CloudBees CI release highlights

What’s new in CloudBees CI 2.492.3.5

Watch video

Critical Issues

WinConnection class cannot be instantiated in FIPS mode

Breaking change: Any Windows agent will stop working in FIPS mode if configured with WinRM (Windows Remote Management).

The Amazon EC2 plugin (ec2-plugin) bundles the com.hierynomus:smbj library, which is not FIPS compliant. Therefore, Windows Agents will no longer work in FIPS mode because the class which uses the aforementioned library cannot be created.

As an alternative, use an SSH server and the Unix Launcher. Refer to the following steps:

  1. Enable the SSH server.

  2. Use the UNIX template.

  3. The plugin will connect to the Windows machine using Mina SSH, but an init script must not be used as it will create a .sh file

    • If an init script is desired, then Git Bash is the simplest option and the installer will create the file association between .sh extension and Git Bash making it possible to use an init script.

Do not use the init script (it must be empty) if there is no shell interpreter configured. Otherwise, Windows will continue to hang.

Upgrade Notes

Breaking change: The minimal supported Kubernetes version is 1.28.

Starting with this release, CloudBees CI requires Kubernetes 1.28 or later. Older Kubernetes versions 1.27 and below are no longer supported.

If you are using Kubernetes 1.27 or earlier, you must upgrade to at least Kubernetes 1.28 before upgrading to this CloudBees CI release.


CloudBees Software Delivery Automation Helm charts are deprecated

In previous CloudBees CD/RO releases, a unified CloudBees Software Delivery Automation Helm chart was delivered to install CloudBees CI, CloudBees CD/RO, and CloudBees Analytics in Kubernetes environments. However, starting with CloudBees CD/RO release v2025.03.0, the CloudBees Software Delivery Automation Helm chart was deprecated and is not supported for future releases.

If you are currently using the CloudBees Software Delivery Automation Helm charts, CloudBees has provided automation scripting and instructions to help migrate your environments. For more information, refer to KBEC-00522 - Migrate from CloudBees Software Delivery Automation Helm chart to product Helm charts.


Addition of the jsoup API (jsoup-api) plugin to the CloudBees Assurance Program envelope

With this release, the jsoup API plugin (jsoup-api) is now part of the CloudBees Assurance Program envelope. This plugin was added to CloudBees Assurance Program because of the Analysis Model API (analysis-model-api) plugin dependency on jsoup. The Analysis Model API plugin was also added to CloudBees Assurance Program.


Operations center CloudBees Assurance Program plugin changes since 2.492.2.2

The following plugins have been added to the operations center CloudBees Assurance Program since 2.492.2.2:

  • Amazon Web Services SDK 2 :: Core (aws-java-sdk2-core)

  • Amazon Web Services SDK 2 :: EC2 (aws-java-sdk2-ec2)


Controller CloudBees Assurance Program plugin changes since 2.492.2.2

The following plugins have been added to the controller CloudBees Assurance Program since 2.492.2.2:

  • Amazon Web Services SDK 2 :: Core (aws-java-sdk2-core)

  • Amazon Web Services SDK 2 :: EC2 (aws-java-sdk2-ec2)

  • jsoup API Plugin (jsoup)


New Features

CloudBees CI on modern cloud platforms now supports Kubernetes 1.32 and Red Hat OpenShift 4.18

CloudBees CI on modern cloud platforms now supports Kubernetes 1.32 on Azure Kubernetes Service, Amazon Elastic Kubernetes Service, Google Kubernetes Engine, and Red Hat OpenShift 4.18. For more information, refer to Supported platforms for CloudBees CI on modern cloud platforms.

Feature Enhancements

The SynchronousResumeNotSupportedException error now includes the name of the step that failed

Some steps in a Jenkins pipeline can’t resume after a controller restart. If one of these steps fails, the build log displays a SynchronousResumeNotSupportedException error.

Previously, the log didn’t specify the failing step. Now, the log identifies the step’s function name and suggests using retry (Scripted pipelines) or retries (Declarative pipelines). This enhancement reduces debugging time, particularly in complex pipelines or those that use shared libraries.


Display cluster up-time in the High Availability (HA) status page

The High Availability (HA) status page now displays the up-time for the High Availability (HA) cluster. This indicates how long the cluster has been running with one replica.


High Availability (HA) controllers display a warning message if ReplicationServletListener is not enabled

When the High Availability (HA) plugin is active, the com.cloudbees.jenkins.replication.warhead.ReplicationServletListener.enabled property should be set to true. This property might have a different value if not configured when starting a High Availability (HA) replica in a traditional setup. Alternatively, in a modern setup, the controller might have been in High Availability (HA) mode but was migrated to non-High Availability (HA) mode without disabling or uninstalling the High Availability (HA) plugin. A warning now appears for these inconsistencies.

Conversely, if the -Dcom.cloudbees.jenkins.replication.warhead.ReplicationServletListener.enabled=true option is specified in a non-High Availability (HA) setup, which is unnecessary, a warning message is printed in the log. The message advises removing the option and restarting.


Fixed the milestone step incompatibility with High Availability (HA)

Previously, Pipeline Milestone steps didn’t work in High Availability (HA) controllers with multiple replicas. The milestone step is now fully compatible with controllers running in High Availability (HA) mode.


Added an admin monitor to notify administrators about duplicate GitHub events.

A new admin monitor alerts Jenkins administrators if the controller receives duplicate GitHub events. Although duplicates don’t affect functionality, they slightly increase performance overhead.


The CloudBees Pipeline Explorer contextual menus have been refactored

In CloudBees Pipeline Explorer, the contextual menus in the log view, map view, and filter by tree view panel have been refactored to improve the user experience.


CloudBees Pipeline Explorer supports restarting builds from checkpoints

The CloudBees CI Groovy Checkpoint plugin (workflow-cps-checkpoint) now supports restarting a build from a checkpoint directly from CloudBees Pipeline Explorer.


CloudBees Pipeline Explorer now supports restarting builds from a stage

CloudBees Pipeline Explorer now supports restarting a build directly from a stage in the log view and map view.


UI changes in Configuration as Code bundle selection for connected controller

New radio buttons have been added to allow users to explicitly choose the source when provisioning a new connected controller through Configuration as Code. Users upgrading from a previous version of the plugin will have their configuration migrated automatically.

Resolved Issues

fsGroupChangePolicy set by default to OnRootMismatch for managed controller Provisioning

managed controllers are now created by default with fsGroupChangePolicy set to OnRootMismatch. This change prevents unnecessary file ownership changes, improving startup time.


Check License Info asynchronously for managed controller configuration changes

Previously, when you made configuration changes to a managed controller from the operations center, the license information was checked and updated synchronously if required. This caused delays in form submissions, especially under high load. Now, the license check and update process is asynchronous, which improves responsiveness.


Adding rotated custom logs to the support bundle for High Availability (HA) controllers

The support bundle generated for controllers running in High Availability (HA) mode now includes all rotated custom logs. The rotated logs are merged and aggregated, with each entry tagged by the replica name.


plugins.yaml file incorrectly handled file-protocol URLs

The plugins.yaml file handled file:///path/to/plugin.jpi URLs but not the equivalent file:/path/to/plugin.jpi URLs. It might also have mishandled URL encoding paths with spaces or other meta characters.


StackOverflowError resuming Pipeline builds

Under specific circumstances, complex Pipeline builds could fail to resume after a controller restart, resulting in a StackOverflowError in deserialization code. This issue stemmed from excessive nesting of program objects, especially when using Declarative syntax.

Now, the stack depth added by the Declarative program structure has been reduced. This may not prevent the error in all situations. Some scripted pipelines using complex recursive function calls might still be affected. The issue is most likely to occur when mixing scripted and Declarative syntax. Avoid mixing syntax; If Declarative syntax doesn’t provide the necessary expressiveness, remove the pipeline {} block and switch to Scripted syntax.

If the error persists after this release and simplifying the pipeline script isn’t feasible, consider increasing the maximum stack size for the Java Virtual Machine (JVM). Note that this workaround increases memory usage.


