Bug 2003204

Hi Mayur,

4 months ago, we upgrade the Jenkins image to an earlier version of Jenkins that deprecated the use of acegi and thus changed the password obfuscation algorithm.
I can that what you are seeing is probably a side effect of it.
https://github.com/openshift/jenkins/commit/2fed2dd020564bcbadbd74687214daa9b923f18e

Can you try bcrypting the admin password before passing it as an environment variable?

Hi Akram,

Thanks for the update.

If possible can you please share the steps that I can use and share with Cu too if get accepted for bcrypting? 

Also, Is there any way to fix this? 

Because README.md is still showing that we can use 'JENKINS_PASSWORD' ENV to set passwords for 'admin' for the default admin password. 
https://github.com/openshift/jenkins#environment-variables

@jkaur and Mayur ; I have reproduced the issue last week and started to work on it https://github.com/openshift/jenkins/pull/1334/files

Right now, it seems that the default password is not saved when setting the JENKINS_PASSWORD env var, the bcyrpt comparison was failing.
A first issue was related to unfound jar during first startup compared to subsequent startups.
We are still investigating it and will update the bz.

Hello Akram, Corey,

Thank you for your update. Please do keep the work progress updated on BZ for reference.
I will share the current updates with the customer. 

Thanks,
Mayur

Hi Mayur,


I have been actively working on this issue for the last 2 days. The good news is that we have a proper fix for it now. The PR is just pending approval.
After doing more tests, I have also seen that the support of the OPENSHIFT_ENABLE_OAUTH variable was certainly broken, but the environment so I also fixed it in another PR. I may merge the 2 PRs together.

I will be working in having an automated e2e test for it between today and tomorrow as this is a pre-requisite for the PR merge, and I will do the requirements for the release.


https://github.com/openshift/jenkins/pull/1334
https://github.com/openshift/jenkins/pull/1345

Akram

Hi Akram,

I am glad that we get the fix for this.

Thank you so much for actively working on this. I really appreciate the time and effort you put into this. 

Thanks,
Mayur

VERIFIED
able to login to jenkins console
=============
 jitsingh@fedora  ~  oc new-project jenkins-test
Now using project "jenkins-test" on server "https://api.app-svc-4.10-011001.devcluster.openshift.com:6443".

You can add applications to this project with the 'new-app' command. For example, try:

    oc new-app rails-postgresql-example

to build a new example application in Ruby. Or use kubectl to deploy a simple Kubernetes application:

    kubectl create deployment hello-node --image=k8s.gcr.io/serve_hostname

 jitsingh@fedora  ~  oc new-app -e JENKINS_PASSWORD=password --docker-image=registry.redhat.io/openshift4/ose-jenkins@sha256:5326101b01e013f94b2f5cd9aa88cd949f8114329eebcc150aaf40f3d535b1a6
Flag --docker-image has been deprecated, Deprecated flag use --image
--> Found container image 64f6876 (3 weeks old) from registry.redhat.io for "registry.redhat.io/openshift4/ose-jenkins@sha256:5326101b01e013f94b2f5cd9aa88cd949f8114329eebcc150aaf40f3d535b1a6"

    Jenkins 2 
    --------- 
    Jenkins is a continuous integration server

    Tags: jenkins, jenkins2, ci

    * An image stream tag will be created as "ose-jenkins:latest" that will track this image

--> Creating resources ...
    imagestream.image.openshift.io "ose-jenkins" created
    deployment.apps "ose-jenkins" created
    service "ose-jenkins" created
--> Success
    Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
     'oc expose service/ose-jenkins' 
    Run 'oc status' to view your app.
 jitsingh@fedora  ~  oc expose service/ose-jenkins
route.route.openshift.io/ose-jenkins exposed
 jitsingh@fedora  ~  oc get routes
NAME          HOST/PORT                                                                    PATH   SERVICES      PORT       TERMINATION   WILDCARD
ose-jenkins   ose-jenkins-jenkins-test.apps.app-svc-4.10-011001.devcluster.openshift.com          ose-jenkins   8080-tcp                 None
 jitsingh@fedora  ~  oc get pods -w
NAME                           READY   STATUS    RESTARTS   AGE
ose-jenkins-59cd8f67fc-8hnhz   1/1     Running   0          38s
^C%                                                                                                                                                                                            ✘ jitsingh@fedora  ~  oc rsh ose-jenkins-59cd8f67fc-8hnhz
sh-4.4$ env | grep JENKINS_PASSWORD
JENKINS_PASSWORD=password
sh-4.4$ exit
exit
============================================

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days