Managing Client Masters

This chapter describes how to manage your Client Masters through Operations Center.

Running on a TLS end-point

If the Operations Center instance is deployed on a TLS end-point, you must import the SSL certificate in the Java Keystore of the Client Master. In case the Client Master is deployed on a Tomcat web container, you might need to tell what keystore Jenkins is using. This should verify that Tomcat is using the correct keystore.

If it is not in the standard location ($JAVA_HOME/jre/lib/security/cacerts), add it as part of the Java arguments:$TOMCAT_LOCATION/cacert

Ensure that the certificates are correctly imported in both Operations Center and Client Master.

keytool -keystore /$JRE_HOME/lib/security/cacerts -v -list

The cacert file should have file system read permission granted to the operating system user running the Jenkins JVM.

Configuring a Client Master

This section describes how to configure a Client Master that has already been connected to your Operations Center instance.

To access a Client Master’s configuration:

  1. Ensure you are logged in to Operations Center as a user with the Client/Managed Master > Configure permission.

  2. From the Operations Center home page/Dashboard, click to the right of your configured Client Master (avoiding its name) and choose Configure from the dropdown menu.

    Client Master dropdown menu
  3. On the resulting Client Master configuration page, you can configure the following properties:

    • Description - Enter an optional description for the Client Master.

    • Health Reporting - When this check box is selected, health-related metrics from this Client Master are collected periodically. The default data collection period is once per minute, when data consumers are present (e.g. Weather columns or CloudBees Jenkins Analytics).

    • Analytics Reporting - When this check box is selected, report events and other metrics from this Client Master for CloudBees Jenkins Analytics are collected.

    • On-master executors - Select Enforce to specify the # of executors, which periodically ensures that the number of executors on the Client Master is the value specified in this # of executors field. Allowing items (i.e. projects or jobs) to execute directly on the Client Master is a security risk since such projects/jobs could potentially access the file system and the build records of all previously run projects/jobs (which may contain sensitive information). Therefore, set this value to 0 to prevent any items from being executing directly on the Client Master.

    • Master Owner - Specify the email address/es (one per line) of the "Owner/s" to be notified whenever this Client Master goes offline or changes state.
      Note: Clicking the Advanced button opens the Delay before notification field, which allows you to specify the number of minutes (a value between 1 and 60) between notifications.

    • Plugin Catalog - Select Specify a plugin catalog for this master to choose a plugin catalog to apply to this Client Master.

Setting up a proxy artifact repository

To maintain the security of Client Masters, as well as your build environment and infrastructure, it is usually a good idea to restrict your Client Masters' access to the Internet as part of a process known as air gapping. [airgap]

However, Pipelines and other types of build projects configured on your Client Masters and other CloudBees CI Masters are likely to require access to artifact repositories on the Internet, since artifacts from such external and/or trusted repositories may need to be integrated into these build projects' builds. Additionally, these external artifact repositories may also house custom plugins, which you can define and configure in a plugin catalog, to install these plugins on your Client Masters.

For instance, the publicly accessible repository is one such artifact repository to which the Jenkins Community publishes Maven artifacts, as well as hpi/plugin files.

Therefore, to provide your Client Masters with access to content housed by these external artifact repositories, set up a proxy artifact repository (with access to the Internet) internally within your organization’s infrastructure.

To set up a proxy artifact repository to an external artifact repository:

  1. Ensure you have installed an artifact repository system within your organization’s infrastructure, and ensure the artifact repository has access to the Internet.

  2. In your artifact repository system, configure your proxy artifact repository to your external or publicly accessible artifact repository.

    • For Sonatype’s Nexus Repository, configure the Proxy  Remote storage option in your new proxy artifact repository’s settings. Read more about configuring a proxy artifact repository in Nexus Repository using their Repository Management documentation, as well as the Proxy > Remote Storage sub-section of the Managing Repositories and Repository Groups section of this documentation.

    • For JFrog’s Artifactory, read more about configuring a proxy artifact repository in JFrog Artifactory using their Managing Proxies documentation.

Installing and updating Client Master plugins

Like how Operations Center makes it easy to install and update plugins, a Client Master also makes it easy to install and update plugins that extend its functionality. Refer to the Plugin management guide for details.

Configuring Client Masters through CLI

Jenkins allows some operations to be invoked through CLI, some of them being useful to configure Client Masters. Refer to Managing plugins from the Client Masters command line for details.

Configuring Plugin Catalogs

The Beekeeper Upgrade Assistant feature of the Manage Jenkins area of Operations Center is the main interface and entry point to the CloudBees Assurance Program.

Beekeeper Upgrade Assistant manages appropriate upgrades (and downgrades) of plugins on your Operations Center instance, in accordance with the CloudBees Assurance Program.

Refer to Configuring plugin catalogs for details.