I brief slide sequence about refactoring a monolithic Jenkins CI system into independent components: Foundation image, Build, Verify, Secrets, SSH, Workflow, Linked dependencies, Artifact “push” (deployment), Audit, and Notifications.

1. CI - A Refactor Story
DevOps Meetup March 2015

2. © Confidential
The real objectives are more like:
◁ Durability
◁ Reliability of delivery
◁ Developer time spent efficiently
◁ Transparency & communication
Automation is not the objective

3. © Confidential
Initial state

4. © Confidential
◁ Build breakdowns
◁ Reliability
◁ Speed
◁ Reproducibility
◁ Loss of “pet” Jenkins login server
Crisis

5. © Confidential
◁ Foundation image
◁ Build
◁ Verify
◁ Secrets
◁ SSH
Separation of concerns
◁ Workflow
◁ Linked dependencies
◁ Artifact “push”
(deployment)
◁ Audit
◁ Notifications

6. © Confidential
◁ Base slave image, strictly managed via CM
Refactor: Pet -> Cow

7. © Confidential
Refactor : “10-factor” build jobs
I. Codebase
One codebase tracked in revision control, many deploys
II. Dependencies
Explicitly declare and isolate dependencies
III. Config
Store config in the environment
IV. Backing Services
Treat backing services as attached resources
V. Build, release, run
Strictly separate build and run stages
VI. Processes
Execute the app as one or more stateless processes
VII. Disposability
Maximize robustness with fast startup and graceful shutdown
VIII. Dev/prod parity
Keep development, staging, and production as similar as possible
IX. Logs
Treat logs as event streams
X. Audit
Build steps and artifacts should be written to an audit system which is independent of any single CI component

8. © Confidential
Refactor : Secrets

9. © Confidential
◁ SSH access is always with your own private key.
◁ Key sharing is eliminated.
◁ If you don’t have access, you request access; not the key.
Refactor - SSH

10. © Confidential
Refactor - Secrets - Clarity of process
Problem:
Solution:

11. © Confidential
◁ Jenkins reduced to an optional automation tool
◁ CI system recovers quickly from failures; “nuke the slave”
◁ Robust processes for still-manual steps
◁ e.g. VMware installer, LXC appliance, prototypes
◁ Limited access to sensitive areas
◁ e.g. Jenkins has no “commit” to Git, nor “push” to Rubygems, PyPi, S3,
etc
◁ Frictionless movement between CI system and developer sandbox
Result