The Jenkinsfile is your pipeline as code

Your Jenkinsfile lives in the root of your Git repository, versioned alongside your application code. This means: pipeline changes go through PR review, you can blame who broke the pipeline, every branch can have its own pipeline variation, and Jenkins automatically discovers it.

Use Declarative pipeline — it has a strict, validated structure that catches errors before running. Scripted pipeline (pure Groovy) is only needed for complex dynamic logic that Declarative cannot handle. 95% of real-world pipelines should be Declarative.

50 microservices, 50 Jenkinsfiles — all doing the same thing

Without Shared Library: Team A wrote their own Docker build. Team B copied it with variations. Team C invented something different. When you need to add Trivy scanning to all 50 services, you update 50 files manually. Half the teams do it wrong. Takes three days.

With Shared Library: One buildAndPush.groovy function in a central Git repo. All 50 services call it. Update once, all 50 pipelines get the change automatically. No coordination required. This is how senior DevOps engineers solve scale.

The absolute rule: no secrets in code

A Jenkinsfile is in Git. Secrets in Git are in Git history forever — even after deletion. Every team member with repo access can see them. Jenkins Credentials store uses AES-128 encryption. Credentials are injected at runtime and automatically masked in all log output as ****.

For production-grade security: integrate with HashiCorp Vault. Jenkins fetches secrets from Vault at pipeline runtime. When a secret rotates in Vault, all pipelines automatically get the new value on next run — zero manual credential updates in Jenkins.

One Jenkinsfile, automatic pipeline per branch

Multibranch Pipeline discovers all branches in your Git repository and creates a pipeline for each automatically. Feature branches get dev deployment. Main branch triggers staging. Main branch + approval triggers production. When a branch is deleted in Git, its pipeline disappears automatically. Zero manual pipeline management.

Combined with when blocks in your Jenkinsfile: one file, one Jenkinsfile, handles all branches with the appropriate deployment target for each.

Why Kubernetes agents over static agents

Traditional Jenkins: permanent agents sit idle between builds, wasting resources. With Kubernetes agents: each build spins up a fresh pod, runs the build, terminates. Zero idle cost. Each build gets a clean environment. Scale to hundreds of parallel builds automatically.

How it works

Jenkinsfile with Kubernetes agent

pipeline {
  agent {
    kubernetes {
      yaml """
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: maven
    image: maven:3.9-eclipse-temurin-17
    command: [cat]
    tty: true
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "1"
        memory: "1Gi"
  - name: docker
    image: docker:24-dind
    securityContext:
      privileged: true
"""
    }
  }
  stages {
    stage('Build') {
      steps {
        container('maven') {
          sh 'mvn clean package -DskipTests'
        }
      }
    }
    stage('Docker Build') {
      steps {
        container('docker') {
          sh 'docker build -t myapp:${BUILD_NUMBER} .'
        }
      }
    }
  }
}

Key Kubernetes plugin settings

• Jenkins URL — the URL agents use to connect back to the controller
• Namespace — where agent pods are created (typically jenkins)
• Pod retention — Never (always clean) or On Failure (keep for debugging)
• Service Account — needs permissions to create/delete pods in namespace

Jenkins HA options

Backup strategy — what to backup

# JENKINS_HOME critical directories:
$JENKINS_HOME/
├── config.xml              # Main Jenkins config
├── credentials.xml         # All credentials
├── jobs/                   # All job definitions and build history
│   └── my-pipeline/
│       └── config.xml      # Jenkinsfile path, branch config
├── plugins/                # Installed plugins
├── secrets/                # Encryption keys — CRITICAL
│   └── master.key          # Without this, credentials cannot be decrypted
└── users/                  # User accounts

# Backup script (run via cron):
tar -czf jenkins-backup-$(date +%Y%m%d).tar.gz   $JENKINS_HOME/config.xml   $JENKINS_HOME/credentials.xml   $JENKINS_HOME/jobs/   $JENKINS_HOME/secrets/

# Upload to cloud storage
aws s3 cp jenkins-backup-$(date +%Y%m%d).tar.gz s3://my-backups/jenkins/

Jenkins on Kubernetes with persistent storage

apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
spec:
  replicas: 1   # Jenkins controller is NOT horizontally scalable
  template:
    spec:
      containers:
      - name: jenkins
        image: jenkins/jenkins:lts
        volumeMounts:
        - name: jenkins-home
          mountPath: /var/jenkins_home
      volumes:
      - name: jenkins-home
        persistentVolumeClaim:
          claimName: jenkins-pvc   # PVC survives pod restarts

Essential plugins — what they do and why you need them