Configuration-as-code-plugin: Resource root URL not shown on a Jenkins docker container run

[peachy-devops]

• [ x] Jenkins version: Jenkins ver. 2.222.3

• [x ] Plugin version: configuration-as-code 1.40

• [x ] OS Ubuntu 16.04.6 LTS

Description

I am running a jenkins container with configuration as a code plugin in my linux machine. It is based from a docker image
FROM jenkins/jenkins:lts

I configured Resource root URL under Serve resource files from another domain under Jenkins (http://localhost:8080/configure)

I defined Resource root URL on the casc yml file like this under

unclassified:
  resourceRoot:
    url: "http://127.0.0.1:8080/"

Once the I run the container, the link url doesn't show in the GUI.
My workaround is to reload manually the casc configuration yml at http://localhost:8080/configuration-as-code/ which works fine. This is not a good solution during automation.

How do we solve this issue that once the container runs, the root url should expectedly be shown?

It seems strange because when building the image, no issues are found and I am quite sure I followed the casc rule definition.

Thank you for your help.

[jetersen]

This is apart of Jenkins core, so it should be reported to http://issues.jenkins-ci.org/
cc @daniel-beck

[jetersen]

This seems like a simple bug in UI (jelly).
a unit tests says it is working.

[peachy-devops]

Thanks for the feedback @jetersen
Should I create a new ticket in http://issues.jenkins-ci.org/ ?

[peachy-devops]

Hello @jetersen it seems that commit fix has a small issue with coverage. Thank you.

[jetersen]

@peachy-devops it's not really a fix, it only adds a test confirming it works.
And the coverage issue is a false positive.

[peachy-devops]

@jetersen thanks for the information. I created an issue ticket to Jenkins to solve the bug issue in the UI: https://issues.jenkins-ci.org/browse/JENKINS-62328
cc: @daniel-beck

[daniel-beck]

This seems like a simple bug in UI (jelly).

@jetersen Could you point me to where the UI bug would be? Because it's extremely simple databinding, there is barely any way for this being broken.

In fact, I am unable to reproduce this issue at all on current master (~2.235, 86af885a41671d1b47e26ebe1a5804fcd4274d42), or on stable-2.222 (as of 771833c8847e4d1fcf22f8ee42a00bbfffaf6d11). I tried it both with and without an existing jenkins.security.ResourceDomainConfiguration.xml and it always worked.

Additionally, we already know that

workaround is to reload manually the casc configuration yml … which works fine

which is basically what JenkinsConfiguredWithCodeRule does, so it is unclear to me what the test is supposed to be testing. This looks like an issue during instance startup, perhaps related to JENKINS-61694?

---

@peachy-devops You forgot to mention whether the configuration is effective before you reload (ignoring the configuration UI). If not, it's just not getting applied during startup.

[jetersen]

@daniel-beck reproducible inside both our plugin and integrations module.

[daniel-beck]

@jetersen Well, I tried on a real(ish) instance and couldn't. Could you provide steps to reproduce, ideally showing that the configuration is actually applied while the UI is empty? So far your test seems to only show the former.

[jetersen]

Checkout the pr I created

mvn hpi:run -f ./plugin/pom.xml

go to jcasc and use the same test yaml added in the PR.
.../integrations/src/test/resources/io/jenkins/plugins/casc/resourceRoot.yml
Go to the global settings page, and notice root resource is missing

[jetersen]

Now that I try to reproduce for myself a second time... I cannot reproduce 😓
~saved config~
Nope cannot reproduce, again...

[peachy-devops]

Hello @jetersen @daniel-beck thanks for checking this out.
@daniel-beck yes, the configuration is effective before I reload it.

You can replicate this using the attached files (dockerfile, configuration yml)
I got this from https://github.com/Praqma/jenkins4casc with my changes to replicate the issue.

Here is how to replicate:
(1) Download the file attached. Then, tar -xvzf jenkins4casc_1383.tar.gz
(2) Build the image. docker build . --tag test_jenkins
(3) Run the container. docker run -d --rm -p 8080:8080 -p 50000:50000 -v jenkins-data:/var/jenkins_home -e CASC_JENKINS_CONFIG="var/jenkins_home/casc_configs/jenkins-minimal-example.yaml" {test_jenkins_image_id}
(4) When you check Configure System in http://localhost:8080/. Resource Root URL is not populated :(
(5) Reload the yaml file at http://localhost:8080/configuration-as-code/. It will be successful which means the yaml being reloaded has the expected configuration.

