Mukul SharmaandClaude Opus 5
f703f0b55a
Each of these now answers on <name>.infra.deployshed.com alongside the nip.io name it already had. Both are kept on purpose: nothing that currently references the old name breaks, and the new one can be proved before anything depends on it. Removing nip.io is a separate step, and a larger one, because Harbor's name is embedded in every running app's image reference. TLS covers the real domain only. Let's Encrypt cannot issue for nip.io — it is not on the public suffix list and every *.nip.io certificate shares one rate limit — so a tls block naming both would request one certificate spanning them and receive nothing for either. Each tls block therefore lists exactly the one new hostname, which is why they are written out rather than derived from the host list beside them. The charts disagree about how to express a second host, so each is done the way its own chart supports: gitea, grafana, vault, victoria-metrics-single take host lists, so the new name joins the existing one on a single Ingress. jenkins' primary ingress accepts exactly one hostName, so the new name goes on secondaryingress — a whole second Ingress object at the same backend. paths must be set explicitly there; left at the chart's default of [] it renders zero routes and the hostname answers nothing. argo-cd takes extraHosts natively, but its ingress.tls is a boolean bound to one fixed secret covering every host at once. Turning it on would request a certificate including nip.io and fail, and there is no extraTls to scope it. So ArgoCD gains the hostname now and its certificate when nip.io goes. Harbor is untouched here. It has no multi-host mechanism at all, so its second hostname needs a standalone Ingress, and its externalURL is what docker clients are handed — both deserve their own change rather than riding along with a hostname tidy-up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
99 lines
3.6 KiB
YAML
99 lines
3.6 KiB
YAML
jenkins:
|
|
# GKE counterpart of helm-overrides/k8s-admin-prd-ase1/jenkins, same chart
|
|
# (5.8.58). Dynamic Kubernetes build agents, so idle cost is the
|
|
# controller alone.
|
|
#
|
|
# Every plugin pin below is carried over deliberately, not copied
|
|
# blindly — each one fixes a failure that is not obvious from its symptom.
|
|
# See the homelab file for the full history.
|
|
|
|
controller:
|
|
image:
|
|
# The chart's own default plugin list requires core >= 2.504.3, while
|
|
# its default image tag is 2.504.2. An upstream inconsistency in the
|
|
# chart, not our configuration: bumping core is the fix, since the
|
|
# plugins involved (kubernetes above all) are what dynamic agents
|
|
# depend on.
|
|
tag: "2.504.3-jdk21"
|
|
|
|
# Helm replaces lists wholesale rather than merging, so this is the
|
|
# chart's full default list with one version corrected, plus two
|
|
# additions — not a hand-picked subset.
|
|
installPlugins:
|
|
# Pinned as a pair. kubernetes needs kubernetes-client-api >=
|
|
# 7.3.1-256.v788a_0b_787114; left unpinned it resolves to an older
|
|
# version at image-build time and every agent launch dies with
|
|
# NoSuchMethodError while constructing the client. The pods start
|
|
# fine, so it presents as builds hanging forever at "Still waiting to
|
|
# schedule task" rather than as a plugin problem.
|
|
- kubernetes:4437.v3a_18554d3f32
|
|
- kubernetes-client-api:7.3.1-256.v788a_0b_787114
|
|
- workflow-aggregator:608.v67378e9d3db_1
|
|
- git:5.7.0
|
|
# kubernetes/git/credentials need this version, though the chart's
|
|
# own default list pins an older one. Same class of upstream
|
|
# inconsistency as the image tag.
|
|
- configuration-as-code:2006.v001a_2ca_6b_574
|
|
# Not in the chart's default list at all — provides readYaml, which
|
|
# the shared library's loadConfig stage uses to parse each repo's
|
|
# config.yaml.
|
|
- pipeline-utility-steps:3.810.va_7672d206740
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
admin:
|
|
# From Vault through External Secrets, never a plaintext password
|
|
# here. Requires secretstores/jenkins-admin-credentials.yaml to have
|
|
# synced, which in turn requires the Vault path secret/jenkins/admin.
|
|
existingSecret: jenkins-admin-credentials
|
|
userKey: jenkins-admin-user
|
|
passwordKey: jenkins-admin-password
|
|
|
|
ingress:
|
|
enabled: true
|
|
hostName: "jenkins.35.238.248.203.nip.io"
|
|
ingressClassName: contour
|
|
# This chart's primary ingress supports exactly one hostName — no
|
|
# extraHosts like argo-cd. secondaryingress renders a whole second
|
|
# Ingress object at the same backend, which is the supported way to get
|
|
# a second hostname here.
|
|
#
|
|
# paths must be set explicitly: the template renders zero routes if left
|
|
# at the chart's own default of [], unlike the primary ingress, and the
|
|
# hostname would then answer nothing at all.
|
|
#
|
|
# Being a separate Ingress object is what makes the certificate clean —
|
|
# it covers this hostname alone, with no nip.io name to drag in.
|
|
secondaryingress:
|
|
enabled: true
|
|
hostName: "jenkins.infra.deployshed.com"
|
|
ingressClassName: contour
|
|
paths:
|
|
- /
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
tls:
|
|
- secretName: jenkins-tls
|
|
hosts:
|
|
- jenkins.infra.deployshed.com
|
|
|
|
agent:
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: standard-rwo
|
|
size: 5Gi
|