Opening the lab note…
A lab pipeline for the Spring PetClinic microservices. Jenkins, scans, Nexus, ECR, and Argo CD on Kubernetes.
12 Sep 2026 · Not a shipped product
This is a lab. I am still building it. It is not a platform I run for anyone else.
I wanted one path I could explain from a git commit to a running set of Spring Boot services. The sample is PetClinic, split the way the microservices sample is split. The question was not "can I deploy it once." The question was whether the pipeline would refuse a bad image, and whether the cluster would follow git.
Git is the source of truth. Scans happen before the image is trusted.
01
Git
The Spring PetClinic microservices, plus the manifests that say what should be running.
02
Jenkins
Build and test, then the checks I want in the way of a bad image.
03
Nexus and the image
The artifact and the SBOM land together. Docker builds the image and pushes it to AWS ECR.
04
Argo CD
The cluster is supposed to match git. A floating tag hides that, so the tag has to be real.
05
Kubernetes
The workloads run from the image Argo CD asked for. If they do not, the diff is the bug.
Jenkins builds and tests the services. SonarQube looks at the code. Trivy scans the image. An SBOM is produced next to the build and stored in Nexus with the artifact, which is the part I kept getting wrong (see below). Docker builds the image, pushes it to AWS ECR, and the tag in git is what Argo CD is supposed to roll out onto Kubernetes.
The manifests live in git. If the cluster and git disagree, that disagreement is the bug I want to see.
latest made Argo CD look healthy while I had no idea which bits were running. A tag that never changes does not give git anything to review. I pin a real tag now, and I treat a floating tag as an unfinished pipeline.
Trivy failed the build on a base image CVE. That was the scanner doing its job, and it stayed red until I pinned the base image and made the fail threshold explicit. A red build with no written rule is just noise.
The SBOM was generated and then left in the workspace. A week later I could not find it next to the artifact in Nexus. Generating a file is not the same as keeping it.
SonarQube on a sample app that nobody owns produced a quality gate full of old issues. I scoped the gate to new code so the pipeline could tell me about the change I just made.
Pin the image. Store the SBOM with the artifact. Make the scan threshold a decision, not a surprise. A green pipeline that does not change the cluster is not a deploy.