CJE cheat sheet

JENKINS_HOME holds config.xml, jobs/, plugins/, users/, secrets/, and workspace/; back it up as a unit because credentials and job definitions live there.

The WAR file runs standalone via java -jar jenkins.war; systemd or Windows service wrappers add restart-on-failure and correct JVM flags.

Initial admin password is written to $JENKINS_HOME/secrets/initialAdminPassword and is consumed by the setup wizard; the file is deleted after setup completes.

JVM heap is set with -Xmx in JAVA_OPTS or the service config; default heap is often too small for large pipelines and plugin-heavy instances.

Configuration as Code (JCasC) loads jenkins.yaml via CASC_JENKINS_CONFIG; settings applied there are marked as managed and cannot be edited in the UI.

The update center has three levels: core, plugins, and plugin dependencies; 'Safe Restart' waits for running builds while 'Restart' does not.

Quiet mode (quietDown) blocks new builds while letting queued and running builds finish, which is the standard pre-restart step.

jenkins-cli.jar supports build, reload-configuration, install-plugin, and safe-restart; modern CLI requires SSH or the -webSocket flag.

Plugin version drift is checked with the plugin manager's update list; compatibility with the running core version is shown per plugin.

Security realm options include Jenkins' own database, LDAP, and servlet-container (reverse-proxy) authentication; the realm and authorization strategy are configured separately.

Authorization strategies: Anyone can do anything, Legacy mode, Logged-in users can do anything, Matrix-based security, and Project-based matrix authorization.

Matrix-based security grants permissions globally per user/group; project-based matrix overrides them per job or folder.

Permissions are grouped by scope: Overall, Credentials, Agent, Job, Run, View, and SCM; 'Overall/Administer' implies all others.

Folders use inheritable permissions; a child item inherits its parent's ACL unless it defines its own.

API tokens authenticate as the owning user without exposing the password; they are ideal for scripts and CLI use.

The CSRF crumb is required on state-changing HTTP requests; crumbIssuer settings control strictness and are relevant to reverse proxies.

Credentials are stored encrypted with the instance identity and master key in secrets/; copying JENKINS_HOME to another instance without those secrets breaks decryption.

Agent-to-controller security subsystem restricts file system and command access from agents; TCP agent port 50000 should be firewalled or disabled.

Freestyle jobs define SCM, triggers, build steps, and post-build actions through the UI; they store configuration in the job's config.xml.

Pipeline jobs run a Jenkinsfile either inline or from SCM; the 'Pipeline script from SCM' option is what makes pipeline-as-code work.

Multibranch Pipeline scans a repository, creates a job per branch/PR that contains a Jenkinsfile, and removes jobs for deleted branches.

Parameterized builds expose params as environment variables; parameters are resolved at build start and are not re-evaluated mid-build.

Build triggers include SCM polling (cron syntax), periodic builds, upstream/downstream jobs, and remote trigger tokens.

Build discardors cap stored builds by count, days, or both; pipelines must set options { buildDiscarder(...) } or the job grows unbounded.

Concurrent builds can be disabled per job; for pipelines, the disableConcurrentBuilds() option serializes or aborts overlapping runs.

Environment variables come from global config, node config, job config, and env steps; later definitions override earlier ones.

Declarative pipeline requires pipeline { agent, stages, steps } and uses post { always, success, failure, unstable, changed } for outcome handling.

Scripted pipeline is Groovy with node { } blocks; declarative wraps scripted via the script { } step for arbitrary Groovy.

agent any, agent none, agent { label 'x' }, and agent { docker { image '...' } } control where stages execute; agent none requires per-stage agents.

The Jenkinsfile is checked out before the pipeline runs for 'from SCM' jobs; the checkout is available as the initial workspace content.

Shared Libraries are loaded with @Library('name@version') _ and provide vars/ global steps and src/ Groovy classes across jobs.

parallel and matrix directives fan out stages; failFast aborts siblings on the first failure in a parallel block.

input { } pauses a stage for approval with optional submitter, timeout, and parameters; without a timeout it can hang indefinitely.

Environment credentials should be bound with withCredentials or environment { SECRET = credentials('id') }; the latter also defines _USR and _PSW variants for username/password credentials.

Replay re-runs a build with an editable copy of its script; it is not persisted to SCM and is useful for debugging only.

GitHub Branch Source and GitLab plugins create multibranch jobs and configure webhooks automatically when credentials allow repository admin access.

The generic endpoint is /github-webhook/ for GitHub and /gitlab-webhook/ (or /project/) for GitLab; the payload URL must be publicly reachable or tunneled.

Webhook secret validation uses a shared secret configured both in the SCM and in the Jenkins job; mismatches return HTTP 403.

Polling SCM uses cron syntax (e.g., H/5 * * * *) and is a fallback when webhooks cannot reach Jenkins; H spreads load across the interval.

Multibranch scan triggers (periodic folder scan) are separate from build triggers; a branch is only built after a scan discovers its Jenkinsfile.

Git plugin checkout options include shallow clone depth, sparse checkout paths, and submodule strategies; shallow clone reduces time and disk.

Credentials for SCM are referenced by ID; the GitHub App or personal access token needs repo scope for private repositories.

Change requests (PRs) can be built as merged-with-target or head-only depending on the 'Build origin PRs' and discover-PR settings.

Agents connect via inbound TCP (JNLP on port 50000), inbound SSH, or outbound WebSocket; outbound WebSocket avoids opening inbound firewall ports.

Agent labels and node names determine scheduling; agent { label 'linux && docker' } matches label expressions with && and ||.

Executors per node set parallelism; the controller's executor count should be 0 in production to keep builds off the controller.

The remoting JAR version is negotiated at connect time; mismatches cause handshake failures, resolved by re-downloading agent.jar from the node page.

Docker agents run each build in a fresh container and can pull private images using credentialsId; the workspace is mounted into the container.

Kubernetes plugin creates pods on demand from a pod template; idleMinutes and instanceCap control scale-down and maximum parallelism.

Cloud agents (EC2, Kubernetes, Azure) are ephemeral; anything needed after the build must be archived as an artifact or pushed to external storage.

Agent disconnection during a build fails the build unless it reconnects within the channel timeout; the workspace stays on the agent's disk.

archiveArtifacts stores files under the build's artifacts/ directory; fingerprinting records which builds produced and consumed each file.

JUnit results are published with junit '**/target/*.xml'; the plugin parses XML and marks the build unstable on failures.

Pipeline steps for reports include publishHTML, recordIssues (warnings-ng), and coverage plugins such as jacoco or cobertura adapters.

Stash/unstash passes files between stages and nodes within a single build; stash is not durable across builds and is not an artifact store.

Artifactory or Nexus integration publishes to an external repository; Jenkins' own artifact storage is not a package repository.

The plugin manager shows dependencies and required core version; installing a plugin can force core upgrades if it declares a minimum version.

Plugins are loaded per instance and can conflict; the plugin usage page and 'Plugin Manager > Installed' warnings list incompatible or failed plugins.

Pipeline step reference is generated from installed plugins; a missing step usually means the plugin is not installed on that controller.

Thread dumps via /threadDump or jstack on the JVM PID diagnose hangs; look for blocked executor threads or stuck remoting channels.

The support bundle (jenkins.io/support-bundle) collects logs, config, and thread dumps for escalation without exposing secrets where filtered.

Build logs live under jobs//builds//log; the 'Log Rotator' and build discarders control retention and disk growth.

The monitoring plugin (Metrics/Health) exposes JVM heap, executor utilization, and response times; heap pressure often shows as long GC pauses.

Disk space is the most common outage cause; workspace and archived artifacts dominate, and 'Workspace Cleanup' or ws cleanup steps reclaim it.

Plugin updates should be staged: back up JENKINS_HOME, update in a maintenance window, and verify with a smoke-test job before broad rollout.

Cron syntax errors in triggers cause silent non-scheduling; check 'Manage > Script Console' or the trigger's log for parse errors.

The script console (Groovy) can inspect and fix state, e.g., Jenkins.instance.getQueue().clear() or reloading config; use with caution on production.

JENKINS_HOME holds config.xml, jobs/, plugins/, users/, secrets/, and workspace/; back it up as a unit because credentials and job definitions live there.

The WAR file runs standalone via java -jar jenkins.war; systemd or Windows service wrappers add restart-on-failure and correct JVM flags.

Initial admin password is written to $JENKINS_HOME/secrets/initialAdminPassword and is consumed by the setup wizard; the file is deleted after setup completes.

JVM heap is set with -Xmx in JAVA_OPTS or the service config; default heap is often too small for large pipelines and plugin-heavy instances.

Configuration as Code (JCasC) loads jenkins.yaml via CASC_JENKINS_CONFIG; settings applied there are marked as managed and cannot be edited in the UI.

The update center has three levels: core, plugins, and plugin dependencies; 'Safe Restart' waits for running builds while 'Restart' does not.

Quiet mode (quietDown) blocks new builds while letting queued and running builds finish, which is the standard pre-restart step.

jenkins-cli.jar supports build, reload-configuration, install-plugin, and safe-restart; modern CLI requires SSH or the -webSocket flag.

Plugin version drift is checked with the plugin manager's update list; compatibility with the running core version is shown per plugin.

Security realm options include Jenkins' own database, LDAP, and servlet-container (reverse-proxy) authentication; the realm and authorization strategy are configured separately.

Authorization strategies: Anyone can do anything, Legacy mode, Logged-in users can do anything, Matrix-based security, and Project-based matrix authorization.

Matrix-based security grants permissions globally per user/group; project-based matrix overrides them per job or folder.

Permissions are grouped by scope: Overall, Credentials, Agent, Job, Run, View, and SCM; 'Overall/Administer' implies all others.

Folders use inheritable permissions; a child item inherits its parent's ACL unless it defines its own.

API tokens authenticate as the owning user without exposing the password; they are ideal for scripts and CLI use.

The CSRF crumb is required on state-changing HTTP requests; crumbIssuer settings control strictness and are relevant to reverse proxies.

Credentials are stored encrypted with the instance identity and master key in secrets/; copying JENKINS_HOME to another instance without those secrets breaks decryption.

Agent-to-controller security subsystem restricts file system and command access from agents; TCP agent port 50000 should be firewalled or disabled.

Freestyle jobs define SCM, triggers, build steps, and post-build actions through the UI; they store configuration in the job's config.xml.

Pipeline jobs run a Jenkinsfile either inline or from SCM; the 'Pipeline script from SCM' option is what makes pipeline-as-code work.

Multibranch Pipeline scans a repository, creates a job per branch/PR that contains a Jenkinsfile, and removes jobs for deleted branches.

Parameterized builds expose params as environment variables; parameters are resolved at build start and are not re-evaluated mid-build.

Build triggers include SCM polling (cron syntax), periodic builds, upstream/downstream jobs, and remote trigger tokens.

Build discardors cap stored builds by count, days, or both; pipelines must set options { buildDiscarder(...) } or the job grows unbounded.

Concurrent builds can be disabled per job; for pipelines, the disableConcurrentBuilds() option serializes or aborts overlapping runs.

Environment variables come from global config, node config, job config, and env steps; later definitions override earlier ones.

Declarative pipeline requires pipeline { agent, stages, steps } and uses post { always, success, failure, unstable, changed } for outcome handling.

Scripted pipeline is Groovy with node { } blocks; declarative wraps scripted via the script { } step for arbitrary Groovy.

agent any, agent none, agent { label 'x' }, and agent { docker { image '...' } } control where stages execute; agent none requires per-stage agents.

The Jenkinsfile is checked out before the pipeline runs for 'from SCM' jobs; the checkout is available as the initial workspace content.

Shared Libraries are loaded with @Library('name@version') _ and provide vars/ global steps and src/ Groovy classes across jobs.

parallel and matrix directives fan out stages; failFast aborts siblings on the first failure in a parallel block.

input { } pauses a stage for approval with optional submitter, timeout, and parameters; without a timeout it can hang indefinitely.

