v0.9.x on Jenkins Operator

Installing the Operator

Sat, 31 Oct 2026 00:00:00 +0000

This guide installs Jenkins Operator 0.9.0. Official images are published on Quay: operator and backup-pvc. Both release images support Linux AMD64 and ARM64.

Requirements

A Kubernetes cluster and permission to create the operator’s CRD and RBAC resources.
kubectl configured for that cluster, using a version compatible with its API server.
Helm 3 if installing the chart.

See the release notes and release CI when evaluating your cluster version.

Install using Helm

Add the chart repository and install chart version 0.9.0:

Deploying Jenkins

Sat, 31 Oct 2026 00:00:00 +0000

This document describes the procedure for deploying Jenkins.

Prerequisites

The Operator needs to have been deployed beforehand. The procedure for deploying Jenkins described here doesn’t apply to installation of Operator via Helm chart unless jenkins.enabled was set to false. That’s because by default, installation via Helm chart also covers deploying Jenkins.

Deploying Jenkins instance

Once Jenkins Operator is up and running let’s deploy actual Jenkins instance. Create manifest e.g. jenkins_instance.yaml with following data and save it on drive.

Customizing Jenkins

Wed, 08 Dec 2021 00:00:00 +0000

How to customize Jenkins

Jenkins can be customized with plugins. Plugin’s configuration is applied as groovy scripts or the configuration as code plugin. Any plugin working for Jenkins can be installed by the Jenkins Operator.

Pre-installed plugins:

configuration-as-code v1.55
git v4.10.0
job-dsl v1.78.1
kubernetes-credentials-provider v0.20
kubernetes v1.30.11
workflow-aggregator v2.6
workflow-job v2.42

Rest of the plugins can be found in plugins repository.

Install plugins

Edit Custom Resource under spec.master.plugins:

apiVersion: jenkins.io/v1alpha2
kind: Jenkins
metadata:
 name: example
spec:
 master:
 plugins:
 - name: simple-theme-plugin
 version: "0.7"

Under spec.master.basePlugins you can find plugins for a valid Jenkins Operator:

Configuring Seed Jobs and Pipelines

Wed, 08 Dec 2021 00:00:00 +0000

Configure Seed Jobs and Pipelines

Jenkins operator uses job-dsl and kubernetes-credentials-provider plugins for configuring jobs and deploy keys.

Prepare job definitions and pipelines

First you have to prepare pipelines and job definition in your GitHub repository using the following structure:

cicd/
├── jobs
│   └── k8s.jenkins
└── pipelines
 └── k8s.jenkins

cicd/jobs/k8s.jenkins is a job definition:

#!/usr/bin/env groovy

pipelineJob('k8s-e2e') {
 displayName('Kubernetes Plugin E2E Test')

 logRotator {
 numToKeep(10)
 daysToKeep(30)
 }

 configure { project ->
 project / 'properties' / 'org.jenkinsci.plugins.workflow.job.properties.DurabilityHintJobProperty' {
 hint('PERFORMANCE_OPTIMIZED')
 }
 }

 definition {
 cpsScm {
 scm {
 git {
 remote {
 url('https://github.com/jenkinsci/kubernetes-operator.git')
 credentials('jenkins-operator')
 }
 branches('*/master')
 }
 }
 scriptPath('cicd/pipelines/k8s.jenkins')
 }
 }
}

cicd/pipelines/k8s.jenkins is an actual Jenkins pipeline:

Configuring backup and restore

Sat, 31 Oct 2026 00:00:00 +0000

Because of Jenkins Operator’s architecture, the configuration of Jenkins should be done using ConfigurationAsCode or GroovyScripts and jobs should be defined as SeedJobs. It means that there is no point in backing up any job configuration up. Therefore, the backup script makes a copy of jobs history only.

Backup and restore is done by a container sidecar. Chart 0.9.0 uses quay.io/jenkins-kubernetes-operator/backup-pvc:v0.5.1, based on Debian Trixie and published for Linux AMD64 and ARM64. The backup image has its own version, independent of the operator and Jenkins images.

Separate namespaces for Jenkins and Operator

Sat, 31 Oct 2026 00:00:00 +0000

Create namespaces

You need to create two namespaces, for example we’ll call them jenkins for Jenkins and jenkins-operator for Jenkins Operator.

$ kubectl create ns jenkins-operator
$ kubectl create ns jenkins

Create necessary resources in Jenkins Operator namespace

Next, you need to install resources necessary for the Operator to work in the jenkins-operator namespace. To do that, copy the manifest you see below to jenkins-operator-rbac.yamlfile.

---
apiVersion: v1
kind: ServiceAccount
metadata:
 name: jenkins-operator
---
# permissions to do leader election.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
 name: leader-election-role
rules:
- apiGroups:
 - ""
 - coordination.k8s.io
 resources:
 - configmaps
 - leases
 verbs:
 - get
 - list
 - watch
 - create
 - update
 - patch
 - delete
- apiGroups:
 - ""
 resources:
 - events
 verbs:
 - create
 - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
 name: leader-election-rolebinding
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: Role
 name: leader-election-role
subjects:
- kind: ServiceAccount
 name: jenkins-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
 name: jenkins-operator
rules:
- apiGroups:
 - apps
 resources:
 - daemonsets
 - deployments
 - replicasets
 - statefulsets
 verbs:
 - '*'
- apiGroups:
 - apps
 - jenkins-operator
 resources:
 - deployments/finalizers
 verbs:
 - update
- apiGroups:
 - build.openshift.io
 resources:
 - buildconfigs
 - builds
 verbs:
 - get
 - list
 - watch
- apiGroups:
 - ""
 resources:
 - configmaps
 - secrets
 - services
 verbs:
 - create
 - get
 - list
 - update
 - watch
- apiGroups:
 - ""
 resources:
 - events
 verbs:
 - create
 - get
 - list
 - patch
 - watch
- apiGroups:
 - ""
 resources:
 - persistentvolumeclaims
 verbs:
 - get
 - list
 - watch
- apiGroups:
 - ""
 resources:
 - pods
 verbs:
 - create
 - delete
 - get
 - list
 - patch
 - update
 - watch
- apiGroups:
 - ""
 resources:
 - pods
 - pods/exec
 verbs:
 - '*'
- apiGroups:
 - ""
 resources:
 - pods/log
 verbs:
 - get
 - list
 - watch
- apiGroups:
 - ""
 resources:
 - pods/portforward
 verbs:
 - create
- apiGroups:
 - ""
 resources:
 - serviceaccounts
 verbs:
 - create
 - get
 - list
 - update
 - watch
- apiGroups:
 - image.openshift.io
 resources:
 - imagestreams
 verbs:
 - get
 - list
 - watch
- apiGroups:
 - jenkins.io
 resources:
 - '*'
 verbs:
 - '*'
- apiGroups:
 - jenkins.io
 resources:
 - jenkins
 verbs:
 - create
 - delete
 - get
 - list
 - patch
 - update
 - watch
- apiGroups:
 - jenkins.io
 resources:
 - jenkins/finalizers
 verbs:
 - update
- apiGroups:
 - jenkins.io
 resources:
 - jenkins/status
 verbs:
 - get
 - patch
 - update
- apiGroups:
 - rbac.authorization.k8s.io
 resources:
 - rolebindings
 - roles
 verbs:
 - create
 - get
 - list
 - update
 - watch
- apiGroups:
 - route.openshift.io
 resources:
 - routes
 verbs:
 - create
 - get
 - list
 - update
 - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
 name: jenkins-operator
subjects:
 - kind: ServiceAccount
 name: jenkins-operator
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: Role
 name: jenkins-operator

Now install the required resources in jenkins-operator namespace with:

Custom backup and restore providers

Wed, 08 Dec 2021 00:00:00 +0000

With enough effort one can create a custom backup and restore provider for the Jenkins Operator.

Requirements

Two commands (e.g. scripts) are required:

a backup command, e.g. backup.sh that takes one argument, a backup number
a restore command, e.g. restore.sh that takes one argument, a backup number

Both scripts need to return an exit code of 0 on success and 1 or greater for failure.

One of those scripts (or the entry point of the container) needs to be responsible for backup cleanup or rotation if required, or an external system.

AKS

Wed, 08 Dec 2021 00:00:00 +0000

Azure AKS managed Kubernetes service adds to every pod the following environment variables:

- name: KUBERNETES_PORT_443_TCP_ADDR
 value:
- name: KUBERNETES_PORT
 value: tcp://
- name: KUBERNETES_PORT_443_TCP
 value: tcp://
- name: KUBERNETES_SERVICE_HOST
 value:

The operator is aware of it and omits these environment variables when checking if a Jenkins pod environment has been changed. It prevents the restart of a Jenkins pod over and over again.

