To enable the Kubernetes plugin in Jenkins, simply set enable_kubernetes_agents to "true" in the dogu config.\nA sensible default configuration is automatically deployed but may be adjusted to your needs.
To set up a namespace and access control for the agents, the k8s-jenkins-agent-integration component can be installed.\nIts default config should also work for the most common scenarios, but depends on Kyverno to schedule agents on specific\nnodes only. If you do not have Kyverno installed, you might want to disable this integration, see\nthe component's configuration options.
\nA small example pipeline may look like this:
\npodTemplate {\n node(POD_LABEL) {\n stage('Run shell') {\n sh 'echo hello world'\n }\n }\n}For more usage, see the official documentation.
\nThe following configuration options are provided.\nThey do not cover everything that is possible with the Jenkins Kubernetes plugin,\nbut the most common use-cases should be possible and others might be if you\ncreate your own cloud configuration.
\nenable_kubernetes_agentsDefault: "false"
Whether to enable kubernetes agent integration. Irrelevant if not on kubernetes.
\necosystem_kubernetes_namespaceDefault: "ecosystem"
Kubernetes namespace where this Jenkins instance is deployed.
\nagent_kubernetes_namespaceDefault: "jenkins-ci"
Kubernetes namespace where the Jenkins agents are deployed.
\nagent_kubernetes_pod_labelsDefault: "{\\"cloudogu.com/pod-kind\\": \\"jenkins-ci\\"}"
Labels to be added to agent pods.
\nagent_kubernetes_restricted_pss_security_contextDefault: "false"
Whether to add a Security Context to agent pods that is suitable for the use of the 'restricted' Pod Security Standard.
\nagent_kubernetes_docker_imageDefault: ""
Container image to be used for the agent pods if none is specified.\nIf no image is specified, the default image of the Kubernetes plugin is used.
\nagent_kubernetes_docker_registryDefault: ""
Docker registry to use for the agent image if none is specified.
\nagent_kubernetes_enable_garbage_collectionDefault: "false"
When enabled, Jenkins will periodically check for orphan pods that have not been touched for 300 seconds and delete them.
\nIf the provided settings do not fit your needs or if you want to add other clouds, it is possible to add your own.\nJust do not name it kubernetes as that is the name our integration uses.
If your cloud needs to access the local kubernetes cluster, a jenkins ServiceAccount is provided and mounted.\nYou can use that to bind the roles you need.\nRoles and RoleBindings for the included kubernetes cloud are readily provided by the aforementioned\ncomponent.
global.networkPolicies.enabledDefault: true
If NetworkPolicies should be used at all.\nNormally the Cloudogu EcoSystem uses NetworkPolicies, so this is necessary.\nIf for some reason, you do not want or need NetworkPolicies, they can be disabled here.
\nglobal.networkPolicies.doguSelectorDefault:
\nmatchLabels:\n dogu.name: jenkinsThe selector that should be used for NetworkPolicies to select the Dogu's Pod.\nNormally, this does not have to be adjusted.
\nglobal.networkPolicies.agentSelectorDefault:
\nmatchLabels:\n cloudogu.com/pod-kind: jenkins-ciThe selector that should be used for NetworkPolicies to select Jenkins agent Pods.\nThis has to match labels set for the agent Pods in the Dogu's configuration.
\nnamespaces.createDefault: true
Whether to create the namespaces specified in namespaces.names.
namespaces.namesDefault: [jenkins-ci]
List of the namespaces to create resources (NetworkPolicies, RBAC, ...) for.
\nserviceAccount.nameDefault: jenkins
The ServiceAccount to bind Roles to.\nSince the ServiceAccount is provided by the Jenkins dogu, this usually does not have to be adjusted.
\nSince resource-heavy builds might interfere with other workloads or compromise security,\nyou might want to limit your Jenkins builds to certain nodes with no other workloads.
\nIt is possible to prevent other workloads from being scheduled on a node by tainting it:
\nkubectl taint nodes <node-name> reserved-node=jenkins-ci:NoScheduleThis has to be done before any workloads are scheduled.\nIf workloads are already scheduled on it, you might want to drain it.
\nWe might also want to label our node to make it easier to give our pods an affinity for it later:
\nkubectl label node <node-name> reserved-node=jenkins-ciJenkins builds are already labeled with cloudogu.com/pod-kind: jenkins-ci by default, so it's easy to single them out.\nMutating these to only run on a specific node is usually accomplished with an admission-controller.\nNow, we could implement our own but there are already multiple options readily available:
Kyverno- and Gatekeeper-Policies are already part of the\nk8s-jenkins-agent-integration component and may be enabled or disabled individually.
\npolicies.kyverno.enabledDefault: true
Whether the Kyverno ClusterPolicy to assign agent pods to specific nodes should be applied.
\npolicies.gatekeeper.enabledDefault: false
Whether the Gatekeeper Assign policies to assign agent pods to specific nodes should be applied.
\npolicies.matchPods.namespaces.enabledDefault: true
Whether to match pods from the namespaces specified in namespaces.names.
policies.matchPods.labelSelector.enabledDefault: false
Whether to match pods via their labels.
\npolicies.matchPods.labelSelector.matchLabelsDefault:
\ncloudogu.com/pod-kind: jenkins-ciMap of labels of pods to match with the policy.
\npolicies.matchPods.namespaceSelector.enabledDefault: false
Whether to match namespaces via their labels.
\npolicies.matchPods.namespaceSelector.matchLabelsDefault:
\nkubernetes.io/metadata.name: jenkins-ciLabels to match the namespaces with.
\npolicies.affinityDefault:
\nnodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: reserved-node\n operator: In\n values:\n - jenkins-ciAffinity to set in the agent pods.
\npolicies.tolerationsDefault:
\n- key: reserved-node\n operator: Equal\n value: jenkins-ci\n effect: NoScheduleTolerations to set in the agent pods.
","frontmatter":{"title":"","canonical":null},"fields":{"folders":["dogus","jenkins","operations"],"delocalizedSlug":"/docs/dogus/jenkins/operations/kubernetes_native_builds/","title":"Kubernetes-native builds","pageType":"docs"},"tableOfContents":"enable_kubernetes_agentsecosystem_kubernetes_namespaceagent_kubernetes_namespaceagent_kubernetes_pod_labelsagent_kubernetes_restricted_pss_security_contextagent_kubernetes_docker_imageagent_kubernetes_docker_registryagent_kubernetes_enable_garbage_collectionpolicies.kyverno.enabledpolicies.gatekeeper.enabled