• setup cli
  • get port
  • ssh
  • jenkins-cli.jar
• execute groovy script via cli
  • ERROR: This command is requesting the -remoting mode which is no longer supported
  • solution
• execute groovysh
  • execute the script via https
• execute cil via kubectl
• man cli

setup cli

export JENKINS_DOMAIN=<jenkins.sample.com>

get port

$ curl -Lv https://${JENKINS_DOMAIN}/login 2>&1 | grep -i 'x-ssh-endpoint'
< x-ssh-endpoint: jenkins.sample.com:31232

$ k -n ci get svc jenkins-discovery -o yaml
apiVersion: v1
kind: Service
metadata:
  ...
spec:
  ports:
  - name: jenkins-agent
    nodePort: 3xxxx
    port: 50000
    protocol: TCP
    targetPort: jnlp-port
  - name: cli-agent
    nodePort: 32123
    port: 31232
    protocol: TCP
    targetPort: cli-port
  selector:
    app: jenkins
...

ssh

• Jenkins config

• ~/.ssh/config

  $ cat ~/.ssh/config
  Host  jenkins.sample.com
      User                marslo
      IdentityFile        ~/.ssh/marslo
      Port                32123
  

• using cli

  $ ssh -q ${JENKINS_DOMAIN} help
  add-job-to-view
    Adds jobs to view.
  apply-configuration
    Apply YAML configuration to instance
  build
    Builds a job, and optionally waits until its completion.
  cancel-quiet-down
    Cancel the effect of the "quiet-down" command.
  channel-process
    Launch a new JVM on a slave and connect it with the master with remoting
  ...
  

• or

  $ ssh -l <user> -i <ssh-private-key> -p <port> ${JENKINS_DOMAIN} <command>
  
  # example
  $ ssh -l marslo -i ~/.ssh/marslo -p 32123 ${JENKINS_DOMAIN} help
  

jenkins-cli.jar

• get client (jenkins-cli.jar)

  $ curl -fsSL -O [-u<username>:<password>] https://${JENKINS_DOMAIN}/jnlpJars/jenkins-cli.jar
  
  # or
  $ curl -fsSL -O --netrc-file ~/.marslo/.netrc' https://${JENKINS_DOMAIN}/jnlpJars/jenkins-cli.jar
  $ cat ~/.marslo/.netrc
  machine <JENKINS_DOMAIN>
  login myaccount
  password mypassword
  

• use cli

  $ java -jar jenkins-cli.jar -auth <username>:<password> -s https://${JENKINS_DOMAIN} <command>
  
  # example
  $ java -jar jenkins-cli.jar -auth marslo:<MY-CLI-TOKEN> -s https://${JENKINS_DOMAIN} help
    add-job-to-view
      Adds jobs to view.
    apply-configuration
      Apply YAML configuration to instance
    build
      Builds a job, and optionally waits until its completion.
    cancel-quiet-down
      Cancel the effect of the "quiet-down" command.
    ...
  

handle -auth

• using directly in command line

  $ java -jar jenkins-cli.jar -auth marslo:<MY-CLI-TOKEN> -s https://${JENKINS_DOMAIN}
  

• using file

  $ echo 'marslo:<MY-CLI-TOKEN> ~/.marslo/.jenkins-cli'
  $ java -jar jenkins-cli.jar -auth @/Users/marslo/.marslo/.jenkins-cli -s https://${JENKINS_DOMAIN}
  

• using environment

  $ export JENKINS_USER_ID=marslo
  $ export JENKINS_API_TOKEN=<MY-CLI-TOKEN>
  $ java -jar jenkins-cli.jar -s https://${JENKINS_DOMAIN}
  

execute groovy script via cli

ERROR: This command is requesting the -remoting mode which is no longer supported

$ ssh -q <jenkins.domain.name> groovy <script.groovy>

solution

$ ssh -q <jenkins.domain.name> groovy = < /path/to/script.groovy

• i.e.:

  $ cat a.groovy
  println System.getProperties().sort().findAll{ it.key.contains('java') }.collect{ "${it.key} ~> ${it.value}" }.join('\n')
  
  $ ssh jenkins.example.com groovy =< ./a.groovy | head -4
  java.awt.graphicsenv ~> sun.awt.X11GraphicsEnvironment
  java.awt.headless ~> true
  java.awt.printerjob ~> sun.print.PSPrinterJob
  java.class.path ~> /usr/share/jenkins/jenkins.war
  ...
  

execute groovysh

$ ssh <jenkins.domina.name> groovysh
groovy:000> println System.getProperties().sort().collect{ "${it.key} ~> ${it.value}" }.join('\n')
awt.toolkit ~> sun.awt.X11.XToolkit
com.cloudbees.workflow.rest.external.ChangeSetExt.resolveCommitAuthors ~> true
executable-war ~> /usr/share/jenkins/jenkins.war
file.encoding ~> UTF-8
file.separator ~> /

execute the script via https

[!TIP|label:references:]

• Script Console
• imarslo : script console

A Jenkins Admin can execute groovy scripts remotely by sending an HTTP POST request to /script/ url or /scriptText/.

• format

  $ curl -d "script=<your_script_here>" https://jenkins/script
  
  # or to get output as a plain text result (no HTML)
  $ curl -d "script=<your_script_here>" https://jenkins/scriptText
  

• example : curl submitting groovy file via bash

  $ curl --data-urlencode "script=$(< ./somescript.groovy)" https://jenkins/scriptText
  
  # or
  $ curl --user 'username:api-token' --data-urlencode \
         "script=$(< ./somescript.groovy)" https://jenkins/scriptText
  

• example : Python submitting groovy file providing username and api token

  with open('somescript.groovy', 'r') as fd:
      data = fd.read()
  r = requests.post('https://jenkins/scriptText', auth=('username', 'api-token'), data={'script': data})
  

execute cil via kubectl

[!TIP|label:references:]

• Secrets handling in Kubernetes - A Jenkins story

$ kubectl exec -it po/jenkins-0 -c jenkins -- bash -c
    'echo \'println(hudson.util.Secret.fromString("test").getEncryptedValue())'
    | java -jar /var/jenkins_home/war/WEB-INF/lib/cli-2.303.1.jar
    s http://0.0.0.0:8080
    auth Admin:$(cat /run/secrets/chart-admin-password)
    groovy = '
{AQAAABAAAAAQGiN0B2weIsYfpg0LqBbM7WSBn9+zSBcH4OXyYpaVVig=}
$

man cli