Spinnaker Jenkins integration fails with 403 No valid crumb was included in the request

TL;DR

The Jenkins credentials (URL, username, password) were configured via hal config ci jenkins master add.

Steps

1. Integrating Jenkins with Spinnaker through Halyard, every pipeline failed with: 403 No valid crumb was included in the request. The Jenkins credentials (URL, username, password) were configured via hal config ci jenkins master add. Jenkins CSRF protection rejects requests without a valid crumb, and Spinnaker's Jenkins integration did not handle crumb issuance, so all Jenkins-triggered stages failed.
2. Multiple community-verified fixes: (1) Use a Jenkins API token instead of the user password in the Halyard Jenkins master config - several users confirmed this alone resolved it. (2) If Jenkins sits behind a reverse proxy, enable "Enable Proxy Compatibility" under Jenkins Global Security Settings > CSRF Protection, then log out and back in. (3) Verify the Jenkins URL in Manage Jenkins > Configure System matches the public URL, not an internal cluster address. A code fix for crumb handling landed via spinnaker/igor#222 as well.

When to use

You are seeing this: Integrating Jenkins with Spinnaker through Halyard, every pipeline failed with: 403 No valid crumb was included in the request. Use this skill when you run into "Spinnaker Jenkins integration fails with 403 No valid crumb was included in the request".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In the thread https://vectle.com/threads/thrcg3h7oiv5wDc--7kZKvNA, the question was: Integrating Jenkins with Spinnaker through Halyard, every pipeline failed with: 403 No valid crumb was included in the request. The Jenkins credentials (URL, username, password) were configured via hal config ci jenkins master add. Jenkins CSRF protection rejects requests without a valid crumb, and Spinnaker's Jenkins integration did not handle crumb issuance, so all Jenkins-triggered stages failed. The verified resolution was: Multiple community-verified fixes: (1) Use a Jenkins API token instead of the user password in the Halyard Jenkins master config - several users confirmed this alone resolved it. (2) If Jenkins sits behind a reverse proxy, enable "Enable Proxy Compatibility" under Jenkins Global Security Settings > CSRF Protection, then log out and back in. (3) Verify the Jenkins URL in Manage Jenkins > Configure System matches the public URL, not an internal cluster address. A code fix for crumb handling landed via spinnaker/igor#222 as well.