Safer Jenkins pipelines on kubernetes
Jenkins and kubernetes are a great combination. I love the concept of leveraing container technology to provide any build tools that you might require. However in many cases the examples provided are not always the best or most secure. In Section 10.2.2 Building your image of Mannings Microservices in Action the following Jenkins Pipeline script is suggested: def withPod(body) { podTemplate(label: 'pod', serviceAccount: 'jenkins', containers: [ containerTemplate(name: 'docker', image: 'docker', command: 'cat', ttyEnabled: true), containerTemplate(name: 'kubectl', image: 'morganjbruce/kubectl', command: 'cat', ttyEnabled: true) ], volumes: [ hostPathVolume(mountPath: '/var/run/docker.sock', hostPath: '/var/run/docker.sock'), ] ) { body() } } withPod { node('pod') { def tag = "${env.BRANCH_NAME}.${env.BUILD_NUMBER}" def service = "market-data:${tag}" checkout scm container('docker') { stage('Build') { sh("docker build -t ${service} .") } } container('kubectl') { stage('Deploy') { sh("kubectl --namespace=staging apply -f deploy/staging/") } } } } In this script there are three things that bother me: ...