add helm charts

2025-11-09 13:22:40 +03:30
parent 282c3e52d0
commit 38e4d749ad
1352 changed files with 190457 additions and 0 deletions
--- a/backing-services/jenkins/templates/NOTES.txt
+++ b/backing-services/jenkins/templates/NOTES.txt
@@ -0,0 +1,49 @@
+CHART NAME: {{ .Chart.Name }}
+CHART VERSION: {{ .Chart.Version }}
+APP VERSION: {{ .Chart.AppVersion }}
+
+** Please be patient while the chart is being deployed **
+
+{{- if .Values.ingress.enabled }}
+
+1. Get the Jenkins URL and associate its hostname to your cluster external IP:
+
+   export CLUSTER_IP=$(minikube ip) # On Minikube. Use: `kubectl cluster-info` on others K8s clusters
+   echo "Jenkins URL: http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.ingress.hostname }}"
+   echo "$CLUSTER_IP  {{ .Values.ingress.hostname }}" | sudo tee -a /etc/hosts
+
+{{- else }}
+
+1. Get the Jenkins URL by running:
+
+{{- if contains "NodePort" .Values.service.type }}
+
+  export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo "Jenkins URL: http://$NODE_IP:$NODE_PORT/"
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+** Please ensure an external IP is associated to the {{ template "common.names.fullname" . }} service before proceeding **
+** Watch the status using: kubectl get svc --namespace {{ include "common.names.namespace" . }} -w {{ template "common.names.fullname" . }} **
+
+  export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ template "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
+{{- $port:=.Values.service.ports.http | toString }}
+  echo "Jenkins URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.http }}{{ end }}/"
+
+{{- else if contains "ClusterIP"  .Values.service.type }}
+
+  echo "Jenkins URL: http://127.0.0.1:8080/"
+  kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ template "common.names.fullname" . }} 8080:{{ .Values.service.ports.http }}
+
+{{- end }}
+{{- end }}
+
+2. Login with the following credentials
+
+  echo Username: {{ .Values.jenkinsUser }}
+  echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ template "common.names.fullname" . }} -o jsonpath="{.data.jenkins-password}" | base64 -d)
+
+{{- include "jenkins.checkRollingTags" . }}
+{{- include "common.warnings.resources" (dict "sections" (list "agent" "" "tls" "volumePermissions") "context" $) }}
+{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.agent.image .Values.volumePermissions.image) "context" $) }}
--- a/backing-services/jenkins/templates/_helpers.tpl
+++ b/backing-services/jenkins/templates/_helpers.tpl
@@ -0,0 +1,150 @@
+{{/*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Return the proper Jenkins image name
+*/}}
+{{- define "jenkins.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
+{{- end -}}
+
+{{/*
+Return the proper Jenkins agent image name
+*/}}
+{{- define "jenkins.agent.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.agent.image "global" .Values.global) }}
+{{- end -}}
+
+{{/*
+Return the proper image name (for the init container volume-permissions image)
+*/}}
+{{- define "jenkins.volumePermissions.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names
+*/}}
+{{- define "jenkins.imagePullSecrets" -}}
+{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.volumePermissions.image) "context" $) -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "jenkins.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Gets the host to be used for this application.
+When using Ingress, it will be set to the Ingress hostname.
+*/}}
+{{- define "jenkins.host" -}}
+{{- if .Values.ingress.enabled }}
+{{- .Values.ingress.hostname | default "" -}}
+{{- else -}}
+{{- .Values.jenkinsHost | default "" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Gets the host to be used for this application.
+When using Ingress, it will be set to the Ingress hostname.
+*/}}
+{{- define "jenkins.configAsCodeCM" -}}
+{{- if .Values.configAsCode.existingConfigmap -}}
+{{- .Values.configAsCode.existingConfigmap -}}
+{{- else -}}
+{{- printf "%s-casc" (include "common.names.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Jenkins TLS secret name
+*/}}
+{{- define "jenkins.tlsSecretName" -}}
+{{- $secretName := .Values.tls.existingSecret -}}
+{{- if $secretName -}}
+    {{- printf "%s" (tpl $secretName $) -}}
+{{- else -}}
+    {{- printf "%s-crt" (include "common.names.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Jenkins JKS password secret name
+*/}}
+{{- define "jenkins.tlsPasswordsSecret" -}}
+{{- $secretName := .Values.tls.passwordsSecret -}}
+{{- if $secretName -}}
+    {{- printf "%s" (tpl $secretName $) -}}
+{{- else -}}
+    {{- printf "%s-tls-pass" (include "common.names.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+ We need to adapt the basic Kubernetes resource object to Jenkins agent configuration
+*/}}
+{{- define "jenkins.agent.resources" -}}
+{{ $resources := (dict "limits" (dict) "requests" (dict)) }}
+{{- if .Values.agent.resources -}}
+    {{ $resources = .Values.agent.resources -}}
+{{- else if ne .Values.agent.resourcesPreset "none" -}}
+    {{ $resources = include "common.resources.preset" (dict "type" .Values.agent.resourcesPreset) | fromYaml -}}
+{{- end -}}
+{{- if $resources.limits }}
+{{- if $resources.limits.cpu }}
+resourceLimitCpu: {{ $resources.limits.cpu }}
+{{- end }}
+{{- if $resources.limits.memory }}
+resourceLimitMemory: {{ $resources.limits.memory }}
+{{- end }}
+{{- end }}
+{{- if $resources.requests }}
+{{- if $resources.requests.cpu }}
+resourceRequestCpu: {{ $resources.requests.cpu }}
+{{- end }}
+{{- if $resources.requests.memory }}
+resourceRequestMemory: {{ $resources.requests.memory }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Check if there are rolling tags in the images
+*/}}
+{{- define "jenkins.checkRollingTags" -}}
+{{- include "common.warnings.rollingTag" .Values.image }}
+{{- end -}}
+
+{{/*
+Get the initialization scripts ConfigMap name.
+*/}}
+{{- define "jenkins.initScriptsName" -}}
+{{- if .Values.initScriptsCM -}}
+  {{- printf "%s" (tpl .Values.initScriptsCM $) -}}
+{{- else -}}
+  {{- printf "%s-init-scripts" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get the initialization hook scripts ConfigMap name.
+*/}}
+{{- define "jenkins.initHookScriptsName" -}}
+{{- if .Values.initHookScriptsCM -}}
+  {{- printf "%s" (tpl .Values.initHookScriptsCM $) -}}
+{{- else -}}
+  {{- printf "%s-init-hook-scripts" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
--- a/backing-services/jenkins/templates/agent-listener-svc.yaml
+++ b/backing-services/jenkins/templates/agent-listener-svc.yaml
@@ -0,0 +1,53 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.agent.enabled .Values.agentListenerService.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ printf "%s-agent-listener" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.agentListenerService.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.agentListenerService.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.agentListenerService.type }}
+  {{- if and .Values.agentListenerService.clusterIP (eq .Values.agentListenerService.type "ClusterIP") }}
+  clusterIP: {{ .Values.agentListenerService.clusterIP }}
+  {{- end }}
+  {{- if or (eq .Values.agentListenerService.type "LoadBalancer") (eq .Values.agentListenerService.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.agentListenerService.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.agentListenerService.type "LoadBalancer") .Values.agentListenerService.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{- toYaml .Values.agentListenerService.loadBalancerSourceRanges | nindent 4 }}
+  {{- end }}
+  {{- if (and (eq .Values.agentListenerService.type "LoadBalancer") (not (empty .Values.agentListenerService.loadBalancerIP))) }}
+  loadBalancerIP: {{ .Values.agentListenerService.loadBalancerIP }}
+  {{- end }}
+  {{- if .Values.agentListenerService.sessionAffinity }}
+  sessionAffinity: {{ .Values.agentListenerService.sessionAffinity }}
+  {{- end }}
+  {{- if .Values.agentListenerService.sessionAffinityConfig }}
+  sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.agentListenerService.sessionAffinityConfig "context" $) | nindent 4 }}
+  {{- end }}
+  ports:
+    - name: agent-listener
+      port: {{ .Values.agentListenerService.ports.agentListener }}
+      protocol: TCP
+      targetPort: agent-listener
+      {{- if (and (or (eq .Values.agentListenerService.type "NodePort") (eq .Values.agentListenerService.type "LoadBalancer")) (not (empty .Values.agentListenerService.nodePorts.agentListener))) }}
+      nodePort: {{ .Values.agentListenerService.nodePorts.agentListener }}
+      {{- else if eq .Values.agentListenerService.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- if .Values.agentListenerService.extraPorts }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.agentListenerService.extraPorts "context" $) | nindent 4 }}
+    {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: jenkins-controller
+{{- end }}
--- a/backing-services/jenkins/templates/casc-cm.yaml
+++ b/backing-services/jenkins/templates/casc-cm.yaml
@@ -0,0 +1,113 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.configAsCode.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-casc" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  config-as-code-default.yaml: |-
+    jenkins:
+      {{- if .Values.configAsCode.authorizationStrategy }}
+      authorizationStrategy: {{ include "common.tplvalues.render" ( dict "value" .Values.configAsCode.authorizationStrategy "context" $ ) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.configAsCode.securityRealm }}
+      securityRealm: {{ include "common.tplvalues.render" ( dict "value" .Values.configAsCode.securityRealm "context" $ ) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.agent.enabled }}
+      slaveAgentPort: {{ .Values.agentListenerService.ports.agentListener | int }}
+      clouds:
+        - kubernetes:
+            name: "kubernetes"
+            namespace: "{{ template "common.names.namespace" . }}"
+            serverUrl: "https://kubernetes.default"
+            jenkinsUrl: {{ printf "http://%s.%s.svc.%s:%d" (include "common.names.fullname" .) (include "common.names.namespace" .)  .Values.clusterDomain (.Values.service.ports.http | int) }}
+            jenkinsTunnel: {{ printf "%s-agent-listener.%s.svc.%s:%d" (include "common.names.fullname" .) (include "common.names.namespace" .)  .Values.clusterDomain (.Values.agentListenerService.ports.agentListener | int) }}
+            podLabels:
+              - key: "app.kubernetes.io/component"
+                value: "jenkins-agent"
+              {{- $podLabels := (include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | fromYaml) }}
+              {{- if .Values.agent.podLabels }}
+              {{- $podLabels = merge $podLabels .Values.agent.podLabels }}
+              {{- end }}
+              {{- range $key, $val := $podLabels }}
+              - key: {{ $key | quote }}
+                value: {{ $val | quote }}
+              {{- end }}
+            templates:
+              - name: {{ printf "%s-agent" (include "common.names.fullname" .) }}
+                label: {{ .Values.agent.templateLabel | quote }}
+                namespace: {{ template "common.names.namespace" . }}
+                id: "agent-template"
+                {{- if or .Values.agent.annotations }}
+                annotations:
+                  {{- range $key, $value := .Values.commonAnnotations }}
+                  - key: {{ $key }}
+                    value: {{ $value | quote }}
+                  {{- end }}
+                  {{- range $key, $value := .Values.agent.annotations }}
+                  - key: {{ $key }}
+                    value: {{ $value | quote }}
+                  {{- end }}
+                {{- end }}
+                containers:
+                  - name: jnlp
+                    alwaysPullImage: {{ ternary "true" "false" (eq .Values.image.pullPolicy "Always") }}
+                    {{- if .Values.agent.command }}
+                    command: {{- include "common.tplvalues.render" (dict "value" .Values.agent.command "context" $) | nindent 20 }}
+                    {{- end }}
+                    {{- if .Values.agent.args }}
+                    args: {{- include "common.tplvalues.render" (dict "value" .Values.agent.args "context" $) | nindent 20 }}
+                    {{- end }}
+                    {{- if .Values.agent.containerExtraEnvVars }}
+                    envVars: {{- include "common.tplvalues.render" (dict "value" .Values.agent.containerExtraEnvVars "context" $) | nindent 22 }}
+                    {{- end }}
+                    image: {{ include "jenkins.agent.image" . }}
+                    {{- if or .Values.agent.resources (ne .Values.agent.resourcesPreset "none") }}
+                    {{- include "jenkins.agent.resources" . | nindent 16 }}
+                    {{- end }}
+                    {{- if .Values.agent.containerSecurityContext.enabled }}
+                    privileged: {{ .Values.agent.containerSecurityContext.privileged }}
+                    {{- if not (or (eq .Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .))) }}
+                    runAsUser: {{ .Values.agent.containerSecurityContext.runAsUser }}
+                    runAsGroup: {{ .Values.agent.containerSecurityContext.runAsGroup }}
+                    {{- end }}
+                    {{- end }}
+                  {{- if .Values.agent.sidecars }}
+                  {{- include "common.tplvalues.render" ( dict "value" .Values.agent.sidecars "context" $) | nindent 18 }}
+                  {{- end }}
+                {{- if .Values.agent.podExtraEnvVars }}
+                envVars: {{- include "common.tplvalues.render" (dict "value" .Values.agent.podExtraEnvVars "context" $) | nindent 18 }}
+                {{- end }}
+                {{- include "jenkins.imagePullSecrets" . | nindent 16 }}
+                {{- if .Values.agent.extraAgentTemplate }}
+                {{- include "common.tplvalues.render" ( dict "value" .Values.agent.extraAgentTemplate "context" $) | nindent 16 }}
+                {{- end }}
+              {{- if .Values.agent.extraTemplates }}
+              {{- include "common.tplvalues.render" ( dict "value" .Values.agent.extraTemplates "context" $ ) | nindent 14 }}
+              {{- end }}
+            {{- if .Values.configAsCode.extraKubernetes }}
+            {{- include "common.tplvalues.render" ( dict "value" .Values.configAsCode.extraKubernetes "context" $ ) | nindent 12 }}
+            {{- end }}
+        {{- if .Values.configAsCode.extraClouds }}
+        {{- include "common.tplvalues.render" ( dict "value" .Values.configAsCode.extraClouds "context" $ ) | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      {{- if  .Values.configAsCode.extraJenkins }}
+      {{- include "common.tplvalues.render" ( dict "value" .Values.configAsCode.extraJenkins "context" $ ) | nindent 6 }}
+      {{- end }}
+    {{- if .Values.configAsCode.security }}
+    security: {{ include "common.tplvalues.render" ( dict "value" .Values.configAsCode.security "context" $ ) | nindent 6 }}
+    {{- end }}
+    {{- if  .Values.configAsCode.extraConfig }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.configAsCode.extraConfig "context" $ ) | nindent 4 }}
+    {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/controller-svc.yaml
+++ b/backing-services/jenkins/templates/controller-svc.yaml
@@ -0,0 +1,60 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.service.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
+  {{- end }}
+  {{- if (and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP))) }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  {{- if .Values.service.sessionAffinity }}
+  sessionAffinity: {{ .Values.service.sessionAffinity }}
+  {{- end }}
+  {{- if .Values.service.sessionAffinityConfig }}
+  sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ .Values.service.ports.http }}
+      protocol: TCP
+      targetPort: http
+      {{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http))) }}
+      nodePort: {{ .Values.service.nodePorts.http }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    - name: https
+      port: {{ .Values.service.ports.https }}
+      protocol: TCP
+      targetPort: https
+      {{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https))) }}
+      nodePort: {{ .Values.service.nodePorts.https }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- if .Values.service.extraPorts }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
+    {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: jenkins-controller
--- a/backing-services/jenkins/templates/deployment.yaml
+++ b/backing-services/jenkins/templates/deployment.yaml
@@ -0,0 +1,563 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+  replicas: {{ .Values.replicaCount }}
+  strategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
+  template:
+    metadata:
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
+        app.kubernetes.io/component: jenkins-controller
+      annotations:
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+        {{- if .Values.podAnnotations }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "jenkins.serviceAccountName" . }}
+      {{- include "jenkins.imagePullSecrets" . | nindent 6 }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- if .Values.hostAliases }}
+      hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.affinity }}
+      affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
+      {{- else }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "jenkins-controller" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "jenkins-controller" "customLabels" $podLabels "context" $) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
+      {{- end }}
+      {{- if .Values.nodeSelector }}
+      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.tolerations }}
+      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.schedulerName }}
