[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev assigned an issue to Unassigned Jenkins / JENKINS-31866 Attempts to restrict Pipeline jobs from running on master result in job hanging Change By: Oleg Nenashev Assignee: Oleg Nenashev Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging As stated in https://groups.google.com/d/msg/jenkinsci-dev/uc6NsMoCFQI/AIO4WG1UCwAJ , I have no bandwidth to work on this issue anytime soon. I have marked the plugin for adoption. But I will be happy to review/release anything related to this issue while there is no other maintainer. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev updated an issue Jenkins / JENKINS-31866 Attempts to restrict Pipeline jobs from running on master result in job hanging Change By: Oleg Nenashev Labels: pipeline-compatibility Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Adrian Vlad commented on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
I have a similar problem. I have a pipeline called "test_pipeline" and inside it does:
node('some_node') {
...
}
On "some_node" I use Restrict jobs execution at node -> Regular _expression_ (Job Name) with value test_pipeline. This configuration doesn't work (the build hangs). But if I change the value to test_pipeline.* then it works. What is the problem? Is job-restrictions using different pipeline names with some suffix? (test_pipeline/.* also works)
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Artur Szostak commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Thank you for the warning fix. Looking forward to seeing the warning disappear in some future upgrade of our Jenkins instance. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Artur Szostak I opened a PR addressing the warning you experienced https://github.com/jenkinsci/job-restrictions-plugin/pull/23 Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Artur Szostak I get that warning too. The primary reason for the error is the class loader for plugins is only populated with related plugins in which it depends. Since the job-restrictions plugin does not directly depend on pipeline plugins, the class loader for it does not include the workflow set of classes. You're right that you can ignore the error and it will "just work". Can probably be considered a bug. It should probably be using the uber classloader which exists in the plugin manager. Add Comment This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Sam Gleske edited a comment on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
Pipelines orchestrate from the master runtime. There's nothing you can change about that. You can set the master executors to 0 and it will still be running the pipeline orchestration within the master.In general, a major concern for me was users abusing the master by adding to their Jenkinsfiles.{noformat}node('master') {sh 'im-a-bad-person.sh'}{noformat}However, with suggestions from this thread one can easily restrict the master by only allowing the Jenkins pipeline orchestration classes (and not the WorkflowRun class which is the actual pipeline build that runs on agents). [~sdalex] check out some of my earlier comments in this issue. I share some of my scripts and methods for handling pipelines and cleanup as well as automatically configuring.
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Sam Gleske commented on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
Pipelines orchestrate from the master runtime. There's nothing you can change about that. You can set the master executors to 0 and it will still be running the pipeline orchestration within the master. In general, a major concern for me was users abusing the master by adding to their Jenkinsfiles.
node('master') {
sh 'im-a-bad-person.sh'
}
However, with suggestions from this thread one can easily restrict the master by only allowing the Jenkins pipeline orchestration classes (and not the WorkflowRun class which is the actual pipeline build that runs on agents). Alexandre Martel check out some of my earlier comments in this issue. I share some of my scripts and methods for handling pipelines and cleanup as well as automatically configuring.
Add Comment
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske edited a comment on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Here's my script https://github.com/samrocketman/jenkins-bootstrap-shared/blob/ master 21f76bb94f89dbbd56e8697482c861266c2b456a /scripts/configure-job-restrictions-master.groovy Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Pipelines now being a core feature of Jenkins, I recommend keeping this issue open until pipelines are natively supported until without any additional configuration on the user. Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske edited a comment on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Pipelines now being a core feature of Jenkins, I recommend keeping this issue open until pipelines are natively supported until without any additional configuration on the user. Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Here's my script https://github.com/samrocketman/jenkins-bootstrap-shared/blob/master/scripts/configure-job-restrictions-master.groovy Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging For multibranch pipelines I had to whitelist org.jenkinsci.plugins.workflow.multibranch.WorkflowMultiBranchProject in addition to org.jenkinsci.plugins.workflow.job.WorkflowJob. Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Sam Gleske commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging I ran a quick test. Looks like the solution works. Does not allow users to define master in their Jenkinsfile. The pipeline runs but hangs on the master node step indefinitely. Looks good to me. A build timeout could cancel hung jobs. In the future it would be nice if pipelines were officially supported. Some support could include: JENKINS-50644 - allow admins to define master node steps in global shared libraries. Throw a security warning to the admin when a user attempts to run on the master node via a Jenkinsfile. Prevent the job from ever starting so it doesn't hang indefinitely taking up resources. It could just kill the job as a failure. Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Sam Gleske edited a comment on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
Question about your class filter configuration.Can normal pipeline users arbitrarily execute code on the master node if a user defines in their Jenkinsfile the following?{noformat}node('master') {//user does something malicious on master}{noformat} I basically want to reserve the master executors to be available to admins only.
Add Comment
This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Sam Gleske edited a comment on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
Question about your class filter configuration . .. Can normal pipeline users arbitrarily execute code on the master node if a user defines in their Jenkinsfile the following?{noformat}node('master') {//user does something malicious on master}{noformat}
Add Comment
This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Sam Gleske commented on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
Question... Can normal pipeline users arbitrarily execute code on the master node if a user defines in their Jenkinsfile the following?
node('master') {
//user does something malicious on master
}
Add Comment
This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Sorry, missed the comment. Yes, this is a change which makes the restriction to work properly. There is also JENKINS-46652 which fixes it on the core's side. I think the ticket can be closed Add Comment This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev commented on JENKINS-31866 Re: Attempts to restrict Pipeline jobs from running on master result in job hanging Greg Smith as designed in the current implementation. You will have to use a more complex Restriction _expression_ in order to allow such task classes (I've added Job Class Restriction for such purpose in 0.6). I would be happy if somebody contributes a better solution Add Comment This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title
Greg Smith commented on JENKINS-31866
Re: Attempts to restrict Pipeline jobs from running on master result in job hanging
I recently ran into this problem too: It seems that the webhook that causes the build to be run – which then kicks off the scan of the repo – runs on master. So say you have a github org definition of "MyCompany" and all projects are under that, like "MyCompany/aproject/master" Now you set the restrictions so that "master will not run any builds under 'MyCompany'" with a regex like: ^(?!MyCompany\/) That successfully stops any of those builds from using a node("master") – but it also stops the incoming webhook from running a scan – so all builds in that github org "hang" This plugin needs some kind of special allowance for the scan, or maybe some way to define that scans are OK.
Add Comment
This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)
--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
[JIRA] (JENKINS-31866) Attempts to restrict Pipeline jobs from running on master result in job hanging
Title: Message Title Oleg Nenashev updated an issue Jenkins / JENKINS-31866 Attempts to restrict Pipeline jobs from running on master result in job hanging Change By: Oleg Nenashev Summary: Attempts to restrict Workflow Pipeline jobs from running on master result in job hanging Add Comment This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
