┌─────────────────────────────────────────────────────────────────────┐
│ CI/CD Pipeline Architecture │
├─────────────────────────────────────────────────────────────────────┤
│ Developer → Git Repository → Jenkins Pipeline → Container Registry │
│ ↓ ↓ ↓ │
│ Code Quality Automated Testing Security Scan │
│ ↓ ↓ ↓ │
│ Build Validation Integration Tests Compliance │
│ ↓ ↓ ↓ │
│ Artifact Creation Performance Tests Image Storage │
│ ↓ │
│ ┌─────────────────────────┴─────────────────────────┐ │
│ │ Deployment Orchestration │ │
│ │ Dev → Staging → Production → Partner Validation │ │
│ └─────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘

pipeline {
 agent any  environment {
 // Global environment variables
 DOCKER_REGISTRY = 'registry.internal..com'
 PROJECT_NAME = 'wireless-apn-dns'
 BUILD_VERSION = "${env.BUILD_NUMBER}-${env.GIT_COMMIT.substring(0,8)}"
 COREDNS_VERSION = '1.11.3'
 }  parameters {
 choice(
 name: 'DEPLOYMENT_ENV',
 choices: ['dev', 'staging', 'production'],
 description: 'Target deployment environment'
 )
 booleanParam(
 name: 'SKIP_TESTS',
 defaultValue: false,
 description: 'Skip automated testing (emergency deployments only)'
 )
 }  stages {
 stage('Source Code Analysis') {
 parallel {
 stage('Code Quality') {
 steps {
 script {
 // SonarQube analysis
 sh 'sonarqube-scanner'
 }
 }
 }
 stage('Security Scan') {
 steps {
 script {
 // Dependency vulnerability scanning
 sh 'trivy fs --security-checks vuln .'
 }
 }
 }
 stage('Configuration Validation') {
 steps {
 script {
 // Validate Docker and configuration files
 sh 'hadolint Dockerfile'
 sh 'yamllint configs/'
 }
 }
 }
 }
 }  stage('Build and Test') {
 steps {
 script {
 // Multi-architecture Docker build
 sh """
 docker buildx create --use --name mybuilder
 docker buildx build \
 --platform linux/amd64,linux/arm64 \
 --build-arg VERSION=${COREDNS_VERSION} \
 --tag ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION} \
 --tag ${DOCKER_REGISTRY}/${PROJECT_NAME}:latest \
 --push .
 """
 }
 }
 }  stage('Automated Testing') {
 when {
 not { params.SKIP_TESTS }
 }
 parallel {
 stage('Unit Tests') {
 steps {
 script {
 // Container functionality tests
 sh 'docker run --rm ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION} /test/unit-tests.sh'
 }
 }
 }
 stage('Integration Tests') {
 steps {
 script {
 // Network integration testing
 sh 'docker-compose -f test/integration/docker-compose.yml up --abort-on-container-exit'
 }
 }
 }
 stage('Performance Tests') {
 steps {
 script {
 // DNS query performance validation
 sh 'docker run --rm ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION} /test/performance-tests.sh'
 }
 }
 }
 }
 }  stage('Security and Compliance') {
 parallel {
 stage('Container Security Scan') {
 steps {
 script {
 // Container image security scanning
 sh 'trivy image ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION}'
 }
 }
 }
 stage('Compliance Check') {
 steps {
 script {
 // Regulatory compliance validation
 sh 'docker run --rm -v $(pwd):/workspace compliance-scanner:latest /workspace'
 }
 }
 }
 }
 }  stage('Deployment') {
 steps {
 script {
 deployToEnvironment(params.DEPLOYMENT_ENV)
 }
 }
 }  stage('Post-Deployment Validation') {
 steps {
 script {
 validateDeployment(params.DEPLOYMENT_ENV)
 }
 }
 }
 }  post {
 always {
 // Cleanup and notifications
 cleanWs()
 }
 success {
 // Success notifications
 slackSend channel: '#deployments',
 color: 'good',
 message: "✅ Deployment successful: ${PROJECT_NAME}:${BUILD_VERSION} to ${params.DEPLOYMENT_ENV}"
 }
 failure {
 // Failure notifications and rollback
 slackSend channel: '#deployments',
 color: 'danger',
 message: "❌ Deployment failed: ${PROJECT_NAME}:${BUILD_VERSION} to ${params.DEPLOYMENT_ENV}"
 script {
 if (params.DEPLOYMENT_ENV != 'dev') {
 rollbackDeployment(params.DEPLOYMENT_ENV)
 }
 }
 }
 }
}

