Bamboo Deployment Plans can bypass dedicate agent checks

[Paul]

It looks as though there is a way round BAM-3491 (Limit agents to given plans). For a deployment plan it is possible to select any agent irrespective of any constraints.

For example if a remote agent is dedicated to Project A and a deployment plan is created under Project B. For that deployment plan, clicking the Agents button under the other environment setting it is possible to select the agent dedicated to Project A. 

We are running Bamboo Server 5.12.2.1 Build 51213

[rsperafico · Accepted solution]

Hello Paul,

clicking the Agents button under the other environment setting it is possible to select the agent dedicated to Project A. 

 Please, notice dedication is not exclusive. You are able to dedicate the same agent to multiple Build project, Build plan, Build job, Deployment project and/or Deployment environment.

Edit agents: Environment

Dedicate specific agents or image configurations to execute all deployments for this environment. If you do not assign an agent to this deployment, one will be chosen at run time according to standard requirement/capability mappings.

NOTE: By adding an agent to this list, it will no longer execute any build jobs. It will only execute deployments for this environment, and other environments that are explicitly configured to use this agent. One agent can be assigned to several deployment environments.

Extracted from view http://localhost:8085/deploy/config/configureEnvironmentAgents.action?environmentId=ENVIRONMENT_ID

Yes, you are correct on your statement. The view in question is another way to Dedicating an agent in Bamboo.

Bamboo allows you to dedicate an agent, to run, for example, only specific build projects, deployment projects or associated activities. You must dedicate an agent to a type of activity and a specific entity of that type.

Note that when you dedicate an agent, then no other activity will be able to use it, unless it is dedicated to that activity as well. Similarly, no other agent will be able to build this plan other than the agent(s) that are dedicated to build it.

Extracted from Dedicating an agent.

—

Kind regards,
Rafael P. Sperafico

[Paul]

Hi Rafael,

Many thanks for your reply. This is a problem for us as we have separate teams that don't want other teams running their deployment plans on their agents. 

As it stands there is nothing to prevent somebody running a deployment plan on any agent.

I have added more detailed comments to ticket BAM-3491