CloudBees CD/RO v10.3.4 is a maintenance release (MR) applied to the v10.3.0 long-term release. As such, consult the following in combination with these notes for everything that this release provides.
- Apache Log4j Security Vulnerability (CVE-2021-44228) in CloudBees CD/RO
CloudBees has assessed our products in light of the CVE-2021-44228 security vulnerability that is present in certain versions of the popular Apache Log4j logging library. We have determined that CloudBees CD is vulnerable to CVE-2021-44228 via the Logstash stack included with the optional DevOps Insights service.
To address these vulnerabilities, we have updated CloudBees CD/RO with the following fixes:
- Performance improvement
ActiveMQ has been updated from 2.6.4 to 2.18 and features performance improvements, including:
- Database support
- Browser support
- Updated plugins
The following is a list of key changes made to existing plugins. For a complete list see Bundled plugin report
- Discontinued plugins
The following is a list of discontinued plugins this release:
- Plugin Development Kit enhancements
For complete installation and upgrade information, see CloudBees CD/RO installation guide.
- CloudBees CD/RO on Kubernetes
Sample CloudBees CD/RO server and agent Helm chart values, found here, provide CloudBees’s default installation values. The CloudBees CD/RO
images.tagvalue associated with version 10.3.4 is
- Upgrading gateway agents
All gateway agents that meet these criteria must be updated to CloudBees CD/RO v10.2+:
Your enterprise implements a multi-zone environment.
Agent versions are a combination of pre-v10.2 and v10.2+.
The access route to a v10.2+ agent is configured through a pre-v10.2 gateway agent.
- Configuring autostart services for Linux installations
Linux installations that you perform as a non-root user or without
sudopermissions cannot automatically start the CloudBees CD/RO server, web server, repository server, or agents. This means that you must set up service autostart after installation is complete. Learn more here.
- Upgrading your CloudBees CD/RO environment
IMPORTANT: Before starting an upgrade, make sure to back up your existing CloudBees CD/RO data.
- Upgradable versions
Upgrades to CloudBees CD/RO 10.x are supported only from ElectricCommander 5.0. For upgrade instructions, see Upgrade roadmap.
- Updating the MySQL configuration before upgrading
Since release 8.0.1, CloudBees has instructed customers using a MySQL database to use the following two lines in their MySQL configuration:
init_connect='SET collation_connection = utf8_unicode_ci, NAMES utf8' skip-character-set-client-handshake
Before upgrading CloudBees CD/RO, you must remove these lines or comment them out. Otherwise, jobs will not start.
- Ensuring the correct default MySQL default collation
Make sure that the default collation for the MySQL database schema is set to
utf8_general_ciand that no table in the schema overrides this. The CloudBees CD/RO server checks this configuration on startup and logs errors in the server log if it is not set correctly.
If the collation is not configured correctly, then entering non-ASCII text into CloudBees CD/RO might cause errors. For example, setting a release name to a non-ASCII value and attempting a search causes an exception.
If your MySQL database schema or any tables in it are set to a non-UTF-8 collation order, see Knowledge Base article KBEC-00385 - Converting a MySQL Database From Latin-1 to UTF-8 for detailed instructions about safely converting your schema to UTF-8. [NMB-26521, NMB_27459]
- Upgrading agents that run the ec-groovy job step in multizone deployments
In multizone CloudBees CD/RO deployments, CloudBees CD/RO agents that are in a different zone than the CloudBees CD/RO server must be upgraded to version 9.0 or later for the
ec-groovyjob step to run successfully on those agents. You must also upgrade the gateway agents that lead back to the server’s zone including those in any zones in between the agent’s zone and the server’s zone. [NMB-27490]
- Removing the SSL 2.0 Client Hello or SSLv2Hello protocol from your security configurations
CloudBees recommends removing the
SSL 2.0 Client Helloor
SSLv2Helloprotocol from your security configurations for all components. [NMB-27934, NMB-29326]
Upgrade agents older that fall into this category for security reasons:
Windows, Linux: 6.0.3 or older; 6.2 or older
Mac OS: 8.4 or older
If this warning appears on the Automation Platform UI:
Note: We recommend removing `SSL 2.0 Client Hello` format from server configuration and upgrade older agents as indicated on the Cloud/Resources Page to avoid security risk.
then enter the following command on the CloudBees CD/RO server:
$ ecconfigure --serverTLSEnabledProtocol=TLSv1.2
- Upgrading the CloudBees Analytics server
This section provides information about upgrading the CloudBees Analytics server.
It is not possible to upgrade CloudBees Analytics version 9.0.1 and below to CloudBees Analytics version 10.2.0 and above. Installer exits with an error and an appropriate message when such an update is attempted. If user needs to upgrade CloudBees Analytics version 9.0.1 and below, then user must first upgrade to a version between 9.1.0 and 10.1.0, or 9.0.2 and above. After that, the user can upgrade CloudBees Analytics to version 10.3.0 or higher. [NMB-31030]
For previous CloudBees Analytics upgrades from version 9.0.1 and below: CloudBees Analytics data may contain obsolete indices that are incompatible with CloudBees Analytics version 10.2.0 and above. To work correctly, it is necessary to re-index these indexes before an upgrade. The installer prompts the user to do this before upgrading.
In console mode and Ui mode, the installer displays the following prompt if outdated indexes are detected:
One or more Elasticsearch indices were created in an obsolete version of Elasticsearch. These indexes must be re-indexed for the upgrade to be successful. Do you want to start the reindexation? [n/Y]
After an affirmative answer, the installer automatically re-indexes and continues the upgrade.
