kubernetes 環境 jenkins CI/CD 配置文件

阿新 • • 發佈：2020-11-02

jenkins CI/CD 配置文件

1.全域性工具配置

1.1 maven配置

預設 settings 提供

檔案路徑：/usr/local/bin/apache-maven-3.3.9/conf/settings.xml

預設全域性 settings 提供

檔案路徑：/usr/local/bin/apache-maven-3.3.9/conf/settings.xml

1.2 jdk

別名：jdk8

JAVA_HOME :/usr/local/openjdk-8

1.3 git

Name :Default

Path to Git executable :/usr/bin/git

1.4 maven

name :maven

MAVEN_HOME : /usr/local/bin/apache-maven-3.3.9

2.下載kubernetes 外掛

2.1 kubernetes plugin 安裝

首先進入外掛管理頁面【系統管理】->【管理外掛】->【可選外掛】，搜尋kubernetes plugin,勾選要安裝的外掛，然後點選【直接安裝】。

2.2 配置kubernetes

單擊【系統管理】 - >【系統設定】，找到【雲】，然後點選【新增一個雲】

WX20200102-151850.png

name：kubernetes

禁用https證書檢查：false

kubernetes URL：https://kubernetes.default.svc.cluster.local

Kubernetes 服務證書 key : 為k8s叢集生成的ca證書

cat /etc/kubernetes/pki/ca.crt

JenkinsURL：http://jenkins-svc.ci.svc.cluster.local:8077 (服務名.名稱空間.svc.cluster.local:埠)

連線超時：5

讀取超時：15

憑據：根據下面命令獲取

##1.直接使用二進位制原始碼包安裝cfssl
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
chmod +x cfssl_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x cfssljson_linux-amd64
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl-certinfo_linux-amd64
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo
export PATH=/usr/local/bin:$PATH

#準備證書籤名請求
mkdir /usr/local/k8s/cfssl
cd /usr/local/k8s/cfssl

vi admin-csr.json
{
  "CN": "admin",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "HangZhou",
      "L": "XS",
      "O": "system:masters",
      "OU": "System"
    }
  ]
}

#3.建立證書和私鑰
cd /usr/local/k8s/cfssl
cfssl gencert -ca=/etc/kubernetes/pki/ca.crt -ca-key=/etc/kubernetes/pki/ca.key --profile=kubernetes admin-csr.json | cfssljson -bare admin
# 生成以下三個檔案
ls -l 
admin.csr
admin-key.pem
admin.pem

#4.我們可以通過openssl來轉換成pkc格式： 
openssl pkcs12 -export -out ./jenkins-admin.pfx -inkey ./admin-key.pem -in ./admin.pem -passout pass:secret
#生成jenkins-admin.pfxpfx檔案
ls
 jenkins-admin.pfx

下載jenkins-admin.pfx到本地儲存

將證書內容填寫，點選憑據後面的新增，點選Jenkins

得到jenkins-admin.pfk檔案後，點選Jenkins配置Credentials後面的Add，配置如下

上傳證書

1341090-20190812121333313-1393693991.png

選擇檔案 jenkins-admin.pfk

22.png

輸入密碼 secret，後面的內容可以不填寫，點選新增。

33.png

選擇憑據，點選連線測試。

出現 Connection test successful 表示連線成功。

2.3配置 Pod Template

構建slave映象

docker pull cnych/jenkins:jnlp6

docker tag cnych/jenkins:jnlp6 harbor.demo.com/private/demo-jenkins:jnlp

docker push harbor.demo.com/private/demo-jenkins:jnlp

設定Pod Template （ jenkinsfile 中label標籤和標籤列表設定保持一致）

WX20200102-154511.png

添加捲
WX20200102-154721.png

Service Account：jenkins

3.gitlab 設定

下載gitlab外掛

系統管理—系統配置-Gitlab

WX20200102-155116.png

GitLab API token API token 在gitlab-settings-Access Token獲取

WX20200102-155245.png

WX20200102-155641.png

4.新建pipeline任務

podTemplate(label: '100kip', cloud: 'kubernetes') {
    node('100kip') {

        environment {
            harborHost = ""
            harborCertificate = ""
            kubeconfigId = ""
            privateHarbor = ""
            version=""
            images=""
            yamlPath="";
        }

        stage('Clone') {
            echo "1.Clone Stage"
            checkout([$class: 'GitSCM',
             branches: [[name: '*/${branch}']],
             doGenerateSubmoduleConfigurations: false,
             extensions: [[$class: 'CloneOption', depth: 1, honorRefspec: true, noTags: true, reference: '', shallow: true]],
             submoduleCfg: [],
             userRemoteConfigs: [[credentialsId: 'jenkins_gitlab', url: '${git_url}']]]
             )
        }

        stage('pom version') {
            echo "2.pom version"
            def pom = readMavenPom file: 'pom.xml'
            version = "${pom.version}"
            harborHost = "harbor.demo.com"
            harborCertificate = "harbor_username_password"
            kubeconfigId = "kubernetes_config"
            privateHarbor = "${harborHost}\\/kb"
            images = "${privateHarbor}\\/${module}:${version}-${BUILD_NUMBER}"
            echo "version:${version}-----privateHarbor:${privateHarbor}----images:${images}"
            def isCanary="${canary}";
            if(isCanary == "true"){
                echo "灰度釋出"
                yamlPath = "k8s/${profiles}/canary/${module}-canary.yaml";
            }else{
                yamlPath = "k8s/${profiles}/${module}.yaml";
            }
        }

        stage('Maven bulid') {
          echo "2.Maven bulid"
          sh "mvn clean package -pl ${module} -P ${profiles} -DskipTests -U "
        }

        stage('Docker build') {
            echo "3.Build Docker Image Stage"
            def buildArg = "-f ${module}/Dockerfile --build-arg version=${version} --build-arg module=${module} ."
            def customImage = docker.build("${images}", "${buildArg}")
            docker.withRegistry("http://${harborHost}", "${harborCertificate}") {
                customImage.push()
            }
        }

        stage('K8S Deploy') {
             echo "K8S Deploy"
             sh "sed -i 's/${module}:lastest/${images}/g' ${yamlPath}"
             kubernetesDeploy configs: "${yamlPath}", kubeconfigId: "${kubeconfigId}"
             echo "Service deploy successfully! please request http://${domain}"
        }

    }
}