From 8918f4175a0d63a232c72be2e456c98afa2e787c Mon Sep 17 00:00:00 2001 From: TGippi Date: Thu, 4 Jan 2018 06:29:19 +0100 Subject: [PATCH] Feature/run jenkins as non root user (#2899) * option to run Jenkins as a non root user * add parameters to run Jenkins as non root user * doc to run Jenkins as non root user * increment minor version due to feature "run Jenkins as non root user" --- stable/jenkins/Chart.yaml | 2 +- stable/jenkins/README.md | 19 +++++++++++++++++++ .../templates/jenkins-master-deployment.yaml | 7 ++++++- stable/jenkins/values.yaml | 4 ++++ 4 files changed, 30 insertions(+), 2 deletions(-) diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index 18985d2dc6..a3044e1959 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,6 +1,6 @@ name: jenkins home: https://jenkins.io/ -version: 0.10.3 +version: 0.11.0 appVersion: 2.73 description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index e7b45492e1..3907c7fe12 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -38,6 +38,8 @@ The following tables lists the configurable parameters of the Jenkins chart and | `Master.AdminUser` | Admin username (and password) created as a secret if useSecurity is true | `admin` | | `Master.Cpu` | Master requested cpu | `200m` | | `Master.Memory` | Master requested memory | `256Mi` | +| `Master.RunAsUser` | uid that jenkins runs with | `0` | +| `Master.FsGroup` | uid that will be used for persistent volume | `0` | | `Master.ServiceAnnotations` | Service annotations | `{}` | | `Master.ServiceType` | k8s service type | `LoadBalancer` | | `Master.ServicePort` | k8s service port | `8080` | @@ -164,3 +166,20 @@ If running upon a cluster with RBAC enabled you will need to do the following: * `helm install stable/jenkins --set rbac.install=true` * Create a Jenkins credential of type Kubernetes service account with service account name provided in the `helm status` output. * Under configure Jenkins -- Update the credentials config in the cloud section to use the service account credential you created in the step above. + +## Run Jenkins as non root user + +The default settings of this helm chart let Jenkins run as root user with uid `0`. +Due to security reasons you may want to run Jenkins as a non root user. +Fortunately the default jenkins docker image `jenkins/jenkins` contains a user `jenkins` with uid `1000` that can be used for this purpose. + +Simply use the following settings to run Jenkins as `jenkins` user with uid `1000`. +``` +jenkins: + Master: + RunAsUser: 1000 + FsGroup: 1000 +``` + +Docs taken from https://github.com/jenkinsci/docker/blob/master/Dockerfile: +*Jenkins is run with user `jenkins`, uid = 1000. If you bind mount a volume from the host or a data container,ensure you use the same uid* diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index a53d4f3817..c4e56ae0b4 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -34,7 +34,12 @@ spec: {{ toYaml .Values.Master.Tolerations | indent 8 }} {{- end }} securityContext: - runAsUser: 0 + runAsUser: {{ default 0 .Values.Master.RunAsUser }} +{{- if and (.Values.Master.RunAsUser) (.Values.Master.FsGroup) }} +{{- if not (eq .Values.Master.RunAsUser 0.0) }} + fsGroup: {{ .Values.Master.FsGroup }} +{{- end }} +{{- end }} serviceAccountName: {{ if .Values.rbac.install }}{{ template "jenkins.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} initContainers: - name: "copy-default-config" diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index c0c83190e6..051f918cbf 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -19,6 +19,10 @@ Master: # JavaOpts: "-Xms512m -Xmx512m" # JenkinsOpts: "" # JenkinsUriPrefix: "/jenkins" + # Set RunAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image. + # When setting RunAsUser to a different value than 0 also set FsGroup to the same value: + # RunAsUser: + # FsGroup: ServicePort: 8080 # For minikube, set this to NodePort, elsewhere use LoadBalancer # Use ClusterIP if your setup includes ingress controller