Skip to content

Commit 7e46d0b

Browse files
rmkandarmkanda
committed
default pipeline
1 parent 9ba9ff0 commit 7e46d0b

8 files changed

+340
-6
lines changed

‎Jenkinsfile

+32-6
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ pipeline {
99
environment {
1010
APP_NAME = "sample-api-service"
1111
IMAGE_REGISTRY = "rmkanda"
12-
1312
}
1413
stages {
1514
stage('Setup') {
@@ -26,14 +25,11 @@ pipeline {
2625
stage('Build') {
2726
steps {
2827
container('maven') {
29-
sh './mvnw package'
30-
}
31-
container('docker-tools') {
32-
sh "docker build . -t ${APP_NAME}"
28+
sh './mvnw package -DskipTests -Dspotbugs.skip=true -Ddependency-check.skip=true'
3329
}
3430
}
3531
}
36-
stage('Verify') {
32+
stage('Static Analysis') {
3733
parallel {
3834
stage('Unit Tests') {
3935
steps {
@@ -44,5 +40,35 @@ pipeline {
4440
}
4541
}
4642
}
43+
stage('Package') {
44+
steps {
45+
container('docker-tools') {
46+
sh "docker build . -t ${APP_NAME}"
47+
}
48+
}
49+
}
50+
stage('Publish') {
51+
steps {
52+
container('docker-tools') {
53+
echo "Publishing docker image"
54+
// sh "docker push ${APP_NAME}"
55+
}
56+
}
57+
}
58+
stage('Deploy to Dev') {
59+
steps {
60+
container('docker-tools') {
61+
echo "Deploying the app"
62+
// sh "kubectl apply -f k8s.yaml"
63+
}
64+
}
65+
}
66+
stage('Promote to Prod') {
67+
steps {
68+
container('docker-tools') {
69+
echo "Promote to Prod"
70+
}
71+
}
72+
}
4773
}
4874
}

‎PREREQUISITE.md

+181
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# Workshop prerequisite
2+
3+
Note: Recommended to setup these labs in your thoughtworks laptop. Also you need to have a good internet connection (mobile internet connection won’t be enough).
4+
5+
## PreRead
6+
7+
- Basic Jenkins Pipeline as a code knowledge (if completely new to pipeline as code, check this https://www.youtube.com/watch?v=s73nhwYBtzE )
8+
- Docker Basics (if you are new to docker - please watch these ROTC recordings - https://www.youtube.com/playlist?list=PLknOipHZHwwVAM2lIKMXcy7HdEoqk0Ep1 )
9+
10+
## Installation
11+
12+
- Install Homebrew
13+
14+
```
15+
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
16+
```
17+
18+
- Install Command Line Tools for Mac
19+
20+
```
21+
sudo xcode-select --install
22+
```
23+
24+
- Install Minikube v1.24
25+
26+
```
27+
brew install hyperkit
28+
brew install minikube
29+
```
30+
31+
- Verify Minikube and kubectl version
32+
33+
```
34+
~ ❯ minikube version
35+
minikube version: v1.24.0
36+
commit: 76b94fb3c4e8ac5062daf70d60cf03ddcc0a741b
37+
~ ❯ kubectl version
38+
Client Version: version.Info{Major:"1", Minor:"23", GitVersion:"v1.23.1", GitCommit:"86ec240af8cbd1b60bcc4c03c20da9b98005b92e", GitTreeState:"clean", BuildDate:"2021-12-16T11:33:37Z", GoVersion:"go1.17.5", Compiler:"gc", Platform:"darwin/amd64"}
39+
```
40+
41+
- Install Helm v3.7.2
42+
```
43+
brew install helm
44+
```
45+
- Add additional repositories for helm
46+
```
47+
helm repo add jenkins https://charts.jenkins.io
48+
helm repo add evryfs-oss https://evryfs.github.io/helm-charts/
49+
helm repo update
50+
```
51+
- Install Java 17
52+
53+
```
54+
brew install openjdk@17
55+
```
56+
57+
- Install Maven 3.8
58+
59+
```
60+
brew install maven
61+
```
62+
63+
- Install Anchore Syft and Grype
64+
65+
```
66+
brew tap anchore/syft
67+
brew install syft
68+
brew tap anchore/grype
69+
brew install grype
70+
```
71+
72+
- Install Dockle
73+
74+
```
75+
brew install goodwithtech/r/dockle
76+
Install Bridgecrew Checkov,
77+
brew install checkov
78+
```
79+
80+
## Setup
81+
82+
- Start Minikube
83+
84+
```
85+
minikube start --nodes=1 --cpus=4 --memory 8192 --disk-size=35g --embed-certs=true --driver=hyperkit
86+
```
87+
88+
E.g,
89+
90+
```
91+
~ ❯ minikube start --nodes=1 --cpus=4 --memory 8192 --disk-size=35g --embed-certs=true --driver=hyperkit
92+
😄 minikube v1.24.0 on Darwin 12.1
93+
✨ Using the hyperkit driver based on user configuration
94+
👍 Starting control plane node minikube in cluster minikube
95+
🔥 Creating hyperkit VM (CPUs=4, Memory=8192MB, Disk=35840MB) ...
96+
🐳 Preparing Kubernetes v1.22.3 on Docker 20.10.8 ...
97+
▪ Generating certificates and keys ...
98+
▪ Booting up control plane ...
99+
▪ Configuring RBAC rules ...
100+
🔎 Verifying Kubernetes components...
101+
▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
102+
🌟 Enabled addons: storage-provisioner, default-storageclass
103+
🏄 Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default
104+
~ ❯
105+
```
106+
107+
- Check minikube installation
108+
109+
```
110+
kubectl get pods --all-namespaces
111+
```
112+
113+
E.g,
114+
115+
```
116+
~ ❯ kubectl get pods --all-namespaces
117+
NAMESPACE NAME READY STATUS RESTARTS AGE
118+
kube-system coredns-78fcd69978-zqqk7 1/1 Running 0 43s
119+
kube-system etcd-minikube 1/1 Running 0 56s
120+
kube-system kube-apiserver-minikube 1/1 Running 0 56s
121+
kube-system kube-controller-manager-minikube 1/1 Running 0 56s
122+
kube-system kube-proxy-gk2rt 1/1 Running 0 43s
123+
kube-system kube-scheduler-minikube 1/1 Running 0 56s
124+
kube-system storage-provisioner 1/1 Running 0 55s
125+
~ ❯
126+
```
127+
128+
- Create a file with name “jenkins-values.yaml” and below contents
129+
130+
```
131+
# Custom values for jenkins.
132+
controller:
133+
# List of plugins to be installed during Jenkins controller start
134+
installPlugins:
135+
- kubernetes:1.30.1
136+
- kubernetes-client-api:5.4.1
137+
- workflow-aggregator:2.6
138+
- git:4.10.1
139+
- configuration-as-code:1.55
140+
- blueocean:latest
141+
- dependency-check-jenkins-plugin:latest
142+
- dependency-track:latest
143+
- warnings-ng:latest
144+
```
145+
146+
- Install Jenkins
147+
148+
```
149+
helm install jenkins jenkins/jenkins -f jenkins-values.yaml
150+
```
151+
152+
- Wait for the jenkins pod to start
153+
154+
```
155+
kubectl get pods --all-namespaces
156+
```
157+
158+
- Get admin user password of Jenkins
159+
160+
```
161+
kubectl exec --namespace default -it svc/jenkins -c jenkins -- /bin/cat /run/secrets/chart-admin-password && echo
162+
```
163+
164+
Note: Make a note of the password
165+
166+
- Forward Jenkins server port to access from local machine
167+
kubectl --namespace default port-forward svc/jenkins 8080:8080
168+
- open http://localhost:8080
169+
- Login with username “admin” and the password from the above step.
170+
171+
### [Optional]
172+
173+
- Pull the below docker images to avoid pulling images during workshop
174+
```
175+
> minikube ssh
176+
> $ docker pull gradle:7-jdk17-alpine
177+
> $ docker pull openjdk:17.0.1
178+
> $ docker pull rmkanda/docker-tools:latest
179+
> $ docker pull licensefinder/license_finder
180+
> $ docker pull rmkanda/trufflehog
181+
```

