War Story: We Switched From Jenkins 2.440 to GitLab CI 16.10 and Cut Deploy Time by 50%

// Jenkins 2.440 Pipeline for User Auth Microservice (Node.js 20.x)
// Requires Jenkins Kubernetes Plugin 1.33+, Blue Ocean 1.27+, Credentials Plugin 2.6+
pipeline {
    agent {
        kubernetes {
            // Custom pod template for build/ test/ deploy stages
            yaml '''
            apiVersion: v1
            kind: Pod
            spec:
              containers:
              - name: node
                image: node:20.11.1-alpine
                command: ["cat"]
                tty: true
                resources:
                  requests:
                    cpu: 500m
                    memory: 1Gi
                  limits:
                    cpu: 1
                    memory: 2Gi
              - name: kubectl
                image: bitnami/kubectl:1.29.3
                command: ["cat"]
                tty: true
              - name: docker
                image: docker:24.0.7-dind
                privileged: true
                command: ["cat"]
                tty: true
            '''
            // Retry pod provisioning 3 times on failure
            retries: 3
            // Timeout waiting for pod to start after 5 minutes
            podRetention: always()
        }
    }
    environment {
        // Stored in Jenkins Credentials Manager as "docker-hub-creds"
        DOCKER_CREDS = credentials('docker-hub-creds')
        // GitLab registry URL for container pushes
        CONTAINER_REGISTRY = "registry.gitlab.com/our-org/user-auth-service"
        // Kubernetes namespace for production deploys
        PROD_NAMESPACE = "prod-user-auth"
    }
    stages {
        stage('Install Dependencies') {
            steps {
                container('node') {
                    sh 'npm ci --cache .npm --prefer-offline'
                }
            }
            // Retry dependency install once on network failure
            post {
                failure {
                    echo "Dependency install failed, retrying once..."
                    sh 'npm ci --cache .npm --prefer-offline'
                }
            }
        }
        stage('Run Unit Tests') {
            steps {
                container('node') {
                    sh 'npm run test:unit -- --coverage'
                }
            }
            post {
                always {
                    // Publish JUnit test results to Jenkins
                    junit 'test-results/unit/*.xml'
                    // Publish coverage to Cobertura plugin
                    cobertura coberturaReportFile: 'coverage/cobertura-coverage.xml'
                }
            }
        }
        stage('Build Docker Image') {
            steps {
                container('docker') {
                    sh "docker login -u $DOCKER_CREDS_USR -p $DOCKER_CREDS_PSW $CONTAINER_REGISTRY"
                    sh "docker build -t $CONTAINER_REGISTRY:$BUILD_TAG -t $CONTAINER_REGISTRY:latest ."
                    sh "docker push $CONTAINER_REGISTRY:$BUILD_TAG"
                    sh "docker push $CONTAINER_REGISTRY:latest"
                }
            }
            post {
                failure {
                    echo "Docker build/push failed for tag $BUILD_TAG"
                    sh "docker logout $CONTAINER_REGISTRY"
                }
            }
        }
        stage('Deploy to Production') {
            when {
                branch 'main'
            }
            steps {
                container('kubectl') {
                    sh "kubectl config use-context prod-eks-cluster"
                    sh "kubectl set image deployment/user-auth-app user-auth-container=$CONTAINER_REGISTRY:$BUILD_TAG -n $PROD_NAMESPACE"
                    sh "kubectl rollout status deployment/user-auth-app -n $PROD_NAMESPACE --timeout=300s"
                }
            }
            post {
                failure {
                    echo "Production deploy failed for $BUILD_TAG, initiating rollback..."
                    sh "kubectl rollout undo deployment/user-auth-app -n $PROD_NAMESPACE"
                    sh "kubectl rollout status deployment/user-auth-app -n $PROD_NAMESPACE --timeout=300s"
                }
            }
        }
    }
    post {
        always {
            // Clean up workspace to avoid disk bloat on Jenkins agents
            cleanWs()
        }
        failure {
            // Send Slack alert on pipeline failure
            slackSend(color: 'danger', message: "Jenkins pipeline failed for $BUILD_TAG: ${env.BUILD_URL}")
        }
        success {
            slackSend(color: 'good', message: "Jenkins pipeline succeeded for $BUILD_TAG: ${env.BUILD_URL}")
        }
    }
}

# GitLab CI 16.10 Pipeline for User Auth Microservice (Node.js 20.x)
# Native Kubernetes integration: no plugins required
# Uses GitLab-managed runners with Docker and kubectl pre-installed

# Global variables available to all stages
variables:
  # Node.js version for build/test stages
  NODE_VERSION: "20.11.1-alpine"
  # Container registry path (GitLab native registry, no external config)
  CONTAINER_REGISTRY: "$CI_REGISTRY/our-org/user-auth-service"
  # Kubernetes namespace for production deploys
  PROD_NAMESPACE: "prod-user-auth"
  # Docker image tag: uses GitLab CI commit SHA by default
  IMAGE_TAG: "$CI_COMMIT_SHA"

# Reusable templates to reduce boilerplate
.node_template: &node_template
  image: node:$NODE_VERSION
  before_script:
    - npm ci --cache .npm --prefer-offline
  cache:
    paths:
      - .npm/
      - node_modules/
    key: $CI_COMMIT_REF_SLUG

# Stages in execution order
stages:
  - test
  - build
  - deploy

# Unit test stage
unit_tests:
  stage: test
  <<: *node_template
  script:
    - npm run test:unit -- --coverage
  artifacts:
    paths:
      - test-results/unit/*.xml
      - coverage/
    expire_in: 1 day
  # Retry flaky tests once
  retry:
    max: 1
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
  # Timeout test stage after 10 minutes
  timeout: 10m
  # Only run on main branch and merge requests
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_PIPELINE_SOURCE == "merge_request_event"

# Docker build and push stage
build_image:
  stage: build
  image: docker:24.0.7
  services:
    - docker:24.0.7-dind
  before_script:
    # Login to GitLab container registry using CI job token (no external creds)
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build -t $CONTAINER_REGISTRY:$IMAGE_TAG -t $CONTAINER_REGISTRY:latest .
    - docker push $CONTAINER_REGISTRY:$IMAGE_TAG
    - docker push $CONTAINER_REGISTRY:latest
  after_script:
    - docker logout $CI_REGISTRY
  # Only run on main branch
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  # Timeout build stage after 15 minutes
  timeout: 15m
  # Retry build once on registry failure
  retry:
    max: 1
    when: runner_system_failure

# Production deploy stage
deploy_prod:
  stage: deploy
  image: bitnami/kubectl:1.29.3
  before_script:
    # Configure kubectl with GitLab-managed Kubernetes cluster (linked in GitLab UI)
    - kubectl config use-context our-org/infra:prod-eks-cluster
  script:
    - kubectl set image deployment/user-auth-app user-auth-container=$CONTAINER_REGISTRY:$IMAGE_TAG -n $PROD_NAMESPACE
    - kubectl rollout status deployment/user-auth-app -n $PROD_NAMESPACE --timeout=300s
  # Rollback on failure
  after_script:
    - if [ $CI_JOB_STATUS == "failed" ]; then kubectl rollout undo deployment/user-auth-app -n $PROD_NAMESPACE; fi
  # Only run on main branch
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  # Timeout deploy stage after 5 minutes
  timeout: 5m
  # Require manual approval for production deploys (GitLab native feature)
  when: manual
  environment:
    name: production
    url: https://auth.our-org.com

# Global pipeline failure notification
workflow:
  rules:
    - if: $CI_COMMIT_BRANCH == "main" || $CI_PIPELINE_SOURCE == "merge_request_event"
  # Send Slack alert on pipeline failure using GitLab Slack integration
  after_script:
    - if [ $CI_PIPELINE_STATUS == "failed" ]; then curl -X POST -H 'Content-type: application/json' --data "{\"text\":\"GitLab pipeline failed for $IMAGE_TAG: $CI_PIPELINE_URL\"}" $SLACK_WEBHOOK_URL; fi

#!/usr/bin/env python3
"""
Jenkins to GitLab CI Migration Script v1.0
Parses Jenkins 2.440 Jenkinsfile (pipeline block) and generates GitLab CI 16.10 .gitlab-ci.yml template
Includes error handling for unsupported Jenkins plugins, missing stages, and invalid syntax
"""

import re
import sys
import yaml
from typing import Dict, List, Optional

class JenkinsfileParser:
    def __init__(self, jenkinsfile_path: str):
        self.jenkinsfile_path = jenkinsfile_path
        self.content = ""
        self.stages: List[Dict] = []
        self.variables: Dict[str, str] = {}
        self.errors: List[str] = []

    def load_jenkinsfile(self) -> bool:
        """Load and read Jenkinsfile content, handle file not found errors"""
        try:
            with open(self.jenkinsfile_path, 'r') as f:
                self.content = f.read()
            return True
        except FileNotFoundError:
            self.errors.append(f"Error: Jenkinsfile not found at {self.jenkinsfile_path}")
            return False
        except PermissionError:
            self.errors.append(f"Error: No permission to read {self.jenkinsfile_path}")
            return False
        except Exception as e:
            self.errors.append(f"Unexpected error reading Jenkinsfile: {str(e)}")
            return False

    def parse_stages(self) -> None:
        """Extract stages from Jenkins pipeline block using regex (simplified for demo)"""
        # Match stage blocks: stage('Stage Name') { ... }
        stage_pattern = r"stage\('([^']+)'\)\s*\{"  
        stage_matches = re.finditer(stage_pattern, self.content)

        for match in stage_matches:
            stage_name = match.group(1)
            # Extract steps inside the stage (simplified, skips nested blocks)
            start_idx = match.end()
            brace_count = 1
            end_idx = start_idx

            while brace_count > 0 and end_idx < len(self.content):
                if self.content[end_idx] == '{':
                    brace_count +=1
                elif self.content[end_idx] == '}':
                    brace_count -=1
                end_idx +=1

            stage_content = self.content[start_idx:end_idx-1]
            self.stages.append({
                "name": stage_name,
                "content": stage_content,
                "steps": self._extract_steps(stage_content)
            })

