[stable/jenkins] Add support for idleMinutes and serviceAccount (#13263)

* [stable/jenkins] Add support for idleMinutes and serviceAccount

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

* Modify agent service account feature to follow best practices

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

* Conditionally set namespace for agent service account

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

* Add missing period

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

* Bump version again

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

* Fix name collision when creating both service accounts but not specifying their names

Signed-off-by: Joshua Bussdieker <jbussdieker@gmail.com>

stable/jenkins/Chart.yaml

@@ -1,6 +1,6 @@
 name: jenkins
 home: https://jenkins.io/
-version: 1.1.6
+version: 1.1.7
 appVersion: lts
 description: Open source continuous integration server. It supports multiple SCM tools
   including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based

stable/jenkins/README.md

@@ -118,6 +118,9 @@ The following tables list the configurable parameters of the Jenkins chart and t
 | `serviceAccount.name`             | name of the ServiceAccount to be used by access-controlled resources | autogenerated |
 | `serviceAccount.create`           | Configures if a ServiceAccount with this name should be created | `true`         |
 | `serviceAccount.annotations`      | Configures annotation for the ServiceAccount | `{}`                              |
+| `serviceAccountAgent.name`        | name of the agent ServiceAccount to be used by access-controlled resources | autogenerated |
+| `serviceAccountAgent.create`      | Configures if an agent ServiceAccount with this name should be created | `false`         |
+| `serviceAccountAgent.annotations` | Configures annotation for the agent ServiceAccount | `{}`                              |
 
 
 Some third-party systems, e.g. GitHub, use HTML-formatted data in their payload sent to a Jenkins webhooks, e.g. URL of a pull-request being built. To display such data as processed HTML instead of raw text set `master.enableRawHtmlMarkupFormatter` to true. This option requires installation of OWASP Markup Formatter Plugin (antisamy-markup-formatter). The plugin is **not** installed by default, please update `master.installPlugins`.
@@ -142,6 +145,7 @@ Some third-party systems, e.g. GitHub, use HTML-formatted data in their payload
 | `agent.TTYEnabled`         | Allocate pseudo tty to the side container       | false                  |
 | `agent.containerCap`       | Maximum number of agent                         | 10                     |
 | `agent.podName`            | slave Pod base name                             | Not set                |
+| `agent.idleMinutes`        | Allows the Pod to remain active for reuse       | 0                      |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.

stable/jenkins/templates/_helpers.tpl

@@ -53,3 +53,14 @@ Create the name of the service account to use
     {{ default "default" .Values.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account for Jenkins agents to use
+*/}}
+{{- define "jenkins.serviceAccountAgentName" -}}
+{{- if .Values.serviceAccountAgent.create -}}
+    {{ default (printf "%s-%s" (include "jenkins.fullname" .) "agent") .Values.serviceAccountAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccountAgent.name }}
+{{- end -}}
+{{- end -}}

stable/jenkins/templates/config.yaml

@@ -44,8 +44,9 @@ data:
               <inheritFrom></inheritFrom>
               <name>{{ .Values.agent.podName }}</name>
               <instanceCap>2147483647</instanceCap>
-              <idleMinutes>0</idleMinutes>
+              <idleMinutes>{{ .Values.agent.idleMinutes }}</idleMinutes>
               <label>{{ .Release.Name }}-{{ .Values.agent.componentName }} {{ .Values.agent.customJenkinsLabels  | join " " }}</label>
+              <serviceAccount>{{ include "jenkins.serviceAccountAgentName" . }}</serviceAccount>
               <nodeSelector>
                 {{- $local := dict "first" true }}
                 {{- range $key, $value := .Values.agent.nodeSelector }}

stable/jenkins/templates/service-account-agent.yaml

@@ -0,0 +1,19 @@
+{{ if .Values.serviceAccountAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jenkins.serviceAccountAgentName" . }}
+{{- if .Values.master.slaveKubernetesNamespace }}
+  namespace: {{ .Values.master.slaveKubernetesNamespace }}
+{{ end }}
+{{- if .Values.serviceAccountAgent.annotations }}
+  annotations:
+{{ toYaml .Values.serviceAccountAgent.annotations | indent 4 }}
+{{ end }}
+  labels:
+    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
+    "helm.sh/chart": "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
+    "app.kubernetes.io/instance": "{{ .Release.Name }}"
+    "app.kubernetes.io/component": "{{ .Values.master.componentName }}"
+{{ end }}

stable/jenkins/values.yaml

@@ -353,6 +353,9 @@ agent:
   containerCap: 10
   # Pod name
   podName: "default"
+  # Allows the Pod to remain active for reuse until the configured number of
+  # minutes has passed since the last step was executed on it.
+  idleMinutes: 0
 
 persistence:
   enabled: true
@@ -396,6 +399,14 @@ serviceAccount:
   name:
   annotations: {}
 
+serviceAccountAgent:
+  # Specifies whether a ServiceAccount should be created
+  create: false
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+  annotations: {}
+
 ## Backup cronjob configuration
 ## Ref: https://github.com/nuvo/kube-tasks
 backup: