Introduction
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionPre-installation requirementsInstallVerify Docker imagesUninstall
IntroductionSystem requirementsVerify Docker imagesInstall operations centerInstall client controllersVerify build componentsVerify WAR files
IntroductionHA fundamentalsGet ready for HAInstall HA on modern cloud platformsInstall HA on traditional platformsHA considerationsHigh Availability (active/passive) installation for CloudBees CI on traditional platforms
IntroductionWhat is FIPS and FIPS 140 compliance?Install CloudBees CI on modern cloud platforms in FIPS modeCAP plugin support in a FIPS 140-3 environmentConfigure the Apache™ Ant plugin for FIPS complianceConfigure the Pipeline Maven API plugin for FIPS complianceKnown FIPS incompatibilities with CloudBees CI on modern cloud platformsJenkins core: FIPS 140-3 compliant artifacts with caveatsJenkins core: Non-compliant classes and libraries
Introduction
IntroductionCommon Pipeline termsPipeline project typesCloudBees proprietary features for Pipelines
IntroductionPipeline development utilitiesDetermine plugin compatibilityPipeline best practices
IntroductionPipeline prerequisitesCreate your first PipelineSelect an agent for your Pipeline jobCreate a Pipeline from SCMCreate a Pipeline in the UIUnderstand and implement Pipeline as Code
IntroductionConfigure advanced Scripted PipelineConfigure the build stageConfigure the deploy stageConfigure optional step argumentsConfigure the test stageCreate a JenkinsfileCustomize parametersHandle failuresString interpolationUse multiple agentsWork with the environmentReuse configuration files
IntroductionManage artifacts with CloudBees Fast Archiving pluginEnable artifact traceability with fingerprintingTrigger jobs with a simple webhookRestore filesVisualize the PipelineInsert checkpointsSecure PipelinesConfigure Pipelines with user-scoped credentialsEnforce standards with Pipeline PoliciesSpecify a matrix of one or more dimensionsConvert a Freestyle project to a Declarative PipelinePipeline builds and High Availability (active/active)
IntroductionRestart aborted buildsLong-running buildsSkip next buildConsolidated Build View pluginCloudBees Quiet Start pluginCloudBees Template pluginCloudBees Workspace Caching
IntroductionTrigger a job with a notification event using Cross Team CollaborationEnable external notification events with external HTTP endpointsCluster-wide copy artifactsCluster-wide job triggers
IntroductionSet up a Pipeline Template CatalogDefine Pipeline Template CatalogsSet up a Pipeline TemplateParameter types in the template.yaml fileManage Multibranch Pipeline options in the template.yaml fileManage Pipeline Template Catalogs in bulkExample full Maven/Java app Jenkinsfile
IntroductionUse Declarative Pipeline syntaxUse Scripted Pipeline syntax
IntroductionBranch SourceBitbucketGitHubGitBranch Property StrategyExamples
CloudBees Docker Build and Publish pluginCloudBees Docker TraceabilityDocker Pipeline pluginCloudBees Docker Hub/Registry Notification plugin
Introduction
Introduction
IntroductionGet startedNavigate the operations center interfaceProvision agents in a separate Kubernetes cluster from a managed controllerProvision a controller in a different OpenShift project than the operations centerManage controllersManage controllers in specific Kubernetes namespacesMigrate an existing managed controller to High Availability (HA)Manage agentsManage SSH credentialsShared agentsShared configurationsShared cloud configurationTrigger restrictionsChange NFS storage locationQuiet startMove/Copy/PromoteCluster operationsInbound agentsUse Kaniko with CloudBees CIUse Buildkit with CloudBees CIUsing self-signed certificates in CloudBees CI on KubernetesSidecar injector for self-signed certificates on OpenShiftAuto-scale nodes on EKSEnable auto-scaling nodes on GKECloudBees Amazon Web Services Deploy EngineCloudBees Amazon AWS CLI pluginCloud Foundry CLI PluginIntegrate OpenShift CLICloudBees CI ServiceNow integrationCreate projects based on a GitHub repository structureUse GitHub App authenticationCreate Multibranch Projects and Organization Folders with large repositoriesWikiText pluginController Lifecycle Notifications Plugin
IntroductionGet startedNavigate the operations center interfaceManage client controllersMigrate from High Availability (active/passive) to High Availability (active/active) on CloudBees CI on traditional platformsManaging agentsManage SSH credentialsShared agentsShared configurationsShared cloud configurationTrigger restrictionsQuiet startMove/Copy/PromoteCluster operationsInbound agentsCloudBees CI ServiceNow integrationCreate projects based on a GitHub repository structureUse GitHub App authenticationCreate Multibranch Projects and Organization Folders with large repositoriesWikiText plugin
Introduction
Trust model
Pod Security Admission
Centrally manage security for controllers
CyberArk Credential Provider Plugin
CloudBees HashiCorp Vault Plugin
Enable advanced use cases: Cross-controller triggers and bulk operations
Restrict access and delegate administration with Role-Based Access Control
Example RBAC configurations
Create secure folders with Role-Based Access Control Auto Configurer
Restrict job triggers
Set up operations center-level access controls
Set up access controls on connected controllers
Test the SSH connection to an agent
Configure restricted credentials with the CloudBees Restricted Credentials plugin
Folders plugin
Folders Plus plugin
Inject secrets into builds
Manage build agents with the Nodes Plus plugin
Extended security settings
Enhanced credentials masking
Understand Beekeeper security warnings
Prevent unauthorized interaction between builds
Security recommendations
Use single sign-on (SSO) in the operations center
CloudBees CI integration with Microsoft Entra ID
Operations center specific permissions
Authentication mapping
Delegate administration
Data collection for the CloudBees Analytics Plugin
Modern DevOps external secrets management
Replace an expired certificate
List of URLs that need access
Block access to URL patterns using the CloudBees Request Filter Plugin
Serve resources from Jenkins
Verify Helm charts with a signature
Introduction
Introduction$JENKINS_HOME directoryBest practices for backup and restoreBack up $JENKINS_HOME manuallyBackup a Role-Based Access Control configurationRestore backup files manuallyRestore credentialsConfigure backups using the CloudBees Backup pluginSchedule backups in the CloudBees Backup pluginRestore backups created with the CloudBees Backup pluginBackup and restore on KubernetesBackup and restore on AWSBackup and restore Kubernetes cluster resources using VeleroRun backups using cluster operations
IntroductionConfigure multiple client controllers with the Jenkins CLI toolConfigure an alias for the Jenkins CLI toolConfigure Jenkins CLI tool with non-TrustStore TLS certificates
CloudBees Inactive Items Plugin
Jenkins Health Advisor by CloudBees
CloudBees Pull Request Builder for GitHub plugin
Count and monitor user licenses with the CloudBees User Activity Monitoring plugin
CloudBees CI Catalog Plugin - Catalog tool
Introduction
CasC fundamentalsCasC requirementsCasC permissionsRecommended workflow
IntroductionExport a CasC configurationTransform an exported bundleAdvanced CasC bundle configurationValidate a CasC bundle
CloudBees CI CasC for operations centersGet started with Configuration as Code for the operations centerConfigure the operations center on modern platforms using CasCConfigure the operations center on traditional platforms using CasCRetrieve bundles using an SCMTroubleshoot CasC
CloudBees CI CasC for controllersGet started with Configuration as Code for controllersDistribute CasC bundles to controllers from your operations centerAdd controller CasC bundles to the operations centerConfigure bundle availability for controllersSet up a client controller using CasCSet up a managed controller using CasCSet up a managed controller using the CasC Controller Bundle ServiceAdvanced topicsTroubleshoot CasC for controllers
IntroductionUpdate a CasC bundleBundle update timingReview the CasC update log
IntroductionPlugin management with CasCDetermine plugin compatibility using CasCCreate an alternate plugin download site
Create items using CasC
Configure RBAC with CasC
CasC CLI commands
CasC HTTP API
Introductionbundle.yaml file referencejenkins.yaml file referenceplugins.yaml file referenceplugin-catalog.yaml file referenceitems.yaml file referencerbac.yaml file referencevariables.yaml file reference
HA on EKS Performance Test
Support policies

Install CloudBees CI on modern cloud platforms on OpenShift

4 minute read

Make sure to review the OpenShift pre-installation requirements before you install CloudBees CI on modern cloud platforms. The supported Helm versions are listed in the Supported platforms page.

Typically, controllers are provisioned using a full context path such as http://acme.com/controller1 and you access the operations center using a URL like http://acme.com/cjoc, for example. However, because you cannot register more than one URL using the same domain in OpenShift, it is not possible to deploy multiple controllers using the same domain, for example, http://acme.com/controller1 and http://acme.com/controller2.

Therefore, for OpenShift CloudBees CI deployments, you can optionally configure subdomains to access controllers and the operations center. When you install CloudBees CI using the Helm chart, if you set the Subdomain attribute to true, you configure CloudBees CI to use a subdomain instead of the typical full context path. So, for example, you can access the operations center using http://cjoc.acme and the controllers using http://controller1.acme.com and http://controller2.acme.com.

The following steps allow you to install CloudBees CI with either HTTP or HTTPS support.

Installing CloudBees CI with HTTP or HTTPS support does the following:

  • Sets the OperationsCenter.HostName and optionally the OperationsCenter.Name (the default value is cjoc) fields.

  • Installs the Helm chart with the release name cloudbees-core and hostname cloudbees-core.example.com.

  • Deploys cloudbees-core on the OpenShift cluster in the default configuration.

CloudBees CI on modern cloud platforms uses Docker containers to run a cluster of computers within OpenShift. You can optionally Verify the CloudBees CI on modern cloud platforms Docker images to ensure their origin and authenticity.

Refer to one of the following procedures to install CloudBees CI on modern cloud platforms:

Install CloudBees CI on modern cloud platforms with HTTP support

To install CloudBees CI on modern cloud platforms with HTTP support:

  1. Type the following commands:

    Fields are case-sensitive: OperationsCenter.HostName is different than operationscenter.hostname. 
$ helm install cloudbees-core \ (1) (2)
               cloudbees/cloudbees-core  \ (3)
               --set OperationsCenter.HostName='cloudbees-core.example.com' \ (4)
▼
1 If you copy this command into your terminal don’t forget to remove the annotations at the end of each line.
2 The name isn’t required, but without it Helm will automatically generate a release name with random strings. For this reason, CloudBees recommends always set a release name.
3 In this example, the command is using the CloudBees Helm chart repository. If you downloaded the CloudBees CI Helm chart using helm fetch, replace cloudbees/cloudbees-core with the file name.
4 OperationsCenter.HostName field is required. The CloudBees CI Helm chart will not install without a HostName being provided.

After you have installed CloudBees CI, you should verify that it is installed correctly.

Install CloudBees CI on modern cloud platforms with HTTPS support

To install CloudBees CI on modern cloud platforms with HTTPS support:

  1. First, create a new OpenShift TLS certificate secret. For instructions, see the Secrets chapter of the Red Hat OpenShift documentation.

  2. Once an OpenShift certificate secret has been created, you can use the Helm chart to install CloudBees CI with SSL\TLS support by setting OperationsCenter.Ingress.tls.Enable to true.

  3. Type the following commands:

    Fields are case-sensitive: OperationsCenter.HostName is different than operationscenter.hostname. 
$ helm install cloudbees-core \
               cloudbees/cloudbees-core \
               --set OperationsCenter.HostName='{domain-name}'
               --set OperationsCenter.Route.tls.Enable=true \ (1)
               --set Agents.SeparateNamespace.Enabled=true|false \ (2)
               --set Agents.SeparateNamespace.Create=true|false \ (3)
▼
1 Here, you are setting OperationsCenter.Route.tls.Enable to true. This property turns on CloudBees CI HTTPS support.
2 Agents.SeparateNamespace.Enabled must have a value. If it is omitted, the installation or upgrade will fail. CloudBees strongly recommends that you use a separate namespace for agents (true), to prevent pods from accessing sensitive information on the operations center. If separate namespaces are not used, an administrative monitor is displayed in CloudBees CI.
3 Agents.SeparateNamespace.Create is optional. To create a separate namespace for agents, you can either allow Helm to create it automatically by adding the Agents.SeparateNamespace.Create=true argument, or create the namespace manually and label it with cloudbees.com/role: agents.

If you plan to enable services, such as the CasC Controller Bundle Service, using this installation command, you must enable them using the right properties for the helm install command.

For example, to enable the CasC Controller Bundle Service, you must add the --set CasCBundleService.enabled=true argument to the command.

Refer to different CloudBees CI setups and Set up a managed controller using the CasC Controller Bundle Service for more information on where and how to enable services, such as the CasC Controller Bundle Service, in your CloudBees CI installation.

After you have installed CloudBees CI, you should verify that it is installed correctly.

Verify the installation using helm status

Once the CloudBees CI install is initiated, Helm displays the status of the release.

The helm status command displays the status of the CloudBees CI release. This command is also executed after helm install and helm update commands are executed.

The helm status command displays three areas of information:

  • Current CloudBees CI Release

  • Kubernetes Resources

  • Release Notes

$ helm status
NAME:   cloudbees-core (1)
LAST DEPLOYED: Tue Apr 16 17:44:12 2019 (1)
NAMESPACE: default (1)
STATUS: DEPLOYED (1)
REVISION: 1
TEST SUITE: None
NOTES:
1. Once {OC} is up and running, get your initial admin user password by running:
  kubectl rollout status sts cjoc --namespace cloudbees-core
  kubectl exec cjoc-0 --namespace cloudbees-core -- cat /var/jenkins_home/secrets/initialAdminPassword
2. Visit https://acme.example.com/cjoc/

3. Login with the password from step 1.

For more information on running {CI-CLOUD}, visit:
xref:ROOT:index.adoc[{PRODUCT}]
▼
1 The first block provides a summary of the CloudBees CI release including:

  • Name of the release

  • The time released

  • The status of the release and

  • The namespace the release is installed in.

Sign in to your CloudBees CI installation

Now that you’ve installed CloudBees CI and operations center, you’ll want to see your system in action.

  1. Retrieve your administrative user password with the oc command:

    $ oc exec cjoc-0 -- cat /var/jenkins_home/secrets/initialAdminPassword
    ▼

  2. Open a browser client and navigate to http://cloudbees-core.example.com/cjoc/.

  3. Sign in with the username admin and the password you retrieved.

If you use the OpenShift Jenkins plugin, you can now configure it to work with CloudBees CI on modern cloud platforms. Refer to Red Hat’s OpenShift Jenkins plugin documentation for more information.
Pre-installation requirements
Verify Docker images