jenkins: update to 2.568.1 LTS and chart
Change-Id: Ib6b48599a09dee669d77441c12b354240ef257b8
diff --git a/charts/jenkins/values.yaml b/charts/jenkins/values.yaml
index 754a01c..4dfadc2 100644
--- a/charts/jenkins/values.yaml
+++ b/charts/jenkins/values.yaml
@@ -29,6 +29,12 @@
# -- Enables rendering of the helm.sh/chart label to the annotations
renderHelmLabels: true
+# -- Configures extra labels for the agent all objects
+extraLabels: {}
+
+# -- Configures extra manifests
+extraObjects:
+
controller:
# -- Used for label app.kubernetes.io/component
componentName: "jenkins-controller"
@@ -38,13 +44,17 @@
# -- Controller image repository
repository: "jenkins/jenkins"
- # -- Controller image tag override; i.e., tag: "2.440.1-jdk17"
+ # -- Controller image tag override; i.e., tag: "2.440.1-jdk21"
tag:
# -- Controller image tag label
- tagLabel: jdk17
+ tagLabel: jdk21
# -- Controller image pull policy
pullPolicy: "Always"
+
+ # -- Number of replicas. Max 1. Can be set to 0 for maintenance scenarios.
+ replicas: 1
+
# -- Controller image pull secret
imagePullSecretName:
# -- Lifecycle specification for controller-container
@@ -73,7 +83,6 @@
# If you disable the non-Jenkins identity store and instead use the Jenkins internal one,
# you should revert controller.admin.username to your preferred admin user:
admin:
-
# -- Admin username created as a secret if `controller.admin.createSecret` is true
username: "admin"
# -- Admin password created as a secret if `controller.admin.createSecret` is true
@@ -123,6 +132,12 @@
# Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod
shareProcessNamespace: false
+ # Service links might cause issue if running in a namespace with a large amount of services
+ # that might cause a slow startup when plugins are copied from ref to volume
+ # Set to true to keep previous behavior
+ # See https://github.com/kubernetes/kubernetes/issues/121787
+ enableServiceLinks: false
+
# Overrides the init container default values
# -- Resources allocation (Requests and Limits) for Init Container
initContainerResources: {}
@@ -185,6 +200,9 @@
# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume.
fsGroup: 1000
+ # -- Deprecated in favor of `controller.podSecurityContextOverride`. fsGroupChangePolicy for the pod security context
+ fsGroupChangePolicy: OnRootMismatch
+
# If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here
# securityContextCapabilities:
# drop:
@@ -208,6 +226,9 @@
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
+ # -- enable or disable the controller k8s service
+ serviceEnabled: true
+
# For minikube, set this to NodePort, elsewhere uses LoadBalancer
# Use ClusterIP if your setup includes ingress controller
# -- k8s service type
@@ -226,6 +247,10 @@
# but risks potentially imbalanced traffic spreading.
serviceExternalTrafficPolicy:
+ # If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and
+ # auto-reload on restart feature possible.
+ publishNotReadyAddresses:
+
# -- Jenkins controller service annotations
serviceAnnotations: {}
# -- Jenkins controller custom labels for the StatefulSet
@@ -328,7 +353,7 @@
agentListenerExternalTrafficPolicy:
# -- Allowed inbound IP for the agentListener service
agentListenerLoadBalancerSourceRanges:
- - 0.0.0.0/0
+ - 0.0.0.0/0
# -- Disabled agent protocols
disabledAgentProtocols:
- JNLP-connect
@@ -337,7 +362,7 @@
defaultCrumbIssuer:
# -- Enable the default CSRF Crumb issuer
enabled: true
- # -- Enable proxy compatibility
+ # -- Enable proxy compatibility. This setting is ignored if you are not on the current LTS release and will be dropped with the next LTS.
proxyCompatability: true
# Kubernetes service type for the JNLP agent service
@@ -370,7 +395,7 @@
# set allowed inbound rules on the security group assigned to the controller load balancer
# -- Allowed inbound IP addresses
loadBalancerSourceRanges:
- - 0.0.0.0/0
+ - 0.0.0.0/0
# -- Optionally assign a known public LB IP
loadBalancerIP:
@@ -393,10 +418,10 @@
# Plugins will be installed during Jenkins controller start
# -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false`
installPlugins:
- - kubernetes:4203.v1dd44f5b_1cf9
- - workflow-aggregator:596.v8c21c963d92d
- - git:5.2.1
- - configuration-as-code:1810.v9b_c30a_249a_4c
+ - kubernetes:4467.vf26561292824
+ - workflow-aggregator:608.v67378e9d3db_1
+ - git:5.10.1
+ - configuration-as-code:2100.vb_fd699d2a_09c
# If set to false, Jenkins will download the minimum required version of all dependencies.
# -- Download the minimum required version or latest version of all dependencies
@@ -533,6 +558,10 @@
authorizationStrategy: |-
loggedInUsersCanDoAnything:
allowAnonymousRead: false
+
+ # -- Annotations for the JCasC ConfigMap
+ configMapAnnotations: {}
+
# -- Custom init-container specification in raw-yaml format
customInitContainers: []
# - name: custom-init
@@ -546,7 +575,7 @@
# If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up.
# Auto-reload uses the http://<jenkins_url>/reload-configuration-as-code endpoint to reapply config when changes to
# the configScripts are detected.
- # -- Enables Jenkins Config as Code auto-reload
+ # -- Enable Jenkins Config as Code auto-reload
enabled: true
image:
# -- Registry for the image that triggers the reload
@@ -554,15 +583,37 @@
# -- Repository of the image that triggers the reload
repository: kiwigrid/k8s-sidecar
# -- Tag for the image that triggers the reload
- tag: 1.26.1
+ tag: 2.8.1
imagePullPolicy: IfNotPresent
- resources: {}
+ # -- Port for sidecar health probes
+ healthPort: 8060
+ resources:
+ {}
# limits:
# cpu: 100m
# memory: 100Mi
# requests:
# cpu: 50m
# memory: 50Mi
+ # -- Enables additional volume mounts for the config auto-reload container
+ additionalVolumeMounts:
+ []
+ # - name: auto-reload-config
+ # mountPath: /var/config/logger
+ # - name: auto-reload-logs
+ # mountPath: /var/log/auto_reload
+ # -- Config auto-reload logging settings
+ logging:
+ # See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py
+ configuration:
+ # -- Enables custom log config utilizing using the settings below.
+ override: false
+ logLevel: INFO
+ formatter: JSON
+ logToConsole: true
+ logToFile: false
+ maxBytes: 1024
+ backupCount: 3
# -- The scheme to use when connecting to the Jenkins configuration as code endpoint
scheme: http
@@ -577,7 +628,7 @@
# -- Environment variable sources for the Jenkins Config as Code auto-reload container
envFrom: []
# -- Environment variables for the Jenkins Config as Code auto-reload container
- env: {}
+ env: []
# - name: REQ_TIMEOUT
# value: "30"
@@ -651,12 +702,18 @@
# -- Update strategy for StatefulSet
updateStrategy: {}
+ # -- Topology spread constraints
+ topologySpreadConstraints: []
+
+ # -- DNS config for the pod
+ dnsConfig: {}
+
ingress:
- # -- Enables ingress
+ # -- Enables the Primary ingress
enabled: false
# Override for the default paths that map requests to the backend
- # -- Override for the default Ingress paths
+ # -- Override for the default Primary Ingress paths
paths: []
# - backend:
# serviceName: ssl-redirect
@@ -667,30 +724,36 @@
# # Don't use string here, use only integer value!
# servicePort: 8080
+ # -- Primary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix
+ pathType: ImplementationSpecific
+
# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
# For Kubernetes v1.19+, use 'networking.k8s.io/v1'
- # -- Ingress API version
- apiVersion: "extensions/v1beta1"
- # -- Ingress labels
+ # -- Primary Ingress API version
+ apiVersion: "networking.k8s.io/v1"
+ # -- Primary Ingress labels
labels: {}
- # -- Ingress annotations
- annotations: {}
+ # -- Primary Ingress annotations
+ annotations:
+ {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
# ingressClassName: nginx
+ # -- Primary Ingress ingressClassName
+ ingressClassName:
# Set this path to jenkinsUriPrefix above or use annotations to rewrite path
- # -- Ingress path
+ # -- Primary Ingress path
path:
# configures the hostname e.g. jenkins.example.com
- # -- Ingress hostname
+ # -- Primary Ingress hostname
hostName:
- # -- Hostname to serve assets from
+ # -- Primary Hostname to serve assets from
resourceRootUrl:
- # -- Ingress TLS configuration
+ # -- Primary Ingress TLS configuration
tls: []
# - secretName: jenkins.cluster.local
# hosts:
@@ -701,22 +764,32 @@
# A secondary ingress will let you expose different urls
# with a different configuration
secondaryingress:
+ # -- Enables the Secondary Ingress
enabled: false
# paths you want forwarded to the backend
# ex /github-webhook
+ # -- Secondary Ingress paths
paths: []
+ # -- Secondary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix
+ pathType: ImplementationSpecific
# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
# For Kubernetes v1.19+, use 'networking.k8s.io/v1'
- apiVersion: "extensions/v1beta1"
+ # -- Secondary Ingress API version
+ apiVersion: "networking.k8s.io/v1"
+ # -- Secondary Ingress labels
labels: {}
+ # -- Secondary Ingress annotations
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
- # ingressClassName: nginx
+ # -- Secondary Ingress ingressClassName
+ ingressClassName:
# configures the hostname e.g., jenkins-external.example.com
+ # -- Secondary Ingress hostname
hostName:
+ # -- Secondary Ingress TLS configuration
tls:
# - secretName: jenkins-external.example.com
# hosts:
@@ -750,6 +823,25 @@
# -- Route path
path:
+ # Gateway API HTTPRoute
+ httpRoute:
+ # Toggle to create an HTTPRoute resource alongside the existing ingress definition
+ enabled: false
+ apiVersion: "gateway.networking.k8s.io/v1"
+ kind: HTTPRoute
+ # specify the Gateway instance to bind the HTTPRoute to.
+ parentRefs: []
+ # - name: envoy-gateway-bundle
+ # namespace: envoy-gateway-system
+ # Reuse ingress host information if true; set to false to manage hostnames below
+ reuseIngressConfiguration: false
+ # Hostnames to use for the http route, only used if reuseIngressConfiguration is false.
+ hostnames: []
+ # Extra HTTPRoute rules that will be appended before the default backend
+ extraRules: []
+ # -- HTTPRoute annotations
+ annotations: {}
+
# -- Allows for adding entries to Pod /etc/hosts
hostAliases: []
# ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
@@ -811,9 +903,9 @@
httpsKeyStore:
# -- Enables HTTPS keystore on jenkins controller
enable: false
- # -- Name of the secret that already has ssl keystore
+ # -- Name of the secret that already has SSL keystore
jenkinsHttpsJksSecretName: ""
- # -- Name of the key in the secret that already has ssl keystore
+ # -- Name of the key in the secret that already has SSL keystore
jenkinsHttpsJksSecretKey: "jenkins-jks-file"
# -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file
jenkinsHttpsJksPasswordSecretName: ""
@@ -876,11 +968,22 @@
# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0=
agent:
+ # -- Add the environment proxy settings form jenkins controller to the agents.
