CloudBees CI on modern cloud platforms 2.568.2.37664

Atlassian is deprecating App Passwords for Bitbucket Cloud, with brownouts already in effect ahead of full removal on July 28, 2026. Starting with version 937.3.4, the Bitbucket Branch Source plugin (cloudbees-bitbucket-branch-source) no longer accepts App Password credentials for Bitbucket Cloud. Atlassian recommends migrating to API tokens. To configure the replacement credential in your controller, refer to the Bitbucket Branch Source plugin user guide.

To streamline the build process, the git-lfs binary is now installed from UBI packages instead of directly from upstream sources. Future updates to git-lfs will be limited to those provided by Red Hat.

As noted in the CloudBees CI 2.462.3.3 release notes, the jenkins-agent ConfigMap has been removed from the CloudBees CI Helm chart. You must migrate its configuration to the new idiom provided by the Kubernetes plugin (kubernetes):

CloudBees CI now supports OpenID Connect (OIDC) authentication for service accounts, in addition to the static token authentication introduced in CloudBees CI 2.541.3.36065. OIDC enables keyless, machine-to-machine authentication, eliminating the need to manage long-lived tokens. A service account can specify one or more OIDC configurations, each defining expected claims such as an issuer URL accessible to CloudBees CI. When a system presents a JSON Web Token (JWT) to authenticate, CloudBees CI verifies its signature against public keys discovered from the issuer and validates the claims. With OIDC, service accounts can authenticate from GitHub Actions, Kubernetes service accounts, or other controllers running Jenkins or CloudBees CI.

When using Kubernetes agents with multiple containers in the pod, the container step (or, in Declarative syntax, using the defaultContainer option) is often used to allow sh steps to be run inside a container other than the one hosting the Jenkins agent. The traditional implementation of this system required the Jenkins controller to make a WebSocket connection to the Kubernetes API server, effectively running kubectl exec. This caused robustness issues at scale. Now you can select the Use active containers option on the Kubernetes cloud (activeContainers: true in CasC) to use an alternate implementation that passes all messages through the Jenkins Remoting channel instead of a WebSocket connection to the Kubernetes API server.

Custom YAML snippets for controller provisioning can now use the ${workloadKind} macro, which resolves to StatefulSet or Deployment depending on whether High Availability (HA) is enabled. This eliminates the need to hardcode the workload type, allowing a single snippet to work correctly across both HA and non-HA controllers.

Previously, the Kubernetes Role-Based Access Control (RBAC) permissions for the operations center only included permission to create HTTPRoutes if the operations center was configured with a gateway. Now the permissions are granted if the Gateway API CRDs are available, regardless of the installation mode.

When restarting a build from a checkpoint, the user who initiated the restart is now displayed in the Console Output for audit traceability.

When hibernating managed controllers, requests to proxy or queue endpoints that included an Authorization header (as Jenkins sends for most HTTP calls) were incorrectly rejected with an HTTP 401 error before reaching the managed controller. This affected all proxy and queue endpoints, not only installations using Hibernation.Protected=true. This release resolves the issue by disabling proactive Kubernetes authentication on routes that do not require it, so Authorization headers are now passed through transparently to the managed controller.

When using the build step to trigger a downstream build from an upstream build, if either the upstream or downstream build was deleted after a controller restart, an exception is no longer printed to the system log.

Activity reports no longer double-count unique users when a user’s identity bridge record (for example, an email change) falls outside the requested time window.

Previously, if a controller shut down while handling a remote procedure call (RPC), such as a remote artifact copy, the call was not aborted correctly and hung until the timeout was reached. RPCs are now canceled, allowing the caller to receive a response when the controller is running again.

Reconnect logic was interfering with offline idle agents, preventing the idle termination logic from deleting them. EC2 agents that go offline with no builds assigned are now deleted after the idle termination period has been reached.

This release resolves a thread leak in the Bitbucket Branch Source plugin (cloudbees-bitbucket-branch-source) Credentials dropdown that caused OutOfMemoryError on instances with large credential stores. It also removes permanent credential blacklisting that caused credentials to disappear from the Credentials dropdown after transient timeouts until a controller restart.

If a remoteCopyArtifact step fails, the error message now includes more detail about why the step failed.

When two or more controllers were configured to use the CloudBees Cache Step plugin (cloudbees-cache-step) with the same Google Cloud Storage (GCS) bucket for workspace caching with different prefixes, the automated cleanup process on each controller listed all objects in the bucket, regardless of prefix. Any object whose key did not match the current controller’s expected prefix was treated as orphaned and deleted, including active caches written by other controllers. This caused cache misses on every build following a cleanup pass.

Previously, when SSO Relay was enabled and an HTTP proxy was configured, the SSO Relay check could fail because the internal relay request was routed through the proxy. This in-cluster call now bypasses the proxy, so the check works regardless of proxy configuration.

In Configuration as Code (CasC), bundles can reference entire directories instead of listing individual YAML files. Previously, the bundle validation endpoint incorrectly reported these bundles as invalid when a directory was referenced in the jcasc, rbac, items, or plugins sections of the bundle.yaml file, even though the bundles loaded correctly at runtime. Bundle validation now correctly handles directory references across all supported bundle sections.

Selecting Restart from this checkpoint multiple times before the server responded would queue multiple builds. The button now disables immediately on selection and re-enables if the request fails, preventing accidental duplicate restarts.

When you search for a specific plugin under the Available tab in the Operations center Plugin Manager, the search results show duplicate entries for the plugin.