客户端证书访问 Kubernetes api

1.查看客户端证书

more /etc/kubernetes/manifests/kube-apiserver.yaml

 

2.更新镜像文件

curl https://192.168.1.9:6443/apis/apps/v1/namespaces/default/deployments/config-deployment -v -k -X PUT \
  -H "content-type: application/yaml" \
  --key /etc/kubernetes/pki/apiserver-kubelet-client.key \
  --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \
  -d '---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: config-deployment
spec:
  selector:
    matchLabels:
      app: cloud_config
  replicas: 2
  template:
    metadata:
      labels:
        app: cloud_config
    spec:
      containers:
      - name: cloud-config
        image: 192.168.1.12/canary/cloud-config:v20220622.17.46.22 # 
        ports:
        - containerPort: 8082
  ' \

这里header 设置是 content-type: application/yaml，（PS:尝试json 没成功）

 

3.jenkins 构建、部署服务shell脚本

cd cloud-config
/usr/local/maven/apache-maven-3.8.6/bin/mvn package -DskipTests=true
DATE=$(date +%Y%m%d.%H.%M.%S)
wget -O ./Dockerfile http://192.168.1.254:9595/beeadmin/app/download
docker build  . -t 192.168.1.12/canary/cloud-config:v$DATE
docker login 192.168.1.12 -u admin -p Harbor12345
docker push 192.168.1.12/canary/cloud-config:v$DATE
docker rmi 192.168.1.12/canary/cloud-config:v$DATE
curl https://192.168.1.9:6443/apis/apps/v1/namespaces/default/deployments/config-deployment -v -k -X PUT \
  -H "content-type: application/yaml" \
  --key /etc/kubernetes/pki/apiserver-kubelet-client.key \
  --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \
  -d '---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: config-deployment
spec:
  selector:
    matchLabels:
      app: cloud_config
  replicas: 2
  template:
    metadata:
      labels:
        app: cloud_config
    spec:
      containers:
      - name: cloud-config
        image: 192.168.1.12/canary/cloud-config:v'$DATE' # 
        ports:
        - containerPort: 8082
  ' \

4.Dockerfile文件内容

FROM majiajue/jdk1.8:latest
COPY target/cloud-config-0.0.1-SNAPSHOT.jar app.jar
EXPOSE 8082
ENTRYPOINT ["java","-jar","/app.jar"]

问题：

jenkins调用docker命令行报错

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.24/build?buildargs=%7B%7D&cachefrom=%5B%5D&cgroupparent=&cpuperiod=0&cpuquota=0&cpusetcpus=&cpusetmems=&cpushares=0&dockerfile=Dockerfile&labels=%7B%7D&memory=0&memswap=0&networkmode=default&rm=1&shmsize=0&t=192.168.1.12%2Fcanary%2Fcloud-config%3Av20221002.23.37.06&target=&ulimits=null&version=1: dial unix /var/run/docker.sock: connect: permission denied

解决：

将 jenkins 账号加入到 root 组中。

gpasswd -a jenkins root

chmod 777 /var/run/docker.sock

重启 Jenkins

systemctl start jenkins