Introduction
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionPre-installation requirementsInstallingVerifying Docker imagesUninstalling
IntroductionSystem requirementsVerifying Docker imagesInstalling operations centerInstalling client controllersInstalling build agentsVerifying build componentsVerifying WAR files
IntroductionHA (active/active) fundamentalsInstallation on modern cloud platforms (active/active)Installation on traditional platforms (active/active)HA (active/active) considerationsSpecific High Availability (active/passive) installation for CloudBees CI on traditional platforms
Introduction
IntroductionPipeline termsPipeline project typesCloudBees Pipeline benefits
IntroductionUsing Pipeline development utilitiesDetermining plugin compatibilityPipeline best practices
IntroductionPrerequisitesCreating your first PipelineSelecting agentsCreating Pipelines in SCMCreating Pipelines in Web UIUsing Pipeline as Code
IntroductionConfig Adv ScriptedConfig Build StageConfig Deploy StageConfig Optional Step ArgsConfig Test StageCreating JenkinsfileCustomizing ParametersHandling FailuresString InterpolationUsing Multiple AgentsWorking With The Env
IntroductionManaging artifactsTracing artifactsTriggering jobs with a simple webhookRestoring filesVisualizing PipelineInserting checkpointsSecuring PipelinesConfiguring Pipelines with user-scoped credentialsUsing Pipeline PoliciesSpecifying a matrix of one or more dimensionsConverting a Freestyle project to a Declarative PipelinePipeline builds and HA (active/active)
IntroductionRestarting aborted buildsLong-running buildsSkip next buildConsolidated Build View pluginCloudBees Quiet Start pluginCloudBees Template pluginCloudBees Git Validated Merge pluginCloudBees Workspace Caching
IntroductionTrigger a job with a notification event using Cross Team CollaborationEnable external notification events with external HTTP endpointsCluster-wide copy artifactsCluster-wide job triggers
IntroductionSetting up a Pipeline Template CatalogDefining Pipeline Template CatalogsSetting Up A Pipeline TemplateUsing parameters in template.yamlManaging multibranch Pipeline options in template.yamlManaging Pipeline Template Catalogs in bulkExample full Maven/Java app Jenkinsfile
IntroductionUsing Declarative Pipeline syntaxUsing Scripted Pipeline syntax
IntroductionBranch SourceBitbucketGitBranch Property StrategyExamples
CloudBees Docker Build and Publish pluginCloudBees Docker TraceabilityDocker Pipeline pluginCloudBees Docker Hub/Registry Notification plugin
Introduction
Introduction
IntroductionGetting startedNavigating the operations centerProvisioning managed controllers in multiple Kubernetes clustersProvisioning agents in a separate Kubernetes cluster from a managed controllerProvisioning a controller in a different namespace than the operations centerProvisioning a controller in a different OpenShift project than the operations centerManaging controllersManage controllers in specific Kubernetes namespacesMigrating an existing managed controller to High Availability (HA)Managing agentsShared agentsShared configurationShared cloud configurationTrigger restrictionsChanging NFS storage locationQuiet startMove/Copy/PromoteCluster operationsInbound agentsUsing KanikoUsing Buildkit (docker buildx)Sidecar injector for self-signed certificates on KubernetesSidecar injector for self-signed certificates on OpenShiftUsing auto-scaling nodes on EKSUsing auto-scaling nodes on GKECloudBees Amazon Web Services Deploy EngineAmazon Web Services CLI PluginCloud Foundry CLI PluginIntegrate OpenShift CLIServiceNow integrationCreating projects based on GitHub repository structureUsing GitHub App authenticationWikiText pluginController Lifecycle Notifications Plugin
IntroductionGetting startedNavigating the Operations CenterManaging client controllersMigrating from High Availability (active/passive) to High Availability (active/active) on CloudBees CI on traditional platformsManaging agentsShared agentsShared configurationShared cloud configurationTrigger restrictionsQuiet startMove/Copy/PromoteCluster operationsJava web start agentsServiceNow integrationCreating projects based on GitHub repository structureUsing GitHub App authenticationWikiText plugin
Introduction
IntroductionTrust modelPod Security AdmissionCentrally managing security for controllersCyberark Credential Provider PluginHashiCorp Vault PluginEnabling advanced use cases: cross controller triggers and bulk operationsRestricting access and delegating administration with Role-Based Access ControlCreating secure folders with Role-Based Access Control Auto ConfigurerRestricting job triggersSetting up operations center access controlsSetting up access controls on connected controllersTesting the SSH connection to an agentConfiguring restricted credentials with the CloudBees Restricted Credentials pluginFoldersFolders PlusInjecting secrets into buildsManaging build agents with Nodes Plus pluginExtended security settingsEnhanced credentials maskingUnderstanding Beekeeper security warningsPreventing unauthorized interaction between buildsSecurity recommendationsUsing single sign-on (SSO)CloudBees CI integration with Microsoft Entra IDoperations center specific permissionsAuthentication mappingExample configurationsDelegating administrationData collection for the CloudBees Analytics PluginExternal secrets managementReplacing an expired certificateList of URLs that need accessBlocking access to URL patterns using the CloudBees Request Filter PluginServing resources from JenkinsVerifying Helm Charts Published with a Signature
IntroductionConfiguring network requirementsCentrally managing security for controllersCyberark Credential Provider PluginHashiCorp Vault PluginEnabling advanced use cases: cross-controller triggers and bulk operationsRestricting access and delegating administration with Role-Based Access ControlCreating secure folders with Role-Based Access Control Auto ConfigurerRestricting job triggersTesting the SSH connection to an agentConfiguring restricted credentials with the CloudBees Restricted Credentials pluginFoldersFolders PlusInjecting secrets into buildsManaging build agents with Nodes Plus pluginUnderstanding Beekeeper security warningsPreventing unauthorized interaction between buildsSecurity recommendationsExtended security settingsUsing single sign-on (SSO)CloudBees CI integration with Microsoft Entra IDOperations Center specific permissionsAuthentication mappingExample configurationsDelegating administrationData collection for the CloudBees Analytics PluginExternal secrets managementList of URLs that need accessBlocking access to URL patterns using the CloudBees Request Filter PluginServing resources from Jenkins
Introduction
IntroductionExplaining $JENKINS_HOMEBest practices for backup and restoreBacking up manuallyRestoring manuallyRestoring credentialsUsing the CloudBees Backup PluginScheduling your backups in the CloudBees Backup PluginRestoring from CloudBees Backup PluginBackup and restore on KubernetesBackup and restore on AWSUsing Velero for backup and restore of Kubernetes clustersUsing cluster operations to run backups
IntroductionGetting the Jenkins CLI toolUsing the Jenkins CLI toolExamples of usageConfiguring multiple client controllers with the Jenkins CLI toolConfiguring an alias for the Jenkins CLI toolConfiguring Jenkins CLI tool with non-TrustStore SSL certificatesCasC bundle management on operations center
CloudBees Inactive Items Plugin
Jenkins Health Advisor by CloudBees
CloudBees Pull Request Builder for GitHub plugin
Count and monitor user licenses with the CloudBees User Activity Monitoring plugin
Introduction
CasC fundamentals
CasC requirements
CasC permissions
IntroductionGetting startedCreating a bundleConfiguring the operations center on modern platformsConfiguring the operations center on traditional platformsRetrieving bundles using SCMUpdating a bundleBundle update timing for the operations centerViewing the operations center update logCreating itemsConfiguring RBACDetermining plugin compatibilityTroubleshooting
IntroductionGetting startedCreating a bundleAdding controller bundles to the operations centerUpdating a bundleBundle update timing for controllersViewing the controller update logConfiguring bundle availabilitySetting up a managed controllerSetting up a client controllerCreating itemsConfiguring RBACDetermining plugin compatibilityAdvanced topicsTroubleshooting
Plugin management with CasC
CasC CLI commands
CasC HTTP API
Support policies

Upgrading plugins with Beekeeper Upgrade Assistant

5 minute read

CloudBees offers the Beekeeper Upgrade Assistant (Beekeeper), which is the user interface that administrators can use to manage plugin versions and enforce compliance with the CloudBees Assurance Program’s recommended sets of plugins and versions.

When the Beekeeper Upgrade Assistant plugin is installed, the Beekeeper Upgrade Assistant option appears on the Manage Jenkins screen under System Configuration.

Beekeeper regularly evaluates the state of the instance to ensure compliance with the CloudBees Assurance Program and alerts administrators when plugin upgrades are available.

Beekeeper alert for an available upgrade
Figure 1. Upgrade message from header

Before any upgrade, CloudBees recommends creating a backup of the instance in case of an unexpected failure during the upgrade process.

Once an upgrade is installed, the recommended plugins that the CloudBees Assurance Program enforces are automatically changed, so the report offered by the Beekeeper plugin may automatically change from compliant to non-compliant. This is normal because restarting the instance is required for the upgrade to complete. After the restart, the Beekeeper report should return to its previous state. However, note that recurring non-compliance issues, such as installation of a plugin that is not in the CloudBees Assurance Program, continue to appear on the report.

If an upgrade fails, Beekeeper notifies the administrator and allows the upgrade to be canceled.

Viewing the Beekeeper Upgrade Assistant

To view the Beekeeper Upgrade Assistant:

  1. In your CloudBees product, select Manage Jenkins  Beekeeper Upgrade Assistant.

    Beekeeper Upgrade Assistant
    Figure 2. Beekeeper Upgrade Assistant

Configuring options for Beekeeper Upgrade Assistant

In the Beekeeper Upgrade Assistant, administrators can enroll instances in the CloudBees Assurance Program, set up automatic upgrades or downgrades of plugins to keep verified plugins up to date with the versions that the CloudBees Assurance Program recommends, and configure options for security updates.

To configure options for Beekeeper Upgrade Assistant:

  1. In your CloudBees product, select Manage Jenkins  Beekeeper Upgrade Assistant  CAP Configuration.

  2. Select the configuration options that you want to use. Review the table below for details about each option.

  3. Select Save.

  4. Restart the instance to allow Beekeeper to perform any required plugin upgrades.

    Table 1. Beekeeper configuration options
    Option Description

    Enroll this instance in the CloudBees Assurance Program

    Selecting Enroll this instance in the CloudBees Assurance Program causes the following to occur:

    • The Beekeeper plugin monitors the instance’s installed plugin list and checks it against the monitored plugin list. This means that for each plugin in the list that is installed, if the installed plugin version is different than the specified version, a warning is generated.

    • The update center configuration is set to a specific CloudBees-provided update center that, for the set of monitored plugins, offers only the version specified in the list and filters the rest of the available plugins so that they are compatible (dependency-wise) with the plugins and versions in the monitored list.

    • The Update and Available views in the Plugin Manager are also filtered in the same way, in case additional update centers are configured.

    If Enroll this instance in the CloudBees Assurance Program is not selected, the following occurs:

    • No monitoring is performed.

    • The update center is configured to a generic update center that still points to the CloudBees Update Center service and provides the latest version of the plugins.

    • No local filtering is performed for the Updates and Available views in the Plugin Manager.

    Allow automatic upgrades of plugins on restart

    CloudBees does not recommend that you disable the automatic plugin upgrades as your plugin upgrades may fail and the controller may not restart.

    Enabling automatic plugin upgrades can help administrators automatically keep their verified plugins up to date with the versions recommended by the CloudBees Assurance Program. The Allow automatic upgrades of plugins on restart option can only be selected if the Enroll this instance in the CloudBees Assurance Program option is selected.

    When the automatic upgrade option is enabled, Beekeeper tries to upgrade every plugin in the list of monitored plugins whenever the instance is restarted. If an upgrade requires the installation of dependencies, the dependencies are installed before the plugin is upgraded.

    Automatic upgrades fail in the following situations:

    • Any required dependency fails to install or upgrade.

    • The system is unable to install the target version of the plugin in the appropriate location inside the $JENKINS_HOME folder.

    If automatic upgrades are not enabled, Beekeeper indicates when your instance becomes out of compliance with the verified plugins in the CloudBees Assurance Program. You can then manually upgrade the plugins that are out of compliance.

    Some plugins (internally those in bootstrap and possibly their optional installed dependencies) are upgraded or reverted on an upgrade as they are required for the plugin to function.

    Allow automatic downgrades of plugins on restart

    You can enable Beekeeper to automatically downgrade any installed plugins that exceed the versions that the CloudBees Assurance Program recommends. When the automatic downgrade option is enabled, Beekeeper tries to downgrade every plugin in the list of monitored plugins whenever the instance is restarted. The Allow automatic downgrades of plugins on restart option can only be selected if the Enroll this instance in the CloudBees Assurance Program option is selected.

    While this option affects only the plugins considered to be verified and part of the CloudBees Assurance Program, using this option may cause unintended side effects on stability if the instance has been taking advantage of features and configurations provided by more recent versions of those plugins.

    CloudBees does not recommend that you enable automatic plugin downgrades. If you choose to use this option, you should back up your instance before you enable it.

    Automatic downgrades fail in the following situations:

    • Other plugins in the system depend on the currently installed version and this dependency is not satisfied by the target version.

    • The system is unable to install the target version of the plugin in the appropriate location inside the $JENKINS_HOME folder.

    Notify when security warnings affecting the core are detected

    Selecting this option enables Beekeeper to notify you if security warnings related to the Jenkins core version that your CloudBees Jenkins-based product is based on are detected. For more information about security warnings, see Understanding Beekeeper security warnings.

    Notify when security warnings affecting plugins are detected

    Selecting this option enables Beekeeper to notify you if security warnings related to plugins are detected. For more information about security warnings, see Understanding Beekeeper security warnings.

Beekeeper system properties

Property Default Description

cb.BeekeeperProp.noFullUpgrade

false

Set to true to not check for full upgrades. Does not disable checks for security fixes to currently installed plugins, even if the security fixes for those currently installed plugins require a full upgrade. An older installation that includes a plugin with a known security issue will be shown as a Beekeeper warning. The solution to that warning may require a full upgrade, but with noFullUpgrade=true, that upgrade will not be included in the warnings

cb.BeekeeperProp.autoInstallIncremental

false

Set to true to install incremental upgrades automatically at startup

cb.BeekeeperProp.disableIncrementalWizard

false

Disable checking for incremental releases during the setup wizard

com.cloudbees.jenkins.cjp.installmanager.CJPPluginManager.allRequired

false

If true, every plugin in the envelope will be considered required when CloudBees Assurance Program is enabled

com.cloudbees.jenkins.cjp.installmanager.CJPPluginManager.suggestedRequired

false

If true, all suggested plugins (as defined in the setup wizard) in the envelope will be considered required when CloudBees Assurance Program is enabled.
CloudBees Assurance Program
Adding Beekeeper plugin exceptions