aboutsummaryrefslogtreecommitdiffstats

ECOMP is a trademark and service mark of AT&T Intellectual Property.

rkt-ice-jenkins (for kubernetes)

design considerations

goals

  • bog standard jenkins
  • one admin user
  • admin password defined in vault, not generated by jenkins
  • no interactive setup on first launch
  • ssh keys set
  • turn on security by default (so anonymous doesn't have admin!)

ideas

  • no need for massive "initial home" tarball; just place the stuff we want and jenkins will install the rest as usual
  • use groovy to set admin password
    • nope: fragile, unreliable, and groovy is gross
  • write users/admin/config.xml as templated k8s secret, insert password hash
    • okay, but ansible has no bcrypt filter. need to store hashed.
    • but paul says prefer environment variables
    • but then any jenkins job has access to the hashed password
  • write jenkins.install.InstallUtil.lastExecVersion jenkins.install.UpgradeWizard.state
    • can't simply mount them; need some process to copy into place

design

  • tweak base image to insert bootstrap wrapper script
  • store secrets wherever (/etc/secrets), bootstrap can apply them
  • bootstrap can generate jenkins.install.InstallUtil.lastExecVersion & jenkins.install.UpgradeWizard.state