Symptoms

Client master cannot be connected with Operations Center

Diagnostic/Treatment

Pre-condition: Initial connection CJOC -> CM

Most of the connectivity issues related to CJOC-CM are related to a wrong HTTP or TCP configuration. To diagnosis such kind of issues the best approach is to Push the Connection Details from CJOC to CM from Manage in CJOC.

Now, we need to copy/paste the CM URL to finally Push the Connection Details.

Related KB articles
How to Reconnect a Client Master Stuck on Registration

OC-CM healthy status

This is the expected output when we try to connected a CM to CJOC

OC-CM apparent healthy status

In case the connectivity table shows everything is fine but the connectivity still fails, it is surely there is a Proxy set-up in the CM under Manage Jenkins -> Manage Plugins [Advanced section] and the OC hostname was not added in the Non Proxy Host. i.e If the URL to access OC is http://cjoc.jenkins.example.com, then it is expected to have just cjoc.jenkins.example.com in the No Proxy Host section at CM level.

OC-CM issue at HTTP level

There is a HTTP connectivity issue between CJOC-CM.

CJOC is not reachable from CJE at HTTP level

There is a proxy configured in CJE and CJOC is not added as No Proxy Host. Ensure that if under Manage Jenkins → Manage Plugins → Advanced Tab there is a proxy configured, then CJOC hostname is added to No Proxy Host. i.e cjoc.jenkins.example.com.
CJOC is not reachable from CJE at HTTP level. From CJE host try to curl CJOC instance: curl -I http://cjoc.jenkins.example.com:8888/

The header X-Jenkins should appear on the output, i.e: X-Jenkins: 2.7.19.0.1 (CloudBees Jenkins Operations Center 2.7.19.0.1-fixed). If this header does not appear it means CJOC is not reachable from CJE, which means you need to talk to your network administrator to resolve this issue.

Related KB articles:
* How to troubleshoot client master connections

Open a Support ticket if you are stuck at this point adding a Screenshot and a support bundle from each end point CJOC and CM. Also, add the connection logs (http://cjoc.jenkins.example.com:8888/job/Master-1/log) on a separate file.

OC-CM issue at TCP level

There is a TCP connectivity issue between CJOC-CM. Usually this happens because an intermediate elements like haproxy, firewall or ELB is blocking the connection. CloudBees recommends to use the System Property -Dhudson.TcpSlaveAgentListener.hostName=<MACHINE_HOSTNAME> on the instance to bypass those intermediate elements.

The above issue happens if the JNLP_PORT advertised by CJOC is incorrect. Most likely because the System Property -Dhudson.TcpSlaveAgentListener.port=<JNLP_PORT> has been set in CJOC but the <JNLP_PORT> points to an application that is not Jenkins.

OC-CM issue at SSL level

This error message means could mean several things:
1. OC is deployed on an TLS end point using a cert that is not trusted by the client master JVM
2. TLS certificate is expired on CJOC
3. The certificate used on OC does not match the Jenkins URL
4. The reverse proxy uses SNI (see Notes below)

Notes

Operations Center Agent (currently 2.32.0.1 latest at time of writing) does not support TLS SNI

In that particular case, the errors shows in the UI are similar to “OC-CM issue at SSL level”:

Though the Master logs however show a specific exception about the <CJOC_URL>/instance-identity/ endpoint:

WARNING: Pre-validation discovery on https://oc.jenkins.example.com:8888/ failed
javax.net.ssl.SSLHandshakeException: TLS Handshake exception establishing connection to Jenkins server: https://oc.jenkins.example.com:8888/. You might need to trust server's self-signed certificate on global security configuration.
	at com.cloudbees.opscenter.agent.AgentProtocolEndpointLocator.locate(AgentProtocolEndpointLocator.java:530)
	at com.cloudbees.opscenter.client.plugin.OperationsCenterRegistrar$PushRegistrationConfirmation.<init>(OperationsCenterRegistrar.java:500)
	at com.cloudbees.opscenter.client.plugin.OperationsCenterRegistrar$DescriptorImpl.doPushRegistration(OperationsCenterRegistrar.java:316)
	[...]
Caused by: java.util.concurrent.ExecutionException: java.net.ConnectException: General SSLEngine problem to https://oc.jenkins.example.com:8888/instance-identity/

To workaround the problem you could use the certificate CJE is expecting as the default one in the CJOC reverse proxy side. This should work as long as it is the default one.

Operations Center connectivity issues while trying to Push the Connection Details