Ravindra BagaleCourses & study guides मराठी

Chapter 26: Jenkins Security, RBAC and Hardening

By Last updated:

Chala mitrano, aaj aapan Jenkins lock: login, roles, sandbox, CSRF, agents. Anonymous band. Exploit steps ithe nahi — fakt kay band thevaycha. Ghabru naka.

What you will learn in this chapter

  • Authentication on; anonymous off
  • Matrix and Role Strategy roles
  • Script approval and Groovy sandbox
  • CSRF, agents, API tokens, advisories
  • Hardening checklist

Concepts in this chapter

  1. 26.1Why this chapter is a checklist
  2. 26.2Authentication
  3. 26.3Matrix and role strategy
  4. 26.4Script approval and the Groovy sandbox
  5. 26.5CSRF, agents, tokens, advisories
  6. 26.6What a wrong role looks like
  7. 26.7Hardening checklist

The chapter recap is at the end of the last concept page.

Practice Tasks

About this scenario

Suppose we are on the DevOps team at Nubank, the digital banking company, working from São Paulo. Ana Souza leads the team, and we look after the card limit service. Costs are counted in BRL. In the tasks below we do real DevOps jobs on this project using what this lesson teaches. Nubank is a real company, but this project, the people, servers, IP addresses and numbers are made up for practice.

0 / 12

Easy Declarative Jenkinsfile: build and test

Why: Pipeline as code lives in Git with the app, so every change is reviewed.

What to do: Write a declarative Jenkinsfile: agent any; stage Build runs sh 'mvn -B package'; stage Test runs sh 'mvn test'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Give a folder to the web server user

Why: If nginx does not own the upload folder, uploads fail with "permission denied".

What to do: Make user nginx and group nginx the owners of /var/www/nubank/uploads and everything inside.

How:
  1. Find the Linux command that does this job.
  2. Add the options (like -r or -h) the task needs.
  3. Add the file names, folders or users in the right order.
  4. Click Check answer.

Medium Run the build inside a Docker agent

Why: A Docker agent gives a clean, versioned toolchain for every build.

What to do: Declarative pipeline with agent docker { image 'maven:3.9-eclipse-temurin-21' } and stage Build running sh 'mvn -B verify'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Pipeline environment variables

Why: Values set once in environment are reused by every stage.

What to do: Declarative pipeline, agent any, environment with IMAGE = 'nubank/card-limit' and TAG = '1.3.0', and stage Image running sh 'docker build -t $IMAGE:$TAG .'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Always archive, alert on failure

Why: post blocks run after the stages, whatever the result.

What to do: Declarative pipeline, agent any, one stage Build with sh 'make'. Add post: always → archiveArtifacts artifacts: 'build/**'; failure → echo 'Build failed'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Deploy only from main

Why: Feature branches are built and tested but never deployed.

What to do: Declarative pipeline, agent any, stage Deploy with when { branch 'main' } and steps sh './deploy.sh sa-east-1'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Use a secret as an env variable

Why: Secrets are masked in logs and never stored in the repo.

What to do: Workflow on workflow_dispatch. Job notify on ubuntu-latest with one step named Notify that runs ./notify.sh and has env SLACK_URL set from secrets.SLACK_URL.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Medium Create a secret

Why: Passwords belong in a Secret, not in the image.

What to do: Create a generic secret db-cred in nubank-prod with DB_PASSWORD=changeme.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

Hard Use Jenkins credentials safely

Why: withCredentials masks the password and removes it after the block.

What to do: Inside stage Push steps, use withCredentials with usernamePassword(credentialsId: 'reg-cred', usernameVariable: 'U', passwordVariable: 'P') and run sh 'echo $P | docker login -u $U --password-stdin registry.nubank.example.com'. Wrap it in a full declarative pipeline with agent any.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Hard Manual approval before production

Why: A human sign-off stops an accidental production release.

What to do: Declarative pipeline, agent any, stage Prod with input message 'Deploy to production?' and steps sh './deploy.sh prod'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Hard Parallel test stages

Why: Running unit and lint at the same time halves feedback time.

What to do: Declarative pipeline, agent any, stage Checks containing parallel with stage Unit (sh 'npm test') and stage Lint (sh 'npm run lint').

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Hard Encrypt a secrets file

Why: Vault lets you commit secrets safely, encrypted.

What to do: Encrypt the file group_vars/all/secrets.yml with Ansible Vault.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

See all DevOps practice tasks in the Task Hub →

Ravi Sir's Cards: 17 revision, interview and comparison cards for this chapter · मराठी cards