Introduction
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstall with IngressVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionSystem requirementsVerify Docker imagesInstall operations centerInstall client controllersVerify build componentsVerify WAR files
IntroductionHA fundamentalsGet ready for HAInstall HA on modern cloud platformsInstall HA on traditional platformsHA considerationsHigh Availability (active/passive) installation for CloudBees CI on traditional platforms
IntroductionWhat is FIPS and FIPS 140 compliance?Install CloudBees CI on modern cloud platforms in FIPS modeCAP plugin support in a FIPS 140-3 environmentConfigure the Pipeline Maven API plugin for FIPS complianceKnown FIPS incompatibilities with CloudBees CI on modern cloud platformsJenkins core: FIPS 140-3 compliant artifacts with caveatsJenkins core: Non-compliant classes and libraries
Introduction
IntroductionCommon Pipeline termsPipeline project typesCloudBees proprietary features for Pipelines
IntroductionPipeline development utilitiesDetermine plugin compatibilityPipeline best practices
IntroductionUse Declarative Pipeline syntaxUse Scripted Pipeline syntax
IntroductionPipeline prerequisitesCreate your first PipelineSelect an agent for your Pipeline jobCreate a Pipeline from SCMCreate a Pipeline in the UIUnderstand and implement Pipeline as Code
IntroductionConfigure advanced Scripted PipelineConfigure the build stageConfigure the deploy stageConfigure optional step argumentsConfigure the test stageCreate a JenkinsfileCustomize parametersHandle failuresString interpolationUse multiple agentsWork with the environmentReuse configuration files
IntroductionManage artifacts with CloudBees Fast Archiving pluginEnable artifact traceability with fingerprintingTrigger jobs with a simple webhookRestore filesVisualize the PipelineInsert checkpointsSecure PipelinesConfigure Pipelines with user-scoped credentialsEnforce standards with Pipeline PoliciesSpecify a matrix of one or more dimensionsConvert a Freestyle project to a Declarative PipelinePipeline builds and High Availability (active/active)
IntroductionRestart aborted buildsLong-running buildsSkip next buildConsolidated Build View pluginCloudBees Quiet Start pluginCloudBees Template pluginCloudBees Workspace Caching
IntroductionTrigger a job with a notification event using Cross Team CollaborationEnable external notification events with external HTTP endpointsCluster-wide copy artifactsCluster-wide job triggers
IntroductionSet up a Pipeline Template CatalogDefine Pipeline Template CatalogsSet up a Pipeline TemplateParameter types in the template.yaml fileManage Multibranch Pipeline options in the template.yaml fileManage Pipeline Template Catalogs in bulkExample full Maven/Java app Jenkinsfile
IntroductionBranch SourceBitbucketGitHubGitBranch Property StrategyExamples
CloudBees Docker Build and Publish pluginCloudBees Docker TraceabilityCloudBees Docker Hub/Registry Notification plugin
Introduction
Introduction
Introduction
IntroductionGet startedNavigate the operations center interfaceProvision agents in a separate Kubernetes cluster from a managed controllerProvision a controller in a different OpenShift project than the operations centerManage controllersManage controllers in specific Kubernetes namespacesMigrate an existing managed controller to High Availability (HA)Manage agentsManage SSH credentialsShared agentsShared configurationsShared cloud configurationTrigger restrictionsChange NFS storage locationQuiet startMove/Copy/PromoteCluster operationsInbound agentsUse Kaniko with CloudBees CIUse Buildkit with CloudBees CIUsing self-signed certificates in CloudBees CI on KubernetesSidecar injector for self-signed certificates on OpenShiftAuto-scale nodes on EKSEnable auto-scaling nodes on GKECloudBees Amazon Web Services Deploy EngineCloudBees Amazon AWS CLI pluginCloud Foundry CLI PluginIntegrate OpenShift CLICloudBees CI ServiceNow integrationCreate projects based on a GitHub repository structureUse GitHub App authenticationCreate Multibranch Projects and Organization Folders with large repositoriesWikiText pluginController Lifecycle Notifications plugin
