untangling-jenkins.md

Summary of "Untangling Jenkins"

and ideas for further writing

Goal: improve developer and operator happiness

Problems leading to paralysis

1. no. of Jenkins jobs
2. dependencies (on various packages needed by job executors)
3. a feeling (from dev & ops perspective) of overall complexity

Solutions

1. use Jenkins pipelines
2. put CI/CD instructions & definitions in the codebase for each unit or application to be tested
3. declaratively define test environments using Docker Compose
4. minimal executors that have just Docker and Summon
5. each pipeline stage is a single shell script
6. use Conjur to store credentials
7. use Summon to fetch creds
8. assign authz for different creds using executor labels (eg. 'releaser')
9. keep secrets off disk and out of source control

Further concepts for Jenkins blog posts

• how to provision a minimal executor for Conjur-style Jenkins setups

  ideally accompanied by ready-to-use AMI or Ansible playbook or similar

• how to Conjurize a Jenkins executor and assign different privileges to different executor labels (via policy, layers, host hactory)

• using Ansible + Conjur module to spin up Jenkins master and executors

  declarative secuirty policy + declarative infrastructure

• the above, but Puppet

• using Summon + local OS keyring to run Jenkins jobs (build, tests, etc) locally as a developer

• a day in the life of a Conjur Jenkins administrator (helping people add new jobs, updating entitlements, etc)