CI/CD automation from freestyle to declarative and scripted pipelines, user management, shared libraries, agents, and production patterns.
15
Chapters
40+
Pipelines
100%
Free
01⚙️
Introduction to Jenkins
The Heart of CI/CD
Jenkins is an open-source automation server that builds, tests, and deploys your code automatically. Think of it as a robot that does all the boring repetitive work — every time you push code to Git, Jenkins picks it up, builds it, runs tests, creates a Docker image, and deploys it. No human intervention needed.
Jenkins Architecture — Simple Explanation
🖥️
Controller (Master)
The brain of Jenkins. It schedules jobs, stores configuration, serves the web dashboard. Think of it as the manager who assigns work but does NOT do the work himself.
🔧
Agent (Worker)
The hands that actually do the building. These are separate machines (VMs, containers, K8s pods) that run your builds. The controller tells the agent: "build this project" and the agent does it.
📋
Job / Pipeline
A set of instructions: "pull code from Git, run Maven build, run tests, push Docker image". Like a recipe that Jenkins follows step by step.
🔄
Build / Run
One execution of a job. Build #45 means the job ran for the 45th time. Each build has logs, status (success/fail), and artifacts.
💡 Golden Rule
In production, the Jenkins controller should NEVER build anything itself. All builds run on agents. The controller only manages and serves the dashboard. This is the most asked interview question about Jenkins architecture.
02📥
Installation & Setup
Get Jenkins Running in 5 Minutes
The fastest way to try Jenkins is Docker. For production, install on a dedicated Linux server or run on Kubernetes.
Docker Installation (Quickest)
TERMINAL# Run Jenkins with Docker — ready in 30 seconds
docker run -d \
--name jenkins \
-p 8080:8080 \
-p 50000:50000 \
-v jenkins_home:/var/jenkins_home \
jenkins/jenkins:lts-jdk17
# Get the initial admin password
docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword
# Output: a1b2c3d4e5f6... (copy this)
✓Paste the initial admin password from the command above
✓Choose "Install Suggested Plugins" (installs the essential plugins)
✓Create your first admin user (NEVER use the built-in admin in production)
✓Set the Jenkins URL (e.g., https://jenkins.yourcompany.com)
✓Install additional plugins: Blue Ocean, Docker Pipeline, Kubernetes
✓Set up your first build agent (never run builds on the controller)
03🖱️
Freestyle Jobs (Classic Editor)
Point-and-Click Builds — No Code Needed
Freestyle jobs are configured entirely through the Jenkins web UI. You click buttons and fill forms instead of writing code. They are great for learning Jenkins, but for production use Pipelines (code-based). Think of Freestyle as training wheels.
Creating a Freestyle Job — Step by Step
✓Dashboard → New Item → Enter name "build-my-app" → Select "Freestyle project" → OK
✓Source Code Management → Select "Git" → Paste your Git repo URL → Add credentials if private repo
✓Build Triggers → Check "GitHub hook trigger for GITScm polling" (auto-build on every push) OR check "Poll SCM" and enter H/5 * * * * (check every 5 minutes)
Every Freestyle job is a ticking time bomb. If Jenkins crashes and you don't have backups, all your Freestyle configs are gone. Pipelines live in Git — they survive anything. Migrate to Pipelines as soon as you learn the basics.
04📝
Declarative Pipeline
The Modern Way — Pipeline as Code
Declarative Pipeline is the recommended way to write Jenkins pipelines. It uses a clean, structured syntax that is easy to read even if you don't know Groovy. The pipeline lives in a file called "Jenkinsfile" in your Git repository — right next to your application code.
