Items cannot be Saved or Displayed due to ProxyGroupContainer missing it descriptor

Article ID:4402576984219
2 minute readKnowledge base

Issue

  • After upgrading CloudBees CI to version 2.249.3.1 or later, items cannot be saved anymore or cannot be seen anymore

  • The Jenkins logs show an exception like the following:

      WARNING h.i.i.InstallUncaughtExceptionHandler#handleException: Caught unhandled exception with ID f8c26def-e3d4-4c5d-93b7-faad25a8cf20
  org.apache.commons.jelly.JellyTagException: jar:file:/var/cache/jenkins/war/WEB-INF/lib/jenkins-core-[VERSION].jar!/lib/form/descriptorList.jelly:78:49: <j:forEach> class <package>[Folder|Node|Job||View|Model|SharedConfiguration|SharedSlave|SharedCloud|ConnectedMaster]ProxyGroupContainer is missing its descriptor

Environment

Explanation

Starting from version 2.249.3.1, the RBAC configuration of Jenkins Saveable items is not persisted in the config.xml anymore but in a nectar-rbac.xml alongside to it.

When upgrading from an earlier version, existing items that have an RBAC configuration are migrated during the startup. Messages like the following should appear in the startup:

INFO	jenkins.InitReactorRunner$1#onAttained: Loaded all jobs
INFO	n.p.r.g.ProxyGroupContainersMigrator#migrate: Starting migration of the groups configured in items, to store them in independent files.
This can take a while. Please do not interrupt.
INFO	c.c.h.p.f.p.FolderProxyGroupContainer$FolderProxyGroupContainersMigratorImpl#doMigration: Starting migration of groups in Folders
[...]
INFO	c.c.h.p.f.p.FolderProxyGroupContainer$FolderProxyGroupContainersMigratorImpl#doMigration: Finished migration of groups in Folders
[...]
INFO	n.p.r.g.ProxyGroupContainersMigrator#migrate: Migration finished successfully
INFO	jenkins.InitReactorRunner$1#onAttained: Configuration for all jobs updated

Once the migration has been completed, a marker file $JENKINS_HOME/.nectar-rbac-separated-group-containers-migrated-v2 (or $JENKINS_HOME/.nectar-rbac-separated-group-containers-migrated for version 2.249.3.1 specifically) is created so that the migration does not occur again in the next startups.

In rare cases or if the migration is interrupted during startup, some items may still contain the migrated configuration in which case the item configuration cannot be saved or loaded.

Related Issue(s)

  • CTR-430: Fix nectar-rbac with doConfigDotXml()

Resolution

The solution is to run the configuration migration again.

If impacted items are created or generated through automation (Job / Folder templates, Job DSL, Jenkins REST API, Groovy scripting, …​), the automation scripts would also need to be adapted.

Solution 1: Relaunch the migration on startup

One solution is to force the migration to happen again on startup:

  • Remove the marker files $JENKINS_HOME/.nectar-rbac-separated-group-containers-migrated-v2 (and also $JENKINS_HOME/.nectar-rbac-separated-group-containers-migrated if it exists)

  • Stop Jenkins

  • Start Jenkins

Solution 2: Launch the migration via Groovy

Another solution is to run the migration via Groovy. The following groovy script can be used to launch the migration from the Manage Jenkins  Script Console:

nectar.plugins.rbac.groups.ProxyGroupContainersMigrator.all().each { migrator ->
  println "Launching migration of ${migrator}"
  migrator.doMigration()
}
return
▼
This can take a while depending on the number of items to migrate, and the Script Console is subjected to HTTP / Session timeouts. If impacted by those timeouts, paste the content of the script in a file - for example rbac-migration.groovy - and use the Jenkins CLI with jenkins-cli groovy = < rbac-migration.groovy

References