🤖 App → ECR → EKS via Jenkins

Declarative pipeline — build, scan, push, deploy with prod-delta hardening for enterprise Jenkins. · ~50 min

Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04

If you're on Kubernetes 1.27 or older

  • Ingress: networking.k8s.io/v1 is required — v1beta1 removed in 1.22+
  • Pod Security: PodSecurityPolicy removed in 1.25 — use Pod Security Admission (PSA) labels
  • HPA v2 autoscaling/v2 is stable — check API version in manifests

If you're on Kubernetes 1.28

  • Sidecar containers (1.29+) change init-container ordering — review sidecar docs before upgrade
  • Verify metrics-server and HPA after control plane bump

If you're on Terraform 1.7 or older

  • S3 native locking (use_lockfile) differs from DynamoDB — don't mix backends mid-migration
  • Provider version constraints: run terraform init -upgrade after bump
  • terraform test (1.6+) replaces some external test harness patterns

1. Jenkins + K8s agent setup

Kubernetes plugin or dedicated agent with docker + kubectl.

Config →Guide →GitHub repo ↗

2. Jenkinsfile (declarative)

pipeline {
  agent any
  environment {
    ECR_REGISTRY = '123456789.dkr.ecr.us-east-1.amazonaws.com'
    IMAGE = "${ECR_REGISTRY}/myapp:${env.GIT_COMMIT}"
  }
  stages {
    stage('Build') {
      steps { sh 'docker build -t $IMAGE .' }
    }
    stage('Scan') {
      steps { sh 'trivy image --exit-code 1 --severity CRITICAL $IMAGE' }
    }
    stage('Push') {
      steps {
        sh 'aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_REGISTRY'
        sh 'docker push $IMAGE'
      }
    }
    stage('Deploy') {
      when { branch 'main' }
      steps {
        sh 'kubectl set image deploy/myapp app=$IMAGE -n apps'
        sh 'kubectl rollout status deploy/myapp -n apps'
      }
    }
  }
}
Config →

3. Credentials — no static keys in prod

Use IAM instance profile on agent or Jenkins OIDC to AWS. Separate kubeconfig cred per env.

Guide →

4. Prod delta checklist

Scan gate, main-only deploy, audit logs — compare minimal vs production.

Config →Guide →

5. Smoke test + rollback

curl -I https://app.example.com/health
kubectl rollout undo deploy/myapp -n apps
Guide →