jenkins

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# Default values for jenkins.

# This is a YAML-formatted file.

# Declare name/value pairs to be passed into your templates.

# name: value

## Overrides for generated resource names

# See templates/_helpers.tpl

# -- Override the resource name prefix

# @default -- `Chart.Name`

nameOverride:

# -- Override the full resource names

# @default -- `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins`

fullnameOverride:

# -- Override the deployment namespace

# @default -- `Release.Namespace`

namespaceOverride:

# For FQDN resolving of the controller service. Change this value to match your existing configuration.

# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md

# -- Override the cluster name for FQDN resolving

clusterZone: "cluster.local"

# -- The URL of the Kubernetes API server

kubernetesURL: "https://kubernetes.default"

# -- The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed.

credentialsId:

# -- Enables rendering of the helm.sh/chart label to the annotations

renderHelmLabels: true

# -- Configures extra labels for the agent all objects

extraLabels: {}

# -- Configures extra manifests

extraObjects:

controller:

# -- Used for label app.kubernetes.io/component

componentName: "jenkins-controller"

image:

# -- Controller image registry

registry: cgr.dev

# -- Controller image repository

repository: scratch-images/test-tmp/jenkins

# -- Controller image tag override; i.e., tag: "2.440.1-jdk21"

tag: 2.580-r0-jdk21@sha256:2ef12fc4714e12f464204c15b038410579ca2b2a213289381581569861ae4a49

# -- Controller image tag label

tagLabel: jdk21

# -- Controller image pull policy

pullPolicy: "Always"

# -- Number of replicas. Max 1. Can be set to 0 for maintenance scenarios.

replicas: 1

# -- Controller image pull secret

imagePullSecretName:

# -- Lifecycle specification for controller-container

lifecycle: {}

# postStart:

# exec:

# command:

# - "uname"

# - "-a"

# -- Disable use of remember me

disableRememberMe: false

# -- Set Number of executors

numExecutors: 0

# -- Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE"

executorMode: "NORMAL"

# -- Append Jenkins labels to the controller

customJenkinsLabels: []

hostNetworking: false

# When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist.

# If you disable the non-Jenkins identity store and instead use the Jenkins internal one,

# you should revert controller.admin.username to your preferred admin user:

admin:

# -- Admin username created as a secret if `controller.admin.createSecret` is true

username: "admin"

# -- Admin password created as a secret if `controller.admin.createSecret` is true

# @default -- <random password>

password:

# -- The key in the existing admin secret containing the username

userKey: jenkins-admin-user

# -- The key in the existing admin secret containing the password

passwordKey: jenkins-admin-password

# The default configuration uses this secret to configure an admin user

# If you don't need that user or use a different security realm, then you can disable it

# -- Create secret for admin user

createSecret: true

# -- The name of an existing secret containing the admin credentials

existingSecret: ""

# -- Email address for the administrator of the Jenkins instance

jenkinsAdminEmail:

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution"

# -- Custom Jenkins home path

jenkinsHome: "/var/jenkins_home"

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref"

# -- Custom Jenkins reference path

jenkinsRef: "/usr/share/jenkins/ref"

# Path to the jenkins war file which is used by jenkins-plugin-cli.

jenkinsWar: "/usr/share/jenkins/jenkins.war"

# Override the default arguments passed to the war

# overrideArgs:

# - --httpPort=8080

100

101

# -- Resource allocation (Requests and Limits)

102

resources:

103

requests:

104

cpu: "50m"

105

memory: "256Mi"

106

limits:

107

cpu: "2000m"

108

memory: "4096Mi"

109

# Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod

110

shareProcessNamespace: false

111

# Service links might cause issue if running in a namespace with a large amount of services

112

# that might cause a slow startup when plugins are copied from ref to volume

113

# Set to true to keep previous behavior

114

# See https://github.com/kubernetes/kubernetes/issues/121787

115

enableServiceLinks: false

116

# Overrides the init container default values

117

# -- Resources allocation (Requests and Limits) for Init Container

118

initContainerResources: {}

119

# initContainerResources:

120

# requests:

121

# cpu: "50m"

122

# memory: "256Mi"

123

# limits:

124

# cpu: "2000m"

125

# memory: "4096Mi"

126

# -- Environment variable sources for Init Container

127

initContainerEnvFrom: []

128

# useful for i.e., http_proxy

129

# -- Environment variables for Init Container

130

initContainerEnv: []

131

# initContainerEnv:

132

# - name: http_proxy

133

# value: "http://192.168.64.1:3128"

134

135

# -- Environment variable sources for Jenkins Container

136

containerEnvFrom: []

137

# -- Environment variables for Jenkins Container

138

containerEnv: []

139

# - name: http_proxy

140

# value: "http://192.168.64.1:3128"

141

142

# Set min/max heap here if needed with "-Xms512m -Xmx512m"

143

# -- Append to `JAVA_OPTS` env var

144

javaOpts:

145

# -- Append to `JENKINS_OPTS` env var

146

jenkinsOpts:

147

# If you are using the ingress definitions provided by this chart via the `controller.ingress` block,

148

# the configured hostname will be the ingress hostname starting with `https://`

149

# or `http://` depending on the `tls` configuration.

150

# The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`.

151

# -- Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise

152

jenkinsUrlProtocol:

153

# -- Set Jenkins URL if you are not using the ingress definitions provided by the chart

154

jenkinsUrl:

155

# If you set this prefix and use ingress controller, then you might want to set the ingress path below

156

# I.e., "/jenkins"

157

# -- Root URI Jenkins will be served on

158

jenkinsUriPrefix:

159

# -- Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set)

160

usePodSecurityContext: true

161

# Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are

162

# being deprecated and replaced by `podSecurityContextOverride`.

163

# Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins', which exists in 'jenkins/jenkins' docker image.

164

# When configuring runAsUser to a different value than 0 also set fsGroup to the same value:

165

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with.

166

runAsUser: 1000

167

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume.

168

fsGroup: 1000

169

# -- Deprecated in favor of `controller.podSecurityContextOverride`. fsGroupChangePolicy for the pod security context

170

fsGroupChangePolicy: OnRootMismatch

171

# If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here

172

# securityContextCapabilities:

173

# drop:

174

# - NET_RAW

175

securityContextCapabilities: {}

176

# In the case of mounting an ext4 filesystem, it might be desirable to use `supplementalGroups` instead of `fsGroup` in

177

# the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496

178

# podSecurityContextOverride:

179

# runAsUser: 1000

180

# runAsNonRoot: true

181

# supplementalGroups: [1000]

182

# capabilities: {}

183

# -- Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities`

184

podSecurityContextOverride: ~

185

# -- Allow controlling the securityContext for the jenkins container

186

containerSecurityContext:

187

runAsUser: 1000

188

runAsGroup: 1000

189

readOnlyRootFilesystem: true

190

allowPrivilegeEscalation: false

191

# -- enable or disable the controller k8s service

192

serviceEnabled: true

193

# For minikube, set this to NodePort, elsewhere uses LoadBalancer

194

# Use ClusterIP if your setup includes ingress controller

195

# -- k8s service type

196

serviceType: ClusterIP

197

# -- k8s service clusterIP. Only used if serviceType is ClusterIP

198

clusterIp:

199

# -- k8s service port

200

servicePort: 8080

201

# -- k8s target port

202

targetPort: 8080

203

# -- k8s node port. Only used if serviceType is NodePort

204

nodePort:

205

# Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and NodePort type services,

206

# but risks potentially imbalanced traffic spreading.

207

serviceExternalTrafficPolicy:

208

# If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and

209

# auto-reload on restart feature possible.

210

publishNotReadyAddresses:

211

# -- Jenkins controller service annotations

212

serviceAnnotations: {}

213

# -- Jenkins controller custom labels for the StatefulSet

214

statefulSetLabels: {}

215

# foo: bar

216

# bar: foo

217

# -- Labels for the Jenkins controller-service

218

serviceLabels: {}

219

# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https

220

221

# Put labels on Jenkins controller pod

222

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

223

podLabels: {}

224

# Enable Kubernetes Startup, Liveness and Readiness Probes

225

# if Startup Probe is supported, enable it too

226

# ~ 2 minutes to allow Jenkins to restart when upgrading plugins. Set ReadinessTimeout to be shorter than LivenessTimeout.

227

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes

228

# -- Enable Kubernetes Probes configuration configured in `controller.probes`

229

healthProbes: true

230

probes:

231

startupProbe:

232

# -- Set the failure threshold for the startup probe

233

failureThreshold: 12

234

httpGet:

235

# -- Set the Pod's HTTP path for the startup probe

236

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

237

# -- Set the Pod's HTTP port to use for the startup probe

238

port: http

239

# -- Set the time interval between two startup probes executions in seconds

240

periodSeconds: 10

241

# -- Set the timeout for the startup probe in seconds

242

timeoutSeconds: 5

243

livenessProbe:

244

# -- Set the failure threshold for the liveness probe

245

failureThreshold: 5

246

httpGet:

247

# -- Set the Pod's HTTP path for the liveness probe

248

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

249

# -- Set the Pod's HTTP port to use for the liveness probe

250

port: http

251

# -- Set the time interval between two liveness probes executions in seconds

252

periodSeconds: 10

253

# -- Set the timeout for the liveness probe in seconds

254

timeoutSeconds: 5

255

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

256

# It delays the initial liveness probe while Jenkins is starting

257

# -- Set the initial delay for the liveness probe in seconds

258

initialDelaySeconds:

259

readinessProbe:

260

# -- Set the failure threshold for the readiness probe

261

failureThreshold: 3

262

httpGet:

263

# -- Set the Pod's HTTP path for the liveness probe

264

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

265

# -- Set the Pod's HTTP port to use for the readiness probe

266

port: http

267

# -- Set the time interval between two readiness probes executions in seconds

268

periodSeconds: 10

269

# -- Set the timeout for the readiness probe in seconds

270

timeoutSeconds: 5

271

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

272

# It delays the initial readiness probe while Jenkins is starting

273

# -- Set the initial delay for the readiness probe in seconds

274

initialDelaySeconds:

275

# PodDisruptionBudget config

276

podDisruptionBudget:

277

# ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

278

279

# -- Enable Kubernetes Pod Disruption Budget configuration

280

enabled: false

281

# For Kubernetes v1.5+, use 'policy/v1beta1'

282

# For Kubernetes v1.21+, use 'policy/v1'

283

# -- Policy API version

284

apiVersion: "policy/v1beta1"

285

annotations: {}

286

labels: {}

287

# -- Number of pods that can be unavailable. Either an absolute number or a percentage

288

maxUnavailable: "0"

289

# -- Create Agent listener service

290

agentListenerEnabled: true

291

# -- Listening port for agents

292

agentListenerPort: 50000

293

# -- Host port to listen for agents

294

agentListenerHostPort:

295

# -- Node port to listen for agents

296

agentListenerNodePort:

297

# ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

298

# -- Traffic Policy of for the agentListener service

299

agentListenerExternalTrafficPolicy:

300

# -- Allowed inbound IP for the agentListener service

301

agentListenerLoadBalancerSourceRanges:

302

- 0.0.0.0/0

303

# -- Disabled agent protocols

304

disabledAgentProtocols:

305

- JNLP-connect

306

- JNLP2-connect

307

csrf:

308

defaultCrumbIssuer:

309

# -- Enable the default CSRF Crumb issuer

310

enabled: true

311

# -- Enable proxy compatibility. This setting is ignored if you are not on the current LTS release and will be dropped with the next LTS.

312

proxyCompatability: true

313

# Kubernetes service type for the JNLP agent service

314

# agentListenerServiceType is the Kubernetes Service type for the JNLP agent service,

315

# either 'LoadBalancer', 'NodePort', or 'ClusterIP'

316

# Note if you set this to 'LoadBalancer', you *must* define annotations to secure it. By default,

317

# this will be an external load balancer and allowing inbound 0.0.0.0/0, a HUGE

318

# security risk: https://github.com/kubernetes/charts/issues/1341

319

# -- Defines how to expose the agentListener service

320

agentListenerServiceType: "ClusterIP"

321

# -- Annotations for the agentListener service

322

agentListenerServiceAnnotations: {}

323

# Optionally, assign an IP to the LoadBalancer agentListenerService LoadBalancer

324

# GKE users: only regional static IPs will work for Service Load balancer.

325

# -- Static IP for the agentListener LoadBalancer

326

agentListenerLoadBalancerIP:

327

# -- Whether legacy remoting security should be enabled

328

legacyRemotingSecurityEnabled: false

329

# Example of a 'LoadBalancer'-type agent listener with annotations securing it

330

# agentListenerServiceType: LoadBalancer

331

# agentListenerServiceAnnotations:

332

# service.beta.kubernetes.io/aws-load-balancer-internal: "True"

333

# service.beta.kubernetes.io/load-balancer-source-ranges: "172.0.0.0/8, 10.0.0.0/8"

334

335

# LoadBalancerSourcesRange is a list of allowed CIDR values, which are combined with ServicePort to

336

# set allowed inbound rules on the security group assigned to the controller load balancer

337

# -- Allowed inbound IP addresses

338

loadBalancerSourceRanges:

339

- 0.0.0.0/0

340

# -- Optionally assign a known public LB IP

341

loadBalancerIP:

342

# Optionally configure a JMX port. This requires additional javaOpts, for example,

343

# javaOpts: >

344

# -Dcom.sun.management.jmxremote.port=4000

345

# -Dcom.sun.management.jmxremote.authenticate=false

346

# -Dcom.sun.management.jmxremote.ssl=false

347

# jmxPort: 4000

348

# -- Open a port, for JMX stats

349

jmxPort:

350

# -- Optionally configure other ports to expose in the controller container

351

extraPorts: []

352

# - name: BuildInfoProxy

353

# port: 9000

354

# targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port)

355

356

# Plugins will be installed during Jenkins controller start

357

# -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false`

358

installPlugins:

359

- kubernetes:4540.v612369217f87

360

- workflow-aggregator:608.v67378e9d3db_1

361

- git:5.10.1

362

- configuration-as-code:2121.v86fe99d4b_b_a_b_

363

# If set to false, Jenkins will download the minimum required version of all dependencies.

364

# -- Download the minimum required version or latest version of all dependencies

365

installLatestPlugins: true

366

# -- Set to true to download the latest version of any plugin that is requested to have the latest version

367

installLatestSpecifiedPlugins: false

368

# -- List of plugins to install in addition to those listed in controller.installPlugins

369

additionalPlugins: []

370

# Without this; whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates that have the potential to cause breakage.

371

# Note that for this to work, `persistence.enabled` needs to be set to `true`

372

# -- Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`

373

initializeOnce: false

374

# Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment.

375

# -- Overwrite installed plugins on start

376

overwritePlugins: false

377

# Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment.

378

# -- Overwrite plugins that are already installed in the controller image

379

overwritePluginsFromImage: true

380

# Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config.

381

projectNamingStrategy: standard

382

# Useful with ghprb plugin. The OWASP plugin is not installed by default, please update controller.installPlugins.

383

# -- Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter)

384

enableRawHtmlMarkupFormatter: false

385

# This is ignored if enableRawHtmlMarkupFormatter is true

386

# -- Yaml of the markup formatter to use

387

markupFormatter: plainText

388

# Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval

389

# -- List of groovy functions to approve

390

scriptApproval: []

391

# - "method groovy.json.JsonSlurperClassic parseText java.lang.String"

392

# - "new groovy.json.JsonSlurperClassic"

393

394

# -- Map of groovy init scripts to be executed during Jenkins controller start

395

initScripts: {}

396

# test: |-

397

# print 'adding global pipeline libraries, register properties, bootstrap jobs...'

398

# -- Name of the existing ConfigMap that contains init scripts

399

initConfigMap:

400

# 'name' is a name of an existing secret in the same namespace as jenkins,

401

# 'keyName' is the name of one of the keys inside the current secret.

402

# the 'name' and 'keyName' are concatenated with a '-' in between, so for example:

403

# an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password}

404

# 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-',

405

# and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc')

406

# existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username}

407

# When using existingSecret no need to specify the keyName under additionalExistingSecrets.

408

existingSecret:

409

# -- List of additional existing secrets to mount

410

additionalExistingSecrets: []

411

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

412

# additionalExistingSecrets:

413

# - name: secret-name-1

414

# keyName: username

415

# - name: secret-name-1

416

# keyName: password

417

418

# -- List of additional secrets to create and mount

419

additionalSecrets: []

420

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

421

# additionalSecrets:

422

# - name: nameOfSecret

423

# value: secretText

424

425

# Generate SecretClaim resources to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller.

426

# 'name' is the name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value.

427

# 'path' is the fully qualified path to the secret in Vault

428

# 'type' is an optional Kubernetes secret type. The default is 'Opaque'

429

# 'renew' is an optional secret renewal time in seconds

430

# -- List of `SecretClaim` resources to create

431

secretClaims: []

432

# - name: secretName # required

433

# path: testPath # required

434

# type: kubernetes.io/tls # optional

435

# renew: 60 # optional

436

437

# -- Name of default cloud configuration.

438

cloudName: "kubernetes"

439

# Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area,

440

# where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value.

441

# Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

442

# characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in

443

# /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each |

444

# become the content of the configuration yaml file. The first line after this is a JCasC root element, e.g., jenkins, credentials,

445

# etc. Best reference is https://<jenkins_url>/configuration-as-code/reference. The example below creates a welcome message:

446

JCasC:

447

# -- Enables default Jenkins configuration via configuration as code plugin

448

defaultConfig: true

449

# If true, the init container deletes all the plugin config files and Jenkins Config as Code overwrites any existing configuration

450

# -- Whether Jenkins Config as Code should overwrite any existing configuration

451

overwriteConfiguration: false

452

# -- Remote URLs for configuration files.

453

configUrls: []

454

# - https://acme.org/jenkins.yaml

455

# -- List of Jenkins Config as Code scripts

456

configScripts: {}

457

# welcome-message: |

458

# jenkins:

459

# systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.

460

461

# Allows adding to the top-level security JCasC section. For legacy purposes, by default, the chart includes apiToken configurations

462

# -- Jenkins Config as Code security-section

463

security:

464

apiToken:

465

creationOfLegacyTokenEnabled: false

466

tokenGenerationOnCreationEnabled: false

467

usageStatisticsEnabled: true

468

# Ignored if securityRealm is defined in controller.JCasC.configScripts

469

# -- Jenkins Config as Code Security Realm-section

470

securityRealm: |-

471

local:

472

allowsSignup: false

473

enableCaptcha: false

474

users:

475

- id: "${chart-admin-username}"

476

name: "Jenkins Admin"

477

password: "${chart-admin-password}"

478

# Ignored if authorizationStrategy is defined in controller.JCasC.configScripts

479

# -- Jenkins Config as Code Authorization Strategy-section

480

authorizationStrategy: |-

481

loggedInUsersCanDoAnything:

482

allowAnonymousRead: false

483

# -- Annotations for the JCasC ConfigMap

484

configMapAnnotations: {}

485

# -- Custom init-container specification in raw-yaml format

486

customInitContainers: []

487

# - name: custom-init

488

# image: "alpine:3"

489

# imagePullPolicy: Always

490

# command: [ "uname", "-a" ]

491

492

sidecars:

493

configAutoReload:

494

# If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot.

495

# If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up.

496

# Auto-reload uses the http://<jenkins_url>/reload-configuration-as-code endpoint to reapply config when changes to

497

# the configScripts are detected.

498

# -- Enable Jenkins Config as Code auto-reload

499

enabled: true

500

image:

501

# -- Registry for the image that triggers the reload

502

registry: cgr.dev

503

# -- Repository of the image that triggers the reload

504

repository: scratch-images/test-tmp/k8s-sidecar

505

# -- Tag for the image that triggers the reload

506

tag: 2.11.2-r0@sha256:46642034de7c0b26d01c2d4e5bc481c45645f854eacdb65a45a467a035399351

507

imagePullPolicy: IfNotPresent

508

# -- Port for sidecar health probes

509

healthPort: 8060

510

resources: {}

511

# limits:

512

# cpu: 100m

513

# memory: 100Mi

514

# requests:

515

# cpu: 50m

516

# memory: 50Mi

517

# -- Enables additional volume mounts for the config auto-reload container

518

additionalVolumeMounts: []

519

# - name: auto-reload-config

520

# mountPath: /var/config/logger

521

# - name: auto-reload-logs

522

# mountPath: /var/log/auto_reload

523

# -- Config auto-reload logging settings

524

logging:

525

# See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py

526

configuration:

527

# -- Enables custom log config utilizing using the settings below.

528

override: false

529

logLevel: INFO

530

formatter: JSON

531

logToConsole: true

532

logToFile: false

533

maxBytes: 1024

534

backupCount: 3

535

# -- The scheme to use when connecting to the Jenkins configuration as code endpoint

536

scheme: http

537

# -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint

538

skipTlsVerify: false

539

# -- How many connection-related errors to retry on

540

reqRetryConnect: 10

541

# -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar)

542

sleepTime:

543

# -- Environment variable sources for the Jenkins Config as Code auto-reload container

544

envFrom: []

545

# -- Environment variables for the Jenkins Config as Code auto-reload container

546

env: []

547

# - name: REQ_TIMEOUT

548

# value: "30"

549

550

# SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random.

551

# This is only used to reload JCasC config from the sidecar container running in the Jenkins controller pod.

552

# This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be

553

# accessible via SSH from outside the pod. Note if you use non-root pod privileges (runAsUser & fsGroup),

554

# this must be > 1024:

555

sshTcpPort: 1044

556

# folder in the pod that should hold the collected dashboards:

557

folder: "/var/jenkins_home/casc_configs"

558

# If specified, the sidecar will search for JCasC config-maps inside this namespace.

559

# Otherwise, the namespace in which the sidecar is running will be used.

560

# It's also possible to specify ALL to search in all namespaces:

561

# searchNamespace:

562

# -- Enable container security context

563

containerSecurityContext:

564

readOnlyRootFilesystem: true

565

allowPrivilegeEscalation: false

566

# -- Configures additional sidecar container(s) for the Jenkins controller

567

additionalSidecarContainers: []

568

## The example below runs the client for https://smee.io as sidecar container next to Jenkins,

569

## that allows triggering build behind a secure firewall.

570

## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall

571

572

## Note: To use it you should go to https://smee.io/new and update the url to the generated one.

573

# - name: smee

574

# image: docker.io/twalter/smee-client:1.0.2

575

# args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"]

576

# resources:

577

# limits:

578

# cpu: 50m

579

# memory: 128Mi

580

# requests:

581

# cpu: 10m

582

# memory: 32Mi

583

# -- Name of the Kubernetes scheduler to use

584

schedulerName: ""

585

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

586

# -- Node labels for pod assignment

587

nodeSelector: {}

588

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature

589

# -- Toleration labels for pod assignment

590

tolerations: []

591

# -- Set TerminationGracePeriodSeconds

592

terminationGracePeriodSeconds:

593

# -- Set the termination message path

594

terminationMessagePath:

595

# -- Set the termination message policy

596

terminationMessagePolicy:

597

# -- Affinity settings

598

affinity: {}

599

# Leverage a priorityClass to ensure your pods survive resource shortages

600

# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

601

# -- The name of a `priorityClass` to apply to the controller pod

602

priorityClassName:

603

# -- Annotations for controller pod

604

podAnnotations: {}

605

# -- Annotations for controller StatefulSet

606

statefulSetAnnotations: {}

607

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

608

# -- Update strategy for StatefulSet

609

updateStrategy: {}

610

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#managing-revision-history

611

# -- Maximum number of revisions that will be maintained in the StatefulSet's revision history

612

revisionHistoryLimit:

613

# -- Topology spread constraints

614

topologySpreadConstraints: []

615

# -- DNS config for the pod

616

dnsConfig: {}

617

ingress:

618

# -- Enables the Primary ingress

619

enabled: false

620

# Override for the default paths that map requests to the backend

621

# -- Override for the default Primary Ingress paths

622

paths: []

623

# - backend:

624

# serviceName: ssl-redirect

625

# servicePort: use-annotation

626

# - backend:

627

# serviceName: >-

628

# {{ template "jenkins.fullname" . }}

629

# # Don't use string here, use only integer value!

630

# servicePort: 8080

631

632

# -- Primary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

633

pathType: ImplementationSpecific

634

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

635

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

636

# -- Primary Ingress API version

637

apiVersion: "networking.k8s.io/v1"

638

# -- Primary Ingress labels

639

labels: {}

640

# -- Primary Ingress annotations

641

annotations: {}

642

# kubernetes.io/ingress.class: nginx

643

# kubernetes.io/tls-acme: "true"

644

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

645

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

646

# ingressClassName: nginx

647

# -- Primary Ingress ingressClassName

648

ingressClassName:

649

# Set this path to jenkinsUriPrefix above or use annotations to rewrite path

650

# -- Primary Ingress path

651

path:

652

# configures the hostname e.g. jenkins.example.com

653

# -- Primary Ingress hostname

654

hostName:

655

# -- Primary Hostname to serve assets from

656

resourceRootUrl:

657

# -- Primary Ingress TLS configuration

658

tls: []

659

# - secretName: jenkins.cluster.local

660

# hosts:

661

# - jenkins.cluster.local

662

# often you want to have your controller all locked down and private,

663

# but you still want to get webhooks from your SCM

664

# A secondary ingress will let you expose different urls

665

# with a different configuration

666

secondaryingress:

667

# -- Enables the Secondary Ingress

668

enabled: false

669

# paths you want forwarded to the backend

670

# ex /github-webhook

671

# -- Secondary Ingress paths

672

paths: []

673

# -- Secondary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

674

pathType: ImplementationSpecific

675

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

676

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

677

# -- Secondary Ingress API version

678

apiVersion: "networking.k8s.io/v1"

679

# -- Secondary Ingress labels

680

labels: {}

681

# -- Secondary Ingress annotations

682

annotations: {}

683

# kubernetes.io/ingress.class: nginx

684

# kubernetes.io/tls-acme: "true"

685

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

686

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

687

# -- Secondary Ingress ingressClassName

688

ingressClassName:

689

# configures the hostname e.g., jenkins-external.example.com

690

# -- Secondary Ingress hostname

691

hostName:

692

# -- Secondary Ingress TLS configuration

693

tls:

694

# - secretName: jenkins-external.example.com

695

# hosts:

696

# - jenkins-external.example.com

697

# If you're running on GKE and need to configure a backendconfig

698

# to finish ingress setup, use the following values.

699

# Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig

700

backendconfig:

701

# -- Enables backendconfig

702

enabled: false

703

# -- backendconfig API version

704

apiVersion: "extensions/v1beta1"

705

# -- backendconfig name

706

name:

707

# -- backendconfig labels

708

labels: {}

709

# -- backendconfig annotations

710

annotations: {}

711

# -- backendconfig spec

712

spec: {}

713

# Openshift route

714

route:

715

# -- Enables openshift route

716

enabled: false

717

# -- Route labels

718

labels: {}

719

# -- Route annotations

720

annotations: {}

721

# -- Route path

722

path:

723

# Gateway API HTTPRoute

724

httpRoute:

725

# Toggle to create an HTTPRoute resource alongside the existing ingress definition

726

enabled: false

727

apiVersion: "gateway.networking.k8s.io/v1"

728

kind: HTTPRoute

729

# specify the Gateway instance to bind the HTTPRoute to.

730

parentRefs: []

731

# - name: envoy-gateway-bundle

732

# namespace: envoy-gateway-system

733

# Reuse ingress host information if true; set to false to manage hostnames below

734

reuseIngressConfiguration: false

735

# Hostnames to use for the http route, only used if reuseIngressConfiguration is false.

736

hostnames: []

737

# Extra HTTPRoute rules that will be appended before the default backend

738

extraRules: []

739

# -- HTTPRoute annotations

740

annotations: {}

741

# -- Allows for adding entries to Pod /etc/hosts

742

hostAliases: []

743

# ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

744

# hostAliases:

745

# - ip: 192.168.50.50

746

# hostnames:

747

# - something.local

748

# - ip: 10.0.50.50

749

# hostnames:

750

# - other.local

751

752

# Expose Prometheus metrics

753

prometheus:

754

# If enabled, add the prometheus plugin to the list of plugins to install

755

# https://plugins.jenkins.io/prometheus

756

757

# -- Enables prometheus service monitor

758

enabled: false

759

# -- Additional labels to add to the service monitor object

760

serviceMonitorAdditionalLabels: {}

761

# -- Set a custom namespace where to deploy ServiceMonitor resource

762

serviceMonitorNamespace:

763

# -- How often prometheus should scrape metrics

764

scrapeInterval: 60s

765

# Defaults to the default endpoint used by the prometheus plugin

766

# -- The endpoint prometheus should get metrics from

767

scrapeEndpoint: /prometheus

768

# See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/

769

# The `groups` root object is added by default, add the rule entries

770

# -- Array of prometheus alerting rules

771

alertingrules: []

772

# -- Additional labels to add to the PrometheusRule object

773

alertingRulesAdditionalLabels: {}

774

# -- Set a custom namespace where to deploy PrometheusRule resource

775

prometheusRuleNamespace: ""

776

# RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds

777

# relabelings for a few standard Kubernetes fields. The original scrape job’s name

778

# is available via the __tmp_prometheus_job_name label.

779

# More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

780

relabelings: []

781

# MetricRelabelConfigs to apply to samples before ingestion.

782

metricRelabelings: []

783

googlePodMonitor:

784

# If enabled, It creates Google Managed Prometheus scraping config

785

enabled: false

786

# Set a custom namespace where to deploy PodMonitoring resource

787

# serviceMonitorNamespace: ""

788

scrapeInterval: 60s

789

# This is the default endpoint used by the prometheus plugin

790

scrapeEndpoint: /prometheus

791

# -- Can be used to disable rendering controller test resources when using helm template

792

testEnabled: true

793

httpsKeyStore:

794

# -- Enables HTTPS keystore on jenkins controller

795

enable: false

796

# -- Name of the secret that already has SSL keystore

797

jenkinsHttpsJksSecretName: ""

798

# -- Name of the key in the secret that already has SSL keystore

799

jenkinsHttpsJksSecretKey: "jenkins-jks-file"

800

# -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file

801

jenkinsHttpsJksPasswordSecretName: ""

802

# -- Name of the key in the secret that contains the JKS password

803

jenkinsHttpsJksPasswordSecretKey: "https-jks-password"

804

disableSecretMount: false

805

# When HTTPS keystore is enabled, servicePort and targetPort will be used as HTTPS port

806

# -- HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port.

807

httpPort: 8081

808

# -- Path of HTTPS keystore file

809

path: "/var/jenkins_keystore"

810

# -- Jenkins keystore filename which will appear under controller.httpsKeyStore.path

811

fileName: "keystore.jks"

812

# -- Jenkins keystore password

813

password: "password"

814

# -- Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here

815

jenkinsKeyStoreBase64Encoded:

816

# Convert keystore.jks files content to base64 > $ cat keystore.jks | base64

817

# /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq

818

# AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z

819

# gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe

820

# TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x

821

# QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy

822

# 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR

823

# pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB

824

# Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l

825

# Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG

826

# Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi

827

# HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI

828

# OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO

829

# NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi

830

# Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg

831

# UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te

832

# fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi

833

# Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT

834

# EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ

835

# y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU

836

# iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl

837

# t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ

838

# gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa

839

# jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H

840

# bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn

841

# xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV

842

# BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p

843

# bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx

844

# MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y

845

# b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb

846

# BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC

847

# AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w

848

# Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF

849

# 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP

850

# F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i

851

# d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe

852

# 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl

853

# m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h

854

# /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q

855

# 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog

856

# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0=

857

858

agent:

859

# -- Add the environment proxy settings form jenkins controller to the agents.

860

addMasterProxyEnvVars: false

861

# -- Enable Kubernetes plugin jnlp-agent podTemplate

862

enabled: true

863

# -- The name of the pod template to use for providing default values

864

defaultsProviderTemplate: ""

865

# Useful for not including a serviceAccount in the template if `false`

866

# -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount`

867

useDefaultServiceAccount: true

868

# -- Override the default service account

869

# @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true`

870

serviceAccount:

871

# For connecting to the Jenkins controller

872

# -- Overrides the Kubernetes Jenkins URL

873

jenkinsUrl:

874

# connects to the specified host and port, instead of connecting directly to the Jenkins controller

875

# -- Overrides the Kubernetes Jenkins tunnel

876

jenkinsTunnel:

877

# -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI

878

skipTlsVerify: false

879

# -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI

880

usageRestricted: false

881

# -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5

882

kubernetesConnectTimeout: 5

883

# -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15

884

kubernetesReadTimeout: 15

885

# -- The maximum concurrent connections to Kubernetes API

886

maxRequestsPerHostStr: "32"

887

# -- Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated

888

retentionTimeout: 5

889

# -- Seconds to wait for pod to be running

890

waitForPodSec: 600

891

# -- Namespace in which the Kubernetes agents should be launched

892

namespace:

893

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

894

podLabels: {}

895

# -- Custom registry used to pull the agent jnlp image from

896

jnlpregistry:

897

image:

898

# -- Registry to pull the agent jnlp image from

899

registry: cgr.dev

900

# -- Repository to pull the agent jnlp image from

901

repository: scratch-images/test-tmp/jenkins-inbound-agent

902

# -- Tag of the image to pull

903

tag: 2.580-r0-jdk21@sha256:41473a541a05229aff56b3cf8a240b384f918f9bc7d0021e705fd5f19645c9df

904

# -- Configure working directory for default agent

905

workingDir: "/home/jenkins/agent"

906

nodeUsageMode: "NORMAL"

907

# -- Append Jenkins labels to the agent

908

customJenkinsLabels: []

909

# -- Name of the secret to be used to pull the image

910

imagePullSecretName:

911

componentName: "jenkins-agent"

912

# -- Enables agent communication via websockets

913

websocket: false

914

directConnection: false

915

# -- Agent privileged container

916

privileged: false

917

# -- Configure container user

918

runAsUser:

919

# -- Configure container group

920

runAsGroup:

921

# -- Enables the agent to use the host network

922

hostNetworking: false

923

# -- Resources allocation (Requests and Limits)

924

resources:

925

requests:

926

cpu: "512m"

927

memory: "512Mi"

928

# ephemeralStorage:

929

limits:

930

cpu: "512m"

931

memory: "512Mi"

932

# ephemeralStorage:

933

livenessProbe: {}

934

# execArgs: "cat /tmp/healthy"

935

# failureThreshold: 3

936

# initialDelaySeconds: 0

937

# periodSeconds: 10

938

# successThreshold: 1

939

# timeoutSeconds: 1

940

941

# You may want to change this to true while testing a new image

942

# -- Always pull agent container image before build

943

alwaysPullImage: false

944

# When using Pod Security Admission in the Agents namespace with the restricted Pod Security Standard,

945

# the jnlp container cannot be scheduled without overriding its container definition with a securityContext.

946

# This option allows to automatically inject in the jnlp container a securityContext

947

# that is suitable for the use of the restricted Pod Security Standard.

948

# -- Set a restricted securityContext on jnlp containers

949

restrictedPssSecurityContext: false

950

# Controls how agent pods are retained after the Jenkins build completes

951

# Possible values: Always, Never, OnFailure

952

podRetention: "Never"

953

# Disable if you do not want the Yaml the agent pod template to show up

954

# in the job Console Output. This can be helpful for either security reasons

955

# or simply to clean up the output to make it easier to read.

956

showRawYaml: true

957

# You can define the volumes that you want to mount for this container

958

# Allowed types are: ConfigMap, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC, Secret

959

# Configure the attributes as they appear in the corresponding Java class for that type

960

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes

961

# -- Additional volumes

962

volumes: []

963

# - type: ConfigMap

964

# configMapName: myconfigmap

965

# mountPath: /var/myapp/myconfigmap

966

# - type: EmptyDir

967

# mountPath: /var/myapp/myemptydir

968

# memory: false

969

# - type: EphemeralVolume

970

# mountPath: /var/myapp/myephemeralvolume

971

# accessModes: ReadWriteOnce

972

# requestsSize: 10Gi

973

# storageClassName: mystorageclass

974

# - type: HostPath

975

# hostPath: /var/lib/containers

976

# mountPath: /var/myapp/myhostpath

977

# - type: Nfs

978

# mountPath: /var/myapp/mynfs

979

# readOnly: false

980

# serverAddress: "192.0.2.0"

981

# serverPath: /var/lib/containers

982

# - type: PVC

983

# claimName: mypvc

984

# mountPath: /var/myapp/mypvc

985

# readOnly: false

986

# - type: Secret

987

# defaultMode: "600"

988

# mountPath: /var/myapp/mysecret

989

# secretName: mysecret

990

# Pod-wide environment, these vars are visible to any container in the agent pod

991

992

# You can define the workspaceVolume that you want to mount for this container

993

# Allowed types are: DynamicPVC, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC

994

# Configure the attributes as they appear in the corresponding Java class for that type

995

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace

996

# -- Workspace volume (defaults to EmptyDir)

997

workspaceVolume: {}

998

## DynamicPVC example

999

# - type: DynamicPVC

1000

# configMapName: myconfigmap

1001

## EmptyDir example

1002

# - type: EmptyDir

1003

# memory: false

1004

## EphemeralVolume example

1005

# - type: EphemeralVolume

1006

# accessModes: ReadWriteOnce

1007

# requestsSize: 10Gi

1008

# storageClassName: mystorageclass

1009

## HostPath example

1010

# - type: HostPath

1011

# hostPath: /var/lib/containers

1012

## NFS example

1013

# - type: Nfs

1014

# readOnly: false

1015

# serverAddress: "192.0.2.0"

1016

# serverPath: /var/lib/containers

1017

## PVC example

1018

# - type: PVC

1019

# claimName: mypvc

1020

# readOnly: false

1021

1022

# Pod-wide environment, these vars are visible to any container in the agent pod

1023

# -- Environment variables for the agent Pod

1024

envVars: []

1025

# - name: PATH

1026

# value: /usr/local/bin

1027

# -- Mount a secret as environment variable

1028

secretEnvVars: []

1029

# - key: PATH

1030

# optional: false # default: false

1031

# secretKey: MY-K8S-PATH

1032

# secretName: my-k8s-secret

1033

1034

# -- Node labels for pod assignment

1035

nodeSelector: {}

1036

# Key Value selectors. Ex:

1037

# nodeSelector

1038

# jenkins-agent: v1

1039

1040

# -- Command to execute when side container starts

1041

command:

1042

# -- Arguments passed to command to execute

1043

args: "${computer.jnlpmac} ${computer.name}"

1044

# -- Side container name

1045

sideContainerName: "jnlp"

1046

# Doesn't allocate pseudo TTY by default

1047

# -- Allocate pseudo tty to the side container

1048

TTYEnabled: false

1049

# -- Max number of agents to launch for a whole cluster.

1050

containerCap: 10

1051

# -- Max number of agents to launch for this type of agent

1052

instanceCap: 2147483647

1053

# -- Agent Pod base name

1054

podName: "default"

1055

# Enables garbage collection of orphan pods for this Kubernetes cloud. (beta)

1056

garbageCollection:

1057

# -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them.

1058

enabled: false

1059

# -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line.

1060

namespaces: ""

1061

# namespaces: |-

1062

# namespaceOne

1063

# namespaceTwo

1064

# -- Timeout value for orphaned pods

1065

timeout: 300

1066

# -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it

1067

idleMinutes: 0

1068

# The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods.

1069

# https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates

1070

# https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1071

# -- The raw yaml of a Pod API Object to merge into the agent spec

1072

yamlTemplate: ""

1073

# yamlTemplate: |-

1074

# apiVersion: v1

1075

# kind: Pod

1076

# spec:

1077

# tolerations:

1078

# - key: "key"

1079

# operator: "Equal"

1080

# value: "value"

1081

1082

# -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override"

1083

yamlMergeStrategy: "override"

1084

# -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one

1085

inheritYamlMergeStrategy: false

1086

# -- Timeout in seconds for an agent to be online

1087

connectTimeout: 100

1088

# -- Annotations to apply to the pod

1089

annotations: {}

1090

# Containers specified here are added to all agents. Set key empty to remove container from additional agents.

1091

# -- Add additional containers to the agents

1092

additionalContainers: []

1093

# - sideContainerName: dind

1094

# image:

1095

# repository: docker

1096

# tag: dind

1097

# command: dockerd-entrypoint.sh

1098

# args: ""

1099

# privileged: true

1100

# resources:

1101

# requests:

1102

# cpu: 500m

1103

# memory: 1Gi

1104

# limits:

1105

# cpu: 1

1106

# memory: 2Gi

1107

1108

# Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template.

1109

# -- Disable the default Jenkins Agent configuration

1110

disableDefaultAgent: false

1111

# Below is the implementation of custom pod templates for the default configured kubernetes cloud.

1112

# Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value.

1113

# Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

1114

# characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers.

1115

# For this pod templates configuration to be loaded, the following values must be set:

1116

# controller.JCasC.defaultConfig: true

1117

# Best reference is https://<jenkins_url>/configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template.

1118

# -- Configures extra pod templates for the default kubernetes cloud

1119

podTemplates: {}

1120

# python: |

1121

# - name: python

1122

# label: jenkins-python

1123

# serviceAccount: jenkins

1124

# containers:

1125

# - name: python

1126

# image: python:3

1127

# command: "/bin/sh -c"

1128

# args: "cat"

1129

# ttyEnabled: true

1130

# privileged: true

1131

# resourceRequestCpu: "400m"

1132

# resourceRequestMemory: "512Mi"

1133

# resourceLimitCpu: "1"

1134

# resourceLimitMemory: "1024Mi"

1135

# Inherits all values from `agent` so you only need to specify values which differ

1136

# -- Configure additional

1137

additionalAgents: {}

1138

# maven:

1139

# podName: maven

1140

# customJenkinsLabels: maven

1141

# # An example of overriding the jnlp container

1142

# # sideContainerName: jnlp

1143

# image:

1144

# repository: jenkins/jnlp-agent-maven

1145

# tag: latest

1146

# python:

1147

# podName: python

1148

# customJenkinsLabels: python

1149

# sideContainerName: python

1150

# image:

1151

# repository: python

1152

# tag: "3"

1153

# command: "/bin/sh -c"

1154

# args: "cat"

1155

# TTYEnabled: true

1156

1157

# Here you can add additional clouds

1158

# They inherit all values from the default cloud (including the main agent), so

1159

# you only need to specify values which differ. If you want to override

1160

# default additionalAgents with the additionalClouds.additionalAgents set

1161

# additionalAgentsOverride to `true`.

1162

additionalClouds: {}

1163

# remote-cloud-1:

1164

# kubernetesURL: https://api.remote-cloud.com

1165

# additionalAgentsOverride: true

1166

# additionalAgents:

1167

# maven-2:

1168

# podName: maven-2

1169

# customJenkinsLabels: maven

1170

# # An example of overriding the jnlp container

1171

# # sideContainerName: jnlp

1172

# image:

1173

# repository: jenkins/jnlp-agent-maven

1174

# tag: latest

1175

# namespace: my-other-maven-namespace

1176

# remote-cloud-2:

1177

# kubernetesURL: https://api.remote-cloud.com

1178

1179

persistence:

1180

# -- Enable the use of a Jenkins PVC

1181

enabled: true

1182

# A manually managed Persistent Volume and Claim

1183

# Requires persistence.enabled: true

1184

# If defined, PVC must be created manually before volume will be bound

1185

# -- Provide the name of a PVC

1186

existingClaim:

1187

# jenkins data Persistent Volume Storage Class

1188

# If defined, storageClassName: <storageClass>

1189

# If set to "-", storageClassName: "", which disables dynamic provisioning

1190

# If undefined (the default) or set to null, no storageClassName spec is

1191

# set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack)

1192

# -- Storage class for the PVC

1193

storageClass:

1194

# -- Annotations for the PVC

1195

annotations: {}

1196

# -- Labels for the PVC

1197

labels: {}

1198

# -- The PVC access mode

1199

accessMode: "ReadWriteOnce"

1200

# -- The size of the PVC

1201

size: "8Gi"

1202

# ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/

1203

# -- Existing data source to clone PVC from

1204

dataSource: {}

1205

# name: PVC-NAME

1206

# kind: PersistentVolumeClaim

1207

1208

# -- SubPath for jenkins-home mount

1209

subPath:

1210

# -- Additional volumes

1211

volumes: []

1212

# - name: nothing

1213

# emptyDir: {}

1214

1215

# -- Additional mounts

1216

mounts: []

1217

# - mountPath: /var/nothing

1218

# name: nothing

1219

# readOnly: true

1220

networkPolicy:

1221

# -- Enable the creation of NetworkPolicy resources

1222

enabled: false

1223

# For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1'

1224

# For Kubernetes v1.7, use 'networking.k8s.io/v1'

1225

# -- NetworkPolicy ApiVersion

1226

apiVersion: networking.k8s.io/v1

1227

# You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range

1228

internalAgents:

1229

# -- Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels

1230

allowed: true

1231

# -- A map of labels (keys/values) that agent pods must have to be able to connect to controller

1232

podLabels: {}

1233

# -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller

1234

namespaceLabels: {}

1235

# project: myproject

1236

externalAgents:

1237

# -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16

1238

ipCIDR:

1239

# -- A list of IP sub-ranges to be excluded from the allowlisted IP range

1240

except: []

1241

# - 172.17.1.0/24

1242

## Install Default RBAC roles and bindings

1243

rbac:

1244

# -- Whether RBAC resources are created

1245

create: true

1246

# -- Whether the Jenkins service account should be able to read Kubernetes secrets

1247

readSecrets: false

1248

# -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints

1249

useOpenShiftNonRootSCC: false

1250

serviceAccount:

1251

# -- Configures if a ServiceAccount with this name should be created

1252

create: true

1253

# The name of the ServiceAccount is autogenerated by default

1254

# -- The name of the ServiceAccount to be used by access-controlled resources

1255

name:

1256

# -- Configures annotations for the ServiceAccount

1257

annotations: {}

1258

# -- Configures extra labels for the ServiceAccount

1259

extraLabels: {}

1260

# -- Controller ServiceAccount image pull secret

1261

imagePullSecretName:

1262

# -- Auto-mount ServiceAccount token

1263

automountServiceAccountToken: true

1264

serviceAccountAgent:

1265

# -- Configures if an agent ServiceAccount should be created

1266

create: false

1267

# If not set and create is true, a name is generated using the fullname template

1268

# -- The name of the agent ServiceAccount to be used by access-controlled resources

1269

name:

1270

# -- Configures annotations for the agent ServiceAccount

1271

annotations: {}

1272

# -- Configures extra labels for the agent ServiceAccount

1273

extraLabels: {}

1274

# -- Agent ServiceAccount image pull secret

1275

imagePullSecretName:

1276

# -- Auto-mount ServiceAccount token

1277

automountServiceAccountToken: true

1278

# -- Checks if any deprecated values are used

1279

checkDeprecation: true

1280

awsSecurityGroupPolicies:

1281

enabled: false

1282

policies:

1283

- name: ""

1284

securityGroupIds: []

1285

podSelector: {}

1286

# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md

1287

helmtest:

1288

# A testing framework for bash

1289

bats:

1290

# Bash Automated Testing System (BATS)

1291

image:

1292

# -- Registry of the image used to test the framework

1293

registry: "docker.io"

1294

# -- Repository of the image used to test the framework

1295

repository: "bats/bats"

1296

# -- Tag of the image to test the framework

1297

tag: "1.14.0"

1298

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

jenkins

The trusted source for open source

Product

Solutions

Customers

Resources

Company