Learn Jenkins - Complete Production-Grade Enterprise Pipeline Case Study

#Introduction

This is the final episode of the Learn Jenkins series. In the previous 19 episodes we built skills from installation, pipeline as code, agents, secrets, Docker, shared libraries, JCasC, to troubleshooting. Now we assemble everything into one complete enterprise pipeline architecture — the flow that DevOps teams at large companies actually use.

We will build a pipeline that satisfies the following flow:

1. SCM event trigger — a webhook triggers a Multibranch Pipeline on every push or pull request.
2. Dynamic agent provisioning — the Kubernetes cluster creates a build pod containing Node.js, SonarScanner, and the Docker CLI.
3. Checkout & quality analysis — git checkout, SonarQube scan, and the quality gate must pass.
4. Test & build — unit tests, JaCoCo coverage, then a multi-stage Docker build.
5. Registry & security scan — push the image to a private registry, then scan vulnerabilities with Trivy.
6. Staging deploy & E2E test — deploy to the staging namespace, then run Cypress.
7. Manual approval gate — the release manager approves via the input step.
8. Production deploy & notification — rolling update to the production namespace, Slack notification, and automatic cleanup of the build pod.

#Enterprise Pipeline Architecture

The key is separation of responsibilities. The Jenkins controller only orchestrates; all heavy work runs on Kubernetes agent pods created and removed per build (episode 3). The source of truth for deployment is the Helm chart (episode 16), quality is controlled by SonarQube (episode 14), and image security is maintained by Trivy. Every stage can fail and stop the flow early — never proceed to production if quality or security has not passed.

#Complete Jenkinsfile

Here is the full Jenkinsfile for the flow above. The application repository contains Node.js source code, the chart/ folder contains the Helm chart, and the pipeline runs as a Multibranch Pipeline.

Enterprise pipeline Jenkinsfile

pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
    - name: build
      image: node:20-alpine
      command: ['sleep', 'infinity']
    - name: sonar
      image: sonarsource/sonar-scanner-cli:11
      command: ['sleep', 'infinity']
    - name: docker
      image: docker:27
      command: ['sleep', 'infinity']
      volumeMounts:
        - name: docker-sock
          mountPath: /var/run/docker.sock
  volumes:
    - name: docker-sock
      hostPath:
        path: /var/run/docker.sock
'''
        }
    }
    options {
        timestamps()
        timeout(time: 60, unit: 'MINUTES')
        disableConcurrentBuilds()
    }
    environment {
        IMAGE = 'registry.example.com/my-app'
        TAG = "1.0.${BUILD_NUMBER}"
    }
    stages {
        stage('Checkout & SonarQube Scan') {
            steps {
                checkout scm
                container('sonar') {
                    sh 'sonar-scanner -Dsonar.projectKey=my-app'
                }
            }
        }
        stage('Quality Gate') {
            steps {
                withSonarQubeEnv('SonarQube') {
                    sh 'echo "Menunggu quality gate..."'
                }
                timeout(time: 5, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }
        stage('Test & Build') {
            steps {
                container('build') {
                    sh 'npm ci'
                    sh 'npm run test:coverage'
                    sh 'npm run build'
                }
            }
            post {
                success {
                    junit 'coverage/report.xml'
                    jacoco execPattern: '**/jacoco.exec'
                }
            }
        }
        stage('Push Image & Trivy Scan') {
            steps {
                container('docker') {
                    docker.withRegistry('https://registry.example.com', 'registry-creds') {
                        sh "docker build -t ${IMAGE}:${TAG} ."
                        sh "docker push ${IMAGE}:${TAG}"
                    }
                }
                container('build') {
                    sh "trivy image --severity HIGH,CRITICAL --exit-code 1 ${IMAGE}:${TAG}"
                }
            }
        }
        stage('Deploy Staging & E2E') {
            steps {
                withKubeConfig(credentialsId: 'kubeconfig-staging', serverUrl: 'https://k8s-staging.example.com') {
                    sh "helm upgrade --install my-app ./chart --namespace staging --set image.repository=${IMAGE} --set image.tag=${TAG}"
                }
                sh 'npm run test:e2e -- --base-url=https://staging.example.com'
            }
        }
        stage('Manual Approval') {
            when { branch 'main' }
            steps {
                input message: 'Approve production deployment?', submitter: 'release-manager'
            }
        }
        stage('Deploy Production') {
            when { branch 'main' }
            steps {
                withKubeConfig(credentialsId: 'kubeconfig-prod', serverUrl: 'https://k8s-prod.example.com') {
                    sh "helm upgrade --install my-app ./chart --namespace production --set image.repository=${IMAGE} --set image.tag=${TAG} --wait"
                }
            }
        }
    }
    post {
        success {
            slackSend(color: 'good', message: "Deploy ${env.JOB_NAME} #${env.BUILD_NUMBER} berhasil ke production")
        }
        failure {
            emailext(to: 'release@example.com', subject: "Pipeline gagal: ${env.JOB_NAME}", body: "Cek log: ${env.BUILD_URL}")
        }
        cleanup {
            cleanWs()
        }
    }
}

#Stage-by-Stage Workflow

• SCM webhook: the repository is registered as a Multibranch Pipeline; every push or pull request automatically triggers the pipeline on its respective branch. Branches other than main only run up to staging.
• Dynamic agent: the Kubernetes plugin creates a pod with three containers — build (default), sonar, and docker. After the build finishes, the pod is automatically destroyed, leaving no resources behind.
• Quality: waitForQualityGate blocks the pipeline if SonarQube gives a failed result. Configure the SonarQube quality gate to auto-pass on non-prod projects so the pipeline does not hang forever.
• Build & scan: the multi-stage Dockerfile produces a slim image. Trivy with --exit-code 1 makes the pipeline fail if HIGH or CRITICAL vulnerabilities are found.
• Staging & E2E: the application is deployed to the staging namespace, then Cypress runs against the staging base URL. This is the last gate before approval.
• Manual approval: the input step stops the pipeline on the main branch until the release manager approves.
• Production: helm upgrade --install with the --wait flag performs a rolling update and waits for pods to be ready before the pipeline is declared successful, then Slack reports.

#Production Readiness & Security Hardening Checklist

Finally, the checklist that must be satisfied before a Jenkins controller is declared production-ready:

• The controller does not run builds — all work runs on agents; the controller only orchestrates.
• Close anonymous access — disable anonymous read; all access requires a login.
• RBAC — use the Role Strategy with separate roles: admin, developer, and release manager.
• Centralized authentication — SSO via LDAP, AD, SAML, or OIDC, not a separate user database.
• All secrets in the credentials store — use withCredentials and never store secrets in the Jenkinsfile.
• Guard kubeconfigs — cluster credentials only for specific jobs, with contexts limited per namespace.
• TLS at the public edge — run Jenkins behind an HTTPS reverse proxy (e.g. Nginx); do not expose plain HTTP.
• Manage plugins — update plugins regularly, remove unused ones, and monitor security.
• Scheduled backup + DR test — ThinBackup or periodic snapshots, with a restore tested quarterly.
• Monitoring & alerting — the Prometheus Metrics plugin for queue, executor, and JVM; alerts active in Grafana.
• Network isolation — restrict the controller's and agents' network access to only what is needed (registry, SCM, cluster).

#Conclusion

In this episode we assembled everything into an enterprise pipeline case study:

• An SCM webhook triggers a Multibranch Pipeline for every branch and pull request.
• Dynamic build pods in Kubernetes run checkout, SonarQube, tests, and the Docker build.
• The image is scanned by Trivy before entering the private registry and being deployed to staging.
• The quality gate, E2E, and manual approval form three security gates before production.
• A rolling update to production, Slack notification, and automatic cleanup close the flow.
• A security hardening checklist ensures the controller is secure and production-ready.

From episode 0 to 20, you now have a complete toolkit for building, securing, monitoring, and troubleshooting Jenkins at enterprise scale. Do not stop here — try applying it to a real project, automate the small things first, then raise the complexity. Happy building your own production-grade pipeline!