CloudBees CI on modern cloud platforms 2.204.3.7

While administrators would like to enable their developers to use pipelines freely, they still may need to set some restrictions based on industry-specific regulatory compliance or general best practice principles. Pipeline Policies provide a central way to enforce best practices across pipeline projects. The plugin uses runtime validation that works for both scripted and declarative pipelines, allowing administrators to include warnings or block the execution of pipelines if policy rules are violated. This initial release of Pipeline Policies is aimed at helping users avoid antipatterns that can damage the stability of their masters.

The 'S3 Publisher plugin' is now included in the CloudBees Assurance Program to guarantee its quality and integration inside CloudBees products. This plugin applies to all masters in CloudBees Jenkins Enterprise, CloudBees Jenkins Distribution, and CloudBees Core. It does not apply to the Operations Center.

The CloudBees Analytics Plugin collects metrics for analysis to help CloudBees make decisions about future product direction. The collected data is used to evaluate patterns of usage of our products.

Helm 3 is now the recommended method to install CloudBees Core on modern cloud platforms. Installation via the CloudBees installer has been deprecated as of the release of CloudBees Core on modern cloud platforms 2.204.3.4.

In prior versions of CloudBees Core on modern cloud platforms, OperationsCenter.HostName was required when you installed CloudBees Core using Helm.

This enhancement provides support for Google service account credentials when connecting to remote Kubernetes clusters running on GKE.

Kubernetes Pod Security Policies can now be enabled by providing --set PodSecurityPolicy.Enabled=true when installing or upgrading the Helm chart.

When using OperationsCenter.Platform=aks, the storage class now defaults automatically to managed-premium in order to leverage solid state drives (SSDs).

The option rbac.installCluster=false was not working as expected and cluster-wide resources were still generated.

When using pod templates with a dynamic label, the generated name is long and overflows the widget.

On GKE, warnings were displayed about defined ingresses.

When using helm template targeting OpenShift, Ingresses are generated instead of Routes. The reason is since 2.204.1.3, the chart relies on capabilities instead of OperationsCenter.Platform to determine whether the target is OpenShift or Kubernetes.

The extra-configmap.yaml suffered a rendering problem when a label was not specified.

Kubernetes resources for Operations Center and Managed Masters defined “liveness probes”, which would ask a controller to restart the pod if it stopped responding to basic web requests, but no “readiness probes” to determine when a pod was up and running. This lapse would cause misleadingly positive statuses from Kubernetes tools for Jenkins-based pods that had actually just started their containers. It also prevented use of the native Ingress system on GKE.

Operations Center and Managed Master WARs for CloudBees Core on modern cloud platforms defined supposedly optional profiles for Kubernetes functionality, but then unconditionally enabled these profiles. Also, the Setup Wizard offered the option of installing a number of plugins that were actually installed unconditionally.

Managed Masters in operations center, such as Team Masters, would not hibernate correctly.

This issue affected version 2.204.3.4, and is fixed in 2.204.3.7.

If a master was connected to Operations Center while its global configuration was being saved via the web interface, the master→operations center communication thread and the HTTP request thread would deadlock. This deadlock would result in a master that could not communicate with Operations Center and eventually, if more global configuration saves were performed, a master that was unresponsive to the HTTP(s) requests.

Users who were assigned only the default Browsers role were unable to see all views, such as the pull requests tab of a GitHub multibranch project.

When an RBAC group configured on a View was modified, the group configuration was removed.

There was not enough information on job logging when using SFTP backup. With this fix, meaningful information has been added.

Using the checkpoint step in a Pipeline incorrectly caused the following warning to be written to the build log: "expected to call WorkflowScript.checkpoint but wound up catching suspend?; see: https://www.jenkins.io/redirect/pipeline-cps-method-mismatches/".

The Display URL API plugin adds environment variables to builds containing the URL of the build in Jenkins. In order to compute the value of these variables, the plugin previously needed to load a large number of classes for each build, which could lead to performance issues. With this fix, the plugin no longer needs to perform significant class loading when contributing environment variables to builds.

Opening the Blue Ocean View with a Microsoft Edge or Internet Explorer browser failed. With this fix, the packaging of the Server Sent Events (SSE) Gateway Plugin no longer causes the Blue Ocean View to fail in IE and Microsoft Edge browsers.

Plugin updates

CloudBees Security Advisory 2020-03-09