Jenkins and Kubernetes

# CHAPTER 13

Jenkins and Kubernetes #

1. Introduction #

2. Learning Objectives #

• Understand the limitations of static Jenkins build nodes.

• Define the concept of ephemeral Kubernetes Build Agents.

• Configure a Jenkinsfile to run pods dynamically in Kubernetes.

• Understand how Jenkins authenticates with a Kubernetes cluster.

• Conceptualize a deployment workflow to Kubernetes using kubectl or Helm.

3. Beginner-Friendly Explanation #

• Traditional Jenkins: You have exactly 3 chefs. If 50 orders come in at once, the 3 chefs work as fast as they can, but the 47 other orders sit in a queue waiting. Customers get angry.

• Jenkins on Kubernetes: You have a magical kitchen. When 50 orders come in, you snap your fingers and 47 temporary chefs instantly appear, cook the meals in parallel, and then instantly vanish. No one waits.

Kubernetes provides Jenkins with "temporary chefs" (Pods) exactly when needed, ensuring builds never queue up.

4. Ephemeral Build Agents #

• Zero Queueing: Infinite parallelism.

• Cost Efficiency: You only pay for the cloud compute power during the 2 minutes the test is running.

5. Writing a Kubernetes Pipeline #

pipeline {
    agent {
        kubernetes {
            // Define the exact containers we need for this build
            yaml '''
            apiVersion: v1
            kind: Pod
            spec:
              containers:
              - name: php
                image: php:8.1-cli
                command: ['cat']
                tty: true
            '''
        }
    }
    stages {
        stage('Test') {
            steps {
                // Tell Jenkins to run this step specifically inside the 'php' container we defined above
                container('php') {
                    sh 'php -v'
                    sh './vendor/bin/phpunit'
                }
            }
        }
    }
}

6. Deploying TO Kubernetes #

The Workflow:

1. 1. Jenkins uses a tool called kubectl (the Kubernetes command-line tool).

1. 2. Jenkins authenticates to the cluster using a secure "Service Account" token.

1. 3. Jenkins runs: kubectl set image deployment/my-app my-app=my-company/my-app:v42.

1. 4. Kubernetes handles the Zero-Downtime Blue/Green deployment automatically.

7. Mini Project: Run Jenkins Builds in Kubernetes Concept #

Step-by-Step Pipeline Concept:

stage('Deploy to K8s') {
    steps {
        // Use a secure credential block to load the K8s config file (kubeconfig)
        withKubeConfig([credentialsId: 'k8s-prod-cluster-token']) {
            echo 'Updating Kubernetes Deployment...'
            // Apply a YAML file that contains our infrastructure definitions
            sh 'kubectl apply -f k8s/deployment.yaml'
            
            // Wait for Kubernetes to finish rolling out the new pods
            sh 'kubectl rollout status deployment/my-php-app'
        }
    }
}

8. Real-World Scenarios #

9. Best Practices #

• Helm over Kubectl: While kubectl apply is great for beginners, enterprise teams deploy to Kubernetes using Helm (a package manager for K8s). Helm allows you to template your YAML files, making it easy to deploy the exact same application to a "Staging" cluster and a "Production" cluster just by changing a few variables in Jenkins.

10. Security Recommendations #

• RBAC for Jenkins: When Jenkins deploys to Kubernetes, it needs a "Service Account." Never give this account "Cluster Admin" rights. Use Kubernetes Role-Based Access Control (RBAC) to ensure Jenkins only has permission to update the specific namespace (e.g., frontend-app) it is responsible for, preventing Jenkins from accidentally deleting the database pods.

11. Exercises #

1. 1. Explain the operational benefit of "ephemeral" build agents in Kubernetes compared to static, permanent Jenkins worker servers.

1. 2. What is the command-line tool Jenkins uses to send deployment instructions to a Kubernetes cluster?

12. FAQs #

13. Interview Questions #

• Q: Describe the architectural workflow of a Jenkins pipeline utilizing the Kubernetes plugin to provision dynamic pod agents. How does the Jenkinsfile define the pod specification?

• Q: A pipeline successfully builds a Docker image and must deploy it to a production Kubernetes cluster. Explain how you would configure Jenkins to authenticate with the cluster securely without hardcoding kubeconfig files in the source code.

14. Summary #

15. Next Chapter Recommendation #