The Challenge


Traditional Jenkins setups use Docker-in-Docker for builds, which has security implications. I needed a better solution for my Kubernetes homelab.


The Solution: Kaniko


Kaniko builds container images inside Kubernetes without requiring Docker daemon access. Here's how I integrated it:


Pipeline Structure


Every project follows this pattern:


pipeline {
  agent any
  stages {
    stage('Build Image') {
      steps {
        sh 'kubectl apply -f ci/kubernetes/kaniko.yaml'
      }
    }
    stage('Security Scan') {
      steps {
        sh 'kubectl apply -f ci/kubernetes/trivy.yaml'
      }
    }
    stage('Deploy') {
      steps {
        sh 'helm upgrade --install app ./charts/app'
      }
    }
  }
}

Benefits


  • Security: No privileged containers
  • Consistency: Same build environment every time
  • Scalability: Kubernetes handles resource allocation
  • Speed: Parallel builds when needed

Lessons Learned


  1. Always use image caching to speed up builds
  2. Keep Helm values separate for different environments
  3. Use Trivy to catch vulnerabilities early
  4. Automate everything - manual deployments are error-prone