Setup a job/set of jobs to allow performing maintenance operations (cron, GCs of resources, etc.)

[dduportal]

We have many use cases (see sub-tasks) which require to run a job regularly as a cron or even manually to perform recurring tasks such as cleaning up resources, updating things, etc.

Cron jobs on Unix machines or Kubernetes CronJob have been used because they are easy to set up.
However they are hard to monitor or to execute manually with a human operator with only partial accesses.

Let's create a setup like this one but in infra.ci.jenkins.io to ensure we can have all the required permissions and credentials.

[dduportal]

• We need a pipeline per "cron project", without PR/tags to avoid conflict to the access on shared resources when running GC.
• For each "cron project", we need distinct credentials: the pattern of https://github.com/jenkins-infra/acceptance-tests/ with one branch per "project" can't be used with a single corresponding Multibranch pipeline (we can't segregate credentials per automatic branch of MB jobs). It leaves use with the following possible Jenkins Jobs implementations (each one contained in a Jenkins Folder):
  • One simple pipeline job per branch (single repository)
  • One simple pipeline job per repository (many repository, only a main branch for each)
  • One Multibranch pipeline job per (repository+branch) (single or many repositories)
• Since our "jenkins-jobs" helm chart does not support simple pipeline jobs (only multibranch pipeline jobs) today (version 3.0.0), let's select the MB job solution
  • There is only one missing feature: disabling Pull Requests. But this feature is needed on other existing jobs, so one stone / two brids. Besides, the effort to implement simple pipeline jobs is way higher (possible and not complicated, but not worth it here).

Implementation proposal:

• One single repository with the proposed name infra-cronjobs
• One branch per "project"
• A Jenkins Folder with one Multibranch per "project" (same repo, different branches) with:
  • No tags, no PR, only basic github check to ensure we get a feedback outside infra.ci for now, and distinct credentials