Varroa vs. CloudBees CI
A feature-by-feature comparison for teams evaluating Varroa against CloudBees CI. Every row below is fact-checked against current CloudBees documentation and dated when it was last confirmed.
| Feature | Varroa | CloudBees CI | Source |
|---|---|---|---|
| Control plane scaling | The control plane is a Kubernetes operator that runs active/active across replicas, sharding controllers over a 256-shard ring. No Jenkins instance sits in the path. | Operations center is deployed as a single instance with its own Jenkins home directory. CloudBees documents High Availability (active/active) for managed controllers, and for operations center documents built-in fault tolerance that restarts it when unhealthy. | docs (verified 2026-08-27) |
| Controller provisioning model | Every Jenkins controller is a Kubernetes Controller CRD; the operator reconciles it continuously (StatefulSet, RBAC, ingress, plugins). | Managed controllers are provisioned and administered through the operations center, which creates the underlying Kubernetes resources itself; admins work through the operations center UI and API rather than per-controller Kubernetes objects. | docs (verified 2026-08-27) |
| RBAC across the fleet | JenkinsRole and JenkinsRoleBinding are Kubernetes objects. The operator generates the authorization strategy for the open-source Role Strategy plugin, so the fleet needs no proprietary RBAC plugin. | Role-based access control is provided by the CloudBees Role-Based Access Control plugin, which is license-gated, requires a CloudBees Jenkins core build, and is not published to the open-source Jenkins plugin index. | docs (verified 2026-08-27) |
| Configuration as Code delivery | A ComposedBundle merges ordered inputs from git repositories, OCI artifacts, and catalog items into one bundle, covering the same bundle files (jenkins, plugins, items, rbac, vars) with drift detection and gated rollout. | The operations center stores and distributes CasC bundles to managed controllers, and bundle inheritance lets one bundle build on another. The items.yaml and rbac.yaml sections depend on CloudBees plugins that are not published to the open-source Jenkins plugin index. | docs (verified 2026-08-27) |
| Plugin distribution and air-gap | An in-cluster update center serves the exact pinned plugin set, with sha256-verified pull-through installs. | Air-gapped installs mirror the CloudBees and Jenkins update sites through a private Nexus proxy repository, configured per environment. | docs (verified 2026-08-27) |
| AI-agent access | The MCP endpoint lets an agent compose a bundle, create a controller from it, and drive jobs, with every call under its own caller identity and RBAC. | The CloudBees CI MCP Router (early access) gives agents one endpoint onto existing controllers for job, build, and SCM queries, authenticated with a single shared API token. | docs (verified 2026-08-27) |
| Fleet-wide observability | A bounded, retained activity stream plus per-controller mite telemetry feeds a single dashboard across the whole brood. | Operations Center provides centralized management and a central view into the cluster's managed controllers. | docs (verified 2026-08-27) |
If you're migrating from CloudBees CI
The core concepts map over directly, even though the mechanics differ:
- CasC bundles ≈ Composed bundles. Where CloudBees CI's Configuration as Code plugin reads a bundle per controller, Varroa's
ComposedBundleCRD merges ordered git, OCI, and catalog inputs into one resolvedjenkins.yaml, reused across as many controllers as reference it. - Managed controllers ≈ Controller CRDs. Operations Center's managed-controller concept becomes a native Kubernetes object:
kubectl get controllershows every Jenkins instance in the brood, its phase, and its owning namespace. - What's different. There's no separate Operations Center process. The operator, gateway, and BFF are the control plane, deployed once per cluster via the Helm chart. Authorization is federated from cluster-scoped RBAC CRDs rather than configured per controller, and plugins come from an in-cluster update center Varroa manages, not a per-environment mirror you maintain by hand.
Start with the first-controller tutorial: an empty cluster to a running Jenkins in three steps, no bundle repo required to begin.