5.2.21. Jenkins (Maven Spark app builder)¶

Jenkins is an optional apps service for building Maven-based Spark applications and publishing their JAR artifacts to the Atlas MinIO jars bucket.

1. Overview¶

Image: jenkins/jenkins:lts-jdk21 (MIT), digest-pinned and extended by services/jenkins/build/Dockerfile with Maven, the MinIO mc client and a small plugin baseline. mc is RELEASE.2026-09-16T00-00-00Z from the maintained pgsty/mc fork (AGPL-3.0). It is copied from the same digest-pinned image that minio-init runs.

Atlas provides the Jenkins server, JCasC, Maven, and MinIO publishing seam. Downstream projects provide repositories, Jenkinsfiles, seed jobs, credentials, and project-specific job definitions.

2. Access¶

Surface	URL	Auth
Direct	`http://localhost:${JENKINS_PORT}`	`${JENKINS_ADMIN_USER}` / `${JENKINS_ADMIN_PASSWORD}`
Kong	`http://jenkins.localhost:${KONG_HTTP_PORT}`	Same Jenkins login

JENKINS_ADMIN_PASSWORD is auto-generated on first bootstrap and persisted to .env.

The direct port binds through HOST_BIND_IP (default 127.0.0.1:, loopback only). The Kong route adds no separate auth layer, so the Jenkins login is the only protection. Use Jenkins only on a local host or a trusted VPN; do not expose it to the public internet.

3. Configuration¶

JENKINS_SOURCE=disabled            # container | disabled
JENKINS_IMAGE=jenkins/jenkins:lts-jdk21@sha256:c1e4c349365f6d16d88595b2c5f7e8ff39b8ae1d061f62420bac193b4b9616d0
JENKINS_PORT=                      # auto-assigned in the apps band
JENKINS_ADMIN_USER=admin
JENKINS_ADMIN_PASSWORD=            # auto-generated
JENKINS_MEMORY_LIMIT=3g            # controller + Maven builds
JENKINS_CPU_LIMIT=2.0

JCasC is loaded from services/jenkins/casc/jenkins.yaml via CASC_JENKINS_CONFIG. The bundled config disables signup and creates the admin user. The image build writes jenkins.install.UpgradeWizard.state, so Jenkins skips the first-run setup wizard. The config gives the controller two executors; Atlas ships no build agents, so builds run on the controller inside the memory and CPU limits above.

JENKINS_HOME persists in the ${PROJECT_NAME}-jenkins-home volume. ./stop.sh --cold removes it with all jobs and build history.

4. Artifact Publishing¶

Jenkins receives MinIO endpoint and scoped Iceberg/lakehouse credentials from the Atlas environment. The canonical artifact path is:

s3a://jars/<app>/<version>/app.jar

A downstream pipeline can publish with mc:

sh 'mvn -q package'
sh 'mc alias set atlas "$MINIO_ENDPOINT" "$MINIO_ICEBERG_ACCESS_KEY" "$MINIO_ICEBERG_SECRET_KEY"'
sh 'mc cp target/*.jar "atlas/${MINIO_BUCKET_ICEBERG_JARS}/<app>/<version>/app.jar"'

Atlas does not ship downstream project job definitions. Mount or seed project jobs from the downstream repository.

5. Architecture & wiring¶

Jenkins calls MinIO to publish built artifacts. Airflow, Spark, notebooks, and downstream labs consume those artifacts later via s3a://jars/...; Jenkins does not need direct startup dependencies on those consumers.

6. Dependencies & Integrations¶

6.1. Current — Upstream (this service calls)¶

Service	Category	Status
minio	data	optional: an operator-authored Jenkins job; none ships with Atlas

6.2. Current — Downstream (services that call this)¶

Service	Category
kong	infra

6.3. Architecture diagram¶

jenkins architecture

Open the full-size diagram for a full-screen view.

6.4. Future — Missing pair integrations¶

No high-confidence opportunities identified.

6.5. Future — Candidate new services¶

No high-confidence opportunities identified.

6.6. Future — Unused features in this service¶

No high-confidence opportunities identified.

7. Troubleshooting¶

Login rejected — check JENKINS_ADMIN_USER and JENKINS_ADMIN_PASSWORD in .env. After a change, rerun ./start.sh: the container must be recreated to receive the new values, and JCasC applies them at startup. A plain docker restart keeps the old values.
Artifact upload fails — verify MinIO is enabled, minio-init completed, and MINIO_ICEBERG_ACCESS_KEY / MINIO_ICEBERG_SECRET_KEY are populated.

8. Capabilities & limitations¶

Support tier: experimental — Capability contract declared; no cited cold-start, workflow, or upgrade qualification run yet (evidence at v0.1.0).

Capability	Status	Verification	Notes
Maven Spark application builds	partial	tested	Atlas builds a Jenkins controller with Maven and a pinned MinIO client, but downstream repositories, Jenkinsfiles, credentials, and all project jobs remain operator-supplied.
Scoped MinIO artifact publishing	supported	tested	The controller receives the dedicated Iceberg jar-bucket credentials and supports publishing versioned artifacts for later Spark or Airflow consumption.
Jenkins UI authentication	supported	tested	JCasC disables signup and creates the generated admin login. Direct and Kong paths rely on that Jenkins login, because the Kong route adds no separate auth layer.
Controller state persistence	partial	tested	JENKINS_HOME persists in one named volume, but Atlas configures one controller without backup, restore, external database, or replicated control-plane state.
Distributed and containerized build agents	not-supported	tested	Atlas ships no agents, seed jobs, Docker socket, or privileged build executor; builds run on the bounded controller unless operators add their own Jenkins infrastructure.