jenkins: update to 2.568.1 LTS and chart
Change-Id: Ib6b48599a09dee669d77441c12b354240ef257b8
diff --git a/charts/jenkins/templates/_helpers.tpl b/charts/jenkins/templates/_helpers.tpl
index 8301a84..33b2d13 100644
--- a/charts/jenkins/templates/_helpers.tpl
+++ b/charts/jenkins/templates/_helpers.tpl
@@ -13,6 +13,21 @@
{{- printf "%s-%s" (include "jenkins.name" .) .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
+{{/*
+Common labels for all Jenkins resources
+*/}}
+{{- define "jenkins.labels" -}}
+"app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
+"app.kubernetes.io/managed-by": "{{ .Release.Service }}"
+"app.kubernetes.io/instance": "{{ .Release.Name }}"
+"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+{{- if .Values.renderHelmLabels }}
+"helm.sh/chart": "{{ template "jenkins.label" .}}"
+{{- end }}
+{{- with .Values.extraLabels }}
+{{- toYaml . | nindent 0 }}
+{{- end }}
+{{- end -}}
{{/*
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
@@ -140,6 +155,14 @@
clouds:
- kubernetes:
containerCapStr: "{{ .Values.agent.containerCap }}"
+ {{- if .Values.agent.garbageCollection.enabled }}
+ garbageCollection:
+ {{- if .Values.agent.garbageCollection.namespaces }}
+ namespaces: |-
+ {{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
+ {{- end }}
+ timeout: "{{ .Values.agent.garbageCollection.timeout }}"
+ {{- end }}
{{- if .Values.agent.jnlpregistry }}
jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
{{- end }}
@@ -164,6 +187,8 @@
webSocket: true
{{- end }}
{{- end }}
+ skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
+ usageRestricted: {{ .Values.agent.usageRestricted | default false}}
maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
@@ -171,6 +196,7 @@
namespace: "{{ template "jenkins.agent.namespace" . }}"
restrictedPssSecurityContext: {{ .Values.agent.restrictedPssSecurityContext }}
serverUrl: "{{ .Values.kubernetesURL }}"
+ addMasterProxyEnvVars: {{ .Values.agent.addMasterProxyEnvVars | default false }}
credentialsId: "{{ .Values.credentialsId }}"
{{- if .Values.agent.enabled }}
podLabels:
@@ -189,8 +215,18 @@
{{- $agent := .Values.agent }}
{{- range $name, $additionalAgent := .Values.additionalAgents }}
{{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }}
+ {{- $runAsUser := $additionalAgent.runAsUser }}
+ {{- $runAsUserSet := not (kindIs "invalid" $runAsUser) }}
+ {{- $runAsGroup := $additionalAgent.runAsGroup }}
+ {{- $runAsGroupSet := not (kindIs "invalid" $runAsGroup) }}
{{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
{{- $additionalAgent := merge $additionalAgent $agent }}
+ {{- if $runAsUserSet }}
+ {{- $_ := set $additionalAgent "runAsUser" $runAsUser }}
+ {{- end }}
+ {{- if $runAsGroupSet }}
+ {{- $_ := set $additionalAgent "runAsGroup" $runAsGroup }}
+ {{- end }}
{{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
{{- if $additionalContainersEmpty }}
{{- $_ := set $additionalAgent "additionalContainers" list }}
@@ -224,6 +260,14 @@
{{- with $newRoot}}
- kubernetes:
containerCapStr: "{{ .Values.agent.containerCap }}"
+ {{- if .Values.agent.garbageCollection.enabled }}
+ garbageCollection:
+ {{- if .Values.agent.garbageCollection.namespaces }}
+ namespaces: |-
+ {{- .Values.agent.garbageCollection.namespaces | nindent 10 }}
+ {{- end }}
+ timeout: "{{ .Values.agent.garbageCollection.timeout }}"
+ {{- end }}
{{- if .Values.agent.jnlpregistry }}
jnlpregistry: "{{ .Values.agent.jnlpregistry }}"
{{- end }}
@@ -248,6 +292,8 @@
webSocket: true
{{- end }}
{{- end }}
+ skipTlsVerify: {{ .Values.agent.skipTlsVerify | default false}}
+ usageRestricted: {{ .Values.agent.usageRestricted | default false}}
maxRequestsPerHostStr: {{ .Values.agent.maxRequestsPerHostStr | quote }}
retentionTimeout: {{ .Values.agent.retentionTimeout | quote }}
waitForPodSec: {{ .Values.agent.waitForPodSec | quote }}
@@ -273,8 +319,18 @@
{{- $agent := .Values.agent }}
{{- range $name, $additionalAgent := .Values.additionalAgents }}
{{- $additionalContainersEmpty := and (hasKey $additionalAgent "additionalContainers") (empty $additionalAgent.additionalContainers) }}
+ {{- $runAsUser := $additionalAgent.runAsUser }}
+ {{- $runAsUserSet := not (kindIs "invalid" $runAsUser) }}
+ {{- $runAsGroup := $additionalAgent.runAsGroup }}
+ {{- $runAsGroupSet := not (kindIs "invalid" $runAsGroup) }}
{{- /* merge original .Values.agent into additional agent to ensure it at least has the default values */}}
{{- $additionalAgent := merge $additionalAgent $agent }}
+ {{- if $runAsUserSet }}
+ {{- $_ := set $additionalAgent "runAsUser" $runAsUser }}
+ {{- end }}
+ {{- if $runAsGroupSet }}
+ {{- $_ := set $additionalAgent "runAsGroup" $runAsGroup }}
+ {{- end }}
{{- /* clear list of additional containers in case it is configured empty for this agent (merge might have overwritten that) */}}
{{- if $additionalContainersEmpty }}
{{- $_ := set $additionalAgent "additionalContainers" list }}
@@ -297,7 +353,8 @@
{{- /* restore root */}}
{{- $_ := set $ "Values" $oldRoot.Values }}
{{- end }}
- {{- if .Values.controller.csrf.defaultCrumbIssuer.enabled }}
