jenkins_kubernetes_cicd.d2

#!/usr/bin/env d2
#
#  Author: Hari Sekhon
#  Date: 2023-05-11 01:42:50 +0100 (Thu, 11 May 2023)
#
#  vim:ts=2:sts=2:sw=2:et:filetype=d2
#
#  https://github.com/HariSekhon/Diagrams-as-Code
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

# ============================================================================ #
#             J e n k i n s   C I / C D   o n   K u b e r n e t e s
# ============================================================================ #

direction: down

title: {
  label: Jenkins CI/CD on Kubernetes
  near: top-center
  shape: text
  style.font-size: 40
  style.underline: true
}

classes: {
  jenkins: {
    label: Jenkins
    icon: https://diagrams.mingrammer.com/img/resources/onprem/ci/jenkins.png
    shape: image
  }
  jnlp: {
    label: JNLP
    icon: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ83AlZnZlE8K4Eu1YcU21AGHqn6yUiR5sPudY-8Sqpsv2SpbIwozrOkafvanvJtnIKDVA&usqp=CAU
    # icon: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRMD1zTPfv13yyi3gUADFXc-paO1PViTt7U1yRUxTGTnD3zXOBlvALgfCYcnNDUDor7sb4&usqp=CAU
    shape: image
  }
  docker: {
    label: Docker
    # icon: https://diagrams.mingrammer.com/img/resources/onprem/container/docker.png
    icon: https://icons.terrastruct.com/dev%2Fdocker.svg
    shape: image
  }
  cloudbuild: {
    label: Cloud Build
    # icon: https://diagrams.mingrammer.com/img/resources/gcp/devtools/build.png
    icon: https://icons.terrastruct.com/gcp%2FProducts%20and%20services%2FDeveloper%20Tools%2FCloud%20Build.svg
    shape: image
  }
  argocd: {
    label: ArgoCD
    icon: https://diagrams.mingrammer.com/img/resources/onprem/gitops/argocd.png
    shape: image
  }
  clair: {
    label: Clair
    # icon: https://www.projectquay.io/img/clair-logo-svg-vector.svg
    # from https://github.com/quay/clair
    # icon: https://cloud.githubusercontent.com/assets/343539/21630811/c5081e5c-d202-11e6-92eb-919d5999c77a.png
    # just the icon without the name, from AquaSec security
    icon: https://lh6.googleusercontent.com/hQqgUGW_dyTn3HHEge2nVAxLsdGdf249Ow0uyKbXcfV8bxpxjEcFugSG3U-DTowCmwbfbecnSnctvwPipewDbFAHh4CkIpTuERZBosEpevr9CBpLmP0zxWNJ-6ACHOP9Pxbw1-JUKs1ykJotHLrx-ZXlPNictVXmNVBkVkRFwGsYeym0Uk1RL5Wkug
    # downloaded in case it disappears from online or link changes and breaks future CI/CD runs
    # icon: images/clair.png
    shape: image
  }
  grype: {
    label: Grype
    # icon: https://user-images.githubusercontent.com/5199289/136855393-d0a9eef9-ccf1-4e2b-9d7c-7aad16a567e5.png
    # just icon without word
    icon: https://anchore.com/wp-content/uploads/2021/11/image-111.png
    shape: image
  }
  trivy: {
    label: Trivy
    # icon: https://appsecmap.com/images/d/Trivy.png
    icon: https://diagrams.mingrammer.com/img/resources/onprem/security/trivy.png
    shape: image
  }
  sonarqube: {
    label: SonarQube
    # word icon
    # icon: https://assets-eu-01.kc-usercontent.com/e1f3885c-805a-0150-804f-0996e00cd37d/afadf76d-420e-414d-acff-4a9efb344baa/SonarQubeIcon.svg
    # solid blue, hard to read
    # icon: https://assets-eu-01.kc-usercontent.com/62ab8174-eef6-01d0-2c3c-101910aab0d4/085492c1-74a1-4749-908f-fa94fbd1fc5a/open-graph-sonar.png
    # official website icon
    # icon: https://assets-eu-01.kc-usercontent.com/62ab8174-eef6-01d0-2c3c-101910aab0d4/5590df23-cc3a-4487-a3dd-e5dcb2da8731/sonar-logo-horizontal.svg
    # pic only icon from twitter profile
    icon: https://pbs.twimg.com/profile_images/1500905367433318400/fMj5ti-L_400x400.jpg
    shape: image
  }
  sonarcloud: {
    label: SonarCloud.io
    icon: https://static-00.iconduck.com/assets.00/sonarcloud-icon-512x449-31oqlodh.png
    shape: image
  }
  ingress: {
    label: Kubernetes Ingress
    icon: https://diagrams.mingrammer.com/img/resources/k8s/network/ing.png
    shape: image
  }
  users: {
    label: Users
    icon: https://icons.terrastruct.com/essentials%2F359-users.svg
    # icon: https://diagrams.mingrammer.com/img/resources/onprem/client/users.png
    shape: image
  }
  github: {
    label: GitHub\nrepos
    icon: https://icons.terrastruct.com/dev%2Fgithub.svg
    # icon: https://icons.terrastruct.com/social%2F039-github.svg
    shape: image
  }
  git: {
    label: GitHub repo
    icon: https://icons.terrastruct.com/dev%2Fgit.svg
    shape: image
  }
  nginx: {
    label: Nginx
    # icon: https://icons.terrastruct.com/dev%2Fnginx.svg
    icon: https://diagrams.mingrammer.com/img/resources/onprem/network/nginx.png
    shape: image
  }
  gke: {
    label: GKE
    icon: https://icons.terrastruct.com/gcp%2FProducts%20and%20services%2FCompute%2FKubetnetes%20Engine.svg
    # icon: https://diagrams.mingrammer.com/img/resources/gcp/compute/kubernetes-engine.png
    shape: image
  }
  gcr: {
    label: GCR
    # dark filled
    icon: https://icons.terrastruct.com/gcp%2FProducts%20and%20services%2FDeveloper%20Tools%2FContainer%20Registry.svg
    # light filled
    # icon: https://diagrams.mingrammer.com/img/resources/gcp/devtools/container-registry.png
    shape: image
  }
  dash: {
    style.stroke-dash: 5
  }
  invisible: {
    style.opacity: 0
  }
}

