jenkins-instance.yaml (5640B)
1 apiVersion: jenkins.io/v1alpha2 2 kind: Jenkins 3 metadata: 4 name: jenkins 5 namespace: jenkins 6 spec: 7 # Enable security validation 8 validateSecurityWarnings: true 9 # Configuration as Code - references ConfigMap 10 configurationAsCode: 11 configurations: 12 - name: jenkins-casc 13 secret: 14 name: "" 15 # Groovy scripts (if needed) 16 groovyScripts: 17 configurations: [] 18 secret: 19 name: "" 20 # API settings - IMPORTANT: jenkins-operator user must have admin rights 21 jenkinsAPISettings: 22 authorizationStrategy: createUser 23 # Seed jobs - auto-create pipelines from gitops repo 24 seedJobs: 25 - id: gitops-pipelines 26 targets: "apps/talos_cluster/jenkins/seeds/jobs/*.groovy" 27 description: "GitOps pipelines and jobs" 28 repositoryBranch: main 29 repositoryUrl: https://github.com/mtrnord/cluster.git 30 # Backup and restore for build history 31 backup: 32 containerName: backup 33 action: 34 exec: 35 command: 36 - /home/user/bin/backup.sh 37 interval: 30 38 makeBackupBeforePodDeletion: true 39 restore: 40 containerName: backup 41 action: 42 exec: 43 command: 44 - /home/user/bin/restore.sh 45 getLatestAction: 46 exec: 47 command: 48 - /home/user/bin/get-latest.sh 49 # Service configuration 50 service: 51 type: ClusterIP 52 port: 8080 53 slaveService: 54 type: ClusterIP 55 port: 50000 56 # Master/Controller pod specification 57 master: 58 # Security context - run as jenkins user (1000) 59 securityContext: 60 runAsUser: 1000 61 fsGroup: 1000 62 # Disable CSRF protection is not recommended - keep enabled (default) 63 disableCSRFProtection: false 64 # Base plugins (required by operator) 65 basePlugins: 66 - name: kubernetes 67 version: 4423.vb_59f230b_ce53 68 - name: workflow-job 69 version: 1571.vb_423c255d6d9 70 - name: workflow-aggregator 71 version: 608.v67378e9d3db_1 72 - name: git 73 version: 5.10.1 74 - name: job-dsl 75 version: 3654.vdf58f53e2d15 76 - name: configuration-as-code 77 version: 2065.v7a_20a_b_d84088 78 - name: kubernetes-credentials-provider 79 version: 1.303.vdfcf47fb_b_fef 80 # Additional plugins for our use case 81 plugins: 82 - name: oic-auth 83 version: 4.668.v653c6b_c6cb_f5 84 - name: matrix-auth 85 version: 3.2.9 86 - name: pipeline-stage-view 87 version: "2.39" 88 - name: generic-webhook-trigger 89 version: 2.4.1 90 - name: timestamper 91 version: "1.30" 92 - name: ansicolor 93 version: 536.v13fa_b_860c267 94 - name: docker-workflow 95 version: 634.vedc7242b_eda_7 96 - name: github 97 version: 1.46.0 98 # Container specification 99 containers: 100 - name: jenkins-master 101 image: jenkins/jenkins:2.541.3-lts 102 imagePullPolicy: IfNotPresent 103 # Security context for container 104 securityContext: 105 # Allow privileged for Docker socket access 106 privileged: true 107 allowPrivilegeEscalation: true 108 # Liveness probe 109 livenessProbe: 110 failureThreshold: 20 111 httpGet: 112 path: /login 113 port: 8080 114 scheme: HTTP 115 initialDelaySeconds: 100 116 periodSeconds: 10 117 successThreshold: 1 118 timeoutSeconds: 8 119 # Readiness probe 120 readinessProbe: 121 failureThreshold: 60 122 httpGet: 123 path: /login 124 port: 8080 125 scheme: HTTP 126 initialDelaySeconds: 120 127 periodSeconds: 10 128 successThreshold: 1 129 timeoutSeconds: 8 130 # Resource management 131 resources: 132 limits: 133 cpu: 1000m 134 memory: 3Gi 135 requests: 136 cpu: 250m 137 memory: 500Mi 138 # Port configuration 139 ports: 140 - containerPort: 8080 141 name: http 142 protocol: TCP 143 - containerPort: 50000 144 name: agent 145 protocol: TCP 146 # Volume mounts 147 volumeMounts: 148 - name: registry-secret 149 mountPath: /var/run/secrets/docker.io 150 readOnly: true 151 - name: cosign-key 152 mountPath: /var/run/secrets/cosign 153 readOnly: true 154 # Backup container sidecar 155 - name: backup 156 image: quay.io/jenkins-kubernetes-operator/backup-pvc:v0.4.4 157 imagePullPolicy: IfNotPresent 158 env: 159 - name: BACKUP_DIR 160 value: /backup 161 - name: JENKINS_HOME 162 value: /var/lib/jenkins 163 - name: BACKUP_COUNT 164 value: "3" 165 volumeMounts: 166 - name: jenkins-home 167 mountPath: /var/lib/jenkins 168 - name: backup 169 mountPath: /backup 170 resources: 171 limits: 172 cpu: 1000m 173 memory: 2Gi 174 requests: 175 cpu: 100m 176 memory: 500Mi 177 # Volumes 178 volumes: 179 - name: registry-secret 180 secret: 181 secretName: registry-credentials 182 defaultMode: 256 183 - name: cosign-key 184 secret: 185 secretName: cosign-signing-key 186 defaultMode: 256 187 - name: backup 188 persistentVolumeClaim: 189 claimName: jenkins-backup 190 --- 191 apiVersion: gateway.networking.k8s.io/v1 192 kind: HTTPRoute 193 metadata: 194 name: jenkins 195 namespace: jenkins 196 spec: 197 parentRefs: 198 - name: envoy-gateway 199 namespace: envoy-gateway 200 hostnames: 201 - jenkins.midnightthoughts.space 202 rules: 203 - backendRefs: 204 - name: jenkins-operator-http-jenkins 205 port: 8080 206 timeouts: 207 request: 600s 208 backendRequest: 0s