Skip to content

Commit

Permalink
Merge pull request #4980 from jenkinsci/fix-agent-to-master-terminology
Browse files Browse the repository at this point in the history
[JENKINS-63905] Agent to controller rather than agent to master
  • Loading branch information
oleg-nenashev committed Oct 10, 2020
2 parents 98956a0 + 613dc49 commit 32138a2
Show file tree
Hide file tree
Showing 4 changed files with 13 additions and 14 deletions.
Expand Up @@ -26,32 +26,31 @@ THE SOFTWARE.
<l:layout title="${%Whitelist}" permission="${app.ADMINISTER}">
<st:include page="sidepanel.jelly" it="${app}"/>
<l:main-panel>
<h1>${%Agent &#8594; Master Access Control}</h1>
<h1>${%Agent &#8594; Controller Access Control}</h1>

<p>
Jenkins master is now more strict about what commands its agents can send to the master.
The Jenkins controller is now more strict about what commands its agents can send to the controller.
Unfortunately, this prevents some plugins from functioning correctly, as those plugins do not
specify which commands are open for agents to execute and which ones are not.
While plugin developers work on improving this,
as an administrator, you can mark commands as OK for agents to execute (aka "whitelisting").
as an administrator, you can mark commands as OK for agents to execute.
</p>
<div class="warning" style="margin:1em">
Please see <a href="https://jenkins.io/redirect/security-144">the discussion of this feature</a> to
understand the security implication of this.
</div>
<j:if test="${it.masterKillSwitch}">
<div class="warning" style="margin:1em">
The agent &#8594; master access control subsystem is currently disabled.
The agent &#8594; controller access control subsystem is currently disabled.
This is unsafe if you have agents from other less trusted people.
You can turn it back on from <a href="${rootURL}/configureSecurity">Global Security Configuration UI</a>.
</div>
</j:if>

<form method="post" action="submit">
<h2>Currently Whitelisted Commands</h2>
<h2>Currently Allowed Commands</h2>
<p>
The following commands are currently whitelisted for agents to execute on the master.
Type in any fully-qualified class names to whitelist them:
Agents are currently allowed to execute the following commands on the controller.
</p>
<textarea id="whitelist" name="whitelist" style="width:100%; height:5em">${it.whitelisted.exists() ? it.whitelisted.read() : ""}</textarea>

Expand All @@ -61,7 +60,7 @@ THE SOFTWARE.
<h2>Currently Rejected Commands</h2>
<p>
Agents have attempted to use the following functionalities but the plugins that implement them
did not specify whether or not they should be usable from agents. Check ones you want to whitelist:
did not specify whether or not they should be usable from agents. Check ones you want to allow to be executed:
</p>
<ul style="list-style:none">
<j:forEach var="r" items="${rejectedList}">
Expand Down
Expand Up @@ -3,8 +3,8 @@ package jenkins.security.s2m.MasterKillSwitchConfiguration
def f=namespace(lib.FormTagLib)

if (instance.isRelevant()) {
f.section(title: _('Agent \u2192 Master Security')) {
f.optionalBlock(field: "masterToSlaveAccessControl", title: _("Enable Agent \u2192 Master Access Control")) {
f.section(title: _('Agent \u2192 Controller Security')) {
f.optionalBlock(field: "masterToSlaveAccessControl", title: _("Enable Agent \u2192 Controller Access Control")) {
f.nested() {
raw _("Rules can be tweaked <a href='${rootURL}/administrativeMonitor/slaveToMasterAccessControl/'>here</a>")
}
Expand Down
@@ -1,2 +1,2 @@
AdminCallableMonitor.DisplayName=Rejected Agent \u2192 Master Access Attempt
MasterKillSwitchWarning.DisplayName=Disabled Agent \u2192 Master Access Control
AdminCallableMonitor.DisplayName=Rejected Agent \u2192 Controller Access Attempt
MasterKillSwitchWarning.DisplayName=Disabled Agent \u2192 Controller Access Control
Expand Up @@ -20,9 +20,9 @@
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.

# Rejected Agent \u2192 Master Access Attempt
# Rejected Agent \u2192 Controller Access Attempt
AdminCallableMonitor.DisplayName=\
\u041e\u0442\u0445\u0432\u044a\u0440\u043b\u0435\u043d \u043f\u043e\u0434\u0447\u0438\u043d\u0435\u043d \u043a\u043e\u043c\u043f\u044e\u0442\u044a\u0440 \u2014 \u043e\u043f\u0438\u0442 \u0437\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044e\u0442\u044a\u0440
# Disabled Agent \u2192 Master Access Control
# Disabled Agent \u2192 Controller Access Control
MasterKillSwitchWarning.DisplayName=\
\u0418\u0437\u043a\u043b\u044e\u0447\u0435\u043d \u043f\u043e\u0434\u0447\u0438\u043d\u0435\u043d \u043a\u043e\u043c\u043f\u044e\u0442\u044a\u0440 \u2014 \u043a\u043e\u043d\u0442\u0440\u043e\u043b \u043d\u0430 \u0434\u043e\u0441\u0442\u044a\u043f\u0430 \u0434\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044e\u0442\u044a\u0440

0 comments on commit 32138a2

Please sign in to comment.