+ slaveAgentPort: {{ .Values.controller.agentListenerPort }}
+ {{- if and .Values.controller.csrf.defaultCrumbIssuer.enabled (eq .Chart.AppVersion (index (splitList "-" (include "controller.image.tag" .)) 0)) (lt (atoi (index (splitList "." .Chart.AppVersion) 1)) 543) }}
crumbIssuer:
standard:
excludeClientIPFromCrumb: {{ if .Values.controller.csrf.defaultCrumbIssuer.proxyCompatability }}true{{ else }}false{{- end }}
@@ -366,7 +423,11 @@
value: "http://{{ template "jenkins.fullname" . }}.{{ template "jenkins.namespace" . }}.svc.{{.Values.clusterZone}}:{{.Values.controller.servicePort}}{{ default "/" .Values.controller.jenkinsUriPrefix }}"
{{- end }}
{{- end }}
- image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
+ {{- if ne .Values.agent.image.registry "" }}
+ image: "{{ tpl .Values.agent.image.registry . }}/{{ tpl .Values.agent.image.repository . }}:{{ tpl .Values.agent.image.tag . }}"
+ {{- else }}
+ image: "{{ tpl .Values.agent.image.repository . }}:{{ tpl .Values.agent.image.tag . }}"
+ {{- end }}
{{- if .Values.agent.livenessProbe }}
livenessProbe:
execArgs: {{.Values.agent.livenessProbe.execArgs | quote}}
@@ -387,11 +448,11 @@
{{- with .Values.agent.resources.requests.ephemeralStorage }}
resourceRequestEphemeralStorage: {{.}}
{{- end }}
- {{- with .Values.agent.runAsUser }}
- runAsUser: {{ . }}
+ {{- if not (kindIs "invalid" .Values.agent.runAsUser) }}
+ runAsUser: {{ .Values.agent.runAsUser }}
{{- end }}
- {{- with .Values.agent.runAsGroup }}
- runAsGroup: {{ . }}
+ {{- if not (kindIs "invalid" .Values.agent.runAsGroup) }}
+ runAsGroup: {{ .Values.agent.runAsGroup }}
{{- end }}
ttyEnabled: {{ .Values.agent.TTYEnabled }}
workingDir: {{ .Values.agent.workingDir }}
@@ -425,11 +486,15 @@
resourceLimitMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.limits.memory }}{{ else }}{{ $.Values.agent.resources.limits.memory }}{{ end }}
resourceRequestCpu: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.cpu }}{{ else }}{{ $.Values.agent.resources.requests.cpu }}{{ end }}
resourceRequestMemory: {{ if $additionalContainers.resources }}{{ $additionalContainers.resources.requests.memory }}{{ else }}{{ $.Values.agent.resources.requests.memory }}{{ end }}
- {{- if or $additionalContainers.runAsUser $.Values.agent.runAsUser }}
- runAsUser: {{ $additionalContainers.runAsUser | default $.Values.agent.runAsUser }}
+ {{- if not (kindIs "invalid" $additionalContainers.runAsUser) }}
+ runAsUser: {{ $additionalContainers.runAsUser }}
+ {{- else if not (kindIs "invalid" $.Values.agent.runAsUser) }}
+ runAsUser: {{ $.Values.agent.runAsUser }}
{{- end }}
- {{- if or $additionalContainers.runAsGroup $.Values.agent.runAsGroup }}
- runAsGroup: {{ $additionalContainers.runAsGroup | default $.Values.agent.runAsGroup }}
+ {{- if not (kindIs "invalid" $additionalContainers.runAsGroup) }}
+ runAsGroup: {{ $additionalContainers.runAsGroup }}
+ {{- else if not (kindIs "invalid" $.Values.agent.runAsGroup) }}
+ runAsGroup: {{ $.Values.agent.runAsGroup }}
{{- end }}
ttyEnabled: {{ $additionalContainers.TTYEnabled | default $.Values.agent.TTYEnabled }}
workingDir: {{ $additionalContainers.workingDir | default $.Values.agent.workingDir }}
@@ -450,7 +515,7 @@
{{- end }}
{{- end }}
idleMinutes: {{ .Values.agent.idleMinutes }}
- instanceCap: 2147483647
+ instanceCap: {{ int .Values.agent.instanceCap }}
{{- if .Values.agent.hostNetworking }}
hostNetwork: {{ .Values.agent.hostNetworking }}
{{- end }}
@@ -471,7 +536,10 @@
nodeUsageMode: {{ quote .Values.agent.nodeUsageMode }}
podRetention: {{ .Values.agent.podRetention }}
showRawYaml: {{ .Values.agent.showRawYaml }}
- serviceAccount: "{{ include "jenkins.serviceAccountAgentName" . }}"
+{{- $asaname := default (include "jenkins.serviceAccountAgentName" .) .Values.agent.serviceAccount -}}
+{{- if or (.Values.agent.useDefaultServiceAccount) (.Values.agent.serviceAccount) }}
+ serviceAccount: "{{ $asaname }}"
+{{- end }}
slaveConnectTimeoutStr: "{{ .Values.agent.connectTimeout }}"
{{- if .Values.agent.volumes }}
volumes:
@@ -520,6 +588,7 @@
{{- tpl (trim .Values.agent.yamlTemplate) . | nindent 4 }}
{{- end }}
yamlMergeStrategy: {{ .Values.agent.yamlMergeStrategy }}
+ inheritYamlMergeStrategy: {{ .Values.agent.inheritYamlMergeStrategy }}
{{- end -}}
{{- define "jenkins.kubernetes-version" -}}
@@ -607,6 +676,8 @@
fieldPath: metadata.name
- name: LABEL
value: "{{ template "jenkins.fullname" $root }}-jenkins-config"
+ - name: HEALTH_PORT
+ value: "{{ $root.Values.controller.sidecars.configAutoReload.healthPort }}"
- name: FOLDER
value: "{{ $root.Values.controller.sidecars.configAutoReload.folder }}"
- name: NAMESPACE
@@ -640,6 +711,10 @@
{{- end -}}
{{- end -}}
{{- end }}
+ {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+ - name: LOG_CONFIG
+ value: "{{ $root.Values.controller.jenkinsHome }}/auto-reload/auto-reload-config.yaml"
+ {{- end }}
resources:
{{ toYaml $root.Values.controller.sidecars.configAutoReload.resources | indent 4 }}
@@ -651,5 +726,24 @@
{{- if $root.Values.persistence.subPath }}
subPath: {{ $root.Values.persistence.subPath }}
{{- end }}
+ - name: tmp-volume
+ mountPath: /tmp
+ {{- if $root.Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+ - name: auto-reload-config
+ mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload
+ - name: auto-reload-config-logs
+ mountPath: {{ $root.Values.controller.jenkinsHome }}/auto-reload-logs
+ {{- end }}
+ {{- if $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts }}
+{{ (tpl (toYaml $root.Values.controller.sidecars.configAutoReload.additionalVolumeMounts) $root) | indent 4 }}
+ {{- end }}
{{- end -}}
+
+{{- define "controller.replicas" -}}
+{{- $replicas := int (default 1 .Values.controller.replicas) -}}
+{{- if or (lt $replicas 0) (gt $replicas 1) -}}
+{{- fail "controller.replicas must be 0 or 1" -}}
+{{- end -}}
+{{- .Values.controller.replicas -}}
+{{- end -}}
diff --git a/charts/jenkins/templates/auto-reload-config.yaml b/charts/jenkins/templates/auto-reload-config.yaml
new file mode 100644
index 0000000..6b9ed27
--- /dev/null
+++ b/charts/jenkins/templates/auto-reload-config.yaml
@@ -0,0 +1,54 @@
+{{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "jenkins.fullname" . }}-auto-reload-config
+ namespace: {{ template "jenkins.namespace" . }}
+ labels:
+ {{ include "jenkins.labels" . | nindent 4 }}
+data:
+ auto-reload-config.yaml: |-
+ version: 1
+ disable_existing_loggers: false
+ root:
+ level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
+ handlers:
+ {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
+ - console
+ {{- end }}
+ {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
+ - file
+ {{- end }}
+ handlers:
+ {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToConsole}}
+ console:
+ class: logging.StreamHandler
+ level: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.logLevel }}
+ formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
+ {{- end }}
+ {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.logToFile }}
+ file:
+ class : logging.handlers.RotatingFileHandler
+ formatter: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.formatter }}
+ filename: {{ .Values.controller.jenkinsHome }}/auto-reload-logs/file.log
+ maxBytes: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.maxBytes }}
+ backupCount: {{ .Values.controller.sidecars.configAutoReload.logging.configuration.backupCount }}
+ {{- end }}
+ formatters:
+ JSON:
+ "()": logger.JsonFormatter
+ format: "%(levelname)s %(message)s"
+ rename_fields:
+ message: msg
+ levelname: level
+ LOGFMT:
+ "()": logger.LogfmtFormatter
+ keys:
+ - time
+ - level
+ - msg
+ mapping:
+ time: asctime
+ level: levelname
+ msg: message
+ {{- end }}
diff --git a/charts/jenkins/templates/config-init-scripts.yaml b/charts/jenkins/templates/config-init-scripts.yaml
index 7dd253c..89ed7dd 100644
--- a/charts/jenkins/templates/config-init-scripts.yaml
+++ b/charts/jenkins/templates/config-init-scripts.yaml
@@ -6,10 +6,7 @@
name: {{ template "jenkins.fullname" . }}-init-scripts
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
data:
{{- range $key, $val := .Values.controller.initScripts }}
init{{ $key }}.groovy: |-
diff --git a/charts/jenkins/templates/config.yaml b/charts/jenkins/templates/config.yaml
index 5de0b9f..c49c248 100644
--- a/charts/jenkins/templates/config.yaml
+++ b/charts/jenkins/templates/config.yaml
@@ -6,10 +6,7 @@
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
data:
apply_config.sh: |-
set -e
diff --git a/charts/jenkins/templates/extra-objects.yaml b/charts/jenkins/templates/extra-objects.yaml
new file mode 100644
index 0000000..c8b9a6e
--- /dev/null
+++ b/charts/jenkins/templates/extra-objects.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.extraObjects -}}
+ {{- $extraObjects := .Values.extraObjects -}}
+
+ {{- if kindIs "map" $extraObjects -}}
+ {{- $extraObjects = values $extraObjects -}}
+ {{- end -}}
+
+ {{- range $index, $object := $extraObjects -}}
+ {{- if $object }}
+---
+ {{- if kindIs "string" $object -}}
+ {{- tpl $object $ | nindent 0 -}}
+ {{- else -}}
+ {{- tpl (toYaml $object) $ | nindent 0 -}}
+ {{- end -}}
+ {{- end -}}
+ {{- end -}}
+{{- end -}}
diff --git a/charts/jenkins/templates/home-pvc.yaml b/charts/jenkins/templates/home-pvc.yaml
index f417d23..023295b 100644
--- a/charts/jenkins/templates/home-pvc.yaml
+++ b/charts/jenkins/templates/home-pvc.yaml
@@ -10,13 +10,7 @@
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.persistence.labels }}
{{ toYaml .Values.persistence.labels | indent 4 }}
{{- end }}
@@ -34,7 +28,7 @@
{{- if (eq "-" .Values.persistence.storageClass) }}
storageClassName: ""
{{- else }}
- storageClassName: "{{ .Values.persistence.storageClass }}"
+ storageClassName: "{{ tpl .Values.persistence.storageClass . }}"
{{- end }}
{{- end }}
{{- end }}
diff --git a/charts/jenkins/templates/jcasc-config.yaml b/charts/jenkins/templates/jcasc-config.yaml
index e404194..c9fdbcb 100644
--- a/charts/jenkins/templates/jcasc-config.yaml
+++ b/charts/jenkins/templates/jcasc-config.yaml
@@ -9,14 +9,12 @@
name: {{ template "jenkins.casc.configName" (list (printf "config-%s" $key) $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
- "app.kubernetes.io/name": {{ template "jenkins.name" $root}}
- {{- if $root.Values.renderHelmLabels }}
- "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
- "app.kubernetes.io/instance": "{{ $.Release.Name }}"
- "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
+ {{- include "jenkins.labels" $root | nindent 4 }}
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+ annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
data:
{{ $key }}.yaml: |-
{{ tpl $val $| indent 4 }}
@@ -30,16 +28,67 @@
name: {{ template "jenkins.casc.configName" (list "jcasc-config" $ )}}
namespace: {{ template "jenkins.namespace" $root }}
labels:
+ {{- include "jenkins.labels" $root | nindent 4 }}
+ {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+ annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
+data:
+ jcasc-default-config.yaml: |-
+ {{- include "jenkins.casc.defaults" . | nindent 4 }}
+{{- end}}
+{{- $configScripts := toYaml .Values.controller.JCasC.configScripts }}
+{{- if and .Values.controller.JCasC.securityRealm (not (contains "securityRealm:" $configScripts)) (not .Values.controller.JCasC.defaultConfig) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "jenkins.casc.configName" (list "config-securityrealm" $ )}}
+ namespace: {{ template "jenkins.namespace" $root }}
+ labels:
"app.kubernetes.io/name": {{ template "jenkins.name" $root}}
{{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
+ "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
{{- end }}
"app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
"app.kubernetes.io/instance": "{{ $.Release.Name }}"
"app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
{{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+ annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
data:
- jcasc-default-config.yaml: |-
- {{- include "jenkins.casc.defaults" . | nindent 4 }}
-{{- end}}
+ securityrealm.yaml: |-
+ jenkins:
+ securityRealm:
+ {{- tpl .Values.controller.JCasC.securityRealm . | nindent 8 }}
+{{- end }}
+{{- if and .Values.controller.JCasC.authorizationStrategy (not (contains "authorizationStrategy:" $configScripts)) (not .Values.controller.JCasC.defaultConfig) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "jenkins.casc.configName" (list "config-authorizationstrategy" $ )}}
+ namespace: {{ template "jenkins.namespace" $root }}
+ labels:
+ "app.kubernetes.io/name": {{ template "jenkins.name" $root}}
+ {{- if .Values.renderHelmLabels }}
+ "helm.sh/chart": "{{ $root.Chart.Name }}-{{ $root.Chart.Version | replace "+" "_" }}"
+ {{- end }}
+ "app.kubernetes.io/managed-by": "{{ $.Release.Service }}"
+ "app.kubernetes.io/instance": "{{ $.Release.Name }}"
+ "app.kubernetes.io/component": "{{ $.Values.controller.componentName }}"
+ {{ template "jenkins.fullname" $root }}-jenkins-config: "true"
+{{- if $root.Values.controller.JCasC.configMapAnnotations }}
+ annotations:
+{{ toYaml $root.Values.controller.JCasC.configMapAnnotations | indent 4 }}
+{{- end }}
+data:
+ authorizationstrategy.yaml: |-
+ jenkins:
+ authorizationStrategy:
+ {{- tpl .Values.controller.JCasC.authorizationStrategy . | nindent 8 }}
+{{- end }}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-agent-svc.yaml b/charts/jenkins/templates/jenkins-agent-svc.yaml
index 4440b91..10b936f 100644
--- a/charts/jenkins/templates/jenkins-agent-svc.yaml
+++ b/charts/jenkins/templates/jenkins-agent-svc.yaml
@@ -5,13 +5,7 @@
name: {{ template "jenkins.fullname" . }}-agent
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.agentListenerServiceAnnotations }}
annotations:
{{- toYaml .Values.controller.agentListenerServiceAnnotations | nindent 4 }}
diff --git a/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml b/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
index 2f6e7a1..6ccabef 100644
--- a/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
+++ b/charts/jenkins/templates/jenkins-aws-security-group-policies.yaml
@@ -5,6 +5,8 @@
metadata:
name: {{ .name }}
namespace: {{ template "jenkins.namespace" $ }}
+ labels:
+ {{ include "jenkins.labels" $ | nindent 4 }}
spec:
podSelector:
{{- toYaml .podSelector | nindent 6}}
diff --git a/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml b/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
index 3fd8061..9bbdc79 100644
--- a/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
+++ b/charts/jenkins/templates/jenkins-controller-alerting-rules.yaml
@@ -10,13 +10,7 @@
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- range $key, $val := .Values.controller.prometheus.alertingRulesAdditionalLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
diff --git a/charts/jenkins/templates/jenkins-controller-backendconfig.yaml b/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
index 0e8a566..8c13fe1 100644
--- a/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
+++ b/charts/jenkins/templates/jenkins-controller-backendconfig.yaml
@@ -5,13 +5,7 @@
name: {{ .Values.controller.backendconfig.name }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.backendconfig.labels }}
{{ toYaml .Values.controller.backendconfig.labels | indent 4 }}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-httproute.yaml b/charts/jenkins/templates/jenkins-controller-httproute.yaml
new file mode 100644
index 0000000..f2dcfc1
--- /dev/null
+++ b/charts/jenkins/templates/jenkins-controller-httproute.yaml
@@ -0,0 +1,40 @@
+{{- if .Values.controller.httpRoute.enabled }}
+{{- $root := . }}
+{{- $hostnames := (list) }}
+{{- if .Values.controller.httpRoute.reuseIngressConfiguration }}
+ {{- if .Values.controller.ingress.hostName }}
+ {{- $hostnames = append $hostnames .Values.controller.ingress.hostName }}
+ {{- end }}
+ {{- if .Values.controller.ingress.resourceRootUrl }}
+ {{- $hostnames = append $hostnames .Values.controller.ingress.resourceRootUrl }}
+ {{- end }}
+{{- else }}
+ {{- $hostnames = default (list) .Values.controller.httpRoute.hostnames }}
+{{- end }}
+apiVersion: {{ .Values.controller.httpRoute.apiVersion }}
+kind: {{ .Values.controller.httpRoute.kind }}
+metadata:
+ name: {{ include "jenkins.fullname" . }}
+ labels:
+ {{- include "jenkins.labels" . | nindent 4 }}
+ {{- if .Values.controller.httpRoute.annotations }}
+ annotations:
+ {{- tpl (toYaml .Values.controller.httpRoute.annotations) . | nindent 4 }}
+ {{- end }}
+spec:
+ {{- with .Values.controller.httpRoute.parentRefs }}
+ parentRefs:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ hostnames:
+ {{- range $hostnames }}
+ - {{ . | quote }}
+ {{- end }}
+ rules:
+{{- if .Values.controller.httpRoute.extraRules }}
+{{- toYaml .Values.controller.httpRoute.extraRules | nindent 2 }}
+{{- end }}
+ - backendRefs:
+ - name: {{ include "jenkins.fullname" $root }}
+ port: {{ $root.Values.controller.servicePort }}
+{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-ingress.yaml b/charts/jenkins/templates/jenkins-controller-ingress.yaml
index b3b344f..53eaa25 100644
--- a/charts/jenkins/templates/jenkins-controller-ingress.yaml
+++ b/charts/jenkins/templates/jenkins-controller-ingress.yaml
@@ -11,24 +11,18 @@
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.ingress.labels }}
{{ toYaml .Values.controller.ingress.labels | indent 4 }}
{{- end }}
{{- if .Values.controller.ingress.annotations }}
annotations:
-{{ toYaml .Values.controller.ingress.annotations | indent 4 }}
+{{ tpl (toYaml .Values.controller.ingress.annotations) . | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}
spec:
{{- if .Values.controller.ingress.ingressClassName }}
- ingressClassName: {{ .Values.controller.ingress.ingressClassName | quote }}
+ ingressClassName: {{ tpl .Values.controller.ingress.ingressClassName . | quote }}
{{- end }}
rules:
- http:
@@ -40,7 +34,7 @@
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
- pathType: ImplementationSpecific
+ pathType: {{ .Values.controller.ingress.pathType }}
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
@@ -63,7 +57,7 @@
name: {{ template "jenkins.fullname" . }}
port:
number: {{ .Values.controller.servicePort }}
- pathType: ImplementationSpecific
+ pathType: {{ .Values.controller.ingress.pathType }}
{{- else }}
serviceName: {{ template "jenkins.fullname" . }}
servicePort: {{ .Values.controller.servicePort }}
@@ -71,7 +65,26 @@
host: {{ tpl .Values.controller.ingress.resourceRootUrl . | quote }}
{{- end }}
{{- if .Values.controller.ingress.tls }}
+{{- $withTlsEntries := false }}
+{{- range .Values.controller.ingress.tls }}
+ {{- if gt (len .) 0 }}
+ {{- $withTlsEntries = true }}
+ {{- end }}
+{{- end }}
+{{- if $withTlsEntries }}
tls:
-{{ tpl (toYaml .Values.controller.ingress.tls ) . | indent 4 }}
-{{- end -}}
+{{- range .Values.controller.ingress.tls }}
+ - hosts:
+{{- range .hosts }}
+ - {{ tpl . $ | quote }}
+{{- end }}
+{{- if $.Values.controller.ingress.resourceRootUrl }}
+ - {{ tpl $.Values.controller.ingress.resourceRootUrl $ | quote }}
+{{- end }}
+{{- if .secretName }}
+ secretName: {{ tpl (.secretName | toString) $ | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
index 82835f2..e281b03 100644
--- a/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
+++ b/charts/jenkins/templates/jenkins-controller-networkpolicy.yaml
@@ -5,13 +5,7 @@
name: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
@@ -60,13 +54,7 @@
name: "{{ .Release.Name }}-{{ .Values.agent.componentName }}"
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
diff --git a/charts/jenkins/templates/jenkins-controller-pdb.yaml b/charts/jenkins/templates/jenkins-controller-pdb.yaml
index 9dc1faf..53090e5 100644
--- a/charts/jenkins/templates/jenkins-controller-pdb.yaml
+++ b/charts/jenkins/templates/jenkins-controller-pdb.yaml
@@ -12,13 +12,7 @@
name: {{ template "jenkins.fullname" . }}-pdb
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.podDisruptionBudget.labels -}}
{{ toYaml .Values.controller.podDisruptionBudget.labels | nindent 4 }}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-podmonitor.yaml b/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
index 9a04019..b84039c 100644
--- a/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
+++ b/charts/jenkins/templates/jenkins-controller-podmonitor.yaml
@@ -10,13 +10,7 @@
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
spec:
endpoints:
diff --git a/charts/jenkins/templates/jenkins-controller-route.yaml b/charts/jenkins/templates/jenkins-controller-route.yaml
index 3550380..9144e10 100644
--- a/charts/jenkins/templates/jenkins-controller-route.yaml
+++ b/charts/jenkins/templates/jenkins-controller-route.yaml
@@ -5,12 +5,10 @@
namespace: {{ template "jenkins.namespace" . }}
labels:
app: {{ template "jenkins.fullname" . }}
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
component: "{{ .Release.Name }}-{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.route.labels }}
{{ toYaml .Values.controller.route.labels | indent 4 }}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml b/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
index c63e482..876b75d 100644
--- a/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
+++ b/charts/jenkins/templates/jenkins-controller-secondary-ingress.yaml
@@ -13,26 +13,21 @@
metadata:
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.secondaryingress.labels -}}
{{ toYaml .Values.controller.secondaryingress.labels | nindent 4 }}
{{- end }}
{{- if .Values.controller.secondaryingress.annotations }}
- annotations: {{ toYaml .Values.controller.secondaryingress.annotations | nindent 4 }}
+ annotations:
+{{ tpl (toYaml .Values.controller.secondaryingress.annotations) . | indent 4 }}
{{- end }}
name: {{ template "jenkins.fullname" . }}-secondary
spec:
{{- if .Values.controller.secondaryingress.ingressClassName }}
- ingressClassName: {{ .Values.controller.secondaryingress.ingressClassName | quote }}
+ ingressClassName: {{ tpl .Values.controller.secondaryingress.ingressClassName . | quote }}
{{- end }}
rules:
- - host: {{ .Values.controller.secondaryingress.hostName }}
+ - host: {{ tpl .Values.controller.secondaryingress.hostName . | quote }}
http:
paths:
{{- range .Values.controller.secondaryingress.paths }}
@@ -43,14 +38,30 @@
name: {{ $serviceName }}
port:
number: {{ $servicePort }}
- pathType: ImplementationSpecific
+ pathType: {{ $.Values.controller.secondaryingress.pathType }}
{{ else }}
serviceName: {{ $serviceName }}
servicePort: {{ $servicePort }}
{{ end }}
{{- end}}
{{- if .Values.controller.secondaryingress.tls }}
+{{- $withTlsEntries := false }}
+{{- range .Values.controller.secondaryingress.tls }}
+ {{- if gt (len .) 0 }}
+ {{- $withTlsEntries = true }}
+ {{- end }}
+{{- end }}
+{{- if $withTlsEntries }}
tls:
-{{ toYaml .Values.controller.secondaryingress.tls | indent 4 }}
+{{- range .Values.controller.secondaryingress.tls }}
+ - hosts:
+{{- range .hosts }}
+ - {{ tpl . $ | quote }}
+{{- end }}
+{{- if .secretName }}
+ secretName: {{ tpl (.secretName | toString) $ | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
{{- end -}}
{{- end }}
diff --git a/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml b/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
index 8710b2b..bf64666 100644
--- a/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
+++ b/charts/jenkins/templates/jenkins-controller-servicemonitor.yaml
@@ -10,13 +10,7 @@
namespace: {{ template "jenkins.namespace" . }}
{{- end }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- range $key, $val := .Values.controller.prometheus.serviceMonitorAdditionalLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
diff --git a/charts/jenkins/templates/jenkins-controller-statefulset.yaml b/charts/jenkins/templates/jenkins-controller-statefulset.yaml
index ca0edc6..80154c7 100644
--- a/charts/jenkins/templates/jenkins-controller-statefulset.yaml
+++ b/charts/jenkins/templates/jenkins-controller-statefulset.yaml
@@ -8,13 +8,7 @@
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- range $key, $val := .Values.controller.statefulSetLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
@@ -24,7 +18,7 @@
{{- end }}
spec:
serviceName: {{ template "jenkins.fullname" . }}
- replicas: 1
+ replicas: {{ include "controller.replicas" . }}
selector:
matchLabels:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
@@ -36,10 +30,7 @@
template:
metadata:
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 8 }}
{{- range $key, $val := .Values.controller.podLabels }}
{{ $key }}: {{ $val | quote }}
{{- end}}
@@ -67,6 +58,14 @@
affinity:
{{ toYaml .Values.controller.affinity | indent 8 }}
{{- end }}
+ {{- if .Values.controller.topologySpreadConstraints }}
+ topologySpreadConstraints:
+{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }}
+ {{- end }}
+ {{- if .Values.controller.dnsConfig }}
+ dnsConfig:
+{{ toYaml .Values.controller.dnsConfig | indent 8 }}
+ {{- end }}
{{- if quote .Values.controller.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- end }}
@@ -76,6 +75,9 @@
{{- if .Values.controller.shareProcessNamespace }}
shareProcessNamespace: true
{{- end }}
