jenkins

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# Default values for jenkins.

# This is a YAML-formatted file.

# Declare name/value pairs to be passed into your templates.

# name: value

## Overrides for generated resource names

# See templates/_helpers.tpl

# -- Override the resource name prefix

# @default -- `Chart.Name`

nameOverride:

# -- Override the full resource names

# @default -- `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins`

fullnameOverride:

# -- Override the deployment namespace

# @default -- `Release.Namespace`

namespaceOverride:

# For FQDN resolving of the controller service. Change this value to match your existing configuration.

# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md

# -- Override the cluster name for FQDN resolving

clusterZone: "cluster.local"

# -- The URL of the Kubernetes API server

kubernetesURL: "https://kubernetes.default"

# -- The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed.

credentialsId:

# -- Enables rendering of the helm.sh/chart label to the annotations

renderHelmLabels: true

# -- Configures extra labels for the agent all objects

extraLabels: {}

# -- Configures extra manifests

extraObjects:

controller:

# -- Used for label app.kubernetes.io/component

componentName: "jenkins-controller"

image:

# -- Controller image registry

registry: cgr.dev

# -- Controller image repository

repository: chainguard-private/jenkins

# -- Controller image tag override; i.e., tag: "2.440.1-jdk21"

tag: 2.581-r0-jdk21@sha256:b196843ad1d1c0daab1fba02e97b1d8c000fddfa079653cd4f621a5c2bbeb7c1

# -- Controller image tag label

tagLabel: jdk21

# -- Controller image pull policy

pullPolicy: "Always"

# -- Number of replicas. Max 1. Can be set to 0 for maintenance scenarios.

replicas: 1

# -- Controller image pull secret

imagePullSecretName:

# -- Lifecycle specification for controller-container

lifecycle: {}

# postStart:

# exec:

# command:

# - "uname"

# - "-a"

# -- Disable use of remember me

disableRememberMe: false

# -- Set Number of executors

numExecutors: 0

# -- Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE"

executorMode: "NORMAL"

# -- Append Jenkins labels to the controller

customJenkinsLabels: []

hostNetworking: false

# When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist.

# If you disable the non-Jenkins identity store and instead use the Jenkins internal one,

# you should revert controller.admin.username to your preferred admin user:

admin:

# -- Admin username created as a secret if `controller.admin.createSecret` is true

username: "admin"

# -- Admin password created as a secret if `controller.admin.createSecret` is true

# @default -- <random password>

password:

# -- The key in the existing admin secret containing the username

userKey: jenkins-admin-user

# -- The key in the existing admin secret containing the password

passwordKey: jenkins-admin-password

# The default configuration uses this secret to configure an admin user

# If you don't need that user or use a different security realm, then you can disable it

# -- Create secret for admin user

createSecret: true

# -- The name of an existing secret containing the admin credentials

existingSecret: ""

# -- Email address for the administrator of the Jenkins instance

jenkinsAdminEmail:

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution"

# -- Custom Jenkins home path

jenkinsHome: "/var/jenkins_home"

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref"

# -- Custom Jenkins reference path

jenkinsRef: "/usr/share/jenkins/ref"

# Path to the jenkins war file which is used by jenkins-plugin-cli.

jenkinsWar: "/usr/share/jenkins/jenkins.war"

# Override the default arguments passed to the war

# overrideArgs:

# - --httpPort=8080

100

101

# -- Resource allocation (Requests and Limits)

102

resources:

103

requests:

104

cpu: "50m"

105

memory: "256Mi"

106

limits:

107

cpu: "2000m"

108

memory: "4096Mi"

109

# Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod

110

shareProcessNamespace: false

111

# Service links might cause issue if running in a namespace with a large amount of services

112

# that might cause a slow startup when plugins are copied from ref to volume

113

# Set to true to keep previous behavior

114

# See https://github.com/kubernetes/kubernetes/issues/121787

115

enableServiceLinks: false

116

# Overrides the init container default values

117

# -- Resources allocation (Requests and Limits) for Init Container

118

initContainerResources: {}

119

# initContainerResources:

120

# requests:

121

# cpu: "50m"

122

# memory: "256Mi"

123

# limits:

124

# cpu: "2000m"

125

# memory: "4096Mi"

126

# -- Environment variable sources for Init Container

127

initContainerEnvFrom: []

128

# useful for i.e., http_proxy

129

# -- Environment variables for Init Container

130

initContainerEnv: []

131

# initContainerEnv:

132

# - name: http_proxy

133

# value: "http://192.168.64.1:3128"

134

135

# -- Environment variable sources for Jenkins Container

136

containerEnvFrom: []

137

# -- Environment variables for Jenkins Container

138

containerEnv: []

139

# - name: http_proxy

140

# value: "http://192.168.64.1:3128"

141

142

# Set min/max heap here if needed with "-Xms512m -Xmx512m"

143

# -- Append to `JAVA_OPTS` env var

144

javaOpts:

145

# -- Append to `JENKINS_OPTS` env var

146

jenkinsOpts:

147

# If you are using the ingress definitions provided by this chart via the `controller.ingress` block,

148

# the configured hostname will be the ingress hostname starting with `https://`

149

# or `http://` depending on the `tls` configuration.

150

# The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`.

151

# -- Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise

152

jenkinsUrlProtocol:

153

# -- Set Jenkins URL if you are not using the ingress definitions provided by the chart

154

jenkinsUrl:

155

# If you set this prefix and use ingress controller, then you might want to set the ingress path below

156

# I.e., "/jenkins"

157

# -- Root URI Jenkins will be served on

158

jenkinsUriPrefix:

159

# -- Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set)

160

usePodSecurityContext: true

161

# Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are

162

# being deprecated and replaced by `podSecurityContextOverride`.

163

# Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins', which exists in 'jenkins/jenkins' docker image.

164

# When configuring runAsUser to a different value than 0 also set fsGroup to the same value:

165

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with.

166

runAsUser: 1000

167

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume.

