How Do I Restrict Access to Agents (previously called Slaves)?
You haven't specified what Jenkins you're running or whether you have licensed Cloudbees plugins. If you have the Cloudbees folder plugin together with the Cloudbees Folders Plus plugin, there is a "simple" way to do what you ask.
To take advantage of the power of the folder and folder plus plugin, you need a well organized hierarchy of jobs. If all of your jobs live in the top level (root) folder this strategy will require some significant work.
- Create FOLDERs for each of your job/jobsets. And even better a parent folder to contain them all. E.g. /teams/Team1, /teams/Team2, ... and perhaps a separate folder for all of the agents /agents (or /admin)
- In essence you'll allow Team1 to have a separate set of resources from Team2 - as well as a SHARED set of resources if appropriate for your situation.
- Create and label Agents as usual, but set them to "Only accept builds from approved folders" I also HIGHLY suggest you only allow agents to accept builds for matching labels... otherwise chaos can occur.
- Assign all the agents to the /admin folder. (So that any admin job can use any agent) - optional, but recommended. See below for how to make that assignment.
- Assign any shared agents to the /teams folder.
- Assign individual team agents to the /teams/TeamN folder to enforce that Team1 only has the agents available it is allowed to use.
- Repeat the assignment process for each teamN + Agent combination.
How to Assign Agents to Folders
This is a bit tricky as there are several steps required - and since those steps may change, I'll suggest you consult Jenkins documentation, but here is the generic process. I recommend you open at least two browser windows, one to navigate agents, one (or more) to navigate folder(s).
- Select a folder you want to have access to an agent e.g. /teams or /teams/team1
- Select "Controlled Agents"
- Create a Request. This generates a Request Key.
- In another window, navigate to the Agent, select Approved Folders
- Paste the request key into the Agent/Approved folders - this generates a Request Secret.
- Navigate to the Folder/Controlled agents, paste the key from step 5 into the open request and click Authorize.
Now your agent has been associated with the specific folder. Repeat this process for ALL of your agents and all of the folders you wish to pair them with.
Note if you want shared-agent-1 to be usable by anyone in teams/Team1, or Team2... you only need to add it to the teams folder. However it would NOT be incorrect to add a shared agent to every sub-folder. There are advantages to both approaches.
There are also some subtleties about the use of the request keys... you can reuse them, but the best security is achieved by creating new request keys for every pairing, that way you can revoke one without revoking others.
The Jenkins CLI has the ability to automate all the steps described above.
What if I DO NOT have Licensed Plugins?
I can't answer that question because I believe the assignment of agents to folders is exclusive to the licensed cloudbees plugins.