Jenkins Platform SIG, 27 Feb 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Platform SIG 2020 02 27

Description

Jenkins platform special interest group discussed Google Summer of Code projects, Jetty support for HTTPS and HTTP/2, PowerPC 64 LE, s390x, and ARM64 latest status

A

Welcome everyone: this is the Jenkins platform special interest group. Let's look at the agenda and go through our topics for the day, so we've got open action items: google, Summer of Code, 2020 custom, Jenkins, build service, discussion, yeah.

B

This is an action. This is the topic I added to the yesterday after the discussion. I'd be sliding I believe, because sliding asked for another session and I suggest that if finally, we'll just keep looking great answer, there is no sliding here also, we can just keep it and I'll organize a second session next week. All right, okay and yeah for whomever is interested. That is also another project added to Windows service wraparound am will support our and we plan to have a dedicated a discussion next week. For that other expendable.

A

So I be sorry, I said the other one again was Windows service wrapper. Is that right? Yes,.

B

Okay, all right yeah I'm, just trying to find a any meal use for buildings. What he ain't in the.

B

Okay, I'll, probably a followed by a mutation meeting. Thank.

A

A

All right, then, we had, in addition, HTTP and HTTPS support with jetty and Jenkins. So, like the druid supported yesterday, we might discuss here. I put it on the agenda, not sure what the topics are but propose. We have it on the agenda. Let's use this this time, capture some notes and discuss yeah.

B

Don't worry, I putted it and that historically, we didn't use HTTP support from Jay King, because our default recommendation and the Jenkins project was to use external service to be a sink, but now default communion users whose features provided by objective because they exposed in Jenkins come online by Winston.

B

So anybody is able to enable its peers, provide certificates and get them working, and it was one of the major regressions we had in a 2.0 4.3, because we missed that build certification from the supported, and since we had exactly zero test automation for HTTP port and basically one who tested straight in ALCS, there was a developer. Manning Christmas with respective situation is the HTTP two is basically similar. Rejected, provides a dis option. You can enable it in Jenkins, but we have no destination at the moment and we have no official documentation.

B

We should stay with the state with valid support, or not so for me for most two options. The thread church would be that, yes, we would like to make this support official, but the knowledge you saw. We need to do some investment so that we can really plan. Like some test coverage for the subject.

A

Ok of the so the and you describe my preference as well, then the challenges we have to find someone who can help with we have to find people who are willing to contribute tests to cover that for HTTP and HTTPS.

B

Right all right business should be really implemented on my Winston level, so that we discover Isha's one that treat happen because yeah one of the major addition, one of the major causes of recent regulations, was that we got a man from Jay King and we didn't really test everything from the based on level. So and then we didn't test them on the Genki score, but it wouldn't be better to have two as earlier so that we know that Jacob bleeds break. Something mean it just.

A

Makes okay, that is all better the test in Winstone, with some form of of checks there. You.

B

Know, in addition to test coverage, it would require some documentation for users, maybe some support in docker images, because you need to go through additional hoops. If you want to enable the options and yeah, if we decide that it's officially supported mode, then we should probably have very easy way to enable them in docker.

B

There was a kind of joke which has probably it deserves a serious discussion later it's about using HTTPS in Jenkins by default, so discouraging cuso4 HTTP.

B

But it's a complex problem and it's definitely not in the scope for the initial steps.

A

But the least I could see how it seems at least to me to be worth consider because baby ships secure by default at the password level. Why should we allow sniffing of sniffing of content? Good, okay, well,.

C

Then the problem Eric certificates right right. Yes, it's difficult get bunch of warnings in browsers and stuff, like that. That's that's the harder thing about doing HTTPS by default. Yeah.

A

I was assuming we do attempt something with let's encrypt and Acme, to try to talk them and talk to them. Ask them to grant us a certificate, but I guess that's probably dreaming. Isn't it well.

B

The problem that it would be users who have to set up their own certificates right- it's not us I- can imagine how we could do it automated non-comedic. We miss let's encrypt for connected instances, but since Jenkins has been installed easily test environments, it would be a bit more challenging their.

B

Environment, yeah I'm not sure anyway, here it's a subject for long-term discussion and the definitely there is no way we disable and remove HTTP mode support right, because a better external services which provide HTTP to many users and removing this case isn't something. You would like to consider great.

A

Okay, anything else on HTTP and.

B

Https, what would be your perspective, I think.

C

The biggest thing we're looking at is increasing your testing of these. Isn't it right now.

C

So I think I need to look at the issues that came out, see if I can understand a little bit better. What happened fully so I could have a little bit better idea of what to recommend, but I think our our test cases should at least be increased to catch, something like what we had happen this at a bare minimum yeah.

B

The smoke test for HTTPS the definitely one smoke test isn't.

B

A

And so that smoke test has been added to Winstone or to to Jenkins Winston, okay,.

B

Yeah testing kit on the Jenkins level is lesser than 300, because hey, if you want to test HTTP, you either create mock certificates and using HTML unit, for that is probably not appropriate, so it would go to acceptance test, harness the proper integrations there banging Jenkins in the container and connecting Tibet. All of that is doable. All of that requires some kind of investment.

B

B

So Italy I would like to run all existing web UI tests and was HTTP and HTTPS mode so that we get a initial test coverage.

B

It's a wishful thinking right now. Yes,.

A

See for me that that seems like that. Would that almost feels excessive to me just because it seems like those things should be protocol independent, whether you're, HTTP or HTTPS, or then cases where they haven't been protocol independent mm.

A

B

Yet very quickly, everything should be a protocol. Independent, okay, but theoretically doesn't mean that JT works that way with Russia TPS.

B

So when you start form submissions, you may discover, for example, that wished we get one more, for instance, limit which TPS you get another one for HTTP. Is it's even more risky because it to is implemented by a digital library injection.

B

So this is the things you need to keep in mind.

B

We well equipped to run such kind of tests, because when we working on customer paid cadet when you're working on one session and session, so the essentials test framework, which is not a string.

B

Opportunity to test with my sturgeon concessions: it was a whole point of customer packager in the trust implementations. You can package everything you can integrate coding system object which will enable HTTPS by default, so you can run, for example, get plug-in tests with HTTPS using this framework.

B

Well, unless it's not that easy, when you try to implement that, but it should be possible right now, just in terms remand, these pipelines, okay,.

A

Okay, anything else, Alex or Oleg.

C

A

Last topic on my list was PowerPC 64 and series. 390 status report I've actually been running the both of them agents on PowerPC 64 and on series 390 from my CI server at home, and it works great and we're great. They run tests they've run the tests of the get client the get plugin the platform labeler general purpose test jobs all seem to be holding up well. I did learn that it is quite important for performance to run open j9 on s/390.

A

It performs much more reasonably than if you run the open JDK that is bundled with the operating system. The operating system, bundled JDK, is interpretive mode. Only no JIT operating system, open JDK is has no JIT interpreted only and it is slow.

A

Any question: have you been using doing anything with PowerPC or series 390 no I have not. I was just wondering.

C

C

So it's only open j9, basically that we can use under the.

A

Jim had said that adopt open JDK.

A

Said that adopt open JDK also has as gene enabled I.

B

Didn't spend a lot of time checking that keep in mind that there are two distributions of a daughter and Gd key, because open JDK includes hotspot and open j9 engines, and these are separate distributions. You can download. So when Jim said that I believe it's related from the top engine and engine.

A

Okay, see that was the that was the spot. That I am I must have misunderstood. I thought he had said that okay, they adopt the open, JDK, definitely has no jet, and that I've observed and I've seen that open, j9 performs quite reasonably so I think it must have jet involved yeah. So.

B

It's not a hot spot in your whining, it's open, j9, at least I, believe so. Okay, alright.

A

We still need in terms of other things, we still need the the final PowerPC configuration.

A

Yeah, no, in fact Oh like so on that one I intentionally oh you're, putting that in is a question to investigate yeah.

B

A

B

You assume it was hot spot yeah and nor.

A

Am I because my observation was and that I think is correct? I know that the adopt open, JDK, open, j9 does and I know that open JDK does not, and the test is for is hot spots agreed. Absolutely then we still need the final PowerPC 64 le le configuration it's currently using a an SSG SSH jump host.

A

Which is it's rather complicated to manage.

A

Manages a Jenkins agent I can give you the instructions on how it's done. It was I found them on a page. It's we launched the agent with a command on the master rather than using the using the SSH agent plug-in.

A

And that have to must approve a system script through script security and that approval is not supported by by Jake asked.

B

You mean my sister, so Jake asked knows, supports a script security. It.

A

Does yeah but unfortunately it doesn't support that aspect of script. Security I found.

B

A

Way to make it work, it.

B

Definitely works for medicine vacation wake at least I have never checked system script because a system, script implementation ask trip. Security is quite weird because basically approves hashes of script. So I believe that as long as you provide the proper location Hashem, you know Jake asked it will work. I have yet to somehow get this proper hash.

A

Well, and and I've I've certainly approved pipeline scripts with the hash and those do work in Jake. Ask this thing is somehow different and I can't even find the key word necessary to to tell it to approve the script.

A

Okay, so maybe wasn't supported yeah so, but I'm not sure it actually should be supported, because I don't think we really want long term to use to require a system-level script to run an essence to run an agent. This thing should be supported through an SSH agent. Just like all the other agents.

A

Olivier is also, as far as I understand it, working on the steps to include in and include on, CI a-- jenkins, that aisle.

A

Questions there.

A

All right, Alex, any other topics.

C

From you just from the arm 64 front least so we're getting AWS, we have AWS credits, they have their graviton instances which arm 64 so I'll be looking into arm 64 there. Oh.

A

Great all right, I.

B

Wonder whether sponsorship inclusive one.

C

B

F1, it's a few G's. The service I can vary the providing usable use, keys for changing to say, oh, but I've definitely tried to come up with something right.

A

Right but your hardware, but your heart of heart of hardware, suddenly gets pumping and the Blood starts flowing and he said: oh that could be interesting, I'll fight, yet cool I didn't know about FPGA as a service. That sounds that sounds interesting. Yeah.

B

We had a student, you know first foundation this year, who implemented some delivery pipelines for projects using tough one. Well, it wasn't powered by Jenkins, but the concept can be adjusted to junkies as well. So at least it could be good as a case study and mainly as a demo, definitely not on the top of my power least.

A

Alright, any anything else on arm 64, Alex or Oh, like nothing from you anything.

C

A

Right I think we have concluded all of the topics that we had on the agenda. If, if there's nothing else, I propose, we call them into this meeting thanks everybody.

A

Thank you. Thanks and I'll host them, I'll save the save the recording and talk to you in two weeks.