
documentIndex: 2
asserts:
- isKind:
of: Role
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-use-nonroot-scc
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: rules
value:
- apiGroups: ["security.openshift.io"]
resources: ["securitycontextconstraints"]
resourceNames: ["nonroot", "nonroot-v2"]
verbs: ["use"]
- it: RoleBinding use-nonroot-scc
set:
rbac.useOpenShiftNonRootSCC: true
documentIndex: 3
asserts:
- isKind:
of: RoleBinding
- equal:
path: apiVersion
value: rbac.authorization.k8s.io/v1
- equal:
path: metadata.name
value: my-release-jenkins-use-nonroot-scc
- equal:
path: metadata.namespace
value: my-namespace
- equal:
path: roleRef
value:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: my-release-jenkins-use-nonroot-scc
- equal:
path: subjects
value:
- kind: ServiceAccount
name: my-release-jenkins
namespace: my-namespace
helm-templates/jenkins-grn/unittests/secret-additional-test.yaml
-41
View File
@@ -1,41 +0,0 @@
suite: Controller Admin Additional Secrets
release:
name: my-release
namespace: my-namespace
templates:
- secret-additional.yaml
tests:
- it: tests defaults
asserts:
- hasDocuments:
count: 0
- it: tests 2 additional secrets
set:
controller.additionalSecrets:
- name: something
value: secret
- name: anotherthing
value: anothersecret
asserts:
- isKind:
of: Secret
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins-additional-secrets
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: data.something
value: c2VjcmV0
- equal:
path: data.anotherthing
value: YW5vdGhlcnNlY3JldA==
helm-templates/jenkins-grn/unittests/secret-claims-test.yaml
-82
View File
@@ -1,82 +0,0 @@
suite: Controller Secret Claims
release:
name: my-release
namespace: my-namespace
templates:
- secret-claims.yaml
tests:
- it: tests defaults
asserts:
- hasDocuments:
count: 0
- it: tests 2 secret claims
set:
controller.secretClaims:
- name: simple-secret
path: secret/path
- name: complex-secret
path: secret/complex
type: kubernetes.io/tls
renew: 60
asserts:
- hasDocuments:
count: 2
- documentIndex: 0
isKind:
of: SecretClaim
- documentIndex: 0
equal:
path: apiVersion
value: vaultproject.io/v1
- documentIndex: 0
equal:
path: metadata.name
value: my-release-jenkins-simple-secret
- documentIndex: 0
matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- documentIndex: 0
isNull:
path: metadata.annotations
- documentIndex: 0
equal:
path: spec.type
value: Opaque
- documentIndex: 0
equal:
path: spec.path
value: secret/path
- documentIndex: 0
isNull:
path: spec.renew
- documentIndex: 1
isKind:
of: SecretClaim
- documentIndex: 1
equal:
path: apiVersion
value: vaultproject.io/v1
- documentIndex: 1
equal:
path: metadata.name
value: my-release-jenkins-complex-secret
- documentIndex: 1
matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- documentIndex: 1
isNull:
path: metadata.annotations
- documentIndex: 1
equal:
path: spec.type
value: kubernetes.io/tls
- documentIndex: 1
equal:
path: spec.path
value: secret/complex
- documentIndex: 1
equal:
path: spec.renew
value: 60
helm-templates/jenkins-grn/unittests/secret-existing-test.yaml
-52
View File
@@ -1,52 +0,0 @@
suite: Controller Additional Existing Secrets
release:
name: my-release
namespace: my-namespace
templates:
- jenkins-controller-statefulset.yaml
- config.yaml
tests:
- it: test additional existing secrets StatefulSet
template: jenkins-controller-statefulset.yaml
set:
controller.additionalExistingSecrets:
- name: "{{ .Release.Name }}-secret"
keyName: username
- name: "{{ .Release.Name }}-secret"
keyName: password
controller.existingSecret: my-existing-credentials
asserts:
- isKind:
of: StatefulSet
- equal:
path: spec.template.spec.containers[0].volumeMounts[4]
value:
mountPath: /run/secrets/additional
name: jenkins-secrets
readOnly: true
- equal:
path: spec.template.spec.volumes[3]
value:
name: jenkins-secrets
projected:
sources:
- secret:
name: my-release-secret
items:
- key: username
path: my-release-secret-username
- secret:
name: my-release-secret
items:
- key: password
path: my-release-secret-password
- secret:
name: my-release-jenkins
items:
- key: jenkins-admin-user
path: chart-admin-username
- key: jenkins-admin-password
path: chart-admin-password
- secret:
name: my-existing-credentials
helm-templates/jenkins-grn/unittests/secret-test.yaml
-63
View File
@@ -1,63 +0,0 @@
suite: Controller Admin Credentials
release:
name: my-release
namespace: my-namespace
templates:
- secret.yaml
tests:
- it: tests defaults
asserts:
- isKind:
of: Secret
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- equal:
path: data.jenkins-admin-user
value: YWRtaW4=
- isNotNull:
path: data.jenkins-admin-password
- it: set admin password
set:
controller.admin.password: secret
asserts:
- equal:
path: data.jenkins-admin-user
value: YWRtaW4=
- equal:
path: data.jenkins-admin-password
value: c2VjcmV0
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: disable
set:
controller.admin.createSecret: false
asserts:
- hasDocuments:
count: 0
- it: disable
set:
controller.admin.existingSecret: my-secret
asserts:
- hasDocuments:
count: 0
helm-templates/jenkins-grn/unittests/service-account-agent-test.yaml
-103
View File
@@ -1,103 +0,0 @@
suite: Controller Service Account
release:
name: my-release
namespace: my-namespace
templates:
- service-account-agent.yaml
tests:
- it: test defaults
asserts:
- hasDocuments:
count: 0
- it: create service account for agents
set:
serviceAccountAgent:
create: true
asserts:
- isKind:
of: ServiceAccount
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins-agent
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- it: agent namespace
set:
serviceAccountAgent:
create: true
annotations:
key: value
agent:
namespace: agents
asserts:
- isKind:
of: ServiceAccount
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins-agent
- equal:
path: metadata.namespace
value: agents
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- equal:
path: metadata.annotations
value:
key: value
- it: disable helm.sh label
set:
renderHelmLabels: false
serviceAccountAgent:
create: true
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: agent image pull secret
set:
renderHelmLabels: false
serviceAccountAgent:
create: true
imagePullSecretName: ips-name
asserts:
- equal:
path: imagePullSecrets
value:
- name: ips-name
- it: agent service account attach labels
set:
serviceAccountAgent:
create: true
extraLabels:
"this.is.a.test.label": "with a value"
"this.is.another.test.label": "with a different value"
asserts:
- equal:
path: metadata.labels["app.kubernetes.io/name"]
value: "jenkins"
- equal:
path: metadata.labels["app.kubernetes.io/managed-by"]
value: "Helm"
- equal:
path: metadata.labels["this.is.a.test.label"]
value: "with a value"
- equal:
path: metadata.labels["this.is.another.test.label"]
value: "with a different value"
helm-templates/jenkins-grn/unittests/service-account-test.yaml
-77
View File
@@ -1,77 +0,0 @@
suite: Controller Service Account
release:
name: my-release
namespace: my-namespace
templates:
- service-account.yaml
tests:
- it: tests defaults
asserts:
- isKind:
of: ServiceAccount
- equal:
path: apiVersion
value: v1
- equal:
path: metadata.name
value: my-release-jenkins
- equal:
path: metadata.namespace
value: my-namespace
- matchRegex:
path: metadata.labels["helm.sh/chart"]
pattern: ^jenkins-
- isNull:
path: metadata.annotations
- it: disable helm.sh label
set:
renderHelmLabels: false
asserts:
- equal:
path: metadata.labels
value:
app.kubernetes.io/component: jenkins-controller
app.kubernetes.io/instance: my-release
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: jenkins
- it: disabled
set:
serviceAccount:
create: false
asserts:
- hasDocuments:
count: 0
- it: controller image pull secret
set:
renderHelmLabels: false
serviceAccount:
create: true
imagePullSecretName: ips-name
asserts:
- equal:
path: imagePullSecrets
value:
- name: ips-name
- it: service account attach labels
set:
serviceAccount:
extraLabels:
"this.is.a.test.label": "with a value"
"this.is.another.test.label": "with a different value"
asserts:
- equal:
path: metadata.labels["app.kubernetes.io/name"]
value: "jenkins"
- equal:
path: metadata.labels["app.kubernetes.io/managed-by"]
value: "Helm"
- equal:
path: metadata.labels["this.is.a.test.label"]
value: "with a value"
- equal:
path: metadata.labels["this.is.another.test.label"]
value: "with a different value"
helm-templates/jenkins-grn/values.yaml
-1382
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins/CHANGELOG.md
-2708
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins/Chart.lock
+6
View File
@@ -0,0 +1,6 @@
dependencies:
- name: jenkins
repository: https://charts.jenkins.io
version: 5.8.58
digest: sha256:e5017c12e31225014e22d5551445f56a3ac80d3fc4106a3aed053c4f9b2b5dbd
generated: "2026-08-31T09:31:32.006387+05:30"
helm-templates/jenkins/Chart.yaml
+9 -44
View File
@@ -1,46 +1,11 @@
apiVersion: v2
name: jenkins
home: https://jenkins.io/
version: 4.8.4
appVersion: 2.426.1
description: Jenkins - Build great things at any scale! The leading open source automation server, Jenkins provides over 1800 plugins to support building, deploying and automating any project.
sources:
- https://github.com/jenkinsci/jenkins
- https://github.com/jenkinsci/docker-inbound-agent
- https://github.com/maorfr/kube-tasks
- https://github.com/jenkinsci/configuration-as-code-plugin
maintainers:
- name: maorfr
email: maor.friedman@redhat.com
- name: torstenwalter
email: mail@torstenwalter.de
- name: mogaal
email: garridomota@gmail.com
- name: wmcdona89
email: wmcdona89@gmail.com
- name: timja
email: timjacomb1@gmail.com
icon: https://get.jenkins.io/art/jenkins-logo/logo.svg
keywords:
- jenkins
- ci
- devops
annotations:
artifacthub.io/links: |
- name: Chart Source
url: https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins
- name: Jenkins
url: https://www.jenkins.io/
- name: support
url: https://github.com/jenkinsci/helm-charts/issues
artifacthub.io/images: |
- name: jenkins
image: jenkins/jenkins:2.426.1-jdk11
- name: k8s-sidecar
image: kiwigrid/k8s-sidecar:1.24.4
- name: inbound-agent
image: jenkins/inbound-agent:3107.v665000b_51092-15
- name: backup
image: maorfr/kube-tasks:0.2.0
artifacthub.io/category: "integration-delivery"
artifacthub.io/license: "Apache-2.0"
version: 1.0.0
dependencies:
- name: jenkins
# Was a fully-vendored chart at v4.8.4 — converted to a thin wrapper
# like every other app in this repo, at the version the fleet's own
# jenkins-grn versioned sibling already targeted as the vetted
# upgrade candidate (appVersion 2.504.2, vs. 2.426.1 on the old one).
version: 5.8.58
repository: https://charts.jenkins.io
helm-templates/jenkins/README.md
-1127
View File
File diff suppressed because it is too large Load Diff
helm-templates/jenkins/Tiltfile
-5
View File
@@ -1,5 +0,0 @@
# If not using a standard local dev name, specify your k8s context here
#allow_k8s_contexts('jenkins-dev')
k8s_yaml(helm('.', values='values.yaml', set=['controller.adminPassword=asdf']))
watch_file('.')
helm-templates/jenkins/VALUES_SUMMARY.md
-421
View File
@@ -1,421 +0,0 @@
# Jenkins
## Configuration
The following tables list the configurable parameters of the Jenkins chart and their default values.
### Jenkins Controller
| Parameter | Description | Default |
|---------------------------------------------|--------------------------------------------------------------------------|----------------------------------------------------------------------|
| `checkDeprecation` | Checks for deprecated values used | `true` |
| `clusterZone` | Override the cluster name for FQDN resolving | `cluster.local` |
| `kubernetesURL` | Override the Kubernetes API server URL | `https://kubernetes.default` |
| `nameOverride` | Override the resource name prefix | `jenkins` |
| `renderHelmLabels` | Enables rendering of the helm.sh/chart label to the annotations | `true` |
| `fullnameOverride` | Override the full resource names | `jenkins-{release-name}` (or `jenkins` if release-name is `jenkins`) |
| `namespaceOverride` | Override the deployment namespace | Not set (`Release.Namespace`) |
| `controller.componentName` | Jenkins controller name | `jenkins-controller` |
| `controller.testEnabled` | Can be used to disable rendering test resources when using helm template | `true` |
| `controller.cloudName` | Name of default cloud configuration | `kubernetes` |
| `controller.legacyRemotingSecurityEnabled` | Is remoting security enabled? | Not set (i.e. not enabled) |
#### Jenkins Configuration as Code (JCasC)
| Parameter | Description | Default |
|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------|
| `controller.JCasC.defaultConfig` | Enables default Jenkins configuration via configuration as code plugin | `true` |
| `controller.JCasC.configScripts` | List of Jenkins Config as Code scripts | `{}` |
| `controller.JCasC.security` | Jenkins Config as Code for Security section | `legacy` |
| `controller.JCasC.securityRealm` | Jenkins Config as Code for Security Realm | `legacy` |
| `controller.JCasC.authorizationStrategy` | Jenkins Config as Code for Authorization Strategy | `loggedInUsersCanDoAnything` |
| `controller.sidecars.configAutoReload` | Jenkins Config as Code auto-reload settings | |
| `controller.sidecars.configAutoReload.enabled` | Jenkins Config as Code auto-reload settings (Attention: rbac needs to be enabled otherwise the sidecar can't read the config map) | `true` |
| `controller.sidecars.configAutoReload.image` | Image which triggers the reload | `kiwigrid/k8s-sidecar:1.24.4` |
| `controller.sidecars.configAutoReload.reqRetryConnect` | How many connection-related errors to retry on | `10` |
| `controller.sidecars.configAutoReload.sleepTime` | How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar) | Not set |
| `controller.sidecars.configAutoReload.envFrom` | Environment variable sources for the Jenkins Config as Code auto-reload container | Not set |
| `controller.sidecars.configAutoReload.env` | Environment variables for the Jenkins Config as Code auto-reload container | Not set |
| `controller.sidecars.configAutoReload.containerSecurityContext` | Enable container security context | `{readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` |
#### Jenkins Configuration Files & Scripts
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.initScripts` | List of Jenkins init scripts | `[]` |
| `controller.initConfigMap` | Pre-existing init scripts | Not set |
#### Jenkins Global Security
| Parameter | Description | Default |
| --------------------------------- | ---------------------------------------- | ----------------------------------------- |
| `controller.adminSecret` | Create secret for admin user | `true` |
| `controller.disableRememberMe` | Disable use of remember me | `false` |
| `controller.enableRawHtmlMarkupFormatter` | Enable HTML parsing using | false |
| `controller.markupFormatter` | Yaml of the markup formatter to use | `plainText` |
| `controller.disabledAgentProtocols` | Disabled agent protocols | `JNLP-connect JNLP2-connect` |
| `controller.csrf.defaultCrumbIssuer.enabled` | Enable the default CSRF Crumb issuer | `true` |
| `controller.csrf.defaultCrumbIssuer.proxyCompatability` | Enable proxy compatibility | `true` |
#### Jenkins Global Settings
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.numExecutors` | Set Number of executors | 0 |
| `controller.executorMode` | Set executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE | NORMAL |
| `controller.customJenkinsLabels` | Append Jenkins labels to the controller | `[]` |
| `controller.jenkinsHome` | Custom Jenkins home path | `/var/jenkins_home` |
| `controller.jenkinsRef` | Custom Jenkins reference path | `/usr/share/jenkins/ref` |
| `controller.jenkinsAdminEmail` | Email address for the administrator of the Jenkins instance | Not set |
| `controller.jenkinsUrl` | Set Jenkins URL if you are not using the ingress definitions provided by the chart | Not set |
| `controller.jenkinsUrlProtocol` | Set protocol for Jenkins URL | Set to `https` if `controller.ingress.tls`, `http` otherwise |
| `controller.jenkinsUriPrefix` | Root Uri Jenkins will be served on | Not set |
| `controller.jenkinsOpts` | Append to `JENKINS_OPTS` env var | Not set |
| `controller.javaOpts` | Append to `JAVA_OPTS` env var | Not set |
#### Jenkins In-Process Script Approval
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.scriptApproval` | List of groovy functions to approve | `[]` |
#### Jenkins Plugins
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.installPlugins` | List of Jenkins plugins to install. If you don't want to install plugins set it to `false` | `kubernetes:1.31.3 workflow-aggregator:2.6 git:4.10.2 configuration-as-code:1414.v878271fc496f` |
| `controller.additionalPlugins` | List of Jenkins plugins to install in addition to those listed in controller.installPlugins | `[]` |
| `controller.initializeOnce` | Initialize only on first install. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`. | `false` |
| `controller.overwritePlugins` | Overwrite installed plugins on start.| `false` |
| `controller.overwritePluginsFromImage` | Keep plugins that are already installed in the controller image.| `true` |
| `controller.installLatestPlugins` | Set to false to download the minimum required version of all dependencies. | `true` |
| `controller.installLatestSpecifiedPlugins` | Set to true to download latest dependencies of any plugin that is requested to have the latest version. | `false` |
#### Jenkins Agent Listener
| Parameter | Description | Default |
| -------------------------------------------- | ----------------------------------------------- | ------------ |
| `controller.agentListenerEnabled` | Create Agent listener service | `true` |
| `controller.agentListenerPort` | Listening port for agents | `50000` |
| `controller.agentListenerHostPort` | Host port to listen for agents | Not set |
| `controller.agentListenerNodePort` | Node port to listen for agents | Not set |
| `controller.agentListenerServiceType` | Defines how to expose the agentListener service | `ClusterIP` |
| `controller.agentListenerServiceAnnotations` | Annotations for the agentListener service | `{}` |
| `controller.agentListenerLoadBalancerIP` | Static IP for the agentListener LoadBalancer | Not set |
| `controller.agentListenerExternalTrafficPolicy` | [Traffic Policy](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies) of for the agentListener service | Not set |
| `controller.agentListenerLoadBalancerSourceRanges` | Allowed inbound IP for the agentListener service | `0.0.0.0/0` |
#### Kubernetes StatefulSet & Service
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.image` | Controller image name | `jenkins/jenkins` |
| `controller.tagLabel` | Controller image tag label | `jdk11` |
| `controller.tag` | Controller image tag override | Not set |
| `controller.imagePullPolicy` | Controller image pull policy | `Always` |
| `controller.imagePullSecretName` | Controller image pull secret | Not set |
| `controller.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 50m, memory: 256Mi}, limits: {cpu: 2000m, memory: 4096Mi}}`|
| `controller.initContainerResources` | Resources allocation (Requests and Limits) for Init Container | Not set |
| `controller.initContainerEnvFrom` | Environment variable sources for Init Container | Not set |
| `controller.initContainerEnv` | Environment variables for Init Container | Not set |
| `controller.containerEnvFrom` | Environment variable sources for Jenkins Container | Not set |
| `controller.containerEnv` | Environment variables for Jenkins Container | Not set |
| `controller.usePodSecurityContext` | Enable pod security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` |
| `controller.runAsUser` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` |
| `controller.fsGroup` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` |
| `controller.podSecurityContextOverride` | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set |
| `controller.containerSecurityContext` | Allow to control securityContext for the jenkins container. | `{runAsUser: 1000, runAsGroup: 1000, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false}` |
| `controller.hostAliases` | Aliases for IPs in `/etc/hosts` | `[]` |
| `controller.serviceAnnotations` | Service annotations | `{}` |
| `controller.serviceType` | k8s service type | `ClusterIP` |
| `controller.clusterIP` | k8s service clusterIP | Not set |
| `controller.servicePort` | k8s service port | `8080` |
| `controller.targetPort` | k8s target port | `8080` |
| `controller.nodePort` | k8s node port | Not set |
| `controller.jmxPort` | Open a port, for JMX stats | Not set |
| `controller.extraPorts` | Open extra ports, for other uses | `[]` |
| `controller.loadBalancerSourceRanges` | Allowed inbound IP addresses | `0.0.0.0/0` |
| `controller.loadBalancerIP` | Optional fixed external IP | Not set |
| `controller.statefulSetLabels` | Custom StatefulSet labels | Not set |
| `controller.serviceLabels` | Custom Service labels | Not set |
| `controller.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set |
| `controller.nodeSelector` | Node labels for pod assignment | `{}` |
| `controller.affinity` | Affinity settings | `{}` |
| `controller.schedulerName` | Kubernetes scheduler name | Not set |
| `controller.terminationGracePeriodSeconds` | Set TerminationGracePeriodSeconds | Not set |
| `controller.terminationMessagePath` | Set the termination message path | Not set |
| `controller.terminationMessagePolicy` | Set the termination message policy | Not set |
| `controller.tolerations` | Toleration labels for pod assignment | `[]` |
| `controller.podAnnotations` | Annotations for controller pod | `{}` |
| `controller.statefulSetAnnotations` | Annotations for controller StatefulSet | `{}` |
| `controller.updateStrategy` | Update strategy for StatefulSet | `{}` |
| `controller.lifecycle` | Lifecycle specification for controller-container | Not set |
| `controller.priorityClassName` | The name of a `priorityClass` to apply to the controller pod | Not set |
| `controller.admin.existingSecret` | The name of an existing secret containing the admin credentials. | `""`|
| `controller.admin.userKey` | The key in the existing admin secret containing the username. | `jenkins-admin-user` |
| `controller.admin.passwordKey` | The key in the existing admin secret containing the password. | `jenkins-admin-password` |
| `controller.customInitContainers` | Custom init-container specification in raw-yaml format | Not set |
| `controller.sidecars.other` | Configures additional sidecar container(s) for Jenkins controller | `[]` |
#### Kubernetes Pod Disruption Budget
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.podDisruptionBudget.enabled` | Enable [Kubernetes Pod Disruption Budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) configuration from `controller.podDisruptionBudget` (see below) | `false` |
| `controller.podDisruptionBudget.apiVersion` | Policy API version | `policy/v1beta1` |
| `controller.podDisruptionBudget.maxUnavailable` | Number of pods that can be unavailable. Either an absolute number or a percentage. | Not set |
#### Kubernetes Health Probes
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.healthProbes` | Enable [Kubernetes Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes) configuration from `controller.probes` (see below) | `true` |
| `controller.probes.livenessProbe.timeoutSeconds` | Set the timeout for the liveness probe in seconds | `5` |
| `controller.probes.livenessProbe.periodSeconds` | Set the time interval (in seconds) between two liveness probes executions | `10` |
| `controller.probes.livenessProbe.failureThreshold` | Set the failure threshold for the liveness probe | `5` |
| `controller.probes.livenessProbe.initialDelaySeconds` | Set the initial delay for the liveness probe | Not set |
| `controller.probes.livenessProbe.httpGet.port` | Set the Pod's HTTP port to use for the liveness probe | `http` |
| `controller.probes.livenessProbe.httpGet.path` | Set the HTTP's path for the liveness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) |
| `controller.probes.readinessProbe.timeoutSeconds` | Set the timeout for the readiness probe in seconds | `5` |
| `controller.probes.readinessProbe.periodSeconds` | Set the time interval (in seconds) between two readiness probes executions | `10` |
| `controller.probes.readinessProbe.failureThreshold` | Set the failure threshold for the readiness probe | `3` |
| `controller.probes.readinessProbe.initialDelaySeconds` | Set the initial delay for the readiness probe | Not set |
| `controller.probes.readinessProbe.httpGet.port` | Set the Pod's HTTP port to use for the readiness probe | `http` |
| `controller.probes.readinessProbe.httpGet.path` | Set the HTTP's path for the readiness probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) |
| `controller.probes.startupProbe.timeoutSeconds` | Set the timeout for the startup probe in seconds | `5` |
| `controller.probes.startupProbe.periodSeconds` | Set the time interval (in seconds) between two startup probes executions | `10` |
| `controller.probes.startupProbe.failureThreshold` | Set the failure threshold for the startup probe | `12` |
| `controller.probes.startupProbe.initialDelaySeconds` | Set the initial delay for the startup probe | Not set |
| `controller.probes.startupProbe.httpGet.port` | Set the Pod's HTTP port to use for the startup probe | `http` |
| `controller.probes.startupProbe.httpGet.path` | Set the HTTP's path for the startup probe | `/login'` (or `${controller.jenkinsUriPrefix}/login` if `controller.jenkinsUriPrefix` is defined) |
#### Kubernetes Ingress
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.ingress.enabled` | Enables ingress | `false` |
| `controller.ingress.apiVersion` | Ingress API version | `extensions/v1beta1` |
| `controller.ingress.hostName` | Ingress hostname | Not set |
| `controller.ingress.resourceRootUrl` | Hostname to serve assets from | Not set |
| `controller.ingress.annotations` | Ingress annotations | `{}` |
| `controller.ingress.labels` | Ingress labels | `{}` |
| `controller.ingress.path` | Ingress path | Not set |
| `controller.ingress.paths` | Override for the default Ingress paths | `[]` |
| `controller.ingress.tls` | Ingress TLS configuration | `[]` |
#### GKE BackendConfig
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.backendconfig.enabled` | Enables backendconfig | `false` |
| `controller.backendconfig.apiVersion` | backendconfig API version | `extensions/v1beta1` |
| `controller.backendconfig.name` | backendconfig name | Not set |
| `controller.backendconfig.annotations` | backendconfig annotations | `{}` |
| `controller.backendconfig.labels` | backendconfig labels | `{}` |
| `controller.backendconfig.spec` | backendconfig spec | `{}` |
#### OpenShift Route
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.route.enabled` | Enables openshift route | `false` |
| `controller.route.annotations` | Route annotations | `{}` |
| `controller.route.labels` | Route labels | `{}` |
| `controller.route.path` | Route path | Not set |
#### Prometheus
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.prometheus.enabled` | Enables prometheus service monitor | `false` |
| `controller.prometheus.serviceMonitorAdditionalLabels` | Additional labels to add to the service monitor object | `{}` |
| `controller.prometheus.serviceMonitorNamespace` | Custom namespace for serviceMonitor | Not set (same ns where is Jenkins being deployed) |
| `controller.prometheus.scrapeInterval` | How often prometheus should scrape metrics | `60s` |
| `controller.prometheus.scrapeEndpoint` | The endpoint prometheus should get metrics from | `/prometheus` |
| `controller.prometheus.alertingrules` | Array of prometheus alerting rules | `[]` |
| `controller.prometheus.alertingRulesAdditionalLabels` | Additional labels to add to the prometheus rule object | `{}` |
| `controller.prometheus.prometheusRuleNamespace` | Custom namespace for PrometheusRule | `""` (same ns where Jenkins being deployed) |
#### HTTPS Keystore
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `controller.httpsKeyStore.enable` | Enables HTTPS keystore on jenkins controller | `false` |
| `controller.httpsKeyStore.jenkinsHttpsJksSecretName` | Name of the secret that already has ssl keystore | `` |
| `controller.httpsKeyStore.jenkinsHttpsJksSecretKey` | Name of the key in the secret that already has ssl keystore | `jenkins-jks-file` |
| `controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretName` | Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file | `` |
| `controller.httpsKeyStore.jenkinsHttpsJksPasswordSecretKey` | Name of the key in the secret that contains the JKS password | `https-jks-password` |
| `controller.httpsKeyStore.httpPort` | HTTP Port that Jenkins should listen on along with HTTPS, it also serves liveness and readiness probs port. When HTTPS keystore is enabled servicePort and targetPort will be used as HTTPS port | `8081` |
| `controller.httpsKeyStore.path` | Path of HTTPS keystore file | `/var/jenkins_keystore` |
| `controller.httpsKeyStore.fileName` | Jenkins keystore filename which will appear under controller.httpsKeyStore.path | `keystore.jks` |
| `controller.httpsKeyStore.password` | Jenkins keystore password | `password` |
| `controller.httpsKeyStore.jenkinsKeyStoreBase64Encoded` | Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here | a self signed cert |
#### Kubernetes Secret
| Parameter | Description | Default |
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ----------------------------------------- |
| `controller.adminUser` | Admin username (and password) created as a secret if adminSecret is true | `admin` |
| `controller.adminPassword` | Admin password (and user) created as a secret if adminSecret is true | Random value |
| `controller.existingSecret` | The name of an existing secret containing keys credentials. | `""`|
| `controller.additionalSecrets` | List of additional secrets to create and mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` |
| `controller.additionalExistingSecrets` | List of additional existing secrets to mount according to [JCasC docs](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets) | `[]` |
| `controller.secretClaims` | List of `SecretClaim` resources to create | `[]` |
#### Kubernetes NetworkPolicy
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources. | `false` |
| `networkPolicy.apiVersion` | NetworkPolicy ApiVersion | `networking.k8s.io/v1` |
| `networkPolicy.internalAgents.allowed` | Allow internal agents (from the same cluster) to connect to controller. Agent pods would be filtered based on PodLabels. | `false` |
| `networkPolicy.internalAgents.podLabels` | A map of labels (keys/values) that agents pods must have to be able to connect to controller. | `{}` |
| `networkPolicy.internalAgents.namespaceLabels` | A map of labels (keys/values) that agents namespaces must have to be able to connect to controller. | `{}` |
| `networkPolicy.externalAgents.ipCIDR` | The IP range from which external agents are allowed to connect to controller. | `` |
| `networkPolicy.externalAgents.except` | A list of IP sub-ranges to be excluded from the whitelisted IP range. | `[]` |
#### Kubernetes RBAC
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `rbac.create` | Whether RBAC resources are created | `true` |
| `rbac.readSecrets` | Whether the Jenkins service account should be able to read Kubernetes secrets | `false` |
#### Kubernetes ServiceAccount - Controller
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `serviceAccount.name` | name of the ServiceAccount to be used by access-controlled resources | autogenerated |
| `serviceAccount.create` | Configures if a ServiceAccount with this name should be created | `true` |
| `serviceAccount.annotations` | Configures annotation for the ServiceAccount | `{}` |
| `serviceAccount.extraLabels` | Configures extra labels for the ServiceAccount | `{}` |
| `serviceAccount.imagePullSecretName` | Controller ServiceAccount image pull secret | Not set |
#### Kubernetes ServiceAccount - Agent
| Parameter | Description | Default |
| --------------------------------- | ------------------------------------ | ----------------------------------------- |
| `serviceAccountAgent.name` | name of the agent ServiceAccount to be used by access-controlled resources | autogenerated |
| `serviceAccountAgent.create` | Configures if an agent ServiceAccount with this name should be created | `false` |
| `serviceAccountAgent.annotations` | Configures annotation for the agent ServiceAccount | `{}` |
| `serviceAccountAgent.extraLabels` | Configures extra labels for the agent ServiceAccount | `{}` |
| `serviceAccountAgent.imagePullSecretName` | Agent ServiceAccount image pull secret | Not set |
### Jenkins Agent(s)
| Parameter | Description | Default |
| -------------------------- |------------------------------------------------------------------------------------------| ---------------------- |
| `agent.enabled` | Enable Kubernetes plugin jnlp-agent podTemplate | `true` |
| `agent.namespace` | Namespace in which the Kubernetes agents should be launched | Not set |
| `agent.containerCap` | Maximum number of agent | 10 |
| `agent.defaultsProviderTemplate` | The name of the pod template to use for providing default values | Not set |
| `agent.jenkinsUrl` | Overrides the Kubernetes Jenkins URL | Not set |
| `agent.jenkinsTunnel` | Overrides the Kubernetes Jenkins tunnel | Not set |
| `agent.kubernetesConnectTimeout` | The connection timeout in seconds for connections to Kubernetes API. Minimum value is 5. | 5 |
| `agent.kubernetesReadTimeout` | The read timeout in seconds for connections to Kubernetes API. Minimum value is 15. | 15 |
| `agent.maxRequestsPerHostStr` | The maximum concurrent connections to Kubernetes API | 32 |
| `agent.retentionTimeout` | Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated | 5 |
| `agent.waitForPodSec` | Seconds to wait for pod to be running | 600 |
| `agent.podLabels` | Custom Pod labels (an object with `label-key: label-value` pairs) | Not set |
| `agent.jnlpregistry` | Custom docker registry used for to get agent jnlp image | Not set |
#### Pod Configuration
| Parameter | Description | Default |
| -------------------------- | ----------------------------------------------- | ---------------------- |
| `agent.websocket` | Enables agent communication via websockets | false |
| `agent.podName` | Agent Pod base name | Not set |
| `agent.customJenkinsLabels`| Append Jenkins labels to the agent | `[]` |
| `agent.envVars` | Environment variables for the agent Pod | `[]` |
| `agent.idleMinutes` | Allows the Pod to remain active for reuse | 0 |
| `agent.imagePullSecretName` | Agent image pull secret | Not set |
| `agent.hostNetworking` | Enabled agent to use hostnetwork | false |
| `agent.nodeSelector` | Node labels for pod assignment | `{}` |
| `agent.connectTimeout` | Timeout in seconds for an agent to be online | 100 |
| `agent.volumes` | Additional volumes | `[]` |
| `agent.workspaceVolume` | Workspace volume (defaults to EmptyDir) | `{}` |
| `agent.yamlTemplate` | The raw yaml of a Pod API Object to merge into the agent spec | Not set |
| `agent.yamlMergeStrategy` | Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates | `override` |
| `agent.annotations` | Annotations to apply to the pod | `{}` |
| `agent.additionalContainers` | Add additional containers to the agents. | `[]` |
#### Side Container Configuration
| Parameter | Description | Default |
| -------------------------- | ----------------------------------------------- |--------------------------------------------------------------------------------|
| `agent.sideContainerName` | Side container name in agent | jnlp |
| `agent.image` | Agent image name | `jenkins/inbound-agent` |
| `agent.tag` | Agent image tag | `3107.v665000b_51092-5` |
| `agent.alwaysPullImage` | Always pull agent container image before build | `false` |
| `agent.privileged` | Agent privileged container | `false` |
| `agent.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 512m, memory: 512Mi}, limits: {cpu: 512m, memory: 512Mi}}` |
| `agent.runAsUser` | Configure container user | Not set |
| `agent.runAsGroup` | Configure container group | Not set |
| `agent.command` | Executed command when side container starts | Not set |
| `agent.args` | Arguments passed to executed command | `${computer.jnlpmac} ${computer.name}` |
| `agent.TTYEnabled` | Allocate pseudo tty to the side container | false |
| `agent.workingDir` | Configure working directory for default agent | `/home/jenkins/agent` |
#### Other
| Parameter | Description | Default |
| -------------------------- | ----------------------------------------------- | ---------------------- |
| `agent.disableDefaultAgent` | Ignore the default Jenkins Agent configuration | false |
| `agent.podTemplates` | Configures extra pod templates for the default kubernetes cloud | `{}` |
| `additionalAgents` | Configure additional agents which inherit values from `agent` | `{}` |
### Persistence
| Parameter | Description | Default |
| --------------------------- | -------------------------------------- | --------------- |
| `persistence.enabled` | Enable the use of a Jenkins PVC | `true` |
| `persistence.existingClaim` | Provide the name of a PVC | `nil` |
| `persistence.storageClass` | Storage class for the PVC | `nil` |
| `persistence.annotations` | Annotations for the PVC | `{}` |
| `persistence.labels` | Labels for the PVC | `{}` |
| `persistence.accessMode` | The PVC access mode | `ReadWriteOnce` |
| `persistence.size` | The size of the PVC | `8Gi` |
| `persistence.dataSource` | Existing data source to clone PVC from | `nil` |
| `persistence.subPath` | SubPath for jenkins-home mount | `nil` |
| `persistence.volumes` | Additional volumes | `nil` |
| `persistence.mounts` | Additional mounts | `nil` |
### Backup
| Parameter | Description | Default |
| ---------------------------------------- | ----------------------------------------------------------------- | --------------------------------- |
| `backup.enabled` | Enable the use of a backup CronJob | `false` |
| `backup.schedule` | Schedule to run jobs | `0 2 * * *` |
| `backup.labels` | Backup pod labels | `{}` |
| `backup.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `backup.serviceAccount.name` | name of the backup ServiceAccount | autogenerated |
| `backup.serviceAccount.annotations` | Backup pod annotations | `{}` |
| `backup.image.repo` | Backup image repository | `maorfr/kube-tasks` |
| `backup.image.tag` | Backup image tag | `0.2.0` |
| `backup.image.imagePullSecretName` | Backup image pull secret | Not set |
| `backup.extraArgs` | Additional arguments for kube-tasks | `[]` |
| `backup.existingSecret` | Environment variables to add to the cronjob container | `{}` |
| `backup.existingSecret.*` | Specify the secret name containing the AWS or GCP credentials | `jenkinsaws` |
| `backup.existingSecret.*.awsaccesskey` | `secretKeyRef.key` used for `AWS_ACCESS_KEY_ID` | `jenkins_aws_access_key` |
| `backup.existingSecret.*.awssecretkey` | `secretKeyRef.key` used for `AWS_SECRET_ACCESS_KEY` | `jenkins_aws_secret_key` |
| `backup.existingSecret.*.azstorageaccount`| `secretKeyRef.key` used for `AZURE_STORAGE_ACCOUNT` | `""` |
| `backup.existingSecret.*.azstoragekey` | `secretKeyRef.key` used for `AZURE_STORAGE_ACCESS_KEY` | `""` |
| `backup.existingSecret.*.gcpcredentials` | Mounts secret as volume and sets `GOOGLE_APPLICATION_CREDENTIALS` | `credentials.json` |
| `backup.env` | Backup environment variables | `[]` |
| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` |
| `backup.destination` | Destination to store backup artifacts | `s3://jenkins-data/backup` |
| `backup.onlyJobs` | Only backup the job folder | `false` |
| `backup.usePodSecurityContext` | Enable backup pod's security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` |
| `backup.runAsUser` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that jenkins runs with. | `1000` |
| `backup.fsGroup` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` |
| `backup.podSecurityContextOverride` | Completely overwrites the contents of the backup pod's security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set |
| `cronJob.apiVersion` | CronJob API version | 'batch/v1' |
| `awsSecurityGroupPolicies.enabled` | Enable the creation of SecurityGroupPolicy resources | `false` |
| `awsSecurityGroupPolicies.policies` | Security Group Policy definitions. `awsSecurityGroupPolicies.enabled` must be `true` | Not set |
### Helm Tests
| Parameter | Description | Default |
| --------------------- | --------------------------------- | --------------- |
| `helmtest.bats.image` | Image used to test the framework | `bats/bats` |
| `helmtest.bats.tag` | Test framework image tag override | `1.2.1` |
helm-templates/jenkins/charts/jenkins-5.8.58.tgz
BIN
View File
Binary file not shown.
helm-templates/jenkins/ci/default-values.yaml
-5
View File
@@ -1,5 +0,0 @@
# this file is empty to check if defaults within values.yaml work as expected
controller:
JCasC:
configScripts:
empty: ""
helm-templates/jenkins/ci/other-values.yaml
-95
View File
@@ -1,95 +0,0 @@
---
controller:
overwritePluginsFromImage: false
containerSecurityContext: ""
runAsUser: 0
fsGroup: 1000
JCasC:
authorizationStrategy: |-
loggedInUsersCanDoAnything:
allowAnonymousRead: true
securityRealm: |-
ldap:
configurations:
- server: ldap.acme.com
rootDN: dc=acme,dc=uk
managerPasswordSecret: ${LDAP_PASSWORD}
groupMembershipStrategy:
fromUserRecord:
attributeName: "memberOf"
additionalPlugins:
- ldap:682.v7b_544c9d1512
scriptApproval:
- "method groovy.json.JsonSlurperClassic parseText java.lang.String"
- "new groovy.json.JsonSlurperClassic"
ingress:
enabled: true
persistence:
enabled: false
agent:
resources:
limits:
cpu: "1"
memory: "2048Mi"
envVars:
- name: HOME
value: /home/jenkins/agent
- name: PATH
value: /usr/local/bin
nodeSelector:
"app.kubernetes.io/component": "{{ .Values.agent.componentName }}"
yamlTemplate: |-
apiVersion: v1
kind: Pod
spec:
tolerations:
- key: "app.kubernetes.io/component"
operator: "Equal"
value: "{{ .Values.agent.componentName }}"
effect: "NoSchedule"
additionalAgents:
maven:
podName: maven
customJenkinsLabels: maven
# An example of overriding the jnlp container
# sideContainerName: jnlp
image: jenkins/jnlp-agent-maven
tag: latest
python:
podName: python
customJenkinsLabels: python
sideContainerName: python
image: python
tag: "3"
command: "/bin/sh -c"
args: "cat"
TTYEnabled: true
podTemplates:
python: |
- name: python
label: jenkins-python
containers:
- name: python
image: python:3
command: "/bin/sh -c"
args: "cat"
ttyEnabled: true
privileged: true
resourceRequestCpu: "400m"
resourceRequestMemory: "512Mi"
resourceLimitCpu: "1"
resourceLimitMemory: "1024Mi"
volumes:
- type: EmptyDir
mountPath: /var/myapp/myemptydir
memory: false
serviceAccount:
annotations:
description: "Used by release {{ .Release.Name }} for role-based access control"
serviceAccountAgent:
create: true
annotations:
description: "Used by release {{ .Release.Name }} for role-based access control"
helm-templates/jenkins/ci/with-secrets-values.yaml
-4
View File
@@ -1,4 +0,0 @@
controller:
additionalSecrets:
- name: nameOfSecret
value: secretText
helm-templates/jenkins/templates/NOTES.txt
-68
View File
@@ -1,68 +0,0 @@
{{- $prefix := .Values.controller.jenkinsUriPrefix | default "" -}}
{{- $url := "" -}}
1. Get your '{{ .Values.controller.adminUser }}' user password by running:
kubectl exec --namespace {{ template "jenkins.namespace" . }} -it svc/{{ template "jenkins.fullname" . }} -c jenkins -- /bin/cat /run/secrets/additional/chart-admin-password && echo
{{- if .Values.controller.ingress.hostName -}}
{{- if .Values.controller.ingress.tls -}}
{{- $url = print "https://" .Values.controller.ingress.hostName $prefix -}}
{{- else -}}
{{- $url = print "http://" .Values.controller.ingress.hostName $prefix -}}
{{- end }}
2. Visit {{ $url }}
{{- else }}
2. Get the Jenkins URL to visit by running these commands in the same shell:
{{- if contains "NodePort" .Values.controller.serviceType }}
export NODE_PORT=$(kubectl get --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "jenkins.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ template "jenkins.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://$NODE_IP:$NODE_PORT" $prefix -}}
{{- else -}}
{{- $url = print "http://$NODE_IP:$NODE_PORT" $prefix -}}
{{- end }}
echo {{ $url }}
{{- else if contains "LoadBalancer" .Values.controller.serviceType }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get svc --namespace {{ template "jenkins.namespace" . }} -w {{ template "jenkins.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ template "jenkins.namespace" . }} {{ template "jenkins.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://$SERVICE_IP:" .Values.controller.servicePort $prefix -}}
{{- else -}}
{{- $url = print "http://$SERVICE_IP:" .Values.controller.servicePort $prefix -}}
{{- end }}
echo {{ $url }}
{{- else if contains "ClusterIP" .Values.controller.serviceType -}}
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- $url = print "https://127.0.0.1:" .Values.controller.servicePort $prefix -}}
{{- else -}}
{{- $url = print "http://127.0.0.1:" .Values.controller.servicePort $prefix -}}
{{- end }}
echo {{ $url }}
kubectl --namespace {{ template "jenkins.namespace" . }} port-forward svc/{{template "jenkins.fullname" . }} {{ .Values.controller.servicePort }}:{{ .Values.controller.servicePort }}
{{- end }}
{{- end }}
3. Login with the password from step 1 and the username: {{ .Values.controller.adminUser }}
4. Configure security realm and authorization strategy
5. Use Jenkins Configuration as Code by specifying configScripts in your values.yaml file, see documentation: {{ $url }}/configuration-as-code and examples: https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos
For more information on running Jenkins on Kubernetes, visit:
https://cloud.google.com/solutions/jenkins-on-container-engine
For more information about Jenkins Configuration as Code, visit:
https://jenkins.io/projects/jcasc/
{{ if (eq .Values.controller.image "jenkins/jenkins") }}
NOTE: Consider using a custom image with pre-installed plugins
{{- else if .Values.controller.installPlugins }}
NOTE: Consider disabling `installPlugins` if your image already contains plugins.