168

fsGroup: 1000

169

# -- Deprecated in favor of `controller.podSecurityContextOverride`. fsGroupChangePolicy for the pod security context

170

fsGroupChangePolicy: OnRootMismatch

171

# If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here

172

# securityContextCapabilities:

173

# drop:

174

# - NET_RAW

175

securityContextCapabilities: {}

176

# In the case of mounting an ext4 filesystem, it might be desirable to use `supplementalGroups` instead of `fsGroup` in

177

# the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496

178

# podSecurityContextOverride:

179

# runAsUser: 1000

180

# runAsNonRoot: true

181

# supplementalGroups: [1000]

182

# capabilities: {}

183

# -- Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities`

184

podSecurityContextOverride: ~

185

# -- Allow controlling the securityContext for the jenkins container

186

containerSecurityContext:

187

runAsUser: 1000

188

runAsGroup: 1000

189

readOnlyRootFilesystem: true

190

allowPrivilegeEscalation: false

191

# -- enable or disable the controller k8s service

192

serviceEnabled: true

193

# For minikube, set this to NodePort, elsewhere uses LoadBalancer

194

# Use ClusterIP if your setup includes ingress controller

195

# -- k8s service type

196

serviceType: ClusterIP

197

# -- k8s service clusterIP. Only used if serviceType is ClusterIP

198

clusterIp:

199

# -- k8s service port

200

servicePort: 8080

201

# -- k8s target port

202

targetPort: 8080

203

# -- k8s node port. Only used if serviceType is NodePort

204

nodePort:

205

# Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and NodePort type services,

206

# but risks potentially imbalanced traffic spreading.

207

serviceExternalTrafficPolicy:

208

# If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and

209

# auto-reload on restart feature possible.

210

publishNotReadyAddresses:

211

# -- Jenkins controller service annotations

212

serviceAnnotations: {}

213

# -- Jenkins controller custom labels for the StatefulSet

214

statefulSetLabels: {}

215

# foo: bar

216

# bar: foo

217

# -- Labels for the Jenkins controller-service

218

serviceLabels: {}

219

# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https

220

221

# Put labels on Jenkins controller pod

222

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

223

podLabels: {}

224

# Enable Kubernetes Startup, Liveness and Readiness Probes

225

# if Startup Probe is supported, enable it too

226

# ~ 2 minutes to allow Jenkins to restart when upgrading plugins. Set ReadinessTimeout to be shorter than LivenessTimeout.

227

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes

228

# -- Enable Kubernetes Probes configuration configured in `controller.probes`

229

healthProbes: true

230

probes:

231

startupProbe:

232

# -- Set the failure threshold for the startup probe

233

failureThreshold: 12

234

httpGet:

235

# -- Set the Pod's HTTP path for the startup probe

236

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

237

# -- Set the Pod's HTTP port to use for the startup probe

238

port: http

239

# -- Set the time interval between two startup probes executions in seconds

240

periodSeconds: 10

241

# -- Set the timeout for the startup probe in seconds

242

timeoutSeconds: 5

243

livenessProbe:

244

# -- Set the failure threshold for the liveness probe

245

failureThreshold: 5

246

httpGet:

247

# -- Set the Pod's HTTP path for the liveness probe

248

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

249

# -- Set the Pod's HTTP port to use for the liveness probe

250

port: http

251

# -- Set the time interval between two liveness probes executions in seconds

252

periodSeconds: 10

253

# -- Set the timeout for the liveness probe in seconds

254

timeoutSeconds: 5

255

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

256

# It delays the initial liveness probe while Jenkins is starting

257

# -- Set the initial delay for the liveness probe in seconds

258

initialDelaySeconds:

259

readinessProbe:

260

# -- Set the failure threshold for the readiness probe

261

failureThreshold: 3

262

httpGet:

263

# -- Set the Pod's HTTP path for the liveness probe

264

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

265

# -- Set the Pod's HTTP port to use for the readiness probe

266

port: http

267

# -- Set the time interval between two readiness probes executions in seconds

268

periodSeconds: 10

269

# -- Set the timeout for the readiness probe in seconds

270

timeoutSeconds: 5

271

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

272

# It delays the initial readiness probe while Jenkins is starting

273

# -- Set the initial delay for the readiness probe in seconds

274

initialDelaySeconds:

275

# PodDisruptionBudget config

276

podDisruptionBudget:

277

# ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

278

279

# -- Enable Kubernetes Pod Disruption Budget configuration

280

enabled: false

281

# For Kubernetes v1.5+, use 'policy/v1beta1'

282

# For Kubernetes v1.21+, use 'policy/v1'

283

# -- Policy API version

284

apiVersion: "policy/v1beta1"

285

annotations: {}

286

labels: {}

287

# -- Number of pods that can be unavailable. Either an absolute number or a percentage

288

maxUnavailable: "0"

289

# -- Create Agent listener service

290

agentListenerEnabled: true

291

# -- Listening port for agents

292

agentListenerPort: 50000

293

# -- Host port to listen for agents

294

agentListenerHostPort:

295

# -- Node port to listen for agents

296

agentListenerNodePort:

297

# ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

298

# -- Traffic Policy of for the agentListener service

299

agentListenerExternalTrafficPolicy:

300

# -- Allowed inbound IP for the agentListener service

301

agentListenerLoadBalancerSourceRanges:

302

- 0.0.0.0/0

303

# -- Disabled agent protocols

304

disabledAgentProtocols:

305

- JNLP-connect

306

- JNLP2-connect

307

csrf:

308

defaultCrumbIssuer:

309

# -- Enable the default CSRF Crumb issuer

310

enabled: true

311

# -- Enable proxy compatibility. This setting is ignored if you are not on the current LTS release and will be dropped with the next LTS.

