From d305c5961bd172bcedb547a4c083e6640b8bf5da Mon Sep 17 00:00:00 2001 From: Simon Wydooghe Date: Sat, 20 Jan 2018 06:50:27 +0100 Subject: [PATCH] [stable/jenkins] Provision credentials.xml, secrets files and jobs (#3316) In order to allow for a more immutable deployment, this commit adds support to allow provisioning of the following: - credentials.xml - secrets files - jobs Bump version to 0.13.0. --- stable/jenkins/Chart.yaml | 2 +- stable/jenkins/README.md | 3 ++ stable/jenkins/templates/config.yaml | 12 +++++ .../templates/jenkins-master-deployment.yaml | 51 +++++++++++++++++++ stable/jenkins/templates/jobs.yaml | 8 +++ stable/jenkins/values.yaml | 10 ++++ 6 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 stable/jenkins/templates/jobs.yaml diff --git a/stable/jenkins/Chart.yaml b/stable/jenkins/Chart.yaml index 5d45779499..f4ceafe7e7 100755 --- a/stable/jenkins/Chart.yaml +++ b/stable/jenkins/Chart.yaml @@ -1,6 +1,6 @@ name: jenkins home: https://jenkins.io/ -version: 0.12.1 +version: 0.13.0 appVersion: 2.73 description: Open source continuous integration server. It supports multiple SCM tools including CVS, Subversion and Git. It can execute Apache Ant and Apache Maven-based diff --git a/stable/jenkins/README.md b/stable/jenkins/README.md index c9c2d4e9a0..fa949540ea 100644 --- a/stable/jenkins/README.md +++ b/stable/jenkins/README.md @@ -55,6 +55,9 @@ The following tables lists the configurable parameters of the Jenkins chart and | `Master.Ingress.Annotations` | Ingress annotations | `{}` | | `Master.Ingress.TLS` | Ingress TLS configuration | `[]` | | `Master.InitScripts` | List of Jenkins init scripts | Not set | +| `Master.CredentialsXmlSecret` | Kubernetes secret that contains a 'credentials.xml' file | Not set | +| `Master.SecretsFilesSecret` | Kubernetes secret that contains 'secrets' files | Not set | +| `Master.Jobs` | Jenkins XML job configs | Not set | | `Master.InstallPlugins` | List of Jenkins plugins to install | `kubernetes:0.11 workflow-aggregator:2.5 credentials-binding:1.11 git:3.2.0` | | `Master.ScriptApproval` | List of groovy functions to approve | Not set | | `Master.NodeSelector` | Node labels for pod assignment | `{}` | diff --git a/stable/jenkins/templates/config.yaml b/stable/jenkins/templates/config.yaml index 28598ba911..920ceced0d 100644 --- a/stable/jenkins/templates/config.yaml +++ b/stable/jenkins/templates/config.yaml @@ -156,6 +156,18 @@ data: mkdir -p /var/jenkins_home/init.groovy.d/; cp -n /var/jenkins_config/*.groovy /var/jenkins_home/init.groovy.d/ {{- end }} +{{- if .Values.Master.CredentialsXmlSecret }} + cp -n /var/jenkins_credentials/credentials.xml /var/jenkins_home; +{{- end }} +{{- if .Values.Master.SecretsFilesSecret }} + cp -n /var/jenkins_secrets/* /usr/share/jenkins/ref/secrets; +{{- end }} +{{- if .Values.Master.Jobs }} + for job in $(ls /var/jenkins_jobs); do + mkdir -p /var/jenkins_home/jobs/$job + cp -n /var/jenkins_jobs/$job /var/jenkins_home/jobs/$job/config.xml + done +{{- end }} {{- range $key, $val := .Values.Master.InitScripts }} init{{ $key }}.groovy: |- {{ $val | indent 4 }} diff --git a/stable/jenkins/templates/jenkins-master-deployment.yaml b/stable/jenkins/templates/jenkins-master-deployment.yaml index 0a951f3d31..b4dbc60975 100644 --- a/stable/jenkins/templates/jenkins-master-deployment.yaml +++ b/stable/jenkins/templates/jenkins-master-deployment.yaml @@ -53,6 +53,24 @@ spec: - mountPath: /var/jenkins_config name: jenkins-config + {{- if .Values.Master.CredentialsXmlSecret }} + - + mountPath: /var/jenkins_credentials + name: jenkins-credentials + readOnly: true + {{- end }} + {{- if .Values.Master.SecretsFilesSecret }} + - + mountPath: /var/jenkins_secrets + name: jenkins-secrets + readOnly: true + {{- end }} + {{- if .Values.Master.Jobs }} + - + mountPath: /var/jenkins_jobs + name: jenkins-jobs + readOnly: true + {{- end }} - mountPath: /usr/share/jenkins/ref/plugins/ name: plugin-dir @@ -120,6 +138,24 @@ spec: mountPath: /var/jenkins_config name: jenkins-config readOnly: true + {{- if .Values.Master.CredentialsXmlSecret }} + - + mountPath: /var/jenkins_credentials + name: jenkins-credentials + readOnly: true + {{- end }} + {{- if .Values.Master.SecretsFilesSecret }} + - + mountPath: /var/jenkins_secrets + name: jenkins-secrets + readOnly: true + {{- end }} + {{- if .Values.Master.Jobs }} + - + mountPath: /var/jenkins_jobs + name: jenkins-jobs + readOnly: true + {{- end }} - mountPath: /usr/share/jenkins/ref/plugins/ name: plugin-dir @@ -135,6 +171,21 @@ spec: - name: jenkins-config configMap: name: {{ template "jenkins.fullname" . }} + {{- if .Values.Master.CredentialsXmlSecret }} + - name: jenkins-credentials + secret: + secretName: {{ .Values.Master.CredentialsXmlSecret }} + {{- end }} + {{- if .Values.Master.SecretsFilesSecret }} + - name: jenkins-secrets + secret: + secretName: {{ .Values.Master.SecretsFilesSecret }} + {{- end }} + {{- if .Values.Master.Jobs }} + - name: jenkins-jobs + configMap: + name: {{ template "jenkins.fullname" . }}-jobs + {{- end }} - name: plugin-dir emptyDir: {} - name: secrets-dir diff --git a/stable/jenkins/templates/jobs.yaml b/stable/jenkins/templates/jobs.yaml new file mode 100644 index 0000000000..c16813a7b8 --- /dev/null +++ b/stable/jenkins/templates/jobs.yaml @@ -0,0 +1,8 @@ +{{- if .Values.Master.Jobs }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "jenkins.fullname" . }}-jobs +data: +{{ .Values.Master.Jobs | indent 2 }} +{{- end -}} diff --git a/stable/jenkins/values.yaml b/stable/jenkins/values.yaml index 6d4ecce792..5e4412642b 100644 --- a/stable/jenkins/values.yaml +++ b/stable/jenkins/values.yaml @@ -64,6 +64,16 @@ Master: InitScripts: # - | # print 'adding global pipeline libraries, register properties, bootstrap jobs...' + # Kubernetes secret that contains a 'credentials.xml' for Jenkins + # CredentialsXmlSecret: jenkins-credentials + # Kubernetes secret that contains files to be put in the Jenkins 'secrets' directory, + # useful to manage encryption keys used for credentials.xml for instance (such as + # master.key and hudson.util.Secret) + # SecretsFilesSecret: jenkins-secrets + # Jenkins XML job configs to provision + # Jobs: |- + # test: |- + # <> CustomConfigMap: false # Node labels and tolerations for pod assignment # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector