15、jenkins

k8s手撕yml方式部署最新版 Jenkins 2.441（jdk-21版）（jenkins-prod）

mkdir -p ~/jenkins-prod-ymlkubectl create ns jenkins-prod

kubectl label node k8s-node1 jenkins-prod=jenkins-prod

cat > ~/jenkins-prod-yml/Jenkins-prod-rbac.yml << 'EOF'
apiVersion: v1
kind: Namespace
metadata:name: jenkins-prod
---
apiVersion: v1
kind: ServiceAccount
metadata:name: jenkins-prodnamespace: jenkins-prod
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:annotations:rbac.authorization.kubernetes.io/autoupdate: "true"labels:kubernetes.io/bootstrapping: rbac-defaultsname: jenkins-prod
rules:
- apiGroups:- '*'resources:- statefulsets- services- replicationcontrollers- replicasets- podtemplates- podsecuritypolicies- pods- pods/log- pods/exec- podpreset- poddisruptionbudget- persistentvolumes- persistentvolumeclaims- jobs- endpoints- deployments- deployments/scale- daemonsets- cronjobs- configmaps- namespaces- events- secretsverbs:- create- get- watch- delete- list- patch- update
- apiGroups:- ""resources:- nodesverbs:- get- list- watch- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:annotations:rbac.authorization.kubernetes.io/autoupdate: "true"labels:kubernetes.io/bootstrapping: rbac-defaultsname: jenkins-prod
roleRef:apiGroup: rbac.authorization.k8s.iokind: ClusterRolename: jenkins-prod
subjects:
- apiGroup: rbac.authorization.k8s.iokind: Groupname: system:serviceaccounts:jenkins-prod
EOF

kubectl apply -f ~/jenkins-prod-yml/Jenkins-prod-rbac.yml

cat > ~/jenkins-prod-yml/Jenkins-prod-Service.yml << 'EOF'
apiVersion: v1
kind: Service
metadata:name: jenkins-prodnamespace: jenkins-prodlabels:app: jenkins-prod
spec:selector:app: jenkins-prodtype: NodePortports:- name: webnodePort: 30456port: 8080targetPort: web- name: agentnodePort: 30789port: 50000targetPort: agent
EOF

kubectl apply -f ~/jenkins-prod-yml/Jenkins-prod-Service.yml

cat > ~/jenkins-prod-yml/Jenkins-prod-Deployment.yml << 'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:name: jenkins-prodnamespace: jenkins-prodlabels:app: jenkins-prod
spec:replicas: 1selector:matchLabels:app: jenkins-prodtemplate:metadata:labels:app: jenkins-prodspec:tolerations:- effect: NoSchedulekey: no-podoperator: ExistsnodeSelector:jenkins-prod: jenkins-prodcontainers:- name: jenkins-prod#image: jenkins/jenkins:2.441-jdk21image: ccr.ccs.tencentyun.com/huanghuanhui/jenkins:2.441-jdk21imagePullPolicy: IfNotPresentresources:limits:cpu: "2"memory: "4Gi"requests:cpu: "1"memory: "2Gi"securityContext:runAsUser: 0ports:- containerPort: 8080name: webprotocol: TCP- containerPort: 50000name: agentprotocol: TCPenv:- name: LIMITS_MEMORYvalueFrom:resourceFieldRef:resource: limits.memorydivisor: 1Mi- name: JAVA_OPTSvalue: -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=truevolumeMounts:- name: jenkins-home-prodmountPath: /var/jenkins_home- mountPath: /etc/localtimename: localtimevolumes:- name: jenkins-home-prodpersistentVolumeClaim:claimName: jenkins-home-prod- name: localtimehostPath:path: /etc/localtime---
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:name: jenkins-home-prodnamespace: jenkins-prod
spec:storageClassName: "nfs-storage"accessModes: [ReadWriteOnce]resources:requests:storage: 2Ti
EOF

kubectl apply -f ~/jenkins-prod-yml/Jenkins-prod-Deployment.yml

cat > ~/jenkins-prod-yml/Jenkins-prod-Ingress.yml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:name: jenkins-prod-ingressnamespace: jenkins-prodannotations:nginx.ingress.kubernetes.io/ssl-redirect: 'true'nginx.ingress.kubernetes.io/proxy-body-size: '4G'
spec:ingressClassName: nginxrules:- host: jenkins-prod.huanghuanhui.cloudhttp:paths:- path: /pathType: Prefixbackend:service:name: jenkins-prod # 将所有请求发送到 jenkins-prod 服务的 8080 端口port:number: 8080tls:- hosts:- jenkins-prod.huanghuanhui.cloudsecretName: jenkins-prod-ingress-tls
EOF

kubectl create secret -n jenkins-prod \
tls jenkins-prod-ingress-tls \
--key=/root/ssl/huanghuanhui.cloud.key \
--cert=/root/ssl/huanghuanhui.cloud.crt

kubectl apply -f ~/jenkins-prod-yml/Jenkins-prod-Ingress.yml

访问地址：jenkins-prod.huanghuanhui.cloud

设置账号密码为：admin、Admin@2024

# 插件
1、Localization: Chinese (Simplified)
2、Pipeline
3、Kubernetes
4、Git
5、Git Parameter
6、GitLab				   # webhook 触发构建
7、Config FIle Provider		# 连接远程k8s集群
#8、Extended Choice Parameter
9、SSH Pipeline Steps		# Pipeline通过ssh远程执行命令
10、Pipeline: Stage View
11、Role-based Authorization Strategy
12、DingTalk				   # 钉钉机器人http://jenkins-prod.jenkins-prod:8080

