IntroductionInstallationFrequently asked questionsConfiguration valuesCreating Docker images
IntroductionSpecial-case installationsInstaller optionsServer topology best practicesDefault installation directories
IntroductionDefault configurationCustom configurationExpress agentExpress agent-onlyAdvanced agent-onlyCloudBees Analytics server
IntroductionExpress serverAdvanced serverExpress agentExpress agent-only (standalone)Advanced agent-only (standalone)CloudBees Analytics server installation
IntroductionSilent install overviewSilent install argumentsLinux installation examplesWindows installation examplesLinux repository server installation exampleWindows repository server installation exampleWindows or Linux CloudBees Analytics server installation example
IntroductionUNIX agent interactive command-lineUNIX agent unattended
IntroductionPrerequisitesPermissionsInstalling via the web interfaceInstalling via the API
Moving the artifact repository in Linux
Moving the artifact repository in Windows
Connecting CloudBees CD/RO to a Microsoft SQL server
Installing the MySQL JDBC driver
IntroductionUninstalling CloudBees CD/RO on Linux, Unix, or macOSUninstalling CloudBees CD/RO on WindowsUninstalling the CloudBees Analytics Server on LinuxUninstalling the CloudBees Analytics Server on Windows
Signing in to CloudBees CD/RO
IntroductionConfiguring initial events for Workload Insights
Introduction
Microservice applications
IntroductionArtifact stagingSnapshotsRollbackManaging dependencies
IntroductionApplications and processesCreating processesAdding process stepsProcess branchingPlugin process stepsManual steps and tasksExample: manual step with runtime parameters
IntroductionCreating environmentsCreating environment tier mapsInventory trackingEnvironment inventoryEnvironment reservationsEnvironment lockingModeling dynamic environmentsAutomated environment discoveryExample: dynamic environment with Amazon and Chef
IntroductionMaster Component ExamplesMaster components list
IntroductionApplication deploy optionsDeploying and troubleshooting applicationsDeployment packagesDeployment examplesDeploying applications with provisioned cloud resourcesExample: implementing deployment strategies
Property reference use case
Creating a project
Parameters
Full-stack dependency view
Configuration drift
Attaching credentials to processes
Developer task: creating custom plugins
Introduction
Release and Environment Reservations Calendar
Visibility and Status of Release Pipelines
Release Definition
Release Dashboard
Planned Versus Actual View
Path to Production View
Release Summary
IntroductionPipeline concepts
Pipeline stages and gates
Pipeline access control
Pipeline tasks
Entry and exit gates
Pipeline conditions
Pipeline start and end stages and stage skipping
Wait dependencies
Native CI integration
Event-based triggers
IntroductionAuthoring and running pipelines
Defining gate approvals
Pipeline objects and conditions
Pipeline stage summary
Credentials in pipelines
IntroductionPipeline examples
Example: Creating a manual task in a pipeline
Example: plugin pipeline tasks
Example: integrating test automation in release pipelines
Example: leveraging test data management and service virtualization in release pipelines
Example: Surfacing Jenkins build details in Flow
Signing in to CloudBees CD/RO
Guided Tutorials
Home page
Personas
Access control
My work dashboard
Object list layout
Object schedules
Event-based triggers
IntroductionPaginationSearching and filteringHierarchy menuProperty browserProjects in CloudBees CD/ROObject tags
IntroductionCleanupStalledJobClusterInfoTooleccertecconfigureecdaemonecproxyecremotefilecopyZKConfigtool
IntroductionThe default zone and gateways to remote zonesSetting agent environment variablesLicensesExternal Database ConfigurationConfiguring CloudBees CD/RO to Use an Alternate DatabaseConfiguring autostart for non-root/non-sudo Linux installationsUniversal access to the plugins directoryEnvironment proxy server configurationSystem health monitoringIncreasing file descriptors on LinuxAdjusting swappiness on LinuxSetting variables on Windows agent machinesConfiguring Kibana to work with CloudBees AnalyticsServer settingsSource code synchronizationGitOps configuration with Helm charts
Data Retention
IntroductionPerformance consequences of change trackingEstimating database growthBest practices for change trackingConfiguring change trackingSearching the change historyViewing the change historyModifying what you see in the change historyReverting changes to a tracked object and its tracked contentsExporting a previous state of a tracked object and its tracked contents
IntroductionSetting Email NotificationsSelecting and Editing Email Messages for Application or Microservice Processes
Producing audit reports
Configuration drift
IntroductionInstalling pluginsCreating configurationsManaging pluginsCreating pluginsManaging the plugin catalog
Self-Service Catalogs
IntroductionArchitecture of a CloudBees CD/RO ClusterResource, agent, and procedure considerationsSoftware for clusteringDependencies for clusteringConfiguring clusteringSeparating agents from flow serversPreparing your cluster resourcesInstalling and configuring a load balancerInstalling ZooKeeperConfiguring a multi-ZooKeeper clusterInstalling CloudBees CD/RO softwareConfiguring repository serversConfiguring machines to operate in clustered modeRunning a cluster in single-server modeAdding the configuration to ZooKeeperUploading configuration files to ZooKeeperGetting Information on the CloudBees CD/RO server cluster from ZooKeeperAdding a node to an existing clusterConfiguring web server propertiesConfiguring repository server propertiesConfiguring CloudBees CD/RO agentsConfiguring the cluster workspaceConfiguring CloudBees CD/RO repositoriesAdding trusted agents to clustersVerifying CloudBees CD/RO servicesAccessing CloudBees CD/RO with clusteringHealth check for the CloudBees CD/RO clusterAdditional Ways to improve a clusterInstalling the CloudBees Analytics server in cluster modeDisaster recovery
Introduction
Build-test automation
IntroductionScenario 1 - Creating a simple procedureScenario 2 - Creating a procedure that uses an SCMScenario 3 - Notification, scheduling, and reportingScenario 4 - Multi-agent build and test
IntroductionAutomation platform home pageCustomizing the automation platform UIConfiguring CloudBees CD/ROUsing CloudBees CD/RO in your environmentCloudBees CD/RO Installed tools
IntroductionArtifact managementAuthenticating users for ldap and active directoryAuto-discoveryDefect trackingElectricSentryJob step execution environmentPreflight buildsPostprocessorsReportsWorkflow overviewWorkspaces and disk space management
IntroductionIntrinsic propertiesProperty shortcutsProperty error codes
IntroductionAdding a link to a jobCalling a subprocedureChecking the outcome of preceding stepsConditional executionCustom parameter layoutsEmail notificationsExecuting tasks on all resources in a poolFactory proceduresPostp extensionPublishing and retrieving an artifactReserving a resource for the job step durationRunning steps in parallelStep timeouts and steps that always runStoring and retrieving properties in a jobWorking with properties stored in a procedure
Using special characters in object names
IntroductionDefining entriesCreate new or edit existing privileges
IntroductionArtifact detailsCreate new or edit existing artifactsArtifact versionsArtifact version detailsEdit an existing artifact versionRepositoriesCreate new or edit existing repositories
Database configuration
IntroductionCreate new or edit existing configurationsDefect tracking reports
IntroductionCreate new or edit existing email configurationsEmail notifiers
Event log
IntroductionJob configurationShortcutsJobs quick view
IntroductionJob step details
IntroductionView licenseImport license
IntroductionCreate new or edit existing procedureCreate new or edit existing stepsPublish artifact version stepsRetrieve artifact version stepsSend email stepsExtract preflight sources stepsCreate new or edit existing parameters
IntroductionCreate new or edit existing projectsProject detailsRun proceduresCreate new or edit existing schedulesCreate new or edit existing credentials
IntroductionNested Property Sheet
Reports
IntroductionResource poolsCreate new or edit existing poolsResource pool detailsZonesGateways
IntroductionSearch results
IntroductionEdit existing property settings
IntroductionCreate new or edit existing configurations
IntroductionUsersCreate new or edit existing local usersUser detailsEdit user settingsGroupsCreate new or edit existing groupsGroup detailsDirectory providersCreate new or edit existing directory providersSingle sign-onTest directory provider
IntroductionCreate new or edit exiting workflow definitionsWorkflow definition detailsRun workflowWorkflow detailsWorkflow logTransition workflow
IntroductionCreate new or edit existing workspacesWorkspace file