{{- end }}
{{- if .Values.persistence.enabled }}
{{- else }}
#################################################################################
###### WARNING: Persistence is disabled!!! You will lose your data when #####
###### the Jenkins pod is terminated. #####
#################################################################################
{{- end }}
helm-templates/jenkins/templates/_helpers.tpl
-554
View File
@@ -1,554 +0,0 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "jenkins.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Expand the label of the chart.
*/}}
{{- define "jenkins.label" -}}
{{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
*/}}
{{- define "jenkins.namespace" -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.agent.namespace" -}}
{{- if .Values.agent.namespace -}}
{{- tpl .Values.agent.namespace . -}}
{{- else -}}
{{- if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else -}}
{{- .Release.Namespace -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "jenkins.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Returns the admin password
https://github.com/helm/charts/issues/5167#issuecomment-619137759
*/}}
{{- define "jenkins.password" -}}
{{ if .Values.controller.adminPassword -}}
{{- .Values.controller.adminPassword | b64enc | quote }}
{{- else -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (include "jenkins.fullname" .)).data -}}
{{- if $secret -}}
{{/*
Reusing current password since secret exists
*/}}
{{- index $secret ( .Values.controller.admin.passwordKey | default "jenkins-admin-password" ) -}}
{{- else -}}
{{/*
Generate new password
*/}}
{{- randAlphaNum 22 | b64enc | quote }}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Returns the Jenkins URL
*/}}
{{- define "jenkins.url" -}}
{{- if .Values.controller.jenkinsUrl }}
{{- .Values.controller.jenkinsUrl }}
{{- else }}
{{- if .Values.controller.ingress.hostName }}
{{- if .Values.controller.ingress.tls }}
{{- default "https" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- else }}
{{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ tpl .Values.controller.ingress.hostName $ }}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- end }}
{{- else }}
{{- default "http" .Values.controller.jenkinsUrlProtocol }}://{{ template "jenkins.fullname" . }}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}
{{- end}}
{{- end}}
{{- end -}}
{{/*
Returns configuration as code default config
*/}}
{{- define "jenkins.casc.defaults" -}}
jenkins:
{{- $configScripts := toYaml .Values.controller.JCasC.configScripts }}
{{- if and (.Values.controller.JCasC.authorizationStrategy) (not (contains "authorizationStrategy:" $configScripts)) }}
authorizationStrategy:
{{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 4 }}
{{- end }}
{{- if and (.Values.controller.JCasC.securityRealm) (not (contains "securityRealm:" $configScripts)) }}
securityRealm:
{{- tpl .Values.controller.JCasC.securityRealm . | nindent 4 }}
{{- end }}
disableRememberMe: {{ .Values.controller.disableRememberMe }}
{{- if .Values.controller.legacyRemotingSecurityEnabled }}
remotingSecurity:
enabled: true
{{- end }}
mode: {{ .Values.controller.executorMode }}
numExecutors: {{ .Values.controller.numExecutors }}
{{- if not (kindIs "invalid" .Values.controller.customJenkinsLabels) }}
labelString: "{{ join " " .Values.controller.customJenkinsLabels }}"
{{- end }}
{{- if .Values.controller.projectNamingStrategy }}
{{- if kindIs "string" .Values.controller.projectNamingStrategy }}
projectNamingStrategy: "{{ .Values.controller.projectNamingStrategy }}"
{{- else }}
projectNamingStrategy:
{{- toYaml .Values.controller.projectNamingStrategy | nindent 4 }}
{{- end }}
{{- end }}
markupFormatter:
{{- if .Values.controller.enableRawHtmlMarkupFormatter }}
rawHtml:
disableSyntaxHighlighting: true
{{- else }}
{{- toYaml .Values.controller.markupFormatter | nindent 4 }}
{{- end }}
clouds:
- kubernetes:
containerCapStr: "{{ .Values.agent.containerCap }}"
{{- if .Values.agent.jnlpregistry }}
jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
{{- end }}
defaultsProviderTemplate: "{{ .Values.agent.defaultsProviderTemplate }}"
connectTimeout: "{{ .Values.agent.kubernetesConnectTimeout }}"
readTimeout: "{{ .Values.agent.kubernetesReadTimeout }}"
{{- if .Values.agent.directConnection }}
directConnection: true
{{- else }}
{{- if .Values.agent.jenkinsUrl }}
jenkinsUrl: "{{ tpl .Values.agent.jenkinsUrl . }}"
{{- else }}
jenkinsUrl: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- if not .Values.agent.websocket }}
{{- if .Values.agent.jenkinsTunnel }}
jenkinsTunnel: "{{ tpl .Values.agent.jenkinsTunnel . }}"
{{- else }}
jenkinsTunnel: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}"
{{- end }}
{{- else }}
webSocket: true
{{- end }}
{{- end }}
maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
name: "{{ .Values.controller.cloudName }}"
namespace: "{{ template "jenkins.agent.namespace" . }}"
serverUrl: "{{ .Values.kubernetesURL }}"
{{- if .Values.agent.enabled }}
podLabels:
- key: "jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}"
value: "true"
{{- range $key, $val := .Values.agent.podLabels }}
- key: {{ $key | quote }}
value: {{ $val | quote }}
{{- end }}
templates:
{{- if not .Values.agent.disableDefaultAgent }}
{{- include "jenkins.casc.podTemplate" . | nindent 8 }}
{{- end }}
{{- if .Values.additionalAgents }}
{{- /* save .Values.agent */}}
{{- $agent := .Values.agent }}
{{- range $name, $additionalAgent := .Values.additionalAgents }}
{{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }}
{{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
{{- $additionalAgent := merge $additionalAgent $agent }}
{{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
{{- if $additionalContainersEmpty }}
{{- $_ := set $additionalAgent "additionalContainers" list }}
{{- end }}
{{- /* set .Values.agent to $additionalAgent */}}
{{- $_ := set $.Values "agent" $additionalAgent }}
{{- include "jenkins.casc.podTemplate" $ | nindent 8 }}
{{- end }}
{{- /* restore .Values.agent */}}
{{- $_ := set .Values "agent" $agent }}
{{- end }}
{{- if .Values.agent.podTemplates }}
{{- range $key, $val := .Values.agent.podTemplates }}
{{- tpl $val $ | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }}
crumbIssuer:
standard:
excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }}
{{- end }}
{{- include "jenkins.casc.security" . }}
{{- if .Values.controller.scriptApproval }}
scriptApproval:
approvedSignatures:
{{- range $key, $val := .Values.controller.scriptApproval }}
- "{{ $val }}"
{{- end }}
{{- end }}
unclassified:
location:
adminAddress: {{ default "" .Values.controller.jenkinsAdminEmail }}
url: {{ template "jenkins.url" . }}
{{- end -}}
{{/*
Returns a name template to be used for jcasc configmaps, using
suffix passed in at call as index 0
*/}}
{{- define "jenkins.casc.configName" -}}
{{- $name := index . 0 -}}
{{- $root := index . 1 -}}
"{{- include "jenkins.fullname" $root -}}-jenkins-{{ $name }}"
{{- end -}}
{{/*
Returns kubernetes pod template configuration as code
*/}}
{{- define "jenkins.casc.podTemplate" -}}
- name: "{{ .Values.agent.podName }}"
namespace: "{{ template "jenkins.agent.namespace" . }}"
{{- if .Values.agent.annotations }}
annotations:
{{- range $key, $value := .Values.agent.annotations }}
- key: {{ $key }}
value: {{ $value | quote }}
{{- end }}
{{- end }}
id: {{ sha256sum (toYaml .Values.agent) }}
containers:
- name: "{{ .Values.agent.sideContainerName }}"
alwaysPullImage: {{ .Values.agent.alwaysPullImage }}
args: "{{ .Values.agent.args | replace "$" "^$" }}"
command: {{ .Values.agent.command }}
envVars:
- envVar:
{{- if .Values.agent.directConnection }}
key: "JENKINS_DIRECT_CONNECTION"
{{- if .Values.agent.jenkinsTunnel }}
value: "{{ tpl .Values.agent.jenkinsTunnel . }}"
{{- else }}
value: "{{ template "jenkins.fullname" . }}-agent.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{ .Values.controller.agentListenerPort }}"
{{- end }}
{{- else }}
key: "JENKINS_URL"
{{- if .Values.agent.jenkinsUrl }}
value: {{ tpl .Values.agent.jenkinsUrl . }}
{{- else }}
value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- end }}
image: "{{ .Values.agent.image }}:{{ .Values.agent.tag }}"
{{- if .Values.agent.livenessProbe }}
livenessProbe:
execArgs: {{.Values.agent.livenessProbe.execArgs | quote}}
failureThreshold: {{.Values.agent.livenessProbe.failureThreshold}}
initialDelaySeconds: {{.Values.agent.livenessProbe.initialDelaySeconds}}
periodSeconds: {{.Values.agent.livenessProbe.periodSeconds}}
successThreshold: {{.Values.agent.livenessProbe.successThreshold}}
timeoutSeconds: {{.Values.agent.livenessProbe.timeoutSeconds}}
{{- end }}
privileged: "{{- if .Values.agent.privileged }}true{{- else }}false{{- end }}"
resourceLimitCpu: {{.Values.agent.resources.limits.cpu}}
resourceLimitMemory: {{.Values.agent.resources.limits.memory}}
{{- if .Values.agent.resources.limits.ephemeralStorage }}
resourceLimitEphemeralStorage: {{.Values.agent.resources.limits.ephemeralStorage}}
{{- end }}
resourceRequestCpu: {{.Values.agent.resources.requests.cpu}}
resourceRequestMemory: {{.Values.agent.resources.requests.memory}}
{{- if .Values.agent.resources.requests.ephemeralStorage }}
resourceRequestEphemeralStorage: {{.Values.agent.resources.requests.ephemeralStorage}}
{{- end }}
runAsUser: {{ .Values.agent.runAsUser }}
runAsGroup: {{ .Values.agent.runAsGroup }}
ttyEnabled: {{ .Values.agent.TTYEnabled }}
workingDir: {{ .Values.agent.workingDir }}
{{- range $additionalContainers := .Values.agent.additionalContainers }}
- name: "{{ $additionalContainers.sideContainerName }}"
alwaysPullImage: {{ $additionalContainers.alwaysPullImage | default $.Values.agent.alwaysPullImage }}
args: "{{ $additionalContainers.args | replace "$" "^$" }}"
command: {{ $additionalContainers.command }}
envVars:
- envVar:
key: "JENKINS_URL"
{{- if $additionalContainers.jenkinsUrl }}
value: {{ tpl ($additionalContainers.jenkinsUrl) . }}
{{- else }}
value: "http://{{ template "jenkins.fullname" $ }}.{{ template "jenkins.namespace" $ }}.svc.{{ $.Values.clusterZone }}:{{ $.Values.controller.servicePort }}{{ default "/" $.Values.controller.jenkinsUriPrefix }}"
{{- end }}
image: "{{ $additionalContainers.image }}:{{ $additionalContainers.tag }}"
{{- if $additionalContainers.livenessProbe }}
livenessProbe:
execArgs: {{$additionalContainers.livenessProbe.execArgs | quote}}
