Jenkins 2025 maintenance

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Added
 
 ### Changed
+- Jenkins master and agent maintenance. Add Rhel9 variant and make it default ([#1361](https://github.com/opendevstack/ods-core/pull/1361))
 - Improved automatic tests for the quickstarters ([#1362](https://github.com/opendevstack/ods-core/pull/1362))
 - Update keystore path in import_certs.sh script ([#1365](https://github.com/opendevstack/ods-core/pull/1365))
 - Added allure plugin and command line installation to jenkins master image ([#1364](https://github.com/opendevstack/ods-core/pull/1364))

configuration-sample/ods-core.env.sample

@@ -276,35 +276,35 @@ CONFLUENCE_URL=http://192.168.56.31:8090
 
 # Base image for Jenkins master.
 # For UBI8-based images (OpenShift 4):
-# - RHEL variant: https://catalog.redhat.com/software/containers/ocp-tools-4/jenkins-rhel8/5fe1f38288e9c2f788526306
-# -      Example: registry.redhat.io/ocp-tools-4/jenkins-rhel8:v4.14.0
-# -      Last tested: registry.redhat.io/ocp-tools-4/jenkins-rhel8:v4.14.0-1723454631
+# - RHEL variant: https://catalog.redhat.com/en/software/containers/ocp-tools-4/jenkins-rhel9/65dc9063b7db2e8b83a5b299
+# -      Example: registry.redhat.io/ocp-tools-4/jenkins-rhel9:v4.19.0
+# -      Last tested: registry.redhat.io/ocp-tools-4/jenkins-rhel9:v4.19.0-1758208739
 # - Community variant: https://quay.io/repository/openshift/origin-jenkins?tab=tags
 # -           Example: quay.io/openshift/origin-jenkins:4.6
-JENKINS_MASTER_BASE_FROM_IMAGE=registry.redhat.io/ocp-tools-4/jenkins-rhel8:v4.14.0-1723454631
+JENKINS_MASTER_BASE_FROM_IMAGE=registry.redhat.io/ocp-tools-4/jenkins-rhel9:v4.19.0-1758208739
 
 # Dockerfile to use for Jenkins master.
-# Use "Dockerfile.ubi8" for both OpenShift 3.11 and 4  (UBI8 base image)
-JENKINS_MASTER_DOCKERFILE_PATH=Dockerfile.ubi8
+# Use "Dockerfile.ubi9" for OpenShift 4  (UBI9 base image)
+JENKINS_MASTER_DOCKERFILE_PATH=Dockerfile.ubi9
 
 # Base image for Jenkins agent base.
 # For UBI8-based images (OpenShift 4):
-# - RHEL variant: https://catalog.redhat.com/software/containers/ocp-tools-4/jenkins-agent-base-rhel8/6241e3457847116cf8577aea
-# -      Example: registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8:v4.14.0
-# -      Last tested: registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8:v4.14.0-1723453106
+# - RHEL variant: https://catalog.redhat.com/en/software/containers/ocp-tools-4/jenkins-agent-base-rhel9/65dc9063b7db2e8b83a5b29e
+# -      Example: registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9:v4.19.0
+# -      Last tested: registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9:v4.19.0-1758206850
 # - Community variant: https://quay.io/repository/openshift/origin-jenkins-agent-base?tab=tags
 # -           Example: quay.io/openshift/origin-jenkins-agent-base:4.6
-JENKINS_AGENT_BASE_FROM_IMAGE=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8:v4.14.0-1723453106
+JENKINS_AGENT_BASE_FROM_IMAGE=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9:v4.19.0-1758206850
 
 # Dockerfile to use for Jenkins agents.
-# Use "Dockerfile.ubi8" for both OpenShift 3.11 and 4  (UBI8 base image)
-JENKINS_AGENT_DOCKERFILE_PATH=Dockerfile.ubi8
+# Use "Dockerfile.ubi9" for OpenShift 4  (UBI9 base image)
+JENKINS_AGENT_DOCKERFILE_PATH=Dockerfile.ubi9
 
 # Snyk CLI binary distribution url
 # Leave empty to avoid installing Snyk.
 # Releases are published at https://github.com/snyk/snyk/releases.
-# Latest tested version is v1.1292.4.
-JENKINS_AGENT_BASE_SNYK_DISTRIBUTION_URL=https://github.com/snyk/snyk/releases/download/v1.1292.4/snyk-linux
+# Latest tested version is v1.1301.2.
+JENKINS_AGENT_BASE_SNYK_DISTRIBUTION_URL=https://github.com/snyk/snyk/releases/download/v1.1301.2/snyk-linux
 
 # AquaSec CLI binary distribution url
 # Leave empty to avoid installing AquaSec.

jenkins/agent-base/Dockerfile.ubi8

@@ -21,7 +21,7 @@ ARG SNYK_DISTRIBUTION_URL
 ARG AQUASEC_SCANNERCLI_URL
 
 # Add UBI repositories.
-COPY yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
+COPY yum.repos.d/ubi8.repo /etc/yum.repos.d/ubi.repo
 
 COPY ensure_java_jre_is_adequate.sh /usr/local/bin/
 COPY ./set-default-java.sh /etc/profile.d/set-default-java.sh

jenkins/agent-base/Dockerfile.ubi9

@@ -0,0 +1,161 @@
+FROM quay.io/openshift/origin-jenkins-agent-base
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+ENV SONAR_SCANNER_VERSION=7.3.0.5189 \
+    SONAR_REPORT_VERSION=1.2 \
+    COSIGN_VERSION=2.6.1 \
+    TAILOR_VERSION=1.3.4 \
+    SOPS_VERSION=3.11.0 \
+    HELM_VERSION=3.19.4 \
+    HELM_PLUGIN_DIFF_VERSION=3.14.1 \
+    HELM_PLUGIN_SECRETS_VERSION=4.7.4 \
+    GIT_LFS_VERSION=3.7.1 \
+    IMGPKG_VERSION=0.47.0 \
+    TRIVY_VERSION=0.68.2 \
+    YQ_VERSION=4.49.2 \
+    JAVA_GC_OPTS="-XX:+UseParallelGC -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90"
+
+ARG APP_DNS
+ARG SNYK_DISTRIBUTION_URL
+ARG AQUASEC_SCANNERCLI_URL
+
+# Add UBI repositories.
+COPY yum.repos.d/ubi9.repo /etc/yum.repos.d/ubi.repo
+
+COPY ensure_java_jre_is_adequate.sh /usr/local/bin/
+COPY ./set-default-java.sh /etc/profile.d/set-default-java.sh
+
+RUN cd /etc/yum.repos.d && rm -f localdev-* ci-rpm-mirrors.repo \
+    && ensure_java_jre_is_adequate.sh \
+    && yum -y install make glibc-langpack-en openssl skopeo \
+    && yum -y update \
+    && yum clean all \
+    && rm -rf /var/cache/yum/* \
+    && skopeo --version
+
+# Copy use java scripts.
+COPY use-j*.sh /usr/local/bin/
+RUN chmod +x /usr/local/bin/use-j*.sh && \
+    chmod ugo+s /usr/local/bin/use-j*.sh && \
+    sh -c 'chmod ugo+s $(which alternatives)' && \
+    ls -la /usr/local/bin/use-j*.sh && \
+    echo "--- STARTS JDK 17 TESTS ---" && \
+    use-j17.sh && \
+    echo "--- ENDS JDK 17 TESTS ---"
+
+COPY ./import_certs.sh /usr/local/bin/import_certs.sh
+COPY ./fix_java_certs_permissions.sh /usr/local/bin/fix_java_certs_permissions.sh
+RUN import_certs.sh && fix_java_certs_permissions.sh
+
+# Install Sonar Scanner.
+RUN cd /tmp \
+    && curl -sSLO https://repo1.maven.org/maven2/org/sonarsource/scanner/cli/sonar-scanner-cli/${SONAR_SCANNER_VERSION}/sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \
+    && unzip sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \
+    && mv sonar-scanner-${SONAR_SCANNER_VERSION} /usr/local/sonar-scanner-cli \
+    && rm -rf sonar-scanner-cli-${SONAR_SCANNER_VERSION}.zip \
+    && /usr/local/sonar-scanner-cli/bin/sonar-scanner --version
+ENV PATH=/usr/local/sonar-scanner-cli/bin:$PATH
+
+# Add sq report jar.
+RUN cd /tmp \
+    && curl -sSL https://github.com/opendevstack/sonar-report/releases/download/v${SONAR_REPORT_VERSION}/sonar-report-v${SONAR_REPORT_VERSION}.jar -o sonar-report.jar \
+    && mkdir /usr/local/sonar \
+    && mv sonar-report.jar /usr/local/sonar/sonar-report.jar \
+    && chmod 777 /usr/local/sonar/sonar-report.jar
+
+# Install sigstore/cosign
+RUN cd /tmp \
+    && curl -sSLO https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64 \
+    && mv /tmp/cosign-linux-amd64 /usr/local/bin/cosign \
+    && chmod 755 /usr/local/bin/cosign \
+    && cosign version
+
+# Install Tailor.
+RUN cd /tmp \
+    && curl -sSLO https://github.com/opendevstack/tailor/releases/download/v${TAILOR_VERSION}/tailor-linux-amd64 \
+    && mv tailor-linux-amd64 /usr/local/bin/tailor \
+    && chmod a+x /usr/local/bin/tailor \
+    && tailor version
+
+# Install Helm.
+RUN cd /tmp \
+    && dnf install -y https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-${SOPS_VERSION}-1.x86_64.rpm \
+    && mkdir -p /tmp/helm \
+    && curl -sSLO https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz \
+    && tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz -C /tmp/helm \
+    && mv /tmp/helm/linux-amd64/helm /usr/local/bin/helm \
+    && chmod a+x /usr/local/bin/helm \
+    && helm version \
+    && helm env \
+    && helm plugin install https://github.com/databus23/helm-diff --version v${HELM_PLUGIN_DIFF_VERSION} \
+    && helm plugin install https://github.com/jkroepke/helm-secrets --version v${HELM_PLUGIN_SECRETS_VERSION} \
+    && sops --version \
+    && rm -rf /tmp/helm /tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz
+
+# Install imgpkg.
+RUN cd /tmp \
+    && curl -sSLO https://github.com/carvel-dev/imgpkg/releases/download/v${IMGPKG_VERSION}/imgpkg-linux-amd64 \
+    && mv imgpkg-linux-amd64 /usr/local/bin/imgpkg \
+    && chmod a+x /usr/local/bin/imgpkg \
+    && imgpkg --version
+
+# Install yq.
+RUN cd /tmp \
+    && curl -sSLO https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64 \
+    && mv yq_linux_amd64 /usr/local/bin/yq \
+    && chmod a+x /usr/local/bin/yq \
+    && yq --version
+
+# Install GIT-LFS extension https://git-lfs.github.com/.
+RUN cd /tmp \
+    && mkdir -p /tmp/git-lfs \
+    && curl -sSLO https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-amd64-v${GIT_LFS_VERSION}.tar.gz \
+    && tar -zxvf git-lfs-linux-amd64-v${GIT_LFS_VERSION}.tar.gz -C /tmp/git-lfs \
+    && bash /tmp/git-lfs/git-lfs-${GIT_LFS_VERSION}/install.sh \
+    && git lfs version \
+    && rm -rf /tmp/git-lfs*
+
+# Optionally install snyk.
+RUN if [ -z $SNYK_DISTRIBUTION_URL ] ; then echo 'Skipping snyk installation!' ; else echo 'Installing snyk... getting binary from' $SNYK_DISTRIBUTION_URL \
+    && curl -sSL $SNYK_DISTRIBUTION_URL --output snyk \
+    && mv snyk /usr/local/bin \
+    && chmod +rwx /usr/local/bin/snyk \
+    && mkdir -p $HOME/.config/configstore/ \
+    && chmod -R g+rw $HOME/.config/configstore/ \
+    && echo 'Snyk CLI version:' \
+    && snyk --version \
+    && echo 'Snyk installation completed!'; \
+    fi
+
+# Optionally install Aquasec.
+RUN if [ -z $AQUASEC_SCANNERCLI_URL ] ; then echo 'Skipping AquaSec installation!' ; else echo 'Installing AquaSec... getting binary from' $AQUASEC_SCANNERCLI_URL \
+    && curl -sSL $AQUASEC_SCANNERCLI_URL --output aquasec \
+    && mv aquasec /usr/local/bin \
+    && chmod +rwx /usr/local/bin/aquasec \
+    && echo 'AquaSec CLI version:' \
+    && aquasec version \
+    && echo 'AquaSec installation completed!'; \
+    fi
+
+# Install Trivy.
+RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v$TRIVY_VERSION \
+    && echo 'Trivy CLI version:' \
+    && trivy version
+
+# Set java proxy var.
+COPY set_java_proxy.sh /tmp/set_java_proxy.sh
+RUN . /tmp/set_java_proxy.sh && echo $JAVA_OPTS
+
+# Customize entrypoint.
+COPY fix_openshift_run_jnlp_client.sh /usr/local/bin/fix_openshift_run_jnlp_client.sh
+RUN mv /usr/local/bin/run-jnlp-client /usr/local/bin/openshift-run-jnlp-client \
+    && fix_openshift_run_jnlp_client.sh /usr/local/bin/openshift-run-jnlp-client
+
+COPY ods-run-jnlp-client.sh /usr/local/bin/run-jnlp-client
+
+# Fix permissions.
+RUN mkdir -p /home/jenkins/.config && chmod -R g+w /home/jenkins/.config \
+    && mkdir -p /home/jenkins/.cache && chmod -R g+w /home/jenkins/.cache \
+    && mkdir -p /home/jenkins/.sonar && chmod -R g+w /home/jenkins/.sonar \
+    && mkdir -p /tmp/aqua && chmod -R g+w /tmp/aqua

jenkins/agent-base/yum.repos.d/ubi9.repo

@@ -0,0 +1,62 @@
+[ubi-9-baseos]
+name = Red Hat Universal Base Image 9 (RPMs) - BaseOS
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os
+enabled = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-baseos-debug]
+name = Red Hat Universal Base Image 9 (Debug RPMs) - BaseOS
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/debug
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-baseos-source]
+name = Red Hat Universal Base Image 9 (Source RPMs) - BaseOS
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-appstream]
+name = Red Hat Universal Base Image 9 (RPMs) - AppStream
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os
+enabled = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-appstream-debug]
+name = Red Hat Universal Base Image 9 (Debug RPMs) - AppStream
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/debug
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-appstream-source]
+name = Red Hat Universal Base Image 9 (Source RPMs) - AppStream
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-codeready-builder]
+name = Red Hat Universal Base Image 9 (RPMs) - CodeReady Builder
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/os
+enabled = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-codeready-builder-debug]
+name = Red Hat Universal Base Image 9 (Debug RPMs) - CodeReady Builder
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/debug
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-codeready-builder-source]
+name = Red Hat Universal Base Image 9 (Source RPMs) - CodeReady Builder
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/source/SRPMS
+enabled = 0
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1

jenkins/master/Dockerfile.ubi8

@@ -15,7 +15,7 @@ ENV JENKINS_JAVA_OVERRIDES="-Dhudson.tasks.MailSender.SEND_TO_UNKNOWN_USERS=true
 USER root
 
 # Add UBI repositories.
-COPY yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
+COPY yum.repos.d/ubi8.repo /etc/yum.repos.d/ubi.repo
 
 COPY ./scripts_for_usr-local-bin/* /usr/local/bin/
 RUN rpm --import https://pkg.jenkins.io/rpm-stable/jenkins.io-2026.key \    

jenkins/master/Dockerfile.ubi9

@@ -0,0 +1,49 @@
+FROM quay.io/openshift/origin-jenkins
+
+ENV JAVA_HOME /usr/lib/jvm/jre-17
+
+# ODS defaults, available to use within pipelines.
+ARG ODS_NAMESPACE
+ARG ODS_GIT_REF
+ARG ODS_IMAGE_TAG
+ARG SONAR_EDITION
+ARG SONAR_VERSION
+ARG APP_DNS
+ENV TAILOR_VERSION=1.3.4
+ENV JENKINS_JAVA_OVERRIDES="-Dhudson.tasks.MailSender.SEND_TO_UNKNOWN_USERS=true -Dhudson.tasks.MailSender.SEND_TO_USERS_WITHOUT_READ=true"
+
+USER root
+
+# Add UBI repositories.
+COPY yum.repos.d/ubi9.repo /etc/yum.repos.d/ubi.repo
+
+COPY ./scripts_for_usr-local-bin/* /usr/local/bin/
+RUN rpm --import https://pkg.jenkins.io/redhat-stable/jenkins.io.key \
+    && disable_yum_repository.sh /etc/yum.repos.d/ci-rpm-mirrors.repo \
+        /etc/yum.repos.d/localdev-* /etc/yum.repos.d/epel.repo \
+    && ensure_java_jre_is_adequate.sh master \
+    && yum -y update \
+    && import_certs.sh \
+    && fix_openshift_scripts.sh \
+    && clean_yum_cache.sh
+
+# Copy configuration and plugins.
+COPY plugins.ubi9.txt /opt/openshift/configuration/plugins.txt
+RUN /usr/local/bin/install-plugins.sh /opt/openshift/configuration/plugins.txt \
+    && rm -r /opt/openshift/configuration/jobs/OpenShift* || true \
+    && touch /var/lib/jenkins/configured \
+    && mv /usr/libexec/s2i/run /usr/libexec/s2i/openshift-run
+COPY configuration/ /opt/openshift/configuration/
+COPY ods-run.sh /usr/libexec/s2i/run
+COPY logging.properties /var/lib/jenkins/
+
+RUN chown :0 /etc/pki/java/cacerts && chmod ugo+w /etc/pki/java/cacerts
+
+# Install Tailor.
+RUN cd /tmp \
+	&& curl -LOv https://github.com/opendevstack/tailor/releases/download/v${TAILOR_VERSION}/tailor-linux-amd64 \
+	&& mv tailor-linux-amd64 /usr/local/bin/tailor \
+	&& chmod a+x /usr/local/bin/tailor \
+    && tailor version
+
+USER jenkins

jenkins/master/ods-run.sh

@@ -42,13 +42,13 @@ else
   echo "ERROR: Neither NEXUS_URL or NEXUS_HOST present."
   exit 1
 fi
-NEXUS_SHORT=$(echo "${nexusUrl}" | sed -e "s|https://||g" | sed -e "s|http://||g")
+NEXUS_SHORT=$(echo "${nexusUrl}" | sed -e "s|https://||g;s|http://||g")
 mkdir -p $HOME/.groovy
 cp /opt/openshift/configuration/grapeConfig.xml $HOME/.groovy/
-sed -i.bak -e "s|__NEXUS_HOST_NO_URL|$NEXUS_SHORT|g" $HOME/.groovy/grapeConfig.xml
-sed -i.bak -e "s|__NEXUS_HOST|$nexusUrl|g" $HOME/.groovy/grapeConfig.xml
-sed -i.bak -e "s|__NEXUS_USER|$NEXUS_USERNAME|g" $HOME/.groovy/grapeConfig.xml
-sed -i.bak -e "s|__NEXUS_PW|$NEXUS_PASSWORD|g" $HOME/.groovy/grapeConfig.xml
+sed -i -e "s|__NEXUS_HOST_NO_URL|$NEXUS_SHORT|g" \
+    -e "s|__NEXUS_HOST|$nexusUrl|g" \
+    -e "s|__NEXUS_USER|$NEXUS_USERNAME|g" \
+    -e "s|__NEXUS_PW|$NEXUS_PASSWORD|g" $HOME/.groovy/grapeConfig.xml
 
 if [ -e "${JENKINS_HOME}/plugins" ]; then
   # RHEL base images install plugins (defined in the yum package jenkins-2-plugins)
@@ -81,20 +81,17 @@ if [ -e "${JENKINS_HOME}/plugins" ]; then
   echo "Copy audit-trail plugin configuration ..."
   cp -n /opt/openshift/configuration/audit-trail.xml ${JENKINS_HOME}/audit-trail.xml
 
-  echo " "
-  echo "Plugins version already installed in Jenkins: "
-  ls -la "${JENKINS_HOME}/plugins/"
-
   echo " "
   echo "Enforcing plugin versions defined in the image ..."
-  if [ "$(ls /opt/openshift/plugins/* 2>/dev/null)" ]; then
-    echo "Copying $(ls /opt/openshift/plugins/* | wc -l) files to ${JENKINS_HOME} ..."
-    for FILENAME in /opt/openshift/plugins/* ; do
-      # also need to nuke the metadir; it will get properly populated on jenkins startup
-      basefilename=`basename $FILENAME .jpi`
-      rm -rfv "${JENKINS_HOME}/plugins/${basefilename}"
-      cp -v --remove-destination $FILENAME ${JENKINS_HOME}/plugins
-    done
+  if [ -d /opt/openshift/plugins ] && [ -n "$(find /opt/openshift/plugins -maxdepth 1 -type f 2>/dev/null | head -1)" ]; then
+    echo "Copying plugins to ${JENKINS_HOME} ..."
+
+    # Remove all old plugin metadata directories at once
+    find "${JENKINS_HOME}/plugins" -maxdepth 1 -type d \( -name "*.jpi" -o -name "*.hpi" \) -exec rm -rf {} + 2>/dev/null || true
+
+    # Copy all plugins in one operation
+    find /opt/openshift/plugins -maxdepth 1 -type f \( -name "*.jpi" -o -name "*.hpi" \) -exec cp --remove-destination {} "${JENKINS_HOME}/plugins" \;
+
     rm -rf /opt/openshift/plugins
   fi
 fi