December 2018 Summaries

The text compares Jenkins X and Codefresh, two CI/CD solutions, highlighting their functionalities, strengths, and limitations. Jenkins X, a newer tool, attempts to provide a comprehensive CI/CD experience for Kubernetes by adding deployment capabilities to Jenkins and enforcing opinionated workflows, such as trunk-based development and mandatory Helm usage for deployments. It offers ease of setup, making it appealing for startups or greenfield projects, but its reliance on a command-line interface and its integration with Jenkins 2.x's complexities may pose challenges. Codefresh, in contrast, is depicted as a more mature and versatile platform, supporting numerous deployment targets beyond Kubernetes and accommodating various development workflows, making it suitable for established companies with diverse project needs. Its graphical interface enhances accessibility across an organization, allowing different teams to manage infrastructure and application development independently. While Jenkins X facilitates quick setups for new projects, Codefresh's flexibility and proven track record in production environments provide a robust solution for companies with existing infrastructure and varied deployment requirements.

Submitting contributions to open source projects often involves challenges such as delayed feedback from maintainers, who are typically few and may be preoccupied with other tasks. The author highlights how continuous integration can alleviate this issue by shortening the feedback loop between contributors and approvers. Specifically, the use of Codefresh's new PR comment-added trigger allows maintainers to quickly initiate builds by commenting predefined commands on pull requests, ensuring that changes are not harmful before executing tests. This system not only streamlines the review process for maintainers but also benefits contributors by providing them access to build logs through publicly-viewable pipelines, enhancing transparency and potentially increasing user trust in open source projects. The author encourages incorporating Codefresh pipelines into projects to enhance testing visibility and reliability.

Codefresh has launched a plugin marketplace featuring a collection of open-source pipeline steps that can be integrated into pipelines by adding specific YAML segments. These plugins, contributed by Codefresh and its partners, are easy to create and use, as each consists of a Docker image with clear input and output parameters. This approach differs from traditional CI/CD platforms that rely on custom scripts and lead to vendor lock-in, making them harder to extend. Codefresh's use of Docker images as the foundation for each plugin allows developers to use any programming language, offering more flexibility and ease of integration. The marketplace aims to provide building blocks for pipelines, encouraging community contributions as Docker adoption grows.

Codefresh has developed a custom step to enhance Docker image security by integrating with Clair, an open-source project for vulnerability scanning. This step allows users to quickly scan Docker images for vulnerabilities and generate reports to determine if the build should pass or fail based on configured vulnerability thresholds. The integration requires an instance of Clair and provides enriched metadata on vulnerabilities for Docker images in the Codefresh registry. Users can also upload reports to storage and connect them with the Codefresh registry for additional metadata enrichment. The process is streamlined, requiring minimal setup, and Codefresh offers resources such as a webinar and a Helm Chart by the CoreOS Team to assist users in deploying Clair on Kubernetes.

JFrog Artifactory is a versatile repository management solution that now includes support for Docker images, and its SaaS counterpart, Bintray, offers similar capabilities in the cloud. The article outlines how to integrate JFrog Bintray with Codefresh pipelines for managing Docker images and binary artifacts, highlighting the ease of connecting Bintray as a Docker registry and its ability to store various types of binary packages beyond Docker images. It demonstrates the dual functionality of Bintray through two Codefresh pipelines: one that compiles and uploads Go binaries to Bintray as a generic repository, and another that packages these binaries into Docker images for upload to Bintray as a Docker registry. The integration process involves using an API key and setting up registry domains, underscoring Bintray's flexibility and adaptability in managing different types of artifacts within Codefresh's CI/CD environment.