devops (jenkins gitea rancher) 安装

最新推荐文章于 2023-11-29 22:45:23 发布

haifengat

最新推荐文章于 2023-11-29 22:45:23 发布

阅读量500

点赞数 1

分类专栏： docker 文章标签： docker nginx centos

本文链接：https://blog.csdn.net/along1976/article/details/106613609

版权

docker 专栏收录该内容

17 篇文章 2 订阅

订阅专栏

install_app.sh

安装devop应用

echo "------------------ 安装应用 --------------------"
# 变量
cat >> /etc/bashrc << EOF
export resources=/home/resources
export data=/home/data
export domain=do.io
EOF
source /etc/bashrc

# 加载镜像
cd ${resources}
for t in *.tar;
  do
  docker load -i $t;
  done

# jenkins目录权限
mkdir -p ${data}/jenkins
chown -R 1000:1000 ${data}/jenkins
chown -R 1000:1000 /var/run/docker.sock
# docker-compose.yml
cat > ${data}/docker-compose.yml << EOF
version: "3"

services:
  nginx:
    image: nginx:1.18.0
    container_name: nginx
    restart: always
    environment:
      - TZ=Asia/Shanghai
    ports:
      - "80:80"
      #留给harbor- "443:443"
    volumes:
      #- ${data}/nginx/www:/usr/share/nginx/html
      - ${data}/nginx/conf/nginx.conf:/etc/nginx/nginx.conf
      #- ${data}/nginx/logs:/var/log/nginx
      #- ${data}/nginx/conf.d:/etc/nginx/conf.d
  # 代码库 3000
  gitea:
    image: gitea/gitea:linux-amd64
    container_name: gitea
	ports:
      - "2222:22"
    volumes:
      - ${data}/gitea/data:/data
    depends_on:
      - gitea_db
    restart: always
  gitea_db:
    image: mariadb:10.5.2
    container_name: gitea_db
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=123456
      - MYSQL_DATABASE=gitea
      - MYSQL_USER=gitea
      - MYSQL_PASSWORD=123456
    volumes:
      - ${data}/gitea/db/:/var/lib/mysql
  # 流水线 8080 / 50000
  jenkins:
    image: jenkinsci/blueocean:1.23.1
    container_name: jenkins
    restart: always
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ${data}/jenkins:/var/jenkins_home
      - /usr/bin/docker:/bin/docker
      - /var/run/docker.sock:/var/run/docker.sock
      - /usr/lib/x86_64-linux-gnu/libltdl.so.7:/usr/lib/x86_64-linux-gnu/libltdl.so.7 
  rancher:
    image: rancher/rancher:v2.4.3-rc3
    container_name: rancher
    restart: unless-stopped
    environment:
      - TZ=Asia/Shanghai
	  - AUDIT_LEVEL=3
    ports:
      - "8443:443"
    volumes:
      - ${data}/rancher_home/rancher:/var/lib/rancher
      - ${data}/rancher_home/auditlog:/var/log/auditlog
EOF
# nginx
mkdir -p ${data}/nginx/conf/
cat > ${data}/nginx/conf/nginx.conf << EOF
worker_processes auto;
pid /tmp/nginx.pid;

events {
  worker_connections 1024;
  use epoll;
  multi_accept on;
}

http {
  # this is necessary for us to be able to disable request buffering in all cases
  proxy_http_version 1.1;

  upstream gitea {
    server gitea:3000;
  }
  upstream jenkins {
    server jenkins:8080;
  }
	
  log_format timed_combined '$remote_addr - '
    '"$request" $status $body_bytes_sent '
    '"$http_referer" "$http_user_agent" '
    '$request_time $upstream_response_time $pipe';

  access_log /dev/stdout timed_combined;

  server {
    listen 80;
    server_name gitea.do.io;
    location / {
      proxy_pass http://gitea/;
    }
  }
  server {
    listen 80;
    server_name jenkins.do.io;
    location / {
      proxy_pass http://jenkins/;
      proxy_read_timeout  90;
      # 解决提示代理问题
      proxy_redirect  http://jenkins $scheme://jenkins.do.io;
    }
  }
  server {
    listen 80;
    server_name harbor.do.io;
    return 308 https://$host$request_uri;
  }
}
EOF
# up -d
docker-compose -f ${data}/docker-compose.yml up -d