LDAP

Wed, 08 Dec 2021 00:00:00 +0000

Configuring LDAP is not supported out of the box, but can be achieved through plugins and some well tuned configurations.

The plugin we will use is: https://plugins.jenkins.io/ldap/

Note: This is an example of how LDAP authentication can be achieved. The LDAP plugin is from a third-party, and there may be other alternatives that suits your use case better. Use this guide with a grain of salt.

Requirements

LDAP server accessible from the Kubernetes cluster where your Jenkins instance will live.
Credentials to a manager account in your AD. Jenkins Operator will use this account to authenticate with Jenkins for health checks, seed jobs, etc.

OpenShift

Mon, 02 Nov 2026 00:00:00 +0000

Jenkins image compatibility

Chart 0.9.0 uses the official jenkins/jenkins:2.580.1-lts image. Compatibility with the Red Hat-provided Jenkins image has not been verified for this release. The earlier report in issue #826 concerns an older operator version; it does not establish the compatibility of 0.9.0.

The PVC backup image supports execution with arbitrary user IDs, but that alone does not verify the complete deployment against OpenShift security constraints. Test the chosen Jenkins image and security context on your OpenShift cluster before upgrading. Please include the operator version, image tags, OpenShift version, and relevant logs when reporting a problem.

Schema

Sat, 31 Oct 2026 00:00:00 +0000

This document describes the jenkins.io/v1alpha2 API used by Jenkins Operator 0.9.0. The release CRD is the authoritative schema for validation and supported fields.

Packages:

jenkins.io

jenkins.io

Package v1alpha2 contains API Schema definitions for the jenkins.io v1alpha2 API group

Resource Types:

Jenkins

Jenkins

Jenkins is the Schema for the jenkins API

Field Description

apiVersion
string jenkins.io/v1alpha2

kind
string Jenkins

metadata
Kubernetes meta/v1.ObjectMeta Refer to the Kubernetes API documentation for the fields of the metadata field.

spec
JenkinsSpec

Spec defines the desired state of the Jenkins

`master` JenkinsMaster	Master represents Jenkins master pod properties and Jenkins plugins. Every single change here requires a pod restart.
`seedJobs` [][]github.com/jenkinsci/kubernetes-operator/api/v1alpha2.SeedJob	(Optional) SeedJobs defines list of Jenkins Seed Job configurations More info: https://jenkinsci.github.io/kubernetes-operator/docs/getting-started/v0.9.x/configuring-seed-jobs-and-pipelines/
`validateSecurityWarnings` bool	(Optional) ValidateSecurityWarnings enables or disables validating potential security warnings in Jenkins plugins via admission webhooks.
`notifications` [][]github.com/jenkinsci/kubernetes-operator/api/v1alpha2.Notification	(Optional) Notifications defines list of a services which are used to inform about Jenkins status Can be used to integrate chat services like Slack, Microsoft Teams or Mailgun
`service` Service	(Optional) Service is Kubernetes service of Jenkins master HTTP pod Defaults to : port: 8080 type: ClusterIP
`slaveService` Service	(Optional) Service is Kubernetes service of Jenkins slave pods Defaults to : port: 50000 type: ClusterIP
`backup` Backup	(Optional) Backup defines configuration of Jenkins backup More info: https://jenkinsci.github.io/kubernetes-operator/docs/getting-started/v0.9.x/configure-backup-and-restore/
`restore` Restore	(Optional) Backup defines configuration of Jenkins backup restore More info: https://jenkinsci.github.io/kubernetes-operator/docs/getting-started/v0.9.x/configure-backup-and-restore/
`groovyScripts` GroovyScripts	(Optional) GroovyScripts defines configuration of Jenkins customization via groovy scripts
`configurationAsCode` ConfigurationAsCode	(Optional) ConfigurationAsCode defines configuration of Jenkins customization via Configuration as Code Jenkins plugin
`roles` []Kubernetes rbac/v1.RoleRef	(Optional) Roles defines list of extra RBAC roles for the Jenkins Master pod service account
`serviceAccount` ServiceAccount	(Optional) ServiceAccount defines Jenkins master service account attributes
`jenkinsAPISettings` JenkinsAPISettings	JenkinsAPISettings defines configuration used by the operator to gain admin access to the Jenkins API