Jenkins Kubernetes Deployment: Build Agents That Survive Production Chaos

// io.thecodeforge — DevOps tutorial
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins-controller
  template:
    metadata:
      labels:
        app: jenkins-controller
    spec:
      containers:
      - name: jenkins
        image: jenkins/jenkins:lts-jdk11
        ports:
        - containerPort: 8080
        - containerPort: 50000  # agent listener
        env:
        - name: JENKINS_OPTS
          value: "--handlerCountMax=100"  # prevent connection overload
        - name: JENKINS_JAVA_OPTIONS
          value: "-Xmx2g -Xms2g -Djenkins.install.runSetupWizard=false"
        volumeMounts:
        - name: jenkins-home
          mountPath: /var/jenkins_home
        resources:
          requests:
            memory: "2Gi"
            cpu: "1"
          limits:
            memory: "3Gi"
            cpu: "2"
      volumes:
      - name: jenkins-home
        persistentVolumeClaim:
          claimName: jenkins-home-pvc

// io.thecodeforge — DevOps tutorial
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: jnlp
    image: jenkins/inbound-agent:4.13-1-jdk11
    args: ["$(JENKINS_SECRET)", "$(JENKINS_NAME)"]
  - name: maven
    image: maven:3.8.6-openjdk-11-slim
    command:
    - cat
    tty: true
    resources:
      requests:
        memory: "512Mi"
        cpu: "500m"
      limits:
        memory: "1Gi"
        cpu: "1"
  - name: docker
    image: docker:20.10-dind
    securityContext:
      privileged: true
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "500m"
  nodeSelector:
    ci-workload: "true"  # pin agents to dedicated nodes

// io.thecodeforge — DevOps tutorial
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-home-pvc
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: standard  # use your cluster's default
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: jenkins-home-pv
spec:
  capacity:
    storage: 10Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain  # don't delete data if PVC is removed
  hostPath:
    path: /data/jenkins-home  # for local testing; use cloud disk in production

// io.thecodeforge — DevOps tutorial
pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: jnlp
    image: jenkins/inbound-agent:4.13-1-jdk11
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "500m"
'''
        }
    }
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean package -DskipTests'
            }
        }
    }
}

// io.thecodeforge — DevOps tutorial
FROM jenkins/jenkins:lts-jdk11

# Install plugins at build time - pin versions
RUN jenkins-plugin-cli --plugins \
    kubernetes:1.31.3 \
    workflow-aggregator:2.6 \
    git:4.11.0 \
    configuration-as-code:1.55 \
    blueocean:1.25.3

# Disable setup wizard
ENV JENKINS_OPTS="--handlerCountMax=100"
ENV JENKINS_JAVA_OPTIONS="-Xmx2g -Xms2g -Djenkins.install.runSetupWizard=false"

# Copy custom config
COPY jenkins.yaml /var/jenkins_home/jenkins.yaml

// io.thecodeforge — DevOps tutorial
jenkins:
  systemMessage: "Jenkins configured by JCasC - do not edit via UI"
  numExecutors: 0  # disable built-in executor
  clouds:
  - kubernetes:
      name: "kubernetes"
      serverUrl: "https://kubernetes.default.svc.cluster.local"
      skipTlsVerify: false
      namespace: "jenkins-agents"
      jenkinsUrl: "http://jenkins-controller:8080"
      containerCap: 10  # max concurrent agents
      templates:
      - name: "default-agent"
        label: "k8s-agent"
        nodeUsageMode: NORMAL
        idleMinutes: 5  # terminate after 5 min idle
        yaml: |
          apiVersion: v1
          kind: Pod
          spec:
            containers:
            - name: jnlp
              image: jenkins/inbound-agent:4.13-1-jdk11
              resources:
                requests:
                  memory: "256Mi"
                  cpu: "250m"
                limits:
                  memory: "512Mi"
                  cpu: "500m"
credentials:
  system:
    domainCredentials:
    - credentials:
      - kubernetesServiceAccount:
          scope: GLOBAL
          id: "k8s-sa"
          description: "Service account for Kubernetes plugin"

// io.thecodeforge — DevOps tutorial
apiVersion: v1
kind: Service
metadata:
  name: jenkins-controller
spec:
  type: ClusterIP  # not LoadBalancer - use Ingress for external access
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  - name: agent
    port: 50000
    targetPort: 50000
  selector:
    app: jenkins-controller
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - jenkins.example.com
    secretName: jenkins-tls
  rules:
  - host: jenkins.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: jenkins-controller
            port:
              number: 8080

// io.thecodeforge — DevOps tutorial
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: jenkins-monitor
  labels:
    release: prometheus
spec:
  selector:
    matchLabels:
      app: jenkins-controller
  endpoints:
  - port: http
    path: /prometheus  # Prometheus plugin endpoint
    interval: 30s
  namespaceSelector:
    matchNames:
    - jenkins