Conductor Server 3.x Production deployment Strategy

[shekarpcs]

How is Netflix Conductor Server is deployed in Dev to Prod.

Do we need to build Source code locally and push generated Jar file? Or get Springboot Jar file file from Repo and build it locally and use that?

1. Just trying to understand how each one of you are using the Springboot jar file.

[aravindanr]

Most users seem to do their own build, since they have extensions. But its also possible and safe to use the Springboot jar directly.

[shekarpcs]

Thanks for the reply.

How is vulnerability is tested when we use Jar directly?

We are planning to use directly springboot jar from maven repo but we are trying find way to get the jar through vulnerability in our pipelines. Just trying to find out what is the best way to build and deploy.

if we go in build path, should we clone the code to local repo? and use jenkins to build it, scan vulnerability and deploy?

[aravindanr]

There are no vulnerability checks currently for the build path. So if that's a concern, building it on your own is the right thing to do.

For building, the repo can be cloned and the instructions are here, https://github.com/Netflix/conductor#production-build