312

proxyCompatability: true

313

# Kubernetes service type for the JNLP agent service

314

# agentListenerServiceType is the Kubernetes Service type for the JNLP agent service,

315

# either 'LoadBalancer', 'NodePort', or 'ClusterIP'

316

# Note if you set this to 'LoadBalancer', you *must* define annotations to secure it. By default,

317

# this will be an external load balancer and allowing inbound 0.0.0.0/0, a HUGE

318

# security risk: https://github.com/kubernetes/charts/issues/1341

319

# -- Defines how to expose the agentListener service

320

agentListenerServiceType: "ClusterIP"

321

# -- Annotations for the agentListener service

322

agentListenerServiceAnnotations: {}

323

# Optionally, assign an IP to the LoadBalancer agentListenerService LoadBalancer

324

# GKE users: only regional static IPs will work for Service Load balancer.

325

# -- Static IP for the agentListener LoadBalancer

326

agentListenerLoadBalancerIP:

327

# -- Whether legacy remoting security should be enabled

328

legacyRemotingSecurityEnabled: false

329

# Example of a 'LoadBalancer'-type agent listener with annotations securing it

330

# agentListenerServiceType: LoadBalancer

331

# agentListenerServiceAnnotations:

332

# service.beta.kubernetes.io/aws-load-balancer-internal: "True"

333

# service.beta.kubernetes.io/load-balancer-source-ranges: "172.0.0.0/8, 10.0.0.0/8"

334

335

# LoadBalancerSourcesRange is a list of allowed CIDR values, which are combined with ServicePort to

336

# set allowed inbound rules on the security group assigned to the controller load balancer

337

# -- Allowed inbound IP addresses

338

loadBalancerSourceRanges:

339

- 0.0.0.0/0

340

# -- Optionally assign a known public LB IP

341

loadBalancerIP:

342

# Optionally configure a JMX port. This requires additional javaOpts, for example,

343

# javaOpts: >

344

# -Dcom.sun.management.jmxremote.port=4000

345

# -Dcom.sun.management.jmxremote.authenticate=false

346

# -Dcom.sun.management.jmxremote.ssl=false

347

# jmxPort: 4000

348

# -- Open a port, for JMX stats

349

jmxPort:

350

# -- Optionally configure other ports to expose in the controller container

351

extraPorts: []

352

# - name: BuildInfoProxy

353

# port: 9000

354

# targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port)

355

356

# Plugins will be installed during Jenkins controller start

357

# -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false`

358

installPlugins:

359

- kubernetes:4557.ve746270f672f

360

- workflow-aggregator:608.v67378e9d3db_1

361

- git:5.10.1

362

- configuration-as-code:2121.v86fe99d4b_b_a_b_

363

# If set to false, Jenkins will download the minimum required version of all dependencies.

364

# -- Download the minimum required version or latest version of all dependencies

365

installLatestPlugins: true

366

# -- Set to true to download the latest version of any plugin that is requested to have the latest version

367

installLatestSpecifiedPlugins: false

368

# -- List of plugins to install in addition to those listed in controller.installPlugins

369

additionalPlugins: []

370

# Without this; whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates that have the potential to cause breakage.

371

# Note that for this to work, `persistence.enabled` needs to be set to `true`

372

# -- Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`

373

initializeOnce: false

374

# Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment.

375

# -- Overwrite installed plugins on start

376

overwritePlugins: false

377

# Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment.

378

# -- Overwrite plugins that are already installed in the controller image

379

overwritePluginsFromImage: true

380

# Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config.

381

projectNamingStrategy: standard

382

# Useful with ghprb plugin. The OWASP plugin is not installed by default, please update controller.installPlugins.

383

# -- Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter)

384

enableRawHtmlMarkupFormatter: false

385

# This is ignored if enableRawHtmlMarkupFormatter is true

386

# -- Yaml of the markup formatter to use

387

markupFormatter: plainText

388

# Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval

389

# -- List of groovy functions to approve

390

scriptApproval: []

391

# - "method groovy.json.JsonSlurperClassic parseText java.lang.String"

392

# - "new groovy.json.JsonSlurperClassic"

393

394

# -- Map of groovy init scripts to be executed during Jenkins controller start

395

initScripts: {}

396

# test: |-

397

# print 'adding global pipeline libraries, register properties, bootstrap jobs...'

398

# -- Name of the existing ConfigMap that contains init scripts

399

initConfigMap:

400

# 'name' is a name of an existing secret in the same namespace as jenkins,

401

# 'keyName' is the name of one of the keys inside the current secret.

402

# the 'name' and 'keyName' are concatenated with a '-' in between, so for example:

403

# an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password}

404

# 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-',

405

# and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc')

406

# existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username}

407

# When using existingSecret no need to specify the keyName under additionalExistingSecrets.

408

existingSecret:

409

# -- List of additional existing secrets to mount

410

additionalExistingSecrets: []

411

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

412

# additionalExistingSecrets:

413

# - name: secret-name-1

414

# keyName: username

415

# - name: secret-name-1

416

# keyName: password

417

418

# -- List of additional secrets to create and mount

419

additionalSecrets: []

420

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

421

# additionalSecrets:

422

# - name: nameOfSecret

423

# value: secretText

424

425

# Generate SecretClaim resources to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller.

426

# 'name' is the name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value.

427

# 'path' is the fully qualified path to the secret in Vault

428

# 'type' is an optional Kubernetes secret type. The default is 'Opaque'

429

# 'renew' is an optional secret renewal time in seconds

430

# -- List of `SecretClaim` resources to create

431

secretClaims: []

432

# - name: secretName # required

433

# path: testPath # required

434

# type: kubernetes.io/tls # optional

435

# renew: 60 # optional

436

437

# -- Name of default cloud configuration.

438

cloudName: "kubernetes"

439

# Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area,

440

# where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value.

441

# Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

442

# characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in

443

# /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each |

444

# become the content of the configuration yaml file. The first line after this is a JCasC root element, e.g., jenkins, credentials,

445

# etc. Best reference is https://<jenkins_url>/configuration-as-code/reference. The example below creates a welcome message:

446

JCasC:

447

# -- Enables default Jenkins configuration via configuration as code plugin

448

defaultConfig: true

449

# If true, the init container deletes all the plugin config files and Jenkins Config as Code overwrites any existing configuration

450

# -- Whether Jenkins Config as Code should overwrite any existing configuration

451

overwriteConfiguration: false

452

# -- Remote URLs for configuration files.

453

configUrls: []

454

# - https://acme.org/jenkins.yaml

455

# -- List of Jenkins Config as Code scripts

456

configScripts: {}

457

# welcome-message: |

458

# jenkins:

459

# systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.

460

461

# Allows adding to the top-level security JCasC section. For legacy purposes, by default, the chart includes apiToken configurations

