feat(service): render systemd unit with configurable User, Group and WorkingDirectory - #174
Merged
Merged
Conversation
…WorkingDirectory Uses the agent_user and jenkins_home values added in the previous commit to render the systemd unit template. The unit now runs the launcher script as the configured user and exports JENKINS_HOME for the launcher and agent process. Defaults remain root and /var/lib/jenkins for backward compatibility.
yanksyoon
requested review from
florentianayuwono and
javierdelapuente
and removed request for
a team
July 23, 2026 16:59
* feat(launcher): honor configured JENKINS_HOME in agent script Removes the hardcoded /var/lib/jenkins path in the launcher script and uses the JENKINS_HOME environment variable. The unit already exports the configured home. The script still falls back to /var/lib/jenkins if invoked directly, preserving backward compatibility. * feat(service): ensure agent user exists and owns JENKINS_HOME (#176) * feat(service): ensure agent user exists and owns JENKINS_HOME When agent_user is non-root, the charm now creates the user if missing and ensures JENKINS_HOME is owned by that user. Failures are logged as warnings so that pre-created users/homes do not block reconcile, matching the warn-and-continue preference. * feat(service): ensure agent user exists and owns JENKINS_HOME Adds _ensure_user_and_home() to create the configured agent_user and chown jenkins_home on every reconcile. Failures are logged and continue, honoring the warn-and-continue preference. Unit tests use a fake useradd/pwd lookup and assert os.chown arguments so they pass on macOS and in CI. * feat(service): parameterize file ownership in _render_file (#177) * feat(service): parameterize file ownership in _render_file The previous implementation always chowned rendered files to root. This is correct for systemd unit files and the launcher script (systemd runs as root), but made it impossible for user-owned files to keep their owner. The helper now accepts an optional owner argument so future code paths can render files as the configured agent user while the service files remain root-owned. * ci: debug * feat: jenkins user w/ passwordless sudo * ci: debug * ci: revert debug * ci(workflow): disable tmate debugging sessions Tmate creates interactive tmux sessions that cannot be driven by automation. Rely on captured Juju and pytest logs for diagnostics instead. * test(integration): add diagnostics to traefik ingress test Capture Jenkins client URL, Juju status, model debug logs and traefik proxied endpoints when the Jenkins API connection drops during the agent job-execution assertion. This helps identify whether the failure is the server pod IP, ingress routing, or agent connectivity. * test: log Jenkins queue state before waiting * test: capture Jenkins API diagnostics on status failures * test: capture wrapped Jenkins API failures * test: use fresh client in traefik test to avoid stale pod IP * test: route traefik client via ingress with retry * fix: lint
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Make the systemd unit template honor the new
agent_userandjenkins_homeconfig options by addingUser=,Group=,WorkingDirectory=and an explicitEnvironment="JENKINS_HOME=..."directive.Rationale
Rev 18 of this charm ran the agent as the
jenkinsuser. The current charm's systemd unit has no user directive and always launches as root. This PR, building on the config added in #173, lets operators opt into the historicaljenkinsuser while keepingrootthe default for backward compatibility.Juju Events Changes
None.
Module Changes
templates/jenkins_agent.service: now a Jinja template with{{ agent_user }}and{{ jenkins_home }}.src/service.py: renders the unit with state values; also updatesis_activeand environments to use the configuredjenkins_home.tests/unit/conftest.py: updates the expectedoverride.conffixture to includeJENKINS_HOME.tests/unit/test_service.py: adds tests for default and custom user/workdir rendering.Library Changes
None.
Checklist
trivial,senior-review-required)