IntroductionGet startedNavigate the operations center interfaceManage client controllersMigrate from High Availability (active/passive) to High Availability (active/active) on CloudBees CI on traditional platformsManaging agentsManage SSH credentialsShared agentsShared configurationsShared cloud configurationTrigger restrictionsQuiet startMove/Copy/PromoteCluster operationsInbound agentsCloudBees CI ServiceNow integrationCreate projects based on a GitHub repository structureUse GitHub App authenticationCreate Multibranch Projects and Organization Folders with large repositoriesWikiText plugin
Introduction
Trust modelCentrally manage securityPod Security Admission
Use single sign-on (SSO) in the operations centerConfigure SAMLIntegrate Microsoft Entra IDSet up SSO Relay for CloudBees CI single sign-on
Role-based access control (RBAC)Example RBAC configurationsRBAC auto-configurer pluginRestrict job triggersAccess controls on the operations centerAccess controls on controllersOperations center specific permissionsAuthentication mappingDelegate administrationFoldersFolders Plus
Authenticate automated processes with CloudBees CI service accountsService account scope and visibilityGet started with CloudBees CI service accountsService accounts CLIService account API endpointsCreate and use service accounts with Configuration as CodeService account security considerations
Restricted credentialsInjecting secretsEnhanced credentials maskingExternal secrets managementCyberArk credential providerManage secrets with HashiCorp VaultShared credentials administrative monitor
Cross-controller triggersTest the SSH connection to an agentManage build agents with Nodes PlusExtended security settings
Beekeeper security warningsCloudBees administrative monitorsSecurity recommendationsData collection
Replace an expired certificateList of URLs that need accessBlock access to URL patternsServe resources from JenkinsVerify Helm charts with a signature
Introduction
Introduction$JENKINS_HOME directoryBest practices for backup and restoreBack up $JENKINS_HOME manuallyBackup a Role-Based Access Control configurationRestore backup files manuallyRestore credentialsConfigure backups using the CloudBees Backup pluginSchedule backups in the CloudBees Backup pluginRestore backups created with the CloudBees Backup pluginBackup and restore on KubernetesBackup and restore on AWSBackup and restore Kubernetes cluster resources using VeleroRun backups using cluster operations
IntroductionConfigure multiple client controllers with the Jenkins CLI toolConfigure an alias for the Jenkins CLI toolConfigure Jenkins CLI tool with non-TrustStore TLS certificates
CloudBees Inactive Items Plugin
Jenkins Health Advisor by CloudBees
CloudBees Pull Request Builder for GitHub plugin
Count and monitor user licenses with the CloudBees User Activity Monitoring plugin
Count and monitor user licenses with the CloudBees User License Counting (ULC) system
Introduction
CasC fundamentalsCasC requirementsCasC permissionsRecommended workflow
IntroductionExport a CasC configurationTransform an exported bundleAdvanced CasC bundle configurationValidate a CasC bundle
CloudBees CI CasC for operations centersGet started with Configuration as Code for the operations centerConfigure the operations center on modern platforms using CasCConfigure the operations center on traditional platforms using CasCRetrieve bundles using an SCMTroubleshoot CasC
CloudBees CI CasC for controllersGet started with Configuration as Code for controllersDistribute CasC bundles to controllers from your operations centerAdd controller CasC bundles to the operations centerConfigure bundle availability for controllersSet up a client controller using CasCSet up a managed controller using CasCSet up a managed controller using the CasC Controller Bundle ServiceAdvanced topicsTroubleshoot CasC for controllers
IntroductionUpdate a CasC bundleBundle update timingReview the CasC update log
IntroductionPlugin management with CasCDetermine plugin compatibility using CasCCreate an alternate plugin download site
Create items using CasC
Configure RBAC with CasC
CasC CLI commands
CasC HTTP API
Introductionbundle.yaml file referencejenkins.yaml file referenceplugins.yaml file referenceplugin-catalog.yaml file referenceitems.yaml file referencerbac.yaml file referencevariables.yaml file reference
HA on EKS Performance Test
Support policies

