1

I have a situation where I have a Jenkins installation that is used by multiple teams. Each team gets their own Jenkins node, which has access to certain parts of the organization that the team is responsible of.

I want to allow the teams to create their own Jenkins jobs, but they should only be allowed to set those jobs to run on their respective Jenkins node. So I need a way to allow users to create jobs, but restrict the nodes they can choose.

The only thing we found is Job Restrictions plugin, which is no longer maintained at this time and up to adoption. And we had some trouble with it.

What are my options?

Improve this question
1

You could use Project-based Matrix Authorization Strategy for user authorisation in Jenkins.

Works well with Folders plugin, then you have each project in a separate folder and permissions on each folder are set to a team that looks after the project.

Each node/slave can have access permissions specified. For example, for node A you will only list Team A as users/team who can have Build and Configure permissions. Team B for node B etc. It is a pain if you have dozens of nodes though.

If integrated with AD, then groups as they are defined in AD can be used to restrict/give access without having to list all members of the team who needs access to which node/project.

Authorisation strategy is defined in "Manage Jenkins" -> “Configure Global Security Option" -> "Authorisation" -> "Project-based Matrix Authorization Strategy" This article describes it to a degree: https://www.thegeekstuff.com/2016/06/jenkins-security/

You could do the same with just Matrix Authorization Strategy, only you won't have projects. You might not need them at all (depends on how many project/teams you have) and then you will only restrict node permissions.

Improve this answer
3
  • "Each node/slave can have access permissions specified". Great. How? Where do I set that? Without Job Restrictions plugin, all I see in node config is "use as often as possible" or "use when job has label set". Doesn't stop people that can set job labels from using any node they want. Using matrix-based security I can set "use all agents" or not, or "configure all jobs". I can't set "use only these agents" or "configure jobs, but not the label". What am I missing? – bgdnlp Aug 18 '20 at 15:10
  • @bgdnlp On Node config screen: Node properties -> Enable node based security. – MasterBuilder Aug 23 '20 at 6:16
  • Unfortunately that seems to require Authorize Project Plugin, which is 4 years old at this point and also up for adoption, like Job Restrictions Plugin. Both of them seem to have issues working with modern Jenkins features, like pipelines. CloudBees seem to have Trigger Restriction, but that's not available in community Jenkins. Looks like there is no better option for now. – bgdnlp Aug 23 '20 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.