Open source libraries and frameworks play a crucial role in the DevOps environment that emphasizes the shorter development lifecycles, collaboration, and innovation. It’s important not to neglect the security of these open source components. Here we will talk about five things that one must consider concerning the safety of an open source project.

•  Security Automation

A significant driving force for DevOps is to automate as much as possible. DevOps automation emphasizes using technologies like virtual machines and containerization to repackage applications into reusable blocks, many of which consist of open source code.

Also, because of this automation and at the pace at which the updates occur, security teams are left behind quickly. Information Security teams need to find out ways of automating several of the most critical security procedures. Greater automation into security checks implies that it is less likely that DevOps practices will release software that contains vulnerable open source components.

•  Open Source Tools

Open source codes form the majority of the footprint of modern proprietary codebases and focus on the libraries and frameworks first.  Moreover, open source tools provide an excellent way to improve open source security in DevOps.

•  Incorporation of Open Source Code-Checking Tools Into Development

Shifting security to the left means that developers need to overcome the inherent tendency to focus on application functionality without considering safety. For this, the developers can integrate some open source code-checking tools into development environments.

•  Hackers Target- Open Source

One of the disadvantages with increased use of Open Source is that the malicious actors are aware of the components that contain vulnerabilities and they can use this knowledge to target companies developing software. Hackers are always in search of organizations that have become lax in their security checks; therefore it is advisable for the organizations to keep a regular check.

•  Policy and Governance

For DevOps and open source to work collaboratively, there is an urgent need to develop dedicated open source policies by DevOps organizations. When these developers are given free space to use open source libraries and frameworks without monitoring or documentation, the chances are high that vulnerabilities creep into the applications.

Hence it is evident that the open source model offers benefits to DevOps teams concerning achieving their goals. As security is of prime importance, many source tools are helping to enhance the safety of the applications developed in DevOps.

This article explains how to implement CI/CD in Kubernetes using two complementary tools: Fabric8 and Jenkins. Another tool sometimes used for this purpose is Gulp, but it is out of scope here.

Why CI/CD and Kubernetes Are a Natural Fit

CI/CD requires environments that can be provisioned and torn down on demand for every code change. Kubernetes provides exactly that: declarative workload definitions, fast container scheduling, and namespace-level isolation make it straightforward to spin up ephemeral build, test, and staging environments without manual intervention.

The main challenges developers face when adopting CI/CD on Kubernetes are the number of microservices to orchestrate and the pace of change in the container ecosystem. Purpose-built platforms such as Fabric8 and Jenkins with the Kubernetes plugin reduce this complexity.

Fabric8: An Open-Source CI/CD Platform for Kubernetes

Fabric8 is an open-source developer platform designed to run on top of Kubernetes, OpenShift, and Google Container Engine. It provides an integrated environment for building, testing, and deploying microservices and manages the full CD pipeline lifecycle.

Key Fabric8 Features

• Web-based developer console — create, edit, deploy, and test microservices from a browser.
• Centralised management tooling — aggregated logging, metrics collection, and Java container management.
• Integration and API support — Apache Camel integration, RESTful and SOAP API visualisation and management.
• Java developer tools — Maven plugins and Java libraries that expose Kubernetes APIs in a developer-friendly way.
• CD pipeline management — tooling to define, run, and monitor continuous delivery pipelines.

Setting Up a Local Cluster with gofabric8

The gofabric8 CLI tool bootstraps a Fabric8 environment on top of a local Kubernetes cluster (via Minikube). On Linux, the KVM hypervisor driver is required before starting.

Step 1 — Install the KVM Driver

# Download the KVM driver binary
sudo curl -L https://github.com/dhiltgen/docker-machine-kvm/releases/download/v0.7.0/docker-machine-driver-kvm \
  -o /usr/local/bin/docker-machine-driver-kvm

# Make it executable
sudo chmod +x /usr/local/bin/docker-machine-driver-kvm

# Install required KVM packages (Debian/Ubuntu)
sudo apt install libvirt-bin qemu-kvm

Step 2 — Install gofabric8

curl -sS https://get.fabric8.io/download.txt | bash

After installation, add the gofabric8 binary to your PATH by appending the export line to ~/.bashrc (or ~/.bash_profile), then reload the file:

export PATH=$PATH:$HOME/.fabric8/bin
source ~/.bashrc

Step 3 — Start the Local Cluster

gofabric8 start

This command downloads any required tooling and starts a single-node Kubernetes cluster locally. Once the cluster is running, open the Fabric8 browser console with:

gofabric8 console

Deploying a Fabric8 Cluster in the Cloud with Stackpoint

For production or shared development environments, running the cluster in a public cloud is more practical. Stackpoint.io (now part of NetApp Kubernetes Service) provides a managed Kubernetes provisioning service that supports Amazon Web Services, Google Cloud Platform, and Microsoft Azure.