+      schedulerName: {{ .Values.schedulerName }}
+      {{- end }}
+      {{- if .Values.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.podSecurityContext.enabled }}
+      securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if or (and .Values.volumePermissions.enabled .Values.persistence.enabled) (or .Values.tls.autoGenerated .Values.tls.existingSecret) .Values.initContainers }}
+      initContainers:
+        - name: copy-plugins
+          image: {{ include "jenkins.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+          command:
+          - /bin/bash
+          - -ec
+          - |-
+            #!/bin/bash
+
+            . /opt/bitnami/scripts/libfs.sh
+
+            if ! is_dir_empty /opt/bitnami/jenkins/plugins; then
+                cp -r /opt/bitnami/jenkins/plugins/* /plugins
+            fi
+          {{- if .Values.resources }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+          {{- else if ne .Values.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+          - name: empty-dir
+            mountPath: /opt/bitnami/jenkins/certs
+            subPath: app-certs-dir
+          - name: empty-dir
+            mountPath: /plugins
+            subPath: app-plugins-dir
+          - name: empty-dir
+            mountPath: /tmp
+            subPath: tmp-dir
+        {{- if or .Values.tls.autoGenerated .Values.tls.existingSecret }}
+        - name: init-certs
+          image: {{ include "jenkins.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+          command:
+          - /bin/bash
+          - -ec
+          - |-
+            if [[ -f /opt/bitnami/jenkins/certs/jenkins.jks ]]; then
+              rm /opt/bitnami/jenkins/certs/jenkins.jks
+            fi
+            {{- if or .Values.tls.autoGenerated .Values.tls.usePemCerts }}
+            if [[ -f "/certs/tls.key" ]] && [[ -f "/certs/tls.crt" ]]; then
+              openssl pkcs12 -export -in "/certs/tls.crt" \
+                  -passout pass:"${JENKINS_KEYSTORE_PASSWORD}" \
+                  -inkey "/certs/tls.key" \
+                  -out "/tmp/keystore.p12"
+              keytool -importkeystore -srckeystore "/tmp/keystore.p12" \
+                  -srcstoretype PKCS12 \
+                  -srcstorepass "${JENKINS_KEYSTORE_PASSWORD}" \
+                  -deststorepass "${JENKINS_KEYSTORE_PASSWORD}" \
+                  -destkeystore "/opt/bitnami/jenkins/certs/jenkins.jks"
+              rm "/tmp/keystore.p12"
+            else
+                echo "Couldn't find the expected PEM certificates! They are mandatory when encryption via TLS is enabled."
+                exit 1
+            fi
+            {{- else }}
+            if [[ -f "/certs/jenkins.jks" ]]; then
+                cp "/certs/jenkins.jks" "/opt/bitnami/jenkins/certs/jenkins.jks"
+            else
+                echo "Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled."
+                exit 1
+            fi
+            {{- end }}
+          env:
+            {{- if or .Values.tls.passwordsSecret .Values.tls.password .Values.tls.autoGenerated .Values.tls.usePemCerts }}
+            - name: JENKINS_KEYSTORE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "jenkins.tlsPasswordsSecret" .) }}
+                  key: keystore-password
+            {{- end }}
+          {{- if .Values.tls.resources }}
+          resources: {{- toYaml .Values.tls.resources | nindent 12 }}
+          {{- else if ne .Values.tls.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.tls.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+          - name: certs
+            mountPath: /certs
+          - name: empty-dir
+            mountPath: /opt/bitnami/jenkins/certs
+            subPath: app-certs-dir
+        {{- end }}
+        {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
+        - name: volume-permissions
+          image: {{ include "jenkins.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - /bin/bash
+          args:
+            - -ec
+            - |
+              mkdir -p /bitnami/jenkins
+              chown -R "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}" /bitnami/jenkins
+          {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }}
+          securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }}
+          {{- else }}
+          securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.volumePermissions.resources }}
+          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: jenkins-data
+              mountPath: /bitnami/jenkins
+        {{- end }}
+        {{- if .Values.initContainers }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: jenkins
+          image: {{ include "jenkins.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+          {{- if .Values.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- else if .Values.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else if .Values.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.lifecycleHooks }}
+          lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
+          {{- end }}
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: BITNAMI_DEBUG
+              value: {{ ternary "true" "false" .Values.image.debug | quote }}
+            - name: JENKINS_USERNAME
+              value: {{ .Values.jenkinsUser | quote }}
+            - name: JENKINS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "common.names.fullname" . }}
+                  key: jenkins-password
+            - name: JENKINS_HOME
+              value: {{ .Values.jenkinsHome | quote }}
+            - name: JENKINS_SKIP_BOOTSTRAP
+              value: {{ .Values.disableInitialization | quote }}
+            - name: JENKINS_HOST
+              value: {{ include "jenkins.host" . | quote }}
+            - name: JENKINS_EXTERNAL_HTTP_PORT_NUMBER
+              value: {{ .Values.service.ports.http | quote }}
+            - name: JENKINS_EXTERNAL_HTTPS_PORT_NUMBER
+              value: {{ .Values.service.ports.https | quote }}
+            {{- if or .Values.tls.autoGenerated .Values.tls.existingSecret }}
+            - name: JENKINS_CERTS_DIR
