-
-
Notifications
You must be signed in to change notification settings - Fork 46
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore(updates.jenkins.io): use new
mirrorbits-parent helm chart (#4320
) * chore(updates.jenkins.io): use new `mirrorbits-parent` helm chart * add nameOverrides * comment out fullnameOverride * cleanup * wip * bump mirrorbits-parent chart version * add updatecli manifest * bump mirrorbits-parent version, include rsyncd 1.x.x helm chart version * please YAML linter * restore 'i' * add rsyncd component * use last chart version with completed hardening * remove old config * cleanup * fix yaml lint errors --------- Co-authored-by: Damien Duportal <[email protected]>
- Loading branch information
1 parent
d79e559
commit 0b660f2
Showing
4 changed files
with
157 additions
and
83 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,94 +1,127 @@ | ||
| nameOverride: updates-jenkins-io | ||
|
|
||
| ingress: | ||
| mirrorbits-lite: | ||
| enabled: true | ||
| className: public-nginx | ||
| annotations: | ||
| "cert-manager.io/cluster-issuer": "letsencrypt-prod" | ||
| "nginx.ingress.kubernetes.io/ssl-redirect": "true" | ||
| hosts: | ||
| - host: azure.updates.jenkins.io | ||
| paths: | ||
| - path: / | ||
| serviceNameSuffix: files | ||
| - path: /.*[.](deb|hpi|war|rpm|msi|pkg|sha256|md5sum|zip|gz|pdf|json|svg|sh|jpeg|ico|png|html)$ | ||
| pathType: ImplementationSpecific | ||
| tls: | ||
| - secretName: updates-jenkins-io-tls | ||
| hosts: | ||
| - azure.updates.jenkins.io | ||
|
|
||
| resources: | ||
| mirrorbits: | ||
| ingress: | ||
| enabled: true | ||
| className: public-nginx | ||
| annotations: | ||
| "cert-manager.io/cluster-issuer": "letsencrypt-prod" | ||
| "nginx.ingress.kubernetes.io/ssl-redirect": "true" | ||
| hosts: | ||
| - host: azure.updates.jenkins.io | ||
| paths: | ||
| - path: / | ||
| serviceNameSuffix: files | ||
| - path: /.*[.](deb|hpi|war|rpm|msi|pkg|sha256|md5sum|zip|gz|pdf|json|svg|sh|jpeg|ico|png|html)$ | ||
| pathType: ImplementationSpecific | ||
| tls: | ||
| - secretName: updates-jenkins-io-tls | ||
| hosts: | ||
| - azure.updates.jenkins.io | ||
|
|
||
| resources: | ||
| limits: | ||
| cpu: 500m | ||
| memory: 1024Mi | ||
| requests: | ||
| cpu: 500m | ||
| memory: 1024Mi | ||
| files: | ||
|
|
||
| repository: | ||
| name: updates-jenkins-io-binary | ||
| persistentVolumeClaim: | ||
| enabled: true | ||
| spec: | ||
| accessModes: | ||
| - ReadOnlyMany | ||
| storageClassName: azurefile-csi-premium | ||
| volumeName: updates-jenkins-io-binary | ||
| resources: | ||
| requests: | ||
| storage: 2Gi # See file share size in https://github.com/jenkins-infra/azure/blob/main/updates.jenkins.io.tf | ||
| # As the storage account is independently declared and created elsewhere (jenkins-infra/azure/updates.jenkins.io.tf), | ||
| # we're adding the PV definition to rattach the PVC to the existing storage account without creating a new one | ||
| # and especially without deleting it when the cluster has to be recreated. | ||
| persistentVolume: | ||
| enabled: true | ||
| spec: | ||
| capacity: | ||
| storage: 2Gi # See file share size in https://github.com/jenkins-infra/azure/blob/main/updates.jenkins.io.tf | ||
| storageClassName: azurefile-csi-premium | ||
| accessModes: | ||
| - ReadOnlyMany | ||
| persistentVolumeReclaimPolicy: Retain | ||
| csi: | ||
| driver: file.csi.azure.com | ||
| readOnly: false | ||
| volumeHandle: updates-jenkins-io-binary # make sure this volumeid is unique for every identical share in the cluster | ||
| volumeAttributes: | ||
| resourceGroup: updates-jenkins-io | ||
| shareName: updates-jenkins-io | ||
| nodeStageSecretRef: | ||
| name: updates-jenkins-io-mirrorbits-lite-binary | ||
| namespace: updates-jenkins-io | ||
| mountOptions: | ||
| - dir_mode=0755 | ||
| - file_mode=0644 | ||
| - uid=1000 | ||
| - gid=1000 | ||
| - mfsymlinks | ||
| - nobrl | ||
| - serverino | ||
| - cache=strict | ||
|
|
||
| nodeSelector: | ||
| agentpool: x86medium | ||
|
|
||
| httpd: | ||
| enabled: true | ||
|
|
||
| resources: | ||
| limits: | ||
| cpu: 2000m | ||
| memory: 2048Mi | ||
| requests: | ||
| cpu: 2000m | ||
