jenkins

# Default values for jenkins.

# This is a YAML-formatted file.

# Declare name/value pairs to be passed into your templates.

# name: value

## Overrides for generated resource names

# See templates/_helpers.tpl

# -- Override the resource name prefix

# @default -- `Chart.Name`

nameOverride:

# -- Override the full resource names

# @default -- `jenkins-(release-name)` or `jenkins` if the release-name is `jenkins`

fullnameOverride:

# -- Override the deployment namespace

# @default -- `Release.Namespace`

namespaceOverride:

# For FQDN resolving of the controller service. Change this value to match your existing configuration.

# ref: https://github.com/kubernetes/dns/blob/master/docs/specification.md

# -- Override the cluster name for FQDN resolving

clusterZone: "cluster.local"

# -- The URL of the Kubernetes API server

kubernetesURL: "https://kubernetes.default"

# -- The Jenkins credentials to access the Kubernetes API server. For the default cluster it is not needed.

credentialsId:

# -- Enables rendering of the helm.sh/chart label to the annotations

renderHelmLabels: true

# -- Configures extra labels for the agent all objects

extraLabels: {}

# -- Configures extra manifests

extraObjects:

controller:

# -- Used for label app.kubernetes.io/component

componentName: "jenkins-controller"

image:

# -- Controller image registry

registry: cgr.dev

# -- Controller image repository

repository: chainguard-private/jenkins

# -- Controller image tag override; i.e., tag: "2.440.1-jdk21"

tag: 2.585-r0-jdk21@sha256:93a33d8d98b203d046c48a9de603844f934db291a9d748aafde2b66ee3caba69

# -- Controller image tag label

tagLabel: jdk21

# -- Controller image pull policy

pullPolicy: "Always"

# -- Number of replicas. Max 1. Can be set to 0 for maintenance scenarios.

replicas: 1

# -- Controller image pull secret

imagePullSecretName:

# -- Lifecycle specification for controller-container

lifecycle: {}

# postStart:

# exec:

# command:

# - "uname"

# - "-a"

# -- Disable use of remember me

disableRememberMe: false

# -- Set Number of executors

numExecutors: 0

# -- Sets the executor mode of the Jenkins node. Possible values are "NORMAL" or "EXCLUSIVE"

executorMode: "NORMAL"

# -- Append Jenkins labels to the controller

customJenkinsLabels: []

hostNetworking: false

# When enabling LDAP or another non-Jenkins identity source, the built-in admin account will no longer exist.

# If you disable the non-Jenkins identity store and instead use the Jenkins internal one,

# you should revert controller.admin.username to your preferred admin user:

admin:

# -- Admin username created as a secret if `controller.admin.createSecret` is true

username: "admin"

# -- Admin password created as a secret if `controller.admin.createSecret` is true

# @default -- <random password>

password:

# -- The key in the existing admin secret containing the username

userKey: jenkins-admin-user

# -- The key in the existing admin secret containing the password

passwordKey: jenkins-admin-password

# The default configuration uses this secret to configure an admin user

# If you don't need that user or use a different security realm, then you can disable it

# -- Create secret for admin user

createSecret: true

# -- The name of an existing secret containing the admin credentials

existingSecret: ""

# -- Email address for the administrator of the Jenkins instance

jenkinsAdminEmail:

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsHome: "/var/cloudbees-jenkins-distribution"

# -- Custom Jenkins home path

jenkinsHome: "/var/jenkins_home"

# This value should not be changed unless you use your custom image of jenkins or any derived from.

# If you want to use Cloudbees Jenkins Distribution docker, you should set jenkinsRef: "/usr/share/cloudbees-jenkins-distribution/ref"

# -- Custom Jenkins reference path

jenkinsRef: "/usr/share/jenkins/ref"

# Path to the jenkins war file which is used by jenkins-plugin-cli.

jenkinsWar: "/usr/share/jenkins/jenkins.war"

# Override the default arguments passed to the war

# overrideArgs:

# - --httpPort=8080

# -- Resource allocation (Requests and Limits)

resources:

requests:

cpu: "50m"

memory: "256Mi"

limits:

cpu: "2000m"

memory: "4096Mi"

# Share process namespace to allow sidecar containers to interact with processes in other containers in the same pod

shareProcessNamespace: false

# Service links might cause issue if running in a namespace with a large amount of services

# that might cause a slow startup when plugins are copied from ref to volume

# Set to true to keep previous behavior

# See https://github.com/kubernetes/kubernetes/issues/121787

enableServiceLinks: false

# Overrides the init container default values

# -- Resources allocation (Requests and Limits) for Init Container

initContainerResources: {}

# initContainerResources:

# requests:

# cpu: "50m"

# memory: "256Mi"

# limits:

# cpu: "2000m"

# memory: "4096Mi"

# -- Environment variable sources for Init Container

initContainerEnvFrom: []

# useful for i.e., http_proxy

# -- Environment variables for Init Container

initContainerEnv: []

# initContainerEnv:

# - name: http_proxy

# value: "http://192.168.64.1:3128"

# -- Environment variable sources for Jenkins Container

containerEnvFrom: []

# -- Environment variables for Jenkins Container

containerEnv: []

# - name: http_proxy

# value: "http://192.168.64.1:3128"

# Set min/max heap here if needed with "-Xms512m -Xmx512m"

# -- Append to `JAVA_OPTS` env var

javaOpts:

# -- Append to `JENKINS_OPTS` env var

jenkinsOpts:

# If you are using the ingress definitions provided by this chart via the `controller.ingress` block,

# the configured hostname will be the ingress hostname starting with `https://`

# or `http://` depending on the `tls` configuration.

# The Protocol can be overwritten by specifying `controller.jenkinsUrlProtocol`.

# -- Set protocol for Jenkins URL; `https` if `controller.ingress.tls`, `http` otherwise

jenkinsUrlProtocol:

# -- Set Jenkins URL if you are not using the ingress definitions provided by the chart

jenkinsUrl:

# If you set this prefix and use ingress controller, then you might want to set the ingress path below

# I.e., "/jenkins"

# -- Root URI Jenkins will be served on

jenkinsUriPrefix:

# -- Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set)

usePodSecurityContext: true

# Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are

# being deprecated and replaced by `podSecurityContextOverride`.

# Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins', which exists in 'jenkins/jenkins' docker image.

