Skip to content

fix(jenkins): commit agent config that only existed on one machine #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Cervator merged 1 commit into from
Aug 12, 2026
Merged

fix(jenkins): commit agent config that only existed on one machine #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion jenkins/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ To experiment with a new/temporary one consider creating a new OAuth application
* Make sure the Authorization callback URL is something like https://jenkins.terasology.io/securityRealm/finishLogin
* Description can be anything, like "Jenkins for The Terasology Foundation"

For the sake of local development ease you can use `jenkins-secret-do-not-recomment.yaml` to prepare the secrets for Kubernetes, just enter the right values as instructed by comments and run `kubectl apply -f jenkins-secret-do-not-recommit.yaml -n jenkins` - you may need to create the namespace first. HOWEVER you do of course not want to commit the actual values, and we should aim to use proper external secrets manager like Vault or some Argo-flavored thing (which does also have a plugin for Vault)
For the sake of local development ease you can use `jenkins-secret-do-not-recommit.yaml` to prepare the secrets for Kubernetes, just enter the right values as instructed by comments and run `kubectl apply -f jenkins-secret-do-not-recommit.yaml -n jenkins` - you may need to create the namespace first. HOWEVER you do of course not want to commit the actual values, and we should aim to use proper external secrets manager like Vault or some Argo-flavored thing (which does also have a plugin for Vault)

## GitHub API via GitHub App

Expand Down Expand Up @@ -53,6 +53,8 @@ The key generated from the GitHub application was included in this repo as `tera

Note: For testing a new Jenkins the existing GitHub app can simply be used directly - it will work even with a test Jenkins at a different URL.

Note: At some point "Checks" became a needed permissions to update commit status on GitHub after builds. Make sure the GitHub app under Permissions & Events / Repository Permissions / Checks is set to "Read and write"

## Various secrets

Jenkins has built up a lot of credentials over the years, and all the original instructions are in the https://github.com/MovingBlocks/InfraPlayground repo - for this rejuvenation attempt let us see how few we can get away with (passwords can be found in a password safe somewhere or the old repo):
Expand Down
25 changes: 23 additions & 2 deletions jenkins/values-agents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,26 @@ jenkins:
resourceLimitCpu: "750m"
resourceLimitMemory: "4096Mi"

# New pre-cached agent for Vertex AI access to run embeddings from a pipeline and such
# Jenkins UI actually has a spot for service account, can we use that instead of a yaml block?
- name: "python-agent-ai"
label: "python-ai"
nodeUsageMode: "EXCLUSIVE"
containers:
- name: builder
image: "us-east1-docker.pkg.dev/teralivekubernetes/logistics/jenkins-python-ai-agent:latest"
command: "sleep"
args: "infinity"
resourceRequestCpu: "250m"
resourceRequestMemory: "2048Mi"
resourceLimitCpu: "750m"
resourceLimitMemory: "4096Mi"
yaml: |
apiVersion: v1
kind: Pod
spec:
serviceAccountName: um-vertex-ai-sa

# TODO: Rebuild atop latest inbound solely using jnlp container rather than an extra (and remove DS default container declaration)
# Android builds for Gestalt and Destination Sol
- name: "android-agent"
Expand Down Expand Up @@ -130,7 +150,8 @@ jenkins:
key: "PATH" # Note: Trying to prepend the existing var by including :$PATH broke the Jenkins agent connection process - hard coding instead
value: "/opt/jdk8u432-b06/bin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin"

# Note that "lib", "light" and "light-java" label jobs tend to be an old generation from back when the JDK was not explicitly called out - leave those on JDK 11 for now
# "lib", "light" and "light-java" are an old generation of labels from before the JDK was called out explicitly, so they deliberately overlap with the JDK 17 template below.
# Jobs are expected to ask compositely ("java11 && light"); a job requesting bare "light" may land on either JDK, which is acceptable for how rare those are.
Comment on lines +153 to +154

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- jenkins/values-agents.yaml: relevant ranges ---'
sed -n '45,85p;135,210p' jenkins/values-agents.yaml

printf '%s\n' '--- JOML.groovy ---'
sed -n '1,80p' jenkins/jobDSL/Libraries/JOML.groovy

printf '%s\n' '--- label references ---'
rg -n --glob '!node_modules' --glob '!dist' \
  'pre-cached-jdk17|light-java|java11|label|lib' \
  jenkins/jobDSL jenkins/values-agents.yaml

Repository: MovingBlocks/Logistics

Length of output: 18210

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path
import re

path = Path("jenkins/values-agents.yaml")
lines = path.read_text().splitlines()

# Print each agent block's labels and service-account-related fields without
# interpreting or executing the repository configuration.
current = None
for i, line in enumerate(lines, 1):
    m = re.match(r"\s*-\s*name:\s*(\S+)", line)
    if m:
        current = m.group(1)
    if current and any(key in line for key in ("name:", "label:", "yaml:", "serviceAccount", "automountServiceAccountToken")):
        if i <= 220:
            print(f"{i}: [{current}] {line}")
PY

Repository: MovingBlocks/Logistics

Length of output: 2909

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path
import re

text = Path("jenkins/values-agents.yaml").read_text()
agents = {}
current = None

for line in text.splitlines():
    m = re.match(r'\s*-\s*name:\s*"([^"]+)"\s*$', line)
    if m:
        current = m.group(1)
        agents[current] = []
        continue
    m = re.match(r'\s*label:\s*"([^"]+)"\s*$', line)
    if current and m:
        agents[current] = m.group(1).split()

for selector in ("lib", "light", "light-java", "java11", "java17"):
    matches = [name for name, labels in agents.items() if selector in labels]
    print(f"{selector}: {matches}")

job = Path("jenkins/jobDSL/Libraries/JOML.groovy").read_text()
labels = re.findall(r'\blabel\s+"([^"]+)"', job)
print(f"JOML labels: {labels}")
print("JOML has explicit java11 constraint:",
      any("java11" in label.split() for label in labels))
PY

Repository: MovingBlocks/Logistics

Length of output: 442

Correct the shared-label documentation.

pre-cached-jdk17 has light and light-java, but not lib. lib remains JDK 11-only. JOML.groovy requests bare light-java, so it can run on either JDK. If JOML requires JDK 11, add java11 to its label expression.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jenkins/values-agents.yaml` around lines 153 - 154, Correct the shared-label
comment near the JDK templates to state that only light and light-java overlap
with JDK 17, while lib remains JDK 11-only. Update the JOML.groovy label
expression to include java11 if JOML must run on JDK 11; otherwise preserve its
ability to run on either JDK.

- name: "pre-cached-jdk11"
label: "lib light java11 light-java"
nodeUsageMode: "EXCLUSIVE"
Expand Down Expand Up @@ -175,7 +196,7 @@ jenkins:
value: "/opt/jdk-11.0.25+9/bin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin"

- name: "pre-cached-jdk17"
label: "ts-module java17"
label: "ts-module java17 light light-java"
nodeUsageMode: "EXCLUSIVE"
containers:
- name: jnlp # Override the default Jenkins container with our extended image
Expand Down
6 changes: 3 additions & 3 deletions jenkins/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ jenkins:
tag: "2.479.2-lts"
resources:
requests:
cpu: "250m"
memory: "4Gi"
cpu: "100m"
memory: "2.5Gi"
limits:
cpu: "2000m"
cpu: "1500m"
memory: "8Gi"
JCasC:
defaultConfig: false # Disable the default JCasC configuration (don't want two Kubernetes clouds) - replacement config in values-jcasc-general.yaml
Expand Down