Provisioning a GCE-Backed Cluster

1. Log in to your Stackpoint account and select Add Cluster.
2. Choose Google Compute Engine as the provider.
3. In the GCE console (console.cloud.google.com), create a new project, then navigate to APIs & Services → Credentials → Service Account Key to generate a JSON key file.
4. Paste the JSON key into the credentials field on Stackpoint and click Create.
5. Provide a cluster name and any required customisations, then click Submit.
6. Wait for the cluster build to complete (status will update in the Stackpoint dashboard).

Connecting kubectl to the New Cluster

Download the kubeconfig file from Stackpoint, then configure kubectl to use it:

export KUBECONFIG=~/Downloads/kubeconfig
kubectl config use-context stackpoint

Verify the cluster nodes are visible:

kubectl get nodes

Implementing CI/CD with Jenkins on Kubernetes

Jenkins remains one of the most widely used CI/CD servers. A community-maintained Docker image (csanchez/jenkins-kubernetes) packages Jenkins together with the Kubernetes plugin, making it straightforward to run Jenkins inside Docker and connect it to a Kubernetes cluster.

Step 1 — Pull the Image and Create a Data Container

# Pull the Jenkins Kubernetes image
sudo docker pull csanchez/jenkins-kubernetes

# Create a named container to hold Jenkins data
sudo docker create --name jenkins-k8s csanchez/jenkins-kubernetes

Step 2 — Run Jenkins Using the Data Container

sudo docker run \
  --volumes-from jenkins-k8s \
  -p 8080:8080 \
  -p 50000:50000 \
  -v /var/jenkins_home \
  csanchez/jenkins-kubernetes

Port 8080 exposes the Jenkins web UI; port 50000 is used by Jenkins agents (JNLP). Jenkins data is persisted in the jenkins-k8s container volume, so it survives container restarts.

Step 3 — Initial Jenkins Configuration

1. Navigate to http://localhost:8080 in your browser.
2. Log in as admin using the initial password printed in the container startup log.
3. Choose to install the recommended plugins or select plugins manually. Allow the installation to complete.
4. Create your first admin user by providing a username, password, and email address.

Step 4 — Configure the Kubernetes Plugin

The Kubernetes plugin enables Jenkins to dynamically provision build agents as Kubernetes pods, freeing you from maintaining static build servers.

1. In Jenkins, go to Manage Jenkins → Configure System.
2. Scroll to the Cloud section and click Add a new cloud → Kubernetes.
3. Fill in the Kubernetes API URL, namespace, and credentials appropriate for your environment.
4. Click Test Connection to verify Jenkins can reach the cluster, then click Save.

When you need Jenkins agents, a JNLP slave image is available on Docker Hub. The Kubernetes plugin will spin up a pod using this image on demand and tear it down once the build completes.

Choosing Between Fabric8 and Jenkins

Fabric8 and Jenkins are complementary rather than competing tools. Fabric8 provides an opinionated, integrated platform with a browser console and pre-built CD pipeline support, making it a good fit for teams that want a complete out-of-the-box experience on Kubernetes. Jenkins offers maximum flexibility through its plugin ecosystem and is appropriate when you need fine-grained control over pipeline logic or need to integrate with existing infrastructure.

In practice, many teams run Jenkins inside a Fabric8 environment, using Fabric8’s developer console for visibility and lifecycle management while Jenkins drives the actual build and test execution.

Summary

• Kubernetes’ container lifecycle features align well with the ephemeral environment requirements of CI/CD pipelines.
• Fabric8 provides a complete open-source platform for managing microservice CI/CD on Kubernetes, OpenShift, and GKE.
• gofabric8 bootstraps a local Fabric8 cluster with a single command; cloud clusters can be provisioned via Stackpoint.
• Jenkins with the Kubernetes plugin enables dynamic, pod-based build agents and integrates with existing Jenkins pipelines.
• The two tools are complementary and are often used together in the same environment.