Architecture

devops-lib is a Jenkins Shared Library that implements the entire CI/CD pipeline for all Meesho microservices. Consumer services load it via @Library('devops-lib@main') and delegate their full build–deploy–notify lifecycle to it through a single eksCICD(repo) call.

TL;DR

One entry point (vars/eksCICD.groovy) routes to GCP (pod-based) or AWS (EKS node) infra via CLOUD_PROVIDER.
A sequential flow: checkout → config parse → build stage → ArgoCD deploy → Ringmaster/Turbo-Turtle notify.
Language-specific build logic lives in src/com/meesho/stages/build*.groovy; infra and policy env vars in src/com/meesho/utilities/constructParam.groovy.
All deployments go through ArgoCD; no kubectl apply ever runs directly.
Secrets and whitelists are injected at runtime — never hard-coded.

Mental model

Think of eksCICD as a dispatcher: it doesn't contain any build or deploy logic itself. It (1) authenticates the triggering user, (2) selects the right infrastructure pod or node, and (3) hands off to commonCICDFlow, which assembles and runs the actual pipeline stages in sequence.

Each stage is a separate Groovy class with a run(Map config) method. constructParam.run() populates env.* variables (registry URL, vault endpoint, ArgoCD credentials, etc.) so every downstream stage can read a consistent environment without reconfiguring itself.

Structure / data flow

Consumer Jenkinsfile
  └─ @Library('devops-lib@main') → eksCICD(repo)
        │
        ├─ [auth guard] allowedUsers check
        │
        ├─ CLOUD_PROVIDER=GCP → gcpInfra() → podTemplate(INFRA_ENV-pod.yaml) → node(POD_LABEL)
        │   └─ container('devops-tools') → commonCICDFlow(repo)
        │
        └─ CLOUD_PROVIDER=AWS → awsInfra() → node('EKS') → commonCICDFlow(repo)
                                      │
                                      ▼
              commonCICDFlow(repo)
                ├─ checkOut.run(repo)               ← clone service + submodules
                ├─ getYamlParameter.getParam()       ← parse config.yaml
                ├─ buildObjHelper.run(build_tool)    ← dispatch to language builder
                ├─ constructParam.run(param)         ← resolve env.* vars
                ├─ hotFix.run(repo_name)             ← skip tests/sonar on hotfix/*
                └─ buildObj.run(param)               ← build + deploy + notify
                        │
                        ├─ build (Maven/Go/Node/…)
                        ├─ deployArgoCD.run()
                        └─ notify.run() → deployRingmaster.run()

Key code locations

Symbol	File	What it does
`call`	`vars/eksCICD.groovy:call`	Top-level entry — auth guard + infra routing
`gcpInfra`	`vars/eksCICD.groovy:gcpInfra`	Loads pod YAML from `resources/org/meesho/` and wraps in `podTemplate`
`awsInfra`	`vars/eksCICD.groovy:awsInfra`	Runs on static EKS node labelled `EKS`
`commonCICDFlow`	`vars/eksCICD.groovy:commonCICDFlow`	Orchestrates the full stage sequence
`run`	`src/com/meesho/stages/buildObjHelper.groovy:run`	Dispatches to language builder by `build_tool`
`run`	`src/com/meesho/utilities/constructParam.groovy:run`	Sets all `env.*` vars for build + deploy
`run`	`src/com/meesho/stages/deployArgoCD.groovy:run`	4-step ArgoCD deploy per deployable
`run`	`src/com/meesho/stages/notify.groovy:run`	Slack + Ringmaster/Turbo-Turtle callback

Sharp edges

Authorization is strict: only ringmaster-bot, turbo-turtle, and the allowedUsers list can trigger builds. Builds not in this list are rejected immediately with a message directing to Ringmaster.
env.* mutation is CPS-bound: constructParam.run() sets env.* in a CPS method. Any utility that needs @NonCPS cannot read from env.* inside the annotation — use method parameters instead.
GCP vs AWS env diverge: constructParam.run() has two separate accountDetails maps for GCP and AWS. Registry URL, bucket name, and ArgoCD cluster coordinates differ between clouds.
useSidecar flag: services that need a sidecar container can pass useSidecar: true in the repo Map. This switches the pod template from INFRA_ENV-pod.yaml to INFRA_ENV-sidecar-pod.yaml.

Build dispatch — how buildObjHelper matches build_tool strings
Environment mapping — branch/PR → cicd_environment table
Config policy — constructParam env resolution + whitelist gates
Deploy ArgoCD — 4-step deploy sequence
Infra pods — GCP pod spec selection
ADR index — the "why" behind devops-lib's core design decisions
Security overview — trust boundaries and credential handling

Notes

← Previous · Index · Next →

5.3 KiB Raw Blame History Unescape Escape