+ addMasterProxyEnvVars: false
+
# -- Enable Kubernetes plugin jnlp-agent podTemplate
enabled: true
# -- The name of the pod template to use for providing default values
defaultsProviderTemplate: ""
+ # Useful for not including a serviceAccount in the template if `false`
+ # -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount`
+ useDefaultServiceAccount: true
+
+ # -- Override the default service account
+ # @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true`
+ serviceAccount:
+
# For connecting to the Jenkins controller
# -- Overrides the Kubernetes Jenkins URL
jenkinsUrl:
@@ -888,6 +991,10 @@
# connects to the specified host and port, instead of connecting directly to the Jenkins controller
# -- Overrides the Kubernetes Jenkins tunnel
jenkinsTunnel:
+ # -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI
+ skipTlsVerify: false
+ # -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI
+ usageRestricted: false
# -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5
kubernetesConnectTimeout: 5
# -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15
@@ -905,10 +1012,12 @@
# -- Custom registry used to pull the agent jnlp image from
jnlpregistry:
image:
+ # -- Registry to pull the agent jnlp image from
+ registry: ""
# -- Repository to pull the agent jnlp image from
repository: "jenkins/inbound-agent"
# -- Tag of the image to pull
- tag: "3206.vb_15dcf73f6a_9-3"
+ tag: "3383.vc8881d4b_0e76-1"
# -- Configure working directory for default agent
workingDir: "/home/jenkins/agent"
nodeUsageMode: "NORMAL"
@@ -939,12 +1048,12 @@
memory: "512Mi"
# ephemeralStorage:
livenessProbe: {}
-# execArgs: "cat /tmp/healthy"
-# failureThreshold: 3
-# initialDelaySeconds: 0
-# periodSeconds: 10
-# successThreshold: 1
-# timeoutSeconds: 1
+ # execArgs: "cat /tmp/healthy"
+ # failureThreshold: 3
+ # initialDelaySeconds: 0
+ # periodSeconds: 10
+ # successThreshold: 1
+ # timeoutSeconds: 1
# You may want to change this to true while testing a new image
# -- Always pull agent container image before build
@@ -1056,15 +1165,28 @@
# Doesn't allocate pseudo TTY by default
# -- Allocate pseudo tty to the side container
TTYEnabled: false
- # -- Max number of agents to launch
+ # -- Max number of agents to launch for a whole cluster.
containerCap: 10
+ # -- Max number of agents to launch for this type of agent
+ instanceCap: 2147483647
# -- Agent Pod base name
podName: "default"
+ # Enables garbage collection of orphan pods for this Kubernetes cloud. (beta)
+ garbageCollection:
+ # -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them.
+ enabled: false
+ # -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line.
+ namespaces: ""
+ # namespaces: |-
+ # namespaceOne
+ # namespaceTwo
+ # -- Timeout value for orphaned pods
+ timeout: 300
+
# -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it
idleMinutes: 0
-
# The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods.
# https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates
# https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
@@ -1081,6 +1203,8 @@
# -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override"
yamlMergeStrategy: "override"
+ # -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one
+ inheritYamlMergeStrategy: false
# -- Timeout in seconds for an agent to be online
connectTimeout: 100
# -- Annotations to apply to the pod
@@ -1237,13 +1361,15 @@
# -- A map of labels (keys/values) that agent pods must have to be able to connect to controller
podLabels: {}
# -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller
- namespaceLabels: {}
+ namespaceLabels:
+ {}
# project: myproject
externalAgents:
# -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16
ipCIDR:
# -- A list of IP sub-ranges to be excluded from the allowlisted IP range
- except: []
+ except:
+ []
# - 172.17.1.0/24
## Install Default RBAC roles and bindings
@@ -1252,6 +1378,8 @@
create: true
# -- Whether the Jenkins service account should be able to read Kubernetes secrets
readSecrets: false
+ # -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints
+ useOpenShiftNonRootSCC: false
serviceAccount:
# -- Configures if a ServiceAccount with this name should be created
@@ -1266,7 +1394,8 @@
extraLabels: {}
# -- Controller ServiceAccount image pull secret
imagePullSecretName:
-
+ # -- Auto-mount ServiceAccount token
+ automountServiceAccountToken: true
serviceAccountAgent:
# -- Configures if an agent ServiceAccount should be created
@@ -1281,6 +1410,8 @@
extraLabels: {}
# -- Agent ServiceAccount image pull secret
imagePullSecretName:
+ # -- Auto-mount ServiceAccount token
+ automountServiceAccountToken: true
# -- Checks if any deprecated values are used
checkDeprecation: true
@@ -1303,4 +1434,4 @@
# -- Repository of the image used to test the framework
repository: "bats/bats"
# -- Tag of the image to test the framework
- tag: "1.11.0"
+ tag: "1.13.0"