From a4a175e8def4803ee610ef7199dff9edd711034f Mon Sep 17 00:00:00 2001 From: Alexis Gauthiez Date: Mon, 20 Apr 2020 12:19:39 +0200 Subject: [PATCH] [stable/jenkins] Enable Jenkins Configuration as Code auto-reload container environment variables configuration (#21170) Closes #21134. Signed-off-by: Alexis Gauthiez --- stable/jenkins/Chart.yaml | 3 +-- stable/jenkins/README.md | 9 +++++---- stable/jenkins/templates/jenkins-master-deployment.yaml | 3 +++ stable/jenkins/values.yaml | 9 +++++++++ 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index 86c7d47b9a..f74f79b0bb 100644 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,8 +1,7 @@ apiVersion: v1 name: jenkins home: https://jenkins.io/ - -version: 1.13.3 +version: 1.14.0 appVersion: lts description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index 2a7ff63ca1..860f695ee0 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -111,7 +111,7 @@ The following tables list the configurable parameters of the Jenkins chart and t | `master.csrf.defaultCrumbIssuer.proxyCompatability` | Enable proxy compatibility | `true` | | `master.cli` | Enable CLI over remoting | `false` | | `master.slaveListenerServiceType` | Defines how to expose the slaveListener service | `ClusterIP` | -| `master.slaveListenerLoadBalancerIP` | Static IP for the slaveListener LoadBalancer | Not set | +| `master.slaveListenerLoadBalancerIP` | Static IP for the slaveListener LoadBalancer | Not set | | `master.loadBalancerSourceRanges` | Allowed inbound IP addresses | `0.0.0.0/0` | | `master.loadBalancerIP` | Optional fixed external IP | Not set | | `master.jmxPort` | Open a port, for JMX stats | Not set | @@ -142,6 +142,7 @@ The following tables list the configurable parameters of the Jenkins chart and t | `master.sidecars.configAutoReload` | Jenkins Config as Code auto-reload settings | | | `master.sidecars.configAutoReload.enabled` | Jenkins Config as Code auto-reload settings (Attention: rbac needs to be enabled otherwise the sidecar can't read the config map) | `false` | | `master.sidecars.configAutoReload.image` | Image which triggers the reload | `kiwigrid/k8s-sidecar:0.1.20` | +| `master.sidecars.configAutoReload.env` | Environment variables for the Jenkins Config as Code auto-reload container | Not set | | `master.sidecars.other` | Configures additional sidecar container(s) for Jenkins master | `[]` | | `master.initScripts` | List of Jenkins init scripts | `[]` | | `master.credentialsXmlSecret` | Kubernetes secret that contains a 'credentials.xml' file | Not set | @@ -173,8 +174,8 @@ The following tables list the configurable parameters of the Jenkins chart and t | `master.prometheus.alertingRulesAdditionalLabels` | Additional labels to add to the prometheus rule object | `{}` | | `master.priorityClassName` | The name of a `priorityClass` to apply to the master pod | Not set | | `master.testEnabled` | Can be used to disable rendering test resources when using helm template | `true` | -| `master.httpsKeyStore.enable` | Enables https keystore on jenkins master | `false` | -| `master.httpsKeyStore.jenkinsHttpsJksSecretName` | Name of the secret that already has ssl keystore | `` | +| `master.httpsKeyStore.enable` | Enables https keystore on jenkins master | `false` | +| `master.httpsKeyStore.jenkinsHttpsJksSecretName` | Name of the secret that already has ssl keystore | `` | | `master.httpsKeyStore.httpPort` | Http Port that Jenkins should listen on along with https, it also serves liveness and readiness probs port. When https keystore is enabled servicePort and targetPort will be used as https port | `8081` | | `master.httpsKeyStore.path` | Path of https keystore file | `/var/jenkins_keystore` | | `master.httpsKeyStore.fileName` | Jenkins keystore filename which will apear under master.httpsKeyStore.path | `keystore.jks` | @@ -612,7 +613,7 @@ Here is the value file section related to keystore configuration.
Keystore itself should be placed in front of `jenkinsKeyStoreBase64Encoded` key and in base64 encoded format. To achive that after having `keystore.jks` file simply do this: `cat keystore.jks | base64` and paste the output in front of `jenkinsKeyStoreBase64Encoded` .
After enabling `httpsKeyStore.enable` make sure that `httpPort` and `targetPort` are not the same as `targetPort` will serve https.
Do not set `master.httpsKeyStore.httpPort` to `-1` because it will cause readiness and liveliness prob to fail.
-If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` and `https-jks-password`.
+If you already have a kubernetes secret that has keystore and its password you can specify its' name in front of `jenkinsHttpsJksSecretName`, You need to remember that your secret should have proper data key names `jenkins-jks-file` and `https-jks-password`.
```yaml master: diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index e1d53988ee..4278c3f129 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -323,6 +323,9 @@ spec: value: "http://localhost:8080{{- .Values.master.jenkinsUriPrefix -}}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)" - name: REQ_METHOD value: "POST" + {{- if .Values.master.sidecars.configAutoReload.env }} +{{ toYaml .Values.master.sidecars.configAutoReload.env | indent 12 }} + {{- end }} resources: {{ toYaml .Values.master.sidecars.configAutoReload.resources | indent 12 }} volumeMounts: diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index cd56ce1a77..963eb2d3b9 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -279,6 +279,15 @@ master: # requests: # cpu: 50m # memory: 50Mi + # env: + # - name: REQ_TIMEOUT + # value: "30" + # SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random. + # Is only used to reload jcasc config from the sidecar container running in the Jenkins master pod. + # This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be + # accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup), + # this must be > 1024: + sshTcpPort: 1044 # folder in the pod that should hold the collected dashboards: folder: "/var/jenkins_home/casc_configs" # If specified, the sidecar will search for JCasC config-maps inside this namespace.