CloudBees CI on modern cloud platforms 2.580.1.38223

Starting with this release, support for Red Hat OpenShift 4.22 has been added and support for Red Hat OpenShift 4.17 and 4.18 have been removed. If you are using Red Hat OpenShift 4.17 or earlier, you must upgrade to Red Hat OpenShift 4.19 or later before upgrading to this CloudBees CI release.

The following plugins have been added to the operations center CloudBees Assurance Program since 2.568.3.37913:

The following plugins have been added to the controller CloudBees Assurance Program since 2.568.3.37913:

As announced in the Windows Server 2019 Agent Containers End of Life, the Jenkins project is dropping inbound agent image builds for the end-of-life Windows LTSC 2019, while adding support for LTSC 2025. CloudBees CI Windows agent images are derived from the Jenkins versions, and are now aligned. Customers who cannot yet upgrade from LTSC 2019 Kubernetes node pools may temporarily pin older agent images.

Support for masking ephemeral credentials in Pipeline build logs and step arguments is now generally available (GA). Configure stock patterns for common ephemeral credential formats such as AWS STS tokens and JWTs, or define custom regular expression patterns for token formats specific to your environment. Optionally configure patterns to fail the build when a secret is detected, signaling to Pipeline authors to fix their Pipelines rather than relying on masking as a permanent solution.

The CloudBees CI MCP Router can now be deployed as an optional service in the CloudBees CI Helm chart. The CloudBees CI MCP Router also now supports OAuth authentication; rather than relying on one shared token, each request carries the identity of the person or tool that made it. To use OAuth authentication, install the required OAuth plugins on your operations center and controllers:

The cloudbees-cloud-core-oc and cloudbees-core-mm Docker images include a software bill of materials (SBOM) in CycloneDX JSON format, available as an attestation alongside every image tag on Docker Hub for CloudBees CI on modern cloud platforms 2.568.1.37445 and later. You can download the SBOM to review software composition for compliance or risk assessment purposes. For more information, refer to the documentation for your platform:

On recent versions of OpenShift, managed controller creation could fail with the error: provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: []int64{1000}: 1000 is not an allowed group This has been resolved; managed controllers are now created successfully on recent versions of OpenShift.

The Script Security plugin (script-security) sandbox incorrectly rejected operations performed on a null receiver as part of the SECURITY-3931 fix, causing sandboxed Pipeline scripts that concatenate a string onto a null value to fail. This has been resolved in Script Security plugin 1429.v0810f1b_530f5.

In environments where a controller’s root URL exceeded 64 characters, such as clusters with long hostnames or controllers with long names, the controller would start successfully but never reach a Connected state in the operations center. This affected all cluster types, including OpenShift, GKE, EKS, AKS, and kind. The controller now establishes its connection to the operations center regardless of root URL length.

When using Move/Copy/Promote, typing a partial path like cjp:///T for cjp:///Tasks in the destination field returned no suggestions, even though typing cjp:/// alone showed all available items. This made it appear as if the destination did not exist. The destination dropdown now correctly filters suggestions as you type.

A Pipeline build has an initial phase during which its definition is being loaded, before the Groovy logic is interpreted and the program state is recorded. This phase can include retrieving a Jenkinsfile from SCM, cloning libraries, or similar operations, and might run for a significant amount of time if SCM access is slow. If the owning replica exited during this phase, other replicas would attempt to adopt and resume the build but failed to do so, leaving the build recorded as running but not making progress, and potentially blocking subsequent builds. This fix also addresses related problems that could affect non-HA controllers.

When anonymization was enabled, support bundles retained references to deleted or renamed items, leading to increased support bundle size. Anonymized support bundles now correctly exclude these stale references.

CloudBees CI now caches JAR checksums, reducing CPU and I/O load on the controller when agents connect.

When you search for a specific plugin under the Available tab in the Operations center Plugin Manager, the search results show duplicate entries for the plugin.