apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: jenkins-controller
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: jenkins
    helm.sh/chart: jenkins-3.11.3
  name: RELEASE-NAME-jenkins
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: jenkins-controller
      app.kubernetes.io/instance: RELEASE-NAME
  serviceName: RELEASE-NAME-jenkins
  template:
    metadata:
      annotations:
        checksum/config: b85cc75ee90b018bbf5548b48bf67d29779d44a235b4792aa943d8fcec9e470e
      labels:
        app.kubernetes.io/component: jenkins-controller
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: jenkins
    spec:
      containers:
      - args:
        - --httpPort=8080
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: JAVA_OPTS
          value: '-Dcasc.reload.token=$(POD_NAME) '
        - name: JENKINS_OPTS
          value: '--webroot=/var/jenkins_cache/war '
        - name: JENKINS_SLAVE_AGENT_PORT
          value: "50000"
        - name: CASC_JENKINS_CONFIG
          value: /var/jenkins_home/casc_configs
        image: jenkins/jenkins:2.319.2-jdk11
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 5
          httpGet:
            path: /login
            port: http
          periodSeconds: 10
          timeoutSeconds: 5
        name: jenkins
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 50000
          name: agent-listener
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /login
            port: http
          periodSeconds: 10
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 2000m
            memory: 4096Mi
          requests:
            cpu: 50m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsGroup: 1000
          runAsUser: 1000
        startupProbe:
          failureThreshold: 12
          httpGet:
            path: /login
            port: http
          periodSeconds: 10
          timeoutSeconds: 5
        volumeMounts:
        - mountPath: /var/jenkins_home
          name: jenkins-home
          readOnly: false
        - mountPath: /var/jenkins_config
          name: jenkins-config
          readOnly: true
        - mountPath: /usr/share/jenkins/ref/plugins/
          name: plugin-dir
          readOnly: false
        - mountPath: /var/jenkins_home/casc_configs
          name: sc-config-volume
        - mountPath: /run/secrets/chart-admin-username
          name: admin-secret
          readOnly: true
          subPath: jenkins-admin-user
        - mountPath: /run/secrets/chart-admin-password
          name: admin-secret
          readOnly: true
          subPath: jenkins-admin-password
        - mountPath: /var/jenkins_cache
          name: jenkins-cache
        - mountPath: /tmp
          name: tmp-volume
      - env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: LABEL
          value: RELEASE-NAME-jenkins-jenkins-config
        - name: FOLDER
          value: /var/jenkins_home/casc_configs
        - name: NAMESPACE
          value: default
        - name: REQ_URL
          value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
        - name: REQ_METHOD
          value: POST
        - name: REQ_RETRY_CONNECT
          value: "10"
        image: kiwigrid/k8s-sidecar:1.15.0
        imagePullPolicy: IfNotPresent
        name: config-reload
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /var/jenkins_home/casc_configs
          name: sc-config-volume
        - mountPath: /var/jenkins_home
          name: jenkins-home
      initContainers:
      - command:
        - sh
        - /var/jenkins_config/apply_config.sh
        image: jenkins/jenkins:2.319.2-jdk11
        imagePullPolicy: Always
        name: init
        resources:
          limits:
            cpu: 2000m
            memory: 4096Mi
          requests:
            cpu: 50m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsGroup: 1000
          runAsUser: 1000
        volumeMounts:
        - mountPath: /var/jenkins_home
          name: jenkins-home
        - mountPath: /var/jenkins_config
          name: jenkins-config
        - mountPath: /usr/share/jenkins/ref/plugins
          name: plugins
        - mountPath: /var/jenkins_plugins
          name: plugin-dir
        - mountPath: /tmp
          name: tmp-volume
      securityContext:
        fsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
      serviceAccountName: RELEASE-NAME-jenkins
      volumes:
      - emptyDir: {}
        name: plugins
      - configMap:
          name: RELEASE-NAME-jenkins
        name: jenkins-config
      - emptyDir: {}
        name: plugin-dir
      - emptyDir: {}
        name: jenkins-cache
      - name: jenkins-home
        persistentVolumeClaim:
          claimName: RELEASE-NAME-jenkins
      - emptyDir: {}
        name: sc-config-volume
      - emptyDir: {}
        name: tmp-volume
      - name: admin-secret
        secret:
          secretName: RELEASE-NAME-jenkins
