clusters/atlas/flux-system/applications/jenkins/kustomization.yaml

@@ -16,6 +16,7 @@ spec:
     name: flux-system
   targetNamespace: jenkins
   dependsOn:
+    - name: core
     - name: helm
     - name: harbor
     - name: vault-hermes-jenkins-token-seed

infrastructure/modules/base/priorityclass/jenkins.yaml

@@ -0,0 +1,17 @@
+# infrastructure/modules/base/priorityclass/jenkins.yaml
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-core
+value: 500
+globalDefault: false
+description: "For the Jenkins controller; must outrank the build agents it owns"
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-agent
+value: 50
+globalDefault: false
+preemptionPolicy: Never
+description: "For ephemeral Jenkins build agents; lower than the controller and non-preempting"

infrastructure/modules/base/priorityclass/kustomization.yaml

@@ -4,5 +4,6 @@ kind: Kustomization
 resources:
   - scavenger.yaml
   - cassandra.yaml
+  - jenkins.yaml
   - media.yaml
   - veles.yaml

services/jenkins/configmap-jcasc.yaml

@@ -795,6 +795,7 @@ data:
               slaveConnectTimeoutStr: "100"
               yaml: |
                 spec:
+                  priorityClassName: jenkins-agent
                   securityContext:
                     runAsUser: 1000
                     runAsGroup: 1000

services/jenkins/deployment.yaml

@@ -71,6 +71,12 @@ spec:
         bstein.dev/restarted-at: "2026-05-20T09:40:31Z"
     spec:
       serviceAccountName: jenkins
+      # The controller must outrank the build agents it schedules. Without this
+      # the controller and its agents are both priority 0, so a Recreate
+      # rollout can free the controller's slot only for one of its own agents
+      # to take it, leaving the controller permanently Pending with the
+      # scheduler reporting "No preemption victims found for incoming pod".
+      priorityClassName: jenkins-core
       nodeSelector:
         kubernetes.io/arch: arm64
         node-role.kubernetes.io/worker: "true"