Create and manage resources

The Resources page displays all resources on the CloudBees CD/RO server and provides users with the ability to manage resources.

To view the resource list, navigate to DevOps essentials Resources.

Each resource has a logical name — a unique name to distinguish this resource from other resources.
Each resource refers to an agent machine by its host name.
Each resource can be assigned to one or more pools.
- A pool is a group of interchangeable resources, such as a pool of Windows servers.
- If you name a pool in a procedure step, CloudBees CD/RO can assign any resource in the pool to that step, enabling CloudBees CD/RO to choose a lightly loaded resource. Change the resources in a pool without modifying procedures that use the pool.
Each resource can be assigned to a zone. A default zone is created during installation, and all resources are members of that zone until they are assigned to a different zone.
- A zone is a collection of agents. Every agent, and all resources defined on that agent, belong to only one zone. When CloudBees CD/RO is installed, a default zone is created. If a zone is deleted, all agents in that zone are moved to the default zone. The CloudBees CD/RO server resides in the default zone.
  
  The default zone cannot be deleted.
Several resources can correspond to the same physical host or agent machine.
When you specify a resource name in a procedure step, the step executes on that resource.

Supported resource categories

Standard: This category specifies a machine running the CloudBees CD/RO agent on one of the supported agent platforms, as specified in Supported platforms for CloudBees CD/RO.
Proxy: This category requires SSH keys for authentication. You can create proxy resources (agents and targets) for CloudBees CD/RO to use on other remote platforms or hosts that exist in your environment.
- Proxy agent: This is an agent on a supported Linux or Windows platform, used to proxy commands to an otherwise unsupported platform. A proxy agent is a CloudBees CD/RO agent, channeling to a proxy target.
- Proxy target: This is a machine on an unsupported platform that can run commands through an SSH server. Proxy targets have limitations, such as the inability to work with plugins or communicate with ectool commands.
  
  For more information on proxy resources, refer to Create a new or edit a proxy resource.

Resource page information

The Resources page provides access to all available resources and functionality to perform multiple actions. The page breaks down as follows:

Resource action rows
Resource information row
Resource selection row

Table 1. Resource action rows

Icon or Link Name

Description

Select one of these actions:

The following options are available:
- Ping: Pings the selected resource.
- Enable: Enable the selected resources.
- Disable: Disable the selected resource.
- Upgrade Resources: Install or publish the selected resource to your platform. For more information about upgrading resources, refer to Remote host traditional installation with Centralized Agent Management.
- Duplicate: Create a copy of the selected resource.
- Add to Pool: Add the selected resource(s) to a pool.
  - Select the appropriate pool from the dropdown menu provided on the Add to Pool pop-up screen. Select OK when done.
- Move to Zone: Move the selected resources to a zone.
  - Select the appropriate pool from the dropdown menu provided on the Move to Zone pop-up screen. Select OK when done.
- Set Trusted: This switches the resource’s current state to the trusted mode.
- Unset Trusted: This switches the selected resource to the untrusted mode.
- Resources Discovery: Allows you to select a plugin to be assigned to the resource.
  - Select the appropriate plugin from the dropdown menu provided on the Resource Directory.
  - Select OK when done.

Delete Resource: Delete one or more selected resources.

If a resource is on a “gateway agent,” the gateway is deleted.

This selects or deselects all resources in the table.

Select All option to enable all resources for a batch action. For example, deleting or enabling multiple resources at the same time is a batch action.

Select one of these actions:

Create Resource: Refer to Create a new or edit a resource for more information.
Create Proxy Resource: Refer to Create a new or edit a proxy resource for more information.
Copy Existing: A dialog box opens with a list of existing resources shown. Do the following:
1. Select the resource to copy.
2. Make any changes to the resource details.
3. Select OK.

Install Resource(s): Refer to Remote host traditional installation with Centralized Agent Management on how to use the CloudBees CD/RO Centralized Agent Management (CAM) feature.

If the Install Resource(s) menu option is not visible, you must log out and then log in as a user with the required permissions. For details about required permissions, refer to Permissions to install or upgrade remote agents.

If you are upgrading one or more agents or resources, the label on this option is Upgrade Resource(s). If the Upgrade Resource(s) menu option is not visible, you must log out and then log in as a user with the required permissions. For details about required permissions, refer to Permissions to install or upgrade remote agents.

The Agent Management plugin must be installed to access this option.

Filters:

Select the Default filter link to display the list of existing filters.

Select the Add new filter icon to create and define new filter criteria.

Select the Edit filter link to rename an existing filter.

Table 2. Resource information row

Icon or Link Name

Description

Quick Search

Enter any text for your search. This field is case-sensitive.

For example, enter a host name. A text string of at least 2–3 characters is required to search.

All Environments

This lists all available environments. There is a search field available to help you quickly search the list.

There may be more resources than environments listed as multiple resources can be assigned to a single environment.

Alive

Status of the agent machine, either Up or Down.

State

Status of the resource, either Enabled or Disabled.

All Pools

The list of resource pools available. There is a search field available to help you quickly search the list.

Create a new or edit a resource

To create a new or edit an existing resource, do one of the following:
- Select the New icon.
- Select the Details link from the Actions menu of the resource to edit.

Enter information in the following fields on the Details screen of the New Resource or Edit Resource pop-up:

Field Description

Name

Enter a unique name for this resource or edit the existing name.

Do not use spaces in a resource name. For example, use "myresource", not "my resource". This is the name used to select the resource for a job step.

It does not need to match the host name for the machine.

Description

(Optional) Plain text or HTML description for this object. If using HTML, you must surround your text with <html> … </html> tags. Allowable HTML tags are <a>, <b>, <br>, <div>, <dl>, <font>, <i>, <li>, <ol>, <p>, <pre>, <span>, <style>, <table>, <tc>, <td>, <th>, <tr>, and <ul>.

For example, the following HTML:

<p>
<span style="font-family: Arial;">
  <i>Note:</i> For more information about the <b>abc</b> object, see
         <a href="https://www.google.com/">https://www.google.com</a>.
</span>
</p>▼

renders as follows:

<i>Note</i>: For more information about the <b>abc</b> object, see https://www.google.com.▼

Agent Host Name

Enter the domain name or IP address of the agent machine for this resource. This is the name all other machines in this agent/ resource zone will use to communicate with this agent host.

Connection Type

Select your Connection Type from the options:

HTTP: Choose this option if you are not using SSL and the agent does not need to be "trusted".
HTTPS: Choose this option if you are using SSL, but this agent does not need to be "trusted".
Trusted HTTPS: Choose this option if you are using SSL and this agent must be “trusted.” A trusted agent is “certificate verified”—The agent verifies the server or “upstream” agent’s certificate.

For information about the certificate used for trusted agents, refer to eccert.

Agents can be either trusted or untrusted :

Trusted— The CloudBees CD/RO agent verifies the server or “upstream” agent’s certificate.
Untrusted— The CloudBees CD/RO agent does not verify the server or “upstream” agent’s certificate. This agent accepts communications from any CloudBees CD/RO server. An untrusted agent is a potential security risk.

If you want to change the Connection Type, using the UI by itself is insufficient. You must also use the ecconfigure utility to change the protocol. Run: ecconfigure --agentProtocol [http/https].

Enabled

Select this box to enable this resource. When this box is checked, the resource is enabled, which means job steps can be assigned to it.

If a job step requests a pool containing this resource, the step executes on a resource in that pool.
If disabled, and this is the only resource that satisfies a particular job step, the step’s execution is delayed until the resource is re-enabled.
If the resource is disabled while job steps are running on it, the running steps continue to completion, but no new steps are assigned to that resource.

Create a new or edit a proxy resource

To create or edit a proxy resource, do one of the following:
- Select New.
  - Select the Create New Proxy… option from the New Resource pop-up screen.
  - Select the Copy Existing… option from New Resource.
- Select Proxy Resource from the options.
  - Select the desired proxy resource to edit from the list.

Enter information in the following fields on the Details screen of the New Proxy Resource pop-up:

Field Description

Name

Enter a unique name for this resource. Do not use spaces in a resource name.

This is the name used to select the resource for a job step; it does not need to be the same as the host name for the machine.

