From 9f200b11b67bd1051c42ab5bdb067abcc844cae5 Mon Sep 17 00:00:00 2001
From: Jesse Glick <jglick@cloudbees.com>
Date: Sat, 4 Oct 2025 16:12:07 -0400
Subject: [PATCH] Define health check for `BindException` on enforced TCP port
 (#11145)

---
 core/src/main/java/hudson/TcpSlaveAgentListener.java | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/core/src/main/java/hudson/TcpSlaveAgentListener.java b/core/src/main/java/hudson/TcpSlaveAgentListener.java
index d7d4e0edd0..9a2377550b 100644
--- a/core/src/main/java/hudson/TcpSlaveAgentListener.java
+++ b/core/src/main/java/hudson/TcpSlaveAgentListener.java
@@ -50,6 +50,7 @@ import java.util.Base64;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import jenkins.AgentProtocol;
+import jenkins.health.HealthCheck;
 import jenkins.model.Jenkins;
 import jenkins.model.identity.InstanceIdentityProvider;
 import jenkins.security.stapler.StaplerAccessibleType;
@@ -445,4 +446,14 @@ public final class TcpSlaveAgentListener extends Thread {
     @SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "Accessible via System Groovy Scripts")
     @Restricted(NoExternalUse.class)
     public static Integer CLI_PORT = SystemProperties.getInteger(TcpSlaveAgentListener.class.getName() + ".port");
+
+    @Extension
+    public static final class EnforcedPortHealthCheck implements HealthCheck {
+        @Override
+        public boolean check() {
+            var j = Jenkins.get();
+            return !j.isSlaveAgentPortEnforced() || j.getSlaveAgentPort() <= 0 || j.getTcpSlaveAgentListener() != null;
+        }
+    }
+
 }