helm repo add jenkins https://charts.jenkins.io
helm repo update
helm install jenkins jenkins/jenkins \
  --namespace jenkins --create-namespace \
  --values values.yaml

Step 3: Write a Declarative Jenkinsfile

The Jenkinsfile lives in the repo it builds. Below is a working pipeline that builds a Java service, runs tests, builds a Docker image, scans it, and pushes to a registry.

pipeline {
  agent {
    kubernetes {
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: maven
            image: maven:3.9-eclipse-temurin-21
            command: ['sleep']
            args: ['99d']
          - name: docker
            image: docker:24-dind
            securityContext: { privileged: true }
      '''
    }
  }
  options { timeout(time: 30, unit: 'MINUTES') }
  stages {
    stage('Build') {
      steps { container('maven') { sh 'mvn -B package -DskipTests' } }
    }
    stage('Test') {
      steps { container('maven') { sh 'mvn -B test' } }
      post  { always { junit 'target/surefire-reports/*.xml' } }
    }
    stage('Image') {
      steps {
        container('docker') {
          sh 'docker build -t registry.example.com/api:${GIT_COMMIT} .'
          sh 'trivy image --severity HIGH,CRITICAL registry.example.com/api:${GIT_COMMIT}'
        }
      }
    }
    stage('Publish') {
      when { branch 'main' }
      steps {
        withCredentials([usernamePassword(credentialsId: 'registry',           usernameVariable: 'U', passwordVariable: 'P')]) {
          container('docker') {
            sh 'docker login -u $U -p $P registry.example.com'
            sh 'docker push registry.example.com/api:${GIT_COMMIT}'
          }
        }
      }
    }
  }
}

Step 4: Wire Up Secrets and Credentials

Never put credentials in the Jenkinsfile. Use the Credentials plugin (built-in) to store registry passwords, deploy keys, and cloud-provider tokens, and reference them with withCredentials blocks. For production we strongly recommend pairing this with HashiCorp Vault — the hashicorp-vault-plugin lets Jenkins fetch short-lived dynamic secrets per build instead of holding long-lived credentials in the controller.

Step 5: Add the Deploy Stage (GitOps Recommended)

The traditional Jenkins approach is to deploy directly: install kubectl in the agent and run kubectl apply. We recommend against this. Instead, use the Opsio's argocd gitops handoff pattern: Jenkins commits an updated image tag to a separate config repo, ArgoCD watches that repo and reconciles the cluster. This keeps Kubernetes credentials out of Jenkins entirely.

stage('Update Manifests') {
  when { branch 'main' }
  steps {
    withCredentials([sshUserPrivateKey(credentialsId: 'config-repo-key',       keyFileVariable: 'KEY')]) {
      sh '''
        git clone git@github.com:acme/k8s-config.git
        cd k8s-config
        yq eval -i '.image.tag = "${GIT_COMMIT}"' apps/api/values.yaml
        git -c user.email=ci@acme.com -c user.name=ci commit -am "api: ${GIT_COMMIT}"
        git push
      '''
    }
  }
}

Step 6: Make It Production-Grade

A pipeline that works on a sunny day is not a production pipeline. Add the following before declaring victory:

• Build retention — keep last 50 builds and last 7 days, prune older. Disk fills fast otherwise.
• Pipeline tests — Jenkinsfile syntax tested with jenkins-pipeline-unit in CI.
• Webhook health — monitor PR-trigger latency. Stale webhooks kill developer trust.
• Backup — JCasC config in Git plus daily backup of $JENKINS_HOME to S3.
• Upgrade cadence — Jenkins LTS upgrades quarterly, plugin upgrades monthly with regression testing.

How Opsio Helps

Opsio runs Jenkins as a managed platform for customers in financial services, healthcare, and industrial automation — sectors where on-prem isolation and auditability matter more than SaaS convenience. Our jenkins automation services service covers controller upgrades, plugin curation, JCasC config, agent topology, and the GitOps handoff to ArgoCD. We also handle the managed pipeline services redesign for customers who want to stay on Jenkins but adopt modern delivery patterns.