diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index 56eb9e8688..006d6ff0b6 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,6 +1,6 @@ name: jenkins home: https://jenkins.io/ -version: 0.26.2 +version: 0.27.0 appVersion: lts description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based @@ -8,9 +8,12 @@ description: Open source continuous integration server. It supports multiple SCM sources: - https://github.com/jenkinsci/jenkins - https://github.com/jenkinsci/docker-jnlp-slave +- https://github.com/nuvo/kube-tasks maintainers: - name: lachie83 email: lachlan.evenson@microsoft.com - name: viglesiasce email: viglesias@google.com +- name: maorfr + email: maorfr@gmail.com icon: https://wiki.jenkins-ci.org/download/attachments/2916393/logo.png diff --git a/stable/jenkins/OWNERS b/stable/jenkins/OWNERS index f5544ea127..7ae600270d 100644 --- a/stable/jenkins/OWNERS +++ b/stable/jenkins/OWNERS @@ -1,6 +1,8 @@ approvers: - lachie83 - viglesiasce +- maorfr reviewers: - lachie83 - viglesiasce +- maorfr diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index e49b3af920..9cddb46f8b 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -236,6 +236,31 @@ If running upon a cluster with RBAC enabled you will need to do the following: * Create a Jenkins credential of type Kubernetes service account with service account name provided in the `helm status` output. * Under configure Jenkins -- Update the credentials config in the cloud section to use the service account credential you created in the step above. +## Backup + +Adds a backup CronJob for jenkins, along with required RBAC resources. + +### Backup Values + +| Parameter | Description | Default | +| --------------------------- | ------------------------------------------ | --------------------------------- | +| `backup.enabled` | Enable the use of a backup CronJob | `false` | +| `backup.schedule` | Schedule to run jobs | `0 2 * * *` | +| `backup.annotations` | Backup pod annotations | iam.amazonaws.com/role: `jenkins` | +| `backup.image.repo` | Backup image repository | `nuvo/kube-tasks` | +| `backup.image.tag` | Backup image tag | `0.1.2` | +| `backup.extraArgs` | Additional arguments for kube-tasks | `[]` | +| `backup.env` | Backup environment variables | AWS_REGION: `us-east-1` | +| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` | +| `backup.destination` | Destination to store backup artifacts | `s3://nuvo-jenkins-data/backup` | + +### Restore from backup + +To restore a backup, you can use the `kube-tasks` underlying tool called [skbn](https://github.com/nuvo/skbn), which copies files from cloud storage to Kubernetes. +The best way to do it would be using a `Job` to copy files from the desired backup tag to the Jenkins pod. +See the [skbn in-cluster example](https://github.com/nuvo/skbn/tree/master/examples/in-cluster) for more details. + + ## Run Jenkins as non root user The default settings of this helm chart let Jenkins run as root user with uid `0`. diff --git a/stable/jenkins/templates/jenkins-backup-cronjob.yaml b/stable/jenkins/templates/jenkins-backup-cronjob.yaml new file mode 100644 index 0000000000..0d5a186e36 --- /dev/null +++ b/stable/jenkins/templates/jenkins-backup-cronjob.yaml @@ -0,0 +1,69 @@ +{{- if .Values.backup.enabled }} +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: {{ template "jenkins.fullname" . }}-backup + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +spec: + schedule: {{ .Values.backup.schedule | quote }} + concurrencyPolicy: Forbid + startingDeadlineSeconds: 120 + jobTemplate: + spec: + template: + metadata: + annotations: + {{ toYaml .Values.backup.annotations }} + spec: + restartPolicy: OnFailure + serviceAccountName: {{ template "jenkins.fullname" . }}-backup + containers: + - name: jenkins-backup + image: "{{ .Values.backup.image.repository }}:{{ .Values.backup.image.tag }}" + command: ["kube-tasks"] + args: + - simple-backup + - -n + - {{ .Release.Namespace }} + - -l + - release={{ .Release.Name }} + - --container + - {{ template "jenkins.fullname" . }} + - --path + - /var/jenkins_home + - --dst + - {{ .Values.backup.destination }} + {{- with .Values.backup.extraArgs }} +{{ toYaml . | indent 12 }} + {{- end }} + {{- with .Values.backup.env }} + env: +{{ toYaml . | indent 12 }} + {{- end }} + {{- with .Values.backup.resources }} + resources: +{{ toYaml . | indent 14 }} + {{- end }} + affinity: + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app + operator: In + values: + - {{ template "jenkins.fullname" . }} + - key: release + operator: In + values: + - {{ .Release.Name }} + topologyKey: "kubernetes.io/hostname" + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 10 }} + {{- end }} +{{- end }} diff --git a/stable/jenkins/templates/jenkins-backup-rbac.yaml b/stable/jenkins/templates/jenkins-backup-rbac.yaml new file mode 100644 index 0000000000..0ac8bdcb4d --- /dev/null +++ b/stable/jenkins/templates/jenkins-backup-rbac.yaml @@ -0,0 +1,46 @@ +{{- if .Values.backup.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jenkins.fullname" . }}-backup + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "jenkins.fullname" . }}-backup + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +rules: +- apiGroups: [""] + resources: ["pods", "pods/log"] + verbs: ["get", "list"] +- apiGroups: [""] + resources: ["pods/exec"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "jenkins.fullname" . }}-backup + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "jenkins.fullname" . }}-backup +subjects: +- kind: ServiceAccount + name: {{ template "jenkins.fullname" . }}-backup + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index ec347147ea..a9729854e5 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -223,3 +223,47 @@ rbac: roleRef: cluster-admin # Role kind (RoleBinding or ClusterRoleBinding) roleBindingKind: ClusterRoleBinding + +## Backup cronjob configuration +## Ref: https://github.com/nuvo/kube-tasks +backup: + # Backup must use RBAC + # So by enabling backup you are enabling RBAC specific for backup + enabled: false + + # Schedule to run jobs. Must be in cron time format + # Ref: https://crontab.guru/ + schedule: "0 2 * * *" + + annotations: + # Example for authorization to AWS S3 using kube2iam + # Can also be done using environment variables + iam.amazonaws.com/role: jenkins + + image: + repository: nuvo/kube-tasks + tag: 0.1.2 + + # Additional arguments for kube-tasks + # Ref: https://github.com/nuvo/kube-tasks#simple-backup + extraArgs: [] + + # Add additional environment variables + env: + # Example environment variable required for AWS credentials chain + - name: AWS_REGION + value: us-east-1 + + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 1Gi + cpu: 1 + + # Destination to store the backup artifacts + # Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage + # Additional support can added. Visit this repository for details + # Ref: https://github.com/nuvo/skbn + destination: s3://nuvo-jenkins-data/backup