Todos

• Jenkins loads https://usage.jenkins.io/usage-stats.js from the page footer once per day (measured on the first signed-in page view: console Loading the script 'https://usage.jenkins.io/usage-stats.js?...' violates the following Content Security Policy directive); usage statistics are on by default and templates/casc.yaml.j2 does not switch them off, so every instance tries to phone home and the platform CSP blocks it. Options: set noUsageStatistics: true under jenkins: in templates/casc.yaml.j2 (confirm the key on /manage/configuration-as-code/reference) and assert in the spec that no request leaves for usage.jenkins.io.

• /manage/ shows the administrative monitor “It appears that your reverse proxy set up is broken.” on the compose stack with sso and ldap off (measured with 2.580.1); the cause is not measured. Jenkins’ ReverseProxySetupMonitor requests administrativeMonitor/hudson.diagnosis.ReverseProxySetupMonitor/test and expects the redirect to come back with the encoded referer intact. Options: probe that URL through the vhost and compare the path the controller receives (encoded slashes, Host, X-Forwarded-Proto, X-Forwarded-Port), then fix the vhost headers or dismiss the monitor through CasC if the setup is correct.