fix(jenkins): commit agent config that only existed on one machine - #12
Merged
Cervator merged 1 commit intoAug 12, 2026
Merged
Conversation
The `python-agent-ai` template was added live and never committed, so every controller restart reloaded the last-synced JCasC and dropped it — the config had to be re-applied by hand each time. That is the actual failure mode behind "we lose the agent config on restart", and committing is what ends it. The `light` / `light-java` labels on `pre-cached-jdk17` overlap with `pre-cached-jdk11` on purpose: jobs are expected to ask compositely (`java11 && light`), and anything requesting bare `light` is rare enough that either JDK is acceptable. Recorded because the comment above the jdk11 template reads as the opposite intent. Controller resources drop to 100m/2.5Gi requests. Restart on sync is expected and fine — nodes recycle regularly anyway. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
📝 WalkthroughSummary by CodeRabbit
WalkthroughJenkins now has a dedicated Vertex AI agent, expanded JDK 17 labels, lower controller resource settings, and corrected local setup instructions. ChangesJenkins configuration updates
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
jenkins/values-agents.yaml (1)
54-54: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the Vertex AI agent image to an immutable reference.
The
latesttag can change the build environment without a JCasC change or review. Use an image digest or an immutable release tag for this identity-bearing Jenkins agent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@jenkins/values-agents.yaml` at line 54, Update the Jenkins agent image reference in the values configuration to replace the mutable latest tag with an immutable image digest or versioned release tag, preserving the existing repository and agent configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@jenkins/values-agents.yaml`:
- Around line 153-154: Correct the shared-label comment near the JDK templates
to state that only light and light-java overlap with JDK 17, while lib remains
JDK 11-only. Update the JOML.groovy label expression to include java11 if JOML
must run on JDK 11; otherwise preserve its ability to run on either JDK.
---
Nitpick comments:
In `@jenkins/values-agents.yaml`:
- Line 54: Update the Jenkins agent image reference in the values configuration
to replace the mutable latest tag with an immutable image digest or versioned
release tag, preserving the existing repository and agent configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3a0842c6-b67f-49a7-ad69-65cd65366ebb
📒 Files selected for processing (3)
jenkins/README.mdjenkins/values-agents.yamljenkins/values.yaml
Comment on lines
+153
to
+154
| # "lib", "light" and "light-java" are an old generation of labels from before the JDK was called out explicitly, so they deliberately overlap with the JDK 17 template below. | ||
| # Jobs are expected to ask compositely ("java11 && light"); a job requesting bare "light" may land on either JDK, which is acceptable for how rare those are. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- jenkins/values-agents.yaml: relevant ranges ---'
sed -n '45,85p;135,210p' jenkins/values-agents.yaml
printf '%s\n' '--- JOML.groovy ---'
sed -n '1,80p' jenkins/jobDSL/Libraries/JOML.groovy
printf '%s\n' '--- label references ---'
rg -n --glob '!node_modules' --glob '!dist' \
'pre-cached-jdk17|light-java|java11|label|lib' \
jenkins/jobDSL jenkins/values-agents.yamlRepository: MovingBlocks/Logistics
Length of output: 18210
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
path = Path("jenkins/values-agents.yaml")
lines = path.read_text().splitlines()
# Print each agent block's labels and service-account-related fields without
# interpreting or executing the repository configuration.
current = None
for i, line in enumerate(lines, 1):
m = re.match(r"\s*-\s*name:\s*(\S+)", line)
if m:
current = m.group(1)
if current and any(key in line for key in ("name:", "label:", "yaml:", "serviceAccount", "automountServiceAccountToken")):
if i <= 220:
print(f"{i}: [{current}] {line}")
PYRepository: MovingBlocks/Logistics
Length of output: 2909
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
text = Path("jenkins/values-agents.yaml").read_text()
agents = {}
current = None
for line in text.splitlines():
m = re.match(r'\s*-\s*name:\s*"([^"]+)"\s*$', line)
if m:
current = m.group(1)
agents[current] = []
continue
m = re.match(r'\s*label:\s*"([^"]+)"\s*$', line)
if current and m:
agents[current] = m.group(1).split()
for selector in ("lib", "light", "light-java", "java11", "java17"):
matches = [name for name, labels in agents.items() if selector in labels]
print(f"{selector}: {matches}")
job = Path("jenkins/jobDSL/Libraries/JOML.groovy").read_text()
labels = re.findall(r'\blabel\s+"([^"]+)"', job)
print(f"JOML labels: {labels}")
print("JOML has explicit java11 constraint:",
any("java11" in label.split() for label in labels))
PYRepository: MovingBlocks/Logistics
Length of output: 442
Correct the shared-label documentation.
pre-cached-jdk17 has light and light-java, but not lib. lib remains JDK 11-only. JOML.groovy requests bare light-java, so it can run on either JDK. If JOML requires JDK 11, add java11 to its label expression.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@jenkins/values-agents.yaml` around lines 153 - 154, Correct the shared-label
comment near the JDK templates to state that only light and light-java overlap
with JDK 17, while lib remains JDK 11-only. Update the JOML.groovy label
expression to include java11 if JOML must run on JDK 11; otherwise preserve its
ability to run on either JDK.
Cervator
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
python-agent-aipod template (Vertex AI,um-vertex-ai-sa) and the JDK 17 label additions that until now only existed on one workstation.Checks: Read and writefor build status to post, and a typo fix in the secrets filename.Why this is worth doing now
values-agents.yamlhas not been committed since 2025-01-16, and theterajenkinsArgo Application has noautomated:block — so it has never self-synced. The live JCasC ConfigMap therefore reflects the last manual sync, and every controller restart reloads that, discarding anything added through the UI since. That is the mechanism behind agent config being repeatedly lost and re-applied by hand; landing this and syncing is what stops it.Hand-created jobs are unaffected either way — they live in
JENKINS_HOME, not in JCasC.Notes for the reviewer
lightandlight-javalabels now appear on bothpre-cached-jdk11andpre-cached-jdk17. That overlap is deliberate: jobs are expected to ask compositely (java11 && light), and barelightrequests are rare enough that either JDK is acceptable. The comment above the JDK 11 template said the opposite, so it has been rewritten to describe the current intent rather than the old one.Test plan
helm template terajenkins jenkins/jenkins -f values.yaml -f values-agents.yaml -f values-jcasc-general.yaml -f values-plugins.yamlrenders without error.python-ailabel resolves and apython-aijob schedules a pod usingum-vertex-ai-sa.Related
terajenkinsstill has noautomated:sync policy, thejava-nativetemplate is dead now that JNBullet builds on GitHub Actions, andvalues-agents.yamlpoints at an Artifact Registry image thatMovingBlocks/JenkinsAgentPrecachedJavadoes not publish.