Allow Kind tests to mount ~/.m2/

[jglick]

I have not had success using the various profiles and connectorHost / jenkins.host.address with Kind. Running tests inside the cluster is more robust. Unfortunately it is also slow to start up, due to the need to download lots of stuff to a volume, and you cannot share local snapshots. The system in this PR (docs) seems to work much better to test e.g. #1494 using

diff --git pom.xml pom.xml
index df3627bc..0b178e0e 100644
--- pom.xml
+++ pom.xml
@@ -62,7 +62,7 @@
       <dependency>
         <groupId>io.jenkins.tools.bom</groupId>
         <artifactId>bom-${bom}</artifactId>
-        <version>${bom.version}</version>
+        <version>2675.v1515e14da_7a_6</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -134,6 +134,7 @@
     <dependency>
       <groupId>org.jenkins-ci.plugins.workflow</groupId>
       <artifactId>workflow-cps</artifactId>
+      <version>999999-SNAPSHOT</version>
       <optional>true</optional>
     </dependency>
     <dependency>
@@ -152,6 +153,7 @@
       <!-- DeclarativeAgent -->
       <groupId>org.jenkinsci.plugins</groupId>
       <artifactId>pipeline-model-extensions</artifactId>
+      <version>999999-SNAPSHOT</version>
       <optional>true</optional>
     </dependency>
     <dependency>

to check things like

diff --git plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/GroovySourceFileAllowlist.java plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/GroovySourceFileAllowlist.java
index 64c13495..987d86a9 100644
--- plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/GroovySourceFileAllowlist.java
+++ plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/GroovySourceFileAllowlist.java
@@ -138,9 +138,11 @@ public abstract class GroovySourceFileAllowlist implements ExtensionPoint {
             String urlString = url.toString();
             for (GroovySourceFileAllowlist allowlist : GroovySourceFileAllowlist.all()) {
                 if (allowlist.isAllowed(urlString)) {
+                    LOGGER.info(() -> "TODO allowing " + urlString + " based on " + allowlist);
                     return true;
                 }
             }
+            LOGGER.info(() -> "TODO denying " + urlString);
             return false;
         }

diff --git pipeline-model-extensions/src/main/java/org/jenkinsci/plugins/pipeline/modeldefinition/withscript/WithScriptDescriptor.java pipeline-model-extensions/src/main/java/org/jenkinsci/plugins/pipeline/modeldefinition/withscript/WithScriptDescriptor.java
index 4a29f937..c23b8618 100644
--- pipeline-model-extensions/src/main/java/org/jenkinsci/plugins/pipeline/modeldefinition/withscript/WithScriptDescriptor.java
+++ pipeline-model-extensions/src/main/java/org/jenkinsci/plugins/pipeline/modeldefinition/withscript/WithScriptDescriptor.java
@@ -38,6 +38,7 @@ import java.util.HashSet;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.logging.Logger;
 
 /**
  * Descriptor for {@link WithScriptDescribable}.
@@ -46,8 +47,11 @@ import java.util.Set;
  */
 public abstract class WithScriptDescriptor<T extends WithScriptDescribable<T>> extends Descriptor<T> {
 
+    private static final Logger LOGGER = Logger.getLogger(WithScriptDescriptor.class.getName());
+
     protected WithScriptDescriptor() {
         ExtensionList.lookupSingleton(WithScriptAllowlist.class).registerScript(getScriptResource());
+        LOGGER.info(() -> "TODO registering " + getScriptResource() + " from " + this);
     }
 
     /**

Holding in the draft for the moment not just because I am unsure whether this will actually work on a CI machine, but also because it would be nice to retain the ability to use test-in-k8s.sh with non-Kind clusters.

[jglick]

whether this will actually work on a CI machine

It does. But it is not any faster than trunk, because each kind-* branch runs in its own VM with no access to a cached local repo. The revised system is much faster locally on a dev machine, though you need to manually run

kubernetes-plugin/kind.sh

Lines 18 to 28 in 62116ec

	m2=$(dirname $(mvn help:evaluate -Dexpression=settings.localRepository -q -DforceStdout))
	cat >"$WORKSPACE_TMP/kind.yaml" <<EOF
	kind: Cluster
	apiVersion: kind.x-k8s.io/v1alpha4
	nodes:
	- role: control-plane
	extraMounts:
	- hostPath: $m2
	containerPath: /m2
	EOF
	kind create cluster --name $cluster --config "$WORKSPACE_TMP/kind.yaml" --wait 5m

locally to set up (plain kind create cluster will not work). That could be extracted to a helper script.

it would be nice to retain the ability to use test-in-k8s.sh with non-Kind clusters

Not sure how to address that without maintaining two copies of at least

kubernetes-plugin/test-in-k8s.yaml

Lines 6 to 32 in 62116ec

	apiVersion: v1
	kind: Pod
	metadata:
	name: jenkins
	labels:
	app: jenkins
	spec:
	serviceAccountName: jenkins
	containers:
	- name: jenkins
	image: maven:3.9.6-eclipse-temurin-17
	command:
	- sleep
	args:
	- infinity
	ports:
	- containerPort: @HTTP_PORT@
	- containerPort: @TCP_PORT@
	volumeMounts:
	- name: m2
	mountPath: /root/.m2
	volumes:
	- name: m2
	hostPath:
	path: /m2
	nodeSelector:
	kubernetes.io/os: linux

which I guess would complicate

kubernetes-plugin/.github/renovate.json

Lines 29 to 33 in 62116ec

	"kubernetes": {
	"fileMatch": [
	".*\\.ya?ml$"
	]
	}

or something. Maybe Kustomize can handle this? Or some yq hacks?

@Vlatombe WDYT—is this worth polishing up?

[Vlatombe]

Do we want to keep Microk8s? Nowadays I only use kind.

[jglick]

KubernetesPipelineTest.dynamicPVCWorkspaceVolume failure 👀

[jglick]

Could not reproduce the test failure locally even without using the new M2 mounting stuff (which CI does not now use). Can see if #1550 (comment) helps…