diff --git a/stable/jenkins/CHANGELOG.md b/stable/jenkins/CHANGELOG.md index b84df7bcb3..eaa1aed9cc 100644 --- a/stable/jenkins/CHANGELOG.md +++ b/stable/jenkins/CHANGELOG.md @@ -6,11 +6,26 @@ numbering uses [semantic versioning](http://semver.org). NOTE: The change log until version 1.5.7 is auto generated based on git commits. Those include a reference to the git commit to be able to get more details. +## 1.8.0 JCasC auto reload works without ssh keys + +We make use of the fact that the Jenkins Configuration as Code Plugin can be triggered via http `POST` to `JENKINS_URL/configuration-as-code/reload`and a pre-shared key. +The sidecar container responsible for reloading config changes is now `kiwigrid/k8s-sidecar:0.1.20` instead of it's fork `shadwell/k8s-sidecar`. + +References: +- [Triggering Configuration Reload](https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md) +- [kiwigrid/k8s-sidecar](https://hub.docker.com/r/kiwigrid/k8s-sidecar) + +`master.sidecars.configAutoReload.enabled` now works using `casc.reload.token` + ## 1.7.10 Disable direct connection in default configuration (when kubernetes plugin version >= 1.20.2). Note: In case direct connection is going to be used `jenkins/jnlp-slave` needs to be version `3.35-5` or newer. +## 1.7.9 + +Prevented Jenkins Setup Wizard on new installations + ## 1.7.8 Extend extraPorts to be opened on the Service object, not just the container. diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index b1d9d5643f..24813b78fd 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: jenkins home: https://jenkins.io/ -version: 1.7.10 +version: 1.8.0 appVersion: lts description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index 3789e4eb0a..1069b87272 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -136,7 +136,7 @@ The following tables list the configurable parameters of the Jenkins chart and t | `master.enableXmlConfig` | enables configuration done via XML files | `false` | | `master.sidecars.configAutoReload` | Jenkins Config as Code auto-reload settings | | | `master.sidecars.configAutoReload.enabled` | Jenkins Config as Code auto-reload settings (Attention: rbac needs to be enabled otherwise the sidecar can't read the config map) | `false` | -| `master.sidecars.configAutoReload.image` | Image which triggers the reload | `shadwell/k8s-sidecar:0.0.2` | +| `master.sidecars.configAutoReload.image` | Image which triggers the reload | `kiwigrid/k8s-sidecar:0.1.20` | | `master.sidecars.other` | Configures additional sidecar container(s) for Jenkins master | `[]` | | `master.initScripts` | List of Jenkins init scripts | `[]` | | `master.credentialsXmlSecret` | Kubernetes secret that contains a 'credentials.xml' file | Not set | diff --git a/stable/jenkins/templates/config.yaml b/stable/jenkins/templates/config.yaml index 1fac4a1d89..1156508053 100644 --- a/stable/jenkins/templates/config.yaml +++ b/stable/jenkins/templates/config.yaml @@ -261,12 +261,6 @@ data: {{- if .Values.master.scriptApproval }} yes n | cp -i /var/jenkins_config/scriptapproval.xml /var/jenkins_home/scriptApproval.xml; {{- end }} -{{- if and (.Values.master.JCasC.enabled) (.Values.master.sidecars.configAutoReload.enabled) }} - {{- if not .Values.master.initScripts }} - mkdir -p /var/jenkins_home/init.groovy.d/; - yes n | cp -i /var/jenkins_config/*.groovy /var/jenkins_home/init.groovy.d/; - {{- end }} -{{- end }} {{- if .Values.master.initScripts }} mkdir -p /var/jenkins_home/init.groovy.d/; {{- if .Values.master.overwriteConfig }} @@ -274,10 +268,8 @@ data: {{- end }} yes n | cp -i /var/jenkins_config/*.groovy /var/jenkins_home/init.groovy.d/; {{- end }} -{{- if .Values.master.JCasC.enabled }} - {{- if .Values.master.sidecars.configAutoReload.enabled }} - bash -c 'ssh-keygen -y -f <(echo "${ADMIN_PRIVATE_KEY}") > /var/jenkins_home/key.pub' - {{- else }} +{{- if .Values.master.JCasC.enabled}} + {{- if not .Values.master.sidecars.configAutoReload.enabled }} mkdir -p /var/jenkins_home/casc_configs; rm -rf /var/jenkins_home/casc_configs/* cp -v /var/jenkins_config/*.yaml /var/jenkins_home/casc_configs @@ -302,25 +294,7 @@ data: {{ $val | indent 4 }} {{- end }} {{- if .Values.master.JCasC.enabled }} - {{- if .Values.master.sidecars.configAutoReload.enabled }} - init-add-ssh-key-to-admin.groovy: |- - import jenkins.security.