mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Allow users to supply their own admin ssh key via helm values instead of expecting them to manually edit the secret produced by this chart with kubectl Signed-off-by: Keith Shook <kshook@onecause.com>
This commit is contained in:
Keith Shook
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
b086d6d01c
commit
80a8c9eb6f
@@ -1,6 +1,6 @@
|
||||
name: jenkins
|
||||
home: https://jenkins.io/
|
||||
version: 0.35.2
|
||||
version: 0.36.0
|
||||
appVersion: lts
|
||||
description: Open source continuous integration server. It supports multiple SCM tools
|
||||
including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based
|
||||
|
||||
@@ -258,7 +258,7 @@ ConfigScripts:
|
||||
|
||||
Further JCasC examples can be found [here.](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos)
|
||||
### Config as Code with and without auto-reload
|
||||
Config as Code changes (to Master.JCasC.ConfigScripts) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. If you choose `Master.Sidecars.autoConfigReload.enabled: true`, a second, auxiliary container will be installed into the Jenkins master pod, known as a "sidecar". This watches for changes to ConfigScripts, copies the content onto the Jenkins file-system and issues a CLI command via SSH to reload configuration. The admin user (or account you specify in Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify `Master.OwnSshKey: true`. This will be saved to a k8s secret. You can monitor this sidecar's logs using command `kubectl logs <master_pod> -c jenkins-sc-config -f`
|
||||
Config as Code changes (to Master.JCasC.ConfigScripts) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. If you choose `Master.Sidecars.autoConfigReload.enabled: true`, a second, auxiliary container will be installed into the Jenkins master pod, known as a "sidecar". This watches for changes to ConfigScripts, copies the content onto the Jenkins file-system and issues a CLI command via SSH to reload configuration. The admin user (or account you specify in Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify a key in `Master.AdminSshKey`. This will be saved to a k8s secret. You can monitor this sidecar's logs using command `kubectl logs <master_pod> -c jenkins-sc-config -f`
|
||||
If you want to enable auto-reload then you also need to configure rbac as the container which triggers the reload needs to watch the config maps.
|
||||
|
||||
```yaml
|
||||
|
||||
@@ -8,6 +8,7 @@ Master.Ingress.Annotations --> Master.ingress.annotations
|
||||
Master.Ingress.Labels --> Master.ingress.labels
|
||||
Master.Ingress.Path --> Master.ingress.path
|
||||
Master.Ingress.TLS --> Master.ingress.tls
|
||||
Master.OwnSshKey, a bool, has been replaced with Master.AdminSshKey, which is expected to be a string containing the actual key
|
||||
|
||||
1. Get your '{{ .Values.Master.AdminUser }}' user password by running:
|
||||
printf $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "jenkins.fullname" . }} -o jsonpath="{.data.jenkins-admin-password}" | base64 --decode);echo
|
||||
|
||||
@@ -37,8 +37,8 @@ If release name contains chart name it will be used as a full name.
|
||||
Generate private key for jenkins CLI
|
||||
*/}}
|
||||
{{- define "jenkins.gen-key" -}}
|
||||
{{- if not .Values.Master.OwnSshKey -}}
|
||||
{{- if not .Values.Master.AdminSshKey -}}
|
||||
{{- $key := genPrivateKey "rsa" -}}
|
||||
jenkins-admin-private-key: {{ $key | b64enc }}
|
||||
jenkins-admin-private-key: {{ $key | b64enc | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -89,7 +89,7 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "jenkins.fullname" . }}
|
||||
key: jenkins-admin-user
|
||||
{{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if .Values.Master.JCasC.enabled }}
|
||||
- name: ADMIN_PRIVATE_KEY
|
||||
valueFrom:
|
||||
@@ -162,7 +162,7 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "jenkins.fullname" . }}
|
||||
key: jenkins-admin-user
|
||||
{{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if .Values.Master.JCasC.enabled }}
|
||||
- name: ADMIN_PRIVATE_KEY
|
||||
valueFrom:
|
||||
@@ -287,7 +287,7 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "jenkins.fullname" . }}
|
||||
key: jenkins-admin-user
|
||||
{{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{- if .Values.Master.JCasC.enabled }}
|
||||
- name: ADMIN_PRIVATE_KEY
|
||||
valueFrom:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if .Values.Master.UseSecurity }}
|
||||
{{- if .Values.Master.UseSecurity -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
@@ -10,15 +10,17 @@ metadata:
|
||||
heritage: "{{ .Release.Service }}"
|
||||
type: Opaque
|
||||
data:
|
||||
{{ if .Values.Master.AdminPassword }}
|
||||
{{ if .Values.Master.AdminPassword -}}
|
||||
jenkins-admin-password: {{ .Values.Master.AdminPassword | b64enc | quote }}
|
||||
{{ else }}
|
||||
{{ else -}}
|
||||
jenkins-admin-password: {{ randAlphaNum 10 | b64enc | quote }}
|
||||
{{ end }}
|
||||
{{ if and (.Values.Master.JCasC.enabled) (.Values.Master.Sidecars.configAutoReload.enabled) }}
|
||||
{{ if not .Values.Master.OwnSshKey }}
|
||||
{{ end -}}
|
||||
{{ if and (.Values.Master.JCasC.enabled) (.Values.Master.Sidecars.configAutoReload.enabled) -}}
|
||||
{{ if not .Values.Master.AdminSshKey -}}
|
||||
{{ ( include "jenkins.gen-key" . ) }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ else -}}
|
||||
jenkins-admin-private-key: {{ .Values.Master.AdminSshKey | b64enc | quote }}
|
||||
{{ end -}}
|
||||
{{ end -}}
|
||||
jenkins-admin-user: {{ .Values.Master.AdminUser | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -34,11 +34,9 @@ Master:
|
||||
# you should revert Master.AdminUser to your preferred admin user:
|
||||
AdminUser: admin
|
||||
# AdminPassword: <defaults to random>
|
||||
OwnSshKey: false
|
||||
# If CasC auto-reload is enabled, an SSH (RSA) keypair is needed. Can either provide your own, or leave unconfigured\false to allow a random key to be auto-generated.
|
||||
# If you choose to use your own, you must upload your decrypted RSA private key (not the public key above) to a Kubernetes secret using the following command:
|
||||
# kubectl -n <namespace> create secret generic <helm_release_name> --dry-run --from-file=jenkins-admin-private-key=~/.ssh/id_rsa -o yaml |kubectl -n <namespace> apply -f -
|
||||
# Replace ~/.ssh/id_rsa in the above command with the path to your private key file and the <helm_release_name> and <namespace> placeholders to suit.
|
||||
# AdminSshKey: <defaults to auto-generated>
|
||||
# If CasC auto-reload is enabled, an SSH (RSA) keypair is needed. Can either provide your own, or leave unconfigured to allow a random key to be auto-generated.
|
||||
# If you supply your own, it is recommended that the values file that contains your key not be committed to source control in an unencrypted format
|
||||
RollingUpdate: {}
|
||||
# Ignored if Persistence is enabled
|
||||
# maxSurge: 1
|
||||
@@ -190,7 +188,7 @@ Master:
|
||||
# If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified,
|
||||
# jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the Jenkins CLI
|
||||
# over SSH to reapply config when changes to the ConfigScripts are detected. The admin user (or account you specify in
|
||||
# Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify OwnSshKey: true. This will be saved to a k8s secret.
|
||||
# Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify AdminSshKey. This will be saved to a k8s secret.
|
||||
enabled: false
|
||||
image: shadwell/k8s-sidecar:0.0.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
Reference in New Issue
Block a user