failureThreshold: {{$additionalContainers.livenessProbe.failureThreshold}}
initialDelaySeconds: {{$additionalContainers.livenessProbe.initialDelaySeconds}}
periodSeconds: {{$additionalContainers.livenessProbe.periodSeconds}}
successThreshold: {{$additionalContainers.livenessProbe.successThreshold}}
timeoutSeconds: {{$additionalContainers.livenessProbe.timeoutSeconds}}
{{- end }}
privileged: "{{- if $additionalContainers.privileged }}true{{- else }}false{{- end }}"
resourceLimitCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.cpu }}{{ else }}{{ $.Values.agent.resources.limits.cpu }}{{ end }}
resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }}
resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }}
resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }}
runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }}
runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }}
ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }}
workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }}
{{- end }}
{{- if or .Values.agent.envVars .Values.agent.secretEnvVars }}
envVars:
{{- range $index, $var := .Values.agent.envVars }}
- envVar:
key: {{ $var.name }}
value: {{ tpl $var.value $ }}
{{- end }}
{{- range $index, $var := .Values.agent.secretEnvVars }}
- secretEnvVar:
key: {{ $var.key }}
secretName: {{ $var.secretName }}
secretKey: {{ $var.secretKey }}
optional: {{ $var.optional | default false }}
{{- end }}
{{- end }}
idleMinutes: {{ .Values.agent.idleMinutes }}
instanceCap: 2147483647
{{- if .Values.agent.hostNetworking }}
hostNetwork: {{ .Values.agent.hostNetworking }}
{{- end }}
{{- if .Values.agent.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.agent.imagePullSecretName }}
{{- end }}
label: "{{ .Release.Name }}-{{ .Values.agent.componentName }} {{ .Values.agent.customJenkinsLabels | join " " }}"
{{- if .Values.agent.nodeSelector }}
nodeSelector:
{{- $local := dict "first" true }}
{{- range $key, $value := .Values.agent.nodeSelector }}
{{- if $local.first }} {{ else }},{{ end }}
{{- $key }}={{ tpl $value $ }}
{{- $_ := set $local "first" false }}
{{- end }}
{{- end }}
nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }}
podRetention: {{ .Values.agent.podRetention }}
showRawYaml: {{ .Values.agent.showRawYaml }}
serviceAccount: "{{ include "jenkins.serviceAccountAgentName" . }}"
slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}"
{{- if .Values.agent.volumes }}
volumes:
{{- range $index, $volume := .Values.agent.volumes }}
-{{- if (eq $volume.type "ConfigMap") }} configMapVolume:
{{- else if (eq $volume.type "EmptyDir") }} emptyDirVolume:
{{- else if (eq $volume.type "HostPath") }} hostPathVolume:
{{- else if (eq $volume.type "Nfs") }} nfsVolume:
{{- else if (eq $volume.type "PVC") }} persistentVolumeClaim:
{{- else if (eq $volume.type "Secret") }} secretVolume:
{{- else }} {{ $volume.type }}:
{{- end }}
{{- range $key, $value := $volume }}
{{- if not (eq $key "type") }}
{{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.agent.workspaceVolume }}
workspaceVolume:
{{- if (eq .Values.agent.workspaceVolume.type "DynamicPVC") }}
dynamicPVC:
{{- else if (eq .Values.agent.workspaceVolume.type "EmptyDir") }}
emptyDirWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "HostPath") }}
hostPathWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "Nfs") }}
nfsWorkspaceVolume:
{{- else if (eq .Values.agent.workspaceVolume.type "PVC") }}
persistentVolumeClaimWorkspaceVolume:
{{- else }}
{{ .Values.agent.workspaceVolume.type }}:
{{- end }}
{{- range $key, $value := .Values.agent.workspaceVolume }}
{{- if not (eq $key "type") }}
{{ $key }}: {{ if kindIs "string" $value }}{{ tpl $value $ | quote }}{{ else }}{{ $value }}{{ end }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.agent.yamlTemplate }}
yaml: |-
{{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }}
{{- end }}
yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }}
{{- end -}}
{{- define "jenkins.kubernetes-version" -}}
{{- if .Values.controller.installPlugins -}}
{{- range .Values.controller.installPlugins -}}
{{ if hasPrefix "kubernetes:" . }}
{{- $split := splitList ":" . }}
{{- printf "%s" (index $split 1 ) -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.casc.security" }}
security:
{{- with .Values.controller.JCasC }}
{{- if .security }}
{{- .security | toYaml | nindent 2 }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "jenkins.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "jenkins.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account for Jenkins agents to use
*/}}
{{- define "jenkins.serviceAccountAgentName" -}}
{{- if .Values.serviceAccountAgent.create -}}
{{ default (printf "%s-%s" (include "jenkins.fullname" .) "agent") .Values.serviceAccountAgent.name }}
{{- else -}}
{{ default "default" .Values.serviceAccountAgent.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account for Jenkins backup to use
*/}}
{{- define "backup.serviceAccountBackupName" -}}
{{- if .Values.backup.serviceAccount.create -}}
{{ default (printf "%s-%s" (include "jenkins.fullname" .) "backup") .Values.backup.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.backup.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Create a full tag name for controller image
*/}}
{{- define "controller.tag" -}}
{{- if .Values.controller.tagLabel -}}
{{- default (printf "%s-%s" .Chart.AppVersion .Values.controller.tagLabel) .Values.controller.tag -}}
{{- else -}}
{{- default .Chart.AppVersion .Values.controller.tag -}}
{{- end -}}
{{- end -}}
{{/*
Create the HTTP port for interacting with the controller
*/}}
{{- define "controller.httpPort" -}}
{{- if .Values.controller.httpsKeyStore.enable -}}
{{- .Values.controller.httpsKeyStore.httpPort -}}
{{- else -}}
{{- .Values.controller.targetPort -}}
{{- end -}}
{{- end -}}
{{- define "jenkins.configReloadContainer" -}}
{{- $root := index . 0 -}}
{{- $containerName := index . 1 -}}
{{- $containerType := index . 2 -}}
- name: {{ $containerName }}
image: "{{ $root.Values.controller.sidecars.configAutoReload.image }}"
imagePullPolicy: {{ $root.Values.controller.sidecars.configAutoReload.imagePullPolicy }}
{{- if $root.Values.controller.sidecars.configAutoReload.containerSecurityContext }}
securityContext: {{- toYaml $root.Values.controller.sidecars.configAutoReload.containerSecurityContext | nindent 4 }}
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.envFrom }}
envFrom:
{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.envFrom) $root) | indent 4 }}
{{- end }}
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: LABEL
value: "{{ template "jenkins.fullname" $root }}-jenkins-config"
- name: FOLDER
value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}"
- name: NAMESPACE
value: '{{ $root.Values.controller.sidecars.configAutoReload.searchNamespace | default (include "jenkins.namespace" $root) }}'
{{- if eq $containerType "init" }}
- name: METHOD
value: "LIST"
{{- else if $root.Values.controller.sidecars.configAutoReload.sleepTime }}
- name: METHOD
value: "SLEEP"
- name: SLEEP_TIME
value: "{{ $root.Values.controller.sidecars.configAutoReload.sleepTime }}"
{{- end }}
{{- if eq $containerType "sidecar" }}
- name: REQ_URL
value: "http://localhost:{{- include "controller.httpPort" $root -}}{{- $root.Values.controller.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)"
- name: REQ_METHOD
value: "POST"
- name: REQ_RETRY_CONNECT
value: "{{ $root.Values.controller.sidecars.configAutoReload.reqRetryConnect }}"
{{- end }}
{{- if $root.Values.controller.sidecars.configAutoReload.env }}
{{- range $envVarItem := $root.Values.controller.sidecars.configAutoReload.env -}}
{{- if or (ne $containerType "init") (ne .name "METHOD") }}
{{- (tpl (toYaml (list $envVarItem)) $root) | nindent 4 }}
{{- end -}}
{{- end -}}
{{- end }}
resources:
{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }}
volumeMounts:
- name: sc-config-volume
mountPath: {{ $root.Values.controller.sidecars.configAutoReload.folder | quote }}
- name: jenkins-home
mountPath: {{ $root.Values.controller.jenkinsHome }}
{{- if $root.Values.persistence.subPath }}
subPath: {{ $root.Values.persistence.subPath }}
{{- end }}
{{- end -}}
helm-templates/jenkins/templates/config-init-scripts.yaml
-18
View File
@@ -1,18 +0,0 @@
{{- if .Values.controller.initScripts -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}-init-scripts
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
data:
{{- range $key, $val := .Values.controller.initScripts }}
init{{ $key }}.groovy: |-
{{ tpl $val $ | indent 4 }}
{{- end }}
{{- end }}
helm-templates/jenkins/templates/config.yaml
-86
View File
@@ -1,86 +0,0 @@
{{- $jenkinsHome := .Values.controller.jenkinsHome -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
data:
apply_config.sh: |-
set -e
{{- if .Values.controller.initializeOnce }}
if [ -f {{ .Values.controller.jenkinsHome }}/initialization-completed ]; then
echo "controller was previously initialized, refusing to re-initialize"
exit 0
fi
{{- end }}
echo "disable Setup Wizard"
# Prevent Setup Wizard when JCasC is enabled
echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.UpgradeWizard.state
echo $JENKINS_VERSION > {{ .Values.controller.jenkinsHome }}/jenkins.install.InstallUtil.lastExecVersion
{{- if .Values.controller.overwritePlugins }}
echo "remove all plugins from shared volume"
# remove all plugins from shared volume
rm -rf {{ .Values.controller.jenkinsHome }}/plugins/*
{{- end }}
{{- if .Values.controller.installPlugins }}
echo "download plugins"
# Install missing plugins
cp /var/jenkins_config/plugins.txt {{ .Values.controller.jenkinsHome }};
rm -rf {{ .Values.controller.jenkinsRef }}/plugins/*.lock
version () { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
if [ -f "{{ .Values.controller.jenkinsWar }}" ] && [ -n "$(command -v jenkins-plugin-cli)" 2>/dev/null ] && [ $(version $(jenkins-plugin-cli --version)) -ge $(version "2.1.1") ]; then
jenkins-plugin-cli --verbose --war "{{ .Values.controller.jenkinsWar }}" --plugin-file "{{ .Values.controller.jenkinsHome }}/plugins.txt" --latest {{ .Values.controller.installLatestPlugins }}{{- if .Values.controller.installLatestSpecifiedPlugins }} --latest-specified{{- end }};
else
/usr/local/bin/install-plugins.sh `echo $(cat {{ .Values.controller.jenkinsHome }}/plugins.txt)`;
fi
echo "copy plugins to shared volume"
# Copy plugins to shared volume
yes n | cp -i {{ .Values.controller.jenkinsRef }}/plugins/* /var/jenkins_plugins/;
{{- end }}
{{- if not .Values.controller.sidecars.configAutoReload.enabled }}
echo "copy configuration as code files"
mkdir -p {{ .Values.controller.jenkinsHome }}/casc_configs;
rm -rf {{ .Values.controller.jenkinsHome }}/casc_configs/*
{{- if or .Values.controller.JCasC.defaultConfig .Values.controller.JCasC.configScripts }}
cp -v /var/jenkins_config/*.yaml {{ .Values.controller.jenkinsHome }}/casc_configs
{{- end }}
{{- end }}
echo "finished initialization"
{{- if .Values.controller.initializeOnce }}
touch {{ .Values.controller.jenkinsHome }}/initialization-completed
{{- end }}
{{- if not .Values.controller.sidecars.configAutoReload.enabled }}
# Only add config to this script if we aren't auto-reloading otherwise the pod will restart upon each config change:
{{- if .Values.controller.JCasC.defaultConfig }}
jcasc-default-config.yaml: |-
{{- include "jenkins.casc.defaults" . |nindent 4}}
{{- end }}
{{- range $key, $val := .Values.controller.JCasC.configScripts }}
{{ $key }}.yaml: |-
{{ tpl $val $| indent 4 }}
{{- end }}
{{- end }}
plugins.txt: |-
{{- if .Values.controller.installPlugins }}
{{- range $installPlugin := .Values.controller.installPlugins }}
{{- $installPlugin | nindent 4 }}
{{- end }}
{{- range $addlPlugin := .Values.controller.additionalPlugins }}
{{- /* duplicate plugin check */}}
{{- range $installPlugin := $.Values.controller.installPlugins }}
{{- if eq (splitList ":" $addlPlugin | first) (splitList ":" $installPlugin | first) }}
{{- $message := print "[PLUGIN CONFLICT] controller.additionalPlugins contains '" $addlPlugin "'" }}
{{- $message := print $message " but controller.installPlugins already contains '" $installPlugin "'." }}
{{- $message := print $message " Override controller.installPlugins to use '" $addlPlugin "' plugin." }}
{{- fail $message }}
{{- end }}
{{- end }}
{{- $addlPlugin | nindent 4 }}
{{- end }}
{{- end }}
helm-templates/jenkins/templates/deprecation.yaml
-115
View File
@@ -1,115 +0,0 @@
{{- if .Values.checkDeprecation }}
{{- if .Values.master }}
{{ fail "`master` does no longer exist. It has been renamed to `controller`" }}
{{- end }}
{{- if .Values.controller.imageTag }}
{{ fail "`controller.imageTag` does no longer exist. Please use `controller.tag` instead" }}
{{- end }}
{{- if .Values.controller.slaveListenerPort }}
{{ fail "`controller.slaveListenerPort` does no longer exist. It has been renamed to `controller.agentListenerPort`" }}
{{- end }}
{{- if .Values.controller.slaveHostPort }}
{{ fail "`controller.slaveHostPort` does no longer exist. It has been renamed to `controller.agentListenerHostPort`" }}
{{- end }}
{{- if .Values.controller.slaveKubernetesNamespace }}
{{ fail "`controller.slaveKubernetesNamespace` does no longer exist. It has been renamed to `agent.namespace`" }}
{{- end }}
{{- if .Values.controller.slaveDefaultsProviderTemplate }}
{{ fail "`controller.slaveDefaultsProviderTemplate` does no longer exist. It has been renamed to `agent.defaultsProviderTemplate`" }}
{{- end }}
{{- if .Values.controller.useSecurity }}
{{ fail "`controller.useSecurity` does no longer exist. It has been renamed to `controller.adminSecret`" }}
{{- end }}
{{- if .Values.controller.slaveJenkinsUrl }}
{{ fail "`controller.slaveJenkinsUrl` does no longer exist. It has been renamed to `agent.jenkinsUrl`" }}
{{- end }}
{{- if .Values.controller.slaveJenkinsTunnel }}
{{ fail "`controller.slaveJenkinsTunnel` does no longer exist. It has been renamed to `agent.jenkinsTunnel`" }}
{{- end }}
{{- if .Values.controller.slaveConnectTimeout }}
{{ fail "`controller.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.kubernetesConnectTimeout`" }}
{{- end }}
{{- if .Values.controller.slaveReadTimeout }}
{{ fail "`controller.slaveReadTimeout` does no longer exist. It has been renamed to `agent.kubernetesReadTimeout`" }}
{{- end }}
{{- if .Values.controller.slaveListenerServiceType }}
{{ fail "`controller.slaveListenerServiceType` does no longer exist. It has been renamed to `controller.agentListenerServiceType`" }}
{{- end }}
{{- if .Values.controller.slaveListenerLoadBalancerIP }}
{{ fail "`controller.slaveListenerLoadBalancerIP` does no longer exist. It has been renamed to `controller.agentListenerLoadBalancerIP`" }}
{{- end }}
{{- if .Values.controller.slaveListenerServiceAnnotations }}
{{ fail "`controller.slaveListenerServiceAnnotations` does no longer exist. It has been renamed to `controller.agentListenerServiceAnnotations`" }}
{{- end }}
{{- if .Values.agent.slaveConnectTimeout }}
{{ fail "`agent.slaveConnectTimeout` does no longer exist. It has been renamed to `agent.connectTimeout`" }}
{{- end }}
{{- if .Values.NetworkPolicy }}
{{- if .Values.NetworkPolicy.Enabled }}
{{ fail "`NetworkPolicy.Enabled` does no longer exist. It has been renamed to `networkPolicy.enabled`" }}
{{- end }}
{{- if .Values.NetworkPolicy.ApiVersion }}
{{ fail "`NetworkPolicy.ApiVersion` does no longer exist. It has been renamed to `networkPolicy.apiVersion`" }}
{{- end }}
{{ fail "NetworkPolicy.* values have been renamed, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.install }}
{{ fail "`rbac.install` does no longer exist. It has been renamed to `rbac.create` and is enabled by default!" }}
{{- end }}
{{- if .Values.rbac.serviceAccountName }}
{{ fail "`rbac.serviceAccountName` does no longer exist. It has been renamed to `serviceAccount.name`" }}
{{- end }}
{{- if .Values.rbac.serviceAccountAnnotations }}
{{ fail "`rbac.serviceAccountAnnotations` does no longer exist. It has been renamed to `serviceAccount.annotations`" }}
{{- end }}
{{- if .Values.rbac.roleRef }}
{{ fail "`rbac.roleRef` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.roleKind }}
{{ fail "`rbac.roleKind` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.rbac.roleBindingKind }}
{{ fail "`rbac.roleBindingKind` does no longer exist. RBAC roles are now generated, please check the documentation" }}
{{- end }}
{{- if .Values.controller.JCasC.pluginVersion }}
{{ fail "controller.JCasC.pluginVersion has been deprecated, please use controller.installPlugins instead" }}
{{- end }}
{{- if .Values.controller.deploymentLabels }}
{{ fail "`controller.deploymentLabels` does no longer exist. It has been renamed to `controller.statefulSetLabels`" }}
{{- end }}
{{- if .Values.controller.deploymentAnnotations }}
{{ fail "`controller.deploymentAnnotations` does no longer exist. It has been renamed to `controller.statefulSetAnnotations`" }}
{{- end }}
{{- if .Values.controller.rollingUpdate }}
{{ fail "`controller.rollingUpdate` does no longer exist. It is no longer relevant, since a StatefulSet is used for the Jenkins controller" }}
{{- end }}
{{- end }}
helm-templates/jenkins/templates/home-pvc.yaml
-44
View File
@@ -1,44 +0,0 @@
{{- if not (contains "jenkins-home" (quote .Values.persistence.volumes)) }}
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
{{- if .Values.persistence.annotations }}
annotations:
{{ toYaml .Values.persistence.annotations | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}-tmp
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.persistence.labels }}
{{ toYaml .Values.persistence.labels | indent 4 }}
{{- end }}
spec:
{{- if .Values.persistence.dataSource }}
dataSource:
{{ toYaml .Values.persistence.dataSource | indent 4 }}
{{- end }}
accessModes:
- {{ .Values.persistence.accessMode | quote }}
resources:
requests:
storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
storageClassName: ""
{{- else }}
storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- if .Values.persistence.volumeName }}
volumeName: "{{ .Values.persistence.volumeName }}"
{{- end }}
{{- end }}
{{- end }}
{{- end }}
helm-templates/jenkins/templates/jcasc-config.yaml
-45
View File
@@ -1,45 +0,0 @@
{{- $root := . }}
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
{{- range $key, $val := .Values.controller.JCasC.configScripts }}
{{- if $val }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
"app.kubernetes.io/name": {{ template "jenkins.name" $root}}
{{- if $root.Values.renderHelmLabels }}
"helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
data:
{{ $key }}.yaml: |-
{{ tpl $val $| indent 4 }}
{{- end }}
{{- end }}
{{- if .Values.controller.JCasC.defaultConfig }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
"app.kubernetes.io/name": {{ template "jenkins.name" $root}}
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
data:
jcasc-default-config.yaml: |-
{{- include "jenkins.casc.defaults" . |nindent 4 }}
{{- end}}
{{- end }}
helm-templates/jenkins/templates/jenkins-agent-svc.yaml
-43
View File
@@ -1,43 +0,0 @@
{{- if .Values.controller.agentListenerEnabled }}
apiVersion: v1
kind: Service
metadata:
name: {{ template "jenkins.fullname" . }}-agent
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.agentListenerServiceAnnotations }}
annotations:
{{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }}
{{- end }}
spec:
{{- if .Values.controller.agentListenerExternalTrafficPolicy }}
externalTrafficPolicy: {{.Values.controller.agentListenerExternalTrafficPolicy}}
{{- end }}
ports:
- port: {{ .Values.controller.agentListenerPort }}
targetPort: {{ .Values.controller.agentListenerPort }}
{{- if (and (eq .Values.controller.agentListenerServiceType "NodePort") (not (empty .Values.controller.agentListenerNodePort))) }}
nodePort: {{ .Values.controller.agentListenerNodePort }}
{{- end }}
name: agent-listener
selector:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
type: {{ .Values.controller.agentListenerServiceType }}
{{if eq .Values.controller.agentListenerServiceType "LoadBalancer"}}
{{- if .Values.controller.agentListenerLoadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.agentListenerLoadBalancerSourceRanges | indent 4 }}
{{- end }}
{{- end }}
{{- if and (eq .Values.controller.agentListenerServiceType "LoadBalancer") (.Values.controller.agentListenerLoadBalancerIP) }}
loadBalancerIP: {{ .Values.controller.agentListenerLoadBalancerIP }}
{{- end }}
{{- end }}
helm-templates/jenkins/templates/jenkins-aws-security-group-policies.yaml
-16
View File
@@ -1,16 +0,0 @@
{{- if .Values.awsSecurityGroupPolicies.enabled -}}
{{- range .Values.awsSecurityGroupPolicies.policies -}}
apiVersion: vpcresources.k8s.aws/v1beta1
kind: SecurityGroupPolicy
metadata:
name: {{ .name }}
namespace: {{ template "jenkins.namespace" $ }}
spec:
podSelector:
{{- toYaml .podSelector | nindent 6}}
securityGroups:
groupIds:
{{- toYaml .securityGroupIds | nindent 6}}
---
{{- end -}}
{{- end -}}
helm-templates/jenkins/templates/jenkins-backup-cronjob.yaml
-168
View File
@@ -1,168 +0,0 @@
{{- if .Values.backup.enabled }}
apiVersion: {{ .Values.cronJob.apiVersion }}
kind: CronJob
metadata:
name: {{ template "jenkins.fullname" . }}-backup
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.backup.componentName }}"
spec:
schedule: {{ .Values.backup.schedule | quote }}
concurrencyPolicy: Forbid
startingDeadlineSeconds: 120
jobTemplate:
spec:
{{- if .Values.backup.activeDeadlineSeconds }}
activeDeadlineSeconds: {{ .Values.backup.activeDeadlineSeconds }}
{{- end }}
template:
metadata:
{{- if .Values.backup.labels }}
labels:
{{- toYaml .Values.backup.labels | trim | nindent 12 }}
{{- end }}
{{- if .Values.backup.annotations }}
annotations:
{{- toYaml .Values.backup.annotations | trim | nindent 12 }}
{{- end }}
spec:
restartPolicy: OnFailure
serviceAccountName: {{ include "backup.serviceAccountBackupName" . }}
{{- if .Values.backup.usePodSecurityContext }}
securityContext:
{{- if hasKey .Values.backup "podSecurityContextOverride" }}
{{- tpl (toYaml .Values.backup.podSecurityContextOverride | nindent 12) . }}
{{- else }}
runAsUser: {{ default 0 .Values.backup.runAsUser }}
{{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }}
{{- if not (eq (int .Values.backup.runAsUser) 0) }}
fsGroup: {{ .Values.backup.fsGroup }}
{{- end }}
{{- end }}
{{- if .Values.backup.securityContextCapabilities }}
capabilities:
{{- toYaml .Values.backup.securityContextCapabilities | nindent 12 }}
{{- end }}
{{- end }}
{{- end }}
containers:
- name: jenkins-backup
image: "{{ .Values.backup.image.repository }}:{{ .Values.backup.image.tag }}"
command: ["kube-tasks"]
args:
- simple-backup
- -n
- {{ template "jenkins.namespace" . }}
- -l
- app.kubernetes.io/instance={{ .Release.Name }}
- --container
- jenkins
- --path
{{- if .Values.backup.onlyJobs }}
- {{ .Values.controller.jenkinsHome }}/jobs
{{- else}}
- {{ .Values.controller.jenkinsHome }}
{{- end}}
- --dst
- {{ .Values.backup.destination }}
{{- with .Values.backup.extraArgs }}
{{- toYaml . | nindent 12 }}
{{- end }}
env:
{{- with .Values.backup.env }}
{{- toYaml . | trim | nindent 12 }}
{{- end }}
{{- if .Values.backup.existingSecret }}
{{- range $key,$value := .Values.backup.existingSecret }}
{{- if $value.awsaccesskey }}
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: {{ $key }}
key: {{ $value.awsaccesskey | quote }}
{{- end }}
{{- if $value.awssecretkey }}
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: {{ $key }}
key: {{ $value.awssecretkey | quote}}
{{- end }}
{{- if $value.azstorageaccount }}
- name: AZURE_STORAGE_ACCOUNT
valueFrom:
secretKeyRef:
name: {{ $key }}
key: {{ $value.azstorageaccount | quote}}
{{- end }}
{{- if $value.azstoragekey }}
- name: AZURE_STORAGE_ACCESS_KEY
valueFrom:
secretKeyRef:
name: {{ $key }}
key: {{ $value.azstoragekey | quote}}
{{- end }}
{{- if $value.gcpcredentials }}
- name: GOOGLE_APPLICATION_CREDENTIALS
value: "/var/run/secrets/{{ $key }}/{{ $value.gcpcredentials }}"
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.backup.resources }}
resources:
{{- toYaml . | trim | nindent 14 }}
{{- end }}
volumeMounts:
{{- if .Values.backup.existingSecret }}
{{- range $key,$value := .Values.backup.existingSecret }}
{{- if $value.gcpcredentials }}
- mountPath: /var/run/secrets/{{ $key }}
name: {{ $key }}
{{- end }}
{{- end }}
{{- end }}
volumes:
{{- if .Values.backup.existingSecret }}
{{- range $key,$value := .Values.backup.existingSecret }}
{{- if $value.gcpcredentials }}
- name: {{ $key }}
secret:
secretName: {{ $key }}
{{- end }}
{{- end }}
{{- end }}
affinity:
podAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
topologyKey: "kubernetes.io/hostname"
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "jenkins.fullname" . }}
- key: release
operator: In
values:
- {{ .Release.Name }}
{{- with .Values.controller.tolerations }}
tolerations:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .Values.controller.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- if .Values.backup.imagePullSecretName }}
imagePullSecrets:
- name: {{ .Values.backup.imagePullSecretName }}
{{- end -}}
{{- end }}
helm-templates/jenkins/templates/jenkins-backup-rbac.yaml
-64
View File
@@ -1,64 +0,0 @@
{{- if .Values.backup.enabled }}
{{- if .Values.backup.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "backup.serviceAccountBackupName" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.backup.serviceAccount.annotations }}
annotations:
{{- toYaml .Values.backup.serviceAccount.annotations | nindent 4 }}
{{- end }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "jenkins.fullname" . }}-backup
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ template "jenkins.fullname" . }}-backup
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "jenkins.fullname" . }}-backup
subjects:
- kind: ServiceAccount
name: {{ include "backup.serviceAccountBackupName" . }}
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
helm-templates/jenkins/templates/jenkins-controller-alerting-rules.yaml
-26
View File
@@ -1,26 +0,0 @@
{{- if and .Values.controller.prometheus.enabled .Values.controller.prometheus.alertingrules }}
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: {{ template "jenkins.fullname" . }}
{{- if .Values.controller.prometheus.prometheusRuleNamespace }}
namespace: {{ .Values.controller.prometheus.prometheusRuleNamespace }}
{{- else }}
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
spec:
groups:
{{ toYaml .Values.controller.prometheus.alertingrules | indent 2 }}
{{- end }}
helm-templates/jenkins/templates/jenkins-controller-backendconfig.yaml
-24
View File
@@ -1,24 +0,0 @@
{{- if .Values.controller.backendconfig.enabled }}
apiVersion: {{ .Values.controller.backendconfig.apiVersion }}
kind: BackendConfig
metadata:
name: {{ .Values.controller.backendconfig.name }}
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.backendconfig.labels }}
{{ toYaml .Values.controller.backendconfig.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.backendconfig.annotations }}
annotations:
{{ toYaml .Values.controller.backendconfig.annotations | indent 4 }}
{{- end }}
spec:
{{ toYaml .Values.controller.backendconfig.spec | indent 2 }}
{{- end }}
helm-templates/jenkins/templates/jenkins-controller-ingress.yaml
-77
View File
@@ -1,77 +0,0 @@
{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }}
{{- if .Values.controller.ingress.enabled }}
{{- if semverCompare ">=1.19-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" $kubeTargetVersion -}}
apiVersion: networking.k8s.io/v1beta1
{{- else -}}
apiVersion: {{ .Values.controller.ingress.apiVersion }}
{{- end }}
kind: Ingress
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
{{- if .Values.controller.ingress.labels }}
{{ toYaml .Values.controller.ingress.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.ingress.annotations }}
annotations:
{{ toYaml .Values.controller.ingress.annotations | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}
spec:
{{- if .Values.controller.ingress.ingressClassName }}
ingressClassName: {{ .Values.controller.ingress.ingressClassName | quote }}
{{- end }}
rules:
- http:
paths:
{{- if empty (.Values.controller.ingress.paths) }}
- backend:
{{- if semverCompare ">=1.19-0" $kubeTargetVersion }}
service:
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
pathType: ImplementationSpecific
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
{{- end }}
{{- if .Values.controller.ingress.path }}
path: {{ .Values.controller.ingress.path }}
{{- end -}}
{{- else }}
{{ tpl (toYaml .Values.controller.ingress.paths | indent 6) . }}
{{- end -}}
{{- if .Values.controller.ingress.hostName }}
host: {{ tpl .Values.controller.ingress.hostName . | quote }}
{{- end }}
{{- if .Values.controller.ingress.resourceRootUrl }}
- http:
paths:
- backend:
{{- if semverCompare ">=1.19-0" $kubeTargetVersion }}
service:
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
pathType: ImplementationSpecific
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
{{- end }}
host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }}
{{- end }}
{{- if .Values.controller.ingress.tls }}
tls:
{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }}
{{- end -}}
{{- end }}
helm-templates/jenkins/templates/jenkins-controller-networkpolicy.yaml
-76
View File
@@ -1,76 +0,0 @@
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ .Values.networkPolicy.apiVersion }}
metadata:
name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
spec:
podSelector:
matchLabels:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
ingress:
# Allow web access to the UI
- ports:
- port: {{ .Values.controller.targetPort }}
{{- if .Values.controller.agentListenerEnabled }}
# Allow inbound connections from agents
- from:
{{- if .Values.networkPolicy.internalAgents.allowed }}
- podSelector:
matchLabels:
"jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true"
{{- range $k,$v:= .Values.networkPolicy.internalAgents.podLabels }}
{{ $k }}: {{ $v }}
{{- end }}
{{- if .Values.networkPolicy.internalAgents.namespaceLabels }}
namespaceSelector:
matchLabels:
{{- range $k,$v:= .Values.networkPolicy.internalAgents.namespaceLabels }}
{{ $k }}: {{ $v }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.networkPolicy.externalAgents }}
- ipBlock:
cidr: {{ required "ipCIDR is required if you wish to allow external agents to connect to Jenkins Controller." .Values.networkPolicy.externalAgents.ipCIDR }}
{{- if .Values.networkPolicy.externalAgents.except }}
except:
{{- range .Values.networkPolicy.externalAgents.except }}
- {{ . }}
{{- end }}
{{- end }}
{{- end }}
ports:
- port: {{ .Values.controller.agentListenerPort }}
{{- end }}
{{- if .Values.agent.enabled }}
---
kind: NetworkPolicy
apiVersion: {{ .Values.networkPolicy.apiVersion }}
metadata:
name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
{{- if .Values.renderHelmLabels }}
"helm.sh/chart": "{{ template "jenkins.label" .}}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
spec:
podSelector:
matchLabels:
# DefaultDeny
"jenkins/{{ .Release.Name }}-{{ .Values.agent.componentName }}": "true"
{{- end }}
{{- end }}

Some files were not shown because too many files have changed in this diff Show More