* - import hudson.model.User - import jenkins.model.Jenkins - User user = User.getOrCreateByIdOrFullName("{{ .Values.master.adminUser | default "admin" }}") - if (user == null) { - System.err.println("ERROR: user '{{ .Values.master.adminUser | default "admin" }}' not found! Can't configure SSH key which is needed to reload JCasC config!") - } else { - String sshKeyString = new File('/var/jenkins_home/key.pub').text - keys_param = new org.jenkinsci.main.modules.cli.auth.ssh.UserPropertyImpl(sshKeyString) - user.addProperty(keys_param) - def inst = Jenkins.getInstance() - def sshDesc = inst.getDescriptor("org.jenkinsci.main.modules.sshd.SSHD") - sshDesc.setPort({{ .Values.master.sidecars.configAutoReload.sshTcpPort | default 1044 }}) - sshDesc.getActualPort() - sshDesc.save() - } - {{- else }} + {{- if not .Values.master.sidecars.configAutoReload.enabled }} # Only add config to this script if we aren't auto-reloading otherwise the pod will restart upon each config change: {{- if .Values.master.JCasC.defaultConfig }} jcasc-default-config.yaml: |- diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index 45060de6a7..5a9bcd9a97 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -101,15 +101,6 @@ spec: secretKeyRef: name: {{ template "jenkins.fullname" . }} key: jenkins-admin-user - {{- if or (.Values.master.adminSshKey) (.Values.master.sidecars.configAutoReload.enabled) }} - {{- if .Values.master.JCasC.enabled }} - - name: ADMIN_PRIVATE_KEY - valueFrom: - secretKeyRef: - name: {{ template "jenkins.fullname" . }} - key: {{ "jenkins-admin-private-key" | quote }} - {{- end }} - {{- end }} {{- end }} {{- if .Values.master.initContainerEnv }} {{ toYaml .Values.master.initContainerEnv | indent 12 }} @@ -167,8 +158,14 @@ spec: {{ toYaml .Values.master.lifecycle | indent 12 }} {{- end }} env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name - name: JAVA_OPTS - value: {{ default "" .Values.master.javaOpts | quote }} + value: > + {{ default "" .Values.master.javaOpts }} + {{- if .Values.master.sidecars.configAutoReload.enabled }} -Dcasc.reload.token=$(POD_NAME) {{end}} - name: JENKINS_OPTS value: "{{ if .Values.master.jenkinsUriPrefix }}--prefix={{ .Values.master.jenkinsUriPrefix }} {{ end }}{{ default "" .Values.master.jenkinsOpts}}" - name: JENKINS_SLAVE_AGENT_PORT @@ -184,15 +181,6 @@ spec: secretKeyRef: name: {{ template "jenkins.fullname" . }} key: jenkins-admin-user - {{- if or (.Values.master.adminSshKey) (.Values.master.sidecars.configAutoReload.enabled) }} - {{- if .Values.master.JCasC.enabled }} - - name: ADMIN_PRIVATE_KEY - valueFrom: - secretKeyRef: - name: {{ template "jenkins.fullname" . }} - key: {{ "jenkins-admin-private-key" | quote }} - {{- end }} - {{- end }} {{- end }} {{- if .Values.master.containerEnv }} {{ toYaml .Values.master.containerEnv | indent 12 }} @@ -284,38 +272,24 @@ spec: {{- end }} {{- if and (.Values.master.JCasC.enabled) (.Values.master.sidecars.configAutoReload.enabled) }} - - name: {{ template "jenkins.name" . }}-sc-config + - name: jenkins-sc-config image: "{{ .Values.master.sidecars.configAutoReload.image }}" imagePullPolicy: {{ .Values.master.sidecars.configAutoReload.imagePullPolicy }} env: - - name: JENKINSRELOADCONFIG - value: "true" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name - name: LABEL value: "{{ template "jenkins.fullname" . }}-jenkins-config" - name: FOLDER value: "{{ .Values.master.sidecars.configAutoReload.folder }}" - name: NAMESPACE - value: "{{ .Values.master.sidecars.configAutoReload.searchNamespace }}" - - name: SSH_PORT - value: "{{ .Values.master.sidecars.configAutoReload.sshTcpPort }}" - - name: JENKINS_PORT - value: "{{ .Values.master.targetPort }}" - {{- if .Values.master.useSecurity }} - - name: ADMIN_USER - valueFrom: - secretKeyRef: - name: {{ template "jenkins.fullname" . }} - key: jenkins-admin-user - {{- if or (.Values.master.adminSshKey) (.Values.master.sidecars.configAutoReload.enabled) }} - {{- if .Values.master.JCasC.enabled }} - - name: ADMIN_PRIVATE_KEY - valueFrom: - secretKeyRef: - name: {{ template "jenkins.fullname" . }} - key: {{ "jenkins-admin-private-key" | quote }} - {{- end }} - {{- end }} - {{- end }} + value: "{{ .Values.master.sidecars.configAutoReload.searchNamespace | default .Release.Namespace }}" + - name: REQ_URL + value: "http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" + - name: REQ_METHOD + value: "POST" resources: {{ toYaml .Values.master.sidecars.configAutoReload.resources | indent 12 }} volumeMounts: diff --git a/stable/jenkins/templates/secret.yaml b/stable/jenkins/templates/secret.yaml index 6a218a7319..3e97bdf471 100644 --- a/stable/jenkins/templates/secret.yaml +++ b/stable/jenkins/templates/secret.yaml @@ -17,12 +17,5 @@ data: {{ else -}} jenkins-admin-password: {{ randAlphaNum 10 | b64enc | quote }} {{ end -}} - {{ if and (.Values.master.JCasC.enabled) (.Values.master.sidecars.configAutoReload.enabled) -}} - {{ if not .Values.master.adminSshKey -}} - {{ ( include "jenkins.gen-key" . ) }} - {{ else -}} - jenkins-admin-private-key: {{ .Values.master.adminSshKey | b64enc | quote }} - {{ end -}} - {{ end -}} jenkins-admin-user: {{ .Values.master.adminUser | b64enc | quote }} {{- end }} diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index 2762ba239f..ec4f89d821 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -224,7 +224,7 @@ master: # over SSH to reapply config when changes to the configScripts are detected. The admin user (or account you specify in # master.adminUser) will have a random SSH private key (RSA 4096) assigned unless you specify adminSshKey. This will be saved to a k8s secret. enabled: false - image: shadwell/k8s-sidecar:0.0.2 + image: kiwigrid/k8s-sidecar:0.1.20 imagePullPolicy: IfNotPresent resources: {} # limits: