Jenkins + Kubernetes
CI/CD Engineering

version: "3.8"
services:
  jenkins:
    image: jenkins/jenkins:lts-jdk17
    container_name: jenkins
    privileged: true
    user: root
    ports:
      - "8080:8080"
      - "50000:50000"
    volumes:
      - jenkins_home:/var/jenkins_home
      # Mount Docker socket so Jenkins can build images
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - JAVA_OPTS=-Djenkins.install.runSetupWizard=false
volumes:
  jenkins_home:

# Paste into Jenkins plugin manager or use install-plugins.sh
git
workflow-aggregator          # Pipeline plugin suite
pipeline-stage-view
docker-workflow
kubernetes
credentials-binding
blueocean
github
slack
junit
cobertura

#!/bin/bash
set -e

# Install Go if not present
export GOPATH=/tmp/go
export PATH=$PATH:/usr/local/go/bin

cd $WORKSPACE
go mod tidy
go build ./...
go test ./... -v
echo "Build successful!"

# Stage 1: Build
FROM golang:1.22-alpine AS builder
WORKDIR /app

# Cache deps separately for faster rebuilds
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o server .

# Stage 2: Runtime — distroless (no shell, minimal attack surface)
FROM gcr.io/distroless/static:nonroot
COPY --from=builder /app/server /server
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/server"]

version: "3.8"
services:
  backend:
    build: .
    container_name: go-backend
    ports:
      - "8080:8080"
    environment:
      - MONGO_URI=mongodb://mongo:27017
    depends_on:
      mongo:
        condition: service_healthy
    restart: unless-stopped

  mongo:
    image: mongo:7.0
    container_name: mongodb
    ports:
      - "27017:27017"
    volumes:
      - mongo_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  mongo_data:

pipeline {
  agent { docker { image 'golang:1.22-alpine' } }

  environment {
    APP_NAME   = 'go-backend'
    REGISTRY   = 'docker.io/yourdockerhubuser'
    IMAGE_TAG  = "${env.BUILD_NUMBER}"
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
        sh 'echo "Branch: ${GIT_BRANCH}, Commit: ${GIT_COMMIT}"'
      }
    }

    stage('Dependencies') {
      steps {
        sh 'go mod download'
        sh 'go mod verify'
      }
    }

    stage('Lint') {
      steps {
        sh '''
          go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
          golangci-lint run ./...
        '''
      }
    }

    stage('Test') {
      steps {
        sh 'go test ./... -v -coverprofile=coverage.out'
        sh 'go tool cover -func=coverage.out'
      }
      post {
        always {
          junit '**/test-results/*.xml'
        }
      }
    }

    stage('Build Binary') {
      steps {
        sh 'CGO_ENABLED=0 GOOS=linux go build -o server .'
      }
    }

    stage('Build Docker Image') {
      agent any  // switch back to host for Docker
      steps {
        script {
          def img = docker.build("${REGISTRY}/${APP_NAME}:${IMAGE_TAG}")
          img.tag('latest')
        }
      }
    }
  }

  post {
    failure {
      echo 'Pipeline failed! Sending notification...'
    }
    success {
      echo "Build ${IMAGE_TAG} succeeded!"
    }
    always {
      cleanWs()
    }
  }
}

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongodb
  namespace: app
spec:
  serviceName: mongodb
  replicas: 1
  selector:
    matchLabels:
      app: mongodb
  template:
    metadata:
      labels:
        app: mongodb
    spec:
      containers:
        - name: mongodb
          image: mongo:7.0
          ports:
            - containerPort: 27017
          volumeMounts:
            - name: mongo-storage
              mountPath: /data/db
          readinessProbe:
            exec:
              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
            initialDelaySeconds: 15
            periodSeconds: 10
  volumeClaimTemplates:
    - metadata:
        name: mongo-storage
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 5Gi
---
apiVersion: v1
kind: Service
metadata:
  name: mongodb
  namespace: app
spec:
  clusterIP: None  # Headless — StatefulSet needs this
  selector:
    app: mongodb
  ports:
    - port: 27017

apiVersion: apps/v1
kind: Deployment
metadata:
  name: go-backend
  namespace: app
  labels:
    app: go-backend
    version: v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: go-backend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: go-backend
    spec:
      containers:
        - name: backend
          image: docker.io/yourdockerhubuser/go-backend:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          env:
            - name: MONGO_URI
              value: "mongodb://mongodb.app.svc.cluster.local:27017"
          resources:
            requests:
              cpu: "100m"
              memory: "64Mi"
            limits:
              cpu: "500m"
              memory: "128Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: go-backend-svc
  namespace: app
spec:
  selector:
    app: go-backend
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