# When configuring runAsUser to a different value than 0 also set fsGroup to the same value:

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with.

runAsUser: 1000

# -- Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume.

fsGroup: 1000

# -- Deprecated in favor of `controller.podSecurityContextOverride`. fsGroupChangePolicy for the pod security context

fsGroupChangePolicy: OnRootMismatch

# If you have PodSecurityPolicies that require dropping of capabilities as suggested by CIS K8s benchmark, put them here

# securityContextCapabilities:

# drop:

# - NET_RAW

securityContextCapabilities: {}

# In the case of mounting an ext4 filesystem, it might be desirable to use `supplementalGroups` instead of `fsGroup` in

# the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496

# podSecurityContextOverride:

# runAsUser: 1000

# runAsNonRoot: true

# supplementalGroups: [1000]

# capabilities: {}

# -- Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, `fsGroup`, and `securityContextCapabilities`

podSecurityContextOverride: ~

# -- Allow controlling the securityContext for the jenkins container

containerSecurityContext:

runAsUser: 1000

runAsGroup: 1000

readOnlyRootFilesystem: true

allowPrivilegeEscalation: false

# -- enable or disable the controller k8s service

serviceEnabled: true

# For minikube, set this to NodePort, elsewhere uses LoadBalancer

# Use ClusterIP if your setup includes ingress controller

# -- k8s service type

serviceType: ClusterIP

# -- k8s service clusterIP. Only used if serviceType is ClusterIP

clusterIp:

# -- k8s service port

servicePort: 8080

# -- k8s target port

targetPort: 8080

# -- k8s node port. Only used if serviceType is NodePort

nodePort:

# Use Local to preserve the client source IP and avoids a second hop for LoadBalancer and NodePort type services,

# but risks potentially imbalanced traffic spreading.

serviceExternalTrafficPolicy:

# If enabled, the controller is available through its service before its pods reports ready. Makes startup screen and

# auto-reload on restart feature possible.

publishNotReadyAddresses:

# -- Jenkins controller service annotations

serviceAnnotations: {}

# -- Jenkins controller custom labels for the StatefulSet

statefulSetLabels: {}

# foo: bar

# bar: foo

# -- Labels for the Jenkins controller-service

serviceLabels: {}

# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: https

# Put labels on Jenkins controller pod

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

podLabels: {}

# Enable Kubernetes Startup, Liveness and Readiness Probes

# if Startup Probe is supported, enable it too

# ~ 2 minutes to allow Jenkins to restart when upgrading plugins. Set ReadinessTimeout to be shorter than LivenessTimeout.

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes

# -- Enable Kubernetes Probes configuration configured in `controller.probes`

healthProbes: true

probes:

startupProbe:

# -- Set the failure threshold for the startup probe

failureThreshold: 12

httpGet:

# -- Set the Pod's HTTP path for the startup probe

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

# -- Set the Pod's HTTP port to use for the startup probe

port: http

# -- Set the time interval between two startup probes executions in seconds

periodSeconds: 10

# -- Set the timeout for the startup probe in seconds

timeoutSeconds: 5

livenessProbe:

# -- Set the failure threshold for the liveness probe

failureThreshold: 5

httpGet:

# -- Set the Pod's HTTP path for the liveness probe

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

# -- Set the Pod's HTTP port to use for the liveness probe

port: http

# -- Set the time interval between two liveness probes executions in seconds

periodSeconds: 10

# -- Set the timeout for the liveness probe in seconds

timeoutSeconds: 5

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

# It delays the initial liveness probe while Jenkins is starting

# -- Set the initial delay for the liveness probe in seconds

initialDelaySeconds:

readinessProbe:

# -- Set the failure threshold for the readiness probe

failureThreshold: 3

httpGet:

# -- Set the Pod's HTTP path for the liveness probe

path: '{{ default "" .Values.controller.jenkinsUriPrefix }}/login'

# -- Set the Pod's HTTP port to use for the readiness probe

port: http

# -- Set the time interval between two readiness probes executions in seconds

periodSeconds: 10

# -- Set the timeout for the readiness probe in seconds

timeoutSeconds: 5

# If Startup Probe is not supported on your Kubernetes cluster, you might want to use "initialDelaySeconds" instead.

# It delays the initial readiness probe while Jenkins is starting

# -- Set the initial delay for the readiness probe in seconds

initialDelaySeconds:

# PodDisruptionBudget config

podDisruptionBudget:

# ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

# -- Enable Kubernetes Pod Disruption Budget configuration

enabled: false

# For Kubernetes v1.5+, use 'policy/v1beta1'

# For Kubernetes v1.21+, use 'policy/v1'

# -- Policy API version

apiVersion: "policy/v1beta1"

annotations: {}

labels: {}

# -- Number of pods that can be unavailable. Either an absolute number or a percentage

maxUnavailable: "0"

# -- Create Agent listener service

agentListenerEnabled: true

# -- Listening port for agents

agentListenerPort: 50000

# -- Host port to listen for agents

agentListenerHostPort:

# -- Node port to listen for agents

agentListenerNodePort:

# ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-policies

# -- Traffic Policy of for the agentListener service

agentListenerExternalTrafficPolicy:

# -- Allowed inbound IP for the agentListener service

agentListenerLoadBalancerSourceRanges:

- 0.0.0.0/0

# -- Disabled agent protocols

disabledAgentProtocols:

- JNLP-connect

- JNLP2-connect

csrf:

defaultCrumbIssuer:

# -- Enable the default CSRF Crumb issuer

enabled: true

# -- Enable proxy compatibility. This setting is ignored if you are not on the current LTS release and will be dropped with the next LTS.

proxyCompatability: true

# Kubernetes service type for the JNLP agent service

# agentListenerServiceType is the Kubernetes Service type for the JNLP agent service,

# either 'LoadBalancer', 'NodePort', or 'ClusterIP'

# Note if you set this to 'LoadBalancer', you *must* define annotations to secure it. By default,

# this will be an external load balancer and allowing inbound 0.0.0.0/0, a HUGE

# security risk: https://github.com/kubernetes/charts/issues/1341

# -- Defines how to expose the agentListener service

agentListenerServiceType: "ClusterIP"

# -- Annotations for the agentListener service

agentListenerServiceAnnotations: {}

# Optionally, assign an IP to the LoadBalancer agentListenerService LoadBalancer

# GKE users: only regional static IPs will work for Service Load balancer.

# -- Static IP for the agentListener LoadBalancer

agentListenerLoadBalancerIP:

# -- Whether legacy remoting security should be enabled

legacyRemotingSecurityEnabled: false

# Example of a 'LoadBalancer'-type agent listener with annotations securing it

# agentListenerServiceType: LoadBalancer

# agentListenerServiceAnnotations:

# service.beta.kubernetes.io/aws-load-balancer-internal: "True"

# service.beta.kubernetes.io/load-balancer-source-ranges: "172.0.0.0/8, 10.0.0.0/8"

# LoadBalancerSourcesRange is a list of allowed CIDR values, which are combined with ServicePort to

# set allowed inbound rules on the security group assigned to the controller load balancer

# -- Allowed inbound IP addresses

loadBalancerSourceRanges:

- 0.0.0.0/0

# -- Optionally assign a known public LB IP

loadBalancerIP:

# Optionally configure a JMX port. This requires additional javaOpts, for example,

# javaOpts: >

# -Dcom.sun.management.jmxremote.port=4000

# -Dcom.sun.management.jmxremote.authenticate=false

# -Dcom.sun.management.jmxremote.ssl=false

# jmxPort: 4000

# -- Open a port, for JMX stats

jmxPort:

# -- Optionally configure other ports to expose in the controller container

extraPorts: []

# - name: BuildInfoProxy

# port: 9000

# targetPort: 9010 (Optional: Use to explicitly set targetPort if different from port)

# Plugins will be installed during Jenkins controller start

# -- List of Jenkins plugins to install. If you don't want to install plugins, set it to `false`

installPlugins:

- kubernetes:4557.ve746270f672f

- workflow-aggregator:608.v67378e9d3db_1

- git:5.10.1

- configuration-as-code:2131.vb_a_13ed96f755

# If set to false, Jenkins will download the minimum required version of all dependencies.

# -- Download the minimum required version or latest version of all dependencies

installLatestPlugins: true

# -- Set to true to download the latest version of any plugin that is requested to have the latest version

installLatestSpecifiedPlugins: false

# -- List of plugins to install in addition to those listed in controller.installPlugins

additionalPlugins: []

# Without this; whenever the controller gets restarted (Evicted, etc.) it will fetch plugin updates that have the potential to cause breakage.

# Note that for this to work, `persistence.enabled` needs to be set to `true`

# -- Initialize only on first installation. Ensures plugins do not get updated inadvertently. Requires `persistence.enabled` to be set to `true`

initializeOnce: false

# Enable to always override the installed plugins with the values of 'controller.installPlugins' on upgrade or redeployment.

# -- Overwrite installed plugins on start

overwritePlugins: false

# Configures if plugins bundled with `controller.image` should be overwritten with the values of 'controller.installPlugins' on upgrade or redeployment.

# -- Overwrite plugins that are already installed in the controller image

overwritePluginsFromImage: true

# Configures the restrictions for naming projects. Set this key to null or empty to skip it in the default config.

projectNamingStrategy: standard

# Useful with ghprb plugin. The OWASP plugin is not installed by default, please update controller.installPlugins.

# -- Enable HTML parsing using OWASP Markup Formatter Plugin (antisamy-markup-formatter)

enableRawHtmlMarkupFormatter: false

# This is ignored if enableRawHtmlMarkupFormatter is true

# -- Yaml of the markup formatter to use

markupFormatter: plainText

# Used to approve a list of groovy functions in pipelines used the script-security plugin. Can be viewed under /scriptApproval

# -- List of groovy functions to approve

scriptApproval: []

# - "method groovy.json.JsonSlurperClassic parseText java.lang.String"

# - "new groovy.json.JsonSlurperClassic"

# -- Map of groovy init scripts to be executed during Jenkins controller start

initScripts: {}

# test: |-

# print 'adding global pipeline libraries, register properties, bootstrap jobs...'

# -- Name of the existing ConfigMap that contains init scripts

initConfigMap:

# 'name' is a name of an existing secret in the same namespace as jenkins,

# 'keyName' is the name of one of the keys inside the current secret.

# the 'name' and 'keyName' are concatenated with a '-' in between, so for example:

# an existing secret "secret-credentials" and a key inside it named "github-password" should be used in JCasC as ${secret-credentials-github-password}

# 'name' and 'keyName' must be lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-',

# and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc')

# existingSecret existing secret "secret-credentials" and a key inside it named "github-username" should be used in JCasC as ${github-username}

# When using existingSecret no need to specify the keyName under additionalExistingSecrets.

existingSecret:

# -- List of additional existing secrets to mount

additionalExistingSecrets: []

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

# additionalExistingSecrets:

# - name: secret-name-1

# keyName: username

# - name: secret-name-1

# keyName: password

# -- List of additional secrets to create and mount

additionalSecrets: []

# ref: https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/secrets.adoc#kubernetes-secrets

# additionalSecrets:

# - name: nameOfSecret

# value: secretText

# Generate SecretClaim resources to create Kubernetes secrets from HashiCorp Vault using kube-vault-controller.

# 'name' is the name of the secret that will be created in Kubernetes. The Jenkins fullname is prepended to this value.

# 'path' is the fully qualified path to the secret in Vault

# 'type' is an optional Kubernetes secret type. The default is 'Opaque'

# 'renew' is an optional secret renewal time in seconds

# -- List of `SecretClaim` resources to create

secretClaims: []

# - name: secretName # required

# path: testPath # required

# type: kubernetes.io/tls # optional

# renew: 60 # optional

# -- Name of default cloud configuration.

cloudName: "kubernetes"

# -- Traits for the chart-generated Kubernetes cloud (for example, `ephemeralContainer`). Additional clouds inherit these unless overridden by `additionalClouds.<name>.controller.cloudTraits`.

cloudTraits: []

# Below is the implementation of Jenkins Configuration as Code. Add a key under configScripts for each configuration area,

# where each corresponds to a plugin or section of the UI. Each key (prior to | character) is just a label, and can be any value.

# Keys are only used to give the section a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

# characters: lowercase letters, numbers, and hyphens. The keys become the name of a configuration yaml file on the controller in

# /var/jenkins_home/casc_configs (by default) and will be processed by the Configuration as Code Plugin. The lines after each |

# become the content of the configuration yaml file. The first line after this is a JCasC root element, e.g., jenkins, credentials,

# etc. Best reference is https://<jenkins_url>/configuration-as-code/reference. The example below creates a welcome message:

JCasC:

# -- Enables default Jenkins configuration via configuration as code plugin

defaultConfig: true

# If true, the init container deletes all the plugin config files and Jenkins Config as Code overwrites any existing configuration

# -- Whether Jenkins Config as Code should overwrite any existing configuration

overwriteConfiguration: false

# -- Remote URLs for configuration files.

configUrls: []

# - https://acme.org/jenkins.yaml

# -- List of Jenkins Config as Code scripts

configScripts: {}

# welcome-message: |

# jenkins:

# systemMessage: Welcome to our CI\CD server. This Jenkins is configured and managed 'as code'.

# Allows adding to the top-level security JCasC section. For legacy purposes, by default, the chart includes apiToken configurations

# -- Jenkins Config as Code security-section

security:

apiToken:

creationOfLegacyTokenEnabled: false

tokenGenerationOnCreationEnabled: false

usageStatisticsEnabled: true

# Ignored if securityRealm is defined in controller.JCasC.configScripts

# -- Jenkins Config as Code Security Realm-section

securityRealm: |-

local:

allowsSignup: false

enableCaptcha: false

users:

- id: "${chart-admin-username}"

name: "Jenkins Admin"

password: "${chart-admin-password}"

# Ignored if authorizationStrategy is defined in controller.JCasC.configScripts

# -- Jenkins Config as Code Authorization Strategy-section

authorizationStrategy: |-

loggedInUsersCanDoAnything:

allowAnonymousRead: false

# -- Annotations for the JCasC ConfigMap

configMapAnnotations: {}

# -- Custom init-container specification in raw-yaml format

customInitContainers: []

# - name: custom-init

# image: "alpine:3"

# imagePullPolicy: Always

# command: [ "uname", "-a" ]

sidecars:

configAutoReload:

# If enabled: true, Jenkins Configuration as Code will be reloaded on-the-fly without a reboot.

# If false or not-specified, JCasC changes will cause a reboot and will only be applied at the subsequent start-up.

# Auto-reload uses the http://<jenkins_url>/reload-configuration-as-code endpoint to reapply config when changes to

# the configScripts are detected.

# -- Enable Jenkins Config as Code auto-reload

enabled: true

image:

# -- Registry for the image that triggers the reload

registry: cgr.dev

# -- Repository of the image that triggers the reload

repository: chainguard-private/k8s-sidecar

# -- Tag for the image that triggers the reload

tag: 2.11.2-r4@sha256:9af4a4aeb34f5b92ed2344b2a7bfbfee21863c6e98a752a29a8df1454ddb8158

imagePullPolicy: IfNotPresent

# -- Port for sidecar health probes

healthPort: 8060

resources: {}

# limits:

# cpu: 100m

# memory: 100Mi

# requests:

# cpu: 50m

# memory: 50Mi

# -- Enables additional volume mounts for the config auto-reload container

additionalVolumeMounts: []

# - name: auto-reload-config

# mountPath: /var/config/logger

# - name: auto-reload-logs

# mountPath: /var/log/auto_reload

# -- Config auto-reload logging settings

logging:

# See default settings https://github.com/kiwigrid/k8s-sidecar/blob/master/src/logger.py

configuration:

# -- Enables custom log config utilizing using the settings below.

override: false

logLevel: INFO

formatter: JSON

logToConsole: true

logToFile: false

maxBytes: 1024

backupCount: 3

# -- The scheme to use when connecting to the Jenkins configuration as code endpoint

scheme: http

# -- Skip TLS verification when connecting to the Jenkins configuration as code endpoint

skipTlsVerify: false

# -- How many connection-related errors to retry on

reqRetryConnect: 10

# -- How many seconds to wait before updating config-maps/secrets (sets METHOD=SLEEP on the sidecar)

sleepTime:

# -- Environment variable sources for the Jenkins Config as Code auto-reload container

envFrom: []

# -- Environment variables for the Jenkins Config as Code auto-reload container

env: []

# - name: REQ_TIMEOUT

# value: "30"

# SSH port value can be set to any unused TCP port. The default, 1044, is a non-standard SSH port that has been chosen at random.

# This is only used to reload JCasC config from the sidecar container running in the Jenkins controller pod.

# This TCP port will not be open in the pod (unless you specifically configure this), so Jenkins will not be

# accessible via SSH from outside the pod. Note if you use non-root pod privileges (runAsUser & fsGroup),

# this must be > 1024:

sshTcpPort: 1044

# folder in the pod that should hold the collected dashboards:

folder: "/var/jenkins_home/casc_configs"

# If specified, the sidecar will search for JCasC config-maps inside this namespace.

# Otherwise, the namespace in which the sidecar is running will be used.

# It's also possible to specify ALL to search in all namespaces:

# searchNamespace:

# -- Enable container security context

containerSecurityContext:

readOnlyRootFilesystem: true

allowPrivilegeEscalation: false

# -- Configures additional sidecar container(s) for the Jenkins controller

additionalSidecarContainers: []

## The example below runs the client for https://smee.io as sidecar container next to Jenkins,

## that allows triggering build behind a secure firewall.

## https://jenkins.io/blog/2019/01/07/webhook-firewalls/#triggering-builds-with-webhooks-behind-a-secure-firewall

##

## Note: To use it you should go to https://smee.io/new and update the url to the generated one.

# - name: smee

# image: docker.io/twalter/smee-client:1.0.2

# args: ["--port", "{{ .Values.controller.servicePort }}", "--path", "/github-webhook/", "--url", "https://smee.io/new"]

# resources:

# limits:

# cpu: 50m

# memory: 128Mi

# requests:

# cpu: 10m

# memory: 32Mi

# -- Name of the Kubernetes scheduler to use

schedulerName: ""

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

# -- Node labels for pod assignment

nodeSelector: {}

# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature

# -- Toleration labels for pod assignment

tolerations: []

# -- Set TerminationGracePeriodSeconds

terminationGracePeriodSeconds:

# -- Set the termination message path

terminationMessagePath:

# -- Set the termination message policy

terminationMessagePolicy:

# -- Affinity settings

affinity: {}

# Leverage a priorityClass to ensure your pods survive resource shortages

# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

# -- The name of a `priorityClass` to apply to the controller pod

priorityClassName:

# -- Annotations for controller pod

podAnnotations: {}

# -- Annotations for controller StatefulSet

statefulSetAnnotations: {}

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

# -- Update strategy for StatefulSet

updateStrategy: {}

# ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#managing-revision-history

# -- Maximum number of revisions that will be maintained in the StatefulSet's revision history

revisionHistoryLimit:

# -- Topology spread constraints

topologySpreadConstraints: []

# -- DNS config for the pod

dnsConfig: {}

ingress:

# -- Enables the Primary ingress

enabled: false

# Override for the default paths that map requests to the backend

# -- Override for the default Primary Ingress paths

paths: []

# - backend:

# serviceName: ssl-redirect

# servicePort: use-annotation

# - backend:

# serviceName: >-

# {{ template "jenkins.fullname" . }}

# # Don't use string here, use only integer value!

# servicePort: 8080

# -- Primary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

pathType: ImplementationSpecific

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

# -- Primary Ingress API version

apiVersion: "networking.k8s.io/v1"

# -- Primary Ingress labels

labels: {}

# -- Primary Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

# ingressClassName: nginx

# -- Primary Ingress ingressClassName

ingressClassName:

# Set this path to jenkinsUriPrefix above or use annotations to rewrite path

# -- Primary Ingress path

path:

# configures the hostname e.g. jenkins.example.com

# -- Primary Ingress hostname

hostName:

# -- Primary Hostname to serve assets from

resourceRootUrl:

# -- Primary Ingress TLS configuration

tls: []

# - secretName: jenkins.cluster.local

# hosts:

# - jenkins.cluster.local

# often you want to have your controller all locked down and private,

# but you still want to get webhooks from your SCM

# A secondary ingress will let you expose different urls

# with a different configuration

secondaryingress:

# -- Enables the Secondary Ingress

enabled: false

# paths you want forwarded to the backend

# ex /github-webhook

# -- Secondary Ingress paths

paths: []

# -- Secondary Ingress rule pathType, choices are: Exact, ImplementationSpecific, Prefix

pathType: ImplementationSpecific

# For Kubernetes v1.14+, use 'networking.k8s.io/v1beta1'

# For Kubernetes v1.19+, use 'networking.k8s.io/v1'

# -- Secondary Ingress API version

apiVersion: "networking.k8s.io/v1"

# -- Secondary Ingress labels

labels: {}

# -- Secondary Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

# -- Secondary Ingress ingressClassName

ingressClassName:

# configures the hostname e.g., jenkins-external.example.com

# -- Secondary Ingress hostname

hostName:

# -- Secondary Ingress TLS configuration

tls:

# - secretName: jenkins-external.example.com

# hosts:

# - jenkins-external.example.com

# If you're running on GKE and need to configure a backendconfig

# to finish ingress setup, use the following values.

# Docs: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig

backendconfig:

# -- Enables backendconfig

enabled: false

# -- backendconfig API version

apiVersion: "extensions/v1beta1"

# -- backendconfig name

name:

# -- backendconfig labels

labels: {}

# -- backendconfig annotations

annotations: {}

# -- backendconfig spec

spec: {}

# Openshift route

route:

# -- Enables openshift route

enabled: false

# -- Route labels

labels: {}

# -- Route annotations

annotations: {}

# -- Route path

path:

# Gateway API HTTPRoute

httpRoute:

# Toggle to create an HTTPRoute resource alongside the existing ingress definition

enabled: false

apiVersion: "gateway.networking.k8s.io/v1"

kind: HTTPRoute

# specify the Gateway instance to bind the HTTPRoute to.

parentRefs: []

# - name: envoy-gateway-bundle

# namespace: envoy-gateway-system

# Reuse ingress host information if true; set to false to manage hostnames below

reuseIngressConfiguration: false

# Hostnames to use for the http route, only used if reuseIngressConfiguration is false.

hostnames: []

# Extra HTTPRoute rules that will be appended before the default backend

extraRules: []

# -- HTTPRoute annotations

annotations: {}

# -- Filters applied to the default HTTPRoute rule

filters: []

# -- Timeouts applied to the default HTTPRoute rule. Requires Gateway API v1.2+ and controller support

timeouts: {}

# -- Allows for adding entries to Pod /etc/hosts

hostAliases: []

# ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

# hostAliases:

# - ip: 192.168.50.50

# hostnames:

# - something.local

# - ip: 10.0.50.50

# hostnames:

# - other.local

# Expose Prometheus metrics

prometheus:

# If enabled, add the prometheus plugin to the list of plugins to install

# https://plugins.jenkins.io/prometheus

# -- Enables prometheus service monitor

enabled: false

# -- Additional labels to add to the service monitor object

serviceMonitorAdditionalLabels: {}

# -- Set a custom namespace where to deploy ServiceMonitor resource

serviceMonitorNamespace:

# -- How often prometheus should scrape metrics

scrapeInterval: 60s

# Defaults to the default endpoint used by the prometheus plugin

# -- The endpoint prometheus should get metrics from

scrapeEndpoint: /prometheus

# See here: https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/

# The `groups` root object is added by default, add the rule entries

# -- Array of prometheus alerting rules

alertingrules: []

# -- Additional labels to add to the PrometheusRule object

alertingRulesAdditionalLabels: {}

# -- Set a custom namespace where to deploy PrometheusRule resource

prometheusRuleNamespace: ""

# RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds

# relabelings for a few standard Kubernetes fields. The original scrape job’s name

# is available via the __tmp_prometheus_job_name label.

# More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config

relabelings: []

# MetricRelabelConfigs to apply to samples before ingestion.

metricRelabelings: []

googlePodMonitor:

# If enabled, It creates Google Managed Prometheus scraping config

enabled: false

# Set a custom namespace where to deploy PodMonitoring resource

# serviceMonitorNamespace: ""

scrapeInterval: 60s

# This is the default endpoint used by the prometheus plugin

scrapeEndpoint: /prometheus

# -- Can be used to disable rendering controller test resources when using helm template

testEnabled: true

httpsKeyStore:

# -- Enables HTTPS keystore on jenkins controller

enable: false

# -- Name of the secret that already has SSL keystore

jenkinsHttpsJksSecretName: ""

# -- Name of the key in the secret that already has SSL keystore

jenkinsHttpsJksSecretKey: "jenkins-jks-file"

# -- Name of the secret that contains the JKS password, if it is not in the same secret as the JKS file

jenkinsHttpsJksPasswordSecretName: ""

# -- Name of the key in the secret that contains the JKS password

jenkinsHttpsJksPasswordSecretKey: "https-jks-password"

disableSecretMount: false

# When HTTPS keystore is enabled, servicePort and targetPort will be used as HTTPS port

# -- HTTP Port that Jenkins should listen to along with HTTPS, it also serves as the liveness and readiness probes port.

httpPort: 8081

# -- Path of HTTPS keystore file

path: "/var/jenkins_keystore"

# -- Jenkins keystore filename which will appear under controller.httpsKeyStore.path

fileName: "keystore.jks"

# -- Jenkins keystore password

password: "password"

# -- Base64 encoded Keystore content. Keystore must be converted to base64 then being pasted here

jenkinsKeyStoreBase64Encoded:

# Convert keystore.jks files content to base64 > $ cat keystore.jks | base64

# /u3+7QAAAAIAAAABAAAAAQANamVua2luc2NpLmNvbQAAAW2r/b1ZAAAFATCCBP0wDgYKKwYBBAEq

# AhEBAQUABIIE6QbCqasvoHS0pSwYqSvdydMCB9t+VNfwhFIiiuAelJfO5sSe2SebJbtwHgLcRz1Z

# gMtWgOSFdl3bWSzA7vrW2LED52h+jXLYSWvZzuDuh8hYO85m10ikF6QR+dTi4jra0whIFDvq3pxe

# TnESxEsN+DvbZM3jA3qsjQJSeISNpDjO099dqQvHpnCn18lyk7J4TWJ8sOQQb1EM2zDAfAOSqA/x

# QuPEFl74DlY+5DIk6EBvpmWhaMSvXzWZACGA0sYqa157dq7O0AqmuLG/EI5EkHETO4CrtBW+yLcy

# 2dUCXOMA+j+NjM1BjrQkYE5vtSfNO6lFZcISyKo5pTFlcA7ut0Fx2nZ8GhHTn32CpeWwNcZBn1gR

# pZVt6DxVVkhTAkMLhR4rL2wGIi/1WRs23ZOLGKtyDNvDHnQyDiQEoJGy9nAthA8aNHa3cfdF10vB

# Drb19vtpFHmpvKEEhpk2EBRF4fTi644Fuhu2Ied6118AlaPvEea+n6G4vBz+8RWuVCmZjLU+7h8l

# Hy3/WdUPoIL5eW7Kz+hS+sRTFzfu9C48dMkQH3a6f3wSY+mufizNF9U298r98TnYy+PfDJK0bstG

# Ph6yPWx8DGXKQBwrhWJWXI6JwZDeC5Ny+l8p1SypTmAjpIaSW3ge+KgcL6Wtt1R5hUV1ajVwVSUi

# HF/FachKqPqyLJFZTGjNrxnmNYpt8P1d5JTvJfmfr55Su/P9n7kcyWp7zMcb2Q5nlXt4tWogOHLI

# OzEWKCacbFfVHE+PpdrcvCVZMDzFogIq5EqGTOZe2poPpBVE+1y9mf5+TXBegy5HToLWvmfmJNTO

# NCDuBjgLs2tdw2yMPm4YEr57PnMX5gGTC3f2ZihXCIJDCRCdQ9sVBOjIQbOCzxFXkVITo0BAZhCi

# Yz61wt3Ud8e//zhXWCkCsSV+IZCxxPzhEFd+RFVjW0Nm9hsb2FgAhkXCjsGROgoleYgaZJWvQaAg

# UyBzMmKDPKTllBHyE3Gy1ehBNGPgEBChf17/9M+j8pcm1OmlM434ctWQ4qW7RU56//yq1soFY0Te

# fu2ei03a6m68fYuW6s7XEEK58QisJWRAvEbpwu/eyqfs7PsQ+zSgJHyk2rO95IxdMtEESb2GRuoi

# Bs+AHNdYFTAi+GBWw9dvEgqQ0Mpv0//6bBE/Fb4d7b7f56uUNnnE7mFnjGmGQN+MvC62pfwfvJTT

# EkT1iZ9kjM9FprTFWXT4UmO3XTvesGeE50sV9YPm71X4DCQwc4KE8vyuwj0s6oMNAUACW2ClU9QQ

# y0tRpaF1tzs4N42Q5zl0TzWxbCCjAtC3u6xf+c8MCGrr7DzNhm42LOQiHTa4MwX4x96q7235oiAU

# iQqSI/hyF5yLpWw4etyUvsx2/0/0wkuTU1FozbLoCWJEWcPS7QadMrRRISxHf0YobIeQyz34regl

# t1qSQ3dCU9D6AHLgX6kqllx4X0fnFq7LtfN7fA2itW26v+kAT2QFZ3qZhINGfofCja/pITC1uNAZ

# gsJaTMcQ600krj/ynoxnjT+n1gmeqThac6/Mi3YlVeRtaxI2InL82ZuD+w/dfY9OpPssQjy3xiQa

# jPuaMWXRxz/sS9syOoGVH7XBwKrWpQcpchozWJt40QV5DslJkclcr8aC2AGlzuJMTdEgz1eqV0+H

# bAXG9HRHN/0eJTn1/QAAAAEABVguNTA5AAADjzCCA4swggJzAhRGqVxH4HTLYPGO4rzHcCPeGDKn

# xTANBgkqhkiG9w0BAQsFADCBgTELMAkGA1UEBhMCY2ExEDAOBgNVBAgMB29udGFyaW8xEDAOBgNV

# BAcMB3Rvcm9udG8xFDASBgNVBAoMC2plbmtpbnN0ZXN0MRkwFwYDVQQDDBBqZW5raW5zdGVzdC5p

# bmZvMR0wGwYJKoZIhvcNAQkBFg50ZXN0QHRlc3QuaW5mbzAeFw0xOTEwMDgxNTI5NTVaFw0xOTEx

# MDcxNTI5NTVaMIGBMQswCQYDVQQGEwJjYTEQMA4GA1UECAwHb250YXJpbzEQMA4GA1UEBwwHdG9y

# b250bzEUMBIGA1UECgwLamVua2luc3Rlc3QxGTAXBgNVBAMMEGplbmtpbnN0ZXN0LmluZm8xHTAb

# BgkqhkiG9w0BCQEWDnRlc3RAdGVzdC5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC

# AQEA02q352JTHGvROMBhSHvSv+vnoOTDKSTz2aLQn0tYrIRqRo+8bfmMjXuhkwZPSnCpvUGNAJ+w

# Jrt/dqMoYUjCBkjylD/qHmnXN5EwS1cMg1Djh65gi5JJLFJ7eNcoSsr/0AJ+TweIal1jJSP3t3PF

# 9Uv21gm6xdm7HnNK66WpUUXLDTKaIs/jtagVY1bLOo9oEVeLN4nT2CYWztpMvdCyEDUzgEdDbmrP

# F5nKUPK5hrFqo1Dc5rUI4ZshL3Lpv398aMxv6n2adQvuL++URMEbXXBhxOrT6rCtYzbcR5fkwS9i

# d3Br45CoWOQro02JAepoU0MQKY5+xQ4Bq9Q7tB9BAwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAe

# 4xc+mSvKkrKBHg9/zpkWgZUiOp4ENJCi8H4tea/PCM439v6y/kfjT/okOokFvX8N5aa1OSz2Vsrl

# m8kjIc6hiA7bKzT6lb0EyjUShFFZ5jmGVP4S7/hviDvgB5yEQxOPpumkdRP513YnEGj/o9Pazi5h

# /MwpRxxazoda9r45kqQpyG+XoM4pB+Fd3JzMc4FUGxfVPxJU4jLawnJJiZ3vqiSyaB0YyUL+Er1Q

# 6NnqtR4gEBF0ZVlQmkycFvD4EC2boP943dLqNUvop+4R3SM1QMM6P5u8iTXtHd/VN4MwMyy1wtog

# hYAzODo1Jt59pcqqKJEas0C/lFJEB3frw4ImNx5fNlJYOpx+ijfQs9m39CevDq0=

agent:

# -- Add the environment proxy settings form jenkins controller to the agents.

addMasterProxyEnvVars: false

# -- Enable Kubernetes plugin jnlp-agent podTemplate

enabled: true

# -- The name of the pod template to use for providing default values

defaultsProviderTemplate: ""

# Useful for not including a serviceAccount in the template if `false`

# -- Use `serviceAccountAgent.name` as the default value for defaults template `serviceAccount`

useDefaultServiceAccount: true

# -- Override the default service account

# @default -- `serviceAccountAgent.name` if `agent.useDefaultServiceAccount` is `true`

serviceAccount:

# For connecting to the Jenkins controller

# -- Overrides the Kubernetes Jenkins URL

jenkinsUrl:

# connects to the specified host and port, instead of connecting directly to the Jenkins controller

# -- Overrides the Kubernetes Jenkins tunnel

jenkinsTunnel:

# -- Disables the verification of the controller certificate on remote connection. This flag correspond to the "Disable https certificate check" flag in kubernetes plugin UI

skipTlsVerify: false

# -- Enable the possibility to restrict the usage of this agent to specific folder. This flag correspond to the "Restrict pipeline support to authorized folders" flag in kubernetes plugin UI

usageRestricted: false

# -- The connection timeout in seconds for connections to Kubernetes API. The minimum value is 5

kubernetesConnectTimeout: 5

# -- The read timeout in seconds for connections to Kubernetes API. The minimum value is 15

kubernetesReadTimeout: 15

# -- The maximum concurrent connections to Kubernetes API

maxRequestsPerHostStr: "32"

# -- Time in minutes after which the Kubernetes cloud plugin will clean up an idle worker that has not already terminated

retentionTimeout: 5

# -- Seconds to wait for pod to be running

waitForPodSec: 600

# -- Namespace in which the Kubernetes agents should be launched

namespace:

# -- Custom Pod labels (an object with `label-key: label-value` pairs)

podLabels: {}

# -- Custom registry used to pull the agent jnlp image from

jnlpregistry:

image:

# -- Registry to pull the agent jnlp image from

registry: cgr.dev

# -- Repository to pull the agent jnlp image from

repository: chainguard-private/jenkins-inbound-agent

# -- Tag of the image to pull

tag: 2.585-r0-jdk21@sha256:6b5be6e83a98d3f09e49e168dce8f16faa4e5f8c63c244532e7dfa8549a7754f

# -- Configure working directory for default agent

workingDir: "/home/jenkins/agent"

nodeUsageMode: "NORMAL"

# -- Append Jenkins labels to the agent

customJenkinsLabels: []

# -- Name of the secret to be used to pull the image

imagePullSecretName:

componentName: "jenkins-agent"

# -- Enables agent communication via websockets

websocket: false

directConnection: false

# -- Agent privileged container

privileged: false

# -- Configure container user

runAsUser:

# -- Configure container group

runAsGroup:

# -- Enables the agent to use the host network

hostNetworking: false

# -- Resources allocation (Requests and Limits)

resources:

requests:

cpu: "512m"

memory: "512Mi"

# ephemeralStorage:

limits:

cpu: "512m"

memory: "512Mi"

# ephemeralStorage:

livenessProbe: {}

# execArgs: "cat /tmp/healthy"

# failureThreshold: 3

# initialDelaySeconds: 0

# periodSeconds: 10

# successThreshold: 1

# timeoutSeconds: 1

# You may want to change this to true while testing a new image

# -- Always pull agent container image before build

alwaysPullImage: false

# When using Pod Security Admission in the Agents namespace with the restricted Pod Security Standard,

# the jnlp container cannot be scheduled without overriding its container definition with a securityContext.

# This option allows to automatically inject in the jnlp container a securityContext

# that is suitable for the use of the restricted Pod Security Standard.

# -- Set a restricted securityContext on jnlp containers

restrictedPssSecurityContext: false

# Controls how agent pods are retained after the Jenkins build completes

# Possible values: Always, Never, OnFailure

podRetention: "Never"

# Disable if you do not want the Yaml the agent pod template to show up

# in the job Console Output. This can be helpful for either security reasons

# or simply to clean up the output to make it easier to read.

showRawYaml: true

# You can define the volumes that you want to mount for this container

# Allowed types are: ConfigMap, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC, Secret

# Configure the attributes as they appear in the corresponding Java class for that type

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes

# -- Additional volumes

volumes: []

# - type: ConfigMap

# configMapName: myconfigmap

# mountPath: /var/myapp/myconfigmap

# - type: EmptyDir

# mountPath: /var/myapp/myemptydir

# memory: false

# - type: EphemeralVolume

# mountPath: /var/myapp/myephemeralvolume

# accessModes: ReadWriteOnce

# requestsSize: 10Gi

# storageClassName: mystorageclass

# - type: HostPath

# hostPath: /var/lib/containers

# mountPath: /var/myapp/myhostpath

# - type: Nfs

# mountPath: /var/myapp/mynfs

# readOnly: false

# serverAddress: "192.0.2.0"

# serverPath: /var/lib/containers

# - type: PVC

# claimName: mypvc

# mountPath: /var/myapp/mypvc

# readOnly: false

# - type: Secret

# defaultMode: "600"

# mountPath: /var/myapp/mysecret

# secretName: mysecret

# Pod-wide environment, these vars are visible to any container in the agent pod

# You can define the workspaceVolume that you want to mount for this container

# Allowed types are: DynamicPVC, EmptyDir, EphemeralVolume, HostPath, Nfs, PVC

# Configure the attributes as they appear in the corresponding Java class for that type

# https://github.com/jenkinsci/kubernetes-plugin/tree/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/volumes/workspace

# -- Workspace volume (defaults to EmptyDir)

workspaceVolume: {}

## DynamicPVC example

# - type: DynamicPVC

# configMapName: myconfigmap

## EmptyDir example

# - type: EmptyDir

# memory: false

## EphemeralVolume example

# - type: EphemeralVolume

# accessModes: ReadWriteOnce

# requestsSize: 10Gi

# storageClassName: mystorageclass

## HostPath example

# - type: HostPath

# hostPath: /var/lib/containers

## NFS example

# - type: Nfs

# readOnly: false

# serverAddress: "192.0.2.0"

# serverPath: /var/lib/containers

## PVC example

# - type: PVC

# claimName: mypvc

# readOnly: false

# Pod-wide environment, these vars are visible to any container in the agent pod

# -- Environment variables for the agent Pod

envVars: []

# - name: PATH

# value: /usr/local/bin

# -- Mount a secret as environment variable

secretEnvVars: []

# - key: PATH

# optional: false # default: false

# secretKey: MY-K8S-PATH

# secretName: my-k8s-secret

# -- Node labels for pod assignment

nodeSelector: {}

# Key Value selectors. Ex:

# nodeSelector

# jenkins-agent: v1

# -- Command to execute when side container starts

command:

# -- Arguments passed to command to execute

args: "${computer.jnlpmac} ${computer.name}"

# -- Side container name

sideContainerName: "jnlp"

# Doesn't allocate pseudo TTY by default

# -- Allocate pseudo tty to the side container

TTYEnabled: false

# -- Max number of agents to launch for a whole cluster.

containerCap: 10

# -- Max number of agents to launch for this type of agent

instanceCap: 2147483647

# -- Agent Pod base name

podName: "default"

# Enables garbage collection of orphan pods for this Kubernetes cloud. (beta)

garbageCollection:

# -- When enabled, Jenkins will periodically check for orphan pods that have not been touched for the given timeout period and delete them.

enabled: false

# -- Namespaces to look at for garbage collection, in addition to the default namespace defined for the cloud. One namespace per line.

namespaces: ""

# namespaces: |-

# namespaceOne

# namespaceTwo

# -- Timeout value for orphaned pods

timeout: 300

# -- Allows the Pod to remain active for reuse until the configured number of minutes has passed since the last step was executed on it

idleMinutes: 0

# The raw yaml of a Pod API Object, for example, this allows usage of toleration for agent pods.

# https://github.com/jenkinsci/kubernetes-plugin#using-yaml-to-define-pod-templates

# https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

# -- The raw yaml of a Pod API Object to merge into the agent spec

yamlTemplate: ""

# yamlTemplate: |-

# apiVersion: v1

# kind: Pod

# spec:

# tolerations:

# - key: "key"

# operator: "Equal"

# value: "value"

# -- Defines how the raw yaml field gets merged with yaml definitions from inherited pod templates. Possible values: "merge" or "override"

yamlMergeStrategy: "override"

# -- Controls whether the defined yaml merge strategy will be inherited if another defined pod template is configured to inherit from the current one

inheritYamlMergeStrategy: false

# -- Timeout in seconds for an agent to be online

connectTimeout: 100

# -- Annotations to apply to the pod

annotations: {}

# Containers specified here are added to all agents. Set key empty to remove container from additional agents.

# -- Add additional containers to the agents

additionalContainers: []

# - sideContainerName: dind

# image:

# repository: docker

# tag: dind

# command: dockerd-entrypoint.sh

# args: ""

# privileged: true

# resources:

# requests:

# cpu: 500m

# memory: 1Gi

# limits:

# cpu: 1

# memory: 2Gi

# Useful when configuring agents only with the podTemplates value, since the default podTemplate populated by values mentioned above will be excluded in the rendered template.

# -- Disable the default Jenkins Agent configuration

disableDefaultAgent: false

# Below is the implementation of custom pod templates for the default configured kubernetes cloud.

# Add a key under podTemplates for each pod template. Each key (prior to | character) is just a label, and can be any value.

# Keys are only used to give the pod template a meaningful name. The only restriction is they may only contain RFC 1123 \ DNS label

# characters: lowercase letters, numbers, and hyphens. Each pod template can contain multiple containers.

# For this pod templates configuration to be loaded, the following values must be set:

# controller.JCasC.defaultConfig: true

# Best reference is https://<jenkins_url>/configuration-as-code/reference#Cloud-kubernetes. The example below creates a python pod template.

# -- Configures extra pod templates for the default kubernetes cloud

podTemplates: {}

# python: |

# - name: python

# label: jenkins-python

# serviceAccount: jenkins

# containers:

# - name: python

# image: python:3

# command: "/bin/sh -c"

# args: "cat"

# ttyEnabled: true

# privileged: true

# resourceRequestCpu: "400m"

# resourceRequestMemory: "512Mi"

# resourceLimitCpu: "1"

# resourceLimitMemory: "1024Mi"

# Inherits all values from `agent` so you only need to specify values which differ

# -- Configure additional

additionalAgents: {}

# maven:

# podName: maven

# customJenkinsLabels: maven

# # An example of overriding the jnlp container

# # sideContainerName: jnlp

# image:

# repository: jenkins/jnlp-agent-maven

# tag: latest

# python:

# podName: python

# customJenkinsLabels: python

# sideContainerName: python

# image:

# repository: python

# tag: "3"

# command: "/bin/sh -c"

# args: "cat"

# TTYEnabled: true

# Here you can add additional clouds

# They inherit all values from the default cloud (including the main agent), so

# you only need to specify values which differ. If you want to override

# default additionalAgents with the additionalClouds.additionalAgents set

# additionalAgentsOverride to `true`.

# To override inherited cloud traits, set controller.cloudTraits for that cloud (use [] to clear them).

additionalClouds: {}

# remote-cloud-1:

# kubernetesURL: https://api.remote-cloud.com

# controller:

# cloudTraits:

# - ephemeralContainer

# additionalAgentsOverride: true

# additionalAgents:

# maven-2:

# podName: maven-2

# customJenkinsLabels: maven

# # An example of overriding the jnlp container

# # sideContainerName: jnlp

# image:

# repository: jenkins/jnlp-agent-maven

# tag: latest

# namespace: my-other-maven-namespace

# remote-cloud-2:

# kubernetesURL: https://api.remote-cloud.com

persistence:

# -- Enable the use of a Jenkins PVC

enabled: true

# A manually managed Persistent Volume and Claim

# Requires persistence.enabled: true

# If defined, PVC must be created manually before volume will be bound

# -- Provide the name of a PVC

existingClaim:

# jenkins data Persistent Volume Storage Class

# If defined, storageClassName: <storageClass>

# If set to "-", storageClassName: "", which disables dynamic provisioning

# If undefined (the default) or set to null, no storageClassName spec is

# set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS & OpenStack)

# -- Storage class for the PVC

storageClass:

# -- Annotations for the PVC

annotations: {}

# -- Labels for the PVC

labels: {}

# -- The PVC access mode

accessMode: "ReadWriteOnce"

# -- The size of the PVC

size: "8Gi"

# ref: https://kubernetes.io/docs/concepts/storage/volume-pvc-datasource/

# -- Existing data source to clone PVC from

dataSource: {}

# name: PVC-NAME

# kind: PersistentVolumeClaim

# -- SubPath for jenkins-home mount

subPath:

# -- Additional volumes

volumes: []

# - name: nothing

# emptyDir: {}

# -- Additional mounts

mounts: []

# - mountPath: /var/nothing

# name: nothing

# readOnly: true

networkPolicy:

# -- Enable the creation of NetworkPolicy resources

enabled: false

# For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1'

# For Kubernetes v1.7, use 'networking.k8s.io/v1'

# -- NetworkPolicy ApiVersion

apiVersion: networking.k8s.io/v1

# You can allow agents to connect from both within the cluster (from within specific/all namespaces) AND/OR from a given external IP range

internalAgents:

# -- Allow internal agents (from the same cluster) to connect to controller. Agent pods will be filtered based on PodLabels

allowed: true

# -- A map of labels (keys/values) that agent pods must have to be able to connect to controller

podLabels: {}

# -- A map of labels (keys/values) that agents namespaces must have to be able to connect to controller

namespaceLabels: {}

# project: myproject

externalAgents:

# -- The IP range from which external agents are allowed to connect to controller, i.e., 172.17.0.0/16

ipCIDR:

# -- A list of IP sub-ranges to be excluded from the allowlisted IP range

except: []

# - 172.17.1.0/24

## Install Default RBAC roles and bindings

rbac:

# -- Whether RBAC resources are created

create: true

# -- Whether the Jenkins service account should be able to read Kubernetes secrets

readSecrets: false

# -- Whether the Jenkins service account should be able to use the OpenShift "nonroot" Security Context Constraints

useOpenShiftNonRootSCC: false

serviceAccount:

# -- Configures if a ServiceAccount with this name should be created

create: true

# The name of the ServiceAccount is autogenerated by default

# -- The name of the ServiceAccount to be used by access-controlled resources

name:

# -- Configures annotations for the ServiceAccount

annotations: {}

# -- Configures extra labels for the ServiceAccount

extraLabels: {}

# -- Controller ServiceAccount image pull secret

imagePullSecretName:

# -- Auto-mount ServiceAccount token

automountServiceAccountToken: true

serviceAccountAgent:

# -- Configures if an agent ServiceAccount should be created

create: false

# If not set and create is true, a name is generated using the fullname template

# -- The name of the agent ServiceAccount to be used by access-controlled resources

name:

# -- Configures annotations for the agent ServiceAccount

annotations: {}

# -- Configures extra labels for the agent ServiceAccount

extraLabels: {}

# -- Agent ServiceAccount image pull secret

imagePullSecretName:

# -- Auto-mount ServiceAccount token

automountServiceAccountToken: true

# -- Checks if any deprecated values are used

checkDeprecation: true

awsSecurityGroupPolicies:

enabled: false

policies:

- name: ""

securityGroupIds: []

podSelector: {}

# Here you can configure unit tests values when executing the helm unittest in the CONTRIBUTING.md

helmtest:

# A testing framework for bash

bats:

# Bash Automated Testing System (BATS)

# -- Name of the secret to be used to pull the image

imagePullSecretName: ""

image:

# -- Registry of the image used to test the framework

registry: "docker.io"

# -- Repository of the image used to test the framework

repository: "bats/bats"

# -- Tag of the image to test the framework

tag: "1.14.0"