Ravindra BagaleCourses & study guides मराठी

Chapter 28: Registries, Kubernetes, Terraform and Ansible from Jenkins

By Last updated:

Chala mitrano, aaj aapan registry push, AWS role (no permanent key), kubectl/Helm, Terraform plan+input+apply, Ansible. Order on a real badge change. Ghabru naka.

What you will learn in this chapter

  • Build and push an image with credential ids
  • AWS identity without a permanent key in Jenkins
  • kubectl apply, rollout status, undo; Helm upgrade/rollback
  • Terraform init validate plan approval apply
  • Ansible-playbook from a stage
  • Honest order for a badge change

Concepts in this chapter

  1. 28.1Registries
  2. 28.2AWS without a permanent key in Jenkins
  3. 28.3Kubernetes deploy and rollback
  4. 28.4Helm upgrade and rollback
  5. 28.5Terraform: init, validate, plan, approval, apply
  6. 28.6Ansible from Jenkins
  7. 28.7Order on a real badge change

The chapter recap is at the end of the last concept page.

Practice Tasks

About this scenario

Suppose we are on the DevOps team at Gojek, the super app company, working from Jakarta. Siti Rahmawati leads the team, and we look after the GoFood menu service. Costs are counted in IDR. In the tasks below we do real DevOps jobs on this project using what this lesson teaches. Gojek is a real company, but this project, the people, servers, IP addresses and numbers are made up for practice.

0 / 12

Easy Push to the registry

Why: The servers pull from the registry, so the image must be there.

What to do: Push registry.gojek.example.com/gofood-menu:1.8.2.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

Easy Which port does the user hit?

Why: Mixing host and container ports is the most common docker mistake.

What to do: A container was started with -p 8443:8081. Which port do you open in the browser on the host?

How:
  1. Write down the facts or numbers the task gives you.
  2. Work it out step by step.
  3. Type only the final answer (one word or number) in the box.
  4. Click Check answer.

Easy Compose: build from source

Why: Developers build the image locally with the same file the team uses.

What to do: Write compose.yaml with one service api that builds from the current folder (.) and publishes 8081:8081.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Medium Tag for a registry

Why: A registry push needs the registry address in the image name.

What to do: Add a second name registry.gojek.example.com/gofood-menu:1.8.2 to the local image gojek/gofood-menu:1.8.2.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

Medium Run the build inside a Docker agent

Why: A Docker agent gives a clean, versioned toolchain for every build.

What to do: Declarative pipeline with agent docker { image 'maven:3.9-eclipse-temurin-21' } and stage Build running sh 'mvn -B verify'.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Medium Compose: env file and restart policy

Why: Secrets live in an env file that is not committed, and services come back after a reboot.

What to do: Write compose.yaml: service worker with image gojek/gofood-menu-worker:1.8.2, env_file .env, and restart: unless-stopped.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Medium Compose: app + database

Why: Compose describes the whole stack in one file anyone can start.

What to do: Write compose.yaml with two services. web: image gojek/gofood-menu:1.8.2, port 8081:8081, depends_on db. db: image postgres:16, environment POSTGRES_PASSWORD: changeme, volume pgdata at /var/lib/postgresql/data. Declare the named volume pgdata at the top level.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Hard Log in to a registry from CI

Why: Passing the password on stdin keeps it out of shell history and process lists.

What to do: The token is in the variable REG_TOKEN. Log in to registry.gojek.example.com as user ci-bot, reading the password from stdin.

How:
  1. Read the task and pick the tool it needs (git, docker, kubectl, terraform, ansible...).
  2. Write the tool name, then the sub-command (the action word).
  3. Add the flags the task needs, each followed by its value.
  4. Add names, files or paths at the end, then click Check answer.

Hard Build and push an image from CI

Why: Every merge to main gives a fresh image in the registry.

What to do: Workflow on push to main. Job image on ubuntu-latest. Steps: actions/checkout@v4; docker/login-action@v3 with registry ghcr.io, username ${{ github.actor }}, password ${{ secrets.GITHUB_TOKEN }}; docker/build-push-action@v6 with push true and tags ghcr.io/gojek-gofood-menu:${{ github.sha }}.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Hard Use Jenkins credentials safely

Why: withCredentials masks the password and removes it after the block.

What to do: Inside stage Push steps, use withCredentials with usernamePassword(credentialsId: 'reg-cred', usernameVariable: 'U', passwordVariable: 'P') and run sh 'echo $P | docker login -u $U --password-stdin registry.gojek.example.com'. Wrap it in a full declarative pipeline with agent any.

How:
  1. Start with pipeline { and close it with } at the end.
  2. Add agent, then stages { } with one stage('Name') { steps { } } per step.
  3. Put the commands inside steps using sh '...'.
  4. Count your { and } so every block is closed, then click Check answer.

Hard Compose: wait for a healthy database

Why: The app crashes if it starts before the database is ready.

What to do: Write compose.yaml: db (mysql:8.0) with a healthcheck whose test is ["CMD", "mysqladmin", "ping", "-h", "localhost"] and interval 10s; app (image gojek/gofood-menu:1.8.2) that depends_on db with condition service_healthy.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

Hard Compose: private backend network

Why: Only the API should reach the database; the proxy stays on the front network.

What to do: Write compose.yaml: proxy (nginx:1.27-alpine) on network front; api (image gojek/gofood-menu:1.8.2) on networks front and back; db (redis:7) on network back. Declare networks front and back at the top level.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Use "- " for list items and fill each value from the task.
  4. Check the colons and spacing, then click Check answer.

See all DevOps practice tasks in the Task Hub →

Ravi Sir's Cards: 17 revision, interview and comparison cards for this chapter · मराठी cards