From 63653fd596a88f2cf45139999155ec60d7b422b2 Mon Sep 17 00:00:00 2001 From: Jacob LeGrone Date: Sun, 1 Jul 2018 15:39:18 -0400 Subject: [PATCH] Make jenkins master pod security context optional (#6122) Cluster configurations may include mutating admission controllers which dynamically add security contexts to pods and containers. OpenShift uses this pattern to implement required uid ranges that differ on a per-namespace basis, and OpenShift's security admission plugin rejects any pods that make runAsUser requests outside of that valid uid range. Removing the securityContext field from the Jenkins pod spec allows the OpenShift security admission plugin to assign a uid in the correct range to each container in the pod on behalf of the user, avoiding the need to provide helm with a different runAsUser value for each namespace in which Jenkins is deployed. --- stable/jenkins/Chart.yaml | 2 +- stable/jenkins/README.md | 1 + stable/jenkins/templates/jenkins-master-deployment.yaml | 2 ++ stable/jenkins/values.yaml | 2 ++ 4 files changed, 6 insertions(+), 1 deletion(-) diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index 60bd252b01..cc41b520d3 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,6 +1,6 @@ name: jenkins home: https://jenkins.io/ -version: 0.16.5 +version: 0.16.6 appVersion: 2.121.1 description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index 9417081200..d68baef7de 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -41,6 +41,7 @@ The following tables list the configurable parameters of the Jenkins chart and t | `Master.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 50m, memory: 256Mi}, limits: {cpu: 2000m, memory: 2048Mi}}`| | `Master.InitContainerEnv` | Environment variables for Init Container | Not set | | `Master.ContainerEnv` | Environment variables for Jenkins Container | Not set | +| `Master.UsePodSecurityContext` | Enable pod security context (must be `true` if `RunAsUser` or `FsGroup` are set) | `true` | | `Master.RunAsUser` | uid that jenkins runs with | `0` | | `Master.FsGroup` | uid that will be used for persistent volume | `0` | | `Master.ServiceAnnotations` | Service annotations | `{}` | diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index 0eaf6a524a..c909656c30 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -40,12 +40,14 @@ spec: affinity: {{ toYaml .Values.Master.Affinity | indent 8 }} {{- end }} +{{- if .Values.Master.UsePodSecurityContext }} securityContext: runAsUser: {{ default 0 .Values.Master.RunAsUser }} {{- if and (.Values.Master.RunAsUser) (.Values.Master.FsGroup) }} {{- if not (eq .Values.Master.RunAsUser 0.0) }} fsGroup: {{ .Values.Master.FsGroup }} {{- end }} +{{- end }} {{- end }} serviceAccountName: {{ if .Values.rbac.install }}{{ template "jenkins.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} initContainers: diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index feedb211d1..f5b8e31505 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -36,6 +36,8 @@ Master: # JavaOpts: "-Xms512m -Xmx512m" # JenkinsOpts: "" # JenkinsUriPrefix: "/jenkins" + # Enable pod security context (must be `true` if RunAsUser or FsGroup are set) + UsePodSecurityContext: true # Set RunAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. # When setting RunAsUser to a different value than 0 also set FsGroup to the same value: # RunAsUser: