UNCLASSIFIED

Skip to content

GitLab

You need to sign in or sign up before continuing.
Commit 99475f0b authored by Andy Maksymowicz's avatar Andy Maksymowicz
Browse files

Merge branch '2.249.2.3' into 'development' 

2.249.2.3

See merge request !32
parents d05c133f e4101fdb
Pipeline #53063 passed with stages
in 21 minutes and 44 seconds
Hide whitespace changes
Inline Side-by-side
Showing with 378 additions and 123 deletions
Dockerfile
View file @ 99475f0b
......@@ -42,8 +42,8 @@ HEALTHCHECK --interval=5m --timeout=3s \
CMD curl -fsL ${JENKINS_URL}/login || exit 1
LABEL securitytxt="https://www.cloudbees.com/.well-known/security.txt"
LABEL release=da3edc0598625e4129f5562827921449394afb42
LABEL version=2.249.1.2
LABEL release=4c482ecc2d194d4868ade0a8cb5f773a3ab1c0d5
LABEL version=2.249.2.3
ARG TARBALL=files.tar
COPY ${TARBALL} /tmp
......
Jenkinsfile
View file @ 99475f0b
@Library('DCCSCR@master') _
dccscrPipeline(version: '2.249.1.2')
dccscrPipeline(version: '2.249.2.3')
README.md
View file @ 99475f0b
......@@ -9,7 +9,7 @@ CloudBees CI (formerly known as _CloudBees Core_) consists of three Docker image
For each image, all files other than UBI and native packages
are included in a `files.tar` marked with a SHA-256 checksum.
A version of CloudBees CI is given in the format `2.249.1.2`
A version of CloudBees CI is given in the format `2.249.2.3`
where the first three components are aligned with a Jenkins LTS.
The Helm chart is coversioned with `core-oc`.
The `core-mm` image typically shares the same version,
......@@ -22,13 +22,13 @@ plus whatever other customizations are desired:
```yaml
OperationsCenter:
Image:
dockerImage: your-registry/core-oc:2.249.1.2
dockerImage: your-registry/core-oc:2.249.2.3
Master:
Image:
dockerImage: your-registry/core-mm:2.249.1.2
dockerImage: your-registry/core-mm:2.249.2.3
Agents:
Image:
dockerImage: your-registry/agent:2.249.1.2
dockerImage: your-registry/agent:2.249.2.3
```
and [install via Helm 3](https://docs.cloudbees.com/docs/cloudbees-core/latest/kubernetes-install-guide/installing-kubernetes-using-helm) using the local copy of the chart:
......
download.json
View file @ 99475f0b
{
"resources": [
{
"url": "https://downloads.cloudbees.com/dsop-files/core-oc-files-1a4963e50dd445eb045a63c87c52b02a7b2abdf64d5c048398943ed818186f30.tar",
"url": "https://downloads.cloudbees.com/dsop-files/core-oc-files-de64bf3a7e6d55e0c13bcf7ddbc72ef820c76548e6d18b4c1d990215e4773698.tar",
"filename": "files.tar",
"validation": {
"type": "sha256",
"value": "1a4963e50dd445eb045a63c87c52b02a7b2abdf64d5c048398943ed818186f30"
"value": "de64bf3a7e6d55e0c13bcf7ddbc72ef820c76548e6d18b4c1d990215e4773698"
}
}
]
......
helm/Chart.yaml
View file @ 99475f0b
apiVersion: v1
appVersion: 2.249.1.2
appVersion: 2.249.2.3
description: The Continuous Delivery Solution for Enterprises
engine: gotpl
home: https://www.cloudbees.com/products/cloudbees-core
home: https://www.cloudbees.com/products/continuous-integration
icon: https://images.ctfassets.net/vtn4rfaw6n2j/7xprMMXARXDBuVxW4y8XfV/349fff91035050e3f2a8ff37bc0615b5/cloudbees-core-logo_header.svg
keywords:
- cloudbees
- jenkins
name: cloudbees-core
version: 3.20.0-DEVELOPMENT
version: 3.22.0-DEVELOPMENT
helm/README.md
View file @ 99475f0b
# cloudbees-core
![Version: 3.22.0](https://img.shields.io/badge/Version-3.22.0-informational?style=flat-square) ![AppVersion: 2.249.2.3](https://img.shields.io/badge/AppVersion-2.249.2.3-informational?style=flat-square)
[CloudBees Core](https://www.cloudbees.com/products/cloudbees-core) is the continuous delivery platform architected for the enterprise. It provides:
* DevOps at scale
......@@ -22,6 +24,14 @@ This chart bootstraps a CloudBees Core deployment on a [Kubernetes](http://kuber
- Kubernetes 1.10 or higher
- Helm 2.12 or higher
## Requirements
| Repository | Name | Version |
|------------|------|---------|
| https://charts.cloudbees.com/public/cloudbees | cloudbees-sidecar-injector | 2.0.7 |
| https://kubernetes-charts.storage.googleapis.com/ | nginx-ingress | 1.40.2 |
| https://kubernetes.github.io/ingress-nginx | ingress-nginx | 2.15.0 |
## Installing the Chart
### Default installation
......@@ -36,10 +46,10 @@ $ helm install cloudbees/cloudbees-core \
The command deploys CloudBees Core on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
### Ingress Controller Installation
### Ingress Controller Installation
The chart is designed, so it can install an nginx-ingress controller.
The `nginx.ingress.Enabled` field controls ingress controller installation and setup.
The chart is designed, so it can install an nginx-ingress controller.
The `nginx.ingress.Enabled` field controls ingress controller installation and setup.
To install the chart with the release name `cloudbees-core` and hostname cloudbees-core.example.com.
```console
......@@ -56,19 +66,18 @@ To uninstall/delete the `cloudbees-core` deployment:
$ helm delete cloudbees-core
```
> **NOTE**: The current version of the CloudBees Core Helm Chart only manages the Operation Center.
Users should manage Managed Master using Operation Center.
Users should manage Managed Master using Operation Center.
The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center.
The release is still stored in the Helm database, but it will now have the status deleted.
The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center.
The release is still stored in the Helm database, but it will now have the status deleted.
If you wish to completely remove the release, use the following variation of the `helm delete` command.
```console
$ helm delete cloudbees-core --purge
```
```
> **IMPORTANT**: The `helm delete` command does NOT remove the persistent volume claims as precaution against data losss.
You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims.
You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims.
The command removes all the Kubernetes components associated with the chart and deletes the release.
......@@ -79,12 +88,12 @@ The easiest way to consult it is through the command `helm inspect values cloudb
Each property can override a default value with a value that specific to your Kubernetes cluster
You can provide this values using the `--set` flag on the Helm command line.
Helm also support merging values files together, so that you can create a YAML file for each environment.
Helm also support merging values files together, so that you can create a YAML file for each environment.
### Environment Property Value Files
Helm provides the option to use a custom property values file to override the default values set in the `values.yaml` file.
CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file.
CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file.
To use an environment property value file with Helm, use the -f option as shown in the following example:
`helm install cloudbees-core --name cloudbees-core -f example-values.yaml`
......@@ -93,3 +102,80 @@ You can download the latest version of the `example-values.yaml` file from Cloud
## Additional Documentation
CloudBees provides complete and more detail installation and operation documentation on the CloudBees web site at https://go.cloudbees.com/docs/cloudbees-core/cloud-install-guide/kubernetes-helm-install/
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| Agents.Enabled | bool | `true` | Enable to create agent resources (service account, role) |
| Agents.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/agent:2.249.2.3"` | Used to override the default docker image used for agents |
| Agents.SeparateNamespace.Create | bool | `false` | If true, the second namespace will be created when installing this chart. Otherwise, the existing namespace should be labeled with `cloudbees.com/role: agents` in order for network policies to work. |
| Agents.SeparateNamespace.Enabled | bool | `false` | If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them. |
| Agents.SeparateNamespace.Name | string | `nil` | Namespace where to create agents resources. Defaults to `${namespace}-builds` where `${namespace}` is the namespace where the chart is installed. |
| Hibernation.Enabled | bool | `false` | Whether to enable the [Hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-masters#_hibernation_of_managed_masters) feature |
| Hibernation.Image.dockerImage | string | `"cloudbees/managed-master-hibernation-monitor:230.ee066a318539"` | Used to override the default docker image |
| Hibernation.Image.dockerPullPolicy | string | `"IfNotPresent"` | Used to override the default pull policy |
| Master.Enabled | bool | `true` | Whether to create the resources required to schedule masters. |
| Master.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/core-mm:2.249.2.3"` | Used to override the default docker image |
| Master.JavaOpts | string | `nil` | Additional Java options to pass to managed masters. For example, setting up a JMX port |
| Master.OperationsCenterNamespace | string | `nil` | When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters |
| NetworkPolicy.Enabled | bool | `false` | Enable only if the cluster supports it. Read the [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to understand what this is about. |
| NetworkPolicy.JMXSelectors | list | `[]` | Custom selectors for accessing JMX port |
| NetworkPolicy.ingressControllerSelector | list | `[]` | Custom selector for the ingress-controller |
| OperationsCenter.AgentListenerPort | int | `50000` | Container port for agent listener traffic |
| OperationsCenter.Annotations | object | `{}` | Additional annotations to put on the pod running Operations Center |
| OperationsCenter.CSRF.ProxyCompatibility | bool | `false` | Proxy compatibility for the default CSRF issuer |
| OperationsCenter.ContainerPort | int | `8080` | Container port for http traffic |
| OperationsCenter.ContextPath | string | `"/cjoc"` | the path under which Operations Center will be accessible in the given host. |
| OperationsCenter.Enabled | bool | `true` | Disable for particular use case like setting up namespaces to host masters only |
| OperationsCenter.HealthProbeLivenessFailureThreshold | int | `12` | Threshold for liveness failure |
| OperationsCenter.HealthProbes | bool | `true` | Enable Kubernetes Liveness and Readiness Probes |
| OperationsCenter.HostName | string | `nil` | The hostname used to access Operations Center through the ingress controller. |
| OperationsCenter.Image.dockerImage | string | `"063356183961.dkr.ecr.us-east-1.amazonaws.com/ubi/unified-distribution/core-oc:2.249.2.3"` | Container image to use for Operations Center |
| OperationsCenter.Image.dockerPullPolicy | string | `"Always"` | https://kubernetes.io/docs/concepts/containers/images/#updating-images |
| OperationsCenter.ImagePullSecrets | string | `nil` | The name of the image pull secret to pull private docker images |
| OperationsCenter.Ingress.Annotations | object | `{"kubernetes.io/tls-acme":"false"}` | annotations to put on Ingress object |
| OperationsCenter.Ingress.Class | string | `"nginx"` | Ingress class to use for OC and MM ingresses Should be set to the same value as nginx-ingress.controller.ingressClass if enabled |
| OperationsCenter.Ingress.tls.Enable | bool | `false` | Set this to true in order to enable TLS on the ingress record |
| OperationsCenter.Ingress.tls.SecretName | string | `nil` | The name of the secret containing the certificate and private key to terminate TLS for the ingress |