In silent mode, the installer reindexes automatically.
Backing up and restoring custom settings
The CloudBees Analytics installer overwrites the
elasticsearch.ymlconfiguration file with a new file. This file includes a
Custom Settingssection, which lets you add Elasticsearch settings not managed by the CloudBees Analytics server without being lost during an upgrade. The installer preserves the settings in the
Custom Settingssection. [NMB-25850]
Upgrading CloudBees Analytics clusters
The principle of forming a cluster in CloudBees Analytics has changed in v10.2 due to the update of Elasticsearch v7.10.2. In this regard, an additional action is required to upgrade to CloudBees Analytics v10.2 or later:
When updating the first master node, the user must explicitly specify that it is the first node to be updated. If this action is not performed, a cluster being updated is placed out of service.
All installers have been instrumented to accommodate this change. See Upgrading the CloudBees Analytics server for more details. [BEE-2717]
CloudBees Analytics server configuration notes
For a production environment, CloudBees recommends that you install the CloudBees Analytics server on a system other than systems running other CloudBees CD/RO components (such as the CloudBees CD/RO server, web server, repository server, or agent). If you must install it on the same system (such as for testing or other non-production or trial-basis situations) see CloudBees Analytics server with other components for details.
- Performing a full import
During a full import, the import operation might hang in the following scenarios. To import successfully into CloudBees CD/RO 8.0 and newer versions, perform the appropriate workarounds [CEV-15447, CEV-11873]:
A manual process step in a process has formal parameters. The workaround is to remove the entry related to the property sheet for the job step that is associated with the manual process step.
In the exported XML file from the earlier release, two pipelines are in different projects, and both pipelines have no gate tasks. The flow associated with the pipeline is duplicated under both projects. The workaround is to remove the flow element under the projects.
When an application is cloned from one project (the original project) to another (the destination project), the tier maps for the application point to the environments with the same names in the destination project. To deploy the application to the environments in the original project, you must create tier maps connecting the application to those environments.
If you encounter unexpected SSL errors related to communications with CloudBees CD server while using
With CloudBees CD/RO v 10.2.1 and earlier, the DSL Import service catalog fails for grouped tasks.
When creating a new EC-Rest plugin configuration, clicking Test Connection results in a broken UI layout.
It is not possible to modify a task in a pipeline or release Application process.
Browser redirects to port 2080 during first navigation to CD deployed from SDA and Flow Helm charts.
When you use the Automation Platform UI to upload and publish artifact files with non-English characters in their file names the operation fails with the following error:
Modifications of LDAP user data (such as email addresses) on an Active Directory server after registration in CloudBees CD/RO do not appear properly in user details (in the Automation Platform UI, the Deploy UI, or
(Windows platforms only) If the Elasticsearch cluster, which is used by CloudBees Analytics, is in the red state (in Elasticsearch this means that it only partly functions and some data is unavailable) then upgrade reconfigure or uninstall operations will not work. Because the Elasticsearch service can not be stopped when a cluster is in red state kill the Elasticsearch service process by the task manager before running the installer for these actions.
The Microsoft Edge browser does not work with SAML 2.0 and a self-signed certificate during redirection from the identity provider to the service provider. Edge is not recommended for sign-in via SAML 2.0.
The LANG environment variable must be set to
When an application with snapshots created in CloudBees CD/RO 6.1 or earlier is cloned and a project containing this application is imported to CloudBees CD/RO 6.3 or higher the import operation fails.
Error prompts for runtimes started by a schedule are not visible if the schedule was created with a missed configuration.
The stage inclusion status in the Release Dashboard changes color after a stage is renamed.
No error prompt appears for failed tasks and retry tasks during a pipeline runtime.
If an application process step cannot expand to its child steps (because of an invalid run condition or an invalid formal parameter) then the step is not retried even if it uses "retry on error" error handling. The job eventually completes with an error.
The retry count for group tasks or rules using "automated retry on error" is missing from the Pipeline runtime page.
Multiple mapped environments with the same name from different projects are not supported in email notifications.
A project import might not include the path-to-production view.
Jobs might not appear upon drill-down into the "Clusters With Most Deployments" widget in the CloudBees Analytics Microservices Dashboard if the service does not contain a deploy step in the process.
All subreleases of a release must appear before the release in the DSL for the release-to-subrelease link to be created.
The ability to search by assignee in a Deployment Report is not available in the CloudBees Analytics report editor.
If Release Command Center was setup for JIRA for user-stories and defects and the JIRA project name was mapped to the release project name using the following field mapping: ` projectName:releaseProjectName` then before upgrading to 10.0 the field mapping must be updated to mention the actual release project name using the following field mapping format:
Approval by email on manual tasks should not expect parameters.
If you use the
Single Sign on does not work unless PHP configuration is changed due to a security related request. Workaround: change
CloudBees CD/RO v10.1 introduced new triggers and an updated UI for them. Pre-v10.1 triggers will continue to work but there is no UI to review or run them.
Before using the export command to perform a full data export from the CloudBees CD/RO database, delete any legacy definitions and references to
You can revert changes only for high-level design objects such as applications procedures procedure steps workflow definitions and state definitions.
Enabling Recursively Traverse Group Hierarchy might impact system performance when the LDAP group hierarchy is traversed. The amount of impact varies with the configurations of the CloudBees CD/RO and LDAP servers the depth of group hierarchy in the LDAP server and the network latency between the servers. Make sure that your directory provider can handle the additional load for supporting nested group hierarchy traversal.
System performance might decrease if you disable change tracking at the server level and then re-enable it. (Change tracking is enabled by default.) For details about using change tracking see change tracking.