Access control for pipelines, releases, and procedures

6 minute readAutomation

This section contains access control scenarios for pipelines, releases, and procedures to show the behavior based on various authentication contexts.

  • For schedule-invoked pipelines or releases that include command tasks, access control is defined by the plugin project EC-Core-<version>. Hence, in order to deny the invocation, project EC-Core-<version> also needs to be given a deny permission on the pipeline or release being invoked.

  • Access control behavior in the tables below is applicable for CloudBees CD/RO v10.3.1+. Before migrating from an earlier release, review access control settings at your site for pipelines, releases, and procedures. Make appropriate changes in access control based on the v10.3.1+ behavior.

Of note:

  • The users referred to below are non-admin users.

  • The access control list (ACL) permissions specified for the principals in the scenarios below could be either directly defined or inherited.

  • The ACL permissions mentioned could be presented for all principals in the context or could be one of the principals with either Allow or Deny category. For example, a user could have an Allow via inheritance but Everyone group, or a project of pipelineA may not have any explicit ACLs defined.

  • Whenever a user has an ACL defined, either explicitly or via inheritance, it always takes precedence over other principals like Group or Project.

Make sure you are familiar with the access control system before making changes. Incorrectly setting ACLs can severely impact CloudBees CD/RO behavior.

Pipelines

  • Data in the table below assumes projectA with pipelineA calls a procedure, procedureB. Similar behavior exists when pipelineA calls the following:

    • A pipeline task, pipelineB, from projectB.

    • An application process task, applicationB-processB-environmentB, from projectB.

