ChrisPetr0
commented
2 years ago Here's a shell script I used with packer (directly before install_plugins) to get around this issue. Note local Jenkins users are not used in final deployment.
#!/bin/bash -x
cd /var/lib/jenkins
cli_groovy=cli_user.groovy
sudo cp /tmp/${cli_groovy} /var/lib/jenkins/${cli_groovy}
echo | systemctl | grep jenkins
sudo wget http://localhost:8080/jnlpJars/jenkins-cli.jar
pw=`sudo cat secrets/initialAdminPassword`
plugins=("matrix-auth")
for str in ${plugins[@]}; do
sudo java -jar jenkins-cli.jar -auth admin:$pw -s http://localhost:8080 install-plugin $str
done
sudo systemctl stop jenkins
sleep 10
sudo systemctl start jenkins
sleep 30
sudo chmod 777 /var/lib/jenkins/${cli_groovy}
sudo chown jenkins:jenkins /var/lib/jenkins/${cli_groovy}
sudo java -jar jenkins-cli.jar -auth admin:$pw -s http://localhost:8080 groovy = < /var/lib/jenkins/${cli_groovy}
sudo systemctl stop jenkins
sleep 10
sudo systemctl start jenkins
sleep 30
djessich
AdrianVarelaG
skies5
Stromweld
:speaking_head: Foreword
Thank for taking the time to fill this bug report fully. Without it we may not be able to fix the bug, and the issue may be closed without resolution.
:ghost: Brief Description
Building Jenkins AMI / Image with packer and Ubuntu 20.04. Pattern has been rock solid for years. Truncated Runlist looks like this:
No problems until install_plugins recipe. Using the
install_pluginresource from Jenkins cookbook which leverages internal Jenkins CLI calls. Using http executor, plugin list is an array walked through for each plugin.Jenkins
LTS 2.319.3(2022-02-09) works as expected and installs plugins successfully. It seems some security changes were made on later versions of Jenkins that breaks the ability to install plugins with http executor via Jenkins CLI and and anonymous user. Latest Jenkins LTS2.332.3and2.332.2have this issue (I believe it started in2.332.1, as significant changes in change log start there).I'm perfectly fine with using ssh executor and creating a user with public key and setting
node.run_state[:jenkins_private_key] = private_key. In fact, I tried this. However, the same CLI problem exists. If I have a base install of Jenkins via this cookbook, want to configure a user via this cookbook viajenkins_userresource, that also needs to use the CLI. I can't create a Jenkins user with ssh configured via this cookbook / resource to use the CLI with ssh executor because it has the same problem when calling thejenkins_userresource (ERROR: anonymous is missing the Overall/Read permission.In testing, I also tried to modify
and run CLI calls with http executor via anonymous user and the error changes to
ERROR: anonymous is missing the Overall/Administer permissionI'm thinking I may have to resort to trying to run CLI calls with
-authflag and use theadminuser with$JENKINS_HOME/secrets/initialAdminPasswordwhich I did try unsuccessfully but need to test more. EDIT: This works, going to try to figure out if I can use this pattern for initial configuration.I would really like to get on latest LTS version, but it seems there is a chicken and egg problem here with CLI unable to be used at all until an ssh user is created, but this cookbook can't create an ssh user because the CLI no longer works with anonymous user.
:pancakes: Cookbook version
'9.5.2':woman_cook: Chef-Infra Version
17.9.26:tophat: Platform details
Ubuntu 20.04
Steps To Reproduce
Steps to reproduce the behavior:
install_pluginresource and attempt to install a valid pluginSTDERR: ERROR: anonymous is missing the Overall/Read permissionjenkins_user,groovy_script, andjenkins_command, basically anything that uses internal CLI to configure Jenkins using http executor with no authEDIT: Upon reading cookbook documentation further, I am going to try the
jenkins_credentialsbut unfamiliar with using that. I'm not sure if this will help get around this issue, but will post back.EDIT_UPDATE: Looks like:
also fails and uses the CLI to run a groovy script
:police_car: Expected behavior
Jenkins CLI calls leveraged in
install_pluginorjenkins_userresources should work or a method to create Jenkins ssh user using an alternative method than Jenkins CLI should exist.:heavy_plus_sign: Additional context
I'm not really sure what to do here. It seems like I am deadlocked from using the functionality of this cookbook natively without introducing additional yet to be determined code to create an ssh enabled user or use jenkins admin user
authflag with http executor to createsshenabled users, which will require custom code.Any help, suggestions, or workarounds would be greatly appreciated. I'm looking to keep up with LTS releases from a security perspective. If anything else is needed from me, I will be happy to provide.
Thank you !