CloudBees CI on modern cloud platforms 2.303.3.3

Multiple security vulnerabilities have been identified in the Jenkins protocol that is used for communication between controllers and agents, as well as between the operations center and any connected controllers.

Messages (“Callables”) in the Jenkins protocol that are used for communication between agents, controllers, and the operations center check the role of the current side of the communication channel to determine whether they are allowed to be executed there.

The CasC bundle access token that is used to authenticate the request between the controller and the operations center server was checked in non-constant time, resulting in a potential security vulnerability.

A new Export CasC item option has been added to the left pane of the operations center and controller dashboards, allowing you to export individual Configuration as Code (CasC) items in YAML format. The Export CasC item for the operations center is a Preview feature. For more information, refer to Creating items with CasC for controllers and Creating items with CasC for the operations center.

When a Cluster Operation is created in an operations center instance, it is now possible to export its configuration in a YAML format that can be used to create and configure Cluster Operations items using CasC. Cluster Operations items for the operations center is a Preview feature. For more information, refer to Creating items with CasC for the operations center.

For controllers, it is now possible to create Backup and Restore items using CasC. You can also export an existing Backup and Restore item configuration in YAML format, and this can be used to create and configure a Backup and Restore item using CasC. For more information, refer to Creating items with CasC for controllers.

A new optional root property can be added to the items.yaml file to define the root path for controller item creation. This allows you to create items using the defined root path instead of the root of the operations center. For more information, refer to items.yaml.

A new casc-items-create-items CLI command has been added to create items based on a CasC items.yaml file. For more information, refer to Configuration as Code (CasC) CLI.

The CloudBees Restricted Credentials plugin enables an additional Jenkins credentials store that lets you define restricted credentials with built-in access control using the full item names.

The Amazon Web Services (AWS) SDK plugin was very large because of the number of services AWS provides. However, CloudBees CI doesn’t require all of the modules in the Amazon Web Services SDK.

The CasC bundle.yaml file now allows you to include a folder or subfolder in any section, without requiring that you list each individual YAML file contained within the subfolder. Previously, if a YAML file was added or removed from the bundle, it also had to be added or removed from the bundle.yaml file descriptor.

The following CLI commands have been added for CasC, to correspond with functionality previously implemented in the user interface.

The following HTTP API endpoints have been added for CasC, to correspond with functionality previously implemented in the user interface.

When exporting the current CasC configuration, plugins are now sorted alphabetically in the plugins.yaml and plugin-catalog.yaml files.

Previously, HTTP communication was managed by an old version of async-http-client.

Previously, HTTP communication was managed by an old version of async-http-client.

When you enabled hibernation in multiple namespaces, the routes that were created shared the same host and path. This could cause conflicts in Kubernetes.

When sending a CasC HTTP API endpoint and an error message was returned, it included a stack trace exception.

If the CasC ‘items.yaml’ file contained an empty environment variable for a Folder, Multibranch Pipeline job, GitHub Organization, or a Bitbucket Team/Project item and the current CasC configuration was exported, the environment variable was exported as - {}, and the YAML could not be used to create a new item.

If Reload Configuration was selected from the CloudBees Configuration as Code export and update screen or if the operations center instance was restarted, Folder and Pipeline job properties defined in the operations center CasC items.yaml file were duplicated.

When the controller’s current configuration was exported, the apiUri field was not included in the exported items.yaml file.

This issue has been resolved. When exporting the current CasC controller configuration, folders are included in the exported items.yaml file and allowed items do not have to be restricted.

If there was any update in the internal CasC bundle storage during the instance initialization process, an event was sent but was not processed, and an error was returned.

When exporting the current CasC configuration for the operations center from the Configuration as Code export and update screen, a NullPointerException was returned.

Some data, such as job names, was collected without being anonymized.

Some Move/Copy/Promote operations failed with an error when you attempted to use them between two non-local controllers.

In some situations, user permissions were not resolving properly when operations center SSO was enabled and impersonation was performed on a controller. Some plugins use impersonation to check whether a user other than the one who is signed in has certain permissions. This issue was observed with the Email Extension plugin, for example, when it would not send emails to a user because the user incorrectly appeared to not have permissions to view the item.

The CloudBees Jenkins Enterprise License Entitlement Check plugin was loading certificates from the wrong location. This could have resulted in signature validation problems in a future release.

Users were not distinguished from groups in the role-based access control (RBAC) configuration, leading to some potential misconfigurations when a user has the same name as a group. Proper credentials may not have been applied.

Occasionally, builds that are still in progress have a build result. This can be due to a modification to currentBuild.result in a Pipeline, a Pipeline step like junit, or a Freestyle builder. Once the build result was set, the CloudBees Backup plugin considered these builds to be complete and could attempt to back them up, even though they were not yet completed.

CloudBees is updating terminology to remove offensive text. During this initiative, "controller" replaces "master," "agent" replaces "slave," "allowlist" replaces "whitelist," and "denylist" replaces "blacklist."

If GitHub does not generate a merge commit SHA for a pull request within four seconds, then pull request builds may not be created.

The Amazon Web Services (AWS) SDK plugin (aws-java-sdk) was split into multiple fine-grained plugins to reduce the size of the CloudBees CI packages. As a result, it is no longer a part of the CloudBees Assurance Program. The plugin is not automatically uninstalled from your CloudBees CI instance and it could lead to an inconsistent state when you upgrade.