Jenkins Online Meetup, 26 Feb 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Jenkins Online Meetup: SystemRead Permission demo by Tim Jacomb (JEP-224)

Description

At the Jenkins Online Meetup on Feb 26 2020 Tim Jacomb presented the new experimental System Read permission which was introduced in Jenkins 2.222. This is a part of the ongoing work to improve experience for Jenkins Configuration-as-Code users.

Slides: https://docs.google.com/presentation/d/167luxwJcETZqP-N3qHgrUt2RcVe9VOnQFpnjtkNxc5c/edit?usp=sharing
JEP-224: https://github.com/jenkinsci/jep/tree/master/jep/224
Meetup page: https://www.meetup.com/Jenkins-online-meetup/

A

You'll see that I've instilled the extended read permission, plug-in version 3.1 this activates the feature.

A

If I go to configure global security, you see I'm using matrix based security, which is the matrix North, plugin and I have configured it to give my system reader user overall read in overall system read they need both do not connected, but in order to login you need read so I'm going to now swap to a different session.

A

And if I go here system reader system reader welcomes Jenkins, he said there is some jobs. He doesn't have access to see them. You probably wouldn't do that in a real world you, the system reads: it probably is allowed to see jobs, but I just have an editor mission.

A

So, as you can see here, you can see if they might just pop back to the other view, so that you could see a total to see everything that an admin currently sees you see. The top is the Edmund monitors, that's not implemented, yet it needs some careful works to that, so that this doesn't really cute. I can't do some of the actions they shouldn't be able to do so.

A

You see here, there's three six, nine twelve about twenty, so that they're twenty pages available, so the couple ones that are not planned at all to be implemented. Those are ones that are actions rather than extra pages that appear for shutdown as an action, reload configuration from disk and the script page, which the only thing it does also not this one, the script console so that just allows you to actually run code, which should never be a kneeler, be allowed just going back to system read. These are the views that are coming very shortly.

A

I think I forgot to install my last version of the configurations code plug-in put them.

A

And possibly I forgot to restart.

A

I think I forgot to I'm. Sorry, my obviously that actually that's doesn't really matter. So you see here a global configure, global security. You see it's a read-only view, so there was an earlier permission implemented back in 2009, 16 degrees they're, just that gave users access to huge, odd configurations, but didn't issue change the UI, so that was quite confusing to users. So one feature that we developed as how this was adapting the HTML inputs and HTML UI to be clearly users that they can interact with it.

A

They can just see it and in the student cases where they can interact, making it obvious that they can so the system really music in here see who is access, see here was permission. They can see the security warnings there on this instance interesting the configuration.

A

Let's see it's one of the very interest: one of them could they can figure system page is implemented, so user can come down here and they can see all the configuration you'll see here that some of this doesn't look fully read-only and that's because some of these new items within the plugins, so we've done incrementally, but everything that we have controlled in core is being implemented.

A

They see here it tells you if a field isn't populated that since not applicable, and it's got some styling on it to show that it's the system read, there is changing this.

A

The other thing I wanted to show, but I, don't I, think I forgot to do a last compiled its configuration. Is code plug-in implemented there. Just in about 15 minutes, just changed a little bit of code and was able to get it so system. Reuse occurs, go to configuration score page, they could view the configuration they could download it and do the schemas and whatnot they're all that sort of user-facing documentation and the currently running configuration.

A

What's going on a chap.

A

I think anything else, just thinking oh yeah right, so I'll just quickly show a little bit of the so for the developers that might be interested in this I'm not really sure what they use. All the interiors is the mostly you little developers so just quickly share a little bit of codes or what plugin developers will need to change. It's not very much, and most of it doesn't require raising the Dinkas core version.

A

So if, if you have a management link- and it's really I might just show matrix or plugin, so this is a very simple plugin which required well here able to adapt to system read.

A

Weather change, so there's a control in coral is Edvin, so anything that you don't want to show on the page hot you hide it with is admin. So, if I go to configure global security, you'll see that this add user or group button has been hidden to read-only users, see it's just not there.

A

So that's that's using the jelly tag is Edmund. There's also.

A

Feature detection so, rather than so, this plugin either some JavaScript adaption done so submitted apply. Buttons are hidden on pages where the user is read-only. So you go in here. There's no a saver or play button.

A

So in matrix or we detect, the button is present by querying for the submit button class and if it's not present, then we disabled the check boxes.

A

Another class of not this one.

A

So most of this is driven off the read-only mode.

A

Jelly context variable where the top-level page or that to the layout will see it, whether it's read-only mode based on whether its administer or not, and if it's read-only mode, then the jelly tags will adapt the UI, which in some cases, means that you don't need to do any other UI changes at all I can associate fully read-only view.

A

So that's an example of a groovy view. Sitting read-only plug-in manager has with jelly example.

A

I was planning on including this on the slide dick, but I didn't quite have enough time, just to show you some very short concrete examples, but this was basically the jelly segment that gets copied around Jake choose, which is basically a complicated. This else lock does a permission check and then sets the value true or false, depending on what's needed, and the last class of examples that I'll show is a plug-in that needs to adapt in these. It needs to access the core dependency and not matrix or.

A

A

Roll strategy plugin.

A

For this plugin needed to add a dependency in the extended read permission, plugin and also needed bumpers, core version, two one, three or four, because that's the baseline for the you've seen the recent commission to may require minor bump, but it doesn't require going to two to two.

A

So the reason that needed this month was it needed its own pages. So as a management link, so it needed to directly reference Commission Xfinity permission does so reflection. Look up depending on your core version. I know she not the clinic or is it just try to look it up and if it finds it, it'll give you some read and if it doesn't find it, it will give you administer.

A

And that's basically it that's the Marion examples. There's also an admin will manage if anyone needs to support the management system. Read permissions which was also introduced recently, but.

A

I have does anyone have any questions or want to see anything else so.

B

So Tim I did have a question if you're, okay, with I'm just barging in and I'm gonna, ask so as a plug-in developer. I've got a plug-in platform labeler as an example that has a global configuration page which has checkboxes on it. Are the check boxes, something that I'm going to need to adapt in my plugin or will system read somehow magically take care of showing the state of those check boxes for me so that on the configure.

A

B

One of its one of its pages is, or one of its things is added to the configure system. Page.

A

So you'll see here that this page here is already marked as read-only.

A

So if you don't have permission to configure anything on this page, it will automatically set read-only for your configuration page. This page is slightly more complicated because they manage permission as well, so you can be allowed to manage pathless page and also read-only cups of it. So it basically checks where you you have to require submission on each descriptor and based on their I will sit read-only mode. So these ones here there's no special changes as long as you're using standard jelly tags.

A

So if checkbox and you're not writing standard HTML, so the problems will happen if people are either making their own jelly tags or writing HTML rather than the jelly tags as long as you're, not doing that, they know you shouldn't have to make any changes unless you want to enhance the UI to look a bit nicer.

A

So on quite a few of the medicine linked pages, we have done minor things to hide buttons and whatnot, but haven't really done any affair and it looks reasonably good. Ok,.

B

And so how I could test I can test this by installing the standard read permission now, do I need to install 2.2 22 to test this myself yeah.

A

So, let's have a look at it now: okay, the Platinum label: oh yeah,.

B

Are you you're really? Yes, platform label are vitally important. Many many many yeah, okay, maybe not vitally important, but yes, platform, labeler.

B

B

There it is, and so what it will do on the system page on the configure system page is, it should add a checkbox. That's called automatic platform labels. Oh it did it cool, so no change on my part as a platform as a plugin maintainer and the UI still retains my help and retains the value of the checkboxes that were defined, even though this particular plugin actually does not support configuration as code at all this. This specific plugin has no support for configuration. It will eventually, but it doesn't right now and yet I get system.

B

Read nice very nice. Thank you. Okay,.

A

Anyone else got any questions or any more questions from up.

B

So could you it's back the the page that just for my reminder, it was matrix off, was a good example of place where I could see the jelly, markup and roll strategy. Those were two: are you likely to do a blog post or some other player, or maybe a web pages to Jenkins dot IO that we can use to read this to learn how to do it or to use video for now and.

A

Like there is a page on sequence, io, the only page in the views section.

A

So this is the documentation here and I should have mentioned it earlier, so this one was slightly aimed towards well it's a mixture of both extended read to this one. Here's looking six gear not administer this one here is aimed at how making system read and manage work together, and this is this one: here's more for tagging of developers.

A

So if you've got your own tag, then these are some of the changes that you might want to do, and this is how so you shouldn't need to do a lot of this, because most of us handle for you in core, but these are kind of some examples of the changes that we've done in core to make it easy for a developer to us to consume them a year and expect this to be updated a bit as I think this was resin pre merged.

A

It's still accurate that probably had have some improvements and yeah I am planning on a blog post. I've just been working on getting this feature more out there, just because I think it looks better if the feature is more complete than just two pages.

B

That is, that is elegant. Thank you. Thanks for showing the demo thanks for doing a live demo with a pro plugin, you've, probably never seen before and having it work. That's that's impressive! Beyond impressive! Well done, I've! Never seen it myself, it's an excellent plugin! You would love it! You need it.

C

It's great to see this feature in the weekly release. Yeah take the current discussion, the developer tomorrow at least it looks like it's going to land him the next NGS baseline, because we are wild choosing 2.2 to 2 na LCS fingers crossed yeah. There is still a lot of changes which need to be done to make it for the company, but hopefully by the next base line, we'll be able to integrate computer user experience for those who want to system live technicians.

B

So Tim I guess one one concern for people running production installations. If I don't install the extended read permission plug-in. This is by default off, so I I'm, safeguarded from it. I have to install extended reaper mission. Plugging the way then have to enable some checkbox which says yes, nice on no two.

A

Ways of doing it, you can well three ways: you can run some groovy scripts. If you want through to enable or disable it, you can see the system property to enable/disable it, and you can install the center of rate Commission plug-in, which will automatically enable it. You can also, then see a certain property to disable it if you want to, and you have theis in the read question plugin installed. If you have many options, but the recommended way is just to install they've seen the great person plug-in and it will lag traitor for you.

B

Thank you thanks very much. Thank you for an excellent presentation that was great now Oleg you mentioned about the the recording I actually don't know, I see that the recording says it's running I make no commitment that it's actually running, given how Unruh how the behavior has been but I propose. We call it the meeting done and see if the recording gets saved. If not anyway, beg you to present it again later. Yeah.

D

I'm going to I'm going to stop the recording now I have the function, dudette and then I will edit this video at some point later today. So.

A

I am Windell it off.

D

The recording now.