[stable/jenkins] Fix: Always mount jenkins-secrets volume if secretsFilesSecret is set (#16512)

* Fix: Always mount jenkins-secrets volume if secretsFilesSecret is set

Signed-off-by: Mikael Bergemalm <mbergemalm@gmail.com>

* Trim config conditional

Signed-off-by: Mikael Bergemalm <mbergemalm@gmail.com>

* Bump version and add info to changelog

Signed-off-by: Mikael Bergemalm <mbergemalm@gmail.com>

stable/jenkins/CHANGELOG.md

@@ -6,6 +6,10 @@ numbering uses [semantic versioning](http://semver.org).
 
 NOTE: The change log until version 1.5.7 is auto generated based on git commits. Those include a reference to the git commit to be able to get more details.
 
+## 1.5.8
+
+Fixed an issue when master.enableXmlConfig is set to false: Always mount jenkins-secrets volume if secretsFilesSecret is set (#16512)
+
 ## 1.5.7
 
 added initial changelog (#16324)

stable/jenkins/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: jenkins
 home: https://jenkins.io/
-version: 1.5.7
+version: 1.5.8
 appVersion: lts
 description: Open source continuous integration server. It supports multiple SCM tools
   including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based

stable/jenkins/templates/config.yaml

@@ -214,8 +214,8 @@ data:
     </jenkins.CLI>
 {{- end }}
   apply_config.sh: |-
-{{- if .Values.master.enableXmlConfig }}
     mkdir -p /usr/share/jenkins/ref/secrets/;
+{{- if .Values.master.enableXmlConfig }}
     echo "false" > /usr/share/jenkins/ref/secrets/slave-to-master-security-kill-switch;
 {{- if .Values.master.overwriteConfig }}
     cp /var/jenkins_config/config.xml /var/jenkins_home;
@@ -278,9 +278,6 @@ data:
 {{- if .Values.master.credentialsXmlSecret }}
     yes n | cp -i /var/jenkins_credentials/credentials.xml /var/jenkins_home;
 {{- end }}
-{{- if .Values.master.secretsFilesSecret }}
-    yes n | cp -i /var/jenkins_secrets/* /usr/share/jenkins/ref/secrets/;
-{{- end }}
 {{- if .Values.master.jobs }}
     for job in $(ls /var/jenkins_jobs); do
       mkdir -p /var/jenkins_home/jobs/$job
@@ -288,6 +285,9 @@ data:
     done
 {{- end }}
 {{- end }}
+{{- if .Values.master.secretsFilesSecret }}
+    yes n | cp -i /var/jenkins_secrets/* /usr/share/jenkins/ref/secrets/;
+{{- end }}
 {{- range $key, $val := .Values.master.initScripts }}
   init{{ $key }}.groovy: |-
 {{ $val | indent 4 }}

stable/jenkins/templates/jenkins-master-deployment.yaml

@@ -132,16 +132,18 @@ spec:
               name: jenkins-credentials
               readOnly: true
             {{- end }}
-            {{- if .Values.master.secretsFilesSecret }}
-            - mountPath: /var/jenkins_secrets
-              name: jenkins-secrets
-              readOnly: true
-            {{- end }}
             {{- if .Values.master.jobs }}
             - mountPath: /var/jenkins_jobs
               name: jenkins-jobs
               readOnly: true
             {{- end }}
+            - mountPath: /usr/share/jenkins/ref/secrets/
+              name: secrets-dir
+            {{- end }}
+            {{- if .Values.master.secretsFilesSecret }}
+            - mountPath: /var/jenkins_secrets
+              name: jenkins-secrets
+              readOnly: true
             {{- end }}
             {{- if .Values.master.installPlugins }}
             - mountPath: /usr/share/jenkins/ref/plugins
@@ -149,10 +151,6 @@ spec:
             - mountPath: /var/jenkins_plugins
               name: plugin-dir
             {{- end }}
-            {{- if .Values.master.enableXmlConfig }}
-            - mountPath: /usr/share/jenkins/ref/secrets/
-              name: secrets-dir
-            {{- end }}
       containers:
         - name: jenkins
 {{- if .Values.master.imageTag }}
@@ -261,27 +259,25 @@ spec:
               name: jenkins-credentials
               readOnly: true
             {{- end }}
-            {{- if .Values.master.secretsFilesSecret }}
-            - mountPath: /var/jenkins_secrets
-              name: jenkins-secrets
-              readOnly: true
-            {{- end }}
             {{- if .Values.master.jobs }}
             - mountPath: /var/jenkins_jobs
               name: jenkins-jobs
               readOnly: true
             {{- end }}
+            - mountPath: /usr/share/jenkins/ref/secrets/
+              name: secrets-dir
+              readOnly: false
+            {{- end }}
+            {{- if or .Values.master.secretsFilesSecret }}
+            - mountPath: /var/jenkins_secrets
+              name: jenkins-secrets
+              readOnly: true
             {{- end }}
             {{- if .Values.master.installPlugins }}
             - mountPath: /usr/share/jenkins/ref/plugins/
               name: plugin-dir
               readOnly: false
             {{- end }}
-            {{- if .Values.master.enableXmlConfig }}
-            - mountPath: /usr/share/jenkins/ref/secrets/
-              name: secrets-dir
-              readOnly: false
-            {{- end }}
             {{- if and (.Values.master.JCasC.enabled) (.Values.master.sidecars.configAutoReload.enabled) }}
             - name: sc-config-volume
               mountPath: {{ .Values.master.sidecars.configAutoReload.folder | default "/var/jenkins_home/casc_configs" | quote }}
@@ -354,25 +350,23 @@ spec:
         secret:
           secretName: {{ .Values.master.credentialsXmlSecret }}
       {{- end }}
-      {{- if .Values.master.secretsFilesSecret }}
-      - name: jenkins-secrets
-        secret:
-          secretName: {{ .Values.master.secretsFilesSecret }}
-      {{- end }}
       {{- if .Values.master.jobs }}
       - name: jenkins-jobs
         configMap:
           name: {{ template "jenkins.fullname" . }}-jobs
       {{- end }}
+      - name: secrets-dir
+        emptyDir: {}
+      {{- end }}
+      {{- if .Values.master.secretsFilesSecret }}
+      - name: jenkins-secrets
+        secret:
+          secretName: {{ .Values.master.secretsFilesSecret }}
       {{- end }}
       {{- if .Values.master.installPlugins }}
       - name: plugin-dir
         emptyDir: {}
       {{- end }}
-      {{- if .Values.master.enableXmlConfig }}
-      - name: secrets-dir
-        emptyDir: {}
-      {{- end }}
       - name: jenkins-home
       {{- if .Values.persistence.enabled }}
         persistentVolumeClaim: