Service Jenkins - thekaveh/atlas GitHub Wiki

5.2.21. Jenkins (Maven Spark app builder)

Jenkins is an optional apps service for building Maven-based Spark applications and publishing their JAR artifacts to the Atlas MinIO jars bucket.

1. Overview

Image: jenkins/jenkins:lts-jdk21 (MIT), digest-pinned and extended by services/jenkins/build/Dockerfile with Maven, the MinIO mc client and a small plugin baseline. mc is RELEASE.2026-09-16T00-00-00Z from the maintained pgsty/mc fork (AGPL-3.0). It is copied from the same digest-pinned image that minio-init runs.

Atlas provides the Jenkins server, JCasC, Maven, and MinIO publishing seam. Downstream projects provide repositories, Jenkinsfiles, seed jobs, credentials, and project-specific job definitions.

2. Access

Surface URL Auth
Direct http://localhost:${JENKINS_PORT} ${JENKINS_ADMIN_USER} / ${JENKINS_ADMIN_PASSWORD}
Kong http://jenkins.localhost:${KONG_HTTP_PORT} Same Jenkins login

JENKINS_ADMIN_PASSWORD is auto-generated on first bootstrap and persisted to .env.

The direct port binds through HOST_BIND_IP (default 127.0.0.1:, loopback only). The Kong route adds no separate auth layer, so the Jenkins login is the only protection. Use Jenkins only on a local host or a trusted VPN; do not expose it to the public internet.

3. Configuration

JENKINS_SOURCE=disabled            # container | disabled
JENKINS_IMAGE=jenkins/jenkins:lts-jdk21@sha256:c1e4c349365f6d16d88595b2c5f7e8ff39b8ae1d061f62420bac193b4b9616d0
JENKINS_PORT=                      # auto-assigned in the apps band
JENKINS_ADMIN_USER=admin
JENKINS_ADMIN_PASSWORD=            # auto-generated
JENKINS_MEMORY_LIMIT=3g            # controller + Maven builds
JENKINS_CPU_LIMIT=2.0

JCasC is loaded from services/jenkins/casc/jenkins.yaml via CASC_JENKINS_CONFIG. The bundled config disables signup and creates the admin user. The image build writes jenkins.install.UpgradeWizard.state, so Jenkins skips the first-run setup wizard. The config gives the controller two executors; Atlas ships no build agents, so builds run on the controller inside the memory and CPU limits above.

JENKINS_HOME persists in the ${PROJECT_NAME}-jenkins-home volume. ./stop.sh --cold removes it with all jobs and build history.

4. Artifact Publishing

Jenkins receives MinIO endpoint and scoped Iceberg/lakehouse credentials from the Atlas environment. The canonical artifact path is:

s3a://jars/<app>/<version>/app.jar

A downstream pipeline can publish with mc:

sh 'mvn -q package'
sh 'mc alias set atlas "$MINIO_ENDPOINT" "$MINIO_ICEBERG_ACCESS_KEY" "$MINIO_ICEBERG_SECRET_KEY"'
sh 'mc cp target/*.jar "atlas/${MINIO_BUCKET_ICEBERG_JARS}/<app>/<version>/app.jar"'

Atlas does not ship downstream project job definitions. Mount or seed project jobs from the downstream repository.

5. Architecture & wiring

Jenkins calls MinIO to publish built artifacts. Airflow, Spark, notebooks, and downstream labs consume those artifacts later via s3a://jars/...; Jenkins does not need direct startup dependencies on those consumers.

6. Capabilities & limitations

Support tier: experimental — Capability contract declared; no cited cold-start, workflow, or upgrade qualification run yet (evidence at v0.1.0).

Capability Status Verification Notes
Maven Spark application builds partial tested Atlas builds a Jenkins controller with Maven and a pinned MinIO client, but downstream repositories, Jenkinsfiles, credentials, and all project jobs remain operator-supplied.
Scoped MinIO artifact publishing supported tested The controller receives the dedicated Iceberg jar-bucket credentials and supports publishing versioned artifacts for later Spark or Airflow consumption.
Jenkins UI authentication supported tested JCasC disables signup and creates the generated admin login. Direct and Kong paths rely on that Jenkins login, because the Kong route adds no separate auth layer.
Controller state persistence partial tested JENKINS_HOME persists in one named volume, but Atlas configures one controller without backup, restore, external database, or replicated control-plane state.
Distributed and containerized build agents not-supported tested Atlas ships no agents, seed jobs, Docker socket, or privileged build executor; builds run on the bounded controller unless operators add their own Jenkins infrastructure.

7. Troubleshooting

  • Login rejected — check JENKINS_ADMIN_USER and JENKINS_ADMIN_PASSWORD in .env. After a change, rerun ./start.sh: the container must be recreated to receive the new values, and JCasC applies them at startup. A plain docker restart keeps the old values.
  • Artifact upload fails — verify MinIO is enabled, minio-init completed, and MINIO_ICEBERG_ACCESS_KEY / MINIO_ICEBERG_SECRET_KEY are populated.

8. Dependencies & Integrations

8.1. Current — Upstream (this service calls)

Service Category Status
minio data optional: an operator-authored Jenkins job; none ships with Atlas

8.2. Current — Downstream (services that call this)

Service Category
kong infra

8.3. Architecture diagram

jenkins architecture

Open the full-size diagram for a full-screen view.

8.4. Future — Missing pair integrations

No high-confidence opportunities identified.

8.5. Future — Candidate new services

No high-confidence opportunities identified.

8.6. Future — Unused features in this service

No high-confidence opportunities identified.

Atlas documentation.

⚠️ **GitHub.com Fallback** ⚠️