+ {{- if not .Values.controller.enableServiceLinks }}
+ enableServiceLinks: false
+ {{- end }}
{{- if .Values.controller.usePodSecurityContext }}
securityContext:
{{- if kindIs "map" .Values.controller.podSecurityContextOverride }}
@@ -84,12 +86,14 @@
{{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed:
runAsUser: 1000
fsGroup: 1000
+ fsGroupChangePolicy: OnRootMismatch
runAsNonRoot: true
*/}}
runAsUser: {{ default 0 .Values.controller.runAsUser }}
{{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }}
{{- if not (eq (int .Values.controller.runAsUser) 0) }}
fsGroup: {{ .Values.controller.fsGroup }}
+ fsGroupChangePolicy: {{ .Values.controller.fsGroupChangePolicy }}
runAsNonRoot: true
{{- end }}
{{- if .Values.controller.securityContextCapabilities }}
@@ -100,6 +104,7 @@
{{- end }}
{{- end }}
serviceAccountName: "{{ template "jenkins.serviceAccountName" . }}"
+ automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.hostNetworking }}
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
@@ -215,10 +220,10 @@
fieldPath: metadata.name
- name: JAVA_OPTS
value: >-
- {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ default "" .Values.controller.javaOpts }}
+ {{ if .Values.controller.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{ end }}{{ tpl (default "" .Values.controller.javaOpts) . }}
- name: JENKINS_OPTS
value: >-
- {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ default "" .Values.controller.jenkinsOpts}}
+ {{ if .Values.controller.jenkinsUriPrefix }}--prefix={{ .Values.controller.jenkinsUriPrefix }} {{ end }} --webroot=/var/jenkins_cache/war {{ tpl (default "" .Values.controller.jenkinsOpts) . }}
- name: JENKINS_SLAVE_AGENT_PORT
value: "{{ .Values.controller.agentListenerPort }}"
{{- if .Values.controller.httpsKeyStore.enable }}
@@ -321,6 +326,13 @@
{{- if .Values.persistence.volumes }}
{{ tpl (toYaml .Values.persistence.volumes | indent 6) . }}
{{- end }}
+ {{- if .Values.controller.sidecars.configAutoReload.logging.configuration.override }}
+ - name: auto-reload-config
+ configMap:
+ name: {{ template "jenkins.fullname" . }}-auto-reload-config
+ - name: auto-reload-config-logs
+ emptyDir: {}
+ {{- end }}
{{- if .Values.controller.installPlugins }}
{{- if .Values.controller.overwritePluginsFromImage }}
- name: plugins
diff --git a/charts/jenkins/templates/jenkins-controller-svc.yaml b/charts/jenkins/templates/jenkins-controller-svc.yaml
index a83466c..3cf9e78 100644
--- a/charts/jenkins/templates/jenkins-controller-svc.yaml
+++ b/charts/jenkins/templates/jenkins-controller-svc.yaml
@@ -1,16 +1,11 @@
+{{- if .Values.controller.serviceEnabled }}
apiVersion: v1
kind: Service
metadata:
name: {{template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.controller.serviceLabels }}
{{ toYaml .Values.controller.serviceLabels | indent 4 }}
{{- end }}
@@ -41,6 +36,9 @@
targetPort: {{ $port.port }}
{{- end -}}
{{- end }}
+ {{- if .Values.controller.publishNotReadyAddresses }}
+ publishNotReadyAddresses: true
+ {{- end }}
selector:
"app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
"app.kubernetes.io/instance": "{{ .Release.Name }}"
@@ -54,3 +52,4 @@
loadBalancerIP: {{.Values.controller.loadBalancerIP}}
{{end}}
{{end}}
+{{- end }}
diff --git a/charts/jenkins/templates/rbac.yaml b/charts/jenkins/templates/rbac.yaml
index 581cb8d..48ba8ab 100644
--- a/charts/jenkins/templates/rbac.yaml
+++ b/charts/jenkins/templates/rbac.yaml
@@ -8,13 +8,7 @@
name: {{ $serviceName }}-schedule-agents
namespace: {{ template "jenkins.agent.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["pods", "pods/exec", "pods/log", "persistentvolumeclaims", "events"]
@@ -33,13 +27,7 @@
name: {{ $serviceName }}-schedule-agents
namespace: {{ template "jenkins.agent.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
@@ -60,13 +48,7 @@
name: {{ template "jenkins.fullname" . }}-read-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["secrets"]
@@ -80,13 +62,7 @@
name: {{ $serviceName }}-read-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
@@ -99,6 +75,43 @@
---
{{- end}}
+{{- if .Values.rbac.useOpenShiftNonRootSCC }}
+# This is needed if you are running on OpenShift and using the default
+# containerSecurityContext in the chart. It grants the Jenkins service account
+# permission to use the "nonroot" and "nonroot-v2" SecurityContextConstraints.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ $serviceName }}-use-nonroot-scc
+ namespace: {{ template "jenkins.namespace" . }}
+ labels:
+ {{- include "jenkins.labels" . | nindent 4 }}
+rules:
+ - apiGroups: ["security.openshift.io"]
+ resources: ["securitycontextconstraints"]
+ resourceNames: ["nonroot", "nonroot-v2"]
+ verbs: ["use"]
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ $serviceName }}-use-nonroot-scc
+ namespace: {{ template "jenkins.namespace" . }}
+ labels:
+ {{- include "jenkins.labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "jenkins.fullname" . }}-use-nonroot-scc
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "jenkins.serviceAccountName" . }}