  • projectB contains:

    • procedureB

    • pipelineB

    • releaseB

    • applicationB

    • environmentB

  • The users userA, userB, and userC are defined. Users userA and userB belong to groupA.

Objects Execute permissions on projectB Run as Result

When all objects have allow permissions on projectB

projectA

allow

Run pipelineA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run pipelineA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run pipelineA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run pipelineA from projectA as userC

procedureB is launched successfully by userC

When projectA has deny permission on projectB

projectA

deny

Run pipelineA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run pipelineA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run pipelineA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run pipelineA from projectA as userC

procedureB is launched successfully by userC

When userA has deny permission on projectB

projectA

allow

Run pipelineA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

deny

Run pipelineA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run pipelineA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run pipelineA from projectA as userC

procedureB is launched successfully by userC

When groupA has deny permission on projectB

projectA

allow

Run pipelineA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run pipelineA from projectA as userA

procedureB cannot be launched by userA

groupA

deny

Run pipelineA from projectA as userB

procedureB cannot be launched by userB

Everyone group

allow

Run pipelineA from projectA as userC

procedureB is launched successfully by userC

When Everyone group has deny permission on projectB

projectA

allow

Run pipelineA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run pipelineA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run pipelineA from projectA as userB

procedureB cannot be launched by userB

Everyone group

deny

Run pipelineA from projectA as userC

procedureB cannot be launched by userC

Releases

Data in the table below assumes projectA with releaseA calls a procedure task, procedureB. Similar behavior exists when releaseA calls:

  • A pipeline task, pipelineB, from projectB.

  • An application process task, applicationB-processB-environmentB, from projectB.

  • A release task, releaseB, from projectB.

  • projectB contains:

    • procedureB.

    • pipelineB.

    • releaseB.

    • applicationB.

    • environmentB.

  • The users userA, userB, and userC are defined. Users userA and userB belong to groupA.

Objects Permissions on projectB Run as Result

When all objects have allow permissions on projectB

projectA

allow

Run releaseA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run releaseA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run releaseA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run releaseA from projectA as userC

procedureB is launched successfully by userC

When projectA has deny permission on projectB

projectA

deny

Run releaseA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run releaseA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run releaseA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run releaseA from projectA as userC

procedureB is launched successfully by userC

When userA has deny permission on projectB

projectA

allow

Run releaseA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

deny

Run releaseA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run releaseA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run releaseA from projectA as userC

procedureB is launched successfully by userC

When groupA has deny permission on projectB

projectA

allow

Run releaseA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run releaseA from projectA as userA

procedureB cannot be launched by userA

groupA

deny

Run releaseA from projectA as userB

procedureB cannot be launched by userB

Everyone group

allow

Run releaseA from projectA as userC

procedureB is launched successfully by userC

When Everyone group has deny permission on projectB

projectA

allow

Run releaseA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run releaseA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run releaseA from projectA as userB

procedureB cannot be launched by userB

Everyone group

deny

Run releaseA from projectA as userC

procedureB cannot be launched by userC

Procedures

  • Data in the table below assumes projectA with procedureA calls procedure step, procedureB. Similar behavior exists when procedureA calls:

    • A pipeline task,pipelineB, from projectB.

    • A release task, releaseB, from projectB.

    • An application process task, applicationB-processB-environmentB, from projectB.

  • projectB contains:

    • procedureB.

    • pipelineB.

    • releaseB.

    • applicationB.

    • environmentB.

  • The users, userA, userB, and userC are defined. userA and userB belong to groupA.

Objects Permissions on projectB Run as Result

When all objects have allow permissions on projectB

projectA

allow

Run procedureA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run procedureA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run procedureA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run procedureA from projectA as userC

procedureB is launched successfully by userC

When projectA has deny permission on projectB

projectA

deny

Run procedureA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run procedureA from projectA as userA

procedureB is launched successfully by userA

groupA

allow

Run procedureA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run procedureA from projectA as userC

procedureB is launched successfully by userC

When userA has deny permission on projectB

projectA

allow

Run procedureA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

deny

Run procedureA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run procedureA from projectA as userB

procedureB is launched successfully by userB

Everyone group

allow

Run procedureA from projectA as userC

procedureB is launched successfully by userC

When groupA has deny permission on projectB

projectA

allow

Run procedureA from projectA using projectA (schedule)

procedureB is launched successfully by projectA

userA

allow

Run procedureA from projectA as userA

procedureB cannot be launched by userA

groupA

deny

Run procedureA from projectA as userB

procedureB cannot be launched by userB

Everyone group

allow

Run procedureA from projectA as userC

procedureB is launched successfully by userC

When Everyone group has deny permission on projectB

projectA

allow

Run procedureA from projectA using projectA (schedule)

procedureB cannot be launched by ProjectA

userA

allow

Run procedureA from projectA as userA

procedureB cannot be launched by userA

groupA

allow

Run procedureA from projectA as userB

procedureB cannot be launched by userB

Everyone group

deny

Run procedureA from projectA as userC

procedureB cannot be launched by userC

Access control for jobs
Access control examples