Tip: Please make sure to have a "clean" jenkins-data docker volume

jenkins4casc_1383.tar.gz

Please let me know if you need more information from my side.

[daniel-beck]

yes, the configuration is effective before I reload it.

It is not, in fact, effective: I can access http://127.0.0.1:8080 without getting 404 errors. Meaning there's no UI bug here, the (resource root URL) configuration was simply never applied.

My guess is the CasC plugin tries to set the Resource Root URL before the Jenkins URL, which is an illegal configuration and will be rejected: https://github.com/jenkinsci/jenkins/blob/86af885a41671d1b47e26ebe1a5804fcd4274d42/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java#L198 + https://github.com/jenkinsci/jenkins/blob/86af885a41671d1b47e26ebe1a5804fcd4274d42/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java#L94-L97

[jetersen]

😢 Why is this not added to the reactor startup to avoid issues like these?

[jetersen]

Oh you actually tried: https://github.com/jenkinsci/jenkins/blob/86af885a41671d1b47e26ebe1a5804fcd4274d42/core/src/main/java/jenkins/security/ResourceDomainConfiguration.java#L70
Not sure why JCasC does not respect that.

[jetersen]

Okay, I actually thought we had some code that cared about ordinal...
Looking into it, we don't. But we really ought to, it would solve a lot of problems.

[peachy-devops]

Thanks for figuring this out @jetersen and @daniel-beck !
Does this mean this needs a fix or new feature for JCasC from your side @jetersen ?

I tried using a workaround by reloading the casc based from https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md (via http POST) but I am having a 403 issue generating the token in order for this command to work curl -u ${user}:${TOKEN} -X POST http://localhost:8080/configuration-as-code/reload/

I used the script below to generate a token but I always get the error.

./generate_token.sh 
Jenkins-Crumb:48db6ce2d0d4e3c752f679c7eb66ac21c14a1471b0a09bf36442412f2dcb13e2
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 403 No valid crumb was included in the request</title>
</head>
<body><h2>HTTP ERROR 403 No valid crumb was included in the request</h2>
<table>
<tr><th>URI:</th><td>/me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken</td></tr>
<tr><th>STATUS:</th><td>403</td></tr>
<tr><th>MESSAGE:</th><td>No valid crumb was included in the request</td></tr>
<tr><th>SERVLET:</th><td>Stapler</td></tr>
</table>
<hr><a href="http://eclipse.org/jetty">Powered by Jetty:// 9.4.27.v20200227</a><hr/>

Script: (generate_token.sh)
JKSERVER="http://localhost:8080"
JKUSER="test"
JKPASSWORD=<test password inside quotes>
JKCRUMB=$(wget -q --auth-no-challenge --user $JKUSER --password $JKPASSWORD --output-document - 'http://localhost:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')

echo ${JKCRUMB}
curl $JKSERVER/me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken --data 'newTokenName=my-second-token' --user $JKUSER:$JKPASSWORD  -H '${JKCRUMB}'

[timja]

See https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md

The reload-configuration-as-code endpoint is the easiest to use

[jetersen]

I think I have a fix for the ordinal sorting.
That way Location should be applied before resourceRoot

Before:

After:

       Comparator<Attribute<T,?>> attributeComparator = Comparator.comparingDouble(a -> {
            Annotation annotation = a.type.getAnnotation(Extension.class);
            if (annotation == null)
                return Double.MIN_VALUE;
            Extension extension = (Extension) annotation;
            return extension.ordinal();
        });

[peachy-devops]

See https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/features/configurationReload.md

The reload-configuration-as-code endpoint is the easiest to use

@timja Good to know this for future references! Can you help me understand how I should generate casc-reload-token ?

[timja]

Any url-safe random string will work, the helm chart just uses the pod name for it: https://github.com/helm/charts/blob/master/stable/jenkins/templates/jenkins-master-deployment.yaml#L325

[jetersen]

Tested with https://github.com/jetersen/jenkins4casc
And it definitely works!

[peachy-devops]

Thank you so much @jetersen ! :smiley: When is the schedule of the plugin release with this fix?
@daniel-beck @timja I appreciate all your help :blush:

[jetersen]

I have a few prs that I would like to land

[jetersen]

The fix is included in v1.41

[peachy-devops]

This makes me happy! :smile:
Thanks again @jetersen