做这个实验目标是往kubernetes集群里交付dubbo服务，采用jenkins+maven+gitee实现，jenkins使用的是v2.303.1，maven使用3.6.3。jenkins数据存储在nfs目录中。如下图所示：
| 主机名 | 提供服务 |
| host11 | nginx-proxy、dns |
| host21 | kubernetes node(v.1.15.2) |
| host22 | kubernetes node(v1.15.2) |
| host200 | harbor、httpd、nfs |
**01 jenkins镜像准备
**
1）在host200上下载jenkins镜像
docker pull jenkins/jenkins:2.303.1
2）添加tag，上传到自己的镜像仓库
docker tag 619aabbe0502 harbor.od.com/public/jenkins:2.303.1
docker push harbor.od.com/public/jenkins:2.303.1
3）准备dockerfile，以官方镜像为底包，构建能和docker联动的镜像
mkdir -pv /data/dockerfile/jenkins
cd /data/dockerfile/jenkins
# 准备sshkey
ssh-keygen -t rsa -b 2048 -C "yunweishaonian@yeah.net" -N "" -f /root/.ssh/id_rsa
# 将key复制到当前目录下
cp -a /root/.ssh/id_rsa .
# 获取get-docker.sh，主要是给jenkens安装docker客户端
curl -fsSL get.docker.com -o /data/dockerfile/jenkins/get-docker.sh
# 复制docker的配置文件
cp -a /root/.docker/config.json .
# 添加config文件，后卖就可以绵密登录gitee了
vi config
Host gitee.com
HostName gitee.com
User git
PreferredAuthentications publickey
IdentityFile /root/.ssh/id_rsa
# 编辑dockerfile
vi /data/dockerfile/jenkins/Dockerfile
FROM harbor.od.com/public/jenkins:2.303.1
USER root
RUN /bin/cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime &&\
echo 'Asia/Shanghai' > /etc/timezone
ADD id_rsa /root/.ssh/id_rsaADD config.json /root/.docker/config.json
ADD get-docker.sh /get-docker.sh
ADD config /root/.ssh/config
RUN echo " StrictHostKeyChecking no" >> /etc/ssh/ssh_config &&\
/get-docker.sh
# build成一个新镜像
docker build . -t harbor.od.com/infra/jenkins:v2.303.1
# 上传至harbor
docker push harbor.od.com/infra/jenkins:v2.303.1
4）在gitee配置公钥
5）测试jenkens镜像是否可用
# 返回成功即可
docker -run --rm harbor.od.com/infra/jenkins:v2.303.1 ssh -T git@gitee.com
**02 kubernetes 准备
**
1）创建namespace
# 创建namespace
kubectl create namespace infra
# 创建secret,这里的密码为harbor的密码
kubectl create secret docker-registry harbor --docker-server=harbor.od.com --docker-username=admin --docker-password=xxxxx -n infra
03 nfs准备
1）每个节点都安装nfs-utils
yum install nfs-utils -y
2）在host200上创建共享目录
mkdir -p /data/nfs-volume/jenkins_home
3）host200配置nfs
vi /etc/exports
/data/nfs-volume 192.168.122.0/24(rw,no_root_squash)
4）host200启动nfs服务
systemctl enable nfs
systemctl start nfs
5）测试
[root@host200 ~]# showmount -e
Export list for host200.yunwei.com:
/data/nfs-volume 192.168.122.0/24 # node地址段
04 资源配置清单
1）创建目录（/data/k8s-yaml/jenkins == k8s-yaml.od.com/jenkins/）
mkdir /data/k8s-yaml/jenkins/
2）创建dp.yaml
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: jenkins
namespace: infra
labels:
name: jenkins
spec:
replicas: 1
selector:
matchLabels:
name: jenkins
template:
metadata:
labels:
app: jenkins
name: jenkins
spec:
volumes:
- name: data # 创建一个卷
nfs: # 卷类型是nfs
server: host200 # nfs服务器地址
path: /data/nfs-volume/jenkins_home
- name: docker # 创建一个卷
hostPath: # 类型是hostpath，即本节点路径
