Issue with Role-Based Authorization Strategy in Jenkins on GKE

Using Jenkins Ask a question
1

I recently installed Jenkins using a Helm chart on Google Kubernetes Engine (GKE) and enabled the Role-Based Authorization Strategy. I created multiple global roles and assigned them to the appropriate items. I also configured a Persistent Volume Claim (PVC) to ensure data persistence.

However, after restarting Jenkins the authorization strategy back to “Logged-in users can do anything,” I noticed that all my previously created roles and their assigned items have disappeared.

Could someone please help me understand why this is happening? Any insights or recommendations on how to prevent this issue in the future would be greatly appreciated.

Thank you!

2

Do you have CasC files in your JENKINS_HOME that are applied after each restart and contain a different security realm?

3

@mawinter69 yes I have that file in JENKINS_HOME path.

drwxrwsrwx 2 root jenkins 4096 Sep 30 08:46 casc_configs

4

That’s a directory, check what you have in there and if it contains something for the security realm.

5

@mawinter69 I can see a security yaml file

pwd
/var/jenkins_home/casc_configs
jenkins@jenkins-0:~/casc_configs$ ls
jcasc-default-config.yaml
jenkins@jenkins-0:~/casc_configs$

But looks like still authorization strategy is ‘loggedInUsersCanDoAnything’ even I selected role based strategy in Jenkins GUI.

jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false

My use case:

  1. I want to enable role-based authorization through the GUI.
  2. I need this configuration to persist even after a Jenkins restart.

My question:

  • What steps should I follow to ensure that this configuration remains persistent after restarts?

Thank you for your assistance!

6

These are configuration files that are applied on every start of Jenkins. So if you don’t want things from there you should remove the corresponding part in that file or delete it completely.