forked from fleetman-ci-cd-demo/jenkins
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathjenkins.yaml
141 lines (139 loc) · 3.45 KB
/
jenkins.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
apiVersion: v1
kind: ServiceAccount
metadata:
name: jenkins
namespace: default
---
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: jenkins-secret
namespace: default
annotations:
kubernetes.io/service-account.name: jenkins
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: jenkins
namespace: default
rules:
- apiGroups: [""]
resources: ["pods","services"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get","list","watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
- apiGroups: [""]
resources: ["persistentvolumeclaims"]
verbs: ["create","delete","get","list","patch","update","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: jenkins
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: jenkins
subjects:
- kind: ServiceAccount
name: jenkins
---
# Allows jenkins to create persistent volumes
# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: jenkins-crb
subjects:
- kind: ServiceAccount
namespace: default
name: jenkins
roleRef:
kind: ClusterRole
name: jenkinsclusterrole
apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
# "namespace" omitted since ClusterRoles are not namespaced
name: jenkinsclusterrole
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["create","delete","get","list","patch","update","watch"]
---
# apiVersion: apps/v1
# kind: Deployment
# metadata:
# name: jenkins
# namespace: default
# spec:
# selector:
# matchLabels:
# app: jenkins
# replicas: 1
# template:
# metadata:
# labels:
# app: jenkins
# spec:
# containers:
# - name: jenkins
# image: truongpx396/myjenkins:latest
# env:
# - name: JAVA_OPTS
# value: -Djenkins.install.runSetupWizard=false
# ports:
# - name: http-port
# containerPort: 8080
# - name: jnlp-port
# containerPort: 50000
# volumeMounts:
# - name: jenkins-home
# mountPath: /var/jenkins_home
# - name: docker-sock-volume
# mountPath: "/var/run/docker.sock"
# imagePullPolicy: Always
# volumes:
# # This allows jenkins to use the docker daemon on the host, for running builds
# # see https://stackoverflow.com/questions/27879713/is-it-ok-to-run-docker-from-inside-docker
# - name: docker-sock-volume
# hostPath:
# path: /var/run/docker.sock
# - name: jenkins-home
# hostPath:
# path: /mnt/jenkins-store
# serviceAccountName: jenkins
# ---
# apiVersion: v1
# kind: Service
# metadata:
# name: jenkins
# namespace: default
# spec:
# type: NodePort
# ports:
# - name: ui
# port: 8080
# targetPort: 8080
# nodePort: 31000
# - name: jnlp
# port: 50000
# targetPort: 50000
# selector:
# app: jenkins
# ---