独立jenkins如何跟k8s配合使用【20】

2024-01-12 16:56:40

在公司内部都有jenkins服务器，如果一旦上容器化需要吧jenkins和k8s结合

目前有两种方式，

1、jenkins容器化，但是这样需要涉及之前业务的搬迁，成本高

2、就是jenkins独立，然后slave已容器方式运行，master是独立出来的，减少运维成本，还能提高效率

第一步：

现在k8s集群上面安装nfs完成，创建jenkinsslave的pv和pvc

[root@k8s-master data]# mkdir -p /data/nfs/{workspace,m2}

创建pv和pvc

[root@k8s-master yaml]# cat jenkins-slave-workspace-pv.yaml
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: jenkins-slave-workspace
spec:
  persistentVolumeReclaimPolicy: Recycle
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  nfs:
    server: 192.168.0.211
    path: /data/nfs/workspace

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-slave-workspace
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

[root@k8s-master yaml]# cat jenkins-slave-m2-pv.yaml
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: jenkins-slave-m2
spec:
  persistentVolumeReclaimPolicy: Recycle
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  nfs:
    server: 192.168.0.211
    path: /data/nfs/m2

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-slave-m2
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

[root@k8s-master yaml]# kubectl create -f jenkins-slave-workspace-pv.yaml
persistentvolume/jenkins-slave-workspace created
persistentvolumeclaim/jenkins-slave-workspace created

[root@k8s-master yaml]# kubectl create -f jenkins-slave-m2-pv.yaml
persistentvolume/jenkins-slave-m2 created
persistentvolumeclaim/jenkins-slave-m2 created

第二步：首先需要在jenkins的master上面安装配合k8s的插件

Kubernetes Continuous Deploy、
Kubernetes、
Gitlab Hook 、
GitLab、
Build Authorization Token
安装完成之后可以系统配置

第三步：开始配置认证

使用?rbac授权，token的方式连接k8s

#创建serviceaccounts
kubectl create sa jenkins
#对jenkins做cluster-admin绑定 ? 网上的有问题
kubectl create clusterrolebinding jenkins --clusterrole=cluster-admin --group=system:serviceaccounts --namespace=default ?--serviceaccount=default:jenkins ??

kubernetes-plugin与k8s连接时，并不是直接使用serviceaccount，而是通过token。因此我们需要获取serviceaccount:jenkins对应的token。

# 1.查看sa
[root@k8s-master updates]# kubectl get sa -n default
NAME      SECRETS   AGE
default   1         116d
jenkins   1         20s
# 2.查看secret
[root@k8s-master updates]# kubectl describe sa jenkins -n default
Name:                jenkins
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   jenkins-token-kgxch
Tokens:              jenkins-token-kgxch
Events:              <none>
3.获取token
[root@k8s-master updates]# kubectl describe secrets jenkins-token-kgxch -n default
Name:         jenkins-token-kgxch
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: jenkins
              kubernetes.io/service-account.uid: 07d8890d-12cc-11eb-8ca1-000c29824e3f

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1025 bytes
namespace:  7 bytes
token:         ####这里就是所需的token

然后配置jenkins 的master