51 lines
1.9 KiB
Markdown
51 lines
1.9 KiB
Markdown
|
# devops-platform — Jenkins Shared Library
|
||
|
|
|
||
|
|
Kisi bhi module ke liye ek hi pipeline. Module ki `Jenkinsfile` sirf itni:
|
||
|
|
|
||
|
|
```groovy
|
||
|
|
@Library('devops-platform') _
|
||
|
|
devopsPipeline(module: 'demo-app')
|
||
|
|
```
|
||
|
|
|
||
|
|
## Kya-kya milta hai (sab default ON)
|
||
|
|
|
||
|
|
| Stage | Tool | Fail hoga jab |
|
||
|
|
|---|---|---|
|
||
|
|
| Secret scan | gitleaks | poori git history me koi secret mila |
|
||
|
|
| Test | module ka test image | test fail |
|
||
|
|
| SAST | SonarQube | quality gate (Sonar side) |
|
||
|
|
| IaC/Dockerfile scan | trivy config | HIGH/CRITICAL misconfig |
|
||
|
|
| CVE gate | trivy image | HIGH/CRITICAL fixable CVE |
|
||
|
|
| SBOM | syft | — (artifact archive hota hai) |
|
||
|
|
| Smoke test | container | `/version` galat |
|
||
|
|
| Push | docker | — |
|
||
|
|
| Sign | cosign | — |
|
||
|
|
| Verify signature | cosign | signature nahi mili |
|
||
|
|
| Deploy + Verify | ansible | playbook fail ya version mismatch |
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
| Key | Default | Kaam |
|
||
|
|
|---|---|---|
|
||
|
|
| `module` | **zaroori** | module ka naam |
|
||
|
|
| `imageName` | `swim/<module>` | registry me image ka naam |
|
||
|
|
| `vaultMount` | `swim` | Vault KV mount jahan `registry` secret hai |
|
||
|
|
| `testImage` | `python:3.12-slim` | test kis image me chalein |
|
||
|
|
| `testCommand` | pytest | test command |
|
||
|
|
| `trivySeverity` | `HIGH,CRITICAL` | CVE gate ki severity |
|
||
|
|
| `appPort` / `healthPath` | `8000` / `/version` | verify endpoint |
|
||
|
|
| `sonarKey` | `swim-<module>` | SonarQube project key |
|
||
|
|
| `inventory` / `playbook` | `deploy/inventory.ini` / `deploy/deploy.yml` | Ansible |
|
||
|
|
| `runSonar` / `runDeploy` / `approval` | `true` | stage on/off |
|
||
|
|
|
||
|
|
## Branch ka niyam
|
||
|
|
- `main`/`master` → poora raasta (staging → approval → production)
|
||
|
|
- `PR-*` aur baaki branches → **sirf CI gates**, koi deploy nahi
|
||
|
|
|
||
|
|
## Rollback
|
||
|
|
`ROLLBACK_TAG=7` do → build/test/scan skip, seedha us image par deploy.
|
||
|
|
|
||
|
|
## Kahan chalta hai
|
||
|
|
- **CI** → `builder-vm-01` (label `builder`). Yahan deploy key **nahi** hai.
|
||
|
|
- **CD + signing** → Jenkins controller (label `built-in`). Yahan docker.sock **nahi** hai.
|