+              value: "/opt/bitnami/jenkins/certs"
+            {{- end }}
+            {{- if or .Values.tls.passwordsSecret .Values.tls.password .Values.tls.autoGenerated .Values.tls.usePemCerts }}
+            - name: JENKINS_KEYSTORE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (include "jenkins.tlsPasswordsSecret" .) }}
+                  key: keystore-password
+            {{- end }}
+            {{- $plugins := .Values.plugins }}
+            {{- if .Values.extraPlugins }}
+            {{- $plugins = append $plugins .Values.extraPlugins }}
+            {{- end }}
+            {{- if $plugins }}
+            - name: JENKINS_PLUGINS
+              value: {{ join ";"  $plugins | quote }}
+            {{- end }}
+            {{- $paths := .Values.overridePaths | default "" }}
+            {{- if or .Values.initHookScripts .Values.initHookScriptsCM .Values.initHookScriptsSecret }}
+              {{- if $paths }}
+                {{- $paths = printf "%s,init.groovy.d" $paths }}
+              {{- else }}
+                {{- $paths = "init.groovy.d" }}
+              {{- end }}
+            {{- end }}
+            {{- if $paths }}
+            - name: JENKINS_OVERRIDE_PATHS
+              value: {{ join ";"  $paths | quote }}
+            {{- end }}
+            - name: JENKINS_PLUGINS_LATEST
+              value: {{ ternary "true" "false" .Values.latestPlugins | quote }}
+            - name: JENKINS_PLUGINS_LATEST_SPECIFIED
+              value: {{ ternary "true" "false" .Values.latestSpecifiedPlugins | quote }}
+            - name: JENKINS_SKIP_IMAGE_PLUGINS
+              value: {{ ternary "true" "false" .Values.skipImagePlugins | quote }}
+            - name: JENKINS_OVERRIDE_PLUGINS
+              value: {{ ternary "true" "false" .Values.overridePlugins | quote }}
+            {{- if .Values.configAsCode.enabled }}
+            - name: CASC_JENKINS_CONFIG
+              value: "$(JENKINS_HOME)/casc_configs"
+            {{- if and .Values.configAsCode.enabled .Values.configAsCode.autoReload.enabled }}
+            - name: CASC_RELOAD_TOKEN
+              value: "$(POD_NAME)"
+            {{- end }}
+            {{- end }}
+            {{- if .Values.javaOpts }}
+            - name: JAVA_OPTS
+              value: {{ .Values.javaOpts | join " " | quote }}
+            {{- end }}
+            {{- if .Values.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }}
+          envFrom:
+            {{- if .Values.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
+            {{- end }}
+            {{- if .Values.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.containerPorts.http }}
+              protocol: TCP
+            - name: https
+              containerPort: {{ .Values.containerPorts.https }}
+              protocol: TCP
+            {{- if .Values.agent.enabled }}
+            - name: agent-listener
+              containerPort: {{ .Values.containerPorts.agentListener }}
+              protocol: TCP
+            {{- end }}
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
+            tcpSocket:
+              port: http
+          {{- end }}
+          {{- if .Values.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.livenessProbe.enabled }}
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
+            successThreshold: {{ .Values.livenessProbe.successThreshold }}
+          {{- end }}
+          {{- if .Values.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.readinessProbe.enabled }}
+          readinessProbe:
+            httpGet:
+              path: /login
+              port: http
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
+            successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          {{- end }}
+          {{- end }}
+          {{- if .Values.resources }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+          {{- else if ne .Values.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/jenkins/plugins
+              subPath: app-plugins-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/jenkins/tmp
+              subPath: app-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/jenkins/logs
+              subPath: app-logs-dir
+            - name: jenkins-data
+              mountPath: /bitnami/jenkins
+            {{- if or .Values.tls.autoGenerated .Values.tls.existingSecret }}
+            - name: empty-dir
+              mountPath: /opt/bitnami/jenkins/certs
+              subPath: app-certs-dir
+            {{- end }}
+            {{- if .Values.configAsCode.enabled }}
+            - name: config-as-code-mountpoint
+              mountPath: /usr/share/jenkins/ref/casc_configs
+            {{- end }}
+            {{- if or .Values.initScripts .Values.initScriptsCM .Values.initScriptsSecret }}
+            - name: custom-init-scripts
+              mountPath: /docker-entrypoint-initdb.d/
+            {{- end }}
+            {{- if or .Values.initHookScripts .Values.initHookScriptsCM .Values.initHookScriptsSecret }}
+            - name: jenkins-init-hook-scripts
+              mountPath: /usr/share/jenkins/ref/init.groovy.d/
+            {{- end }}
+            {{- if .Values.extraVolumeMounts }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
+            {{- end }}
+        {{- if and .Values.configAsCode.enabled .Values.configAsCode.autoReload.enabled }}
+        - name: reload-configuration-as-code
+          image: {{ include "jenkins.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
+          {{- if .Values.configAsCode.autoReload.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.configAsCode.autoReload.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.command "context" $) | nindent 12 }}
+          {{- else }}
+          command:
+            - /bin/bash
+          {{- end }}
+          {{- if .Values.configAsCode.autoReload.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.args "context" $) | nindent 12 }}
+          {{- else }}
+          args:
+            - -ec
+            - |
+              set -o errexit
+              set -o nounset
+              set -o pipefail
+
+              . /opt/bitnami/scripts/libjenkins.sh
+
+              get_configmap() {
+                local -r print_output=${1:-false}
+
+                local -r apiserver="https://kubernetes.default.svc"
+                local -r sa_dir="/var/run/secrets/kubernetes.io/serviceaccount"
+                local -r token=$(cat "${sa_dir}/token")
+                local -r ca_cert="${sa_dir}/ca.crt"
+                local -r url="${apiserver}/api/v1/namespaces/${NAMESPACE}/configmaps/${CONFIGMAP_NAME}"
+
+                local command=("curl" "-s" --cacert "${ca_cert}" "-H" "Authorization: Bearer ${token}" "-H" "Accept: application/json" "${url}")
+
+                if ! is_boolean_yes "$print_output"; then
+                  command+=("--fail" "-o" "/old_copy/cm.json")
+                fi
+                "${command[@]}"
+              }
+
+              trigger_config_reload() {
+                local -r jenkins_host="http://localhost:{{ .Values.containerPorts.http }}"
+                local -r url="${jenkins_host}/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)"
+                local command=("curl" "-s" "--fail" "-X" "POST" "${url}")
+
+                "${command[@]}"
+              }
+
+              # Variables
+              k8s_api_retries=12
+              k8s_api_sleep=5
+              jenkins_casc_reload_retries={{ .Values.configAsCode.autoReload.reqRetries | int }}
+              jenkins_casc_reload_sleep={{ .Values.configAsCode.autoReload.interval | int }}
+
+              sleep {{ .Values.configAsCode.autoReload.initialDelay | int | quote }}
+
+              while true; do
+                # Download configmap content
+                if ! retry_while 'get_configmap' "$k8s_api_retries" "$k8s_api_sleep"; then
+                  error "Failed to obtain the ConfigMap. Please check the following error message:\n $(get_configmap "true")"
+                  exit 1
+                else
+                  if [[ -d "/bitnami/jenkins/home/casc_configs" ]]; then
+                    # Remove existing config-as-code files
+                    rm  -rf /bitnami/jenkins/home/casc_configs
+                  fi
+                  # Create target directories
+                  mkdir -p /bitnami/jenkins/home/casc_configs /old_copy/casc_configs
+                  # Copy files defined in the ConfigMap
+                  for file in $(jq -rc '.data | keys[]' "/old_copy/cm.json"); do
+                    jq -r ".data.\"${file}\"" "/old_copy/cm.json" > "/bitnami/jenkins/home/casc_configs/${file}"
+                  done
+                  # Remove configmap json file
+                  rm /old_copy/cm.json
+                  # Compare running configuration and new configuration
+                  if [[ -d /old_copy/casc_configs && -d /bitnami/jenkins/home/casc_configs ]] && ! diff -q /old_copy/casc_configs /bitnami/jenkins/home/casc_configs; then
+                    if ! retry_while "trigger_config_reload" "$jenkins_casc_reload_retries" "$jenkins_casc_reload_sleep"; then
+                        error "Failed to trigger config reload."
+                    else
+                      info "Configuration successfully applied"
+                      # Copy running configuration to compare in the next iteration
+                      cp -rf /bitnami/jenkins/home/casc_configs /old_copy/
+                    fi
+                  fi
+                fi
+                sleep {{ default "60" .Values.configAsCode.autoReload.interval }}
+              done
+          {{- end }}
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: CONFIGMAP_NAME
+              value: {{ template "jenkins.configAsCodeCM" . }}
+            - name: NAMESPACE
+              value: {{ include "common.names.namespace" . | quote }}
+            {{- if .Values.configAsCode.autoReload.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          {{- if .Values.configAsCode.autoReload.resources }}
+          resources: {{- toYaml .Values.configAsCode.autoReload.resources | nindent 12 }}
+          {{- else if ne .Values.configAsCode.autoReload.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.configAsCode.autoReload.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          {{- if or .Values.configAsCode.autoReload.extraEnvVarsCM .Values.configAsCode.autoReload.extraEnvVarsSecret }}
+          envFrom:
+            {{- if .Values.configAsCode.autoReload.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.extraEnvVarsCM "context" $) }}
+            {{- end }}
+            {{- if .Values.configAsCode.autoReload.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.extraEnvVarsSecret "context" $) }}
+            {{- end }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: jenkins-data
+              mountPath: /bitnami/jenkins
+            - name: empty-dir
+              mountPath: /old_copy
+              subPath: app-casc-tmp-dir
+            {{- if .Values.configAsCode.autoReload.extraVolumeMounts }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.configAsCode.autoReload.extraVolumeMounts "context" $) | nindent 12 }}
+            {{- end }}
+        {{- end}}
+        {{- if .Values.sidecars }}
+        {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
+        {{- end }}
+      volumes:
+        - name: empty-dir
+          emptyDir: {}
+        - name: jenkins-data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ default (include "common.names.fullname" .) (tpl .Values.persistence.existingClaim $) }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- if or .Values.tls.autoGenerated .Values.tls.existingSecret }}
+        - name: certs
+          secret:
+            secretName: {{ include "jenkins.tlsSecretName" . }}
+        {{- end }}
+        {{- if .Values.configAsCode.enabled }}
+        - name: config-as-code-mountpoint
+          configMap:
+            name: {{ template "jenkins.configAsCodeCM" . }}
+        {{- end }}
+        {{- if or .Values.initScripts .Values.initScriptsCM .Values.initScriptsSecret }}
+        - name: custom-init-scripts
+          projected:
+            sources:
+              {{- if or .Values.initScripts .Values.initScriptsCM }}
+              - configMap:
+                  name: {{ template "jenkins.initScriptsName" . }}
+              {{- end }}
+              {{- if .Values.initScriptsSecret }}
+              - secret:
+                  secretName: {{ print (tpl .Values.initScriptsSecret .) }}
+                  defaultMode: 0755
+              {{- end }}
+        {{- end }}
+        {{- if or .Values.initHookScripts .Values.initHookScriptsCM .Values.initHookScriptsSecret }}
+        - name: jenkins-init-hook-scripts
+          projected:
+            sources:
+              {{- if or .Values.initHookScripts .Values.initHookScriptsCM }}
+              - configMap:
+                  name: {{ template "jenkins.initHookScriptsName" . }}
+              {{- end }}
+              {{- if .Values.initHookScriptsSecret }}
+              - secret:
+                  secretName: {{ print (tpl .Values.initHookScriptsSecret .) }}
+                  defaultMode: 0755
+              {{- end }}
+        {{- end }}
+        {{- if .Values.extraVolumes }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
+        {{- end }}
--- a/backing-services/jenkins/templates/extra-list.yaml
+++ b/backing-services/jenkins/templates/extra-list.yaml
@@ -0,0 +1,9 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- range .Values.extraDeploy }}
+---
+{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
+{{- end }}
--- a/backing-services/jenkins/templates/ingress.yaml
+++ b/backing-services/jenkins/templates/ingress.yaml
@@ -0,0 +1,59 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.ingress.enabled }}
+apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.ingress.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingress.hostname }}
+    - host: {{ .Values.ingress.hostname }}
+      http:
+        paths:
+          {{- if .Values.ingress.extraPaths }}
+          {{- toYaml .Values.ingress.extraPaths | nindent 10 }}
+          {{- end }}
+          - path: {{ .Values.ingress.path }}
+            {{- if eq "true" (include "common.ingress.supportsPathType" .) }}
+            pathType: {{ .Values.ingress.pathType }}
+            {{- end }}
+            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" "http" "context" $)  | nindent 14 }}
+    {{- end }}
+    {{- range .Values.ingress.extraHosts }}
+    - host: {{ .name | quote }}
+      http:
+        paths:
+          - path: {{ default "/" .path }}
+            {{- if eq "true" (include "common.ingress.supportsPathType" $) }}
+            pathType: {{ default "ImplementationSpecific" .pathType }}
+            {{- end }}
+            backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "http" "context" $) | nindent 14 }}
+    {{- end }}
+    {{- if .Values.ingress.extraRules }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if or .Values.ingress.tls .Values.ingress.extraTls }}
+  tls:
+    {{- if .Values.ingress.tls }}
+    - hosts:
+        - {{ .Values.ingress.hostname | quote }}
+      secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
+    {{- end }}
+    {{- if .Values.ingress.extraTls }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/init-hook-scripts-configmap.yaml
+++ b/backing-services/jenkins/templates/init-hook-scripts-configmap.yaml
@@ -0,0 +1,21 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.initHookScripts }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-init-hook-scripts" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- range $filename, $content := .Values.initHookScripts }}
+  {{ $filename }}: |
+    {{- include "common.tplvalues.render" (dict "value" $content "context" $) | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/init-script-configmap.yaml
+++ b/backing-services/jenkins/templates/init-script-configmap.yaml
@@ -0,0 +1,21 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.initScripts }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- range $filename, $content := .Values.initScripts }}
+  {{ $filename }}: |
+    {{- include "common.tplvalues.render" (dict "value" $content "context" $) | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/networkpolicy.yaml
+++ b/backing-services/jenkins/templates/networkpolicy.yaml
@@ -0,0 +1,85 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.networkPolicy.enabled }}
+kind: NetworkPolicy
+apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: jenkins-controller
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  podSelector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: jenkins-controller
+  policyTypes:
+    - Ingress
+    - Egress
+  {{- if .Values.networkPolicy.allowExternalEgress }}
+  egress:
+    - {}
+  {{- else }}
+  egress: 
+    - ports:
+        # Allow dns resolution
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+        # Allow http and https for plugin download
+        - port: 80
+        - port: 443
+        {{- range $port := .Values.networkPolicy.kubeAPIServerPorts }}
+        - port: {{ $port }}
+        {{- end }}
+    - ports:
+        # Allow traffic to Kubernetes agents
+        - port: {{ .Values.agentListenerService.ports.agentListener }}
+      to:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+              app.kubernetes.io/component: jenkins-agent
+    {{- if .Values.networkPolicy.extraEgress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  ingress:
+    - ports:
+        - port: {{ .Values.containerPorts.http }}
+        - port: {{ .Values.containerPorts.https }}
+        {{- if .Values.agent.enabled }}
+        - port: {{ .Values.containerPorts.agentListener }}
+        {{- end }}
+      {{- if not .Values.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+        - podSelector:
+            matchLabels:
+              {{ template "common.names.fullname" . }}-client: "true"
+        {{- if .Values.networkPolicy.ingressNSMatchLabels }}
+        - namespaceSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
+          podSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- if .Values.networkPolicy.extraIngress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
+    {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/pdb.yaml
+++ b/backing-services/jenkins/templates/pdb.yaml
@@ -0,0 +1,26 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.pdb.create }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.pdb.minAvailable }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- end  }}
+  {{- if or .Values.pdb.maxUnavailable ( not .Values.pdb.minAvailable ) }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
+  {{- end  }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+{{- end }}
--- a/backing-services/jenkins/templates/pvc.yaml
+++ b/backing-services/jenkins/templates/pvc.yaml
@@ -0,0 +1,31 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  annotations:
+    volume.alpha.kubernetes.io/storage-class: {{ ternary "default" (trimPrefix "storageClassName: " (include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global))) (empty (include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global))) }}
+    {{- if or .Values.persistence.annotations .Values.commonAnnotations }}
+    {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.annotations .Values.commonAnnotations ) "context" . ) }}
+    {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+    {{- end }}
+spec:
+  accessModes:
+  {{- range .Values.persistence.accessModes }}
+    - {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+  {{- if .Values.persistence.selector }}
+  selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 4 }}
+  {{- end }}
+  {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 2 }}
+{{- end }}
--- a/backing-services/jenkins/templates/role.yaml
+++ b/backing-services/jenkins/templates/role.yaml
@@ -0,0 +1,56 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.rbac.create (or .Values.agent.enabled .Values.configAsCode.enabled .Values.rbac.rules) }}
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+kind: Role
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+rules:
+  {{- if .Values.agent.enabled }}
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "pods/exec"
+      - "pods/log"
+      - "persistentvolumeclaims"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "pods/exec"
+      - "persistentvolumeclaims"
+    verbs:
+      - "create"
+      - "delete"
+      - "deletecollection"
+      - "patch"
+      - "update"
+  {{- end }}
+  {{- if .Values.configAsCode.enabled }}
+  - apiGroups:
+      - ""
+    resources:
+      - "configmaps"
+    verbs:
+      - "get"
+      - "watch"
+      - "list"
+  {{- end }}
+  {{- if .Values.rbac.rules }}
+  {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/jenkins/templates/rolebinding.yaml
+++ b/backing-services/jenkins/templates/rolebinding.yaml
@@ -0,0 +1,24 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.rbac.create }}
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+kind: RoleBinding
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "common.names.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "jenkins.serviceAccountName" . }}
+    namespace: {{ include "common.names.namespace" . | quote }}
+{{- end }}
--- a/backing-services/jenkins/templates/secrets.yaml
+++ b/backing-services/jenkins/templates/secrets.yaml
@@ -0,0 +1,35 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  jenkins-password: {{ include "common.secrets.passwords.manage" (dict "secret" ( include "common.names.fullname" .) "key" "jenkins-password" "providedValues" (list "jenkinsPassword") "context" $) }}
+{{- if and (or .Values.tls.autoGenerated .Values.tls.existingSecret) (not .Values.tls.passwordsSecret) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-tls-pass" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  {{- if .Values.tls.existingSecret }}
+  {{- $pass := required "Is 'tls.existingSecret' is provided, providing a JKS password is mandatory" .Values.tls.password }}
+  {{- end }}
+  keystore-password: {{ include "common.secrets.passwords.manage" (dict "secret" ( printf "%s-tls-pass" (include "common.names.fullname" .)) "key" "keystore-password" "providedValues" (list "tls.password") "context" $) }}
+{{- end }}
--- a/backing-services/jenkins/templates/serviceaccount.yaml
+++ b/backing-services/jenkins/templates/serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jenkins.serviceAccountName" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}
--- a/backing-services/jenkins/templates/tls-secret.yaml
+++ b/backing-services/jenkins/templates/tls-secret.yaml
@@ -0,0 +1,69 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.ingress.enabled }}
+{{- if .Values.ingress.secrets }}
+{{- range .Values.ingress.secrets }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .name }}
+  namespace: {{ include "common.names.namespace" $ | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if $.Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ .certificate | b64enc }}
+  tls.key: {{ .key | b64enc }}
+---
+{{- end }}
+{{- end }}
+{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
+{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
+{{- $ca := genCA "jenkins-ca" 365 }}
+{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
+  tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
+  ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
+---
+{{- end }}
+{{- end }}
+{{- if and .Values.tls.autoGenerated (not .Values.tls.existingSecret) }}
+{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
+{{- $fullname := include "common.names.fullname" . }}
+{{- $releaseNamespace := include "common.names.namespace" . }}
+{{- $clusterDomain := .Values.clusterDomain }}
+{{- $serviceName := include "common.names.fullname" . }}
+{{- $altNames := list (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $serviceName $fullname "localhost" "127.0.0.1" }}
+{{- $ca := genCA "jenkins-https-ca" 365 }}
+{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
+  tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
+  ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
+{{- end }}