| OperationsCenter.JavaOpts | string | `nil` | Additional java options to pass to the Operations Center |
| OperationsCenter.JenkinsOpts | string | `nil` | Additional arguments for jenkins.war |
| OperationsCenter.LoadBalancerIP | string | `nil` | Optionally assign a known public LB IP |
| OperationsCenter.LoadBalancerSourceRanges | list | `["0.0.0.0/0"]` | Only applicable when using `ServiceType: LoadBalancer` |
| OperationsCenter.NodeSelector | object | `{}` | Node labels and tolerations for pod assignment ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector |
| OperationsCenter.Platform | string | `"standard"` | Enables specific settings depending on the platform platform specific values are: `eks`, `aws`, `gke`, `aks`, `pks`, `openshift`, `openshift4` Note: `openshift` maps to OpenShift 3.x |
| OperationsCenter.Protocol | string | `"http"` | the protocol used to access CJOC. Possible values are http/https. |
| OperationsCenter.Resources.Limits.Cpu | int | `1` | CPU limit to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu |
| OperationsCenter.Resources.Limits.Memory | string | `"2G"` | Memory limit to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory |
| OperationsCenter.Resources.Requests.Cpu | int | `1` | CPU request to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu |
| OperationsCenter.Resources.Requests.Memory | string | `"2G"` | Memory request to run Operations Center https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory |
| OperationsCenter.Route.tls.Enable | bool | `false` | Set this to true in OpenShift to terminate TLS at route level |
| OperationsCenter.ServiceAgentListenerPort | int | `50000` | Controls the service port where Operations Center TCP port for agents is exposed. Don't change this parameter unless you know what you are doing |
| OperationsCenter.ServiceAnnotations | object | `{}` | Additional annotations to put on the Operations Center service |
| OperationsCenter.ServicePort | int | `80` | Controls the service port where Operations Center http port is exposed. Don't change this parameter unless you know what you are doing |
| OperationsCenter.ServiceType | string | `"ClusterIP"` | Service Type. Defaults to ClusterIP, since we recommend using an ingress controller. |
| OperationsCenter.Tolerations | list | `[]` | Specify tolerations for the Operations Center pod. See [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) |
| Persistence.AccessMode | string | `"ReadWriteOnce"` | Access mode for the PVC ([doc](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes)) |
| Persistence.Annotations | object | `{}` | Annotations to put on the PVC |
| Persistence.Size | string | `"20Gi"` | Size of the Operations Center volume |
| Persistence.StorageClass | string | `nil` | Persistent Volume Storage Class for Jenkins Home If defined, storageClassName: <storageClass>. If set to "-", storageClassName: "", which disables dynamic provisioning. If undefined (the default) or set to null, the default storage class will be used, unless specified otherwise below. If setting OperationsCenter.Platform == gke, a storage class backed with SSD drives will be created by this chart and used automatically. |
| Persistence.mounts | list | `[]` | Additional volume mounts to attach to Operations Center container |
| Persistence.volumes | list | `[]` | Additional volumes to attach to Operations Center pod |
| PodSecurityPolicy.Annotations | object | `{}` | Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings |
| PodSecurityPolicy.Enabled | bool | `false` | Enables [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) support Enable only if the cluster supports it. |
| ingress-nginx.Enabled | bool | `false` | Installs the [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/master/charts/ingress-nginx) controller (optional). Enable this section if you don't have an existing installation of ingress-nginx controller Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16 |
| ingress-nginx.controller.ingressClass | string | `"nginx"` | |
| ingress-nginx.controller.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
| ingress-nginx.controller.service.externalTrafficPolicy | string | `"Local"` | |
| ingress-nginx.defaultBackend.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
| nginx-ingress.Enabled | bool | `false` | Installs the [nginx-ingress](https://github.com/helm/charts/tree/master/stable/nginx-ingress) controller (optional). DEPRECATED - Use ingress-nginx section instead. Enable this section if you don't have an existing installation of nginx-ingress controller Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16 |
| nginx-ingress.controller.ingressClass | string | `"nginx"` | |
| nginx-ingress.controller.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
| nginx-ingress.controller.service.externalTrafficPolicy | string | `"Local"` | |
| nginx-ingress.defaultBackend.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
| rbac.agentsServiceAccountName | string | `"jenkins-agents"` | |
| rbac.hibernationMonitorServiceAccountName | string | `"managed-master-hibernation-monitor"` | Name of the service account the Hibernation monitor will run as (if enabled) |
| rbac.install | bool | `true` | Install `role`/`rolebindings`/`serviceAccount`. If false (and rbac is enabled in the cluster anyway), provide valid names for `serviceAccountName`, `masterServiceAccountName` and `hibernationMonitorServiceAccountName` |
| rbac.masterServiceAccountName | string | `"jenkins"` | Name of the service account Jenkins masters will run as |
| rbac.serviceAccountName | string | `"cjoc"` | Name of the service account Operations Center will run as |
| sidecarinjector.Enabled | bool | `false` | Whether to enable installation of Sidecar Injector |
helm/README.md.gotmpl 0 → 100644
View file @ 99475f0b
# cloudbees-core
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
[CloudBees Core](https://www.cloudbees.com/products/cloudbees-core) is the continuous delivery platform architected for the enterprise. It provides:
* DevOps at scale
* Resilience and high availability
* Easy management
* Enterprise grade security
## TL;DR;
```console
$ helm repo add cloudbees https://charts.cloudbees.com/public/cloudbees
$ helm install cloudbees/cloudbees-core --name <release name>
```
## Introduction
This chart bootstraps a CloudBees Core deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
## Prerequisites
- Kubernetes 1.10 or higher
- Helm 2.12 or higher
{{ template "chart.requirementsSection" . }}
## Installing the Chart
### Default installation
To install the chart with the release name `cloudbees-core` and hostname `cloudbees-core.example.com`. The default installation requires nginx-ingress controller to be installed. The chart can install the nginx-ingress controller for you. This installation is described in the next section.
```console
$ helm install cloudbees/cloudbees-core \
--name cloudbees-core \
--set OperationsCenter.HostName='cloudbees-core.example.com'
```
The command deploys CloudBees Core on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
### Ingress Controller Installation
The chart is designed, so it can install an nginx-ingress controller.
The `nginx.ingress.Enabled` field controls ingress controller installation and setup.
To install the chart with the release name `cloudbees-core` and hostname cloudbees-core.example.com.
```console
$ helm install cloudbees/cloudbees-core \
--name cloudbees-core \
--set nginx.ingress.Enabled=true
```
## Uninstalling the Chart
To uninstall/delete the `cloudbees-core` deployment:
```console
$ helm delete cloudbees-core
```
> **NOTE**: The current version of the CloudBees Core Helm Chart only manages the Operation Center.
Users should manage Managed Master using Operation Center.
The `helm delete` command stops the CloudBees Core deployment than removes the OperationsCenter Center.
The release is still stored in the Helm database, but it will now have the status deleted.
If you wish to completely remove the release, use the following variation of the `helm delete` command.
```console
$ helm delete cloudbees-core --purge
```
> **IMPORTANT**: The `helm delete` command does NOT remove the persistent volume claims as precaution against data losss.
You will need to use the `kubectl delete pvc` command to delete the persistent volumn claims.
The command removes all the Kubernetes components associated with the chart and deletes the release.
## Configuration
Please refer to the chart `values.yaml` to get the exhaustive list of values that can be customized.
The easiest way to consult it is through the command `helm inspect values cloudbees/cloudbees-core`.
Each property can override a default value with a value that specific to your Kubernetes cluster
You can provide this values using the `--set` flag on the Helm command line.
Helm also support merging values files together, so that you can create a YAML file for each environment.
### Environment Property Value Files
Helm provides the option to use a custom property values file to override the default values set in the `values.yaml` file.
CloudBees recommends creating a custom properties file to override the default for your environments, instead of directly editing the included values.yaml file.
To use an environment property value file with Helm, use the -f option as shown in the following example:
`helm install cloudbees-core --name cloudbees-core -f example-values.yaml`
You can download the latest version of the `example-values.yaml` file from CloudBees Examples GitHub repository at https://github.com/cloudbees/cloudbees-examples/tree/master/helm-custom-value-file-examples.
## Additional Documentation
CloudBees provides complete and more detail installation and operation documentation on the CloudBees web site at https://go.cloudbees.com/docs/cloudbees-core/cloud-install-guide/kubernetes-helm-install/
{{ template "chart.valuesSection" . }}
helm/requirements.lock
View file @ 99475f0b
......@@ -2,8 +2,11 @@ dependencies:
- name: nginx-ingress
repository: https://kubernetes-charts.storage.googleapis.com/
version: 1.40.2
- name: ingress-nginx
repository: https://kubernetes.github.io/ingress-nginx
version: 2.15.0
- name: cloudbees-sidecar-injector
repository: https://charts.cloudbees.com/public/cloudbees
version: 2.0.6
digest: sha256:d030d7cde88b3247e6924bbd0dd3c00e5708edbe6fae2bdba9ed7eaa9ca2cc24
generated: "2020-09-15T12:13:54.481668733Z"
version: 2.0.7
digest: sha256:10f7e8c53d0a6f910f4dbe0fd253fbefd288fb5fc24365635968e99b3bc75dbf
generated: "2020-10-07T14:35:15.239221954Z"
helm/requirements.yaml
View file @ 99475f0b
......@@ -3,7 +3,11 @@ dependencies:
version: 1.40.2
repository: https://kubernetes-charts.storage.googleapis.com/
condition: nginx-ingress.Enabled
- name: ingress-nginx
version: 2.15.0
repository: https://kubernetes.github.io/ingress-nginx
condition: ingress-nginx.Enabled
- name: cloudbees-sidecar-injector
version: 2.0.6
version: 2.0.7
repository: https://charts.cloudbees.com/public/cloudbees
condition: sidecarinjector.Enabled
helm/templates/_helpers.tpl
View file @ 99475f0b
......@@ -256,11 +256,22 @@ Plural versions for usage in network policy ingress rules
- namespaceSelector:
matchLabels:
network.openshift.io/policy-group: ingress
{{- else if not (include "cloudbees-core.is-openshift" .) -}}
{{- else if (not (include "cloudbees-core.is-openshift" .)) -}}
{{ include "nginxingress.podSelectors" . }}
{{- end -}}
{{- end -}}
{{- define "ingress.name" -}}
{{- if index .Values "nginx-ingress" "Enabled" -}}
nginx-ingress
{{- else if index .Values "ingress-nginx" "Enabled" -}}
ingress-nginx
{{- else -}}
ingress-nginx
{{- end -}}
{{- end -}}
{{/* stable/nginx-ingress chart going away in Nov. 2020. This will be part of the 10/2020 release. Delete this after 4/2021 */}}
{{- define "nginxingress.podSelectors" -}}
{{- if index .Values "nginx-ingress" "Enabled" }}
{{ include "nginxingress.includedPodSelector" . }}
......@@ -274,33 +285,49 @@ Plural versions for usage in network policy ingress rules
{{- define "nginxingress.includedPodSelector" -}}
- podSelector:
matchLabels:
app: nginx-ingress
app: {{ include "ingress.name" . }}
component: controller
{{- end -}}
{{- define "nginxingress.defaultPodSelectors" -}}
- namespaceSelector:
matchLabels:
name: nginx-ingress
name: {{ include "ingress.name" . }}
podSelector:
matchLabels:
app: nginx-ingress
app: {{ include "ingress.name" . }}
component: controller
- namespaceSelector:
matchLabels:
name: ingress-nginx
podSelector:
matchLabels:
app: nginx-ingress
app: {{ include "ingress.name" . }}
component: controller
- namespaceSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
name: ingress-nginx
podSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/component: controller
{{- end -}}
{{- define "ingressnginx.podSelectors" -}}
{{- if index .Values "ingress-nginx" "Enabled" }}
{{ include "ingressnginx.includedPodSelector" . }}
{{- else if .Values.NetworkPolicy.ingressControllerSelector }}
{{ toYaml .Values.NetworkPolicy.ingressControllerSelector -}}
{{- else }}
{{ include "ingressnginx.defaultPodSelectors" . }}
{{- end }}
{{- end -}}
{{- define "ingressnginx.includedPodSelector" -}}
- podSelector:
matchLabels:
app: {{ include "ingress.name" . }}
component: controller
{{- end -}}
{{- define "networkpolicy.cjoc.http" -}}
......@@ -376,3 +403,9 @@ status:
{{ .Release.Namespace }}
{{- end -}}
{{- end -}}
{{- define "ingress.check" -}}
{{- if and (index .Values "nginx-ingress" "Enabled") (index .Values "ingress-nginx" "Enabled") -}}
{{ fail "\n\nERROR: Only one of nginx-ingress.Enabled or ingress-nginx.Enabled may be true" }}
{{- end -}}
{{- end -}}
helm/templates/cjoc-ingress.yaml
View file @ 99475f0b
{{- if .Values.OperationsCenter.Enabled -}}
{{- if include "cloudbees-core.needs-ingress" . -}}
{{- include "ingress.check" . -}}
apiVersion: {{ include "ingress.apiVersion" . }}
kind: Ingress
metadata:
......@@ -33,7 +34,7 @@ spec:
{{- if .Values.OperationsCenter.Ingress.tls.Enable }}
tls:
- hosts:
- {{ .Values.OperationsCenter.Ingress.tls.Host }}
- {{ .Values.OperationsCenter.HostName | quote }}
secretName: {{ .Values.OperationsCenter.Ingress.tls.SecretName }}
{{- end -}}
{{- end -}}
......
helm/templates/managed-master-hibernation-monitor-ingress.yaml
View file @ 99475f0b
......@@ -7,9 +7,11 @@ metadata:
labels:
{{ include "cloudbees-core.labels" . | indent 4 }}
annotations:
{{ toYaml .Values.OperationsCenter.Ingress.Annotations | indent 4 }}
{{ if .Values.OperationsCenter.Ingress.Class }}
kubernetes.io/ingress.class: {{ .Values.OperationsCenter.Ingress.Class }}
{{- end }}
nginx.ingress.kubernetes.io/ssl-redirect: "{{- template "ingress.ssl_redirect" . }}"
# TODO should OperationsCenter.Ingress.Annotations be honored here?
spec:
rules:
-
......@@ -29,7 +31,7 @@ spec:
{{- if .Values.OperationsCenter.Ingress.tls.Enable }}
tls:
- hosts:
- {{ .Values.OperationsCenter.Ingress.tls.Host }}
- {{ .Values.OperationsCenter.HostName | quote }}
secretName: {{ .Values.OperationsCenter.Ingress.tls.SecretName }}
{{- end -}}
{{- end -}}
......
helm/values.yaml
View file @ 99475f0b
......@@ -2,7 +2,23 @@
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
# Installs the nginx ingress controller (optional)
# ingress-nginx.Enabled -- Installs the [ingress-nginx](https://github.com/kubernetes/ingress-nginx/tree/master/charts/ingress-nginx) controller (optional).
# Enable this section if you don't have an existing installation of ingress-nginx controller
# Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16
ingress-nginx:
Enabled: false
controller:
ingressClass: nginx
nodeSelector:
kubernetes.io/os: linux
service:
externalTrafficPolicy: Local
defaultBackend:
nodeSelector:
kubernetes.io/os: linux
# nginx-ingress.Enabled -- Installs the [nginx-ingress](https://github.com/helm/charts/tree/master/stable/nginx-ingress) controller (optional).
# DEPRECATED - Use ingress-nginx section instead.
# Enable this section if you don't have an existing installation of nginx-ingress controller
# Note: use `beta.kubernetes.io/os` when deploying on Kubernetes versions below 1.16
nginx-ingress:
......@@ -23,52 +39,60 @@ nginx-ingress:
# without having to build custom docker images.
# Use helm inspect readme cloudbees/cloudbees-sidecar-injector to read more on this optional components
sidecarinjector:
# sidecarinjector.Enabled -- Whether to enable installation of Sidecar Injector
Enabled: false
# Operations Center options
OperationsCenter:
# Disable for particular use case like setting up namespaces to host masters only
# OperationsCenter.Enabled -- Disable for particular use case like setting up namespaces to host masters only
Enabled: true
# Operations Center docker image
Image:
dockerImage: dcar/core-oc:2.249.1.2
# OperationsCenter.Image.dockerImage -- Container image to use for Operations Center
dockerImage: dcar/core-oc:2.249.2.3
# OperationsCenter.Image.dockerPullPolicy -- https://kubernetes.io/docs/concepts/containers/images/#updating-images
dockerPullPolicy: IfNotPresent
# Image pull secrets
# Enable this option when using a private registry.
# https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line
# ImagePullSecrets: my-k8s-secret
# OperationsCenter.ImagePullSecrets -- The name of the image pull secret to pull private docker images
ImagePullSecrets: null
# Platform enables specific settings, option defaults standard
# platform specific values are: eks, aws, gke, aks, pks, openshift, openshift4
# Note: openshift maps to OpenShift 3.x
# OperationsCenter.Platform -- Enables specific settings depending on the platform
# platform specific values are: `eks`, `aws`, `gke`, `aks`, `pks`, `openshift`, `openshift4`
# Note: `openshift` maps to OpenShift 3.x
Platform: standard
# The hostname used to access Operations Center through the ingress controller.
# OperationsCenter.HostName -- The hostname used to access Operations Center through the ingress controller.
HostName: null
# ContextPath under which Operations Center will be accessible in the given host.
# OperationsCenter.ContextPath -- the path under which Operations Center will be accessible in the given host.
ContextPath: /cjoc
# Protocol used to access CJOC. Possible values are http/https.
# OperationsCenter.Protocol -- the protocol used to access CJOC. Possible values are http/https.
Protocol: http
# Protocol: https
# Port used to access CJOC. Defaults to 80/443 depending on Protocol. Can be overriden.
# OperationsCenter.Port -- the port used to access CJOC. Defaults to 80/443 depending on Protocol. Can be overridden.
# Port: 80
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container
Resources:
Limits:
# CPU limit to run Operations Center
# OperationsCenter.Resources.Limits.Cpu -- CPU limit to run Operations Center
# https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
Cpu: 1
# Memory limit to run Operations Center
# OperationsCenter.Resources.Limits.Memory -- Memory limit to run Operations Center
# https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
Memory: 2G
Requests:
# OperationsCenter.Resources.Requests.Cpu -- CPU request to run Operations Center
# https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu
Cpu: 1
# OperationsCenter.Resources.Requests.Memory -- Memory request to run Operations Center
# https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory
Memory: 2G
# Environment variables that get added to the container (useful for e.g. http_proxy)
......@@ -76,8 +100,8 @@ OperationsCenter:
# - name: http_proxy
# value: "http://192.168.64.1:3128"
# Additional java options to pass to the Operations Center
# JavaOpts: ""
# OperationsCenter.JavaOpts -- Additional java options to pass to the Operations Center
JavaOpts: null
# -Dcom.sun.management.jmxremote.port=4000
# -Dcom.sun.management.jmxremote.authenticate=false
# -Dcom.sun.management.jmxremote.ssl=false
......@@ -85,8 +109,8 @@ OperationsCenter:
# Container port where JMX is exposed
# JMXPort: 4000
# Additional arguments for jenkins.war
# JenkinsOpts: ""
# OperationsCenter.JenkinsOpts -- Additional arguments for jenkins.war
JenkinsOpts: null
# Run the Operations Center as a specific user (defaults to uid 1000)
# When setting RunAsUser to a different value than 0 also set FsGroup to the same value:
......@@ -98,68 +122,68 @@ OperationsCenter:
# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#discussion
# FsGroup: 1000
# Controls the service port where Operations Center http port is exposed.
# Don't change this parameter unless you know what you are doing
# OperationsCenter.ServicePort -- Controls the service port where Operations Center http port is exposed. Don't change this parameter unless you know what you are doing
ServicePort: 80
# Controls the service port where Operations Center TCP port for agents is exposed.
# Don't change this parameter unless you know what you are doing
# OperationsCenter.ServiceAgentListenerPort -- Controls the service port where Operations Center TCP port for agents is exposed. Don't change this parameter unless you know what you are doing
