Merge pull request 'feat: convert jenkins to Helm chart (helm/jenkins/)' (#6 ) from feat/helm-jenkins into main

Reviewed-on: #6
feat: jenkins ArgoCD Application — points to helm/jenkins chart
2026-03-08 15:37:57 +00:00 · 2026-03-08 15:24:18 +00:00 · 2026-03-08 15:24:07 +00:00 · 2026-03-08 15:23:59 +00:00 · 2026-03-08 15:23:51 +00:00 · 2026-03-08 15:23:38 +00:00
27 changed files with 888 additions and 4 deletions
--- a/apps/nginx-canary/application.yaml
+++ b/apps/nginx-canary/application.yaml
@@ -0,0 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: nginx-canary
  namespace: argocd
 spec:
  project: default
  source:
    repoURL: http://gitea-http.gitea.svc.cluster.local:3000/admin/k3s-gitops
    path: apps/nginx-canary
    targetRevision: HEAD
  destination:
    server: https://kubernetes.default.svc
    namespace: nginx-canary
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
--- a/apps/nginx-canary/certificate.yaml
+++ b/apps/nginx-canary/certificate.yaml
@@ -0,0 +1,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: nginx-canary-tls
  namespace: nginx-canary
 spec:
  secretName: nginx-canary-tls
  issuerRef:
    name: letsencrypt-http
    kind: ClusterIssuer
  dnsNames:
    - nginx-canary.thedevops.dev
--- a/apps/nginx-canary/configmap.yaml
+++ b/apps/nginx-canary/configmap.yaml
@@ -0,0 +1,180 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: nginx-canary-html
  namespace: nginx-canary
 data:
  index.html: |
    <!DOCTYPE html>
    <html lang="en">
    <head>
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
      <title>Hello from MCP v2 — Canary</title>
      <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
          font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
          background: linear-gradient(135deg, #1a0a00, #3d1f00, #1a0a00);
          min-height: 100vh;
          display: flex;
          align-items: center;
          justify-content: center;
          color: #fff;
        }
        .card {
          background: rgba(255,200,0,0.08);
          backdrop-filter: blur(12px);
          border: 1px solid rgba(255,200,0,0.3);
          border-radius: 20px;
          padding: 60px 80px;
          text-align: center;
          box-shadow: 0 25px 50px rgba(0,0,0,0.5), 0 0 60px rgba(255,180,0,0.08);
          max-width: 650px;
          width: 90%;
        }
        .badge {
          display: inline-block;
          background: linear-gradient(90deg, #f59e0b, #d97706);
          color: #000;
          font-size: 0.75rem;
          font-weight: 800;
          letter-spacing: 2px;
          text-transform: uppercase;
          padding: 6px 18px;
          border-radius: 20px;
          margin-bottom: 10px;
        }
        .version-badge {
          display: inline-block;
          background: rgba(245,158,11,0.2);
          border: 1px solid rgba(245,158,11,0.5);
          color: #fbbf24;
          font-size: 0.7rem;
          font-weight: 700;
          letter-spacing: 2px;
          text-transform: uppercase;
          padding: 4px 14px;
          border-radius: 20px;
          margin-bottom: 30px;
        }
        h1 {
          font-size: 3rem;
          font-weight: 800;
          background: linear-gradient(90deg, #fbbf24, #f59e0b);
          -webkit-background-clip: text;
          -webkit-text-fill-color: transparent;
          margin-bottom: 10px;
        }
        .subtitle { color: #d97706; font-size: 1rem; margin-bottom: 20px; }
        .canary-warning {
          background: rgba(245,158,11,0.15);
          border: 1px solid rgba(245,158,11,0.4);
          border-radius: 8px;
          padding: 10px 20px;
          font-size: 0.85rem;
          color: #fbbf24;
          margin-bottom: 25px;
          font-weight: 600;
        }
        .ip-box {
          background: rgba(0,0,0,0.35);
          border: 1px solid rgba(245,158,11,0.5);
          border-radius: 12px;
          padding: 20px 30px;
          margin-bottom: 20px;
        }
        .ip-label {
          font-size: 0.7rem;
          letter-spacing: 2px;
          text-transform: uppercase;
          color: #b45309;
          margin-bottom: 8px;
        }
        .ip-value {
          font-size: 1.8rem;
          font-weight: 700;
          font-family: 'Courier New', monospace;
          color: #fbbf24;
          letter-spacing: 3px;
        }
        .info-grid {
          display: grid;
          grid-template-columns: 1fr 1fr;
          gap: 12px;
          margin-bottom: 20px;
        }
        .info-box {
          background: rgba(0,0,0,0.35);
          border: 1px solid rgba(245,158,11,0.3);
          border-radius: 10px;
          padding: 12px 16px;
          text-align: left;
        }
        .info-label {
          font-size: 0.65rem;
          letter-spacing: 2px;
          text-transform: uppercase;
          color: #b45309;
          margin-bottom: 4px;
        }
        .info-value {
          font-size: 0.95rem;
          font-weight: 700;
          font-family: 'Courier New', monospace;
          color: #fbbf24;
        }
        .footer { font-size: 0.78rem; color: #78350f; margin-top: 10px; }
      </style>
    </head>
    <body>
      <div class="card">
        <div class="badge">&#128036; Canary Release</div><br>
        <div class="version-badge">v2.0.0</div>
        <h1>Hello from MCP v2</h1>
        <p class="subtitle">Canary deployment — receiving experimental traffic</p>
        <div class="canary-warning">&#9888; This is a CANARY build — not yet promoted to stable</div>
        <div class="ip-box">
          <div class="ip-label">Your IP Address</div>
          <div class="ip-value" id="ip">Detecting...</div>
        </div>
        <div class="info-grid">
          <div class="info-box">
            <div class="info-label">Track</div>
            <div class="info-value">canary</div>
          </div>
          <div class="info-box">
            <div class="info-label">Version</div>
            <div class="info-value">v2.0.0</div>
          </div>
          <div class="info-box">
            <div class="info-label">Image</div>
            <div class="info-value">nginx:1.25-alpine</div>
          </div>
          <div class="info-box">
            <div class="info-label">Replicas</div>
            <div class="info-value">2</div>
          </div>
        </div>
        <div class="footer">nginx-canary &middot; thedevops.dev &middot; ArgoCD + Traefik + MCP</div>
      </div>
      <script>
        fetch('https://api.ipify.org?format=json')
          .then(r => r.json())
          .then(d => { document.getElementById('ip').textContent = d.ip; })
          .catch(() => { document.getElementById('ip').textContent = window.location.hostname; });
      </script>
    </body>
    </html>
  nginx.conf: |
    server {
      listen 80;
      server_name _;
      root /usr/share/nginx/html;
      index index.html;
      add_header X-Version "v2.0.0" always;
      add_header X-Track "canary" always;
      location / {
        try_files $uri $uri/ =404;
      }
    }
--- a/apps/nginx-canary/deployment.yaml
+++ b/apps/nginx-canary/deployment.yaml
@@ -0,0 +1,56 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: nginx-canary
  namespace: nginx-canary
  labels:
    app: nginx-canary
    track: canary
    version: v2.0.0
 spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-canary
  template:
    metadata:
      labels:
        app: nginx-canary
        track: canary
        version: v2.0.0
    spec:
      containers:
        - name: nginx
          image: nginx:1.25-alpine
          ports:
            - containerPort: 80
          volumeMounts:
            - name: html
              mountPath: /usr/share/nginx/html/index.html
              subPath: index.html
            - name: html
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: nginx.conf
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 20
      volumes:
        - name: html
          configMap:
            name: nginx-canary-html
--- a/apps/nginx-canary/ingressroute.yaml
+++ b/apps/nginx-canary/ingressroute.yaml
@@ -0,0 +1,37 @@
 ---
 # Direct HTTPS access to canary app at nginx-canary.thedevops.dev
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-canary-direct
  namespace: nginx-canary
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`nginx-canary.thedevops.dev`)
      kind: Rule
      services:
        - name: nginx-canary
          port: 80
  tls:
    secretName: nginx-canary-tls
 ---
 # HTTP redirect for nginx-canary.thedevops.dev
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-canary-direct-http
  namespace: nginx-canary
 spec:
  entryPoints:
    - web
  routes:
    - match: Host(`nginx-canary.thedevops.dev`)
      kind: Rule
      middlewares:
        - name: redirect-https
          namespace: nginx-mcp
      services:
        - name: nginx-canary
          port: 80
--- a/apps/nginx-canary/namespace.yaml
+++ b/apps/nginx-canary/namespace.yaml
@@ -4,3 +4,4 @@ metadata:
  name: nginx-canary
  labels:
    track: canary
    managed-by: argocd
--- a/apps/nginx-canary/service.yaml
+++ b/apps/nginx-canary/service.yaml
@@ -0,0 +1,16 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: nginx-canary
  namespace: nginx-canary
  labels:
    app: nginx-canary
    track: canary
 spec:
  selector:
    app: nginx-canary
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP
--- a/apps/nginx-mcp/configmap.yaml
+++ b/apps/nginx-mcp/configmap.yaml
@@ -10,7 +10,7 @@ data:
    <head>
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <title>Hello from MCP - v1 Stable</title>
+      <title>Hello from MCP — v1 Stable</title>
      <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
@@ -74,9 +74,21 @@ data:
          padding: 20px 30px;
          margin-bottom: 30px;
        }
-        .ip-label { font-size: 0.7rem; letter-spacing: 2px; text-transform: uppercase; color: #64748b; margin-bottom: 8px; }
+        .ip-label {
-        .ip-value { font-size: 1.8rem; font-weight: 700; font-family: 'Courier New', monospace; color: #a78bfa; letter-spacing: 3px; }
+          font-size: 0.7rem;
-        .footer { font-size: 0.78rem; color: #475569; }
+          letter-spacing: 2px;
          text-transform: uppercase;
          color: #64748b;
          margin-bottom: 8px;
        }
        .ip-value {
          font-size: 1.8rem;
          font-weight: 700;
          font-family: 'Courier New', monospace;
          color: #a78bfa;
          letter-spacing: 3px;
        }
        .footer { font-size: 0.78rem; color: #475569; margin-top: 10px; }
      </style>
    </head>
    <body>
--- a/apps/nginx-mcp/namespace.yaml
+++ b/apps/nginx-mcp/namespace.yaml
@@ -4,3 +4,4 @@ metadata:
  name: nginx-mcp
  labels:
    track: stable
    managed-by: argocd
--- a/apps/nginx-weighted/application.yaml
+++ b/apps/nginx-weighted/application.yaml
@@ -0,0 +1,20 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: nginx-weighted
  namespace: argocd
 spec:
  project: default
  source:
    repoURL: http://gitea-http.gitea.svc.cluster.local:3000/admin/k3s-gitops
    path: apps/nginx-weighted
    targetRevision: HEAD
  destination:
    server: https://kubernetes.default.svc
    namespace: nginx-mcp
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
--- a/apps/nginx-weighted/canary-proxy-svc.yaml
+++ b/apps/nginx-weighted/canary-proxy-svc.yaml
@@ -0,0 +1,18 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: nginx-canary-proxy
  namespace: nginx-mcp
  labels:
    app: nginx-canary-proxy
  annotations:
    description: >
      ExternalName proxy required because Traefik v3 does not allow
      cross-namespace service references inside TraefikService weighted config.
      This service bridges nginx-mcp namespace → nginx-canary namespace.
 spec:
  type: ExternalName
  externalName: nginx-canary.nginx-canary.svc.cluster.local
  ports:
    - port: 80
      targetPort: 80
--- a/apps/nginx-weighted/certificate-stable.yaml
+++ b/apps/nginx-weighted/certificate-stable.yaml
@@ -0,0 +1,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: nginx-stable-tls
  namespace: nginx-mcp
 spec:
  secretName: nginx-stable-tls
  issuerRef:
    name: letsencrypt-http
    kind: ClusterIssuer
  dnsNames:
    - nginx-stable.thedevops.dev
--- a/apps/nginx-weighted/certificate.yaml
+++ b/apps/nginx-weighted/certificate.yaml
@@ -0,0 +1,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: nginx-weighted-tls
  namespace: nginx-mcp
 spec:
  secretName: nginx-weighted-tls
  issuerRef:
    name: letsencrypt-http
    kind: ClusterIssuer
  dnsNames:
    - nginx.thedevops.dev
--- a/apps/nginx-weighted/ingressroute-stable.yaml
+++ b/apps/nginx-weighted/ingressroute-stable.yaml
@@ -0,0 +1,37 @@
 ---
 # Direct HTTPS access to stable app at nginx-stable.thedevops.dev
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-stable-direct
  namespace: nginx-mcp
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`nginx-stable.thedevops.dev`)
      kind: Rule
      services:
        - name: nginx-mcp
          port: 80
  tls:
    secretName: nginx-stable-tls
 ---
 # HTTP redirect for nginx-stable.thedevops.dev
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-stable-direct-http
  namespace: nginx-mcp
 spec:
  entryPoints:
    - web
  routes:
    - match: Host(`nginx-stable.thedevops.dev`)
      kind: Rule
      middlewares:
        - name: redirect-https
          namespace: nginx-mcp
      services:
        - name: nginx-mcp
          port: 80
--- a/apps/nginx-weighted/ingressroute.yaml
+++ b/apps/nginx-weighted/ingressroute.yaml
@@ -0,0 +1,38 @@
 ---
 # HTTPS entrypoint — routes nginx.thedevops.dev through weighted TraefikService
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-weighted
  namespace: nginx-mcp
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`nginx.thedevops.dev`)
      kind: Rule
      services:
        - name: nginx-weighted
          namespace: nginx-mcp
          kind: TraefikService
  tls:
    secretName: nginx-weighted-tls
 ---
 # HTTP entrypoint — redirects all HTTP traffic to HTTPS via middleware
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: nginx-weighted-http
  namespace: nginx-mcp
 spec:
  entryPoints:
    - web
  routes:
    - match: Host(`nginx.thedevops.dev`)
      kind: Rule
      middlewares:
        - name: redirect-https
          namespace: nginx-mcp
      services:
        - name: nginx-mcp
          port: 80
--- a/apps/nginx-weighted/middleware.yaml
+++ b/apps/nginx-weighted/middleware.yaml
@@ -0,0 +1,9 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: redirect-https
  namespace: nginx-mcp
 spec:
  redirectScheme:
    scheme: https
    permanent: true
--- a/apps/nginx-weighted/traefikservice.yaml
+++ b/apps/nginx-weighted/traefikservice.yaml
@@ -0,0 +1,25 @@
 ---
 # TraefikService — weighted load balancer between stable and canary.
 # THIS IS THE ONLY FILE YOU NEED TO EDIT to shift traffic weights.
 #
 # Weight scenarios:
 #   Initial canary test    → stable: 90  canary: 10
 #   Extended testing       → stable: 50  canary: 50
 #   Full promote to canary → stable:  0  canary: 100
 #   Emergency rollback     → stable: 100 canary:  0
 apiVersion: traefik.io/v1alpha1
 kind: TraefikService
 metadata:
  name: nginx-weighted
  namespace: nginx-mcp
 spec:
  weighted:
    services:
      - name: nginx-mcp
        namespace: nginx-mcp
        port: 80
        weight: 90
      - name: nginx-canary-proxy
        namespace: nginx-mcp
        port: 80
        weight: 10
--- a/helm/jenkins/Chart.yaml
+++ b/helm/jenkins/Chart.yaml
@@ -0,0 +1,13 @@
 apiVersion: v2
 name: jenkins
 description: Jenkins CI/CD — Helm chart for thedevops.dev cluster
 type: application
 version: 0.1.0
 appVersion: "lts-jdk17"
 keywords:
  - jenkins
  - ci
  - cd
 maintainers:
  - name: admin
    url: https://thedevops.dev
--- a/helm/jenkins/argocd-application.yaml
+++ b/helm/jenkins/argocd-application.yaml
@@ -0,0 +1,28 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: jenkins
  namespace: argocd
 spec:
  project: default
  source:
    repoURL: http://gitea-http.gitea.svc.cluster.local:3000/admin/k3s-gitops
    path: helm/jenkins          # Helm chart directory
    targetRevision: HEAD
    helm:
      valueFiles:
        - values.yaml           # default values
      # To override per-environment add values here:
      # values: |
      #   replicaCount: 2
      #   persistence:
      #     size: 50Gi
  destination:
    server: https://kubernetes.default.svc
    namespace: jenkins
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
--- a/helm/jenkins/templates/_helpers.tpl
+++ b/helm/jenkins/templates/_helpers.tpl
@@ -0,0 +1,43 @@
 {{/*
 Expand the name of the chart.
 */}}
 {{- define "jenkins.name" -}}
 {{- .Chart.Name }}
 {{- end }}
 {{/*
 Full name: release + chart name (trimmed to 63 chars)
 */}}
 {{- define "jenkins.fullname" -}}
 {{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 {{/*
 Common labels applied to all resources
 */}}
 {{- define "jenkins.labels" -}}
 helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
 app.kubernetes.io/name: {{ include "jenkins.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 {{/*
 Selector labels used in Deployment + Service matchLabels
 */}}
 {{- define "jenkins.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "jenkins.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 {{/*
 ServiceAccount name
 */}}
 {{- define "jenkins.serviceAccountName" -}}
 {{- if .Values.rbac.enabled }}
 {{- .Values.rbac.serviceAccountName }}
 {{- else }}
 default
 {{- end }}
 {{- end }}
--- a/helm/jenkins/templates/deployment.yaml
+++ b/helm/jenkins/templates/deployment.yaml
@@ -0,0 +1,100 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "jenkins.name" . }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "jenkins.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "jenkins.selectorLabels" . | nindent 8 }}
    spec:
      serviceAccountName: {{ include "jenkins.serviceAccountName" . }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
      initContainers:
        {{- if .Values.initContainers.installDocker.enabled }}
        - name: install-docker
          image: {{ .Values.initContainers.installDocker.image }}
          command:
            - sh
            - -c
            - |
              echo "Installing Docker CLI..."
              cp /usr/local/bin/docker /tmp/tools-bin/
              chmod +x /tmp/tools-bin/docker
              echo "Docker CLI installed"
          volumeMounts:
            - name: tools-bin
              mountPath: /tmp/tools-bin
        {{- end }}
        {{- if .Values.initContainers.installKubectl.enabled }}
        - name: install-kubectl
          image: {{ .Values.initContainers.installKubectl.image }}
          command:
            - sh
            - -c
            - |
              echo "Installing kubectl {{ .Values.initContainers.installKubectl.kubectlVersion }}..."
              wget -q -O /tmp/tools-bin/kubectl \
                "https://dl.k8s.io/release/{{ .Values.initContainers.installKubectl.kubectlVersion }}/bin/linux/amd64/kubectl"
              chmod +x /tmp/tools-bin/kubectl
              echo "kubectl installed"
          volumeMounts:
            - name: tools-bin
              mountPath: /tmp/tools-bin
        {{- end }}
      containers:
        - name: {{ include "jenkins.name" . }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: {{ .Values.service.httpPort }}
            - name: agent
              containerPort: {{ .Values.service.agentPort }}
          env:
            {{- toYaml .Values.extraEnv | nindent 12 }}
            {{- if .Values.containerd.enabled }}
            - name: DOCKER_HOST
              value: "unix:///var/run/containerd.sock"
            {{- end }}
          command:
            - sh
            - -c
            - |
              export PATH="/tmp/tools-bin:$PATH"
              exec /usr/local/bin/jenkins.sh
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: jenkins-home
              mountPath: /var/jenkins_home
            {{- if .Values.containerd.enabled }}
            - name: docker-sock
              mountPath: /var/run/containerd.sock
            {{- end }}
            - name: tools-bin
              mountPath: /tmp/tools-bin
      volumes:
        - name: jenkins-home
          {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.claimName }}
          {{- else }}
          emptyDir: {}
          {{- end }}
        {{- if .Values.containerd.enabled }}
        - name: docker-sock
          hostPath:
            path: {{ .Values.containerd.socketPath }}
            type: Socket
        {{- end }}
        - name: tools-bin
          emptyDir: {}
--- a/helm/jenkins/templates/ingress.yaml
+++ b/helm/jenkins/templates/ingress.yaml
@@ -0,0 +1,28 @@
 {{- if .Values.ingress.enabled }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: {{ include "jenkins.name" . }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
  annotations:
    kubernetes.io/ingress.class: traefik
    cert-manager.io/cluster-issuer: {{ .Values.ingress.certIssuer }}
 spec:
  tls:
    - hosts:
        - {{ .Values.ingress.host }}
      secretName: {{ .Values.ingress.tlsSecretName }}
  rules:
    - host: {{ .Values.ingress.host }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ include "jenkins.name" . }}
                port:
                  number: {{ .Values.service.httpPort }}
 {{- end }}
--- a/helm/jenkins/templates/namespace.yaml
+++ b/helm/jenkins/templates/namespace.yaml
@@ -0,0 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
--- a/helm/jenkins/templates/pvc.yaml
+++ b/helm/jenkins/templates/pvc.yaml
@@ -0,0 +1,16 @@
 {{- if .Values.persistence.enabled }}
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: {{ .Values.persistence.claimName }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 spec:
  accessModes:
    - {{ .Values.persistence.accessMode }}
  storageClassName: {{ .Values.persistence.storageClass }}
  resources:
    requests:
      storage: {{ .Values.persistence.size }}
 {{- end }}
--- a/helm/jenkins/templates/rbac.yaml
+++ b/helm/jenkins/templates/rbac.yaml
@@ -0,0 +1,47 @@
 {{- if .Values.rbac.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ .Values.rbac.serviceAccountName }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: {{ .Values.rbac.clusterRoleName }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 rules:
  - apiGroups: [""]
    resources: ["pods", "services", "configmaps", "secrets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec", "pods/log"]
    verbs: ["create", "get"]
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["argoproj.io"]
    resources: ["applications"]
    verbs: ["get", "list", "watch", "update", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: {{ .Values.rbac.clusterRoleName }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.rbac.clusterRoleName }}
 subjects:
  - kind: ServiceAccount
    name: {{ .Values.rbac.serviceAccountName }}
    namespace: {{ .Values.namespace }}
 {{- end }}
--- a/helm/jenkins/templates/service.yaml
+++ b/helm/jenkins/templates/service.yaml
@@ -0,0 +1,18 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "jenkins.name" . }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "jenkins.labels" . | nindent 4 }}
 spec:
  type: {{ .Values.service.type }}
  selector:
    {{- include "jenkins.selectorLabels" . | nindent 4 }}
  ports:
    - name: http
      port: {{ .Values.service.httpPort }}
      targetPort: {{ .Values.service.httpPort }}
    - name: agent
      port: {{ .Values.service.agentPort }}
      targetPort: {{ .Values.service.agentPort }}
--- a/helm/jenkins/values.yaml
+++ b/helm/jenkins/values.yaml
@@ -0,0 +1,79 @@
 # Jenkins Helm Chart — default values
 # All tuneable parameters are here.
 # Override per-environment with: helm install -f values-prod.yaml
 # -- Namespace where Jenkins is deployed
 namespace: jenkins
 # -- Number of Jenkins pods (should stay 1 — Jenkins is stateful)
 replicaCount: 1
 image:
  # -- Jenkins image
  repository: jenkins/jenkins
  tag: lts-jdk17
  pullPolicy: IfNotPresent
 service:
  type: ClusterIP
  # -- Jenkins web UI port
  httpPort: 8080
  # -- Jenkins agent JNLP port
  agentPort: 50000
 ingress:
  enabled: true
  # -- Hostname for Jenkins web UI
  host: jenkins.thedevops.dev
  # -- cert-manager ClusterIssuer name
  certIssuer: letsencrypt-http
  # -- TLS secret name
  tlsSecretName: jenkins-tls
 persistence:
  enabled: true
  # -- Storage class (longhorn, local-path, etc.)
  storageClass: longhorn
  # -- PVC size for jenkins_home
  size: 20Gi
  accessMode: ReadWriteOnce
  claimName: jenkins-home
 # -- Security context — fsGroup 1000 required for jenkins_home permissions
 securityContext:
  fsGroup: 1000
 # -- RBAC — creates ServiceAccount, ClusterRole, ClusterRoleBinding
 rbac:
  enabled: true
  serviceAccountName: jenkins
  clusterRoleName: jenkins-deployer
 # -- Resource limits/requests
 resources:
  requests:
    cpu: 200m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 2Gi
 # -- Mount containerd socket for Docker CLI access
 containerd:
  enabled: true
  socketPath: /run/k3s/containerd/containerd.sock
 # -- initContainers install Docker CLI and kubectl into shared volume
 initContainers:
  installDocker:
    enabled: true
    image: docker:24-cli
  installKubectl:
    enabled: true
    image: alpine:3.19
    kubectlVersion: v1.28.0
 # -- Extra environment variables for Jenkins container
 extraEnv:
  - name: JENKINS_OPTS
    value: "--httpPort=8080"
Author	SHA1	Message	Date
admin	ac9b178aa1	Merge pull request 'feat: convert jenkins to Helm chart (helm/jenkins/)' (#6 ) from feat/helm-jenkins into main Reviewed-on: #6	2026-03-08 15:37:57 +00:00
Claude AI	b79af99667	feat: jenkins ArgoCD Application — points to helm/jenkins chart	2026-03-08 15:24:18 +00:00
Claude AI	bf29990add	feat: jenkins Helm chart — ingress template	2026-03-08 15:24:07 +00:00
Claude AI	b7f0fc4f6b	feat: jenkins Helm chart — service template	2026-03-08 15:23:59 +00:00
Claude AI	d72569f68f	feat: jenkins Helm chart — deployment template	2026-03-08 15:23:51 +00:00
Claude AI	6efd08a5fa	feat: jenkins Helm chart — pvc template	2026-03-08 15:23:38 +00:00
Claude AI	4d06531df5	feat: jenkins Helm chart — rbac template	2026-03-08 15:23:31 +00:00
Claude AI	170b15ed47	feat: jenkins Helm chart — namespace template	2026-03-08 15:23:22 +00:00
Claude AI	1c102876ea	feat: jenkins Helm chart — _helpers.tpl	2026-03-08 15:23:18 +00:00
Claude AI	a2aeb08427	feat: jenkins Helm chart — values.yaml	2026-03-08 15:23:09 +00:00
Claude AI	c4ed5c305c	feat: jenkins Helm chart — Chart.yaml	2026-03-08 15:22:56 +00:00
admin	096008617d	Merge pull request 'fix: add direct IngressRoutes for nginx-stable and nginx-canary subdomains' (#5 ) from feat/nginx-direct-routes into main Reviewed-on: #5	2026-03-04 19:02:24 +00:00
Claude AI	128857d740	feat: IngressRoute direct access to canary at nginx-canary.thedevops.dev	2026-03-04 19:01:07 +00:00
Claude AI	a74380c917	feat: IngressRoute direct access to stable at nginx-stable.thedevops.dev	2026-03-04 19:01:01 +00:00
Claude AI	e0ef0e683f	feat: TLS certificate for nginx-canary.thedevops.dev	2026-03-04 19:00:54 +00:00
Claude AI	7fec458a39	feat: TLS certificate for nginx-stable.thedevops.dev	2026-03-04 19:00:49 +00:00
admin	a09690feba	Merge pull request 'feat: deploy nginx-weighted traffic layer (TraefikService 90/10, TLS, HTTP redirect)' (#4 ) from feat/nginx-weighted into main Reviewed-on: #4	2026-03-04 18:43:12 +00:00
Claude AI	cdb736d5b2	feat: nginx-weighted ArgoCD application — destination nginx-mcp namespace	2026-03-04 18:41:39 +00:00
Claude AI	e9823e56ad	feat: IngressRoutes — websecure (weighted) + web (redirect)	2026-03-04 18:41:33 +00:00
Claude AI	d906dd2d25	feat: Traefik Middleware HTTP→HTTPS permanent redirect	2026-03-04 18:41:26 +00:00
Claude AI	ebef2bf36e	feat: cert-manager Certificate for nginx.thedevops.dev	2026-03-04 18:41:21 +00:00
Claude AI	9447fe8b01	feat: TraefikService weighted routing 90/10 stable/canary	2026-03-04 18:41:15 +00:00
Claude AI	539483b4b5	feat: canary ExternalName proxy service (namespace bridge)	2026-03-04 18:41:08 +00:00
admin	047b1cbde8	Merge pull request 'feat/nginx-canary' (#3 ) from feat/nginx-canary into main Reviewed-on: #3	2026-03-04 18:40:19 +00:00
Claude AI	16a8ab3276	feat: nginx-canary ArgoCD application — automated sync, prune, selfHeal	2026-03-04 18:39:41 +00:00
Claude AI	c02e2b29c7	feat: nginx-canary service — ClusterIP port 80	2026-03-04 18:39:36 +00:00
Claude AI	15c2233a71	feat: nginx-canary deployment — 2 replicas, nginx:1.25-alpine	2026-03-04 18:39:31 +00:00
Claude AI	2d51a42271	feat: nginx-canary configmap — orange UI, v2.0.0, X-Version/X-Track headers	2026-03-04 18:39:22 +00:00
Claude AI	785a363547	feat: nginx-canary namespace	2026-03-04 18:38:58 +00:00
admin	79e264572b	Merge pull request 'feat: deploy nginx-mcp stable app (v1, 3 replicas, purple UI)' (#2 ) from feat/nginx-mcp-stable into main Reviewed-on: #2	2026-03-04 18:37:39 +00:00
Claude AI	e1fa1ae998	feat: nginx-mcp ArgoCD application — automated sync, prune, selfHeal	2026-03-04 18:34:38 +00:00
Claude AI	3842b6f84d	feat: nginx-mcp stable service — ClusterIP port 80	2026-03-04 18:34:22 +00:00
Claude AI	a1e4fd80b0	feat: nginx-mcp stable deployment — 3 replicas, nginx:1.25-alpine	2026-03-04 18:34:11 +00:00
Claude AI	de925ec39b	feat: nginx-mcp stable configmap — purple UI, v1 stable	2026-03-04 18:34:01 +00:00
Claude AI	6031836442	feat: nginx-mcp stable namespace	2026-03-04 18:33:42 +00:00