<p>I am new to DevOps and have the below scenario to handle.</p>
<p>Environment:-</p>
<p>Host is running on MacOS.
A Kubernete cluster running on Minikube was installed on this MacOS. This Minikube cluster has 2 environments(namespaces) - Development and Production.
Each namespace will have a MySQL database deployed.</p>
<p>The Docker host service is also running on the MacOS host.  Helm and kubectl clients are installed on the MacOS host.</p>
<p>Jenkins will be used for building the CI and CD process and was setup in a pod within the jenkins namespace on the Minikube.</p>
<p>Objective:-
I need to build a CICD pipeline which consist of a NodeJS application that will be embedded in a docker image. This docker image will be deployed as a pod.  It will connect to a database in the development environment to  retrieve a text string from a MySQL database which will be displayed in the web browser. Upon successful testing, the image will be deployed to the Production namspace.</p>
<p>Pipeline workflow:-</p>
<ol>
<li><p>Jenkins will retrieve the code for the NodeJS application from GitHub.  </p>
</li>
<li><p>Jenkins will build the Docker image by creating a container inside a pod in the jenkins namespace with the NodeJS application embedded via a DockerFile. </p>
</li>
<li><p>The image will be pushed to a repository (eg, DockerHub).</p>
</li>
<li><p>Jenkins will then pull the image from DockerHub and deploy to the development environment(dev namespace)  using Helm.</p>
</li>
<li><p>A series of test will then be conducted.</p>
</li>
<li><p>Once successful, the same image will then be deployed to the(production namespace) using Helm.</p>
</li>
</ol>
<p>I got the below pipeline up till step 3 working and was stucked at step 4.</p>
<pre><code>pipeline {
  agent any
  
  environment {
        DOCKERHUB_CREDENTIALS = credentials('DOCKERHUB_LOGIN')
  }
  
  tools {nodejs &quot;nodejs&quot;}

  parameters {
    gitParameter branchFilter: 'origin/(.*)', defaultValue: 'main', name: 'BRANCH', type: 'PT_BRANCH'
  }
  
  stages {
    stage('Clone Code Repository') {
      steps {
        git branch: &quot;${params.BRANCH}&quot;, url: 'https://github.com/dkelim1/nodejs-app.git'
      }
    }
    
    stage('Install NPM application') {
      steps {
        sh 'npm install'
      }
    }
    
    
    stage('Download docker binary') {
        steps{
            script {
                    def dockerHome = tool 'docker'
                    env.PATH = &quot;${dockerHome}/bin:${env.PATH}&quot;           
            }
        }
    }    
    

    stage('Docker Build and Tag') {
        steps {
            script {
                docker.withServer('tcp://192.168.59.102:2376', 'DOCKERHOST_CRED'){
                sh 'docker build -t dkelim1/nodejs-app .' 
                }
            }
        }
    }
    
    stage('DockerHub Login') {
        steps {
            script {
                docker.withServer('tcp://192.168.59.102:2376', 'DOCKERHOST_CRED'){
                sh 'echo $DOCKERHUB_CREDENTIALS_PSW | docker login -u $DOCKERHUB_CREDENTIALS_USR --password-stdin'     
                }
            }    
        }
    }

    stage('Push Image to DockerHub') {
        steps {
            script {
                docker.withServer('tcp://192.168.59.102:2376', 'DOCKERHOST_CRED'){
                sh 'docker push dkelim1/nodejs-app:latest' 
                }
            }    
        }
    }


    stage('Logout from DockerHub') {
        steps {
            script {
                docker.withServer('tcp://192.168.59.102:2376', 'DOCKERHOST_CRED'){
                sh 'docker logout' 
                }
            }    
        }
    }
    
  }    
}
</code></pre>
<p>I am trying to achieve the below but did not know how.  Would appreciate if anyone can advise how do I achieve it.</p>
<ol>
<li><p>How to trigger helm from within the pipeline to perform the deployments? Googled around and watched a couple of DevOps videos but none seems to be answering to my needs.</p>
</li>
<li><p>For step number 2, instead of building the docker image as a pod in the jenkins namespace, how can I build it as a pod in the dev namespace instead?</p>
</li>
</ol>
<p>I goggled and tried the proposed solution within the below link but it did not help.</p>
<p><a href="https://stackoverflow.com/questions/66399589/run-helm-in-jenkins-pipeline">Run helm in jenkins pipeline</a></p>
<pre><code>    name: &quot;workspace-volume&quot;

Running on testpipeline-1-0xk9b-90pm8-31qgv in /home/jenkins/agent/workspace/testpipeline
[Pipeline] {
[Pipeline] container
[Pipeline] {
[Pipeline] container
[Pipeline] {
[Pipeline] sh
+ helm list -A
Error: list: failed to list: secrets is forbidden: User &quot;system:serviceaccount:jenkins:default&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; at the cluster scope
[Pipeline] }
[Pipeline] // container
[Pipeline] }
[Pipeline] // container
[Pipeline] }
[Pipeline] // node
[Pipeline] }
[Pipeline] // podTemplate
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 1
Finished: FAILURE
</code></pre>

Ldd
<p>To fix the immediate error, which is a permission error, you will need to grant permission to the <code>jenkins</code> user to read secrets (fair warning, this can be a security issue if your Jenkins is not locked down). Manifests like the below will set up a role with those permissions and grant it to Jenkins (you might need to change the <code>subjects</code> list to match your installation).</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: jenkins-read-secrets-role
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: jenkins-read-secrets-binding
subjects:
- kind: User
  name: jenkins
- kind: ServiceAccount
  name: default
  namespace: jenkins
- kind: ServiceAccount
  name: jenkins
  namespace: jenkins
roleRef:
 kind: ClusterRole
 name: jenkins-read-secrets-role
 apiGroup: rbac.authorization.k8s.io

</code></pre>
<p>As for the target namespace, Helm can deploy into any given namespace, but you may need additional permissions set up to permit your Jenkins user to do so.</p>
