[JEP-230] [JENKINS-55582] Convert `instance-identity` to a detached plugin #6585

jglick · 2022-05-19T15:51:24Z

See JEP-230, especially as of jenkinsci/jep#389. Continues work done in #5304 and #6570.

Sanity testing: start Jenkins from scratch; accept default plugins; check that /instance-identity/ endpoint works; create an inbound TCP agent (need to first enable TCP port) and connect; run a Pipeline build on it. Disable instance-identity despite stern warnings and restart—the agent will not work, and there are also various errors from sshd and github plugins. Enable it again and restart—back to normal. Enable SSHD and use the CLI in -ssh mode and via ssh.

Proposed changelog entries

The instance-identity module has been converted to a detached plugin.

Proposed upgrade guidelines

Normally the new plugin will be automatically installed. If you use an “as-code” installation mechanism like a text file with a list of plugins, you may need to add instance-identity (version 3.1 or later) in order to restore this functionality. In particular, inbound agents using TCP (but not WebSocket) transport require this plugin to be installed. There may be other cases, which can be identified by use of APIs in the jenkins.model.identity package rather than directly accessing org.jenkinsci.main.modules.instance_identity.

Maintainer checklist

Before the changes are marked as ready-for-merge:

There are at least 2 approvals for the pull request and no outstanding requests for change
Conversations in the pull request are over OR it is explicit that a reviewer does not block the change
Changelog entries in the PR title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood
Proper changelog labels are set so that the changelog can be generated automatically
If the change needs additional upgrade steps from users, upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the PR title. (example)
If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

…-identity-JEP-230

…stance-identity-JEP-230

war/pom.xml

…er version from the UC when running the Setup Wizard

jglick · 2022-05-19T18:16:02Z

bom/pom.xml

@@ -256,11 +256,6 @@ THE SOFTWARE.
        <artifactId>remoting</artifactId>
        <version>${remoting.version}</version>
      </dependency>
-      <dependency>
-        <groupId>org.jenkins-ci.modules</groupId>
-        <artifactId>instance-identity</artifactId>


Once this is released, bom-weekly can get it.

Though if I understand correctly from jenkinsci/bom#671 jenkinsci/bom#570 (comment) jenkinsci/bom#681, it cannot be added until this PR is in the oldest supported line, so that will be a while. In the meantime the handful of plugins using this dep can specify 3.1.

jglick · 2022-05-19T18:17:25Z

war/pom.xml

@@ -423,7 +419,7 @@ THE SOFTWARE.
                <artifactItem>
                  <groupId>org.jenkins-ci.modules</groupId>
                  <artifactId>sshd</artifactId>
-                  <version>3.0.3</version>
+                  <version>3.236.ved5e1b_cb_50b_2</version>


jenkinsci/sshd-plugin#75

jglick · 2022-05-19T18:17:40Z

war/pom.xml

@@ -399,7 +395,7 @@ THE SOFTWARE.
                <artifactItem>
                  <groupId>org.jenkins-ci.plugins</groupId>
                  <artifactId>bouncycastle-api</artifactId>
-                  <version>2.25</version>
+                  <version>2.26</version>


dep of current instance-identity

* JEP-230 edits * Linking to jenkinsci/jenkins#6585 * Treating JEP-230 as accepted

Other than `instance-identity` itself, known to be used from: * `support-core` * `pipeline-restful-api` * `operations-center-server` (CloudBees CI) * `devoptics` (CloudBees, but not CI)

daniel-beck · 2022-05-19T19:06:50Z

jenkins/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java

Lines 148 to 190 in f9912f5

    
               // Send a request to /instance-identity/ at the resource root URL and check whether it is this Jenkins 
        
               try { 
        
                   URLConnection urlConnection = new URL(resourceRootUrlString + "instance-identity/").openConnection(); 
        
                   if (urlConnection instanceof HttpURLConnection) { 
        
                       HttpURLConnection httpURLConnection = (HttpURLConnection) urlConnection; 
        
                       int responseCode = httpURLConnection.getResponseCode(); 
        
                       if (responseCode == 200) { 
        
                           String identityHeader = urlConnection.getHeaderField("X-Instance-Identity"); 
        
                           if (identityHeader == null) { 
        
                               return FormValidation.warning(Messages.ResourceDomainConfiguration_NotJenkins()); 
        
                           } 
        
                           // URL points to a Jenkins instance 
        
                           RSAPublicKey publicKey = InstanceIdentityProvider.RSA.getPublicKey(); 
        
                           if (publicKey != null) { 
        
                               String identity = Base64.getEncoder().encodeToString(publicKey.getEncoded()); 
        
                               if (identity.equals(identityHeader)) { 
        
                                   return FormValidation.ok(Messages.ResourceDomainConfiguration_ThisJenkins()); 
        
                               } 
        
                               return FormValidation.warning(Messages.ResourceDomainConfiguration_OtherJenkins()); 
        
                           } // the current instance has no public key 
        
                           return FormValidation.warning(Messages.ResourceDomainConfiguration_SomeJenkins()); 
        
                       } 
        
                       // response is error 
        
                       String responseMessage = httpURLConnection.getResponseMessage(); 
        
                       if (responseCode == 404) { 
        
                           String responseBody = String.join("", IOUtils.readLines(httpURLConnection.getErrorStream(), StandardCharsets.UTF_8)); 
        
                           if (responseMessage.contains(ERROR_RESPONSE) || responseBody.contains(ERROR_RESPONSE)) { 
        
                               return FormValidation.ok(Messages.ResourceDomainConfiguration_ResourceResponse()); 
        
                           } 
        
                       } 
        
                       return FormValidation.error(Messages.ResourceDomainConfiguration_FailedIdentityCheck(responseCode, responseMessage)); 
        
                   } 
        
                   return FormValidation.error(Messages.ResourceDomainConfiguration_Invalid()); // unlikely to ever be hit 
        
               } catch (MalformedURLException ex) { 
        
                   // Not expected to be hit 
        
                   LOGGER.log(Level.FINE, "MalformedURLException occurred during instance identity check for " + resourceRootUrlString, ex); 
        
                   return FormValidation.error(Messages.ResourceDomainConfiguration_Exception(ex.getMessage())); 
        
               } catch (IOException ex) { 
        
                   LOGGER.log(Level.FINE, "IOException occurred during instance identity check for " + resourceRootUrlString, ex); 
        
                   return FormValidation.warning(Messages.ResourceDomainConfiguration_IOException(ex.getMessage())); 
        
               } 
        
           }

will need an alternative approach for detecting whether "there" is "here".

jglick · 2022-05-19T19:13:29Z

will need an alternative approach for detecting whether "there" is "here"

Not going to bother with that. If you avoid installing instance-identity (which is very unlikely in GUI mode) then you would just not get this bit of form validation.

jglick · 2022-05-25T12:28:37Z

core/src/main/resources/jenkins/split-plugins.txt


 javax-activation-api 2.330 1.2.0-2
 javax-mail-api 2.330 1.6.2-5
+
+# JENKINS-55582
+instance-identity 2.348 3.1


Note: split point may need to be updated just before merge.

(have been trying to keep this up to date when merging in master, but whoever finally merges this PR should double-check)

…stance-identity-JEP-230

oleg-nenashev

+1 for pushing it forward

timja · 2022-06-11T21:56:22Z

This PR is now ready for merge, after ~24 hours, we will merge it if there's no negative feedback.

Thanks!

jglick · 2022-06-13T17:25:27Z

Whoever is merging, please bear in mind #6585 (comment)

…stance-identity-JEP-230

core/src/main/resources/jenkins/split-plugins.txt

…stance-identity-JEP-230

…lugin (jenkinsci#6585) Co-authored-by: Basil Crow <me@basilcrow.com> Co-authored-by: Tim Jacomb <21194782+timja@users.noreply.github.com>

timja · 2022-06-24T22:15:58Z

Caused ATH failure: jenkinsci/acceptance-test-harness#796

basil · 2022-12-05T02:52:11Z

Likely cause of JENKINS-70206.