462

# -- Jenkins Config as Code security-section

463

security:

464

apiToken:

465

creationOfLegacyTokenEnabled: false

466

tokenGenerationOnCreationEnabled: false

467

usageStatisticsEnabled: true

468

# Ignored if securityRealm is defined in controller.JCasC.configScripts

469

# -- Jenkins Config as Code Security Realm-section

470

securityRealm: |-

471

local:

472

allowsSignup: false

473

enableCaptcha: false

474

users:

475

- id: "${chart-admin-username}"

476

name: "Jenkins Admin"

477

password: "${chart-admin-password}"

478

# Ignored if authorizationStrategy is defined in controller.JCasC.configScripts

479

# -- Jenkins Config as Code Authorization Strategy-section

480

authorizationStrategy: |-

481

loggedInUsersCanDoAnything:

482

allowAnonymousRead: false

483

# -- Annotations for the JCasC ConfigMap

484

configMapAnnotations: {}

485

# -- Custom init-container specification in raw-yaml format

486

customInitContainers: []

487

# - name: custom-init

488

# image: "alpine:3"

489

# imagePullPolicy: Always

490

# command: [ "uname", "-a" ]

491

492

sidecars:

493

configAutoReload:

494

# If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot.

495

# If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up.

496

# Auto-reload uses the http://<jenkins_url>/reload-configuration-as-code endpoint to reapply config when changes to

497

# the configScripts are detected.

498

# -- Enable Jenkins Config as Code auto-reload

499

enabled: true

500

image:

501

# -- Registry for the image that triggers the reload

502

registry: cgr.dev

503

# -- Repository of the image that triggers the reload

504

repository: chainguard-private/k8s-sidecar

505

# -- Tag for the image that triggers the reload

506

tag: 2.11.2-r1@sha256:3e8d6d3d1865ec7d2ca2a253ca996713b3917cb86ac373f4d51d6296f743b93a

507

imagePullPolicy: IfNotPresent

508

# -- Port for sidecar health probes

509

healthPort: 8060

510

resources: {}

511

# limits:

512

# cpu: 100m

513

# memory: 100Mi

514

# requests:

515

# cpu: 50m

516

# memory: 50Mi

517

# -- Enables additional volume mounts for the config auto-reload container

518

additionalVolumeMounts: []

519

# - name: auto-reload-config

520

# mountPath: /var/config/logger

521

# - name: auto-reload-logs

522

# mountPath: /var/log/auto_reload

523

# -- Config auto-reload logging settings

524

logging:

525

# See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py

526

configuration:

527

# -- Enables custom log config utilizing using the settings below.

528

override: false

529

logLevel: INFO

530

formatter: JSON

531

logToConsole: true

532

logToFile: false

533

maxBytes: 1024

534

backupCount: 3

535

# -- The scheme to use when connecting to the Jenkins configuration as code endpoint

536

scheme: http

537

# -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint

538

skipTlsVerify: false

539

# -- How many connection-related errors to retry on

540

reqRetryConnect: 10

541

# -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar)

542

sleepTime:

543

# -- Environment variable sources for the Jenkins Config as Code auto-reload container

544

envFrom: []

545

# -- Environment variables for the Jenkins Config as Code auto-reload container

546

env: []

547

# - name: REQ_TIMEOUT

548

# value: "30"

549

550

# SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random.

551

# This is only used to reload JCasC config from the sidecar container running in the Jenkins controller pod.

552

# This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be

553

# accessible via SSH from outside the pod. Note if you use non-root pod privileges (runAsUser & fsGroup),

554

# this must be > 1024:

555

sshTcpPort: 1044

556

# folder in the pod that should hold the collected dashboards:

557

folder: "/var/jenkins_home/casc_configs"

558

# If specified, the sidecar will search for JCasC config-maps inside this namespace.

559

# Otherwise, the namespace in which the sidecar is running will be used.

560

# It's also possible to specify ALL to search in all namespaces:

561

# searchNamespace:

562

# -- Enable container security context

563

containerSecurityContext:

564

readOnlyRootFilesystem: true

565

allowPrivilegeEscalation: false

566

# -- Configures additional sidecar container(s) for the Jenkins controller

567

additionalSidecarContainers: []

568

## The example below runs the client for https://smee.io as sidecar container next to Jenkins,

569

## that allows triggering build behind a secure firewall.

570

## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall

571

572

## Note: To use it you should go to https://smee.io/new and update the url to the generated one.

573

# - name: smee

574

# image: docker.io/twalter/smee-client:1.0.2

575

# args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"]

576

# resources:

577

# limits:

578

# cpu: 50m

579

# memory: 128Mi

580

# requests:

581

# cpu: 10m

582

# memory: 32Mi

583

# -- Name of the Kubernetes scheduler to use

584

schedulerName: ""

585

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

586

# -- Node labels for pod assignment

587

nodeSelector: {}

588

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature

589

# -- Toleration labels for pod assignment

590

tolerations: []

591

# -- Set TerminationGracePeriodSeconds

592

terminationGracePeriodSeconds:

593

# -- Set the termination message path

594

terminationMessagePath:

595

# -- Set the termination message policy

596

terminationMessagePolicy:

597

# -- Affinity settings

598

affinity: {}

599

# Leverage a priorityClass to ensure your pods survive resource shortages

600

# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

601

# -- The name of a `priorityClass` to apply to the controller pod

602

priorityClassName:

603

# -- Annotations for controller pod

604

podAnnotations: {}

605

# -- Annotations for controller StatefulSet

606

statefulSetAnnotations: {}

607

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

608

# -- Update strategy for StatefulSet

609

updateStrategy: {}

610

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#managing-revision-history

611

# -- Maximum number of revisions that will be maintained in the StatefulSet's revision history

612

revisionHistoryLimit:

613

# -- Topology spread constraints

614

topologySpreadConstraints: []

615

# -- DNS config for the pod

616

dnsConfig: {}

617

ingress:

618

# -- Enables the Primary ingress

619

enabled: false

620

# Override for the default paths that map requests to the backend

621

# -- Override for the default Primary Ingress paths

622

paths: []

