CloudBees CI on modern cloud platforms 2.580.2.38434

The categorization of CloudBees Assurance Program (CAP) plugins was reviewed across operations center and controller server types, for both CloudBees CI on modern cloud platforms and CloudBees CI on traditional platforms.

The following plugins have been removed from the operations center CloudBees Assurance Program since 2.580.1.38223:

The following plugins have been removed from the controller CloudBees Assurance Program since 2.580.1.38223:

The CasC Controller Bundle Service can now optionally record the Git commit each bundle came from in a new gitCommit field, stored separately from the Configuration as Code (CasC) bundle’s existing version. This enables tracing a bundle back to the exact change in source control. Enabling this feature does not change how bundle versions are calculated or how updates are detected.

When a CasC bundle is reloaded, the notification shown in Manage Jenkins now includes the bundle version that was reloaded (or that failed to reload) and the date and time the reload completed. This makes it easier to confirm exactly which change was applied, especially when reloads happen in quick succession. On controllers running in High Availability (HA) mode, this information is consistent across all replicas.

To better comply with an OpenID Connect (OIDC) specification requirement, a controller connected to the operations center now retains only secure hashes of the state and nonce fields during an SSO redirect, instead of the original values. Fine-grained logging is also available to more clearly track SSO failures, such as those caused by failing to use -Dcom.cloudbees.jenkins.replication.jetty_hazelcast.Integrator.tolerateNonStickySessions=true in an HA controller without sticky sessions.

You can now create a Jenkins OAuth client credential that uses the client_credentials grant to authenticate API requests as a Jenkins user, with no sign-in required. For more information, refer to Bind an OAuth client credential to a user.

Previously, Pipeline Groovy library Git repositories were checked out to /var/jenkins/workspace/$jobname@libs/$nameHash directories. When using the same library in many jobs, for example when using Multibranch Pipeline with many branches, this could lead to many copies of the same library being checked out, ultimately filling up the temporary volume and crashing a replica in an HA controller. Now /var/jenkins/libraries/$definitionHash is used regardless of the job requesting the library, except when the library step is used with the retriever argument.

A warning is now displayed on the High Availability checkbox in the managed controller configuration to remind you to read through the associated HA documentation and ensure that various prerequisites have been met.

The OKHttp plugin (okhttp-api) previously emitted a WARNING log entry for every attempted connection to an HTTPS server through a proxy that required authentication. You can now opt into proper support for preemptive authentication by setting the plugins.okhttp-api.proxy.preemptive-auth-enabled system property to true.

Previously, HA controllers accessed without sticky sessions could fail to complete operations center SSO sign-in. You can now resolve this by passing -Dcom.cloudbees.jenkins.replication.jetty_hazelcast.Integrator.tolerateNonStickySessions=true to the controller, which forces all session data access to check other replicas. This can impose a small performance penalty and cause minor issues with UI controls based on progressive rendering, such as the agent build history page.

Under certain conditions, problems with Hazelcast communications in an HA controller might cause the Jenkins queue lock to be held excessively long while checking whether a non-concurrent task might be running on another replica.

Reprovisioning a non-HA managed controller to enable High Availability (HA) using the Reprovision button did not recreate the Ingress resource, leaving it without the sticky session annotations required for High Availability (HA). Previously, the only workaround was to use Deprovision followed by Start. Now Reprovision adds or removes sticky session annotations when High Availability (HA) is enabled or disabled, respectively.

After switching an HA controller to non-HA, the controller installation continued to use the overridden workspace directory on the built-in node (used for purposes such as library checkouts), even after the system property that set the override was removed. The value now defaults correctly when no system property actively sets it.

Pipeline jobs that use a Stashed File parameter and unstash could fail intermittently with No such saved stash on HA controllers. This happened when a build was scheduled on a replica other than the one where it was triggered. Such builds now run on the replica that received the request, so the file is always available. Base64 File parameters are unchanged and still load-balance across replicas.

When a job was in the queue on an HA controller and the current user had Discover permissions but not Read permissions for it, the task was expected to be concealed or shown as unknown. Instead, an error was printed to the system log, and the UI could break in various ways.

Red Hat Enterprise Linux (RHEL) 9 was rejecting the Update Center custom certificates because they were signed using the SHA-1 algorithm. The operations center now re-signs these SHA-1 custom Update Center certificates with SHA-512 and keeps the same keys.

A size limit of 3 MB per file is enforced for CasC bundles, resulting in CasC rejecting any file exceeding this size. This was noticed when using the create-items HTTP API or the casc-items-create-items CLI command. You can now increase the limit by setting the following JVM system property, with the value specified in bytes: -Dcasc.yaml.max.document.size=<size-bytes>.

When the bundle validation endpoint was reached with a CasC bundle containing an invalid items.yaml file, an error page was displayed. The endpoint now returns a JSON result instead.

On Amazon Elastic Kubernetes Service (EKS) with an AWS Application Load Balancer (ALB), SSO Relay, the hibernation monitor, and the CasC Controller Bundle Service used the wrong health check path, causing the load balancer to mark them as unhealthy. This has been resolved; these services now use the correct health check path.

Previously, accessing the CloudBees Unify configuration page on a Jenkins controller displayed an error, preventing users from configuring the CloudBees Unify integration. This issue only affected Jenkins controllers and did not affect CloudBees CI controllers.

Under special circumstances a deserialization error in an unusually formed build.xml for a Pipeline build could result in the build being presented as loaded but with nonsensical metadata, and with no log messages indicating the root cause. Now any such exception can be tracked via a FINE logger on OldDataMonitor, and the build will not be loaded at all.

When a plugin used a Groovy script with the sandbox option deselected, loading the script from disk unconditionally saved changes to $JENKINS_HOME/scriptApproval.xml, triggering notifications that could add further overhead, such as from the Job Config History plugin.

The Kubernetes Agents widget no longer throws an IndexOutOfBoundsException or logs a warning on controllers with no Kubernetes cloud configured.

When you search for a specific plugin under the Available tab in the Operations center Plugin Manager, the search results show duplicate entries for the plugin.