Complete Declarative Pipeline — Explained Line by Line
JENKINSFILEpipeline { // Everything inside this block
agent any // Run on any available agent
environment { // Variables available to all stages
APP_NAME = 'order-service'
REGISTRY = 'registry.company.com'
VERSION = "${env.BUILD_NUMBER}" // Jenkins build number
}
options {
timeout(time: 30, unit: 'MINUTES') // Kill build if takes >30 min
disableConcurrentBuilds() // Only 1 build at a time
buildDiscarder(logRotator(numToKeepStr: '10')) // Keep last 10 builds
}
triggers {
pollSCM('H/5 * * * *') // Check Git every 5 minutes
}
stages {
stage('Checkout') {
steps {
git branch: 'main',
url: 'https://github.com/org/order-service.git',
credentialsId: 'github-token'
}
}
stage('Build') {
steps {
sh 'mvn clean package -DskipTests'
}
}
stage('Test') {
steps {
sh 'mvn test'
}
post {
always {
junit 'target/surefire-reports/*.xml' // Publish test results
}
}
}
stage('Docker Build & Push') {
steps {
sh "docker build -t ${REGISTRY}/${APP_NAME}:${VERSION} ."
sh "docker push ${REGISTRY}/${APP_NAME}:${VERSION}"
}
}
stage('Deploy to Staging') {
when { branch 'develop' } // Only on develop branch
steps {
sh "kubectl set image deploy/${APP_NAME} app=${REGISTRY}/${APP_NAME}:${VERSION} -n staging"
}
}
stage('Approval') {
when { branch 'main' }
steps {
input message: 'Deploy to Production?',
ok: 'Yes, Deploy!',
submitter: 'admin,lead-devops' // Only these users can approve
}
}
stage('Deploy to Production') {
when { branch 'main' }
steps {
sh "kubectl set image deploy/${APP_NAME} app=${REGISTRY}/${APP_NAME}:${VERSION} -n production"
}
}
}
post { // Runs AFTER all stages
success {
slackSend channel: '#deploys', color: 'good',
message: "SUCCESS: ${JOB_NAME} #${BUILD_NUMBER}"
}
failure {
slackSend channel: '#deploys', color: 'danger',
message: "FAILED: ${JOB_NAME} #${BUILD_NUMBER}"
}
always {
cleanWs() // Clean workspace after build
}
}
}
Key Directives Explained
Directive
What It Does
Simple Explanation
agent
Where to run
Pick a machine to run on. agent any = any available, agent { docker { image \"node:20\" } } = inside a container
environment
Set variables
Like setting constants. Available in all stages. Can use credentials() to inject secrets
stages
Group of stages
The steps of your recipe: Build → Test → Deploy. They run in order, top to bottom
when
Conditional stage
Only run this stage IF condition is true. when { branch \"main\" } = only on main branch
input
Human approval
Pauses the pipeline and waits for someone to click Approve. Used before production deploys
post
After-pipeline
Runs after everything. success{} for green builds, failure{} for red, always{} for both
options
Pipeline settings
timeout, retry, build discard policy. Safety nets for your pipeline
triggers
Auto-run
pollSCM checks Git for changes. cron runs on a schedule. upstream triggers after another job
05🔗
Advanced Declarative Features
Parallel, Matrix, Retry & More
Real pipelines need parallel execution, conditional logic, retries, and matrix builds. These advanced features make your pipelines production-ready.
Parallel Stages — Run Multiple Things at Once
JENKINSFILEstage('Quality Gates') {
parallel { // All 3 run at the SAME TIME
stage('Unit Tests') {
steps { sh 'mvn test' }
}
stage('Integration Tests') {
steps { sh 'mvn verify -P integration' }
}
stage('Security Scan') {
steps { sh 'trivy image myapp:latest' }
}
}
}
// Without parallel: 5+10+3 = 18 minutes
// With parallel: max(5,10,3) = 10 minutes — saved 8 minutes!
Scripted Pipeline is the older, more flexible way to write Jenkins pipelines. It uses full Groovy programming — variables, loops, try-catch, API calls. Use it when Declarative is too limiting (complex logic, dynamic stages). Think of Declarative as a form you fill out, Scripted as writing your own essay.
Need a for loop to generate stages based on a list
Complex error handling
Need try-catch-finally with custom recovery logic
API calls during pipeline
Need to call REST APIs and use results to decide what to do next
Build matrix from external source
Stages generated from a JSON file or API response
Legacy pipelines
Old pipelines written before Declarative existed
Full Scripted Pipeline Example
SCRIPTED PIPELINEnode('docker-agent') {
def services = ['user-service', 'order-service', 'payment-service']
def registry = 'registry.company.com'
stage('Checkout') {
checkout scm
}
stage('Build All Services') {
for (svc in services) {
dir(svc) { // Enter subdirectory
sh 'mvn clean package -DskipTests'
}
}
}
stage('Test All Services') {
def parallelTests = [:]
for (svc in services) {
def serviceName = svc // Must capture in local var for closure
parallelTests[serviceName] = {
dir(serviceName) {
sh 'mvn test'
}
}
}
parallel parallelTests // Run all tests in parallel!
}
stage('Docker Build & Push') {
for (svc in services) {
dir(svc) {
sh "docker build -t ${registry}/${svc}:${env.BUILD_NUMBER} ."
sh "docker push ${registry}/${svc}:${env.BUILD_NUMBER}"
}
}
}
stage('Deploy') {
try {
sh 'kubectl apply -f k8s/'
sh 'kubectl rollout status deployment/order-service --timeout=120s'
} catch (err) {
echo "Deploy failed: ${err.message}"
sh 'kubectl rollout undo deployment/order-service'
error 'Deployment failed and was rolled back'
}
}
}
💡 Interview Answer
\"Declarative is structured and easier to read — use it for 90% of pipelines. Scripted gives full Groovy — use it for complex logic like dynamic stages, API-driven builds, or custom error handling. Most companies standardize on Declarative.\"
07📄
Real-World Jenkinsfiles
Complete Pipeline Examples for Every Stack
Copy-paste ready Jenkinsfile examples for the most common technology stacks. Each one is production-tested.
Jenkins Credentials Manager stores passwords, tokens, SSH keys, and certificates encrypted. They are injected into builds at runtime — your Jenkinsfile never contains actual secrets.
Credential Types
Type
Use Case
How to Access in Pipeline
Username + Password
Git repos, Docker Hub, Nexus
credentials(\"cred-id\") → sets CRED_USR and CRED_PSW variables
Secret Text
API tokens, webhook URLs, Slack tokens
credentials(\"token-id\") → single string variable
Jenkins automatically masks credentials in build logs. But be careful with echo, printenv, or debugging that might accidentally expose secrets. Never use sh \"echo $PASSWORD\" in production.
09🖧
Agents & Distributed Builds
Scale Jenkins Across Machines
Agents are separate machines that execute your builds. Without agents, Jenkins controller does everything — which is slow, insecure, and a single point of failure. With agents, you can run 50 builds in parallel across different machines.
Agent Types — Simple Comparison
🖥️
Permanent Agent
A VM or server permanently connected to Jenkins. Always running, always ready. Good for specialized builds (GPU, big disk). Downside: you pay for it even when idle.
🐳
Docker Agent
Jenkins spins up a Docker container for each build and destroys it after. Every build gets a clean environment. Most popular choice for most teams.
☸️
Kubernetes Agent
Jenkins creates a K8s pod for each build. Auto-scales: busy = more pods, idle = fewer pods. Best for large teams on Kubernetes.
☁️
Cloud Agent (EC2/Azure)
Jenkins launches a cloud VM for each build. Shuts down when done. Pay only for build time. Good for burst capacity.
In a real company, not everyone should be able to delete pipelines or deploy to production. Jenkins has a complete permission system — you create users, organize them into roles, and control exactly what each role can do.
Setting Up Users
✓Go to Manage Jenkins → Security → Authentication
✓Choose "Jenkins own user database" (simplest) or LDAP/Active Directory (enterprise)
✓Check "Allow users to sign up" only if you want self-registration
✓Create users manually: Manage Jenkins → Users → Create User
✓For SSO: install "SAML Plugin" or "OpenID Connect Plugin" to integrate with Okta/Azure AD
Role-Based Access Control (RBAC)
RBAC SETUP# Install plugin: Role-based Authorization Strategy
# Manage Jenkins → Security → Authorization → Role-Based Strategy
# Step 1: Create Global Roles
# admin → Full access to everything
# developer → Read + build jobs (no delete, no configure Jenkins)
# viewer → Read-only (can see logs but can't trigger builds)
# Step 2: Create Project Roles (Pattern-based)
# team-a-dev → Pattern: team-a-.* → Build + Read
# team-b-dev → Pattern: team-b-.* → Build + Read
# This means team-a can only see and build team-a jobs!
# Step 3: Assign Users to Roles
# suresh → admin (global) + team-platform-dev (project)
# priya → developer (global) + team-a-dev (project)
# intern → viewer (global)
Folder-Level Permissions
📁
Jenkins Folders
Organize jobs into folders: /team-a/build-app, /team-b/deploy-api. Each folder can have its own permissions.
🔒
Folder Credentials
Store credentials at folder level. Team-A's AWS keys are only available to Team-A's jobs. Team-B can't see them.
👤
Folder RBAC
Assign roles per folder. Suresh is admin of /platform/ folder but only viewer of /frontend/ folder.
Best Practices for User Management
✓Never share the built-in admin account — create individual users
✓Use LDAP/Active Directory or SSO (Okta/Azure AD) for enterprise
✓Install Role-Based Authorization Strategy plugin on day one
✓Create roles like admin, developer, deployer, viewer — not per-person permissions
✓Use folder-level permissions so teams can't access each other's secrets
✓Restrict who can approve production deployments (use submitter in input step)
✓Enable audit trail logging — know who did what and when
✓Disable "Remember me" for security-sensitive environments
11📚
Shared Libraries
Write Once, Use in All Pipelines
When you have 50 microservices with almost identical pipelines, you don't copy-paste the same Jenkinsfile 50 times. You create a Shared Library — a central Git repo with reusable pipeline functions. Change it once, all 50 pipelines get the update.
Library Structure
DIRECTORYjenkins-shared-library/ (a Git repository)
vars/
buildDockerImage.groovy // Global function — called like: buildDockerImage()
deployToK8s.groovy // Global function — called like: deployToK8s()
notifySlack.groovy // Global function
standardPipeline.groovy // Full pipeline template
src/
com/company/Utils.groovy // Helper classes
resources/
templates/ // Config file templates
50 microservices × same Docker+K8s pipeline = maintain 1 shared library instead of 50 Jenkinsfiles. Fix a bug in the deploy step? Change 1 file, all 50 services get the fix automatically. This is how Netflix, Amazon, and Reliance scale CI/CD.
12🔌
Essential Plugins — Detailed
Must-Have Plugins with Setup Guide
Jenkins without plugins is just a cron scheduler. Plugins make Jenkins powerful. Here are the must-have plugins with what they do and why you need them.
Plugin
What It Does
Why You Need It
Pipeline
Enables Declarative & Scripted pipelines
Without this, no Jenkinsfile support at all. Core plugin.
Git
Clone and checkout Git repositories
Basic Git integration. Installed by default.
Docker Pipeline
Use Docker containers as build agents
Run builds inside containers for clean, reproducible environments.
Kubernetes
Create K8s pods as dynamic build agents
Auto-scale build agents in Kubernetes clusters.
Blue Ocean
Modern visual pipeline UI
Beautiful pipeline visualization. Much better than classic UI.
Credentials Binding
Inject secrets into builds securely
withCredentials() block. Essential for any real pipeline.
Role-Based Authorization
RBAC for Jenkins
Control who can see/build/configure what. Must-have for teams.
SonarQube Scanner
Static code analysis
Quality gates in CI. Block merges with code smells.
Slack Notification
Send Slack messages from pipelines
Build success/failure alerts to team channels.
JaCoCo
Code coverage reports
Track test coverage percentage. Fail builds below threshold.
Job DSL
Create jobs programmatically
Define Jenkins jobs as code. Reproducible Jenkins setup.
Configuration as Code (JCasC)
Entire Jenkins config in YAML
Recreate Jenkins from scratch in minutes. Store config in Git.
Multibranch Pipeline
Auto-create pipelines per branch
Push a branch with Jenkinsfile → pipeline auto-created. Delete branch → pipeline auto-deleted.
Pipeline: Stage View
Visualize pipeline stages
See which stage failed, how long each took.
Timestamper
Add timestamps to build logs
Know exactly when each line was logged. Essential for debugging.
13🔧
Jenkins Administration
Backup, Monitoring & JCasC
Running Jenkins in production means keeping it healthy — backups, monitoring, upgrades, and configuration management.
✓Add timeout and retry to network-dependent stages
✓Notify on failure only — nobody reads success notifications
✓Use Multibranch Pipeline to auto-create/delete branch pipelines
Security Best Practices
✓Never hardcode credentials in Jenkinsfile — use Credentials Manager
✓Enable RBAC with Role-Based Authorization Strategy plugin
✓Use folder-level credentials — team-A can't see team-B's secrets
✓Put Jenkins behind a reverse proxy with HTTPS (Nginx or ALB)
✓Disable Jenkins CLI — it's a security risk. Use HTTPS API only
✓Update Jenkins and plugins monthly for security patches
✓Use JCasC to define security config in code (auditable, version-controlled)
✓Restrict Script Security approvals — review every sandbox escape
✓Enable Audit Trail plugin for compliance logging
15💼
Interview Questions
30+ Jenkins Q&A for DevOps Interviews
These questions are asked in real DevOps interviews — from entry-level to senior positions.
Architecture & Basics
❓
What is Jenkins?
Open-source automation server for CI/CD. Builds, tests, and deploys code automatically. Written in Java. 1800+ plugins.
❓
Controller vs Agent?
Controller (master) orchestrates — schedules jobs, stores config, serves UI. Agent (slave) executes builds on separate machines. Controller should NEVER run builds in production.
❓
What is a Jenkinsfile?
A text file in your Git repo that defines the CI/CD pipeline as code. Stored alongside application code. Enables Pipeline-as-Code — version-controlled, reviewable.
❓
Declarative vs Scripted Pipeline?
Declarative: structured pipeline{} syntax, easier to read, opinionated, recommended for 90% of cases. Scripted: node{} syntax, full Groovy programming, use when Declarative can't handle complex logic.
Pipelines & Features
❓
What is a Multibranch Pipeline?
Auto-creates pipeline for every branch that has a Jenkinsfile. Push new branch → pipeline auto-created. Delete branch → pipeline auto-deleted. Industry standard.
❓
How to run stages in parallel?
Use parallel { stage(\"A\"){...} stage(\"B\"){...} } inside a parent stage. Reduces pipeline time by running independent tasks simultaneously.
❓
What is the when directive?
Conditional execution. when { branch \"main\" } runs only on main. when { not { changeRequest() } } skips for PRs. Controls which stages run based on branch, tag, or expression.
❓
What is the input step?
Pauses the pipeline for manual approval. submitter restricts who can approve. Used before production deployments. Pipeline waits until someone clicks Approve.
Security & Administration
❓
How to manage secrets?
Jenkins Credentials Manager stores them encrypted. Access via credentials() in environment block or withCredentials() wrapper. Types: username+password, secret text, secret file, SSH key.
❓
What is Shared Library?
Central Git repo with reusable pipeline code (vars/ directory). Called with @Library annotation. One library serves 50+ pipelines. Change once, all pipelines get the update.
❓
Jenkins RBAC?
Install Role-Based Authorization Strategy plugin. Create roles (admin, developer, viewer). Assign users to roles. Use folder-level permissions for team isolation.
❓
What is JCasC?
Jenkins Configuration as Code. Define entire Jenkins setup in YAML — users, credentials, plugins, tools. Store in Git. Recreate Jenkins from scratch in minutes.
Advanced & Comparison
❓
Jenkins vs GitHub Actions?
Jenkins: self-hosted, full control, 1800+ plugins, complex. GitHub Actions: cloud-hosted, simpler YAML, tight GitHub integration, pay-per-minute. Jenkins for enterprise control, GH Actions for simplicity.
Machines that execute builds. Types: permanent (VM always connected), Docker (container per build), Kubernetes (pod per build), Cloud (EC2/Azure VM on demand).
❓
How to back up Jenkins?
Backup $JENKINS_HOME directory (configs, credentials, job history). Use ThinBackup plugin for scheduling. Store in S3/Azure. With JCasC, rebuild from YAML + Git.
❓
What is Blue Ocean?
Modern UI plugin for Jenkins. Visual pipeline editor, beautiful run visualization, GitHub/Bitbucket integration. Makes Jenkins look modern.
