Maintainer Guide for JayeX on JayeX - Cloud Native CI/CD Built On Kubernetes

Golang upgrades

Mon, 01 Jan 0001 00:00:00 +0000

JayeX codebase uses Golang/Go. New versions of golang comes every 6 months, and golang supports only 2 versions. It is highly desireable to use the latest and greatest version of golang for JayeX as newer versions have performance improvements and get regular security updates.

To update golang version in JayeX follow these steps

Open an issue in jx repository announcing the upgrade.
Upgrade the goreleaser image - https://github.com/jenkins-x/jx-goreleaser-image
Change the go version in the pipeline catalog repository. See this PR for which files to change.
Update the catalog version in the version stream See this PR for which files to change.
Update the library packages first (please follow this order)
Once these packages are upgraded, start the upgrade for the plugins and main jx repository
Follow these steps to upgrade the version
- Change the version in go.mod file
- Upgrade any direct dependencies to other JayeX packages that you see in go.mod: If you for example find the line github.com/jenkins-x/jx-logging/v3 v3.0.7 you run go get -u github.com/jenkins-x/jx-logging/v3
- Run go mod tidy and ensure that it does not error out
- Change GO_VERSION in makefile to the version you are upgrading to.
- Check if there are any references to an older version and replace those.
- Verify that
  - the build works by running make build
  - tests are working, by running make test
  - linting checks are working by running golangci-lint run
    - Use the same version that is used by JayeX. At the time of writing that is 1.58; you can see what image version is referenced in the pipeline.
    - If there is a configuration file for golangci-lint in the repository (.golangci.yaml) it likely needs to be updated. See for example https://github.com/jenkins-x/jx-kube-client/blob/main/.golangci.yml for reference.

JayeX infrastructure

Mon, 01 Jan 0001 00:00:00 +0000

JayeX runs it’s infrastructure in Google Cloud Platform (GCP). We have 2 GCP projects

jenkinsxio
jenkins-x-bdd

jenkinsxio

This is where the main infrastructure runs (the jobs triggered when a pull request is opened in any repository). Some details about the infrastructure are shown below

GKE kubernetes version 1.21
Spot instances to keep costs low
- n1-standard-2 with boot size 100 GB
Cluster autoscaler scales the nodes between 1 and 5.
We use terraform, an infrastructure as Code tool to manage the cluster using the google-jx module.

jenkins-x-bdd

This project is only used for bdd testing. Test clusters are created here when a pull request is opened in the jx3-versions repository.

Add sbom generation step to release pipelines

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

JayeX started to support supply chain security through different steps. Till now we support:

SBOM generation
Uploading SBOMs to the release page and to our container-registry

How we do it?

There are two types of artifacts we deal with:

Zipped binaries

For .tar.gz artifacts, we use goreleaser to generate the artifacts themselves and to generate SBOMs for them. (Both get released on the release page on github of the repository). See Assets at the release-page for example.