Securing and streamlining your CI/CD pipelines with Jenkins and Steampunk Spotter

The quickly evolving realm of software development calls for efficiency and security in continuous integration and continuous deployment (CI/CD) pipelines. Steampunk Spotter and Jenkins are both popular DevOps tools, and they can be used together to improve the quality and security of your software development process. It is common not to deploy locally but in CI/CD pipelines in DevOps. This diminishes your control and by integrating Spotter into your Jenkins pipeline, you can automatically scan your Ansible Playbooks for errors and vulnerabilities before they are deployed to production. This can help you avoid costly and time-consuming production outages and security breaches.

In this blog, we’ll delve into how to guarantee a safe deployment with Ansible, using Jenkins, and how to make sure your playbooks are reliable and secure – with Spotter.

Jenkins: Streamlining software development

Jenkins has become a cornerstone tool for modern DevOps practices by automating the process of taking code from development and integrating it into the production environment. This automation dramatically accelerates the software development cycle but can also create challenges, particularly in terms of security.

Critical features of Jenkins include:

• Automation: Jenkins provides hundreds of plugins to support building, deploying, and automating any project.

• Extensibility: The functionality of Jenkins can be extended through its plugin architecture, providing nearly infinite possibilities for what Jenkins can do.

• Distributed Nature: Jenkins can distribute work across multiple machines, helping to drive builds, tests, and deployments across multiple platforms faster.

• Continuous Integration and Continuous Delivery/Deployment: Jenkins is widely used for CI/CD, helping to ensure that code changes are automatically tested and deployed.

Please read our blog on Jenkins vs Ansible for more information on what benefits using Jenkins can bring and how it compares to Ansible.

Why use Spotter with Jenkins

Today’s codebases are dynamic and increasingly complex. While CI/CD pipelines facilitate rapid development, they can also introduce code vulnerabilities if proper analysis is lacking. Neglecting code quality can result in security vulnerabilities, increased maintenance costs, and decreased development agility.

To address these challenges effectively, it’s essential to introduce code analysis as early as possible in the development cycle. This concept, known as “Shift Left,” emphasizes detecting and resolving potential issues before they propagate down the pipeline.

Steampunk Spotter: A solution to Ansible CI/CD security

Steampunk Spotter is an Ansible Playbook Platform that analyses and identifies and rectifies hard-to-detect errors and time-consuming issues within Ansible Playbooks. It enhances their quality, reliability, and security.

The role of code analysis tools

Integrating code analysis tools like Spotter into your CI/CD pipeline offers several key advantages:

• Early issue detection: Code analysis tools help detect potential issues early in development, reducing the likelihood of vulnerabilities entering production.

• Code quality maintenance: These tools aid in maintaining high code quality and compliance with industry standards, making them invaluable in today’s fast-paced development environments.

• Automated Code Reviews: Code analysis tools streamline the code review process by automatically identifying areas that need attention, saving time for developers and ensuring consistent code quality.

• Collaboration Facilitation: Integration with CI/CD promotes collaboration by providing a centralized platform where development teams can collectively address and resolve code issues.

Seamless integration with Jenkins

Steampunk Spotter can be seamlessly integrated into your Jenkins CI/CD pipeline, allowing you to run Ansible scans from a Docker container using the Spotter CLI and display the results in JUnit format.

To get started, follow these steps:

1. Ensure you have the Docker, JUnit, and Git Jenkins plugins installed and enabled. Typically, these plugins are automatically installed and enabled when you install Jenkins using the standard method.

2. Set up credentials for authenticating with Spotter. We recommend using an API token, which can be generated in your user settings within the Spotter web app.

3. Create a new Pipeline item for running Spotter scans.

4. Configure your pipeline (Jenkinsfile) to use the Spotter CLI Docker image, clone, and scan the desired Git repository. You can also connect to GitLab, GitHub, or any other source code management solution of your choice and trigger scans whenever there’s a new change pushed to a repository. In the example Jenkinsfile below, we use a declarative pipeline syntax. We have cloned an example Git repository with playbooks, which you can find here , and then ran a Spotter scan.