If High Availability (HA) build adoption is slow, permanent agents can be acquired by other builds

When a High Availability (HA) controller replica exits, any builds it was running are offered for adoption by other replicas. Any agents currently in use by that build remain reserved for it. If the adoption process is slow (for example, if the build record takes a long time to load), a permanent (non-cloud) agent occupied by that build might incorrectly be considered available for other builds. This could result in workspace corruption as unrelated tasks run. If several minutes pass, the original build might abort.

Now, the High Availability (HA) controller records agent usage by specific builds (or build stages), ensuring that other replicas do not allow the agent to be used by any build except the same one once it is adopted.


In High Availability (HA) controllers, load balanced builds could sometimes get scheduled twice

On a HA controller, when a job configured to disable concurrent builds started a new build, a second build could sometimes be scheduled after the first build completed. Now, duplicate builds no longer occur.


CloudBees Pipeline Explorer tree view was not displayed under certain conditions

If the CloudBees Pipeline Explorer tree view was filtered and then manually closed, a display issue could occur after a refresh (either a manual refresh or a refresh due to auto-polling) that prevented the tree view from displaying.


CloudBees Pipeline Explorer browser error related to aria-hidden attribute

When opening a contextual menu from a CloudBees Pipeline Explorer stage, a browser error related to an aria-hidden attribute may have been returned. This issue has been resolved.


Display issue fixed in the CloudBees Pipeline Explorer map view

A build display issue has been fixed for downstream builds in the CloudBees Pipeline Explorer map view.


CloudBees Pipeline Explorer log view links and content could not be copied after choosing to deselect a line or range of lines

In CloudBees Pipeline Explorer, copying the URL or log content to the clipboard now works correctly, even after selecting and then deselecting a line or range of lines in the log view.


Controllers configured to use Websockets may not have reconnected to the operations center after a restart

If controllers were configured to use Websockets to connect to the operations center and the controllers or operations center were restarted, the controllers may not have automatically reconnected to the operations center and an error may have been returned. This was due to an asynchronous call when establishing the channel, that resulted in a race condition between closing the channel and reinitializing. Upon connection request, controllers now successfully reconnect to the operations center, and an error is no longer returned.


Hardening of file permissions for the Operations Center Context plugin (operations-center-context)

Previously, the Operations Center Context plugin (operations-center-context) may have used temporary directories with weak file permission to transfer files. This issue has been resolved. Appropriate file permissions are now enforced for temporary directories to transfer files.


Plugins that are not in the CloudBees Assurance Program are only downloaded when the CasC 2.0 bundle is initially applied

When using CasC 2.0 (apiVersion:2.0), if there are non-CloudBees Assurance Program plugins installed on the controller using the plugin.yaml file, the plugins are no longer unnecessarily downloaded every time the CasC bundle is applied.


User properties now propagate upon successful sign in with an API token

User properties were propagated from the operations center to controllers when signing in with a username and password using SSH. However, this did not occur when interacting with controllers that used a username and an API token. Therefore, for non-interactive users (for example, service accounts) that only called the Jenkins API using API tokens, if the operations center was unavailable, these service accounts could no longer sign in to controllers. This issue has been resolved, so user data propagation is now also performed when using API tokens.


GitHub plugin settings would not load on startup

The GitHub plugin configuration failed to load during the operations center startup. Refer to GitHub Plugin settings not loaded on startup after upgrading for more information.


Shared Clouds UI no longer supports renaming

Previously, the Shared Clouds UI permitted configuration renaming, although it was unsupported. This caused errors. The UI is now fixed and configuration renaming is no longer supported.

Known Issues

Duplicate plugins in the Operations Center Plugin Manager UI

When you search for a specific plugin under the Available tab in the operations center Plugin Manager, the search results show duplicate entries for the plugin.


The controller and operations center fail to start when upgrading CloudBees CI

When upgrading or restarting CloudBees CI, the controller or operations center fails to start and returns a Messaging.afterExtensionsAugmented error. The operations center can also fail to start with an OperationsCenter.afterExtensionsAugmented error. Refer to CloudBees CI startup failure due to IndexOutOfBoundsException related to corrupt messaging transport files for a workaround for this issue.