# users -> gcp.gke.ingress.nginx
# users.class: users

# github -> sonarcloud: code scanning
# sonarcloud.class: sonarcloud

# github : GitHub{
github.class: github
#  repo1.class: git {
#    label: GitHub repo 1
#  }
#  repo2.class: git {
#    label: GitHub repo 2
#  }
#  repo3.class: git {
#    label: GitHub repo 3
#  }
# }

# dockerhub: {
#  label: DockerHub
#  class: docker
# }
#
# quay: Quay.io {
#  icon: https://pics.freeicons.io/uploads/icons/png/21458934601551942638-512.png
#  shape: image
# }

gcp: Google Cloud Platform {
  gcr.class: gcr
  # _.dockerhub -> gke.gke
  # _.quay -> gke.gke
  gcr -> gke.gke: {
    label: pull docker images
    # label: pull\njenkins\ntrivy\ndocker\nimages
    # style.stroke-dash: 5
    style.animated: true
  }
  cloudbuild.class: cloudbuild
  cloudbuild -> gcr: push docker images {style.animated: true}
  gke: Google Kubernetes Engine {
    gke.class: gke
    # ingress: Ingress {
    #  nginx.class: nginx
    # }
    # ingress.nginx -> jenkins.server
    jenkins: Jenkins Server\npod {
      server.class: jenkins
      server.label: Jenkins Server
    }
    _._.github -> jenkins.server: webhook trigger {style.animated: true}
    _._.github <- jenkins.server: polling SCM (as backup for lost webhooks) {style.animated: true}
    # messy and ugly
    # _._.github.repo1 -> jenkins.server: webhook trigger
    # _._.github.repo2 -> jenkins.server: webhook trigger
    # _._.github.repo3 -> jenkins.server: webhook trigger
    # _._.github.repo1 <- jenkins.server: polling SCM (as backup for lost webhooks) { style.stroke-dash: 5 }
    # _._.github.repo2 <- jenkins.server: polling SCM (as backup for lost webhooks) { style.stroke-dash: 5 }
    # _._.github.repo3 <- jenkins.server: polling SCM (as backup for lost webhooks) { style.stroke-dash: 5 }
    jenkins.server -> jenkins_agent: Spawn ephemeral Jenkins Agent(s)\ndynamically
    jenkins_agent: Jenkins Agent\npod {
      agent.class: Jenkins
      agent.label: Jenkins Agent
      agent -- jnlp # : { class: invisible }
      jnlp -> _.jenkins.server: phone home\nfor CI/CD pipeline\ninstructions {style.animated: true}
      jnlp.class: jnlp
      jnlp.label: JNLP container
      jnlp -> gcloud_sdk: CI/CD Build,\nScan & Deploy\ninstructions

      gcloud_sdk: GCloud SDK\ncontainer {
        icon: https://icons.terrastruct.com/gcp%2FProducts%20and%20services%2FDeveloper%20Tools%2FCloud%20SDK.svg
        shape: image
      }
      # gcloud_sdk <- _._._.github: git clone
      gcloud_sdk -> _._.cloudbuild: Docker Build {style.animated: true}

      grype.class: grype
      trivy.class: trivy

      gcloud_sdk -> sonar-scanner: Scan code for\nbugs & vulnerabilities
      sonar-scanner: {
        label: Sonar Scanner
        class: sonarqube
      }
      sonar-scanner -> _.sonar.container: Report results {style.animated: true}

      gcloud_sdk -> clairctl: Scan docker images\nfor vulnerabilities
      clairctl: {
        label: clairctl
        class: clair
      }
      clairctl -> _.clair.container: Index & Match\nagainst vulnerabilities DBs {style.animated: true}

      gcloud_sdk -> grype: Scan code & docker images\nfor vulnerabilities
      gcloud_sdk -> trivy: Scan code\n& docker images\nfor vulnerabilities

      # gcloud_sdk -> docker: Docker Build

      trivy -> _.docker: use\nDOCKER_HOST=\ntcp://docker.docker.svc.cluster.local:2376 {style.animated: true}
      grype -> _.docker: use\nDOCKER_HOST=\ntcp://docker.docker.svc.cluster.local:2376 {style.animated: true}

      # trivy -> _._.gcr: { style.stroke-dash: 5 }
      # grype -> _._.gcr: { style.stroke-dash: 5 }
    }

    docker: Docker\npod {
      container.class: docker
      container.label: Docker-in-Docker\ncontainer
      # container -> _._.gcr: push built docker images {style.animated: true}
      container <- _._.gcr: pull docker images to test {style.animated: true}
    }

    # jenkins_agent.trivy -> jenkins.server: publish HTML report in UI { style.stroke-dash: 5 }
    trivy: Trivy pod {
      server: {
        label: Trivy Server
        class: trivy
      }
      server <- _.jenkins_agent.trivy: {
        label: send analysis and get security results
        style.animated: true
      }
    }

    blank: {style.opacity: 0}

    argocd: ArgoCD\npods {
      container.class: argocd
      _.jenkins_agent.gcloud_sdk -> container: Deploy\nKustomize\n+ Helm\nto\nKubernetes
      # container -> _.gke: {style.animated: true}
    }

    clair: Clair\npod {
      container.class: clair
    }

    # clair.container -> _.gcr: scan images in registry { style.stroke-dash: 5 }
    sonar: SonarQube\npod {
      container.class: sonarqube
    }

    # places sonar on the right of the diagram, giving more balance
    # comes out on the left insted of right
    # sonar -- _._.github {
    #  style.opacity: 0
    #  style.stroke-dash: 5
    # }
    # forces sonar back to the right
    # clair -- blank: {
    #  #style.opacity: 0
    # }
    # sonar -- blank: {
    #  #style.opacity: 0
    # }
  }
}