pipeline {
  agent any

  environment {
    REGISTRY     = "yourdockerhubuser/go-backend"
    IMAGE_TAG    = "${env.GIT_COMMIT[0..7]}"
    KUBECONFIG   = credentials('kubeconfig-prod')
    DOCKER_CREDS = credentials('dockerhub-creds')
  }

  stages {
    stage('Test') {
      agent { docker { image 'golang:1.22-alpine' } }
      steps {
        sh 'go test ./... -coverprofile=coverage.out'
      }
    }

    stage('Build & Push Image') {
      steps {
        script {
          docker.withRegistry('https://index.docker.io/v1/', 'dockerhub-creds') {
            def img = docker.build("${REGISTRY}:${IMAGE_TAG}")
            img.push()
            img.push('latest')
          }
        }
      }
    }

    stage('Deploy to Kubernetes') {
      steps {
        sh """
          kubectl --kubeconfig=$KUBECONFIG set image \
            deployment/go-backend \
            backend=${REGISTRY}:${IMAGE_TAG} \
            -n app

          kubectl --kubeconfig=$KUBECONFIG rollout status \
            deployment/go-backend \
            -n app \
            --timeout=120s
        """
      }
    }
  }

  post {
    failure {
      // Auto-rollback on deploy failure
      sh "kubectl --kubeconfig=$KUBECONFIG rollout undo deployment/go-backend -n app"
    }
  }
}

pipeline {
  agent any

  triggers {
    // Triggered by GitHub webhook automatically
    githubPush()
  }

  stages {
    stage('Test') {
      agent { docker { image 'golang:1.22-alpine' } }
      steps {
        sh 'go test ./... -race -coverprofile=coverage.out'
      }
    }

    stage('Build Image') {
      when {
        anyOf {
          branch 'main'
          branch 'release/*'
        }
      }
      steps {
        script {
          docker.withRegistry('https://index.docker.io/v1/', 'dockerhub-creds') {
            def tag = env.BRANCH_NAME == 'main' ? 'latest' : env.BRANCH_NAME.replace('/', '-')
            docker.build("yourdockerhubuser/go-backend:${tag}").push()
          }
        }
      }
    }

    stage('Deploy Staging') {
      when { branch 'release/*' }
      steps {
        sh "kubectl set image deployment/go-backend backend=yourdockerhubuser/go-backend:${BRANCH_NAME.replace('/','-')} -n staging"
      }
    }

    stage('Deploy Production') {
      when { branch 'main' }
      steps {
        input message: 'Deploy to production?', ok: 'Deploy'
        sh "kubectl set image deployment/go-backend backend=yourdockerhubuser/go-backend:latest -n app"
        sh "kubectl rollout status deployment/go-backend -n app --timeout=120s"
      }
    }
  }
}

apiVersion: v2
name: go-mongo-app
description: Golang REST API + MongoDB 2-tier app
type: application
version: 0.1.0
appVersion: "1.0.0"

backend:
  image:
    repository: yourdockerhubuser/go-backend
    tag: latest
    pullPolicy: Always
  replicas: 2
  resources:
    requests:
      cpu: 100m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 128Mi

mongodb:
  image: mongo:7.0
  storage: 5Gi

namespace: app

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "go-mongo-app.fullname" . }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "go-mongo-app.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.backend.replicas }}
  selector:
    matchLabels:
      app: go-backend
  template:
    metadata:
      labels:
        app: go-backend
    spec:
      containers:
        - name: backend
          image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
          env:
            - name: MONGO_URI
              valueFrom:
                secretKeyRef:
                  name: mongo-secret
                  key: mongo-uri

stage('Helm Deploy') {
  steps {
    sh """
      helm upgrade --install go-mongo-app ./helm-chart \
        --namespace app \
        --create-namespace \
        --set backend.image.tag=${IMAGE_TAG} \
        --set backend.replicas=2 \
        --atomic \
        --timeout 3m \
        --wait
    """
  }
}

apiVersion: v1
kind: Secret
metadata:
  name: mongo-secret
  namespace: app
type: Opaque
stringData:
  # In prod: use Sealed Secrets or External Secrets Operator
  mongo-uri: "mongodb://admin:CHANGEME@mongodb.app.svc.cluster.local:27017/appdb"
---
# Docker registry pull secret
apiVersion: v1
kind: Secret
metadata:
  name: dockerhub-pull-secret
  namespace: app
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base64-encoded-docker-config>

