From 80a8c9eb6fb6c75ef25ed29aad22f7b26bbdf587 Mon Sep 17 00:00:00 2001 From: Keith Shook <3358621+kashook@users.noreply.github.com> Date: Mon, 25 Mar 2019 00:01:06 -0400 Subject: [PATCH] [stable/jenkins] Replace OwnSshKey with AdminSshKey (#12140) (#12466) Allow users to supply their own admin ssh key via helm values instead of expecting them to manually edit the secret produced by this chart with kubectl Signed-off-by: Keith Shook --- stable/jenkins/Chart.yaml | 2 +- stable/jenkins/README.md | 2 +- stable/jenkins/templates/NOTES.txt | 1 + stable/jenkins/templates/_helpers.tpl | 4 ++-- .../templates/jenkins-master-deployment.yaml | 6 +++--- stable/jenkins/templates/secret.yaml | 20 ++++++++++--------- stable/jenkins/values.yaml | 10 ++++------ 7 files changed, 23 insertions(+), 22 deletions(-) diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index de8f2e18d5..7857f7e4fb 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,6 +1,6 @@ name: jenkins home: https://jenkins.io/ -version: 0.35.2 +version: 0.36.0 appVersion: lts description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index 5dc26b0247..a557fe89f9 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -258,7 +258,7 @@ ConfigScripts: Further JCasC examples can be found [here.](https://github.com/jenkinsci/configuration-as-code-plugin/tree/master/demos) ### Config as Code with and without auto-reload -Config as Code changes (to Master.JCasC.ConfigScripts) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. If you choose `Master.Sidecars.autoConfigReload.enabled: true`, a second, auxiliary container will be installed into the Jenkins master pod, known as a "sidecar". This watches for changes to ConfigScripts, copies the content onto the Jenkins file-system and issues a CLI command via SSH to reload configuration. The admin user (or account you specify in Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify `Master.OwnSshKey: true`. This will be saved to a k8s secret. You can monitor this sidecar's logs using command `kubectl logs -c jenkins-sc-config -f` +Config as Code changes (to Master.JCasC.ConfigScripts) can either force a new pod to be created and only be applied at next startup, or can be auto-reloaded on-the-fly. If you choose `Master.Sidecars.autoConfigReload.enabled: true`, a second, auxiliary container will be installed into the Jenkins master pod, known as a "sidecar". This watches for changes to ConfigScripts, copies the content onto the Jenkins file-system and issues a CLI command via SSH to reload configuration. The admin user (or account you specify in Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify a key in `Master.AdminSshKey`. This will be saved to a k8s secret. You can monitor this sidecar's logs using command `kubectl logs -c jenkins-sc-config -f` If you want to enable auto-reload then you also need to configure rbac as the container which triggers the reload needs to watch the config maps. ```yaml diff --git a/stable/jenkins/templates/NOTES.txt b/stable/jenkins/templates/NOTES.txt index 2d6512e234..2f7bde97b8 100644 --- a/stable/jenkins/templates/NOTES.txt +++ b/stable/jenkins/templates/NOTES.txt @@ -8,6 +8,7 @@ Master.Ingress.Annotations --> Master.ingress.annotations Master.Ingress.Labels --> Master.ingress.labels Master.Ingress.Path --> Master.ingress.path Master.Ingress.TLS --> Master.ingress.tls +Master.OwnSshKey, a bool, has been replaced with Master.AdminSshKey, which is expected to be a string containing the actual key 1. Get your '{{ .Values.Master.AdminUser }}' user password by running: printf $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "jenkins.fullname" . }} -o jsonpath="{.data.jenkins-admin-password}" | base64 --decode);echo diff --git a/stable/jenkins/templates/_helpers.tpl b/stable/jenkins/templates/_helpers.tpl index 3a0569cc98..8a54f65db1 100644 --- a/stable/jenkins/templates/_helpers.tpl +++ b/stable/jenkins/templates/_helpers.tpl @@ -37,8 +37,8 @@ If release name contains chart name it will be used as a full name. Generate private key for jenkins CLI */}} {{- define "jenkins.gen-key" -}} -{{- if not .Values.Master.OwnSshKey -}} +{{- if not .Values.Master.AdminSshKey -}} {{- $key := genPrivateKey "rsa" -}} -jenkins-admin-private-key: {{ $key | b64enc }} +jenkins-admin-private-key: {{ $key | b64enc | quote }} {{- end -}} {{- end -}} diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index 35d57ad3d3..f4f17c2950 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -89,7 +89,7 @@ spec: secretKeyRef: name: {{ template "jenkins.fullname" . }} key: jenkins-admin-user - {{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} + {{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} {{- if .Values.Master.JCasC.enabled }} - name: ADMIN_PRIVATE_KEY valueFrom: @@ -162,7 +162,7 @@ spec: secretKeyRef: name: {{ template "jenkins.fullname" . }} key: jenkins-admin-user - {{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} + {{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} {{- if .Values.Master.JCasC.enabled }} - name: ADMIN_PRIVATE_KEY valueFrom: @@ -287,7 +287,7 @@ spec: secretKeyRef: name: {{ template "jenkins.fullname" . }} key: jenkins-admin-user - {{- if or (.Values.Master.OwnSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} + {{- if or (.Values.Master.AdminSshKey) (.Values.Master.Sidecars.configAutoReload.enabled) }} {{- if .Values.Master.JCasC.enabled }} - name: ADMIN_PRIVATE_KEY valueFrom: diff --git a/stable/jenkins/templates/secret.yaml b/stable/jenkins/templates/secret.yaml index edf1250b2b..2b18a75971 100644 --- a/stable/jenkins/templates/secret.yaml +++ b/stable/jenkins/templates/secret.yaml @@ -1,4 +1,4 @@ -{{- if .Values.Master.UseSecurity }} +{{- if .Values.Master.UseSecurity -}} apiVersion: v1 kind: Secret metadata: @@ -10,15 +10,17 @@ metadata: heritage: "{{ .Release.Service }}" type: Opaque data: - {{ if .Values.Master.AdminPassword }} + {{ if .Values.Master.AdminPassword -}} jenkins-admin-password: {{ .Values.Master.AdminPassword | b64enc | quote }} - {{ else }} + {{ else -}} jenkins-admin-password: {{ randAlphaNum 10 | b64enc | quote }} - {{ end }} - {{ if and (.Values.Master.JCasC.enabled) (.Values.Master.Sidecars.configAutoReload.enabled) }} - {{ if not .Values.Master.OwnSshKey }} + {{ end -}} + {{ if and (.Values.Master.JCasC.enabled) (.Values.Master.Sidecars.configAutoReload.enabled) -}} + {{ if not .Values.Master.AdminSshKey -}} {{ ( include "jenkins.gen-key" . ) }} - {{ end }} - {{ end }} + {{ else -}} + jenkins-admin-private-key: {{ .Values.Master.AdminSshKey | b64enc | quote }} + {{ end -}} + {{ end -}} jenkins-admin-user: {{ .Values.Master.AdminUser | b64enc | quote }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index fe6eaba4ac..bff19eb2c1 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -34,11 +34,9 @@ Master: # you should revert Master.AdminUser to your preferred admin user: AdminUser: admin # AdminPassword: - OwnSshKey: false - # If CasC auto-reload is enabled, an SSH (RSA) keypair is needed. Can either provide your own, or leave unconfigured\false to allow a random key to be auto-generated. - # If you choose to use your own, you must upload your decrypted RSA private key (not the public key above) to a Kubernetes secret using the following command: - # kubectl -n create secret generic --dry-run --from-file=jenkins-admin-private-key=~/.ssh/id_rsa -o yaml |kubectl -n apply -f - - # Replace ~/.ssh/id_rsa in the above command with the path to your private key file and the and placeholders to suit. + # AdminSshKey: + # If CasC auto-reload is enabled, an SSH (RSA) keypair is needed. Can either provide your own, or leave unconfigured to allow a random key to be auto-generated. + # If you supply your own, it is recommended that the values file that contains your key not be committed to source control in an unencrypted format RollingUpdate: {} # Ignored if Persistence is enabled # maxSurge: 1 @@ -190,7 +188,7 @@ Master: # If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified, # jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the Jenkins CLI # over SSH to reapply config when changes to the ConfigScripts are detected. The admin user (or account you specify in - # Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify OwnSshKey: true. This will be saved to a k8s secret. + # Master.AdminUser) will have a random SSH private key (RSA 4096) assigned unless you specify AdminSshKey. This will be saved to a k8s secret. enabled: false image: shadwell/k8s-sidecar:0.0.2 imagePullPolicy: IfNotPresent