paci-jenkins.yaml

apiVersion: v1
kind: Template
labels:
  app: paci-jenkins
  template: paci-jenkins-template
metadata:
  annotations:
    description: |-
      Jenkins service for PACI. This template is heavily based on the built-in
      jenkins-persistent OpenShift template. It adds an S2I buildconfig to
      create Jenkins images tailored for PACI usage.
    iconClass: icon-jenkins
    openshift.io/display-name: PACI Jenkins
    openshift.io/documentation-url: https://github.com/projectatomic/projectatomic-ci-infra
    openshift.io/support-url: https://github.com/projectatomic/projectatomic-ci-infra
    openshift.io/provider-display-name: Project Atomic CI
    tags: paci,jenkins
  name: paci-jenkins
objects:
- apiVersion: v1
  kind: ImageStream
  metadata:
    name: paci-jenkins
    namespace: ${NAMESPACE}
# this is a version of the openshift/jenkins locked to stable openshift tags,
# since we're using v3.6, which didn't do this versioning
# see: https://github.com/openshift/jenkins/issues/528#issuecomment-378381468
# Once we move away from v3.6, we can drop this and change the paci-jenkins bc
# to use the openshift/jenkins:2 tag
- apiVersion: v1
  kind: ImageStream
  metadata:
    name: jenkins
    namespace: ${NAMESPACE}
  spec:
    tags:
      - name: stable
        from:
          kind: DockerImage
          name: openshift/jenkins-2-centos7:v3.9
- apiVersion: v1
  kind: BuildConfig
  metadata:
    name: paci-jenkins
  # Note no triggers: we don't want e.g. git pushes/config changes to restart
  # Jenkins. Let's just require manual restarts here. XXX: Should investigate if
  # there's an easy way to auto-redeploy during downtimes.
  spec:
    source:
      type: Git
      git:
        uri: ${REPO_URL}
        ref: ${REPO_REF}
      contextDir: jenkins/bc/master
    strategy:
      type: Source
      sourceStrategy:
        from:
          kind: ImageStreamTag
          name: jenkins:stable
        forcePull: true
    output:
      to:
        kind: ImageStreamTag
        name: paci-jenkins:latest
        namespace: ${NAMESPACE}
    successfulBuildsHistoryLimit: 2
    failedBuildsHistoryLimit: 2
- apiVersion: v1
  kind: ImageStream
  metadata:
    name: paci-jenkins-slave
    namespace: ${NAMESPACE}
- apiVersion: v1
  kind: BuildConfig
  metadata:
    name: paci-jenkins-slave
  triggers:
  - type: ImageChange
    imageChange: {}
  - type: ConfigChange
  - type: GitHub
    github:
      secret: ${GITHUB_WEBHOOK_SHARED_SECRET}
  spec:
    source:
      type: Git
      git:
        uri: ${REPO_URL}
        ref: ${REPO_REF}
      contextDir: jenkins/bc/slave
    strategy:
      type: Docker
    output:
      to:
        kind: ImageStreamTag
        name: paci-jenkins-slave:latest
        namespace: ${NAMESPACE}
    successfulBuildsHistoryLimit: 2
    failedBuildsHistoryLimit: 2
- apiVersion: v1
  kind: ImageStream
  metadata:
    name: papr
    namespace: ${NAMESPACE}
- apiVersion: v1
  kind: BuildConfig
  metadata:
    name: papr
  triggers:
  - type: ImageChange
    imageChange: {}
  - type: ConfigChange
  - type: GitHub
    github:
      secret: ${GITHUB_WEBHOOK_SHARED_SECRET}
  spec:
    source:
      type: Git
      git:
        # XXX: or migrate papr to paci/ or use as submodule?
        uri: ${PAPR_REPO_URL}
        ref: ${PAPR_REPO_REF}
    strategy:
      type: Docker
    output:
      to:
        kind: ImageStreamTag
        name: papr:latest
        namespace: ${NAMESPACE}
    successfulBuildsHistoryLimit: 2
    failedBuildsHistoryLimit: 2
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: papr
- apiVersion: v1
  kind: RoleBinding
  metadata:
    name: papr-edit
  roleRef:
    name: edit
  subjects:
  - kind: ServiceAccount
    name: papr
- apiVersion: v1
  kind: ConfigMap
  metadata:
    name: papr-config
  data:
    config: |
      github:
        auth-from-env: true
      publisher:
        type: s3
        config:
          auth-from-env: true
          bucket: aos-ci
          rootdir: ghprb
- apiVersion: v1
  kind: Route
  metadata:
    annotations:
      template.openshift.io/expose-uri: http://{.spec.host}{.spec.path}
    name: ${JENKINS_SERVICE_NAME}
  spec:
    tls:
      insecureEdgeTerminationPolicy: Redirect
      termination: edge
    to:
      kind: Service
      name: ${JENKINS_SERVICE_NAME}
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: ${JENKINS_SERVICE_NAME}
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: ${VOLUME_CAPACITY}
- apiVersion: v1
  kind: Secret
  metadata:
    name: webhook-secret
  stringData:
    secret: ${GITHUB_WEBHOOK_SHARED_SECRET}
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    annotations:
      template.alpha.openshift.io/wait-for-ready: "true"
    name: ${JENKINS_SERVICE_NAME}
  spec:
    replicas: 1
    selector:
      name: ${JENKINS_SERVICE_NAME}
    strategy:
      type: Recreate
    template:
      metadata:
        labels:
          name: ${JENKINS_SERVICE_NAME}
      spec:
        containers:
        - capabilities: {}
          env:
          - name: OPENSHIFT_ENABLE_OAUTH
            value: ${ENABLE_OAUTH}
          - name: OPENSHIFT_ENABLE_REDIRECT_PROMPT
            value: "true"
          - name: KUBERNETES_MASTER
            value: https://kubernetes.default:443
          - name: KUBERNETES_TRUST_CERTIFICATES
            value: "true"
          - name: JENKINS_SERVICE_NAME
            value: ${JENKINS_SERVICE_NAME}
          - name: JNLP_SERVICE_NAME
            value: ${JNLP_SERVICE_NAME}
          image: ' '
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 30
            httpGet:
              path: /login
              port: 8080
            initialDelaySeconds: 420
            timeoutSeconds: 3
          name: jenkins
          readinessProbe:
            httpGet:
              path: /login
              port: 8080
            initialDelaySeconds: 3
            timeoutSeconds: 3
          resources:
            limits:
              memory: ${MEMORY_LIMIT}
          securityContext:
            capabilities: {}
            privileged: false
          terminationMessagePath: /dev/termination-log
          volumeMounts:
          - name: ${JENKINS_SERVICE_NAME}-data
            mountPath: /var/lib/jenkins
          - name: github-token-mount
            mountPath: /etc/github-token
            readOnly: true
          - name: webhook-secret-mount
            mountPath: /etc/webhook-secret
            readOnly: true
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        serviceAccountName: ${JENKINS_SERVICE_NAME}
        volumes:
        - name: ${JENKINS_SERVICE_NAME}-data
          persistentVolumeClaim:
            claimName: ${JENKINS_SERVICE_NAME}
        - name: github-token-mount
          secret:
            # we expect users to have created a secret called github-token with
            # the key "token" containing the actual token
            secretName: github-token
        - name: webhook-secret-mount
          secret:
            secretName: webhook-secret
    triggers:
    - imageChangeParams:
        automatic: true
        containerNames:
        - jenkins
        from:
          kind: ImageStreamTag
          name: ${JENKINS_IMAGE_STREAM_TAG}
          namespace: ${NAMESPACE}
        lastTriggeredImage: ""
      type: ImageChange
    - type: ConfigChange
- apiVersion: v1
  kind: ServiceAccount
  metadata:
    annotations:
      serviceaccounts.openshift.io/oauth-redirectreference.jenkins: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"${JENKINS_SERVICE_NAME}"}}'
    name: ${JENKINS_SERVICE_NAME}
- apiVersion: v1
  kind: RoleBinding
  metadata:
    name: ${JENKINS_SERVICE_NAME}-edit
  roleRef:
    name: edit
  subjects:
  - kind: ServiceAccount
    name: ${JENKINS_SERVICE_NAME}
- apiVersion: v1
  kind: Service
  metadata:
    name: ${JNLP_SERVICE_NAME}
  spec:
    ports:
    - name: agent
      nodePort: 0
      port: 50000
      protocol: TCP
      targetPort: 50000
    selector:
      name: ${JENKINS_SERVICE_NAME}
    sessionAffinity: None
    type: ClusterIP
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      service.alpha.openshift.io/dependencies: '[{"name": "${JNLP_SERVICE_NAME}", "namespace": "", "kind": "Service"}]'
      service.openshift.io/infrastructure: "true"
    name: ${JENKINS_SERVICE_NAME}
  spec:
    ports:
    - name: web
      nodePort: 0
      port: 80
      protocol: TCP
      targetPort: 8080
    selector:
      name: ${JENKINS_SERVICE_NAME}
    sessionAffinity: None
    type: ClusterIP
- apiVersion: v1
  kind: BuildConfig
  metadata:
    name: job-builder
  triggers:
  - type: GitHub
    github:
      secret: ${GITHUB_WEBHOOK_SHARED_SECRET}
  - type: ConfigChange
  spec:
    source:
      type: Git
      git:
        uri: ${REPO_URL}
        ref: ${REPO_REF}
    strategy:
      jenkinsPipelineStrategy:
        jenkinsfilePath: jenkins/jjb/job-builder.Jenkinsfile
parameters:
- description: The name of the OpenShift Service exposed for the Jenkins container.
  displayName: Jenkins Service Name
  name: JENKINS_SERVICE_NAME
  value: jenkins
- description: The name of the service used for master/slave communication.
  displayName: Jenkins JNLP Service Name
  name: JNLP_SERVICE_NAME
  value: jenkins-jnlp
- description: Whether to enable OAuth OpenShift integration. If false, the static
    account 'admin' will be initialized with the password 'password'.
  displayName: Enable OAuth in Jenkins
  name: ENABLE_OAUTH
  value: "true"
- description: Maximum amount of memory the Jenkins container can use.
  displayName: Memory Limit
  name: MEMORY_LIMIT
  value: 2Gi # https://github.com/openshift/jenkins/issues/501
- description: Volume space available for data, e.g. 512Mi, 2Gi.
  displayName: Volume Capacity
  name: VOLUME_CAPACITY
  required: true
  value: 1Gi
- description: Name of the ImageStreamTag to be used for the Jenkins image.
  displayName: Jenkins ImageStreamTag
  name: JENKINS_IMAGE_STREAM_TAG
  value: paci-jenkins:latest
# Templates are not able to pick up the namespace we're currently in, so let's
# allow users to specify a different one if they didn't name the project
# "projectatomic-ci" (https://github.com/openshift/origin/issues/13934).
- description: >
    The OpenShift Namespace where the Jenkins ImageStream resides. This is
    usually the same namespace as the project.
  displayName: Jenkins ImageStream Namespace
  name: NAMESPACE
  value: projectatomic-ci
  required: true
- description: Git source URI for paci-jenkins, slave, and job-builder BCs
  name: REPO_URL
  value: https://github.com/projectatomic/projectatomic-ci-infra
- description: Git branch/tag reference
  name: REPO_REF
  value: master
- description: Git source URI for papr BC
  name: PAPR_REPO_URL
  value: https://github.com/projectatomic/papr
- description: Git branch/tag reference
  name: PAPR_REPO_REF
  value: master
- description: Shared webhook secret.
  name: GITHUB_WEBHOOK_SHARED_SECRET
  generate: expression
  from: '[A-Z0-9]{32}'
  required: true