623

# - backend:

624

# serviceName: ssl-redirect

625

# servicePort: use-annotation

626

# - backend:

627

# serviceName: >-

628

# {{ template "jenkins.fullname" . }}

629

# # Don't use string here, use only integer value!

630

# servicePort: 8080

631

632

# -- Primary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

633

pathType: ImplementationSpecific

634

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

635

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

636

# -- Primary Ingress API version

637

apiVersion: "networking.k8s.io/v1"

638

# -- Primary Ingress labels

639

labels: {}

640

# -- Primary Ingress annotations

641

annotations: {}

642

# kubernetes.io/ingress.class: nginx

643

# kubernetes.io/tls-acme: "true"

644

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

645

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

646

# ingressClassName: nginx

647

# -- Primary Ingress ingressClassName

648

ingressClassName:

649

# Set this path to jenkinsUriPrefix above or use annotations to rewrite path

650

# -- Primary Ingress path

651

path:

652

# configures the hostname e.g. jenkins.example.com

653

# -- Primary Ingress hostname

654

hostName:

655

# -- Primary Hostname to serve assets from

656

resourceRootUrl:

657

# -- Primary Ingress TLS configuration

658

tls: []

659

# - secretName: jenkins.cluster.local

660

# hosts:

661

# - jenkins.cluster.local

662

# often you want to have your controller all locked down and private,

663

# but you still want to get webhooks from your SCM

664

# A secondary ingress will let you expose different urls

665

# with a different configuration

666

secondaryingress:

667

# -- Enables the Secondary Ingress

668

enabled: false

669

# paths you want forwarded to the backend

670

# ex /github-webhook

671

# -- Secondary Ingress paths

672

paths: []

673

# -- Secondary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

674

pathType: ImplementationSpecific

675

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

676

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

677

# -- Secondary Ingress API version

678

apiVersion: "networking.k8s.io/v1"

679

# -- Secondary Ingress labels

680

labels: {}

681

# -- Secondary Ingress annotations

682

annotations: {}

683

# kubernetes.io/ingress.class: nginx

684

# kubernetes.io/tls-acme: "true"

685

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

686

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

687

# -- Secondary Ingress ingressClassName

688

ingressClassName:

689

# configures the hostname e.g., jenkins-external.example.com

690

# -- Secondary Ingress hostname

691

hostName:

692

# -- Secondary Ingress TLS configuration

693

tls:

694

# - secretName: jenkins-external.example.com

695

# hosts:

696

# - jenkins-external.example.com

697

# If you're running on GKE and need to configure a backendconfig

698

# to finish ingress setup, use the following values.

699

# Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig

700

backendconfig:

701

# -- Enables backendconfig

702

enabled: false

703

# -- backendconfig API version

704

apiVersion: "extensions/v1beta1"

705

# -- backendconfig name

706

name:

707

# -- backendconfig labels

708

labels: {}

709

# -- backendconfig annotations

710

annotations: {}

711

# -- backendconfig spec

712

spec: {}

713

# Openshift route

714

route:

715

# -- Enables openshift route

716

enabled: false

717

# -- Route labels

718

labels: {}

719

# -- Route annotations

720

annotations: {}

721

# -- Route path

722

path:

723

# Gateway API HTTPRoute

724

httpRoute:

725

# Toggle to create an HTTPRoute resource alongside the existing ingress definition

726

enabled: false

727

apiVersion: "gateway.networking.k8s.io/v1"

728

kind: HTTPRoute

729

# specify the Gateway instance to bind the HTTPRoute to.

730

parentRefs: []

731

# - name: envoy-gateway-bundle

732

# namespace: envoy-gateway-system

733

# Reuse ingress host information if true; set to false to manage hostnames below

734

reuseIngressConfiguration: false

735

# Hostnames to use for the http route, only used if reuseIngressConfiguration is false.

736

hostnames: []

737

# Extra HTTPRoute rules that will be appended before the default backend

738

extraRules: []

739

# -- HTTPRoute annotations

740

annotations: {}

741

# -- Filters applied to the default HTTPRoute rule

742

filters: []

743

# -- Timeouts applied to the default HTTPRoute rule. Requires Gateway API v1.2+ and controller support

744

timeouts: {}

745

# -- Allows for adding entries to Pod /etc/hosts

746

hostAliases: []

747

# ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

748

# hostAliases:

749

# - ip: 192.168.50.50

750

# hostnames:

751

# - something.local

752

# - ip: 10.0.50.50

753

# hostnames:

754

# - other.local

755

756

# Expose Prometheus metrics

757

prometheus:

758

# If enabled, add the prometheus plugin to the list of plugins to install

759

# https://plugins.jenkins.io/prometheus

760

761

# -- Enables prometheus service monitor

762

enabled: false

763

# -- Additional labels to add to the service monitor object

764

serviceMonitorAdditionalLabels: {}

765

# -- Set a custom namespace where to deploy ServiceMonitor resource

766

serviceMonitorNamespace:

767

# -- How often prometheus should scrape metrics

768

scrapeInterval: 60s

769

# Defaults to the default endpoint used by the prometheus plugin

770

# -- The endpoint prometheus should get metrics from

771

scrapeEndpoint: /prometheus

772

# See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/

773

# The `groups` root object is added by default, add the rule entries

774

# -- Array of prometheus alerting rules

775

alertingrules: []

776

# -- Additional labels to add to the PrometheusRule object

777

alertingRulesAdditionalLabels: {}

778

# -- Set a custom namespace where to deploy PrometheusRule resource

779

prometheusRuleNamespace: ""

780

# RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds

781

# relabelings for a few standard Kubernetes fields. The original scrape job’s name

782

# is available via the __tmp_prometheus_job_name label.

783

# More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

784

relabelings: []

785

# MetricRelabelConfigs to apply to samples before ingestion.

786

metricRelabelings: []

787

googlePodMonitor:

788

# If enabled, It creates Google Managed Prometheus scraping config

789

enabled: false

790

# Set a custom namespace where to deploy PodMonitoring resource

791

# serviceMonitorNamespace: ""

792

scrapeInterval: 60s

793

# This is the default endpoint used by the prometheus plugin

794

scrapeEndpoint: /prometheus

795

# -- Can be used to disable rendering controller test resources when using helm template

796

testEnabled: true

797

httpsKeyStore:

798

# -- Enables HTTPS keystore on jenkins controller

799

enable: false

800

# -- Name of the secret that already has SSL keystore

801

jenkinsHttpsJksSecretName: ""

802

# -- Name of the key in the secret that already has SSL keystore

803

jenkinsHttpsJksSecretKey: "jenkins-jks-file"

804

# -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file

805

jenkinsHttpsJksPasswordSecretName: ""

806

# -- Name of the key in the secret that contains the JKS password

807

jenkinsHttpsJksPasswordSecretKey: "https-jks-password"

808

disableSecretMount: false

809

# When HTTPS keystore is enabled, servicePort and targetPort will be used as HTTPS port

810

# -- HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port.

811

httpPort: 8081

812

# -- Path of HTTPS keystore file

813

path: "/var/jenkins_keystore"

814

# -- Jenkins keystore filename which will appear under controller.httpsKeyStore.path

815

fileName: "keystore.jks"

816

# -- Jenkins keystore password

817

password: "password"

818

# -- Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here

819

jenkinsKeyStoreBase64Encoded:

820

# Convert keystore.jks files content to base64 > $ cat keystore.jks | base64

821

# /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq

822

# AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z

823

# gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe

824

# TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x

825

# QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy

826

# 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR

827

# pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB

828

# Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l

829

# Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG

830

# Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi

831

# HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI

832

# OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO

833

# NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi

834

# Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg

835

# UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te

836

# fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi

837

# Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT

838

# EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ

839

# y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU

840

# iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl

841

# t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ

842

# gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa

843

# jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H

844

# bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn

845

# xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV

846

# BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p

847

# bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx

848

# MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y

849

# b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb

850

# BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC

851

# AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w

852

# Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF

853

# 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP

854

# F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i

855

# d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe

856

# 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl

857

# m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h

858

# /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q

859

# 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog

860

# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0=

861

862

agent:

863

# -- Add the environment proxy settings form jenkins controller to the agents.

864

addMasterProxyEnvVars: false

865

# -- Enable Kubernetes plugin jnlp-agent podTemplate

866

enabled: true

867

# -- The name of the pod template to use for providing default values

868

defaultsProviderTemplate: ""

869

# Useful for not including a serviceAccount in the template if `false`

870

# -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount`

871

useDefaultServiceAccount: true

872

# -- Override the default service account

873

# @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true`

874

serviceAccount:

875

# For connecting to the Jenkins controller

876

# -- Overrides the Kubernetes Jenkins URL

877

jenkinsUrl:

878

# connects to the specified host and port, instead of connecting directly to the Jenkins controller

879

# -- Overrides the Kubernetes Jenkins tunnel

880

jenkinsTunnel:

881

# -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI

882

skipTlsVerify: false

883

# -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI

884

usageRestricted: false

885

# -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5

886

kubernetesConnectTimeout: 5

887

# -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15

888

kubernetesReadTimeout: 15

889

# -- The maximum concurrent connections to Kubernetes API

890

maxRequestsPerHostStr: "32"

891

# -- Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated

892

retentionTimeout: 5

893

# -- Seconds to wait for pod to be running

894

waitForPodSec: 600

895

# -- Namespace in which the Kubernetes agents should be launched

896

namespace:

897

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

898

podLabels: {}

899

# -- Custom registry used to pull the agent jnlp image from

900

jnlpregistry:

901

image:

902

# -- Registry to pull the agent jnlp image from

903

registry: cgr.dev

904

# -- Repository to pull the agent jnlp image from

905

repository: chainguard-private/jenkins-inbound-agent

906

# -- Tag of the image to pull

907

tag: 2.581-r0-jdk21@sha256:eac6238f4a6c67674500c280f2aa5f3839018f547dcc7171b7d5385aced6c15a

908

# -- Configure working directory for default agent

909

workingDir: "/home/jenkins/agent"

910

nodeUsageMode: "NORMAL"

911

# -- Append Jenkins labels to the agent

912

customJenkinsLabels: []

913

# -- Name of the secret to be used to pull the image

914

imagePullSecretName:

915

componentName: "jenkins-agent"

916

# -- Enables agent communication via websockets

917

websocket: false

918

directConnection: false

919

# -- Agent privileged container

920

privileged: false

921

# -- Configure container user

922

runAsUser:

923

# -- Configure container group

924

runAsGroup:

925

# -- Enables the agent to use the host network

926

hostNetworking: false

927

# -- Resources allocation (Requests and Limits)

928

resources:

929

requests:

930

cpu: "512m"

931

memory: "512Mi"

932

# ephemeralStorage:

933

limits:

934

cpu: "512m"

935

memory: "512Mi"

936

# ephemeralStorage:

937

livenessProbe: {}

938

# execArgs: "cat /tmp/healthy"

939

# failureThreshold: 3

940

# initialDelaySeconds: 0

941

# periodSeconds: 10

942

# successThreshold: 1

943

# timeoutSeconds: 1

944

945

# You may want to change this to true while testing a new image

946

# -- Always pull agent container image before build

947

alwaysPullImage: false

948

# When using Pod Security Admission in the Agents namespace with the restricted Pod Security Standard,

949

# the jnlp container cannot be scheduled without overriding its container definition with a securityContext.

950

# This option allows to automatically inject in the jnlp container a securityContext

951

# that is suitable for the use of the restricted Pod Security Standard.

952

# -- Set a restricted securityContext on jnlp containers

953

restrictedPssSecurityContext: false

954

# Controls how agent pods are retained after the Jenkins build completes

955

# Possible values: Always, Never, OnFailure

956

podRetention: "Never"

957

# Disable if you do not want the Yaml the agent pod template to show up

958

# in the job Console Output. This can be helpful for either security reasons

959

# or simply to clean up the output to make it easier to read.

960

showRawYaml: true

961

# You can define the volumes that you want to mount for this container

962

# Allowed types are: ConfigMap, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC, Secret

963

# Configure the attributes as they appear in the corresponding Java class for that type

964

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes

965

# -- Additional volumes

966

volumes: []

