jayfo
commented
3 years ago Ran into this same issue, the cause is this line:
java.io.IOException: Failed to load: Credentials Plugin (2.3.15)
- Update required: Configuration as Code Plugin (1.46) to be updated to 1.47 or higherWorkaround was to override default plugins via controller.installPlugins, updating the version:
controller:
# Override the default plugins so we can control versions
installPlugins:
- kubernetes:1.27.6
- workflow-aggregator:2.6
- git:4.5.2
- configuration-as-code:1.47
cybaj
starkca90
abdennour
Describe the bug A clear and concise description of what the bug is.
jenkins.wardoesn't works in the pod.Version of Helm and Kubernetes:
Helm Version:
Kubernetes Version:
Which version of the chart: 3.1.8
What happened: after
initbelow happened.What you expected to happen:
jenkins works.
How to reproduce it (as minimally and precisely as possible):
I followed this tutorial. only applied two things modified.
Anything else we need to know:
values.yamlI used.Overrides for generated resource names
See templates/_helpers.tpl
nameOverride:
fullnameOverride:
namespaceOverride:
For FQDN resolving of the controller service. Change this value to match your existing configuration.
ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md
clusterZone: "cluster.local"
renderHelmLabels: true
controller:
Used for label app.kubernetes.io/component
componentName: "jenkins-controller" image: "jenkins/jenkins" tag: "2.263.3" imagePullPolicy: "Always" imagePullSecretName:
Optionally configure lifetime for controller-container
lifecycle:
postStart:
exec:
command:
- "uname"
- "-a"
disableRememberMe: false numExecutors: 0
configures the executor mode of the Jenkins node. Possible values are: NORMAL or EXCLUSIVE
executorMode: "NORMAL"
This is ignored if enableRawHtmlMarkupFormatter is true
markupFormatter: plainText customJenkinsLabels: []
The default configuration uses this secret to configure an admin user
If you don't need that user or use a different security realm then you can disable it
adminSecret: true
hostNetworking: false
When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist.
If you disable the non-Jenkins identity store and instead use the Jenkins internal one,
you should revert controller.adminUser to your preferred admin user:
adminUser: "admin"
adminPassword:
admin: existingSecret: "" userKey: jenkins-admin-user passwordKey: jenkins-admin-password
This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use
Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution"
jenkinsHome: "/var/jenkins_home"
This values should not be changed unless you use your custom image of jenkins or any devired from. If you want to use
Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref"
jenkinsRef: "/usr/share/jenkins/ref"
Path to the jenkins war file which is used by jenkins-plugin-cli.
jenkinsWar: "/usr/share/jenkins/jenkins.war" resources: requests: cpu: "50m" memory: "256Mi" limits: cpu: "2000m" memory: "4096Mi"
Environment variables that get added to the init container (useful for e.g. http_proxy)
initContainerEnv:
- name: http_proxy
value: "http://192.168.64.1:3128"
containerEnv:
- name: http_proxy
value: "http://192.168.64.1:3128"
Set min/max heap here if needed with:
javaOpts: "-Xms512m -Xmx512m"
jenkinsOpts: ""
jenkinsUrl: ""
If you set this prefix and use ingress controller then you might want to set the ingress path below
jenkinsUriPrefix: "/jenkins"
Enable pod security context (must be
trueif podSecurityContextOverride, runAsUser or fsGroup are set)usePodSecurityContext: true
Note that
runAsUser,fsGroup, andsecurityContextCapabilitiesarebeing deprecated and replaced by
podSecurityContextOverride.Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image.
When setting runAsUser to a different value than 0 also set fsGroup to the same value:
runAsUser: 1000 fsGroup: 1000
If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here
securityContextCapabilities: {}
drop:
- NET_RAW
Completely overwrites the contents of the
securityContext, ignoring thevalues provided for the deprecated fields:
runAsUser,fsGroup, andsecurityContextCapabilities. In the case of mounting an ext4 filesystem,it might be desirable to use
supplementalGroupsinstead offsGroupinthe
securityContextblock: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496podSecurityContextOverride:
runAsUser: 1000
runAsNonRoot: true
supplementalGroups: [1000]
capabilities: {}
servicePort: 8080 targetPort: 8080
For minikube, set this to NodePort, elsewhere use LoadBalancer
Use ClusterIP if your setup includes ingress controller
serviceType: "NodePort"
Jenkins controller service annotations
serviceAnnotations: {}
Jenkins controller custom labels
statefulSetLabels: {}
foo: bar
bar: foo
Jenkins controller service labels
serviceLabels: {}
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https
Put labels on Jenkins controller pod
podLabels: {}
Used to create Ingress record (should used with ServiceType: ClusterIP)
nodePort: 32000 # <to set explicitly, choose port between 30000-32767
Enable Kubernetes Liveness and Readiness Probes
if Startup Probe is supported, enable it too
~ 2 minutes to allow Jenkins to restart when upgrading plugins. Set ReadinessTimeout to be shorter than LivenessTimeout.
healthProbes: true probes: startupProbe: httpGet: path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' port: http periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 12 livenessProbe: failureThreshold: 5 httpGet: path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' port: http periodSeconds: 10 timeoutSeconds: 5 readinessProbe: failureThreshold: 3 httpGet: path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login' port: http periodSeconds: 10 timeoutSeconds: 5 agentListenerPort: 50000 agentListenerHostPort: disabledAgentProtocols:
JNLP2-connect csrf: defaultCrumbIssuer: enabled: true proxyCompatability: true
Kubernetes service type for the JNLP agent service
agentListenerServiceType is the Kubernetes Service type for the JNLP agent service,
either 'LoadBalancer', 'NodePort', or 'ClusterIP'
Note if you set this to 'LoadBalancer', you must define annotations to secure it. By default
this will be an external load balancer and allowing inbound 0.0.0.0/0, a HUGE
security risk: https://github.com/kubernetes/charts/issues/1341
agentListenerServiceType: "ClusterIP"
Optionally assign an IP to the LoadBalancer agentListenerService LoadBalancer
GKE users: only regional static IPs will work for Service Load balancer.
agentListenerLoadBalancerIP: agentListenerServiceAnnotations: {}
Example of 'LoadBalancer' type of agent listener with annotations securing it
agentListenerServiceType: LoadBalancer
agentListenerServiceAnnotations:
service.beta.kubernetes.io/aws-load-balancer-internal: "True"
service.beta.kubernetes.io/load-balancer-source-ranges: "172.0.0.0/8, 10.0.0.0/8"
LoadBalancerSourcesRange is a list of allowed CIDR values, which are combined with ServicePort to
set allowed inbound rules on the security group assigned to the controller load balancer
loadBalancerSourceRanges:
Optionally assign a known public LB IP
loadBalancerIP: 1.2.3.4
Optionally configure a JMX port
requires additional javaOpts, ie
javaOpts: >
-Dcom.sun.management.jmxremote.port=4000
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.ssl=false
jmxPort: 4000
Optionally configure other ports to expose in the controller container
extraPorts: []
- name: BuildInfoProxy
port: 9000
List of plugins to be install during Jenkins controller start
installPlugins:
configuration-as-code:1.46
List of plugins to install in addition to those listed in controller.installPlugins
additionalPlugins: []
Enable to initialize the Jenkins controller only once on initial installation.
Without this, whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates which has the potential to cause breakage.
Note that for this to work,
persistence.enabledneeds to be set totrueinitializeOnce: false
Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment.
overwritePlugins: true
Configures if plugins bundled with
controller.imageshould be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment.overwritePluginsFromImage: true
Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter), useful with ghprb plugin.
The plugin is not installed by default, please update controller.installPlugins.
enableRawHtmlMarkupFormatter: false
Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval
scriptApproval: []
- "method groovy.json.JsonSlurperClassic parseText java.lang.String"
- "new groovy.json.JsonSlurperClassic"
List of groovy init scripts to be executed during Jenkins controller start
initScripts: []
- |
print 'adding global pipeline libraries, register properties, bootstrap jobs...'
Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area,
where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value.
Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label
characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in
/var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each |
become the content of the configuration yaml file. The first line after this is a JCasC root element, eg jenkins, credentials,
etc. Best reference is https:///configuration-as-code/reference. The example below creates a welcome message:
JCasC: defaultConfig: true configScripts: {}
welcome-message: |
jenkins:
systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.
Ignored if securityRealm is defined in controller.JCasC.configScripts and
ignored if controller.enableXmlConfig=true as controller.securityRealm takes precedence
securityRealm: |- local: allowsSignup: false enableCaptcha: false users:
Ignored if authorizationStrategy is defined in controller.JCasC.configScripts
authorizationStrategy: |- loggedInUsersCanDoAnything: allowAnonymousRead: false
Optionally specify additional init-containers
customInitContainers: []
- name: custom-init
image: "alpine:3.7"
imagePullPolicy: Always
command: [ "uname", "-a" ]
sidecars: configAutoReload:
If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot. If false or not-specified,
jcasc changes will cause a reboot and will only be applied at the subsequent start-up. Auto-reload uses the
http:///reload-configuration-as-code endpoint to reapply config when changes to the configScripts are detected.
enabled: true image: kiwigrid/k8s-sidecar:0.1.275 imagePullPolicy: IfNotPresent resources: {}
limits:
How many connection-related errors to retry on
reqRetryConnect: 10
env:
- name: REQ_TIMEOUT
value: "30"
SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random.
Is only used to reload jcasc config from the sidecar container running in the Jenkins controller pod.
This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be
accessible via SSH from outside of the pod. Note if you use non-root pod privileges (runAsUser & fsGroup),
this must be > 1024:
sshTcpPort: 1044
folder in the pod that should hold the collected dashboards:
folder: "/var/jenkins_home/casc_configs"
If specified, the sidecar will search for JCasC config-maps inside this namespace.
Otherwise the namespace in which the sidecar is running will be used.
It's also possible to specify ALL to search in all namespaces:
searchNamespace:
Allows you to inject additional/other sidecars
other: []
The example below runs the client for https://smee.io as sidecar container next to Jenkins,
that allows to trigger build behind a secure firewall.
https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall
Note: To use it you should go to https://smee.io/new and update the url to the generete one.
- name: smee
image: docker.io/twalter/smee-client:1.0.2
args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"]
resources:
limits:
cpu: 50m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
Name of the Kubernetes scheduler to use
schedulerName: ""
Node labels and tolerations for pod assignment
ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
nodeSelector: {}
terminationGracePeriodSeconds:
tolerations: []
affinity: {}
Leverage a priorityClass to ensure your pods survive resource shortages
ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
priorityClassName:
podAnnotations: {}
Add StatefulSet annotations
statefulSetAnnotations: {}
ingress: enabled: false
Override for the default paths that map requests to the backend
paths: []
- backend:
serviceName: ssl-redirect
servicePort: use-annotation
- backend:
serviceName: >-
{{ template "jenkins.fullname" . }}
Don't use string here, use only integer value!
servicePort: 8080
For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
For Kubernetes v1.19+, use 'networking.k8s.io/v1'
apiVersion: "extensions/v1beta1" labels: {} annotations: {}
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
Set this path to jenkinsUriPrefix above or use annotations to rewrite path
path: "/jenkins"
configures the hostname e.g. jenkins.example.com
hostName: tls:
- secretName: jenkins.cluster.local
hosts:
- jenkins.cluster.local
often you want to have your controller all locked down and private
but you still want to get webhooks from your SCM
A secondary ingress will let you expose different urls
with a differnt configuration
secondaryingress: enabled: false
paths you want forwarded to the backend
ex /github-webhook
paths: []
For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'
For Kubernetes v1.19+, use 'networking.k8s.io/v1'
apiVersion: "extensions/v1beta1" labels: {} annotations: {}
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
configures the hostname e.g. jenkins-external.example.com
hostName: tls:
- secretName: jenkins-external.example.com
hosts:
- jenkins-external.example.com
If you're running on GKE and need to configure a backendconfig
to finish ingress setup, use the following values.
Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig
backendconfig: enabled: false apiVersion: "extensions/v1beta1" name: labels: {} annotations: {} spec: {}
Openshift route
route: enabled: false labels: {} annotations: {}
path: "/jenkins"
controller.hostAliases allows for adding entries to Pod /etc/hosts:
https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
hostAliases: []
- ip: 192.168.50.50
hostnames:
- something.local
- ip: 10.0.50.50
hostnames:
- other.local
Expose Prometheus metrics
prometheus:
If enabled, add the prometheus plugin to the list of plugins to install
https://plugins.jenkins.io/prometheus
enabled: false
Additional labels to add to the ServiceMonitor object
serviceMonitorAdditionalLabels: {}
Set a custom namespace where to deploy ServiceMonitor resource
serviceMonitorNamespace: monitoring
scrapeInterval: 60s
This is the default endpoint used by the prometheus plugin
scrapeEndpoint: /prometheus
Additional labels to add to the PrometheusRule object
alertingRulesAdditionalLabels: {}
An array of prometheus alerting rules
See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
The
groupsroot object is added by default, simply add the rule entriesalertingrules: []
Set a custom namespace where to deploy PrometheusRule resource
prometheusRuleNamespace: ""
Can be used to disable rendering controller test resources when using helm template
testEnabled: true
httpsKeyStore: jenkinsHttpsJksSecretName: '' enable: false httpPort: 8081 path: "/var/jenkins_keystore" fileName: "keystore.jks" password: "password"
Convert keystore.jks files content to base64 ( cat keystore.jks | base64 ) and put the output here
jenkinsKeyStoreBase64Encoded: | /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0=
agent: enabled: true defaultsProviderTemplate: ""
URL for connecting to the Jenkins contoller
jenkinsUrl:
connect to the specified host and port, instead of connecting directly to the Jenkins controller
jenkinsTunnel: kubernetesConnectTimeout: 5 kubernetesReadTimeout: 15 maxRequestsPerHostStr: "32" namespace: image: "jenkins/inbound-agent" tag: "4.6-1" workingDir: "/home/jenkins" customJenkinsLabels: []
name of the secret to be used for image pulling
imagePullSecretName: componentName: "jenkins-agent" websocket: false privileged: false runAsUser: runAsGroup: resources: requests: cpu: "512m" memory: "512Mi" limits: cpu: "512m" memory: "512Mi"
You may want to change this to true while testing a new image
alwaysPullImage: false
Controls how agent pods are retained after the Jenkins build completes
Possible values: Always, Never, OnFailure
podRetention: "Never"
You can define the volumes that you want to mount for this container
Allowed types are: ConfigMap, EmptyDir, HostPath, Nfs, PVC, Secret
Configure the attributes as they appear in the corresponding Java class for that type
https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes
volumes: []
- type: ConfigMap
configMapName: myconfigmap
mountPath: /var/myapp/myconfigmap
- type: EmptyDir
mountPath: /var/myapp/myemptydir
memory: false
- type: HostPath
hostPath: /var/lib/containers
mountPath: /var/myapp/myhostpath
- type: Nfs
mountPath: /var/myapp/mynfs
readOnly: false
serverAddress: "192.0.2.0"
serverPath: /var/lib/containers
- type: PVC
claimName: mypvc
mountPath: /var/myapp/mypvc
readOnly: false
- type: Secret
defaultMode: "600"
mountPath: /var/myapp/mysecret
secretName: mysecret
Pod-wide environment, these vars are visible to any container in the agent pod
You can define the workspaceVolume that you want to mount for this container
Allowed types are: DynamicPVC, EmptyDir, HostPath, Nfs, PVC
Configure the attributes as they appear in the corresponding Java class for that type
https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace
workspaceVolume: {}
- type: DynamicPVC
configMapName: myconfigmap
- type: EmptyDir
memory: false
- type: HostPath
hostPath: /var/lib/containers
- type: Nfs
readOnly: false
serverAddress: "192.0.2.0"
serverPath: /var/lib/containers
- type: PVC
claimName: mypvc
readOnly: false
Pod-wide environment, these vars are visible to any container in the agent pod
envVars: []
- name: PATH
value: /usr/local/bin
nodeSelector: {}
Key Value selectors. Ex:
jenkins-agent: v1
Executed command when side container gets started
command: args: "${computer.jnlpmac} ${computer.name}"
Side container name
sideContainerName: "jnlp"
Doesn't allocate pseudo TTY by default
TTYEnabled: false
Max number of spawned agent
containerCap: 10
Pod name
podName: "default"
Allows the Pod to remain active for reuse until the configured number of
minutes has passed since the last step was executed on it.
idleMinutes: 0
Raw yaml template for the Pod. For example this allows usage of toleration for agent pods.
https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates
https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
yamlTemplate: ""
yamlTemplate: |-
apiVersion: v1
kind: Pod
spec:
tolerations:
- key: "key"
operator: "Equal"
value: "value"
Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates: merge or override
yamlMergeStrategy: "override"
Timeout in seconds for an agent to be online
connectTimeout: 100
Annotations to apply to the pod.
annotations: {}
Below is the implementation of custom pod templates for the default configured kubernetes cloud.
Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value.
Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label
characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers.
For this pod templates configuration to be loaded the following values must be set:
controller.JCasC.defaultConfig: true
Best reference is https:///configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template.
podTemplates: {}
python: |
- name: python
label: jenkins-python
serviceAccount: jenkins
containers:
- name: python
image: python:3
command: "/bin/sh -c"
args: "cat"
ttyEnabled: true
privileged: true
resourceRequestCpu: "400m"
resourceRequestMemory: "512Mi"
resourceLimitCpu: "1"
resourceLimitMemory: "1024Mi"
Here you can add additional agents
They inherit all values from
agentso you only need to specify values which differadditionalAgents: {}
maven:
podName: maven
customJenkinsLabels: maven
An example of overriding the jnlp container
sideContainerName: jnlp
image: jenkins/jnlp-agent-maven
tag: latest
python:
podName: python
customJenkinsLabels: python
sideContainerName: python
image: python
tag: "3"
command: "/bin/sh -c"
args: "cat"
TTYEnabled: true
persistence: enabled: true
A manually managed Persistent Volume and Claim
Requires persistence.enabled: true
If defined, PVC must be created manually before volume will be bound
existingClaim:
jenkins data Persistent Volume Storage Class
If defined, storageClassName:
If set to "-", storageClassName: "", which disables dynamic provisioning
If undefined (the default) or set to null, no storageClassName spec is
set, choosing the default provisioner. (gp2 on AWS, standard on
GKE, AWS & OpenStack)
storageClass: jenkins-pv annotations: {} accessMode: "ReadWriteOnce" size: "8Gi" volumes:
- name: nothing
emptyDir: {}
mounts:
- mountPath: /var/nothing
name: nothing
readOnly: true
networkPolicy:
Enable creation of NetworkPolicy resources.
enabled: false
For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1'
For Kubernetes v1.7, use 'networking.k8s.io/v1'
apiVersion: networking.k8s.io/v1
You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range
internalAgents: allowed: true podLabels: {} namespaceLabels: {}
project: myproject
externalAgents: {}
ipCIDR: 172.17.0.0/16
except:
- 172.17.1.0/24
Install Default RBAC roles and bindings
rbac: create: true readSecrets: false
serviceAccount: create: false
The name of the service account is autogenerated by default
name: jenkins annotations: {}
serviceAccountAgent:
Specifies whether a ServiceAccount should be created
create: false
The name of the ServiceAccount to use.
If not set and create is true, a name is generated using the fullname template
name: annotations: {}
Backup cronjob configuration
Ref: https://github.com/maorfr/kube-tasks
backup:
Backup must use RBAC
So by enabling backup you are enabling RBAC specific for backup
enabled: false
Used for label app.kubernetes.io/component
componentName: "backup"
Schedule to run jobs. Must be in cron time format
Ref: https://crontab.guru/
schedule: "0 2 *" labels: {} annotations: {}
Example for authorization to AWS S3 using kube2iam or IRSA
Set this to terminate the job that is running/failing continously and set the job status to "Failed"
activeDeadlineSeconds: "" image: repository: "maorfr/kube-tasks" tag: "0.2.0"
Additional arguments for kube-tasks
Ref: https://github.com/maorfr/kube-tasks#simple-backup
extraArgs: []
Add existingSecret for AWS credentials
existingSecret: {}
Example for using an existing secret
jenkinsaws:
Use this key for AWS access key ID
Use this key for AWS secret access key
Add additional environment variables
jenkinsgcp:
Use this key for GCP credentials
env: []
Example environment variable required for AWS credentials chain
- name: "AWS_REGION"
value: "us-east-1"
resources: requests: memory: 1Gi cpu: 1 limits: memory: 1Gi cpu: 1
Destination to store the backup artifacts
Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage, Google Cloud Storage
Additional support can added. Visit this repository for details
Ref: https://github.com/maorfr/skbn
destination: "s3://jenkins-data/backup"
By enabling only the jenkins_home/jobs folder gets backed up, not the whole jenkins instance
onlyJobs: false
Enable backup pod security context (must be
trueif runAsUser or fsGroup are set)usePodSecurityContext: true
When setting runAsUser to a different value than 0 also set fsGroup to the same value:
runAsUser: 1000 fsGroup: 1000 securityContextCapabilities: {}
drop:
- NET_RAW
checkDeprecation: true