Whilst the test was correct that RJR would load detached plugins it was actually relying on it to do so to load instance-idenentity so that JNLP (sic) agents would work. if RJR is updated then this assumption no longer holds and the test would time out waiting for the JNLP agent to connect. instance-identity is already in the test classpath - and we are not testing that this functionality works with no plugins or a limited set, so no longer remove any test scoped plugin from the test. ammends #6585

daniel-beck · 2025-01-15T10:17:44Z

Caused (sort of)/revealed JENKINS-75145.

basil and others added 5 commits May 13, 2022 16:15

[JENKINS-55582] Split instance-identity to a plugin

d5cdafe

Merge commit 'd5cdafeb1d290e224aa7f2a8e478b08be9435f41' into instance…

cf4d77c

…-identity-JEP-230

Update to instance-identity 3.1

70f6bf2

Add form validation for agents jenkinsci#6570 (comment)

1ed16c0

Will also need bouncycastle-api 2.26 for the instance-identity dep

a3cd19a

jglick added a commit to jenkinsci/jep that referenced this pull request May 19, 2022

Linking to jenkinsci/jenkins#6585

dec6e23

Improved Javadoc

ab04b07

jglick mentioned this pull request May 19, 2022

Do not bundle a copy of instance-identity jenkinsci/sshd-plugin#75

Merged

jglick added 2 commits May 19, 2022 13:22

JNLPLauncherRealTest turned up need for jenkinsci/sshd-plugin#75

5eb2e05

Merge branch 'master' of https://github.com/jenkinsci/jenkins into in…

f6af760

…stance-identity-JEP-230

jglick commented May 19, 2022

View reviewed changes

war/pom.xml Outdated Show resolved Hide resolved

jglick added 2 commits May 19, 2022 13:45

Also need to bump sshd in split-plugins.txt or we will get an old…

d96d64b

…er version from the UC when running the Setup Wizard

jenkinsci/sshd-plugin#75 released

da0fd2d

jglick requested a review from jtnord May 19, 2022 18:03

jglick mentioned this pull request May 19, 2022

JEP-230 edits jenkinsci/jep#389

Merged

jglick commented May 19, 2022

View reviewed changes

timja pushed a commit to jenkinsci/jep that referenced this pull request May 19, 2022

JEP-230 edits (#389)

7a6c06d

* JEP-230 edits * Linking to jenkinsci/jenkins#6585 * Treating JEP-230 as accepted

Discourage use of jenkins.model.identity from plugins.

3b263bc

Other than `instance-identity` itself, known to be used from: * `support-core` * `pipeline-restful-api` * `operations-center-server` (CloudBees CI) * `devoptics` (CloudBees, but not CI)

This was referenced May 20, 2022

Bump instance-identity from 2.2 to 3.1 #6586

Closed

[JEP-230] [JENKINS-55582] Test instance-identity as a detached plugin jenkinsci/bom#1159

Closed

jglick commented May 25, 2022

View reviewed changes

This was referenced May 26, 2022

Remove instance-identity dep jenkinsci/kubernetes-plugin#1185

Merged

Warn when instance-identity is missing jenkinsci/kubernetes-plugin#1186

Merged

jglick added 2 commits June 2, 2022 15:16

Merge branch 'master' of https://github.com/jenkinsci/jenkins into in…

a8c46f1

…stance-identity-JEP-230

Provisionally targeting 2.350

fb2908c

jglick marked this pull request as ready for review June 2, 2022 19:18

jglick requested a review from a team June 2, 2022 19:18

timja approved these changes Jun 2, 2022

View reviewed changes

res0nance approved these changes Jun 9, 2022

View reviewed changes

Merge branch 'master' of https://github.com/jenkinsci/jenkins into in…

ecd8400

…stance-identity-JEP-230

oleg-nenashev added upgrade-guide-needed This changes might be breaking in rare circumstances, an entry in the LTS upgrade guide is needed rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted labels Jun 11, 2022

oleg-nenashev approved these changes Jun 11, 2022

View reviewed changes

NotMyFault approved these changes Jun 11, 2022

View reviewed changes

timja added the ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback label Jun 11, 2022

jglick mentioned this pull request Jun 14, 2022

[JENKINS-68662] Rewrite PEMHelper to use BouncyCastle APIs jenkinsci/instance-identity-plugin#23

Merged

6 tasks

Merge branch 'master' of https://github.com/jenkinsci/jenkins into in…

6192c7e

…stance-identity-JEP-230

timja reviewed Jun 14, 2022

View reviewed changes

core/src/main/resources/jenkins/split-plugins.txt Outdated Show resolved Hide resolved

timja and others added 2 commits June 14, 2022 20:54

Update core/src/main/resources/jenkins/split-plugins.txt

46d571a

Merge branch 'master' of https://github.com/jenkinsci/jenkins into in…

1b55251

…stance-identity-JEP-230

timja merged commit bcc2efb into jenkinsci:master Jun 22, 2022

jglick deleted the instance-identity-JEP-230 branch June 22, 2022 23:16

timja mentioned this pull request Jun 24, 2022

wizardInstallSuggestedTest fails if ATH runs several times jenkinsci/acceptance-test-harness#796

Closed

This was referenced Jun 28, 2022

[JEP-230] [JENKINS-55582] Set the baseline to be 2.357 where this plugin was split jenkinsci/instance-identity-plugin#25

Merged

Mark JEP-230 as Final jenkinsci/jep#391

Merged

jglick mentioned this pull request Jul 19, 2022

Require 2.357+, use instance-identity as a plugin jenkinsci/mailer-plugin#182

Merged

This was referenced Aug 4, 2022

Removing instance-identity dependency jenkinsci/blueocean-plugin#2317

Merged

Consume instance-identity as a plugin jenkinsci/pubsub-light-plugin#86

Merged

jglick mentioned this pull request Dec 12, 2022

[JENKINS-70206] Lazy initialization of JnlpSlaveAgentProtocol4 #7514

Merged

6 tasks

jglick mentioned this pull request Jan 30, 2024

Refresh plugin jenkinsci/workflow-step-api-plugin#141

Merged

daniel-beck mentioned this pull request Jan 15, 2025

[JENKINS-75145] Hide UnprotectedRootActions with null URL #10156

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JEP-230] [JENKINS-55582] Convert `instance-identity` to a detached plugin #6585

[JEP-230] [JENKINS-55582] Convert `instance-identity` to a detached plugin #6585

jglick commented May 19, 2022 •

edited by gitpod-io bot

Loading

jglick May 19, 2022

jglick May 19, 2022

jglick May 19, 2022

jglick May 19, 2022

daniel-beck commented May 19, 2022

jglick commented May 19, 2022

jglick May 25, 2022

jglick Jun 9, 2022

oleg-nenashev left a comment

timja commented Jun 11, 2022

jglick commented Jun 13, 2022

timja commented Jun 24, 2022

basil commented Dec 5, 2022

daniel-beck commented Jan 15, 2025

[JEP-230] [JENKINS-55582] Convert instance-identity to a detached plugin #6585

[JEP-230] [JENKINS-55582] Convert instance-identity to a detached plugin #6585

Conversation

jglick commented May 19, 2022 • edited by gitpod-io bot Loading

Proposed changelog entries

Proposed upgrade guidelines

Maintainer checklist

jglick May 19, 2022

Choose a reason for hiding this comment

jglick May 19, 2022

Choose a reason for hiding this comment

jglick May 19, 2022

Choose a reason for hiding this comment

jglick May 19, 2022

Choose a reason for hiding this comment

daniel-beck commented May 19, 2022

jglick commented May 19, 2022

jglick May 25, 2022

Choose a reason for hiding this comment

jglick Jun 9, 2022

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

timja commented Jun 11, 2022

jglick commented Jun 13, 2022

timja commented Jun 24, 2022

basil commented Dec 5, 2022

daniel-beck commented Jan 15, 2025

[JEP-230] [JENKINS-55582] Convert `instance-identity` to a detached plugin #6585

[JEP-230] [JENKINS-55582] Convert `instance-identity` to a detached plugin #6585

jglick commented May 19, 2022 •

edited by gitpod-io bot

Loading