967

# - type: ConfigMap

968

# configMapName: myconfigmap

969

# mountPath: /var/myapp/myconfigmap

970

# - type: EmptyDir

971

# mountPath: /var/myapp/myemptydir

972

# memory: false

973

# - type: EphemeralVolume

974

# mountPath: /var/myapp/myephemeralvolume

975

# accessModes: ReadWriteOnce

976

# requestsSize: 10Gi

977

# storageClassName: mystorageclass

978

# - type: HostPath

979

# hostPath: /var/lib/containers

980

# mountPath: /var/myapp/myhostpath

981

# - type: Nfs

982

# mountPath: /var/myapp/mynfs

983

# readOnly: false

984

# serverAddress: "192.0.2.0"

985

# serverPath: /var/lib/containers

986

# - type: PVC

987

# claimName: mypvc

988

# mountPath: /var/myapp/mypvc

989

# readOnly: false

990

# - type: Secret

991

# defaultMode: "600"

992

# mountPath: /var/myapp/mysecret

993

# secretName: mysecret

994

# Pod-wide environment, these vars are visible to any container in the agent pod

995

996

# You can define the workspaceVolume that you want to mount for this container

997

# Allowed types are: DynamicPVC, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC

998

# Configure the attributes as they appear in the corresponding Java class for that type

999

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace

1000

# -- Workspace volume (defaults to EmptyDir)

1001

workspaceVolume: {}

1002

## DynamicPVC example

1003

# - type: DynamicPVC

1004

# configMapName: myconfigmap

1005

## EmptyDir example

1006

# - type: EmptyDir

1007

# memory: false

1008

## EphemeralVolume example

1009

# - type: EphemeralVolume

1010

# accessModes: ReadWriteOnce

1011

# requestsSize: 10Gi

1012

# storageClassName: mystorageclass

1013

## HostPath example

1014

# - type: HostPath

1015

# hostPath: /var/lib/containers

1016

## NFS example

1017

# - type: Nfs

1018

# readOnly: false

1019

# serverAddress: "192.0.2.0"

1020

# serverPath: /var/lib/containers

1021

## PVC example

1022

# - type: PVC

1023

# claimName: mypvc

1024

# readOnly: false

1025

1026

# Pod-wide environment, these vars are visible to any container in the agent pod

1027

# -- Environment variables for the agent Pod

1028

envVars: []

1029

# - name: PATH

1030

# value: /usr/local/bin

1031

# -- Mount a secret as environment variable

1032

secretEnvVars: []

1033

# - key: PATH

1034

# optional: false # default: false

1035

# secretKey: MY-K8S-PATH

1036

# secretName: my-k8s-secret

1037

1038

# -- Node labels for pod assignment

1039

nodeSelector: {}

1040

# Key Value selectors. Ex:

1041

# nodeSelector

1042

# jenkins-agent: v1

1043

1044

# -- Command to execute when side container starts

1045

command:

1046

# -- Arguments passed to command to execute

1047

args: "${computer.jnlpmac} ${computer.name}"

1048

# -- Side container name

1049

sideContainerName: "jnlp"

1050

# Doesn't allocate pseudo TTY by default

1051

# -- Allocate pseudo tty to the side container

1052

TTYEnabled: false

1053

# -- Max number of agents to launch for a whole cluster.

1054

containerCap: 10

1055

# -- Max number of agents to launch for this type of agent

1056

instanceCap: 2147483647

1057

# -- Agent Pod base name

1058

podName: "default"

1059

# Enables garbage collection of orphan pods for this Kubernetes cloud. (beta)

1060

garbageCollection:

1061

# -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them.

1062

enabled: false

1063

# -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line.

1064

namespaces: ""

1065

# namespaces: |-

1066

# namespaceOne

1067

# namespaceTwo

1068

# -- Timeout value for orphaned pods

1069

timeout: 300

1070

# -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it

1071

idleMinutes: 0

1072

# The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods.

1073

# https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates

1074

# https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1075

# -- The raw yaml of a Pod API Object to merge into the agent spec

1076

yamlTemplate: ""

1077

# yamlTemplate: |-

1078

# apiVersion: v1

1079

# kind: Pod

1080

# spec:

1081

# tolerations:

1082

# - key: "key"

1083

# operator: "Equal"

1084

# value: "value"

1085

1086

# -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override"

1087

yamlMergeStrategy: "override"

1088

# -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one

1089

inheritYamlMergeStrategy: false

1090

# -- Timeout in seconds for an agent to be online

1091

connectTimeout: 100

1092

# -- Annotations to apply to the pod

1093

annotations: {}

1094

# Containers specified here are added to all agents. Set key empty to remove container from additional agents.

1095

# -- Add additional containers to the agents

1096

additionalContainers: []

1097

# - sideContainerName: dind

1098

# image:

1099

# repository: docker

1100

# tag: dind

1101

# command: dockerd-entrypoint.sh

1102

# args: ""

1103

# privileged: true

1104

# resources:

1105

# requests:

1106

# cpu: 500m

1107

# memory: 1Gi

1108

# limits:

1109

# cpu: 1

1110

# memory: 2Gi

1111

1112

# Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template.

1113

# -- Disable the default Jenkins Agent configuration

1114

disableDefaultAgent: false

1115

# Below is the implementation of custom pod templates for the default configured kubernetes cloud.

1116

# Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value.