+ namespace: {{ template "jenkins.namespace" . }}
+
+---
+{{- end}}
+
{{- if .Values.controller.sidecars.configAutoReload.enabled }}
# The sidecar container which is responsible for reloading configuration changes
# needs permissions to watch ConfigMaps
@@ -108,13 +121,7 @@
name: {{ template "jenkins.fullname" . }}-casc-reload
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["configmaps"]
@@ -128,13 +135,7 @@
name: {{ $serviceName }}-watch-configmaps
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
diff --git a/charts/jenkins/templates/secret-additional.yaml b/charts/jenkins/templates/secret-additional.yaml
index d1908aa..9504b3b 100644
--- a/charts/jenkins/templates/secret-additional.yaml
+++ b/charts/jenkins/templates/secret-additional.yaml
@@ -6,13 +6,7 @@
name: {{ template "jenkins.fullname" . }}-additional-secrets
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
type: Opaque
data:
{{- range .Values.controller.additionalSecrets }}
diff --git a/charts/jenkins/templates/secret-claims.yaml b/charts/jenkins/templates/secret-claims.yaml
index e8b6d6c..b47c7bd 100644
--- a/charts/jenkins/templates/secret-claims.yaml
+++ b/charts/jenkins/templates/secret-claims.yaml
@@ -1,7 +1,5 @@
{{- if .Values.controller.secretClaims -}}
-{{- $r := .Release -}}
-{{- $v := .Values -}}
-{{- $chart := printf "%s-%s" .Chart.Name .Chart.Version -}}
+{{- $root := . -}}
{{- $namespace := include "jenkins.namespace" . -}}
{{- $serviceName := include "jenkins.fullname" . -}}
{{ range .Values.controller.secretClaims }}
@@ -12,13 +10,9 @@
name: {{ $serviceName }}-{{ .name | default .path | lower }}
namespace: {{ $namespace }}
labels:
- "app.kubernetes.io/name": '{{ $serviceName }}'
- {{- if $v.renderHelmLabels }}
- "helm.sh/chart": "{{ $chart }}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ $r.Service }}"
- "app.kubernetes.io/instance": "{{ $r.Name }}"
- "app.kubernetes.io/component": "{{ $v.controller.componentName }}"
+ {{- $baseLabels := include "jenkins.labels" $root | fromYaml }}
+ {{- $overrideLabels := dict "app.kubernetes.io/name" $serviceName }}
+ {{- toYaml (merge $overrideLabels $baseLabels) | nindent 4 }}
spec:
type: {{ .type | default "Opaque" }}
path: {{ .path }}
@@ -26,4 +20,4 @@
renew: {{ .renew }}
{{- end }}
{{- end }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/charts/jenkins/templates/secret-https-jks.yaml b/charts/jenkins/templates/secret-https-jks.yaml
index 5348de4..244e1a5 100644
--- a/charts/jenkins/templates/secret-https-jks.yaml
+++ b/charts/jenkins/templates/secret-https-jks.yaml
@@ -5,13 +5,7 @@
name: {{ template "jenkins.fullname" . }}-https-jks
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
type: Opaque
data:
jenkins-jks-file: |
diff --git a/charts/jenkins/templates/secret.yaml b/charts/jenkins/templates/secret.yaml
index cc6ace1..a3000d1 100644
--- a/charts/jenkins/templates/secret.yaml
+++ b/charts/jenkins/templates/secret.yaml
@@ -6,13 +6,7 @@
name: {{ template "jenkins.fullname" . }}
namespace: {{ template "jenkins.namespace" . }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{ include "jenkins.labels" . | nindent 4 }}
type: Opaque
data:
jenkins-admin-password: {{ template "jenkins.password" . }}
diff --git a/charts/jenkins/templates/service-account-agent.yaml b/charts/jenkins/templates/service-account-agent.yaml
index 48f08ba..42df234 100644
--- a/charts/jenkins/templates/service-account-agent.yaml
+++ b/charts/jenkins/templates/service-account-agent.yaml
@@ -1,6 +1,7 @@
{{ if .Values.serviceAccountAgent.create }}
apiVersion: v1
kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccountAgent.automountServiceAccountToken }}
metadata:
name: {{ include "jenkins.serviceAccountAgentName" . }}
namespace: {{ template "jenkins.agent.namespace" . }}
@@ -9,13 +10,7 @@
{{ tpl (toYaml .Values.serviceAccountAgent.annotations) . | indent 4 }}
{{- end }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.serviceAccountAgent.extraLabels }}
{{ tpl (toYaml .Values.serviceAccountAgent.extraLabels) . | indent 4 }}
{{- end }}
diff --git a/charts/jenkins/templates/service-account.yaml b/charts/jenkins/templates/service-account.yaml
index b44eb48..c868af5 100644
--- a/charts/jenkins/templates/service-account.yaml
+++ b/charts/jenkins/templates/service-account.yaml
@@ -1,6 +1,7 @@
{{ if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
metadata:
name: {{ include "jenkins.serviceAccountName" . }}
namespace: {{ template "jenkins.namespace" . }}
@@ -9,13 +10,7 @@
{{ tpl (toYaml .Values.serviceAccount.annotations) . | indent 4 }}
{{- end }}
labels:
- "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
- {{- if .Values.renderHelmLabels }}
- "helm.sh/chart": "{{ template "jenkins.label" .}}"
- {{- end }}
- "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
- "app.kubernetes.io/instance": "{{ .Release.Name }}"
- "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
+ {{- include "jenkins.labels" . | nindent 4 }}
{{- if .Values.serviceAccount.extraLabels }}
{{ tpl (toYaml .Values.serviceAccount.extraLabels) . | indent 4 }}
{{- end }}