anchor.diff:  |Variable name |Description
   
   |`*JENKINS_PASSWORD*`
  -|Password for the `*admin*` user when using standard Jenkins authentication.  Not applicable when using {product-title} OAuth authentication.
  +|The password for the `*admin*` user when using standard Jenkins authentication.  Not applicable when using {product-title} OAuth authentication.
   
   |`*OPENSHIFT_ENABLE_OAUTH*`
  -|Determines whether the OpenShift Login plugin manages authentication when logging into Jenkins.  Enabled when set to any non-empty value other than "false".
  +|Determines whether the OpenShift Login plug-in manages authentication when logging into Jenkins. Enabled when set to any non-empty value other than "false".
   
   |`*OPENSHIFT_PERMISSIONS_POLL_INTERVAL*`
  -|Specifies in seconds how often the OpenShift Login plugin polls {product-title} for the permissions associated with each user defined in Jenkins.
  +|Specifies in seconds how often the OpenShift Login plug-in polls {product-title} for the permissions associated with each user defined in Jenkins.
   
   |===
   
  +[[jenkins-cross-project-access]]
   === Cross Project Access
   
  -If you are going to run Jenkins somewhere other than as a deployment within your same project you will need to provide an access token to Jenkins to access your project.
  -
  -    1. Identify the service account token secret associated with a service account that has appropriate permissions to access the project Jenkins will need to access::
  -
  -            $ oc describe serviceaccount default
  -
  -        Example output:
  -
  -            Name:       default
  -            Labels:     <none>
  -            Secrets:    {  default-token-uyswp    }
  -                        {  default-dockercfg-xcr3d    }
  -            Tokens:     default-token-izv1u
  -                        default-token-uyswp
  -
  -        In this case the secret name is `default-token-uyswp`
  -
  -    2. Retrieve the token from the secret:
  -
  -            $ oc describe secret <secret name from above> # e.g. default-token-izv1u
  -
  -        Example output:
  -
  -            Name:       default-token-izv1u
  -            Labels:     <none>
  -            Annotations:    kubernetes.io/service-account.name=default,kubernetes.io/service-account.uid=32f5b661-2a8f-11e5-9528-3c970e3bf0b7
  -            Type:   kubernetes.io/service-account-token
  -            Data
  -            ====
  -            ca.crt: 1066 bytes
  -            token:  eyJhbGc..<content cut>....wRA
  -
  -The token field contains the token value Jenkins will need to access the project.
  -
  +If you are going to run Jenkins somewhere other than as a deployment within your same project, you will need to provide an access token to Jenkins to access your project.
  +
  +. Identify the secret for the service account that has appropriate permissions
  +to access the project Jenkins needs to access:
  ++
  +----
  +$ oc describe serviceaccount default
  +Name:       default
  +Labels:     <none>
  +Secrets:    {  default-token-uyswp    }
  +            {  default-dockercfg-xcr3d    }
  +Tokens:     default-token-izv1u
  +            default-token-uyswp
  +----
  ++
  +In this case the secret is named `default-token-uyswp`
  +
  +. Retrieve the token from the secret:
  ++
  +----
  +$ oc describe secret <secret name from above> # e.g. default-token-izv1u
  +Name:       default-token-izv1u
  +Labels:     <none>
  +Annotations:    kubernetes.io/service-account.name=default,kubernetes.io/service-account.uid=32f5b661-2a8f-11e5-9528-3c970e3bf0b7
  +Type:   kubernetes.io/service-account-token
  +Data
  +====
  +ca.crt: 1066 bytes
  +token:  eyJhbGc..<content cut>....wRA
  +----
  +
  +The token field contains the token value Jenkins needs to access the project.
  +
  +[[jenkins-volume-mount-points]]
   === Volume Mount Points
   The Jenkins image can be run with mounted volumes to enable persistent storage for the configuration:
   
   * *_/var/lib/jenkins_* - This is the data directory where Jenkins stores configuration files including job definitions.
   
  +[[jenkins-creating-jenkins-service-from-template]]
   == Creating a Jenkins Service from a Template
   
   xref:../../dev_guide/templates.adoc#dev-guide-templates[Templates] provide parameter fields to
  
positive.code: Your {product-title} resources can then reference the ImageStream.
  You can find https://github.com/openshift/origin/tree/master/examples/image-streams[example] ImageStream definitions for all the provided {product-title} images.
  
  == Configuration and Usage
  
  === Initializing Jenkins
  
  There are two methods for managing authentication with the {product-title} Jenkins images when they are initially started.
  
  * {product-title} OAuth authentication provided by the OpenShift Login plugin.
  
  * Standard authentication provided by Jenkins
  
  ==== {product-title} OAuth authentication
  
  {product-title} OAuth authentication will be used when it is explicitly configured in the `*Configure Global Security*` panel in the Jenkins UI, or it will be used automatically when the OpenShift Login plugin
  determines that it is running in a pod and the `*OPENSHIFT_ENABLE_OAUTH*` environment variable on the Jenkins `*Deployment Config*` is set to anything other than `false`.  The plugin will retrieve the
  configuration information needed either from data seeded into the pod, or by interacting with the {product-title} API server via REST invocations.  There are configuration fields available for the plugin, but
  they should only be required for development testing or atypical configurations accessing a different {product-title} installation for OAuth than the installation hosting Jenkins.
  
  The login process is comprised of a series of HTTP redirects.  Rather than the traditional Jenkins login page, you will first be directed to an {product-title} login page, similar to what you see when you log into the web console.  If login
  is successful, you will be redirected to the page within the Jenkins UI you are trying to access.
  
  Valid user / password combinations are controlled by the identity provider in use with {product-title}.  So, for example,  if the default identity provider `Allow All` is used, you can provide any non-empty string for both the user name
  and password.  If you supply the user name used to create the `*Project*` Jenkins is running in, you will have administrative privileges within Jenkins.
  
  If one of the other identity providers is running, valid user/password combinations stored with your identity provider must be used to login.
  
  Valid users are automatically added to the Jenkins authorization matrix as part of login.
  
  The {product-title} `*Role*` of the user then dictates which permissions within the Jenkins authorization matrix are associated with the user.  The `admin` `*Role*` maps to the set of
  permissions traditionally associated with the `admin` user in the {product-title} Jenkins image:
  
  * hudson.model.Computer.Configure
  * hudson.model.Computer.Delete
  
negative.code: * hudson.model.Item.Workspace
  * hudson.scm.SCM.Tag
  
  
  [NOTE]
  ====
  The `admin` user that is pre-populated in the {product-title} Jenkins image with
  administrative privileges will not be given those privileges when
  {product-title} OAuth is used, unless the {product-title} cluster administrator
  explicitly defines that user in the {product-title} identity provider and
  assigns the `admin` role to the user.
  ====
  
  Jenkins' users permissions can be changed after the users are initially
  established. The OpenShift Login plug-in polls the {product-title} API server
  for permissions and updates the permissions stored in Jenkins for each user with
  the permissions retrieved from {product-title}. If the Jenkins UI is used to
  update permissions for a Jenkins user, the permission changes are overwritten
  the next time the plug-in polls {product-title}.
  
  You can control how often the polling occurs with the
  `OPENSHIFT_PERMISSIONS_POLL_INTERVAL` environment variable. The default polling
  interval is five minutes.
  
  .Creating a new Jenkins pod
  
  . Ensure you have installed
  xref:../../install_config/imagestreams_templates.adoc[the default imagestreams
  and templates].
  
  . Then create a new Jenkins application using:
  .. Persistent volumes:
  ----
  $ oc new-app jenkins-persistent
  ----
  
  .. Or an EmptyDir type volume (where configuration does not persist across pod restarts):
  ----
  $ oc new-app jenkins-ephemeral
  ----
  
  [NOTE]
  ====
  If you instantiate the template against releases prior to v3.4 of
  {product-title}, standard Jenkins authentication is used, and the default
  'admin' account will exist with password 'password'. See
  xref:../../using_images/other_images/jenkins.adoc#jenkins-jenkins-standard-authentication[Jenkins
  Standard Authentication] for details about changing this password.
  ====
  
  [[jenkins-jenkins-standard-authentication]]
  ==== Jenkins Standard Authentication
  
  Jenkins authentication is used by default if the image is run outside of
  {product-title}.
  
  The first time Jenkins starts, the configuration is created along with the
  administrator user and password. The default user credentials are `*admin*` and
  `*password*`. Configure the default password by setting the `*JENKINS_PASSWORD*`
  environment variable when using (and only when using) standard Jenkins
  authentication.
  
  To create a new Jenkins application using standard Jenkins authentication:
  
  ----
  $ oc new-app -e \
  