[4564] Restructure Security section #4612
Conversation
probot-autolabeler
bot
added
the
documentation
…ns.io into 1004-security-overview
|
@daniel-beck Can you approve this so we can merge it? |
content/doc/book/security/index.adoc
Outdated
| that are destroyed at the end of each build job. | ||
|
|
||
| NOTE: A job that performs administrative tasks such as backups may run on the controller, | ||
| but be sure to label the executor and only allow it to be used by jobs that specify that label. |
There was a problem hiding this comment.
This is already a potential problem, as pipeline authors can configure their pipelines to run on node('master || built-in') and suddenly other stuff is running. https://plugins.jenkins.io/job-restrictions/ exists, but out of the box, only zero executors can prevent that.
There was a problem hiding this comment.
This whole sub-section is being merged with the info in the controller-isolation.adoc file. See #4635 . I will modify the note in that PR.
There was a problem hiding this comment.
See lines 45ff in the controller-isolation.adoc file. I did not include the syntax that Pipeline authors can use to access a labeled executor. I figured we didn't want to make this a how-to manual, right?
|
The PR is now being redone to conform with the structure discussed in https://docs.google.com/document/d/1xpx6CGyCv3Dcs9blZLwKnzgTsPg-pkabM3XeyfMiUNY/edit#heading=h.df9a9tasgkqd . All this restructuring is going to make this PR very large but it will mean we have the structure in place moving forward. To try to reduce the pain, I am annotating the gdoc with links to the relevant commit. |
StackScribe
changed the title
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
…ns.io into 1004-security-overview
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
…ns.io into 1004-security-overview
jenkins-infra/jenkins.io#4612 includes a detailed review by Daniel where he recommended that Meg McRoberts proceed with the removal of the file that references this location. The content on the page is well covered by the destination of the redirect and the destination of the redirect is being updated and corrected as needed for further improvements.
|
We discussed the structural issues with this piece in the 24 January Docs Office Hours and came up with the following actions, all of which have been implemented:
|
github-actions
bot
added
the
unresolved-merge-conflict
|
Please take a moment and address the merge conflicts of your pull request. Thanks! |
This is the first of a series of PRs to restructure and update the "Securing Jenkins" chapter, adding:
Reviewers: please particularly note material about Security Advisories and Security Updates. I am not sure that they are linked to the most appropriate pages.
@MarkEWaite @daniel-beck @Wadeck
This PR also modifies the information about "Enable Security" that is in the "Managing Security" page and turns it into a NOTE. This is here because I first moved that note onto this page but then decided it belongs where it is.
This PR also includes some rewrites to the "Agents and Security" material that was here, although this will be removed and merged with what is in the "Controller Isolation" page.
The rest of the material on this page will be merged with information in other pages of this chapter.
When completed, this chapter will have this general flow: