kubernetes部署Jenkins

部署 nfs

centos
yum install nfs-utils

ubuntu
apt install -y nfs-kernel-server

编辑配置文件/etc/exports 来配置我们的 NFS 服务的访问和同步策略

ro 只读
rw 可读写
sync 同步写数据，保证数据不丢失
async 异步写数据，在写入持久化存储之前进行请求响应，如果服务器重启可能会导致文件丢失或者损坏
root_squash 将 root 用户（uid/gid 0）的请求映射为匿名用户（anonymous uid/gid）
no_root_squash 禁用 root_squash 规则
all_squash 将所有用户都映射为匿名用户
no_all_squash 禁用 all_squash 规则，默认选项
anonuid 指定要映射为匿名用户的 uid，例如：anonuid=150
anongid 指定要映射为匿名用户的 gid，例如：anongid=100

创建共享目录

mkdir /data/nfs

/data/nfs *(rw,sync,no_subtree_check)

重新共享目录

exportfs -r

安装 NFS CSI driver

git clone https://gitee.com/xyenvy/study-notes.git
cd kubernetes/jenkins_deploy/csi-nfs
kubectl apply -f .

check pods status:

kubectl -n kube-system get pod -o wide -l app=csi-nfs-controller
kubectl -n kube-system get pod -o wide -l app=csi-nfs-node

创建 StorageClass

---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-csi
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: nfs.csi.k8s.io
parameters:
  server: # nfs服务器IP
  share: /data/nfs/ # nfs服务共享目录
reclaimPolicy: Retain
volumeBindingMode: Immediate

创建 namespace

---
apiVersion: v1
kind: Namespace
metadata:
  name: jenkins

创建 PVC

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-pvc
  namespace: jenkins
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Gi
  storageClassName: nfs-csi

创建 rbac

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-master
  namespace: jenkins

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jenkins-master
rules:
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments"]
    verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins-master
roleRef:
  kind: ClusterRole
  name: jenkins-master
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: jenkins-master
    namespace: jenkins

创建 deployment

---
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      serviceAccountName: jenkins-master
      volumes:
        - name: jenkins-store
          persistentVolumeClaim:
            claimName: jenkins-pvc
      containers:
        - name: jenkins
          image: jenkins/jenkins:jdk17
          volumeMounts:
            - name: jenkins-store
              mountPath: /var/jenkins_home/
          imagePullPolicy: IfNotPresent
          env:
            - name: JAVA_OPTS
              value: -XshowSettings:vm -Dhudson.slaves.NodeProvisioner.initialDelay=0 -Dhudson.slaves.NodeProvisioner.MARGIN=50 -Dhudson.slaves.NodeProvisioner.MARGIN0=0.85 -Duser.timezone=Asia/Shanghai -Djenkins.install.runSetupWizard=true
          ports:
            - containerPort: 8080
              name: web
              protocol: TCP
            - containerPort: 50000
              name: agent
              protocol: TCP
          resources:
            requests:
              cpu: "2"
              memory: 4G
            limits:
              cpu: "2"
              memory: 4G

创建 service

---
apiVersion: v1
kind: Service
metadata:
  name: jenkins
  namespace: jenkins
  labels:
    app: jenkins
spec:
  selector:
    app: jenkins
  type: ClusterIP
  ports:
    - name: http
      port: 8080
      targetPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: jenkins-jnlp
  namespace: jenkins
  labels:
    app: jenkins
spec:
  selector:
    app: jenkins
  ports:
    - name: agent
      port: 50000
      targetPort: 50000
---
apiVersion: v1
kind: Service
metadata:
  name: jenkins-node
  namespace: jenkins
  labels:
    app: jenkins
spec:
  selector:
    app: jenkins
  type: NodePort
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      nodePort: 31080

创建 ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins
  namespace: jenkins
spec:
  ingressClassName: nginx
  rules:
    - host: cicd.example.com
      http:
        paths:
          - backend:
              service:
                name: jenkins
                port:
                  number: 8080
            path: /
            pathType: Prefix
    - host: jnlp.example.com
      http:
        paths:
          - backend:
              service:
                name: jenkins
                port:
                  number: 8080
            path: /
            pathType: Prefix

以下内容需要使用 istio 服务网格才需创建

创建 gateway

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: example-com-gateway
  namespace: jenkins
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - cicd.example.com
      port:
        name: http
        number: 80
        protocol: HTTP

创建 VirtualService

使用 istio 服务网格

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: jenkins-www
  namespace: jenkins
spec:
  hosts:
    - "cicd-example.com"
  gateways:
    - example-com-gateway
  http:
    - match:
        - uri:
            prefix: /
      # rewrite:
      #   uri: /
      route:
        - destination:
            host: jenkins
            port:
              number: 8080

初始化

nodeip:31080

查找登录密码

cat /var/jenkins_home/secrets/initialAdminPassword

安装中文插件

修改密码

修改插件下载地址

default.json 为插件源地址配置将国外官方地址替换为国内阿里 jenkins 插件地址阿里下载地址

https://mirrors.aliyun.com/jenkins/plugins/

sed -i.bak 's#updates.jenkins.io/download#mirrors.aliyun.com/jenkins#g' default.json

sed -i 's#www.google.com#www.baidu.com#g' default.json

修改升级站点 url

https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/update-center.json
https://mirrors.aliyun.com/jenkins/updates/update-center.json
https://jenkins-zh.gitee.io/update-center-mirror/tsinghua/update-center.json

重启 jenkins 即可