Jenkins Agent Security

Question

I have 2 questions that Im trying to figure out.

QUESTION 1

I have setup a Jenkins Master and am trying to create a Agent using the UI. Here is the UI snippet.

Now when I click Save and open the Agent, it tells me to use this command to conenct.

java -jar agent.jar -jnlpUrl https://<MASTER_NODE>/computer/Test_node/slave-agent.jnlp

It is not giving me the option to use -secret. How can I enable that feature so that I also need to provide the secret to connect to my master.

QUESTION 2

I am in the process of automating the creation of multiple Jenkins Agents. Im going to do that using REST API calls. The command is

curl -s -k -w %{http_code} -X POST "https://<MASTER_NODE>/computer/doCreateItem?name=jenkins-slave-1&type=hudson.slaves.DumbSlave" \
                        -H "Content-Type: application/x-www-form-urlencoded" \
                        -H "Jenkins-Crumb: ${JENKINS_CRUMB}" \
                        -d "json=${JNLP_JSON}" )

Now the thing is for every agent, the secret value inside the jnlp file is different. Is there a way to specify that value in the Jenkins Master so that every Jenkins Agent has the same password ?

Answer 1

If you are the jenkins admin, check

1) Manage Jenkins -->Configure Global Security-->Access Control-->Authorization

under Project-based Matrix Authorization Strategy, make sure you have not ticked the Connect options under Agent for Anonymous role.

(or)

2) Make sure Manage Jenkins--> Configure Global Security-->Agents-->Agent protocols has only V4 enabled JNLP V4 TLS based encryption

As for your second question I do not know. am facing the same issue of how to connect the slaves automatically to the Jenkins Master with different Secrets

Answer 2

JNLP Secrets are derived from the Agent's name. You could get the JnlpMac or secret for a specific agent from the jnlp file or via groovy executed on the master. See for example How to find JNLP Node's secret key remotely?

Answer 3

You can add jenkins-slave.exe and jenkins-slave.xml in Remote root directory which contains jre argument this need a secret key. Secret key only needed when you are setting agent as windows service.

I have followed instruction in LINK