Framework Deployer permissions missing from the permissions list in new controllers

2 minute readKnowledge base

Issue

  • Framework Deployer plugin permissions - Deploy Now/Deploy, Deploy Now/JobCredentials and Deploy Now/UserCredentials - are not in the list of permissions available under my controller authorization settings although the plugin was successfully installed in the controller.

  • When I try to provision a new controller with CasC and any of the Framework Deployer plugin permissions in the rbac.yaml file by their fully qualified name - com.cloudbees.plugins.deployer.DeployNowRunAction.Deploy, com.cloudbees.plugins.deployer.DeployNowRunAction.JobCredentials, com.cloudbees.plugins.deployer.DeployNowRunAction.UserCredentials - the controller fails to start with the following error:

SEVERE jenkins.InitReactorRunner$1#onTaskFailed: Failed Bootstrap.initialize com.cloudbees.jenkins.plugins.casc.CasCException: Unknown or disabled permissions are not allowed to be part of the definition file. Please remove [com.cloudbees.plugins.deployer.DeployNowRunAction.Deploy, com.cloudbees.plugins.deployer.DeployNowRunAction.JobCredentials, com.cloudbees.plugins.deployer.DeployNowRunAction.UserCredentials] at com.cloudbees.jenkins.plugins.casc.rbac.CRoles.allPermissionAreEnabledCheck(CRoles.java:135)

Environment

Context

The Framework Deloyer permissions are only injected and configurable once a deploy step is used in a job for the first time. Moreover, that’s incompatible with configuring the plugin permissions via CasC for a brand-new controller, because CasC loads the RBAC information before loading the items, so the permissions cannot be recognized at the moment of provisioning a new instance.

Workaround

In a new controller provisioned without the RBAC CasC file but with the deployer-framework plugin installed, you can make the permissions appear in the RBAC permissions matrix by creating a Freestyle job with a post-build deploy action and saving the job.

For example, you can reproduce this using the CloudBees Amazon Web Services Deploy Engine plugin, if already installed.

CloudBees removed the CloudBees Amazon Web Services Deploy Engine plugin from the CloudBees Assurance Program (CAP) in January 2023. Please contact CloudBees Support if you have any concerns or questions.

To reproduce the issue:

  1. In the Update Center, select in the upper-right corner to navigate to the Manage Jenkins page.

  2. Select Plugins to enable the two new plugins to support Elastic Beanstalk deployment, which you will find under Available plugins.

  3. Select in the upper-right corner to navigate to the Manage Jenkins page.

  4. Select Manage Credentials, and then add your AWS credentials. Start by identifying the type of credentials you’re adding.

  5. Provide the necessary keys to Jenkins so you will be able to access AWS Elastic Beanstalk.

  6. As a post-build action, choose Elastic Beanstalk as the Host Service for the CloudBees Deployer.

  7. Select the AWS credentials that you provided earlier, and configure any parameters associated with the deployment.

Tested product/plugin versions

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.