def deployToEnvironment(environment) {
 echo "Deploying to ${environment} environment"  // Environment-specific configuration injection
 def configFile = "configs/${environment}/deployment.yml"  // Kubernetes/Docker Compose deployment
 sh """
 envsubst < ${configFile} | kubectl apply -f -
 kubectl rollout status deployment/${PROJECT_NAME} -n ${environment}
 """  // Wait for service readiness
 sh """
 kubectl wait --for=condition=available --timeout=300s deployment/${PROJECT_NAME} -n ${environment}
 """
} def validateDeployment(environment) {
 echo "Validating deployment in ${environment}"  // Health check validation
 sh """
 curl -f http://${PROJECT_NAME}-service.${environment}.svc.cluster.local:8080/health || exit 1
 """  // DNS functionality validation
 sh """
 dig @${PROJECT_NAME}-service.${environment}.svc.cluster.local google.com || exit 1
 """  // BGP session validation (if applicable)
 if (environment == 'production') {
 sh """
 docker exec \$(docker ps -q -f name=${PROJECT_NAME}) vtysh -c "show ip bgp summary"
 """
 }
} def rollbackDeployment(environment) {
 echo "Rolling back deployment in ${environment}"  // Get previous successful deployment
 def previousVersion = sh(
 script: "kubectl rollout history deployment/${PROJECT_NAME} -n ${environment} | tail -2 | head -1 | awk '{print \$1}'",
 returnStdout: true
 ).trim()  // Perform rollback
 sh "kubectl rollout undo deployment/${PROJECT_NAME} -n ${environment} --to-revision=${previousVersion}"  // Wait for rollback completion
 sh "kubectl rollout status deployment/${PROJECT_NAME} -n ${environment}"
}

Container Registry Architecture:
├── Production Registry (registry.internal..com)
│ ├── Image Scanning (Trivy + Clair)
│ ├── Vulnerability Database Updates
│ ├── Access Control (RBAC)
│ └── Retention Policies
│
├── Staging Registry (staging-registry.internal..com)
│ ├── Development Images
│ ├── Feature Branch Testing
│ └── Integration Testing
│
└── Development Registry (dev-registry.internal..com)
 ├── Local Development
 ├── Prototype Testing
 └── Experimental Features

# Multi-stage build for optimization
FROM registry.internal..com/infra/cr-frr:frr-stable-jammy AS base
ARG VERSION="1.11.3"
ENV COREDNS_VERSION=${VERSION} # Build stage
FROM base AS build
RUN apt-get update && \
 curl -L https://github.com/coredns/coredns/releases/download/v$COREDNS_VERSION/coredns_${VERSION}_linux_amd64.tgz -o coredns.tgz && \
 tar xf coredns.tgz && \
 rm coredns.tgz # Production stage
FROM base AS prod
COPY --from=build /coredns /usr/local/bin/
COPY configs /
EXPOSE 11915/tcp 53 53/udp
CMD ["/init"]

Image Tagging Conventions:
├── Semantic Versioning: v1.2.3
├── Build Metadata: v1.2.3-build.123-abc1234
├── Environment Tags: v1.2.3-staging, v1.2.3-production
├── Feature Branches: feature-bgp-optimization-abc1234
└── Latest Tags: latest-dev, latest-staging, latest-prod

Testing Strategy:
├── Unit Tests (70%)
│ ├── Configuration validation
│ ├── Service startup tests
│ └── Health check validation
│
├── Integration Tests (20%)
│ ├── BGP session establishment
│ ├── DNS resolution testing
│ ├── Container orchestration
│ └── Network connectivity
│
└── End-to-End Tests (10%)
 ├── Partner connectivity
 ├── Load testing
 ├── Failover scenarios
 └── Performance benchmarks

#!/bin/bash
# integration-tests.sh set -e echo "Starting integration test suite..." # Test 1: Container startup and health
echo "Testing container startup..."
docker run -d --name test-dns \
 -e SERVER_HOSTNAME=test..com \
 -e SITE_ASN=65001 \
 -e SIGNALLING_ROUTER_IP=192.168.1.1 \
 -e EXTERNAL_SIGNALLING_IP=203.0.113.1 \
 -e _ROUTER_IP=10.0.0.1 \
 ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION} # Wait for service readiness
sleep 30 # Test 2: DNS resolution functionality
echo "Testing DNS resolution..."
docker exec test-dns nslookup google.com 127.0.0.1 || exit 1 # Test 3: Metrics endpoint
echo "Testing metrics endpoint..."
docker exec test-dns curl -f http://localhost:11915/metrics || exit 1 # Test 4: BGP configuration validation
echo "Testing BGP configuration..."
docker exec test-dns vtysh -c "show running-config" | grep "router bgp" || exit 1 # Test 5: Network connectivity
echo "Testing network connectivity..."
docker exec test-dns ping -c 3 ${_ROUTER_IP} || exit 1 # Cleanup
docker stop test-dns && docker rm test-dns echo "All integration tests passed!"

# performance-test.yml
version: '3.8'
services:
 dns-service:
 image: ${DOCKER_REGISTRY}/${PROJECT_NAME}:${BUILD_VERSION}
 environment:
 - SERVER_HOSTNAME=perf-test..com
 - SITE_ASN=65001
 networks:
 - test-network  load-generator:
 image: registry.internal..com/tools/dns-load-tester:latest
 depends_on:
 - dns-service
 environment:
 - TARGET_HOST=dns-service
 - QPS_TARGET=10000
 - TEST_DURATION=300s
 networks:
 - test-network  metrics-collector:
 image: prom/prometheus:latest
 networks:
 - test-network networks:
 test-network:
 driver: bridge

# Environment-specific configurations
environments:
 development:
 replicas: 1
 resources:
 cpu: "0.5"
 memory: "512Mi"
 external_ip: "203.0.113.100"
 monitoring: basic  staging:
 replicas: 2
 resources:
 cpu: "1.0"
 memory: "1Gi"
 external_ip: "203.0.113.101"
 monitoring: full
 load_testing: enabled  production:
 replicas: 3
 resources:
 cpu: "2.0"
 memory: "2Gi"
 external_ip: "203.0.113.102"
 monitoring: full
 alerting: critical
 backup: enabled
 partner_validation: required

# Blue-Green deployment configuration
deployment_strategy:
 type: blue_green  blue_environment:
 version: current_production
 traffic_percentage: 100
 health_check: /health  green_environment:
 version: new_candidate
 traffic_percentage: 0
 health_check: /health  promotion_criteria:
 - health_checks_passing: true
 - error_rate: < 0.1%
 - response_time_p99: < 100ms
 - manual_approval: required (production only)  rollback_triggers:
 - error_rate: > 1%
 - response_time_p99: > 500ms
 - health_check_failures: > 3

Pipeline Metrics:
├── Build Metrics
│ ├── Build success rate: 98.5%
│ ├── Average build time: 8 minutes
│ ├── Test execution time: 12 minutes
│ └── Deployment time: 5 minutes
│
├── Quality Metrics
│ ├── Code coverage: 85%
│ ├── Security scan pass rate: 100%
│ ├── Performance test pass rate: 95%
│ └── Compliance check pass rate: 100%
│
└── Deployment Metrics
 ├── Deployment frequency: 15/week
 ├── Lead time: 2 hours (commit to production)
 ├── MTTR: 15 minutes
 └── Change failure rate: 2%

# Alerting rules for pipeline failures
alerting_rules:
 - name: "Pipeline Build Failure"
 condition: "build_status == 'failed'"
 severity: "high"
 channels: ["slack", "pagerduty"]  - name: "Security Scan Failure"
 condition: "security_scan_vulnerabilities > 0"
 severity: "critical"
 channels: ["slack", "security-team"]  - name: "Deployment Failure"
 condition: "deployment_status == 'failed'"
 severity: "critical"
 channels: ["slack", "pagerduty", "ops-team"]  - name: "Long Build Time"
 condition: "build_duration > 15_minutes"
 severity: "warning"
 channels: ["slack"]

Security Scanning Stages:
├── Static Code Analysis
│ ├── SonarQube: Code quality and security
│ ├── Bandit: Python security issues
│ └── ESLint: JavaScript security patterns
│
├── Dependency Scanning
│ ├── OWASP Dependency Check
│ ├── Snyk: Known vulnerabilities
│ └── Retirement.js: Outdated dependencies
│
├── Container Scanning
│ ├── Trivy: Comprehensive vulnerability scanning
│ ├── Clair: Static vulnerability analysis
│ └── Docker Bench: Security best practices
│
└── Compliance Validation
 ├── CIS Benchmarks
 ├── NIST Framework alignment
 └── Industry-specific requirements

# Secrets management strategy
secrets_management:
 vault_integration:
 server: "vault.internal..com"
 authentication: "kubernetes"  secret_rotation:
 frequency: "30 days"
 automated: true
 notification: required  access_control:
 principle: "least privilege"
 audit_logging: enabled
 approval_workflow: required

Quality Improvements:
├── Code Quality
│ ├── Technical debt reduction: 60%
│ ├── Code coverage increase: 40% → 85%
│ ├── Security vulnerability reduction: 90%
│ └── Configuration consistency: 100%
│
├── Operational Excellence
│ ├── Mean Time to Recovery: 4 hours → 15 minutes
│ ├── Change Failure Rate: 15% → 2%
│ ├── Availability improvement: 99.9% → 99.99%
│ └── Operational overhead reduction: 70%
│
└── Business Impact
 ├── Feature delivery speed: 300% increase
 ├── Customer issue resolution: 80% faster
 ├── Partner onboarding time: 75% reduction
 └── Infrastructure costs: 30% reduction

Problem: Environment configuration drift
Solution: 
 - Centralized configuration management
 - Environment-specific validation
 - Infrastructure as code principles

Problem: "Works on my machine" syndrome
Solution:
 - Containerized test environments
 - Standardized test data sets
 - Environment parity validation

Problem: Complex multi-service deployments
Solution:
 - Service dependency mapping
 - Orchestrated deployment workflows
 - Automated rollback procedures