<commit_before>[[using-images-other-images-jenkins]]
= Jenkins
{product-author}
{product-version}
:data-uri:
:icons:
:experimental:
:toc: macro
:toc-title:
:prewrap!:

toc::[]

== Overview
{product-title} provides a container image for running Jenkins. This image provides a Jenkins server instance, which can be used to set up a basic flow for continuous testing, integration, and delivery.

This image also includes a sample Jenkins job, which triggers a new build of a `*BuildConfig*` defined in {product-title}, tests the output of that build, and then on successful build, retags the output to indicate the build is ready for production.

[[jenkins-version]]
== Versions

{product-title} follows the https://jenkins.io/changelog-stable/[LTS] releases of Jenkins.

[[jenkins-images]]
== Images

This image comes in two flavors, depending on your needs:

* RHEL 7
* CentOS 7

*RHEL 7 Based Image*

The RHEL 7 image is available through Red Hat's subscription registry:

----
$ docker pull registry.access.redhat.com/openshift3/jenkins-1-rhel7
----

*CentOS 7 Based Image*

This image is available on DockerHub. To download it:

----
$ docker pull openshift/jenkins-1-centos7
----

To use these images, you can either access them directly from these registries or push them into your {product-title} Docker registry.
Additionally, you can create an ImageStream that points to the image, either in your Docker registry or at the external location.
Your {product-title} resources can then reference the ImageStream.
You can find https://github.com/openshift/origin/tree/master/examples/image-streams[example] ImageStream definitions for all the provided {product-title} images.

[[jenkins-configuration-and-usage]]
== Configuration and Usage

[[jenkins-initializing-jenkins]]
=== Initializing Jenkins

You can manage Jenkins authentication in two ways:

* {product-title} OAuth authentication provided by the OpenShift Login plug-in.

* Standard authentication provided by Jenkins

[[jenkins-openshift-oauth-authentication]]
==== {product-title} OAuth authentication

xref:../../architecture/additional_concepts/authentication.adoc#oauth[OAuth
authentication] is activated by configuring the `*Configure Global Security*`
panel in the Jenkins UI, or by setting the `*OPENSHIFT_ENABLE_OAUTH*`
environment variable on the Jenkins `*Deployment Config*` to anything other than
`false`. This activates the OpenShift Login plug-in, which retrieves the
configuration information from pod data or by interacting with the
{product-title} API server.

Valid user and password combinations are controlled by your identity provider.
For example, if `Allow All` is the default identity provider, you can provide
any non-empty string for both the user name and password. If you have
administrator privileges in the project Jenkins is running in, you will have
administrative privileges within Jenkins.

Valid users are automatically added to the Jenkins authorization matrix at log
in, dictated by the permissions within the Jenkins authorization matrix
associated with the user. Users authenticated against {product-title} OAuth are
added to the Jenkins authorization matrix on their first successful log in.

The `admin` role maps to the set of permissions traditionally associated with
the `admin` user in the {product-title} Jenkins image:

* hudson.model.Computer.Configure
* hudson.model.Computer.Delete
* hudson.model.Hudson.Administer
* hudson.model.Hudson.Read
* hudson.model.Item.Build
* hudson.model.Item.Configure
* hudson.model.Item.Create
* hudson.model.Item.Delete
* hudson.model.Item.Read
* hudson.model.Item.Workspace
* hudson.model.Run.Delete
* hudson.model.Run.Update
* hudson.model.View.Configure
* hudson.model.View.Create
* hudson.model.View.Delete
* hudson.scm.SCM.Tag

Users with the `edit` or `view` roles for the {product-title} project have progressively reduced permissions within Jenkins.

For the `view` role:

* hudson.model.Hudson.Read
* hudson.model.Item.Read

For the `edit` role, in addition to the permissions available to `*view*`:

* hudson.model.Item.Build
* hudson.model.Item.Configure
* hudson.model.Item.Create
* hudson.model.Item.Delete
* hudson.model.Item.Workspace
* hudson.scm.SCM.Tag


[NOTE]
====
The `admin` user that is pre-populated in the {product-title} Jenkins image with
administrative privileges will not be given those privileges when
{product-title} OAuth is used, unless the {product-title} cluster administrator
explicitly defines that user in the {product-title} identity provider and
assigns the `admin` role to the user.
====

Jenkins' users permissions can be changed after the users are initially
established. The OpenShift Login plug-in polls the {product-title} API server
for permissions and updates the permissions stored in Jenkins for each user with
the permissions retrieved from {product-title}. If the Jenkins UI is used to
update permissions for a Jenkins user, the permission changes are overwritten
the next time the plug-in polls {product-title}.

You can control how often the polling occurs with the
`OPENSHIFT_PERMISSIONS_POLL_INTERVAL` environment variable. The default polling
interval is five minutes.

.Creating a new Jenkins pod

. Ensure you have installed
xref:../../install_config/imagestreams_templates.adoc[the default imagestreams
and templates].
<commit_msg>jenkins oauth fixes; adde non-browser access<commit_after>[[using-images-other-images-jenkins]]
= Jenkins
{product-author}
{product-version}
:data-uri:
:icons:
:experimental:
:toc: macro
:toc-title:
:prewrap!:

toc::[]

== Overview
{product-title} provides a container image for running Jenkins. This image provides a Jenkins server instance, which can be used to set up a basic flow for continuous testing, integration, and delivery.

This image also includes a sample Jenkins job, which triggers a new build of a `*BuildConfig*` defined in {product-title}, tests the output of that build, and then on successful build, retags the output to indicate the build is ready for production.

[[jenkins-version]]
== Versions

{product-title} follows the https://jenkins.io/changelog-stable/[LTS] releases of Jenkins.

[[jenkins-images]]
== Images

This image comes in two flavors, depending on your needs:

* RHEL 7
* CentOS 7

*RHEL 7 Based Image*

The RHEL 7 image is available through Red Hat's subscription registry:

----
$ docker pull registry.access.redhat.com/openshift3/jenkins-1-rhel7
----

*CentOS 7 Based Image*

This image is available on DockerHub. To download it:

----
$ docker pull openshift/jenkins-1-centos7
----

To use these images, you can either access them directly from these registries or push them into your {product-title} Docker registry.
Additionally, you can create an ImageStream that points to the image, either in your Docker registry or at the external location.
Your {product-title} resources can then reference the ImageStream.
You can find https://github.com/openshift/origin/tree/master/examples/image-streams[example] ImageStream definitions for all the provided {product-title} images.

[[jenkins-configuration-and-usage]]
== Configuration and Usage

[[jenkins-initializing-jenkins]]
=== Initializing Jenkins

You can manage Jenkins authentication in two ways:

* {product-title} OAuth authentication provided by the OpenShift Login plug-in.

* Standard authentication provided by Jenkins

[[jenkins-openshift-oauth-authentication]]
==== {product-title} OAuth authentication

xref:../../architecture/additional_concepts/authentication.adoc#oauth[OAuth
authentication] is activated by configuring the `*Configure Global Security*`
panel in the Jenkins UI, or by setting the `*OPENSHIFT_ENABLE_OAUTH*`
environment variable on the Jenkins `*Deployment Config*` to anything other than
`false`. This activates the OpenShift Login plug-in, which retrieves the
configuration information from pod data or by interacting with the
{product-title} API server.

Valid credentials are controlled by your identity provider.
For example, if `Allow All` is the default identity provider, you can provide
any non-empty string for both the user name and password.

For non-browser access, the OpenShift Login plug-in also supports use of
the HTTP bearer token authorization header to supply valid credentials for
accessing Jenkins.  A suggested token to use is a token associated with the
serviceaccount for the project Jenkins in running in.  If you started
Jenkins using the example https://github.com/openshift/origin/blob/master/examples/jenkins/jenkins-ephemeral-template.json[jenkins-ephemeral]
or https://github.com/openshift/origin/blob/master/examples/jenkins/jenkins-persistent-template.json[jenkins-persistent] templates,
the commands to display the token are:

----
$ oc describe serviceaccount jenkins
$ oc describe secret <serviceaccount secret name>
----

Valid users are automatically added to the Jenkins authorization matrix at log
in, where {product-title} `*Roles*` dictate the specific Jenkins permissions the
user will have.

Users with the `admin` role have the traditional Jenkins administrative user permissions.
Users with the `edit` or `view` role have progressively less permissions.  See the
https://github.com/openshift/jenkins#jenkins-admin-user[Jenkins image source repository README]
for the specifics on the OpenShift roles to Jenkins permissions mappings.


[NOTE]
====
The `admin` user that is pre-populated in the {product-title} Jenkins image with
administrative privileges will not be given those privileges when
{product-title} OAuth is used, unless the {product-title} cluster administrator
explicitly defines that user in the {product-title} identity provider and
assigns the `admin` role to the user.
====

Jenkins' users permissions can be changed after the users are initially
established. The OpenShift Login plug-in polls the {product-title} API server
for permissions and updates the permissions stored in Jenkins for each user with
the permissions retrieved from {product-title}. If the Jenkins UI is used to
update permissions for a Jenkins user, the permission changes are overwritten
the next time the plug-in polls {product-title}.

You can control how often the polling occurs with the
`OPENSHIFT_PERMISSIONS_POLL_INTERVAL` environment variable. The default polling
interval is five minutes.

.Creating a new Jenkins pod

. Ensure you have installed
xref:../../install_config/imagestreams_templates.adoc[the default imagestreams
and templates].

{'fraction_non_alphanumeric': 0.07796804745049268, 'fraction_numerical': 0.0019133263178035013, 'mean_word_length': 4.997705106138841, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 7, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '961051', 'n_tokens_mistral': 2925, 'n_tokens_neox': 2723, 'n_words': 1225}