‎k8s.yaml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
kind: Service
2+
apiVersion: v1
3+
metadata:
4+
name: hostname-service
5+
spec:
6+
type: NodePort
7+
selector:
8+
app: sample-api
9+
ports:
10+
- nodePort: 30163
11+
port: 8080
12+
targetPort: 8080
13+
---
14+
apiVersion: v1
15+
kind: Pod
16+
metadata:
17+
labels:
18+
app: sample-api
19+
spec:
20+
containers:
21+
- name: sample-api
22+
image: sample-api-service:latest
23+
resources:
24+
requests:
25+
memory: "64Mi"
26+
cpu: "250m"
27+
limits:
28+
memory: "128Mi"
29+
cpu: "500m"
30+
securityContext:
31+
runAsNonRoot: true
32+
runAsUser: 10001
33+
allowPrivilegeEscalation: false
34+
capabilities:
35+
drop:
36+
- "ALL"
37+
add: ["NET_ADMIN", "SYS_TIME"]

‎pom.xml

+68
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,74 @@
4949
<groupId>org.springframework.boot</groupId>
5050
<artifactId>spring-boot-maven-plugin</artifactId>
5151
</plugin>
52+
<plugin>
53+
<groupId>org.owasp</groupId>
54+
<artifactId>dependency-check-maven</artifactId>
55+
<version>6.5.1</version>
56+
<configuration>
57+
<format>ALL</format>
58+
<failBuildOnCVSS>5</failBuildOnCVSS>
59+
<suppressionFiles>
60+
<suppressionFile>sca-supressions.xml</suppressionFile>
61+
</suppressionFiles>
62+
</configuration>
63+
<executions>
64+
<execution>
65+
<goals>
66+
<goal>check</goal>
67+
</goals>
68+
</execution>
69+
</executions>
70+
</plugin>
71+
<plugin>
72+
<groupId>com.github.spotbugs</groupId>
73+
<artifactId>spotbugs-maven-plugin</artifactId>
74+
<version>4.5.2.0</version>
75+
<configuration>
76+
<effort>Max</effort>
77+
<threshold>Low</threshold>
78+
<failOnError>true</failOnError>
79+
<includeFilterFile>${session.executionRootDirectory}/spotbugs-security-include.xml</includeFilterFile>
80+
<excludeFilterFile>${session.executionRootDirectory}/spotbugs-security-exclude.xml</excludeFilterFile>
81+
<plugins>
82+
<plugin>
83+
<groupId>com.h3xstream.findsecbugs</groupId>
84+
<artifactId>findsecbugs-plugin</artifactId>
85+
<version>1.11.0</version>
86+
</plugin>
87+
</plugins>
88+
</configuration>
89+
<executions>
90+
<execution>
91+
<id>scan</id>
92+
<phase>verify</phase>
93+
<goals>
94+
<goal>check</goal>
95+
</goals>
96+
</execution>
97+
</executions>
98+
</plugin>
99+
<plugin>
100+
<groupId>org.cyclonedx</groupId>
101+
<artifactId>cyclonedx-maven-plugin</artifactId>
102+
<version>2.5.3</version>
103+
<executions>
104+
<execution>
105+
<phase>verify</phase>
106+
<goals>
107+
<goal>makeAggregateBom</goal>
108+
</goals>
109+
</execution>
110+
</executions>
111+
<configuration>
112+
<includeCompileScope>true</includeCompileScope>
113+
<includeProvidedScope>true</includeProvidedScope>
114+
<includeRuntimeScope>true</includeRuntimeScope>
115+
<includeSystemScope>true</includeSystemScope>
116+
<includeTestScope>false</includeTestScope>
117+
<includeDependencyGraph>true</includeDependencyGraph>
118+
</configuration>
119+
</plugin>
52120
</plugins>
53121
</build>
54122

‎sca-supressions.xml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<!-- <suppress>
4+
<notes><![CDATA[
5+
file name: log4j-api-2.14.1.jar
6+
]]></notes>
7+
<packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j\-api@.*$</packageUrl>
8+
<cpe>cpe:/a:apache:log4j</cpe>
9+
</suppress> -->
10+
</suppressions>

‎secrets-exclude.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
PREREQUISITE.md

‎spotbugs-security-exclude.xml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<FindBugsFilter>
2+
<!-- <Match>
3+
<Class name="com.sample.UserManager.LoadDatabase" />
4+
<Bug pattern="CRLF_INJECTION_LOGS" />
5+
</Match> -->
6+
</FindBugsFilter>

‎spotbugs-security-include.xml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<FindBugsFilter>
2+
<!-- <Match>
3+
<Bug category="SECURITY"/>
4+
</Match> -->
5+
</FindBugsFilter>

0 commit comments

Comments
 (0)