1117

# Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

1118

# characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers.

1119

# For this pod templates configuration to be loaded, the following values must be set:

1120

# controller.JCasC.defaultConfig: true

1121

# Best reference is https://<jenkins_url>/configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template.

1122

# -- Configures extra pod templates for the default kubernetes cloud

1123

podTemplates: {}

1124

# python: |

1125

# - name: python

1126

# label: jenkins-python

1127

# serviceAccount: jenkins

1128

# containers:

1129

# - name: python

1130

# image: python:3

1131

# command: "/bin/sh -c"

1132

# args: "cat"

1133

# ttyEnabled: true

1134

# privileged: true

1135

# resourceRequestCpu: "400m"

1136

# resourceRequestMemory: "512Mi"

1137

# resourceLimitCpu: "1"

1138

# resourceLimitMemory: "1024Mi"

1139

# Inherits all values from `agent` so you only need to specify values which differ

1140

# -- Configure additional

1141

additionalAgents: {}

1142

# maven:

1143

# podName: maven

1144

# customJenkinsLabels: maven

1145

# # An example of overriding the jnlp container

1146

# # sideContainerName: jnlp

1147

# image:

1148

# repository: jenkins/jnlp-agent-maven

1149

# tag: latest

1150

# python:

1151

# podName: python

1152

# customJenkinsLabels: python

1153

# sideContainerName: python

1154

# image:

1155

# repository: python

1156

# tag: "3"

1157

# command: "/bin/sh -c"

1158

# args: "cat"

1159

# TTYEnabled: true

1160

1161

# Here you can add additional clouds

1162

# They inherit all values from the default cloud (including the main agent), so

1163

# you only need to specify values which differ. If you want to override

1164

# default additionalAgents with the additionalClouds.additionalAgents set

1165

# additionalAgentsOverride to `true`.

1166

additionalClouds: {}

1167

# remote-cloud-1:

1168

# kubernetesURL: https://api.remote-cloud.com

1169

# additionalAgentsOverride: true

1170

# additionalAgents:

1171

# maven-2:

1172

# podName: maven-2

1173

# customJenkinsLabels: maven

1174

# # An example of overriding the jnlp container

1175

# # sideContainerName: jnlp

1176

# image:

1177

# repository: jenkins/jnlp-agent-maven

1178

# tag: latest

1179

# namespace: my-other-maven-namespace

1180

# remote-cloud-2:

1181

# kubernetesURL: https://api.remote-cloud.com

1182

1183

persistence:

1184

# -- Enable the use of a Jenkins PVC

1185

enabled: true

1186

# A manually managed Persistent Volume and Claim

1187

# Requires persistence.enabled: true

1188

# If defined, PVC must be created manually before volume will be bound

1189

# -- Provide the name of a PVC

1190

existingClaim:

1191

# jenkins data Persistent Volume Storage Class

1192

# If defined, storageClassName: <storageClass>

1193

# If set to "-", storageClassName: "", which disables dynamic provisioning

1194

# If undefined (the default) or set to null, no storageClassName spec is

1195

# set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack)

1196

# -- Storage class for the PVC

1197

storageClass:

1198

# -- Annotations for the PVC

1199

annotations: {}

1200

# -- Labels for the PVC

1201

labels: {}

1202

# -- The PVC access mode

1203

accessMode: "ReadWriteOnce"

1204

# -- The size of the PVC

1205

size: "8Gi"

1206

# ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/

1207

# -- Existing data source to clone PVC from

1208

dataSource: {}

1209

# name: PVC-NAME

1210

# kind: PersistentVolumeClaim

1211

1212

# -- SubPath for jenkins-home mount

1213

subPath:

1214

# -- Additional volumes

1215

volumes: []

1216

# - name: nothing

1217

# emptyDir: {}

1218

1219

# -- Additional mounts

1220

mounts: []

1221

# - mountPath: /var/nothing

1222

# name: nothing

1223

# readOnly: true

1224

networkPolicy:

1225

# -- Enable the creation of NetworkPolicy resources

1226

enabled: false

1227

# For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1'

1228

# For Kubernetes v1.7, use 'networking.k8s.io/v1'

1229

# -- NetworkPolicy ApiVersion

1230

apiVersion: networking.k8s.io/v1

1231

# You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range

1232

internalAgents:

1233

# -- Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels

1234

allowed: true

1235

# -- A map of labels (keys/values) that agent pods must have to be able to connect to controller

1236

podLabels: {}

1237

# -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller

1238

namespaceLabels: {}

1239

# project: myproject

1240

externalAgents:

1241

# -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16

1242

ipCIDR:

1243

# -- A list of IP sub-ranges to be excluded from the allowlisted IP range

1244

except: []

1245

# - 172.17.1.0/24

1246

## Install Default RBAC roles and bindings

1247

rbac:

1248

# -- Whether RBAC resources are created

1249

create: true

1250

# -- Whether the Jenkins service account should be able to read Kubernetes secrets

1251

readSecrets: false

1252

# -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints

1253

useOpenShiftNonRootSCC: false

1254

serviceAccount:

1255

# -- Configures if a ServiceAccount with this name should be created

1256

create: true

1257

# The name of the ServiceAccount is autogenerated by default

1258

# -- The name of the ServiceAccount to be used by access-controlled resources

1259

name:

1260

# -- Configures annotations for the ServiceAccount

1261

annotations: {}

1262

# -- Configures extra labels for the ServiceAccount

1263

extraLabels: {}

1264

# -- Controller ServiceAccount image pull secret

1265

imagePullSecretName:

1266

# -- Auto-mount ServiceAccount token

1267

automountServiceAccountToken: true

1268

serviceAccountAgent:

1269

# -- Configures if an agent ServiceAccount should be created

1270

create: false

1271

# If not set and create is true, a name is generated using the fullname template

1272

# -- The name of the agent ServiceAccount to be used by access-controlled resources

1273

name:

1274

# -- Configures annotations for the agent ServiceAccount

1275

annotations: {}

1276

# -- Configures extra labels for the agent ServiceAccount

1277

extraLabels: {}

1278

# -- Agent ServiceAccount image pull secret

1279

imagePullSecretName:

1280

# -- Auto-mount ServiceAccount token

1281

automountServiceAccountToken: true

1282

# -- Checks if any deprecated values are used

1283

checkDeprecation: true

1284

awsSecurityGroupPolicies:

1285

enabled: false

1286

policies:

1287

- name: ""

1288

securityGroupIds: []

1289

podSelector: {}

1290

# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md

1291

helmtest:

1292

# A testing framework for bash

1293

bats:

1294

# Bash Automated Testing System (BATS)

1295

# -- Name of the secret to be used to pull the image

1296

imagePullSecretName: ""

1297

image:

1298

# -- Registry of the image used to test the framework

1299

registry: "docker.io"

1300

# -- Repository of the image used to test the framework

1301

repository: "bats/bats"

1302

# -- Tag of the image to test the framework

1303

tag: "1.14.0"

1304

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

jenkins

The trusted source for open source

Product

Solutions

Customers

Resources

Company