Secure Jenkins CI/CD to VKE with Container Registry

What you will build

A Jenkins-driven delivery pipeline you would trust with production: every step automated, every credential scoped, Jenkins itself locked down, and unsafe images stopped at the gate.

Starting point: you only need a Vultr account. This challenge is self-contained, so you can do it without having done any other.

The requirements

• Jenkins running on Vultr, on an instance or inside the VKE cluster, served over HTTPS
• A Vultr Container Registry and a VKE cluster
• A declarative Jenkinsfile kept in the application repository
• Stages for test, build, scan, push and deploy
• Images tagged with the commit SHA, never latest
• A vulnerability scan stage that fails the build above a severity you choose
• Registry and cluster access held in the Jenkins credentials store, scoped or short-lived, never an owner-level API key
• A one-command rollback to the previous version

Harden Jenkins itself

• No builds run on the controller; use separate agents, for example Kubernetes pod agents or a dedicated build instance
• Authentication enabled with role-based access, and anonymous access off
• Only the plugins you need, kept up to date
• Credentials injected into steps and never printed in logs
• The Jenkins UI not exposed to the whole internet if it does not need to be

The drill

1. Push a clean change and watch the pipeline carry it to the cluster
2. Push a change with a known-vulnerable base image and show the scan stage failing the build
3. Push a change that fails a test and show nothing is deployed
4. Ship a bad release that passes the checks, then roll back
5. Expire or rotate the pipeline's registry credentials and show the pipeline fails safe
6. Show that a build cannot read credentials it was not granted

pipeline {
  agent { label 'build' }
  stages {
    stage('Test')  { steps { sh 'make test' } }
    stage('Build') { steps { sh 'docker build -t $REGISTRY/app:$GIT_COMMIT .' } }
    stage('Scan')  { steps { sh 'scan-image $REGISTRY/app:$GIT_COMMIT --fail-on high' } }
    stage('Push')  { steps { sh 'docker push $REGISTRY/app:$GIT_COMMIT' } }
    stage('Deploy'){ steps { sh 'kubectl set image deployment/app app=$REGISTRY/app:$GIT_COMMIT' } }
  }
}

kubectl rollout undo deployment/app

How you will be judged

• No long-lived secrets in Jenkins that could administer your whole account
• Every refusal demonstrated, not just described
• A Jenkinsfile another team could reuse
• A Jenkins you could defend in a security review

Never print credentials in logs. Destroy Jenkins, the cluster, the registry and any credentials you created when you are done.