/kubesphere-devops-jenkins

name: kubesphere-devops-jenkins
description: Use when configuring Jenkins in KubeSphere DevOps, including agent customization, LDAP/OIDC integration, build artifact retrieval, or troubleshooting Jenkins issues

KubeSphere DevOps Jenkins Configuration

Overview

KubeSphere DevOps embeds Jenkins as the CI engine. Jenkins is configured via Configuration as Code (CasC) and provides the underlying pipeline execution environment. Understanding Jenkins configuration is essential for customizing agents, authentication, and resource management.

When to Use

• Accessing Jenkins console directly
• Configuring LDAP or OIDC authentication
• Customizing Jenkins agent images
• Configuring GitLab or other SCM servers
• Troubleshooting Jenkins startup issues
• Updating Jenkins after DevOps upgrade
• Triggering builds via API
• Downloading build artifacts
• Viewing build logs and status

Accessing Jenkins Console

Get Admin Credentials

# Get Jenkins admin user and password
kubectl -n kubesphere-devops-system get secret devops-jenkins -o yaml

# Decode values
echo "<jenkins-admin-password-base64>" | base64 -d
echo "<jenkins-admin-user-base64>" | base64 -d

Get Jenkins NodePort

kubectl -n kubesphere-devops-system get svc devops-jenkins
# Default NodePort: 30180

Access via: `http://<master-node-ip>:30180`

Configuration As Code (CasC)

Jenkins configuration is managed through the `jenkins-casc-config` ConfigMap:

# View current CasC
kubectl -n kubesphere-devops-system get cm jenkins-casc-config -o yaml

Key Configuration Sections

agent:
  jenkins:
    Master:
      NodeSelector: {}
      Tolerations: []
    Agent:
      Image: "jenkins/inbound-agent"
      Tag: "3309.v27b_9314fd1a_4-1-jdk21"
      Privileged: false
      NodeSelector: {}

Authentication Configuration

LDAP Integration

agent:
  jenkins:
    exactSecurityRealm:
      ldap:
        configurations:
        - displayNameAttributeName: "uid"
          mailAddressAttributeName: "mail"
          inhibitInferRootDN: false
          managerDN: "cn=admin,dc=kubesphere,dc=io"
          managerPasswordSecret: "admin"
          rootDN: "dc=kubesphere,dc=io"
          userSearchBase: "ou=Users"
          userSearch: "(&(objectClass=inetOrgPerson)(|(uid={0})(mail={0})))"
          groupSearchBase: "ou=Groups"
          groupSearchFilter: "(&(objectClass=posixGroup)(cn={0}))"
          server: "ldap://openldap.kubesphere-system.svc:389"
        disableMailAddressResolver: false
        disableRolePrefixing: true

OpenID Connect (OIDC) Integration

agent:
  jenkins:
    exactSecurityRealm:
      oic:
        clientId: "jenkins"
        clientSecret: "jenkins"
        tokenServerUrl: "http://192.168.1.20:30880/oauth/token"
        authorizationServerUrl: "http://192.168.1.20:30880/oauth/authorize"
        userInfoServerUrl: "http://192.168.1.20:30880/oauth/userinfo"
        endSessionEndpoint: "http://192.168.1.20:30880/oauth/logout"
        logoutFromOpenidProvider: true
        scopes: openid profile email
        fullNameFieldName: url
        userNameField: preferred_username
    redirectURIs:
    - http://192.168.1.20:30180/securityRealm/finishLogin

GitLab Integration

Configure GitLab servers for pipeline integration:

agent:
  jenkins:
    unclassified:
      gitLabServers:
        - name: "gitlab-a"
          serverUrl: "https://gitlab.a.com"
        - name: "gitlab-b"
          serverUrl: "https://gitlab.b.com"

After updating ConfigMap, create credentials in Jenkins Console: 1. Manage Jenkins > System 2. Find GitLab section 3. Add credentials (GitLab Personal Access Token) 4. Test connection 5. Save

Agent Customization

Update JNLP Image (v1.2.x)

# Get current config
kubectl -n kubesphere-devops-system get cm jenkins-casc-config -o yaml > /tmp/casc-old.yaml

# Update image version
sed 's/inbound-agent:4.10-2/inbound-agent:3309.v27b_9314fd1a_4-1-jdk21/g' /tmp/casc-old.yaml > /tmp/casc.yaml

# Apply new config
kubectl apply -f /tmp/casc.yaml

# Restart Jenkins
kubectl -n kubesphere-devops-system rollout restart deployment devops-jenkins

Enable Podman for Non-Docker Environments

For hosts running containerd instead of Docker:

agent:
  jenkins:
    Agent:
      Privileged: true  # Required for podman

Use agent images with `-podman` suffix. These alias `docker` command to `podman`.

Custom Agent PodTemplate

agent:
  jenkins:
    Agent:
      PodTemplate:
        Name: "default"
        Label: "jenkins-agent"
        Containers:
        - Name: "jnlp"
          Image: "jenkins/inbound-agent:3309.v27b_9314fd1a_4-1-jdk21"
          Args: "^${computer.jnlpmac} ^${computer.name}"
          Resource:
            Request:
              Cpu: "100m"
              Memory: "256Mi"
            Limit:
              Cpu: "500m"
              Memory: "512Mi"

Backup and Restore

Backup Jenkins Data

# Find Jenkins PVC
kubectl -n kubesphere-devops-system get pvc

# Create backup inside Jenkins pod
kubectl -n kubesphere-devops-system exec deployment/devops-jenkins -- bash -c \
  'cd /tmp && tar czvf jenkins_home.backup.tar /var/jenkins_home && mv jenkins_home.backup.tar /var/jenkins_home'

# Copy to local
kubectl -n kubesphere-devops-system cp \
  deployment/devops-jenkins:/var/jenkins_home/jenkins_home.backup.tar \
  ./jenkins_home.backup.tar

Reset Jenkins Components

agent:
  jenkins:
    Master:
      resetPlugins: true    # Reset all plugins to default
      resetRBACRoles: true  # Reset RBAC roles
      resetAdminPassword: true  # Reset admin password
      resetAdminToken: true     # Reset admin API token

Apply and restart Jenkins to reset.

Troubleshooting

Jenkins Won't Start

# Check pod status
kubectl -n kubesphere-devops-system get pods -l app=devops-jenkins

# View logs
kubectl -n kubesphere-devops-system logs -l ap