resources.yaml

apiVersion: v1
kind: Secret
metadata:
  name: jenkins-secrets
  namespace: jenkins
data:
  ADMIN-PASSWORD: 
  ADMIN-TOKEN: 
  ADMIN-USER: 
  AWS-SM-ACCESSKEY: 
  AWS-SM-SECRETKEY: 
  JENKINS-URL: 
  JJB-REPO:
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: jenkins-custom-casc-config
  namespace: jenkins
data:
  jenkins.yaml: |
    jenkins:
      globalNodeProperties:
      - envVars:
          env:
          - key: ADMIN_TOKEN
            value: "${jenkins-secrets-ADMIN-TOKEN}"
      systemMessage: Welcome to the Rancher QA jenkins server.
      authorizationStrategy:
          loggedInUsersCanDoAnything:
            allowAnonymousRead: false
      securityRealm: 
        local:
          allowsSignup: false
          enableCaptcha: false
          users:
          - id: "${jenkins-secrets-ADMIN-USER}"
            name: "Jenkins Admin"
            password: "${jenkins-secrets-ADMIN-PASSWORD}"
      agentProtocols:
      - "JNLP4-connect"
      - "Ping"
      clouds:
      - kubernetes:
          containerCap: 40
          containerCapStr: "40"
          jenkinsTunnel: "jenkins-qa-agent.jenkins.svc.cluster.local:50000"
          jenkinsUrl: "http://jenkins-qa.jenkins.svc.cluster.local:8080"
          name: "kubernetes"
          namespace: "jenkins"
          podLabels:
          - key: "jenkins/jenkins-qa-jenkins-agent"
            value: "true"
          serverUrl: "https://kubernetes.default"
          templates:
          - containers:
            - alwaysPullImage: true
              args: "^${computer.jnlpmac} ^${computer.name}"
              envVars:
              - envVar:
                  key: "JENKINS_URL"
                  value: "http://jenkins-qa.jenkins.svc.cluster.local:8080/"
              - envVar:
                  key: "DOCKER_HOST"
                  value: "tcp://localhost:2375"
              image: "ranchertest/dind-agent:latest"
              livenessProbe:
                failureThreshold: 0
                initialDelaySeconds: 0
                periodSeconds: 0
                successThreshold: 0
                timeoutSeconds: 0
              name: "jnlp"
              privileged: true
              resourceLimitCpu: "512m"
              resourceLimitMemory: "512Mi"
              resourceRequestCpu: "512m"
              resourceRequestMemory: "512Mi"
              runAsUser: "0"
              workingDir: "/home/jenkins/agent"
            - envVars:
              - envVar:
                  key: "DOCKER_TLS_VERIFY"
              - envVar:
                  key: "DOCKER_TLS_CERTDIR"
              image: "docker:20.10-dind"
              livenessProbe:
                failureThreshold: 0
                initialDelaySeconds: 0
                periodSeconds: 0
                successThreshold: 0
                timeoutSeconds: 0
              name: "dind-daemon"
              privileged: true
              workingDir: "/home/jenkins/agent"
            id: "14bc718b11f9a4cea39e9531ec6db3e728e1a56afb6cae41fdbcc4455bb0e611"
            label: "jenkins-qa-jenkins-agent"
            name: "default"
            namespace: "jenkins"
            nodeUsageMode: NORMAL
            podRetention: "never"
            serviceAccount: "default"
            slaveConnectTimeout: 100
            slaveConnectTimeoutStr: "100"
            yamlMergeStrategy: "override"
      crumbIssuer:
        standard:
          excludeClientIPFromCrumb: true
      disabledAdministrativeMonitors:
      - "hudson.util.DoubleLaunchChecker"
      labelAtoms:
      - name: "built-in"
      - name: "jenkins-qa-jenkins-agent"
      markupFormatter: "plainText"
      mode: NORMAL
      myViewsTabBar: "standard"
      noUsageStatistics: true
      nodeMonitors:
      - "architecture"
      - "clock"
      - diskSpace:
          freeSpaceThreshold: "1GiB"
          freeSpaceWarningThreshold: "2GiB"
      - "swapSpace"
      - tmpSpace:
          freeSpaceThreshold: "1GiB"
          freeSpaceWarningThreshold: "2GiB"
      - "responseTime"
      numExecutors: 0
      primaryView:
        all:
          name: "all"
      projectNamingStrategy: "standard"
      quietPeriod: 5
      scmCheckoutRetryCount: 0
      slaveAgentPort: 50000
      updateCenter:
        sites:
        - id: "default"
          url: "https://updates.jenkins.io/update-center.json"
      views:
      - all:
          name: "all"
      viewsTabBar: "standard"
    globalCredentialsConfiguration:
      configuration:
        providerFilter:
          includes:
            classNames:
            - "io.jenkins.plugins.credentials.secretsmanager.AwsCredentialsProvider"
            - "com.cloudbees.hudson.plugins.folder.properties.FolderCredentialsProvider"
            - "com.cloudbees.plugins.credentials.SystemCredentialsProvider$ProviderImpl"
            - "com.cloudbees.plugins.credentials.UserCredentialsProvider"
        typeFilter: "none"
    appearance:
      prism:
        theme: PRISM
    security:
      apiToken:
        creationOfLegacyTokenEnabled: false
        tokenGenerationOnCreationEnabled: false
        usageStatisticsEnabled: true
      copyartifact:
        mode: PRODUCTION
      gitHooks:
        allowedOnAgents: false
        allowedOnController: false
      gitHostKeyVerificationConfiguration:
        sshHostKeyVerificationStrategy: "noHostKeyVerificationStrategy"
      sSHD:
        port: -1
      scriptApproval:
        approvedSignatures:
        - "staticMethod org.codehaus.groovy.runtime.EncodingGroovyMethods decodeBase64"
        - "method java.util.Base64$Decoder decode java.lang.String"
        - "new java.lang.String byte[]"
        - "staticMethod java.util.Base64 getDecoder"
        - "java.lang.String"
    unclassified:
      ansiColorBuildWrapper:
        colorMaps:
        - black: "#000000"
          blackB: "#4C4C4C"
          blue: "#1E90FF"
          blueB: "#4682B4"
          cyan: "#00CDCD"
          cyanB: "#00FFFF"
          green: "#00CD00"
          greenB: "#00FF00"
          magenta: "#CD00CD"
          magentaB: "#FF00FF"
          name: "xterm"
          red: "#CD0000"
          redB: "#FF0000"
          white: "#E5E5E5"
          whiteB: "#FFFFFF"
          yellow: "#CDCD00"
          yellowB: "#FFFF00"
        - black: "#000000"
          blackB: "#555555"
          blue: "#0000AA"
          blueB: "#5555FF"
          cyan: "#00AAAA"
          cyanB: "#55FFFF"
          defaultBackground: 0
          defaultForeground: 7
          green: "#00AA00"
          greenB: "#55FF55"
          magenta: "#AA00AA"
          magentaB: "#FF55FF"
          name: "vga"
          red: "#AA0000"
          redB: "#FF5555"
          white: "#AAAAAA"
          whiteB: "#FFFFFF"
          yellow: "#AA5500"
          yellowB: "#FFFF55"
        - black: "black"
          blackB: "black"
          blue: "blue"
          blueB: "blue"
          cyan: "cyan"
          cyanB: "cyan"
          green: "green"
          greenB: "green"
          magenta: "magenta"
          magentaB: "magenta"
          name: "css"
          red: "red"
          redB: "red"
          white: "white"
          whiteB: "white"
          yellow: "yellow"
          yellowB: "yellow"
        - black: "#2E3436"
          blackB: "#2E3436"
          blue: "#3465A4"
          blueB: "#3465A4"
          cyan: "#06989A"
          cyanB: "#06989A"
          defaultBackground: 0
          defaultForeground: 7
          green: "#4E9A06"
          greenB: "#4E9A06"
          magenta: "#75507B"
          magentaB: "#75507B"
          name: "gnome-terminal"
          red: "#CC0000"
          redB: "#CC0000"
          white: "#D3D7CF"
