[stable/jenkins] Add runAsUser and runAsGroup to podTemplate

[janekbaraniewski]

Is this a new chart

NOTE: We're experiencing a high volume of PRs to this repo and reviews will be delayed. Please host your own chart repository and submit your repository to the Helm Hub instead of this repo to make them discoverable to the community. Here is how to submit new chart repositories to the Helm Hub.

No

What this PR does / why we need it:

Adds ability to configure user/group for Jenkins agent containers. Currently it's impossible to do using Jenking Configuration as a Code because of those missing values, causing failure of custom agent sidecar containers with different default user.

Special notes for your reviewer:

@lachie83 Hey, first time making a PR to charts repo so not really sure how it works, should I tag all maintainers here?

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• DCO signed
• Chart Version bumped
• Variables are documented in the README.md
• Title of the PR starts with chart name (e.g. [stable/mychartname])

[k8s-ci-robot]

Hi @janekbaraniewski. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[janekbaraniewski]

/assign @viglesiasce

[wmcdona89]

@janekbaraniewski thanks for the PR!

please rebase and also update values.yaml and the CHANGELOG

[wmcdona89]

could you explain your use case in more detail? these fields can be configured for both the pod and the container and I'm wondering if there's a need to support both. if so, the naming will need to account for this.

perhaps...

agent.runAsUserContainer
agent.runAsGroupContainer
agent.runAsUserPod
agent.runAsGroupPod

[janekbaraniewski]

Hey, I'm using custom agent sidecar image with some custom default user example which doesn't have proper permissions to use mounted jenkins workspace that's managed by jnlp container.
So in my case I only need to modify them at container level and I'm not sure if there is a need to set it at pod level. Only example I can think of is when you want to also change user in jnlp sidecar that's added to agent pod when you overwrite sideContainerName and set it to one value for all containers.

[wmcdona89]

Yeah, setting these options at the container level does seem like the more common use case.

[torstenwalter]

@wmcdona89 Isn't it already possible to configure it using podTemplate?
In that case it could be better to add an example rather than introducing yet another field.

[janekbaraniewski]

@torstenwalter that's true, it is possible to configure using agent.podTemplates. However, this doesn't suit my usecase that well.

I need to define common "base" configuration that then can have specific fields overwritten depending on environment. Since agent.podTemplates is essentially a string I cannot simply overwrite for example image attribute without redefining whole structure again. I could introduce some rendering mechanism but that introduces additional complexity to my configuration and I would like to avoid it if possible.

I also can't see a reason why it should be possible to do it using podTemplates but not additionalAgents. From a user perspective I think that's misleading since both of them claim to do the same thing - configure additional kubernetes pod templates.

[wmcdona89]

/ok-to-test

[wmcdona89]

@torstenwalter lgtm

[torstenwalter]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: janekbaraniewski, torstenwalter

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• stable/jenkins/OWNERS [torstenwalter]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[torstenwalter]

/retest

[unguiculus]

/retest

[unguiculus]

/retest

[torstenwalter]

/retest

[scottrigby]

/retest