| memory: 2048Mi | ||
|
|
||
| repository: | ||
| name: updates-jenkins-io-binary | ||
| persistentVolumeClaim: | ||
| enabled: true | ||
| spec: | ||
| accessModes: | ||
| - ReadOnlyMany | ||
| storageClassName: azurefile-csi-premium | ||
| volumeName: updates-jenkins-io-binary | ||
| resources: | ||
| requests: | ||
| storage: 2Gi # See file share size in https://github.com/jenkins-infra/azure/blob/main/updates.jenkins.io.tf | ||
| # As the storage account is independently declared and created elsewhere (jenkins-infra/azure/updates.jenkins.io.tf), | ||
| # we're adding the PV definition to rattach the PVC to the existing storage account without creating a new one | ||
| # and especially without deleting it when the cluster has to be recreated. | ||
| persistentVolume: | ||
| enabled: true | ||
| spec: | ||
| capacity: | ||
| storage: 2Gi # See file share size in https://github.com/jenkins-infra/azure/blob/main/updates.jenkins.io.tf | ||
| storageClassName: azurefile-csi-premium | ||
| accessModes: | ||
| - ReadOnlyMany | ||
| persistentVolumeReclaimPolicy: Retain | ||
| csi: | ||
| driver: file.csi.azure.com | ||
| readOnly: false | ||
| volumeHandle: updates-jenkins-io-binary # make sure this volumeid is unique for every identical share in the cluster | ||
| volumeAttributes: | ||
| resourceGroup: updates-jenkins-io | ||
| shareName: updates-jenkins-io | ||
| nodeStageSecretRef: | ||
| name: updates-jenkins-io-binary | ||
| namespace: updates-jenkins-io | ||
| mountOptions: | ||
| - dir_mode=0755 | ||
| - file_mode=0644 | ||
| - uid=1000 | ||
| - gid=1000 | ||
| - mfsymlinks | ||
| - nobrl | ||
| - serverino | ||
| - cache=strict | ||
| repository: | ||
| name: updates-jenkins-io-binary | ||
| reuseExistingPersistentVolumeClaim: true | ||
|
|
||
| replicaCount: | ||
| mirrorbits: 1 #2 | ||
| files: 1 #2 | ||
| rsyncd: 1 | ||
| nodeSelector: | ||
| agentpool: x86medium | ||
|
|
||
| rsyncd: | ||
| enabled: true | ||
| volumes: | ||
| datadir: | ||
| persistentVolumeClaim: | ||
| claimName: updates-jenkins-io-binary | ||
|
|
||
| nodeSelector: | ||
| agentpool: x86medium | ||
| configuration: | ||
| components: | ||
| - name: jenkins | ||
| path: /rsyncd/data/jenkins | ||
| comment: "Jenkins Read-Only Mirror" | ||
| volume: | ||
| persistentVolumeClaim: | ||
| claimName: updates-jenkins-io-binary | ||
|
|
||
| podSecurityContext: | ||
| runAsUser: 65534 # User 'nobody' | ||
| runAsGroup: 65534 # Group 'nogroup' | ||
| runAsNonRoot: true | ||
| containerSecurityContext: | ||
| readOnlyRootFilesystem: true | ||
| allowPrivilegeEscalation: false | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
|
|
||
| resources: | ||
| limits: | ||
| cpu: 100m | ||
| memory: 128Mi | ||
| requests: | ||
| cpu: 50m | ||
| memory: 64Mi | ||
|
|
||
| nodeSelector: | ||
| agentpool: x86medium |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: "Bump mirrorbits-parent Helm Chart Version" | ||
|
|
||
| scms: | ||
| default: | ||
| kind: github | ||
| spec: | ||
| user: "{{ .github.user }}" | ||
| email: "{{ .github.email }}" | ||
| owner: "{{ .github.owner }}" | ||
| repository: "{{ .github.repository }}" | ||
| token: "{{ requiredEnv .github.token }}" | ||
| username: "{{ .github.username }}" | ||
| branch: "{{ .github.branch }}" | ||
|
|
||
| sources: | ||
| lastChartVersion: | ||
| kind: helmchart | ||
| name: get last chart version | ||
| spec: | ||
| url: https://jenkins-infra.github.io/helm-charts | ||
| name: mirrorbits-parent | ||
|
|
||
| targets: | ||
| updateChartVersion: | ||
| name: "Update the chart version for mirrorbits-parent" | ||
| kind: file | ||
| spec: | ||
| file: clusters/publick8s.yaml | ||
| matchpattern: 'chart: jenkins-infra\/mirrorbits-parent((\r\n|\r|\n)(\s+))version: .*' | ||
| replacepattern: 'chart: jenkins-infra/mirrorbits-parent${1}version: {{ source "lastChartVersion" }}' | ||
| scmid: default | ||
|
|
||
| actions: | ||
| default: | ||
| kind: github/pullrequest | ||
| scmid: default | ||
| title: Bump `mirrorbits-parent` helm chart version to {{ source "lastChartVersion" }} | ||
| spec: | ||
| labels: | ||
| - dependencies | ||
| - mirrorbits-parent |