cat > ~/jenkins-prod-yml/Jenkins-prod-slave-maven-cache.yml << 'EOF'
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:name: jenkins-prod-slave-maven-cachenamespace: jenkins-prod
spec:storageClassName: "nfs-storage"accessModes: [ReadWriteOnce]resources:requests:storage: 2Ti
EOF

cat > ~/jenkins-prod-yml/Jenkins-prod-slave-node-cache.yml << 'EOF'
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:name: jenkins-prod-slave-node-cachenamespace: jenkins-prod
spec:storageClassName: "nfs-storage"accessModes: [ReadWriteOnce]resources:requests:storage: 2Ti
EOF

cat > ~/jenkins-prod-yml/Jenkins-prod-slave-golang-cache.yml << 'EOF'
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:name: jenkins-prod-slave-golang-cachenamespace: jenkins-prod
spec:storageClassName: "nfs-storage"accessModes: [ReadWriteOnce]resources:requests:storage: 2Ti
EOFcat > ~/jenkins-prod-yml/Jenkins-prod-slave-go-build-cache.yml << 'EOF'
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:name: jenkins-prod-slave-go-build-cachenamespace: jenkins-prod
spec:storageClassName: "nfs-storage"accessModes: [ReadWriteOnce]resources:requests:storage: 2Ti
EOF

Jenkins （jdk-21）（pipeline）

测试 docker、测试 maven、 测试 node、测试 golang、 测试 gcc、 测试 kubectl

#!/usr/bin/env groovypipeline {agent {kubernetes {yaml '''
apiVersion: v1
kind: Pod
metadata:name: jenkins-slavenamespace: jenkins-prod
spec:tolerations:- key: "no-pod"operator: "Exists"effect: "NoSchedule"containers:- name: docker#image: docker:24.0.6image: ccr.ccs.tencentyun.com/huanghuanhui/docker:24.0.6imagePullPolicy: IfNotPresentreadinessProbe:exec:command: [sh, -c, "ls -S /var/run/docker.sock"]command:- sleepargs:- 99dvolumeMounts:- name: docker-socketmountPath: /var/run- name: docker-daemon#image: docker:24.0.6-dindimage: ccr.ccs.tencentyun.com/huanghuanhui/docker:24.0.6-dindimagePullPolicy: IfNotPresentsecurityContext:privileged: truevolumeMounts:- name: docker-socketmountPath: /var/run- name: maven#image: maven:3.8.1-jdk-8image: ccr.ccs.tencentyun.com/huanghuanhui/maven:3.8.1-jdk-8imagePullPolicy: IfNotPresentcommand:- sleepargs:- 99dvolumeMounts:- name: maven-cachemountPath: /root/.m2/repository- name: node#image: node:16.17.0-alpineimage: ccr.ccs.tencentyun.com/huanghuanhui/node:16.17.0-alpineimagePullPolicy: IfNotPresentcommand:- sleepargs:- 99dvolumeMounts:- name: node-cachemountPath: /root/.npm- name: golang#image: golang:1.21.3image: ccr.ccs.tencentyun.com/huanghuanhui/golang:1.21.3imagePullPolicy: IfNotPresentcommand:- sleepargs:- 99d- name: gcc#image: gcc:13.2.0image: ccr.ccs.tencentyun.com/huanghuanhui/gcc:13.2.0imagePullPolicy: IfNotPresentcommand:- sleepargs:- 99d- name: kubectl#image: kostiscodefresh/kubectl-argo-rollouts:v1.6.0#image: kubectl:v1.28.4image: ccr.ccs.tencentyun.com/huanghuanhui/kubectl:v1.28.4imagePullPolicy: IfNotPresentcommand:- sleepargs:- 99dvolumes:- name: docker-socketemptyDir: {}- name: maven-cachepersistentVolumeClaim:claimName: jenkins-prod-slave-maven-cache- name: node-cachepersistentVolumeClaim:claimName: jenkins-prod-slave-node-cache
'''}}stages {stage('测试 docker') {steps {container('docker') {sh """docker version"""}}}stage('测试 maven') {steps {container('maven') {sh """mvn -version && java -version && javac -version"""}}}stage('测试 node') {steps {container('node') {sh """node --version && npm --version && yarn --version"""}}}stage('测试 golang') {steps {container('golang') {sh """go version
cat > HelloWorld.go << 'EOF'
package mainimport "fmt"func main() {fmt.Println("Hello, world! My Name is go!")
}
EOFgo build -o HelloWorld-go HelloWorld.go && ./HelloWorld-go"""}}}stage('测试 gcc') {steps {container('gcc') {sh """gcc --version && g++ --version && make --version
cat > HelloWorld.cpp << 'EOF'
#include <iostream>int main() {std::cout << "Hello, World! My Name is C++!" << std::endl;return 0;
}
EOFg++ -o HelloWorld-cpp HelloWorld.cpp && ./HelloWorld-cpp"""}}}stage('测试 kubectl') {steps {container('kubectl') {sh """kubectl get node"""}}}}
}