Environment credentials should be bound with withCredentials or environment { SECRET = credentials('id') }; the latter also defines _USR and _PSW variants for username/password credentials.

Replay re-runs a build with an editable copy of its script; it is not persisted to SCM and is useful for debugging only.

GitHub Branch Source and GitLab plugins create multibranch jobs and configure webhooks automatically when credentials allow repository admin access.

The generic endpoint is /github-webhook/ for GitHub and /gitlab-webhook/ (or /project/) for GitLab; the payload URL must be publicly reachable or tunneled.

Webhook secret validation uses a shared secret configured both in the SCM and in the Jenkins job; mismatches return HTTP 403.

Polling SCM uses cron syntax (e.g., H/5 * * * *) and is a fallback when webhooks cannot reach Jenkins; H spreads load across the interval.

Multibranch scan triggers (periodic folder scan) are separate from build triggers; a branch is only built after a scan discovers its Jenkinsfile.

Git plugin checkout options include shallow clone depth, sparse checkout paths, and submodule strategies; shallow clone reduces time and disk.

Credentials for SCM are referenced by ID; the GitHub App or personal access token needs repo scope for private repositories.

Change requests (PRs) can be built as merged-with-target or head-only depending on the 'Build origin PRs' and discover-PR settings.

Agents connect via inbound TCP (JNLP on port 50000), inbound SSH, or outbound WebSocket; outbound WebSocket avoids opening inbound firewall ports.

Agent labels and node names determine scheduling; agent { label 'linux && docker' } matches label expressions with && and ||.

Executors per node set parallelism; the controller's executor count should be 0 in production to keep builds off the controller.

The remoting JAR version is negotiated at connect time; mismatches cause handshake failures, resolved by re-downloading agent.jar from the node page.

Docker agents run each build in a fresh container and can pull private images using credentialsId; the workspace is mounted into the container.

Kubernetes plugin creates pods on demand from a pod template; idleMinutes and instanceCap control scale-down and maximum parallelism.

Cloud agents (EC2, Kubernetes, Azure) are ephemeral; anything needed after the build must be archived as an artifact or pushed to external storage.

Agent disconnection during a build fails the build unless it reconnects within the channel timeout; the workspace stays on the agent's disk.

archiveArtifacts stores files under the build's artifacts/ directory; fingerprinting records which builds produced and consumed each file.

JUnit results are published with junit '**/target/*.xml'; the plugin parses XML and marks the build unstable on failures.

Pipeline steps for reports include publishHTML, recordIssues (warnings-ng), and coverage plugins such as jacoco or cobertura adapters.

Stash/unstash passes files between stages and nodes within a single build; stash is not durable across builds and is not an artifact store.

Artifactory or Nexus integration publishes to an external repository; Jenkins' own artifact storage is not a package repository.

The plugin manager shows dependencies and required core version; installing a plugin can force core upgrades if it declares a minimum version.

Plugins are loaded per instance and can conflict; the plugin usage page and 'Plugin Manager > Installed' warnings list incompatible or failed plugins.

Pipeline step reference is generated from installed plugins; a missing step usually means the plugin is not installed on that controller.

Thread dumps via /threadDump or jstack on the JVM PID diagnose hangs; look for blocked executor threads or stuck remoting channels.

The support bundle (jenkins.io/support-bundle) collects logs, config, and thread dumps for escalation without exposing secrets where filtered.

Build logs live under jobs//builds//log; the 'Log Rotator' and build discarders control retention and disk growth.

The monitoring plugin (Metrics/Health) exposes JVM heap, executor utilization, and response times; heap pressure often shows as long GC pauses.

Disk space is the most common outage cause; workspace and archived artifacts dominate, and 'Workspace Cleanup' or ws cleanup steps reclaim it.

Plugin updates should be staged: back up JENKINS_HOME, update in a maintenance window, and verify with a smoke-test job before broad rollout.

Cron syntax errors in triggers cause silent non-scheduling; check 'Manage > Script Console' or the trigger's log for parse errors.

The script console (Groovy) can inspect and fix state, e.g., Jenkins.instance.getQueue().clear() or reloading config; use with caution on production.