path: /run/docker.sock # 将物理节点的docker.sock挂在到jenkins里，这样jenkins就可以通过socket和物理节点的docker通信了
type: ''
containers:
- name: jenkins
image: harbor.od.com/infra/jenkins:v2.303.1
imagePullPolicy: IfNotPresent # 镜像拉去策略 awlays 不管本地有没有，都从远程拉，never只从本地拉，IfNotPresent 优先本地，本地没有去远程拉
ports:
- containerPort: 8080
protocol: TCP
env:
- name: JAVA_OPTS
value: -Xmx512m -Xms512m
volumeMounts:
- name: data
mountPath: /var/jenkins_home # 将host200:/data/nfs-volume/jenkins_home挂在到容器里的/var/jenkins_home
- name: docker
mountPath: /run/docker.sock # 将物理主机的/run/docker.sock挂在到容器的/run/docker.sock
imagePullSecrets:
- name: harbor # 镜像仓库 之前用kubectl create secret docker-registry harbor --docker-server=harbor.od.com --docker-username=admin --docker-password=xxxxx -n infra 定义了
securityContext:
runAsUser: 0
strategy:
type: RollingUpdate # 滚动升级
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
revisionHistoryLimit: 7 # 保留7份滚动版本 ，以便回退
progressDeadlineSeconds: 600 # 启动超时时间
3）创建svc.yaml
kind: Service
apiVersion: v1
metadata:
name: jenkins
namespace: infra
spec:
ports:
- protocol: TCP
port: 80 # cluterip的80端口转换到容器的8080
targetPort: 8080
selector:
app: jenkins
4）ingress.yaml
kind: Ingress
apiVersion: extensions/v1beta1
metadata:
name: jenkins
namespace: infra
spec:
rules:
- host: jenkins.od.com
http:
paths:
- path: /
backend:
serviceName: jenkins
servicePort: 80
05 将jenkins交付到kubernetes集群
1）任意一个node创建资源
kubectl create -f http://k8s-yaml.od.com/jenkins/dp.yaml
kubectl create -f http://k8s-yaml.od.com/jenkins/svc.yaml
kubectl create -f http://k8s-yaml.od.com/jenkins/ingress.yaml
2）查看资源情况
[root@host21 ~]# kubectl get all -n infra
NAME READY STATUS RESTARTS AGE
pod/jenkins-7df8bf4ff9-qj85m 1/1 Running 0 10h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/jenkins ClusterIP 10.254.129.207 <none> 80/TCP 13h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/jenkins 1/1 1 1 10h
NAME DESIRED CURRENT READY AGE
replicaset.apps/jenkins-7df8bf4ff9 1 1 1 10h
06 验证jenkins
1）验证jenkins镜像的用户
[root@host21 ~]# kubectl exec -it pod/jenkins-7df8bf4ff9-qj85m -n infra /bin/bash
root@jenkins-7df8bf4ff9-qj85m:/# whoami
root
2）验证是否可以登录git
root@jenkins-7df8bf4ff9-qj85m:/# ssh -i /root/.ssh/id_rsa -T git@gitee.com
Hi yunweishaonian! You've successfully authenticated, but GITEE.COM does not provide shell access.
3）验证jenkins是否可以联动host的docker
root@jenkins-7df8bf4ff9-qj85m:/# docker image ls
REPOSITORY TAG IMAGE ID CREATED SIZE
harbor.od.com/app/dubbo-demo-service master_211002_2213 a8f3cec136fc About an hour ago 377MB
07 配置jenkins
1）在host11添加解析
# 添加解析
vi /var/named/od.com.zone
jenkins A 192.168.122.10
# 重启dns
systemctl restart named
2）打开网页，查看提示的文件，将密码输入
3）选推荐安装的插件，安装完成后创建admin用户即可
4）进入jenkins
5）修改安全参数
6）下载blue ocean插件
7）在[可选插件]中搜索blue ocean 选择下面的安装后重启
8）安装完成后选择restart
9）一切就绪后，你就可以在首页看到blue ocean了
本文使用 文章同步助手 同步
