anchor.diff:  toc::[]
   
   == Overview
  -{product-title} provides a container image for running Jenkins.  This image provides a Jenkins server instance which can be used to set up a basic flow for continuous testing, integration, and delivery.
  -
  -This image also includes a sample Jenkins job which triggers a new build of a `*BuildConfig*` defined in {product-title}, tests the output of that build, and then on successful build, retags the output to indicate the build is ready for production.
  -
  +{product-title} provides a container image for running Jenkins. This image provides a Jenkins server instance, which can be used to set up a basic flow for continuous testing, integration, and delivery.
  +
  +This image also includes a sample Jenkins job, which triggers a new build of a `*BuildConfig*` defined in {product-title}, tests the output of that build, and then on successful build, retags the output to indicate the build is ready for production.
  +
  +[[jenkins-version]]
   == Versions
   
   {product-title} follows the https://jenkins.io/changelog-stable/[LTS] releases of Jenkins.
   
  +[[jenkins-images]]
   == Images
   
   This image comes in two flavors, depending on your needs:
  
positive.code: Your {product-title} resources can then reference the ImageStream.
  You can find https://github.com/openshift/origin/tree/master/examples/image-streams[example] ImageStream definitions for all the provided {product-title} images.
  
  == Configuration and Usage
  
  === Initializing Jenkins
  
  There are two methods for managing authentication with the {product-title} Jenkins images when they are initially started.
  
  * {product-title} OAuth authentication provided by the OpenShift Login plugin.
  
  * Standard authentication provided by Jenkins
  
  ==== {product-title} OAuth authentication
  
  {product-title} OAuth authentication will be used when it is explicitly configured in the `*Configure Global Security*` panel in the Jenkins UI, or it will be used automatically when the OpenShift Login plugin
  determines that it is running in a pod and the `*OPENSHIFT_ENABLE_OAUTH*` environment variable on the Jenkins `*Deployment Config*` is set to anything other than `false`.  The plugin will retrieve the
  configuration information needed either from data seeded into the pod, or by interacting with the {product-title} API server via REST invocations.  There are configuration fields available for the plugin, but
  they should only be required for development testing or atypical configurations accessing a different {product-title} installation for OAuth than the installation hosting Jenkins.
  
  The login process is comprised of a series of HTTP redirects.  Rather than the traditional Jenkins login page, you will first be directed to an {product-title} login page, similar to what you see when you log into the web console.  If login
  is successful, you will be redirected to the page within the Jenkins UI you are trying to access.
  
  Valid user / password combinations are controlled by the identity provider in use with {product-title}.  So, for example,  if the default identity provider `Allow All` is used, you can provide any non-empty string for both the user name
  and password.  If you supply the user name used to create the `*Project*` Jenkins is running in, you will have administrative privileges within Jenkins.
  
  If one of the other identity providers is running, valid user/password combinations stored with your identity provider must be used to login.
  
  Valid users are automatically added to the Jenkins authorization matrix as part of login.
  
  The {product-title} `*Role*` of the user then dictates which permissions within the Jenkins authorization matrix are associated with the user.  The `admin` `*Role*` maps to the set of
  permissions traditionally associated with the `admin` user in the {product-title} Jenkins image:
  
  * hudson.model.Computer.Configure
  * hudson.model.Computer.Delete
  
negative.code: * hudson.model.View.Delete
  * hudson.scm.SCM.Tag
  
  Users with the `edit` or `view` roles for the {product-title} project have progressively reduced permissions within Jenkins.
  
  For the `view` role:
  
  * hudson.model.Hudson.Read
  * hudson.model.Item.Read
  
  For the `edit` role, in addition to the permissions available to `*view*`:
  
  * hudson.model.Item.Build
  * hudson.model.Item.Configure
  