k8s中安装Jenkins
查看Jenkins最新的LTS版本创建本地目录用于Jenkins持久化创建ServiceAccount创建ClusterRole创建ClusterRoleBinding创建Deployment创建集群访问入口访问集群参考文档
安装环境
阿里云CentOS 7.9(公网IP:8.130.177.188)
k3s v1.22.7+k3s1centos安装k3s,如需Dockerfile功能,请使用INSTALL_K3S_EXEC="server --docker"模式
Jenkins 2.332.1
查看Jenkins最新的LTS版本
查看最新LTS版本
当前最新LTS版本为2.332.1
创建本地目录用于Jenkins持久化
创建持久化文件:mkdir -p /opt/jenkins/data
文件授权:sudo chown -R 1000:1000 /opt/jenkins/data
查看目录权限:ls -al /opt/jenkins
创建ServiceAccount
需要一个拥有相关权限的serviceAccount的Jenkins用户:vim jenkins-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: jenkins-sa
执行创建ServiceAccount:kubectl create -f jenkins-sa.yaml
查看ServiceAccount:kubectl get sa
创建ClusterRole
创建角色:vim jenkins-clusterRole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: jenkins-clusterRole
rules:
- apiGroups: ["extensions", "apps"]
resources: ["deployments"]
verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
resources: ["services"]
verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get","list","watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
执行创建ClusterRole:kubectl create -f jenkins-clusterRole.yaml
查看ClusterRole:kubectl get clusterRole|grep jenkins
创建ClusterRoleBinding
创建角色绑定:vim jenkins-clusterRoleBinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: jenkins-clusterRoleBinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: jenkins-clusterRole
subjects:
- kind: ServiceAccount
name: jenkins-sa
namespace: default # 默认命名空间下也需要添加此行
执行创建ClusterRoleBinding:kubectl create -f jenkins-clusterRoleBinding.yaml
查看ClusterRoleBinding:kubectl get clusterRoleBinding|grep jenkins
创建Deployment
如需安装jdk8版本的jenkins,使用version:2.332.1-jdk8
如需安装jdk11版本的jenkins,使用version:2.332.1
创建Deployment定义vim jenkins-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: jenkins-deploy #deployment名称
spec:
replicas: 1
selector:
matchLabels:
app: jenkins
template:
metadata:
labels:
app: jenkins
spec:
terminationGracePeriodSeconds: 10 #优雅停止pod
serviceAccount: jenkins-sa #后面还需要创建服务账户
containers:
- name: jenkins
image: jenkins/jenkins:2.332.1-jdk8 #镜像版本(2.332.1默认安装的jdk11版本,如果想安装jdk8可以指定version:2.332.1-jdk8)
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080 #外部访问端口
name: web
protocol: TCP
- containerPort: 50000 #jenkins save发现端口
name: agent
protocol: TCP
resources:
limits:
cpu: 2
memory: 1Gi
requests:
cpu: 1
memory: 512Mi
livenessProbe:
httpGet:
path: /login
port: 8080
initialDelaySeconds: 30 #容器初始化完成后,等待30秒进行探针检查
timeoutSeconds: 5
failureThreshold: 12 #当Pod成功启动且检查失败时,Kubernetes将在放弃之前尝试failureThreshold次。放弃生存检查意味着重新启动Pod。而放弃就绪检查,Pod将被标记为未就绪。默认为3.最小值为1
readinessProbe:
httpGet:
path: /login
port: 8080
initialDelaySeconds: 30
timeoutSeconds: 5
failureThreshold: 12
volumeMounts: #需要将jenkins_home目录挂载出来
- name: jenkins-home
mountPath: /var/jenkins_home
env:
- name: LIMITS_MEMORY
valueFrom:
resourceFieldRef:
resource: limits.memory
divisor: 1Mi
- name: JAVA_OPTS # -Dhudson.model.DownloadService.noSignatureCheck=true 关闭源配置检查,否则换源后可能无法使用
value: -Xmx$(LIMITS_MEMORY)m -XshowSettings:vm -Dhudson.slaves.NodeProvisioner.initialDelay=0 -Dhudson.slaves.NodeProvisioner.MARGIN=50 -Dhudson.slaves.NodeProvisioner.MARGIN0=0.85 -Duser.timezone=Asia/Shanghai -Dhudson.model.DownloadService.noSignatureCheck=true -Dhudson.model.UpdateCenter.updateCenterUrl=https://mirrors.tuna.tsinghua.edu.cn/jenkins/updates/
securityContext:
fsGroup: 1000
volumes:
- name: jenkins-home
hostPath: #此处可自定义本地已存在的路径
path: /opt/jenkins/data
执行创建Deployment:kubectl create -f jenkins-deploy.yaml
等待30秒左右,执行以下指令确认jenkins已成功启动:
查看Deployment:kubectl get deploy
查看Pod:kubectl get po
创建集群访问入口
创建服务定义vim jenkins-svc.yaml
apiVersion: v1
kind: Service
metadata:
name: jenkins-svc
spec:
selector:
app: jenkins
type: NodePort
ports:
- name: web
port: 8080
targetPort: web
nodePort: 30190
- name: agent
port: 50000
targetPort: agent
执行创建服务:kubectl create -f jenkins-svc.yaml
查看服务:kubectl get svc
开放端口
阿里云开放安全组入方向端口
访问web页面
浏览器访问:8.130.177.188:30190/login
获取密码,因(/var/jenkins_home)映射到目录(/opt/jenkins/data),此处替换掉部分路径:
cat /opt/jenkins/data/secrets/initialAdminPassword
登录成功!
此处点击使用安装推荐的插件
,等待推荐插件安装完成
如果有安装失败的插件,可点击重试安装【可能重试安装也会失败,目前部分插件已不支持此版本,需要手动安装插件的低版本】。或者点击继续,进入系统后再安装。(目前遇到的是credentials插件安装失败,配置完成后,自行进入系统管理可手动安装低版本:https://updates.jenkins.io/download/plugins/credentials/1087.v16065d268466/credentials.hpi,安装完成需要8.130.177.188:30190/restart下)
如果无创建用户需求,点击使用admin账户继续即可。
实例配置使用默认值:
配置完成,点击开始使用Jenkins:
配置完成,跳转到主页:
参考文档
基于Kubernetes Jenkins CICD(项目实战)
Jenkins启动参数
jenkins安装提示Please wait while Jenkins is getting ready to work…(Jenkins访问资源慢的问题)
Docker Desktop for Mac ACL权限控制
Docker Desktop for Mac user manual
更多推荐
所有评论(0)