Gateway API features required by CloudBees CI

4 minute read
CloudBees Beta

This feature is available as a beta release and is subject to change without notice. CloudBees recommends stringent testing in a development environment and a complete review of the documentation and architecture before using it in production.
Modern Cloud Platforms

This content applies only to CloudBees CI on modern cloud platforms.

CloudBees CI on modern cloud platforms uses specific features from the Kubernetes Gateway API specification. Verify that your chosen implementation supports the features below for CloudBees CI on modern cloud platforms to function correctly. If a Gateway API feature is not listed here, it is not required for CloudBees CI on modern cloud platforms. For the full list of tested and conformant implementations, refer to Kubernetes Gateway API supported implementations.

This list reflects CloudBees CI on modern cloud platforms requirements as of the current release. Future versions may require additional Gateway API features. Check these requirements when upgrading CloudBees CI on modern cloud platforms or changing your Gateway API implementation.

CloudBees CI on modern cloud platforms requires a Gateway API implementation that achieves GATEWAY-HTTP conformance. All Core features (such as HTTPRoute and cross-namespace routing) are guaranteed by this conformance profile and do not need per-feature verification. Refer to Core features for details on how CloudBees CI on modern cloud platforms uses Core features.

The following table lists the Extended features CloudBees CI on modern cloud platforms requires beyond the Core conformance baseline. Extended features are portable but not universally supported; implementations that do not support an Extended feature may silently ignore it. Verify that your implementation supports these features before deploying CloudBees CI on modern cloud platforms.

Table 1. Gateway API feature requirements
Feature Required Purpose

HTTPRoute Path Redirect

Conditional

Redirects the root path to the operations center context path (for example, / to /cjoc/). Only needed for path-based routing, not subdomain-based routing.

Session persistence

Conditional

Provides cookie-based sticky sessions for High Availability (HA) and Horizontal Scalability (HS) controllers. Not needed if you do not use HA/HS controllers.

HTTPRoute Scheme Redirect

Recommended

Redirects HTTP to HTTPS. Customer-managed; not created by CloudBees CI on modern cloud platforms.

HTTPRoute Backend Protocol WebSocket

Conditional

Required for external WebSocket-based agents connecting through the Gateway.

Use the Gateway API implementation wizard or the implementations page to check which features your implementation supports. Focus on the GATEWAY-HTTP conformance profile. CloudBees CI on modern cloud platforms does not require the GATEWAY-TLS, GATEWAY-GRPC, MESH-HTTP, or MESH-GRPC profiles.

Core features

All Core features are guaranteed by GATEWAY-HTTP conformance; you do not need to verify them individually. This section describes how CloudBees CI on modern cloud platforms uses Core features.

HTTPRoute

CloudBees CI on modern cloud platforms creates HTTPRoute resources to route traffic to the operations center, managed controllers, and infrastructure services (for example, CasC retriever, CasC bundle service, hibernation monitor, and SSO relay). The following HTTPRoute capabilities are used:

  • parentRefs: Each HTTPRoute references the customer’s Gateway resource by name and namespace. The optional sectionName field targets a specific Gateway listener.

  • Hostname matching: HTTPRoute resources specify hostnames to match incoming requests to the correct service.

  • Path matching: HTTPRoute resources use PathPrefix and Exact path types to route requests.

  • Backend references: HTTPRoute resources reference Kubernetes Service resources as backends.

Gateway with cross-namespace routing

Cross-namespace routing is a Core feature, but it requires explicit configuration on your Gateway resource:

  • Cross-namespace routing: allowedRoutes.namespaces.from must be set to Selector (or All for development environments). CloudBees CI on modern cloud platforms deploys HTTPRoute resources in application namespaces that must attach to a Gateway in an infrastructure namespace. Without cross-namespace routing, HTTPRoute resources created by CloudBees CI on modern cloud platforms fail to attach to the Gateway.

  • Namespace label selector: When using Selector, namespaces containing operations center or managed controller services must have the matching label (for example, cloudbees.com/gateway-routes: enabled).

For detailed Gateway verification steps, refer to Verify Gateway resource.

Extended features

Extended features are portable across implementations that support them but are not universally available. Verify that your Gateway API implementation supports these features before deploying CloudBees CI on modern cloud platforms.

HTTPRoute Path Redirect (path-based routing only)

The HTTPRoute Path Redirect (HTTPRoutePathRedirect) enables the RequestRedirect filter with path replacement. When using path-based routing, CloudBees CI on modern cloud platforms creates an HTTPRoute rule that redirects the root path (/) to the operations center context path (for example, /cjoc/) with an HTTP 301 status code. This redirect is not needed for subdomain-based routing, where each service has its own hostname.

Most implementations that achieve GATEWAY-HTTP conformance support this feature.

Session persistence (HA/HS controllers only)

CloudBees CI on modern cloud platforms uses the sessionPersistence field on HTTPRoute rules (GEP-1619) to provide cookie-based sticky sessions for HA and HS controllers. When a controller is configured for replication, CloudBees CI on modern cloud platforms automatically adds session persistence to its HTTPRoute.

This feature requires:

  • Experimental channel CustomResourceDefinitions (CRDs): The sessionPersistence field is only available when Gateway API experimental channel CRDs are installed. Refer to Verify experimental channel CRDs.

  • Implementation support: Not all Gateway API implementations support sessionPersistence. Implementations that do not support it silently ignore the field, which means sticky sessions are not enforced and HA controllers may not function correctly.

For the current status of sessionPersistence support across implementations tested by CloudBees, refer to session persistence implementation support.

HTTPRoute Scheme Redirect

The HTTPRoute Scheme Redirect (HTTPRouteSchemeRedirect) enables the RequestRedirect filter with scheme replacement. CloudBees CI on modern cloud platforms does not manage HTTP-to-HTTPS redirects. CloudBees recommends configuring an HTTPRoute with a RequestRedirect filter that changes the scheme from http to https to prevent users from accessing CloudBees CI on modern cloud platforms over unencrypted HTTP.

For an example configuration, refer to Recommended Gateway-level routing configuration.

HTTPRoute Backend Protocol WebSocket (external agents only)

The HTTPRoute Backend Protocol WebSocket (HTTPRouteBackendProtocolWebSocket) enables WebSocket protocol support for backend connections. CloudBees CI on modern cloud platforms requires this feature when external WebSocket-based agents connect through the Gateway.

Provider-specific considerations

Some Gateway API implementations require additional configuration beyond the standard Gateway API specification. Provider-specific requirements identified by CloudBees are listed below.

Table 2. Provider-specific Gateway API considerations
Implementation Considerations

Istio

Does not support sessionPersistence (GEP-1619). Requires an Istio DestinationRule with consistentHash for HA/HS controllers. Refer to Configure sticky sessions with Istio.

Google Kubernetes Engine (GKE) Gateway Controller

Does not support sessionPersistence (GEP-1619). Requires vendor-specific configuration for sticky sessions. May require additional health check configuration for backend services.

Azure Kubernetes Service (AKS) Application Gateway for Containers

Does not support sessionPersistence (GEP-1619). Requires vendor-specific configuration for sticky sessions.

Traefik

Does not support sessionPersistence (GEP-1619). No vendor-specific workaround is currently available. Refer to BEE-71301 for tracking.

This table is not exhaustive. If your Gateway API implementation requires additional configuration, refer to your implementation’s documentation or contact CloudBees Support.
Kubernetes Gateway API supported implementations
Verify Kubernetes Gateway API prerequisites