#14 Add username/password authentication for seed jobs

pkg/controller/jenkins/configuration/base/reconcile.go

@@ -253,9 +253,8 @@ func (r *ReconcileJenkinsBaseConfiguration) createUserConfigurationConfigMap(met
 	} else if err != nil {
 		return stackerr.WithStack(err)
 	}
-	valid := r.verifyLabelsForWatchedResource(currentConfigMap)
-	if !valid {
-		currentConfigMap.ObjectMeta.Labels = resources.BuildLabelsForWatchedResources(r.jenkins)
+	if !resources.VerifyIfLabelsAreSet(currentConfigMap, resources.BuildLabelsForWatchedResources(*r.jenkins)) {
+		currentConfigMap.ObjectMeta.Labels = resources.BuildLabelsForWatchedResources(*r.jenkins)
 		return stackerr.WithStack(r.k8sClient.Update(context.TODO(), currentConfigMap))
 	}
 
@@ -270,9 +269,8 @@ func (r *ReconcileJenkinsBaseConfiguration) createUserConfigurationSecret(meta m
 	} else if err != nil {
 		return stackerr.WithStack(err)
 	}
-	valid := r.verifyLabelsForWatchedResource(currentSecret)
-	if !valid {
-		currentSecret.ObjectMeta.Labels = resources.BuildLabelsForWatchedResources(r.jenkins)
+	if !resources.VerifyIfLabelsAreSet(currentSecret, resources.BuildLabelsForWatchedResources(*r.jenkins)) {
+		currentSecret.ObjectMeta.Labels = resources.BuildLabelsForWatchedResources(*r.jenkins)
 		return stackerr.WithStack(r.k8sClient.Update(context.TODO(), currentSecret))
 	}
 
@@ -547,14 +545,3 @@ func (r *ReconcileJenkinsBaseConfiguration) ensureBaseConfiguration(jenkinsClien
 
 	return reconcile.Result{}, nil
 }
-
-func (r *ReconcileJenkinsBaseConfiguration) verifyLabelsForWatchedResource(object metav1.Object) bool {
-	requiredLabels := resources.BuildLabelsForWatchedResources(r.jenkins)
-	for key, value := range requiredLabels {
-		if object.GetLabels()[key] != value {
-			return false
-		}
-	}
-
-	return true
-}

pkg/controller/jenkins/configuration/base/resources/base_configuration_configmap.go

@@ -155,6 +155,16 @@ if (jenkins.getView(jenkinsViewName) == null) {
 jenkins.save()
 `
 
+const disableJobDSLScriptApproval = `
+import jenkins.model.Jenkins
+import javaposse.jobdsl.plugin.GlobalJobDslSecurityConfiguration
+import jenkins.model.GlobalConfiguration
+
+// disable Job DSL script approval
+GlobalConfiguration.all().get(GlobalJobDslSecurityConfiguration.class).useScriptSecurity=false
+GlobalConfiguration.all().get(GlobalJobDslSecurityConfiguration.class).save()
+`
+
 // GetBaseConfigurationConfigMapName returns name of Kubernetes config map used to base configuration
 func GetBaseConfigurationConfigMapName(jenkins *v1alpha1.Jenkins) string {
 	return fmt.Sprintf("%s-base-configuration-%s", constants.OperatorName, jenkins.ObjectMeta.Name)
@@ -178,7 +188,8 @@ func NewBaseConfigurationConfigMap(meta metav1.ObjectMeta, jenkins *v1alpha1.Jen
 				fmt.Sprintf("http://%s.%s:%d", GetJenkinsHTTPServiceName(jenkins), jenkins.ObjectMeta.Namespace, jenkins.Spec.Service.Port),
 				fmt.Sprintf("%s.%s:%d", GetJenkinsSlavesServiceName(jenkins), jenkins.ObjectMeta.Namespace, jenkins.Spec.SlaveService.Port),
 			),
-			"7-configure-views.groovy": configureViews,
+			"7-configure-views.groovy":                 configureViews,
+			"8-disable-job-dsl-script-approval.groovy": disableJobDSLScriptApproval,
 		},
 	}
 }

pkg/controller/jenkins/configuration/base/resources/meta.go

@@ -29,7 +29,7 @@ func BuildResourceLabels(jenkins *v1alpha1.Jenkins) map[string]string {
 // BuildLabelsForWatchedResources returns labels for Kubernetes resources which operator want to watch
 // resources with that labels should not be deleted after Jenkins CR deletion, to prevent this situation don't set
 // any owner
-func BuildLabelsForWatchedResources(jenkins *v1alpha1.Jenkins) map[string]string {
+func BuildLabelsForWatchedResources(jenkins v1alpha1.Jenkins) map[string]string {
 	return map[string]string{
 		constants.LabelAppKey:       constants.LabelAppValue,
 		constants.LabelJenkinsCRKey: jenkins.Name,
@@ -41,3 +41,14 @@ func BuildLabelsForWatchedResources(jenkins *v1alpha1.Jenkins) map[string]string
 func GetResourceName(jenkins *v1alpha1.Jenkins) string {
 	return fmt.Sprintf("%s-%s", constants.LabelAppValue, jenkins.ObjectMeta.Name)
 }
+
+// VerifyIfLabelsAreSet check is selected labels are set for specific resource
+func VerifyIfLabelsAreSet(object metav1.Object, requiredLabels map[string]string) bool {
+	for key, value := range requiredLabels {
+		if object.GetLabels()[key] != value {
+			return false
+		}
+	}
+
+	return true
+}

pkg/controller/jenkins/configuration/base/resources/user_configuration_configmap.go

@@ -49,7 +49,7 @@ func NewUserConfigurationConfigMap(jenkins *v1alpha1.Jenkins) *corev1.ConfigMap
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      GetUserConfigurationConfigMapNameFromJenkins(jenkins),
 			Namespace: jenkins.ObjectMeta.Namespace,
-			Labels:    BuildLabelsForWatchedResources(jenkins),
+			Labels:    BuildLabelsForWatchedResources(*jenkins),
 		},
 		Data: map[string]string{
 			"1-configure-theme.groovy": configureTheme,

pkg/controller/jenkins/configuration/base/resources/user_configuration_secret.go

@@ -27,7 +27,7 @@ func NewUserConfigurationSecret(jenkins *v1alpha1.Jenkins) *corev1.Secret {
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      GetUserConfigurationSecretNameFromJenkins(jenkins),
 			Namespace: jenkins.ObjectMeta.Namespace,
-			Labels:    BuildLabelsForWatchedResources(jenkins),
+			Labels:    BuildLabelsForWatchedResources(*jenkins),
 		},
 	}
 }