    def _extract_steps(self, stage_content: str) -> List[str]:
        """Extract shell steps from stage content (looks for sh '...' or sh \"...\")"""
        step_pattern = r'sh\s+[\'\"]([^\'"]+)[\'\"]'  
        return re.findall(step_pattern, stage_content)

    def parse_variables(self) -> None:
        """Extract environment variables from Jenkins pipeline environment block"""
        env_pattern = r"environment\s*\{"  
        env_match = re.search(env_pattern, self.content)
        if not env_match:
            return

        start_idx = env_match.end()
        brace_count = 1
        end_idx = start_idx

        while brace_count >0 and end_idx < len(self.content):
            if self.content[end_idx] == '{':
                brace_count +=1
            elif self.content[end_idx] == '}':
                brace_count -=1
            end_idx +=1

        env_block = self.content[start_idx:end_idx-1]
        # Match variable assignments: VAR_NAME = "value" or VAR_NAME = 'value'
        var_pattern = r'(\w+)\s*=\s*[\'\"]([^\'"]+)[\'\"]'  
        for var_match in re.finditer(var_pattern, env_block):
            self.variables[var_match.group(1)] = var_match.group(2)

    def generate_gitlab_ci(self) -> Optional[str]:
        """Generate GitLab CI 16.10 .gitlab-ci.yml template from parsed Jenkins config"""
        if not self.stages:
            self.errors.append("No stages found in Jenkinsfile")
            return None

        gitlab_ci = {
            "variables": {
                "CONTAINER_REGISTRY": "$CI_REGISTRY/our-org/migrated-service",
                "IMAGE_TAG": "$CI_COMMIT_SHA"
            },
            "stages": []
        }

        # Add stages in order
        for stage in self.stages:
            stage_name = stage["name"].lower().replace(" ", "_")
            if stage_name not in gitlab_ci["stages"]:
                gitlab_ci["stages"].append(stage_name)

        # Add job for each stage
        for stage in self.stages:
            stage_name = stage["name"].lower().replace(" ", "_")
            job = {
                "stage": stage_name,
                "script": []
            }

            # Add steps from Jenkins stage
            for step in stage["steps"]:
                job["script"].append(step)

            # Add error handling for deploy stages
            if "deploy" in stage_name.lower():
                job["after_script"] = [
                    "if [ $CI_JOB_STATUS == 'failed' ]; then kubectl rollout undo deployment/app -n prod; fi"
                ]
                job["when"] = "manual"
                job["environment"] = {
                    "name": "production",
                    "url": "https://app.our-org.com"
                }

            gitlab_ci[stage_name] = job

        # Add global error notification
        gitlab_ci["workflow"] = {
            "after_script": [
                "if [ $CI_PIPELINE_STATUS == 'failed' ]; then echo 'Pipeline failed'; fi"
            ]
        }

        try:
            return yaml.dump(gitlab_ci, sort_keys=False)
        except Exception as e:
            self.errors.append(f"Error generating YAML: {str(e)}")
            return None

def main():
    if len(sys.argv) != 2:
        print("Usage: python migrate_jenkins_to_gitlab.py ")
        sys.exit(1)

    jenkinsfile_path = sys.argv[1]
    parser = JenkinsfileParser(jenkinsfile_path)

    if not parser.load_jenkinsfile():
        for error in parser.errors:
            print(error)
        sys.exit(1)

    parser.parse_variables()
    parser.parse_stages()

    gitlab_ci_yaml = parser.generate_gitlab_ci()
    if gitlab_ci_yaml:
        print(gitlab_ci_yaml)
    else:
        for error in parser.errors:
            print(error)
        sys.exit(1)

if __name__ == "__main__":
    main()

# GitLab Runner config.toml snippet for Kubernetes runner
[[runners]]
  name = "eks-gitlab-runner"
  url = "https://gitlab.our-org.com"
  token = "glrt-xxxxxxxxxxxxxxxxxxxx"
  executor = "kubernetes"
  [runners.kubernetes]
    host = ""
    bearer_token_overwrite_allowed = false
    image = "alpine:latest"
    namespace = "gitlab-runners"
    namespace_overwrite_allowed = false
    privileged = false
    service_account = "gitlab-runner"
    service_account_overwrite_allowed = false
    pod_annotations_overwrite_allowed = false
    [runners.kubernetes.resources]
      limits = { cpu = "1", memory = "2Gi" }
      requests = { cpu = "500m", memory = "1Gi" }

# GitLab CI job for Trivy container scanning (replaces Jenkins Anchore plugin)
container_scan:
  stage: test
  image: aquasec/trivy:0.50.1
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CONTAINER_REGISTRY:$IMAGE_TAG
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  allow_failure: false

# Run migration script and validate output
python migrate_jenkins_to_gitlab.py Jenkinsfile > .gitlab-ci.yml
# Lint generated GitLab CI config via GitLab API
curl --request POST \
  --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"content": "'"$(cat .gitlab-ci.yml | jq -Rs .)"'"}' \
  https://gitlab.our-org.com/api/v4/ci/lint