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-deployer
  namespace: app
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: jenkins-deploy-role
  namespace: app
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins-deploy-binding
  namespace: app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins-deploy-role
subjects:
  - kind: ServiceAccount
    name: jenkins-deployer
    namespace: app

environment {
  DOCKER_HUB = credentials('dockerhub-creds')    // binds USR + PSW
  KUBECONFIG = credentials('kubeconfig-prod')     // file credential
}

steps {
  sh '''
    echo $DOCKER_HUB_PSW | docker login -u $DOCKER_HUB_USR --password-stdin
    kubectl --kubeconfig=$KUBECONFIG get pods -n app
  '''
}

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: go-backend-hpa
  namespace: app
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: go-backend
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

pipeline {
  agent any

  options {
    timeout(time: 20, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '10'))
    disableConcurrentBuilds()
  }

  environment {
    REGISTRY      = "yourdockerhubuser/go-backend"
    IMAGE_TAG     = "${env.GIT_COMMIT[0..7]}"
    DOCKER_CREDS  = credentials('dockerhub-creds')
    KUBECONFIG    = credentials('kubeconfig-prod')
    SLACK_CHANNEL = '#deployments'
    NAMESPACE     = 'app'
  }

  stages {
    stage('Checkout & Info') {
      steps {
        checkout scm
        sh 'git log --oneline -5'
      }
    }

    stage('Unit Tests') {
      agent { docker { image 'golang:1.22-alpine'; reuseNode true } }
      steps {
        sh 'go mod download'
        sh 'go test ./... -race -coverprofile=coverage.out -json | tee test-report.json'
        sh 'go tool cover -html=coverage.out -o coverage.html'
      }
      post {
        always {
          archiveArtifacts 'coverage.html'
        }
      }
    }

    stage('Build & Push') {
      steps {
        script {
          docker.withRegistry('https://index.docker.io/v1/', 'dockerhub-creds') {
            def img = docker.build("${REGISTRY}:${IMAGE_TAG}",
              "--label git-commit=${env.GIT_COMMIT} .")
            img.push()
            if (env.BRANCH_NAME == 'main') { img.push('latest') }
          }
        }
      }
    }

    stage('Security Scan') {
      steps {
        sh """
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy:latest image --exit-code 1 --severity HIGH,CRITICAL \
            ${REGISTRY}:${IMAGE_TAG}
        """
      }
    }

    stage('Deploy to K8s') {
      when { branch 'main' }
      steps {
        sh """
          helm upgrade --install go-mongo-app ./helm-chart \
            --namespace ${NAMESPACE} \
            --create-namespace \
            --set backend.image.tag=${IMAGE_TAG} \
            --atomic \
            --timeout 3m \
            --wait \
            --kubeconfig=$KUBECONFIG
        """
      }
    }

    stage('Smoke Test') {
      when { branch 'main' }
      steps {
        sh """
          sleep 5
          kubectl --kubeconfig=$KUBECONFIG get pods -n ${NAMESPACE}
          POD=$(kubectl --kubeconfig=$KUBECONFIG get pod -l app=go-backend -n ${NAMESPACE} -o name | head -1)
          kubectl --kubeconfig=$KUBECONFIG exec $POD -n ${NAMESPACE} -- \
            wget -qO- http://localhost:8080/health | grep 'ok'
        """
      }
    }
  }

  post {
    success {
      slackSend(channel: env.SLACK_CHANNEL,
        color: 'good',
        message: "✅ Deploy OK | ${env.JOB_NAME} #${env.BUILD_NUMBER} | ${REGISTRY}:${IMAGE_TAG}")
    }
    failure {
      sh "helm --kubeconfig=$KUBECONFIG rollback go-mongo-app -n ${NAMESPACE} || true"
      slackSend(channel: env.SLACK_CHANNEL,
        color: 'danger',
        message: "❌ Deploy FAILED | ${env.JOB_NAME} #${env.BUILD_NUMBER} | Auto-rolled back")
    }
    always {
      cleanWs()
    }
  }
}