Here’s an example Jenkinsfile configuration:

pipeline {
    agent any
    stages {
        stage('checkout') {
            steps {
                checkout scmGit(
                    branches: [[name: '*/main']],
                    userRemoteConfigs: [[url: 'https://gitlab.com/xlab-steampunk/steampunk-spotter-client/playbook-examples.git']]
                )
                sh 'ls -la'
            }
        }
        stage('spotter-scan') {
            agent {
                docker {
                    image 'registry.gitlab.com/xlab-steampunk/steampunk-spotter-client/spotter-cli:2.5.0'
                    args '--entrypoint=""'
                    reuseNode true
                }
            }
            steps {
                withCredentials([string(credentialsId: 'SPOTTER_API_TOKEN', variable: 'TOKEN')]) {
                    sh 'spotter --storage-path . -t $TOKEN scan --junit-xml report.xml . || true'
                }
            }
        }
    }
    post {
        always {
            sh "ls -la"
            junit '**/*.xml'
        }
    }
 }

5. After setting up the pipeline, you can trigger it by selecting “Build Now,” and you will quickly see the scan results.

6. To view the scan results in JUnit format for a specific build, click on “Test Result” within that build.

If you cannot use the Spotter CLI Docker image due to concerns about untrusted sources, you can still use trusted Python Docker images. Here’s an example Jenkinsfile that demonstrates how to configure Jenkins CI to do that:

pipeline { 
   agent any 
   stages { 
       stage('checkout') { 
           steps { 
               checkout scmGit( 
                   branches: [[name: '*/main']], 
                   userRemoteConfigs: [[url: 'https://gitlab.com/xlab-steampunk/steampunk-spotter-client/playbook-examples.git']] 
               ) 
               sh 'ls -la' 
           } 
       } 
       stage('spotter-scan') { 
           agent { 
               docker { 
                   image 'python:3.11.0-alpine3.16' 
                   reuseNode true 
               } 
           } 
           steps { 
               withCredentials([string(credentialsId: 'SPOTTER_API_TOKEN', variable: 'TOKEN')]) { 
                   sh ''' 
                   python3 -m venv .venv && . .venv/bin/activate && pip install steampunk-spotter 
                   spotter --storage-path . -t $TOKEN scan --junit-xml report.xml . 
                   ''' 
               } 
           } 
       } 
   } 
   post { 
       always { 
           sh "ls -la" 
           junit '**/*.xml' 
       } 
   } 
} 

These steps and configurations will help you integrate Steampunk Spotter into your Jenkins pipeline and effectively run Ansible scans with clear reporting in JUnit format.

The power of early detection

By integrating Spotter with Jenkins, you can take a significant step towards securing your codebase and automating it confidently. Early detection of vulnerabilities and the maintenance of code quality become standard practices in your CI/CD pipeline.

Conclusion: The benefits of Jenkins and Spotter integration

The synergy between Jenkins and Steampunk Spotter is a win-win for your CI/CD pipeline. While Jenkins streamlines the development process, Spotter adds the crucial layer of security and code analysis that ensures your code is delivered quickly and securely.

Key benefits of using Jenkins and Spotter together:

• Early detection of vulnerabilities.
• Code quality maintenance.
• Compliance with industry standards.
• Reduced maintenance costs.
• Enhanced development agility.
• Minimized risk of production outages.
• Improved security.

In summary, integrating Spotter into your CI/CD process can substantially reduce the risk of introducing vulnerabilities into your production environment. By integrating Spotter into your CI/CD pipeline, you’re taking a significant step towards securing your Ansible Playbook code and automating it confidently. We showed you that Jenkins and Spotter make a good pair, but don’t hesitate to integrate Spotter with other CI/CD tools as well.

For more information and to get started with Spotter, visit the Spotter website and join our community on Reddit or Discord.

Interested in Spotter, but don’t know how to start? Explore our Getting started guide.