Jenkins-slave

Jenkins插件

chinese
Role-based Authorization Strategy  用户权限
Credentials Binding  凭证管理
git
Deploy to container
Maven Integration
Pipeline
Groovy Postbuild
GitLab
Gitlab Hook
Email Extension
SonarQube Scanner
Publish Over SSH
NodeJS

Extended Choice Parameter
Git Parameter
Kubernetes
Kubernetes Continuous Deploy
thinbackup

---

开启代理程序的TCP端口

新建节点

slave节点创建目录

mkdir /root/jenkins

在命令行中启动节点

java -jar agent.jar -jnlpUrl http://192.168.66.101:8888/computer/slave1/slave-agent.jnlp -secret 57478f5900889d386e86f7336394f590d134a2ac4b4f4204e8faf3e332f8b4b6 -workDir "/root/jenkins"

测试节点是否可用

node('slave1') {
  stage('check out') {
    checkout([$class: 'GitSCM', branches: [[name: '*/master']],doGenerateSubmoduleConfigurations: false, extensions: [], submoduleCfg: [],userRemoteConfigs: [[credentialsId: '7fd05954-bb3c-416e-8cad-9eafd681ec35', url: '[email protected]:wuxing_group/tensquare_back.git']]])
  }
}

安装和配置NFS

NFS服务器安装在192.168.66.101机器上

安装(k8s节点都安装)

yum install -y nfs-utils
mkdir -p /opt/nfs/jenkins

配置

cat /etc/exports
/opt/nfs/jenkins *(rw,no_root_squash)

启动

systemctl start nfs
systemctl enable nfs

查看共享目录

showmount -e 192.168.66.101

在Kubernetes安装Jenkins-Master

构建nfs-client-provisioner的pod资源

rbac.yaml

kind: ServiceAccount
apiVersion: v1
metadata:
  name: nfs-client-provisioner
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-client-provisioner-runner
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: run-nfs-client-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    namespace: default
roleRef:
  kind: ClusterRole
  name: nfs-client-provisioner-runner
  apiGroup: rbac.authorization.k8s.io
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
subjects:
  - kind: ServiceAccount
    name: nfs-client-provisioner
    # replace with namespace where provisioner is deployed
    namespace: default
roleRef:
  kind: Role
  name: leader-locking-nfs-client-provisioner
  apiGroup: rbac.authorization.k8s.io

class.yaml

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: managed-nfs-storage
provisioner: fuseim.pri/ifs # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
  archiveOnDelete: "true"

deployment.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: nfs-client-provisioner
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nfs-client-provisioner
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: nfs-client-provisioner
  template:
    metadata:
      labels:
        app: nfs-client-provisioner
    spec:
      serviceAccountName: nfs-client-provisioner
      containers:
        - name: nfs-client-provisioner
          image: lizhenliang/nfs-client-provisioner:latest
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: fuseim.pri/ifs
            - name: NFS_SERVER
              value: 192.168.66.101 
            - name: NFS_PATH
              value: /opt/nfs/jenkins/
      volumes:
        - name: nfs-client-root
          nfs:
            server: 192.168.66.101
            path: /opt/nfs/jenkins/

cd nfs-client
kubectl create -f .

构建Jenkins-Master的pod资源

ServiceaAcount.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: kube-ops

rbac.yaml

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkins
  namespace: kube-ops
rules:
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments"]
    verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create","delete","get","list","patch","update","watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get","list","watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkins
  namespace: kube-ops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
  - kind: ServiceAccount
    name: jenkins
    namespace: kube-ops
    
---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkinsClusterRole
  namespace: kube-ops
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
 
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: jenkinsClusterRuleBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkinsClusterRole
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: kube-ops

StatefulSet.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: jenkins
  labels:
    name: jenkins
  namespace: kube-ops
spec:
  serviceName: jenkins
  selector:
    matchLabels:
      app: jenkins
  replicas: 1
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      name: jenkins
      labels:
        app: jenkins
    spec:
      terminationGracePeriodSeconds: 10
      serviceAccountName: jenkins
      containers:
        - name: jenkins
          image: jenkins/jenkins:lts-alpine
          imagePullPolicy: IfNotPresent
          ports:
          - containerPort: 8080
            name: web
            protocol: TCP
          - containerPort: 50000
            name: agent
            protocol: TCP
#          resources:
#            limits:
#              cpu: 1
#              memory: 1Gi
#            requests:
#              cpu: 0.5
#              memory: 500Mi
          env:
            - name: LIMITS_MEMORY
              valueFrom:
                resourceFieldRef:
                  resource: limits.memory
                  divisor: 1Mi
            - name: JAVA_OPTS
              value: -Xmx$(LIMITS_MEMORY)m -XshowSettings:vm -Dhudson.slaves.NodeProvisioner.initialDelay=0 -Dhudson.slaves.NodeProvisioner.MARGIN=50 -Dhudson.slaves.NodeProvisioner.MARGIN0=0.85
          volumeMounts:
            - name: jenkins-home
              mountPath: /var/jenkins_home
#          livenessProbe:
#            httpGet:
#              path: /login
#              port: 8080
#            initialDelaySeconds: 60
#            timeoutSeconds: 5
#            failureThreshold: 12
#          readinessProbe:
#            httpGet:
#              path: /login
#              port: 8080
#            initialDelaySeconds: 60
#            timeoutSeconds: 5
#            failureThreshold: 12
      securityContext:
        fsGroup: 1000
  volumeClaimTemplates:
  - metadata:
      name: jenkins-home
    spec:
      storageClassName: "managed-nfs-storage"
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi

Service.yaml

apiVersion: v1
kind: Service
metadata:
  name: jenkins
  namespace: kube-ops
  labels:
    app: jenkins
spec:
  selector:
    app: jenkins
  type: NodePort
  ports:
  - name: web
    port: 8080
    targetPort: web
  - name: agent
    port: 50000
    targetPort: agent

kubectl create namespace kube-ops

cd jenkins-master
kubectl create -f .

jenkins-master安装插件

插件相关设置
vim hudson.model.UpdateCenter.xml

<sites>
  <site>
    <id>defaultid>
    <url>https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.jsonurl>
  site>
sites>

cd jenkins家目录/updates
sed -i 's/http:\/\/updates.jenkinsci.org\/download/https:\/\/mirrors.tuna.tsinghua.edu.cn\/jenkins/g' default.json && sed -i 's/http:\/\/www.google.com/https:\/\/www.baidu.com/g' default.json

---

插件
Localization:Chinese
Git
Pipeline
Extended Choice Parameter

---

Jenkins与Kubernetes整合

安装Kubernetes插件

kubernetes地址采用了kube的服务器发现：https://kubernetes.default.svc.cluster.local

Jenkins URL 地址：http://jenkins.kube-ops.svc.cluster.local:8080

http://service名称.名称空间.svc.cluster.local:service端口

构建Jenkins-Slave自定义镜像

Dockerfile

FROM jenkins/jnlp-slave:latest

MAINTAINER wuxing

# 切换到 root 账户进行操作
USER root

# 安装 maven
COPY apache-maven-3.6.2-bin.tar.gz .

RUN tar -zxf apache-maven-3.6.2-bin.tar.gz && \
    mv apache-maven-3.6.2 /usr/local && \
    rm -f apache-maven-3.6.2-bin.tar.gz && \
    ln -s /usr/local/apache-maven-3.6.2/bin/mvn /usr/bin/mvn && \
    ln -s /usr/local/apache-maven-3.6.2 /usr/local/apache-maven && \
    mkdir -p /usr/local/apache-maven/repo

COPY settings.xml /usr/local/apache-maven/conf/settings.xml

USER jenkins

settings.xml

...
  <localRepository>/usr/local/apache-maven/repolocalRepository>
...
    <mirror>
      <id>centralid>
      <mirrorOf>centralmirrorOf>
      <name>aliyun mavenname>
      <url>https://maven.aliyun.com/repository/publicurl>
    mirror>
...

vim Dockerfile

FROM registry.cn-hangzhou.aliyuncs.com/wuxingge/jenkins-slave-maven-centos7:v1
USER root
COPY settings.xml /opt/rh/rh-maven33/root/etc/maven/settings.xml
USER 1001

docker build -t jenkins-slave-maven:latest .
docker tag jenkins-slave-maven:latest 192.168.66.102:85/library/jenkins-slave-maven:latest
docker login -u admin -p Harbor12345 192.168.66.102:85
docker push 192.168.66.102:85/library/jenkins-slave-maven:latest

测试Jenkins-Slave创建

创建一个Jenkins流水线项目

def git_address = "http://192.168.66.100:82/wuxing_group/tensquare_back.git"
def git_auth = "ebe06142-096b-4648-ac79-db5d224b3554"
//创建一个Pod的模板，label为jenkins-slave
podTemplate(label: 'jenkins-slave', cloud: 'kubernetes', containers: [
  containerTemplate(
    name: 'jnlp',
    image: "192.168.66.102:85/library/jenkins-slave-maven:latest"
  )
 ]
)
{
  //引用jenkins-slave的pod模块来构建Jenkins-Slave的pod
  node("jenkins-slave"){
    // 第一步
    stage('拉取代码'){
      checkout([$class: 'GitSCM', branches: [[name: 'master']], userRemoteConfigs: [[credentialsId: "${git_auth}", url: "${git_address}"]]])
    }
  }
}