ServiceAgentListenerPort: 50000
# Service Type
# Defaults to ClusterIP, since we recommend using an ingress controller.
# OperationsCenter.ServiceType -- Service Type. Defaults to ClusterIP, since we recommend using an ingress controller.
ServiceType: ClusterIP
# Additional annotations to put on the Operations Center service
# OperationsCenter.ServiceAnnotations -- Additional annotations to put on the Operations Center service
ServiceAnnotations: {}
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https
# Container port for http traffic
# OperationsCenter.ContainerPort -- Container port for http traffic
ContainerPort: 8080
# Container port for agent listener traffic
# OperationsCenter.AgentListenerPort -- Container port for agent listener traffic
AgentListenerPort: 50000
# Enable Kubernetes Liveness and Readiness Probes
# OperationsCenter.HealthProbes -- Enable Kubernetes Liveness and Readiness Probes
HealthProbes: true
# OperationsCenter.HealthProbeLivenessFailureThreshold -- Threshold for liveness failure
HealthProbeLivenessFailureThreshold: 12
# Proxy compatibility for the default CSRF issuer
# https://wiki.jenkins.io/display/JENKINS/CSRF+Protection
CSRF:
# OperationsCenter.CSRF.ProxyCompatibility -- Proxy compatibility for the default CSRF issuer
ProxyCompatibility: false
# Only used when ServiceType: LoadBalancer
# https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
# OperationsCenter.LoadBalancerSourceRanges -- Only applicable when using `ServiceType: LoadBalancer`
LoadBalancerSourceRanges:
- 0.0.0.0/0
# Optionally assign a known public LB IP
# OperationsCenter.LoadBalancerIP -- Optionally assign a known public LB IP
LoadBalancerIP: null
# LoadBalancerIP: 1.2.3.4
# Node labels and tolerations for pod assignment
# OperationsCenter.NodeSelector -- Node labels and tolerations for pod assignment
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
NodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
# OperationsCenter.Tolerations -- Specify tolerations for the Operations Center pod.
# See [documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
Tolerations: []
# Additional annotations to put on the pod running Operations Center
# OperationsCenter.Annotations -- Additional annotations to put on the pod running Operations Center
Annotations: {}
Ingress:
# Ingress class to use for OC and MM ingresses
# OperationsCenter.Ingress.Class -- Ingress class to use for OC and MM ingresses
# Should be set to the same value as nginx-ingress.controller.ingressClass if enabled
Class: nginx
# Annotations to put on Ingress object
# OperationsCenter.Ingress.Annotations -- annotations to put on Ingress object
Annotations:
kubernetes.io/tls-acme: 'false'
tls:
## Set this to true in order to enable TLS on the ingress record
# OperationsCenter.Ingress.tls.Enable -- Set this to true in order to enable TLS on the ingress record
Enable: false
SecretName: cloudbees-core-example-com-tls
Host: jenkins.cluster.local
# OperationsCenter.Ingress.tls.SecretName -- The name of the secret containing the certificate
# and private key to terminate TLS for the ingress
SecretName: null
# OpenShift uses a Route instead of an Ingress, this section is added to match the opensource Jenkins Chart
Route:
tls:
# OperationsCenter.Route.tls.Enable -- Set this to true in OpenShift to terminate TLS at route level
Enable: false
## @param ExtraConfigMaps - array of objects - optional
......@@ -209,88 +233,91 @@ OperationsCenter:
# Master options
Master:
# Master.Enabled -- Whether to create the resources required to schedule masters.
Enabled: true
# When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters
# Master.OperationsCenterNamespace -- When deploying Master resources, this grants an Operations Center deployed in another namespace the right to deploy masters
OperationsCenterNamespace: null
# Docker image inserted in Operations Center automatically
Image:
dockerImage: dcar/core-mm:2.249.1.2
dockerPullPolicy: IfNotPresent
# Additional Java options to pass to managed masters. For example, setting up a JMX port
# Master.Image.dockerImage -- Used to override the default docker image
dockerImage: dcar/core-mm:2.249.2.3
# Master.JavaOpts -- Additional Java options to pass to managed masters. For example, setting up a JMX port
JavaOpts: null
# Agent options
Agents:
# Agents.Enabled -- Enable to create agent resources (service account, role)
Enabled: true
SeparateNamespace:
# If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them.
# Agents.SeparateNamespace.Enabled -- If enabled, agents resources will be created in a separate namespace as well as bindings allowing masters to schedule them.
Enabled: false
# Namespace where to create agents resources. Defaults to ${namespace}-builds where ${namespace} is the namespace where the chart is installed.
# Agents.SeparateNamespace.Name -- Namespace where to create agents resources. Defaults to `${namespace}-builds` where `${namespace}` is the namespace where the chart is installed.
Name: null
# If true, the second namespace will be created when installing this chart.
# Otherwise, the existing namespace should be labeled with "cloudbees.com/role: agents" in order for network policies to work.
# Agents.SeparateNamespace.Create -- If true, the second namespace will be created when installing this chart. Otherwise, the existing namespace should be labeled with `cloudbees.com/role: agents` in order for network policies to work.
Create: false
Image:
# Used to override the default docker image used for agents
dockerImage: dcar/agent:2.249.1.2
# Agents.Image.dockerImage -- Used to override the default docker image used for agents
dockerImage: dcar/agent:2.249.2.3
Persistence:
## Persistent Volume Storage Class for Jenkins Home
## If defined, storageClassName: <storageClass>
## If set to "-", storageClassName: "", which disables dynamic provisioning
##
## If undefined (the default) or set to null, the default storage class will be used,
## unless specified otherwise below.
##
## If setting OperationsCenter.Platform == gke, a storage class backed with
## SSD drives will be created by this chart and used automatically.
##
# Persistence.StorageClass -- Persistent Volume Storage Class for Jenkins Home
# If defined, storageClassName: <storageClass>.
# If set to "-", storageClassName: "", which disables dynamic provisioning.
# If undefined (the default) or set to null, the default storage class will be used,
# unless specified otherwise below.
# If setting OperationsCenter.Platform == gke, a storage class backed with
# SSD drives will be created by this chart and used automatically.
#
# StorageClass: "-"
StorageClass: null
# On AKS, use the following
# StorageClass: "managed-premium"
# Annotations to put on the PVC
# Persistence.Annotations -- Annotations to put on the PVC
Annotations: {}
# Persistence.AccessMode -- Access mode for the PVC ([doc](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes))
AccessMode: ReadWriteOnce
# Size of the Operations Center volume
# Persistence.Size -- Size of the Operations Center volume
Size: 20Gi
# Additional volumes to attach to Operations Center pod
volumes:
# Persistence.volumes -- Additional volumes to attach to Operations Center pod
volumes: []
# - name: nothing
# emptyDir: {}
# Additional volume mounts to attach to Operations Center container
mounts:
# Persistence.mounts -- Additional volume mounts to attach to Operations Center container
mounts: []
# - mountPath: /var/nothing
# name: nothing
# readOnly: true
# Master hibernation
Hibernation:
# Hibernation.Enabled -- Whether to enable the [Hibernation](https://docs.cloudbees.com/docs/cloudbees-ci/latest/cloud-admin-guide/managing-masters#_hibernation_of_managed_masters) feature
Enabled: false
Image:
# Hibernation.Image.dockerImage -- Used to override the default docker image
dockerImage: cloudbees/managed-master-hibernation-monitor:230.ee066a318539
# Hibernation.Image.dockerPullPolicy -- Used to override the default pull policy
dockerPullPolicy: IfNotPresent
PodSecurityPolicy:
# Requires rbac.installCluster = true
#
# PodSecurityPolicy.Enabled -- Enables [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) support
# Enable only if the cluster supports it.
# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
Enabled: false
# Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings
# PodSecurityPolicy.Annotations -- Additional annotations to put on the PodSecurityPolicy, e.g. AppArmor/Seccomp settings
Annotations: {}
NetworkPolicy:
# Enable only if the cluster supports it.
# https://kubernetes.io/docs/concepts/services-networking/network-policies/
# NetworkPolicy.Enabled -- Enable only if the cluster supports it. Read the [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/) to understand what this is about.
Enabled: false
# Custom selector for the ingress-controller
ingressControllerSelector:
# NetworkPolicy.ingressControllerSelector -- Custom selector for the ingress-controller
ingressControllerSelector: []
# - namespaceSelector:
# matchLabels:
# name: nginx-ingress
......@@ -299,8 +326,8 @@ NetworkPolicy:
# app: nginx-ingress
# component: controller
# Custom selectors for accessing JMX port
JMXSelectors:
# NetworkPolicy.JMXSelectors -- Custom selectors for accessing JMX port
JMXSelectors: []
# - namespaceSelector:
# matchLabels:
# name: datadog
......@@ -310,23 +337,21 @@ NetworkPolicy:
## Install Default RBAC roles and bindings
rbac:
# Install role/rolebindings/serviceAccount.
# If false (and rbac is enabled in the cluster anyway), provide valid names for
# - serviceAccountName
# - masterServiceAccountName
# - hibernationMonitorServiceAccountName
# rbac.install -- Install `role`/`rolebindings`/`serviceAccount`.
# If false (and rbac is enabled in the cluster anyway), provide valid names for `serviceAccountName`, `masterServiceAccountName` and `hibernationMonitorServiceAccountName`
install: true
# Install clusterrole/clusterrolebinding
# rbac.installCluster -- Install `clusterrole`/`clusterrolebinding`
# These cluster roles are optional but prevent usage of some features, so we recommend setting them up.
# Defaults to true, except on Openshift 3 where it defaults to false
# Please refer to templates/cjoc-clusterrole-master-management.yaml in the chart
#installCluster: true
# Name of the service account Operations Center will run as
# rbac.serviceAccountName -- Name of the service account Operations Center will run as
serviceAccountName: cjoc
# Name of the service account Jenkins masters will run as
# rbac.masterServiceAccountName -- Name of the service account Jenkins masters will run as
masterServiceAccountName: jenkins
# rbac.agentServiceAccountName -- Name of the service account Jenkins agents will run as
agentsServiceAccountName: jenkins-agents
# Name of the service account the Hibernation monitor will run as (if enabled)
# rbac.hibernationMonitorServiceAccountName -- Name of the service account the Hibernation monitor will run as (if enabled)
hibernationMonitorServiceAccountName: managed-master-hibernation-monitor
scripts/usr/local/bin/jenkins.sh
View file @ 99475f0b
......@@ -52,7 +52,7 @@ find /usr/share/jenkins/ref/ -type f -exec bash -c "copy_reference_file '{}'" \;
# if `docker run` first argument start with `--` the user is passing jenkins launcher arguments
if [[ $# -lt 1 ]] || [[ "$1" == "--"* ]]; then
eval "exec java ${JAVA_OPTS:-} -jar -Dcb.distributable.name=\"Docker Common CJE\" -Dcb.distributable.commit_sha=da3edc0598625e4129f5562827921449394afb42 /usr/share/jenkins/jenkins.war $JENKINS_OPTS \"\$@\""
eval "exec java ${JAVA_OPTS:-} -jar -Dcb.distributable.name=\"Docker Common CJE\" -Dcb.distributable.commit_sha=4c482ecc2d194d4868ade0a8cb5f773a3ab1c0d5 /usr/share/jenkins/jenkins.war $JENKINS_OPTS \"\$@\""
fi
# As argument is not jenkins, assume user want to run his own process, for sample a `bash` shell to explore this image
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

UNCLASSIFIED