Description

For example, the following HTML:

<p>
<span style="font-family: Arial;">
  <i>Note:</i> For more information about the <b>abc</b> object, see
         <a href="https://www.google.com/">https://www.google.com</a>.
</span>
</p>▼

renders as follows:

<i>Note</i>: For more information about the <b>abc</b> object, see https://www.google.com.▼

Proxy Agent Host Name

Enter the domain name or IP address of the proxy agent machine corresponding to this resource.

Connection Type

Use the drop-down menu to select your Connection Type:

HTTP: choose this option if you are not using SSL and the agent does not need to be "trusted".
HTTPS: choose this option if you are using SSL, but this agent does not need to be "trusted".
Trusted HTTPS: choose this option if you are using SSL and this agent must be "trusted". A trusted agent has "certificate verified"—the agent verifies the server or "upstream" agent’s certificate.

For information about the certificate used for trusted agents, see eccert.

Agents can be either trusted or untrusted :

Trusted —The CloudBees CD/RO server verifies the agent’s identity using SSL certificate verification.
Untrusted —The CloudBees CD/RO server does not verify agent identity. Potentially, an untrusted agent is a security risk.

Enabled

Select this box to enable this resource. When this box is checked, the resource is enabled, which means job steps will be assigned to it. If a job step requests a pool containing this resource, the step executes on a resource in that pool. If disabled, and this is the only resource that satisfies a particular job step, the step’s execution is delayed until the resource is re-enabled. If a resource is disabled while job steps are running on it, the running steps continue to completion, but no new steps are assigned to that resource.

Switching a Non-Trusted Agent to Trusted

By default, the local agent is not trusted during a new or upgrade installation. After an upgrade, if you want to use a trusted configuration, any existing agent or host machines must be manually switched to "trusted."

Perform the following steps on the agent machine to change the agent status to "trusted" in your environment and in the customer’s site.

Enter ectool --server your_server_name login admin to log into the server and save the session ID.
Enter eccert --server your_server_name initAgent --remote --force to install the agent with a self-signed certificate that needs to be overwritten.
- To run this command, the user must have “modify” privilege on systemObject 'resources'. The user or the group to which they belong can be given this permission in the Resources category on the Administration System Access Control page.
Restart the agent.
- If you do not restart the agent, it tries to use a previously cached certificate if one exists. The old certificate is invalid because a new one was just created.
Ping the agent, in the CloudBees CD/RO UI.

For information about the CloudBees CD/RO Certificate Authority (CA) and the certificates configured in CloudBees CD/RO Server and CloudBees CD/RO Agent installations, CloudBees CD/RO utility and tools.

Creating the First Trusted Agent in a New Zone

This section describes how to create a new trusted agent in a new zone that is protected by a firewall. Perform the following steps to create the first trusted agent in the new zone. These steps assume that port 7800 is open between the new agent and the gateway agent in the default zone:

Set the following property to specify the gateway agent:
```
COMMANDER_HTTP_PROXY=https://gateway_agent_IP:7800▼
```

Create a trusted connection between the agent and the CloudBees CD/RO server:

ectool --server your_server_name login admin your_admin_password▼

eccert --server your_server_name initAgent --force --remote▼

Restart the agent.

A certificate is generated (required for the trusted connection for the two gateway agents).
Change the Connection Type of the agent as described above.

Upgrading Agents for Compatibility with Transport Layer Security (TLS)

If there are outdated agents, a warning appears on the Resources page that states:

You have Windows or Linux agents older than 6.0.4 or 6.3, or UNIX agents older than 8.5. You would need to upgrade those agents to the latest version to avoid security risk.▼

Also, those resources that require an upgrade are flagged with a icon in the Upgrade Required column.

The Upgrade Required column appears only if there are outdated agents.

The default security configurations are as follows:

First-time CloudBees CD/RO installations: TLSv1, TLSv1.1, and TLSv1.2 are enabled
Existing CloudBees CD/RO installations: TLSv1, TLSv1.1, TLSv1.2, and SSLv2Hello are enabled

CloudBees recommends removing the SSL 2.0 Client Hello or SSLv2Hello protocol from your security configurations for all components. When you do this, you also need to upgrade older agents to the latest version to avoid security risks. You need to upgrade agents if you are using the following agent versions:

Windows: 6.0.3 or older
Linux: 6.2 or older
Mac OS: 8.4 or older

For details about upgrading agents and enabling the TLS protocol for agents, refer to Upgrade remote agents.