During my Google Summer of Code Project,
I have created the brand new Folder Auth Plugin for easily
managing permissions to projects organized in folders from the Folders plugin.
This new plugin is designed for fast permission checks with easy-to-manage roles.
The 1.0 version of the plugin has just been released and can be downloaded
from your Jenkins’ Update center.
This plugin was inspired by the Role Strategy Plugin
and brings about performance improvements and makes managing roles much easier.
The plugin was developed to overcome performance limitations of the Role Strategy
plugin on a large number of roles. At the same time, the plugin addresses one
of the most popular ways of organizing projects in Jenkins, through folders.
The plugin also has a new UI with more improvements to come in the future.
The plugin supports three types of roles which are applicable at different places
in Jenkins.
- Global Roles: applicable everywhere in Jenkins
- Agent Roles: restrict permissions for multiple agents connected to your instance
- Folder Roles: applicable to multiple jobs organized inside folders
Performance Improvements over Role Strategy Plugin
This plugin, unlike the Role Strategy plugin, does not use regular expressions
for finding matching projects and agents giving us performance improvements
and makes administrators’ lives easier. To reduce the number of roles required
to be managed, permissions given to a folder through a folder role get inherited
to all of its children. This is useful for giving access to multiple projects
through a single role. Similarly, an agent role can be applied to multiple agents
and assigned to multiple users.
This plugin is designed to outperform Role Strategy Plugin in permission
checks. The improvements were measured using the
micro-benchmark framework
I had created during the first phase of my GSoC project.
Benchmarks for identical configurations for both plugin show that the
permissions check are up to 934x faster for 500 global roles when compared to
the global roles from the Role Strategy 2.13, which in itself contains several
performance improvements. Comparing folder roles with Role Strategy’s project
roles, a permission check for access to a job almost 15x faster for 250 projects
organized in two-level deep folders on an instance with 150 users. You can see
the benchmarks and the result comparisons
here.
Jenkins Configuration as Code Support
The plugin supports Jenkins Configuration-as-Code so you can configure permissions
without going through the Web UI. A YAML configuration looks like this:
jenkins:
authorizationStrategy:
folderBased:
globalRoles:
- name: "admin"
permissions:
- id: "hudson.model.Hudson.Administer"
# ...
sids:
- "admin"
- name: "read"
permissions:
- id: "hudson.model.Hudson.Read"
sids:
- "user1"
folderRoles:
- folders:
- "root"
name: "viewRoot"
permissions:
- id: "hudson.model.Item.Read"
sids:
- "user1"
agentRoles:
- agents:
- "agent1"
name: "agentRole1"
permissions:
- id: "hudson.model.Computer.Configure"
- id: "hudson.model.Computer.Disconnect"
sids:
- "user1"REST APIs with Swagger support
The plugin provides REST APIs for managing roles with OpenAPI specifications
through Swagger.json. You can check out the Swagger API on
SwaggerHub.
SwaggerHub provides stubs in multiple languages which can be downloaded and
used to interact with the plugin. You can also see some sample requests from
the command line using curl.
What’s next
In the (not-too-distant) future, I would like to work on improving the UI and
make the plugin easier to work with. I would also like to work on improving the
APIs, documentation and more optimizations for improving the plugin’s performance.
Links and Feedback
I would love to hear your comments and suggestions. Please feel free to reach
out to me through either the
Role Strategy Plugin Gitter chat or through
Jenkins Developer Mailing list.
Originally posted on Jenkins Blog
Author: abhyudayasharma