目錄
- 環(huán)境
- 思路
- 1、NFS（動(dòng)態(tài)存儲(chǔ)）
- 2、helm安裝nfs-client
- 3、創(chuàng)建namespace
- 4、持久化Jenkins數(shù)據(jù)
- 5、創(chuàng)建service account
- 6、安裝Jenkins
- 7、授權(quán)對(duì)Jenkins服務(wù)的訪問權(quán)限
- 8、打開瀏覽器IP:31400/
環(huán)境
生產(chǎn)實(shí)踐-k8s安裝Jenkins和Jenkins Kubernetes插件
環(huán)境要求：你需要一個(gè)正常可以使用的Kubernetes集群，集群中可以使用的內(nèi)存大于等于4G。
Kubernetes版本1.18
思路
Jenkins插件可以在Kubernetes集群中運(yùn)行動(dòng)態(tài)jenkins-slave代理。
基于Kubernetes的docker，自動(dòng)化在Kubernetes中運(yùn)行的Jenkins-slave代理的縮放。
該插件為每個(gè)jenkins-slave代理創(chuàng)建Kubernetes Pod，并在每個(gè)構(gòu)建后停止它。
在Kubernetes中jenkins-slave代理啟動(dòng)，會(huì)自動(dòng)連接到Jenkins主控制器。 對(duì)于某些環(huán)境變量，會(huì)自動(dòng)注入：
Jenkins_URL：Jenkins Web界面URL
jenkins_secret：身份驗(yàn)證的秘密密鑰
jenkins_agent_name：jenkins代理的名稱
jenkins_name：jenkins代理的名稱（已棄用。僅用于向后兼容性）
不需要在Kubernetes內(nèi)運(yùn)行Jenkins Controller。
1、NFS（動(dòng)態(tài)存儲(chǔ)）
#安裝 yum install -y nfs-utils rpcbind mkdir -p /data/nfsdata # 修改配置 $ vim /etc/exports /data/nfsdata 192.168.31.* (rw,async,no_root_squash) # 使配置生效 $ exportfs -r # 服務(wù)端查看下是否生效 $ showmount -e localhost Export list for localhost: /data/nfsdata (everyone)
2、helm安裝nfs-client
stable https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts helm添加這個(gè)源
下載helm包 helm pull aliyuncs/nfs-client-provisioner 解壓 tar -zxvf nfs-client-provisioner-1.2.8.tgz 修復(fù)values.yaml 三處 image: repository: quay.io/external_storage/nfs-client-provisioner tag: v3.1.0-k8s1.11 pullPolicy: IfNotPresent nfs: server: 192.168.31.73 path: /data/nfsdata reclaimPolicy: Retain
3、創(chuàng)建namespace
kubectl create namespace jenkins kubectl get namespaces
4、持久化Jenkins數(shù)據(jù)
pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jenkins-pvc
namespace: jenkins
spec:
storageClassName: "nfsdata"
accessModes:
- ReadWriteMany
resources:
requests:
storage: 10Gi
通過kubectl部署volume
kubectl apply -f pvc.yaml
5、創(chuàng)建service account
創(chuàng)建pod時(shí)，如果不指定服務(wù)賬戶，則會(huì)自動(dòng)為其分配一個(gè)名為default的同一namespace中的服務(wù)賬戶。但是通常應(yīng)用程序時(shí)存在權(quán)限不足的情況，所以需要我們自己創(chuàng)建一個(gè)服務(wù)賬戶。
①下載jenkins-sa.yaml
wget https://raw.githubusercontent.com/jenkins-infra/jenkins.io/master/content/doc/tutorials/kubernetes/installing-jenkins-on-kubernetes/jenkins-sa.yaml
②通過kubectl部署jenkins-sa.yaml
kubectl apply -f jenkins-sa.yaml
或者使用下面的文件
jenkins-sa.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: jenkins
namespace: jenkins
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: jenkins
rules:
- apiGroups:
- '*'
resources:
- statefulsets
- services
- replicationcontrollers
- replicasets
- podtemplates
- podsecuritypolicies
- pods
- pods/log
- pods/exec
- podpreset
- poddisruptionbudget
- persistentvolumes
- persistentvolumeclaims
- jobs
- endpoints
- deployments
- deployments/scale
- daemonsets
- cronjobs
- configmaps
- namespaces
- events
- secrets
verbs:
- create
- get
- watch
- delete
- list
- patch
- update
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- list
- watch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
name: jenkins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: jenkins
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts:jenkins
6、安裝Jenkins
jenkins-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: jenkins
namespace: jenkins
spec:
replicas: 1
selector:
matchLabels:
app: jenkins
template:
metadata:
labels:
app: jenkins
spec:
serviceAccountName: jenkins #指定我們前面創(chuàng)建的服務(wù)賬號(hào)
containers:
- name: jenkins
image: registry.cn-hangzhou.aliyuncs.com/s-ops/jenkins:2.346
ports:
- containerPort: 8080
- containerPort: 50000
volumeMounts:
- name: jenkins-home
mountPath: /var/jenkins_home
volumes:
- name: jenkins-home
persistentVolumeClaim:
claimName: jenkins-pvc #指定前面創(chuàng)建的PVC
通過kubectl部署jenkins-deployment.yaml
kubectl create -f jenkins-deployment.yaml -n jenkins
7、授權(quán)對(duì)Jenkins服務(wù)的訪問權(quán)限
主要目的暴露外部訪問Jenkins的8080端口，我將31400定義為8080的映射端口。
jenkins-service.yaml
apiVersion: v1
kind: Service
metadata:
name: jenkins
namespace: jenkins
spec:
type: NodePort
ports:
- name: http
port: 8080
targetPort: 8080
nodePort: 31400
- name: agent
port: 50000
targetPort: 50000
nodePort: 31401
selector:
app: jenkins
通過kubectl部署服務(wù)
kubectl create -f jenkins-service.yaml -n jenkins
8、打開瀏覽器IP:31400/
查看密碼
kubectl get pod -n jenkins //查詢podname kubectl logs podname -n jenkins ************************************************************* Jenkins initial setup is required. An admin user has been created and a password generated. Please use the following password to proceed to installation: cf8d9da9de0346fd90461be366915d76 This may also be found at: /var/jenkins_home/secrets/initialAdminPassword *************************************************************
選擇推薦插件安裝，創(chuàng)建管理員~完成！