          whiteB: "#D3D7CF"
          yellow: "#C4A000"
          yellowB: "#C4A000"
      awsCredentialsProvider:
        cache: true
        client:
          credentialsProvider:
            static:
              accessKey: "${jenkins-secrets-AWS-SM-ACCESSKEY}"
              secretKey: "${jenkins-secrets-AWS-SM-SECRETKEY}"
          region: "us-east-2"
        transformations:
          description: "default"
          name: "default"
      buildDiscarders:
        configuredBuildDiscarders:
        - "jobBuildDiscarder"
      cacheConfig:
        cacheGetJobs: false
        cacheGetJobsMinutes: 0
      fingerprints:
        fingerprintCleanupDisabled: false
        storage: "file"
      gitHubPluginConfig:
        hookUrl: "${jenkins-secrets-JENKINS-URL}/github-webhook/"
      junitTestResultStorage:
        storage: "file"
      location:
        url: "${jenkins-secrets-JENKINS-URL}"
      mailer:
        charset: "UTF-8"
        useSsl: false
        useTls: false
      pollSCM:
        pollingThreadCount: 10
      scmGit:
        addGitTagAction: false
        allowSecondFetch: false
        createAccountBasedOnEmail: false
        disableGitToolChooser: false
        hideCredentials: false
        showEntireCommitSummaryInChanges: false
        useExistingAccountWithSameEmail: false
      slackNotifier:
        botUser: false
        sendAsText: false
      timestamper:
        allPipelines: true
        elapsedTimeFormat: "'<b>'HH:mm:ss.S'</b> '"
        systemTimeFormat: "'<b>'HH:mm:ss'</b> '"
      upstream:
        globalUpstreamFilterStrategy: UseOldest
      whitelist:
        enabled: false
    tool:
      git:
        installations:
        - home: "git"
          name: "Default"
      mavenGlobalConfig:
        globalSettingsProvider: "standard"
        settingsProvider: "standard"
    groovy: 
      - script: |
          import hudson.model.User;
          import jenkins.security.ApiTokenProperty;
          import jenkins.model.*

          // workaround for setting api-key https://github.com/jenkinsci/configuration-as-code-plugin/issues/1830
          def nodes = Jenkins.instance.globalNodeProperties;
          def envVars = nodes[0].envVars;
          def token = envVars['ADMIN_TOKEN'];
          def user = User.get('admin');
          user.getProperty(ApiTokenProperty.class).tokenStore.addFixedNewToken("auto-token", token);
          user.save();
    jobs:
      - script: |
          job('Build Jenkins Jobs') {
              logRotator {
                numToKeep(5)
              }
              wrappers {
                  credentialsBinding {
                      string('JJB_USER', 'ADMIN_USER')
                      string('JJB_PASSWORD', 'JENKINS_TOKEN')
                      string('JENKINS_URL', 'JENKINS_URL')
                  }
              }
              scm {
                git {
                    remote {
                        url("${jenkins-secrets-JJB-REPO}")
                        credentials('jenkins-job-builder-github')
                    }
                    branch('staging')
                }
              }
              triggers {
                  githubPush()
              }
              steps {
                  shell('''cat <<EOT > jenkins_jobs.ini
          [job_builder]
          allow_empty_variables=True
          ignore_cache=True
          keep_descriptions=False
          include_path=.:scripts:~/git/
          recursive=False
          exclude=.*:manual:./development
          allow_duplicates=False
          update=all

          [jenkins]
          user=$JJB_USER
          password=$JJB_PASSWORD
          url=$JENKINS_URL
          query_plugins_info=False
          EOT''')
          shell('jenkins-jobs --conf ./jenkins_jobs.ini update ./ && rm -rf jenkins_jobs.ini')
              }
          }