OpenShift CI/CD with Jenkins

Learn how to build an enterprise-grade CI/CD pipeline for Spring Boot applications using Jenkins and OpenShift. Understand automated builds, testing, Docker image creation, image scanning, deployment, rollback, and DevSecOps best practices.

Introduction

Large enterprise organizations such as banks, insurance companies, healthcare providers, and retailers deploy applications multiple times every day.

Manually performing the following tasks is slow, error-prone, and unreliable:

Compile source code
Execute unit tests
Build Docker images
Scan images for vulnerabilities
Push images to a registry
Deploy to OpenShift
Verify deployments
Roll back failed releases

To automate this entire process, enterprises use Jenkins.

Jenkins is one of the most widely adopted CI/CD platforms and integrates seamlessly with OpenShift.

Learning Objectives

By the end of this article, you will understand:

What is Jenkins?
CI/CD Architecture
Jenkins Pipeline
Spring Boot Build
Docker Image Build
Image Scanning
Deploying to OpenShift
Rollback Strategy
Enterprise DevSecOps Best Practices

What is Jenkins?

Jenkins is an open-source automation server used to implement Continuous Integration (CI) and Continuous Delivery (CD).

Typical pipeline stages include:

Source Code Checkout
Build
Unit Testing
Code Analysis
Docker Build
Security Scan
Push Image
Deploy
Health Verification

Enterprise CI/CD Architecture

flowchart LR
    A[Developer]
    B[Git Repository]
    C[Jenkins]
    D[Maven Build]
    E[Docker Build]
    F[Image Scan]
    G[Container Registry]
    H[OpenShift Cluster]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

Complete Deployment Workflow

sequenceDiagram
    participant Dev as Developer
    participant Git
    participant Jenkins
    participant Registry
    participant OCP as OpenShift

    Dev->>Git: Commit Code
    Git->>Jenkins: Trigger Pipeline
    Jenkins->>Jenkins: Build & Test
    Jenkins->>Registry: Push Docker Image
    Registry->>OCP: Deploy Image
    OCP-->>Dev: Deployment Successful

CI/CD Pipeline

flowchart LR
    A[Git Commit]
    B[Checkout]
    C[Compile]
    D[Unit Test]
    E[Package]
    F[Docker Build]
    G[Security Scan]
    H[Push Registry]
    I[Deploy OpenShift]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

Project Structure

payment-service/

├── src/
├── pom.xml
├── Dockerfile
├── deployment.yaml
├── service.yaml
├── route.yaml
└── Jenkinsfile

Jenkinsfile

pipeline {

    agent any

    stages {

        stage('Build') {
            steps {
                sh 'mvn clean package'
            }
        }

        stage('Test') {
            steps {
                sh 'mvn test'
            }
        }

        stage('Docker Build') {
            steps {
                sh 'docker build -t payment-service .'
            }
        }

    }

}

Jenkins Pipeline Architecture

flowchart LR
    A[Jenkinsfile]
    B[Build]
    C[Test]
    D[Package]

    A --> B
    B --> C
    C --> D

Maven Build

mvn clean package

Generated artifact

target/payment-service.jar

Unit Testing

mvn test

Never deploy if tests fail.

Docker Build

docker build \
-t quay.io/company/payment-service:1.0 .

Docker Build Architecture

flowchart LR
    A[Source Code]
    B[Maven Package]
    C[Docker Image]

    A --> B
    B --> C

Image Scanning

Use Trivy.

trivy image quay.io/company/payment-service:1.0

Critical vulnerabilities should stop deployment.

Push Image

docker push quay.io/company/payment-service:1.0

Registry Architecture

flowchart LR
    A[Jenkins]
    B[Container Image]
    C[Quay Registry]
    D[OpenShift]

    A --> B
    B --> C
    C --> D

Login to OpenShift

oc login \
--token=OPENSHIFT_TOKEN \
--server=https://api.cluster.company.com

Deploy Application

oc apply -f deployment.yaml

oc apply -f service.yaml

oc apply -f route.yaml

Update Deployment

oc set image deployment/payment-service \
payment-service=quay.io/company/payment-service:1.0

Deployment Architecture

flowchart LR
    A[Jenkins]
    B[OpenShift API]
    C[Deployment]
    D[ReplicaSet]
    E[Pods]

    A --> B
    B --> C
    C --> D
    D --> E

Verify Deployment

oc rollout status deployment/payment-service

Rollback

oc rollout undo deployment/payment-service

SonarQube Integration

Pipeline should include static code analysis.

flowchart LR
    A[Git]
    B[Jenkins]
    C[SonarQube]
    D[Docker Build]

    A --> B
    B --> C
    C --> D

Checks include:

Code Smells
Bugs
Vulnerabilities
Duplications
Coverage

Complete Enterprise Pipeline

flowchart LR
    A[Git Commit]
    B[Build]
    C[Unit Tests]
    D[SonarQube]
    E[Docker Build]
    F[Image Scan]
    G[Push Registry]
    H[Deploy Dev]
    I[Deploy QA]
    J[Deploy Production]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I
    I --> J

Environment Promotion

flowchart LR
    A[Development]
    B[QA]
    C[UAT]
    D[Production]

    A --> B
    B --> C
    C --> D

Production deployment should require approval.

Banking Pipeline

flowchart LR
    A[Developer]
    B[GitHub]
    C[Jenkins]
    D[SonarQube]
    E[Trivy]
    F[Quay]
    G[OpenShift Dev]
    H[OpenShift QA]
    I[OpenShift Production]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

Deployment Verification

After deployment:

Pod Status
Health Endpoint
Readiness Probe
Liveness Probe
Route Accessibility

Example

curl https://payment.company.com/actuator/health

Expected

{
  "status":"UP"
}

Useful OpenShift Commands

oc login

Deploy

oc apply -f deployment.yaml

View Pods

oc get pods

View Logs

oc logs deployment/payment-service

Check Rollout

oc rollout status deployment/payment-service

Rollback

oc rollout undo deployment/payment-service

Common Problems

Build Failed

Possible causes:

Compilation errors
Missing dependencies
Failed tests

Docker Build Failed

Verify:

Dockerfile
Build context
Registry access

Deployment Failed

Check

oc describe pod

Review:

Events
ConfigMaps
Secrets
Image Pull

Image Pull Error

Verify:

Registry credentials
Image tag
Image exists

Rollout Stuck

Check

oc rollout status deployment/payment-service

Review Pod logs.

Production Best Practices

Store credentials in Jenkins Credentials.
Never hardcode passwords.
Run automated tests.
Integrate SonarQube.
Scan every image.
Use immutable image tags.
Enable deployment approvals.
Monitor pipeline execution.
Keep Jenkins plugins updated.
Implement automated rollback.

Common Mistakes

❌ Deploying directly from a developer machine.

❌ Skipping unit tests.

❌ Ignoring SonarQube quality gates.

❌ Deploying unscanned images.

❌ Using the latest image tag in production.

❌ Storing credentials inside the Jenkinsfile.

Advantages

Fully automated CI/CD
Faster software delivery
Improved code quality
Reduced deployment failures
Secure DevSecOps pipeline
Repeatable deployments
Easy rollback
Enterprise-ready automation

Summary

Jenkins remains one of the most powerful CI/CD platforms for automating Spring Boot deployments to OpenShift.

Key takeaways:

Automate build, test, scan, and deployment workflows.
Integrate SonarQube and vulnerability scanning into the pipeline.
Store sensitive credentials securely in Jenkins Credentials.
Deploy immutable container images to OpenShift.
Verify deployments and support automated rollback for reliable releases.

Interview Questions

What is Jenkins?
What is the difference between Continuous Integration and Continuous Deployment?
Why should Jenkins Credentials be used instead of hardcoding secrets?
How do you deploy a new image to OpenShift from Jenkins?
Why should image scanning be part of the CI/CD pipeline?
What is a Jenkinsfile?
How does SonarQube improve code quality?
How do you roll back a failed deployment in OpenShift?
Why should production deployments require approval?
What are the best practices for implementing CI/CD with Jenkins and OpenShift?