Safer Jenkins pipelines on kubernetes

Mon, 20 Apr 2020 12:45:04 +0200

Jenkins and kubernetes are a great combination. I love the concept of leveraing container technology to provide any build tools that you might require. However in many cases the examples provided are not always the best or most secure.

In Section 10.2.2 Building your image of Mannings Microservices in Action the following Jenkins Pipeline script is suggested:

def withPod(body) {
 podTemplate(label: 'pod', serviceAccount: 'jenkins', containers: [
 containerTemplate(name: 'docker', image: 'docker', command: 'cat', ttyEnabled: true),
 containerTemplate(name: 'kubectl', image: 'morganjbruce/kubectl', command: 'cat', ttyEnabled: true)
 ],
 volumes: [
 hostPathVolume(mountPath: '/var/run/docker.sock', hostPath: '/var/run/docker.sock'),
 ]
 ) { body() }
}

withPod {
 node('pod') {
 def tag = "${env.BRANCH_NAME}.${env.BUILD_NUMBER}"
 def service = "market-data:${tag}"
 checkout scm
 container('docker') {
 stage('Build') {
 sh("docker build -t ${service} .")
 }
 }
 container('kubectl') {
 stage('Deploy') {
 sh("kubectl --namespace=staging apply -f deploy/staging/")
 }
 }
 }
}

In this script there are three things that bother me:

Jenkins on .NET wat we zoeken

Safer Jenkins pipelines on kubernetes