# ssl
mkdir -p ${data}/certs && cd ${data}/certs
### private
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=${domain}" -key ca.key  -out ca.crt
### server
openssl genrsa -out ${domain}.key 4096
openssl req -sha512 -new -subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=${domain}" -key ${domain}.key -out ${domain}.csr
cat > v3.ext << EOF
    authorityKeyIdentifier=keyid,issuer
    basicConstraints=CA:FALSE
    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
    extendedKeyUsage = serverAuth
    subjectAltName = @alt_names
    [alt_names]
    DNS.1=${domain}
    DNS.2=$(hostname)
    DNS.3=gitea.${domain}
    DNS.4=jenkins.${domain}
    DNS.5=harbor.${domain}
    DNS.6=rancher.${domain}
    DNS.7=reg.${domain}
    DNS.8=sftp.${domain}
    DNS.9=dev.${domain}
    DNS.10=opt.${domain}
    DNS.11=abc.${domain}
    DNS.12=ftp.${domain}
EOF
openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in ${domain}.csr -out ${domain}.crt
openssl x509 -inform PEM -in ${domain}.crt -out ${domain}.cert

# 本机信任
mkdir -p /etc/docker/certs.d/${domain}
\cp ${domain}.cert /etc/docker/certs.d/${domain}/
\cp ${domain}.key /etc/docker/certs.d/${domain}/
\cp ca.crt /etc/docker/certs.d/${domain}/
\cp ${domain}.crt /etc/pki/ca-trust/source/anchors/${domain}.crt
update-ca-trust extract
systemctl restart docker

# harbor
### ssl
mkdir -p /etc/docker/certs.d/harbor.${domain}
\cp ${data}/certs/ca.crt /etc/docker/certs.d/harbor.${domain}/
systemctl restart docker
\cp ${data}/certs/${domain}.crt /etc/pki/ca-trust/source/anchors/harbor.${domain}.crt
update-ca-trust extract
# export ip=IP@harbor
# export node=nx
# 其他机器信任 scp -r /etc/docker/certs.d/${domain} root@${node}:/etc/docker/certs.d/harbor.${domain}
# ssh root@${node} "echo ${ip} harbor.${domain} >> /etc/hosts; systemctl restart docker;"
#### install
cd $data
tar xvf ${resources}/harbor-offline-installer-v1.10.2.tgz
cd harbor
docker load -i ./harbor.v*
rm -f ./harbor.v*
# config
\cp harbor.yml.tmpl harbor.yml
### hostname        
sed -i "s#hostname:.*#hostname: harbor.${domain}#" harbor.yml
### SSL
sed -i "s#certificate:.*#certificate: ${data}/certs/${domain}.cert#"  harbor.yml
sed -i "s#private_key:.*#private_key: ${data}/certs/${domain}.key#"  harbor.yml
### data
sed -i "s#data_volume.*#data_volume: ${data}/hbdata#"  harbor.yml
# install
./prepare
# 端口映射
sed -i "s#: nginx#: harbor_ng#" docker-compose.yml
sed -i "s#\"proxy\"#\"nginx\"#" docker-compose.yml
sed -i "s#80:8080#8080:8080#g" docker-compose.yml
# up -d
docker-compose up -d

安装k3s

work节点

echo "------------- install k3s on node ---------------"
# ip与nx对应
echo "ip@node n1" >> /etc/hosts
# 免密登录
cd ${data}/certs
### 生成秘钥
ssh-keygen -t rsa -b 4096 -C "hubert28@qq.com" -N ''
# 用agent会导致mobax无法同步目录
# ssh-keygen -t rsa -b 4096 -f haifeng -C "hubert28@qq.com" -N ''
### 加载秘钥
#cat >> /etc/bashrc << EOF
# eval \`ssh-agent\`
# ssh-add ${data}/certs/haifeng
# EOF
# source /etc/bashrc
### 自动登录
#ssh-copy-id -i ./haifeng.pub -f root@n1
ssh-copy-id -f root@n1

# n1上安装k3s
### 资源复制
cd ${resources}
scp -r ./k3s_1.18.2 root@n1:${resources}/k3s_1.18.2
scp -r ./off_docker_c8 root@n1:${resources}/off_docker_c8
scp ./rancher.2.4.3.agent.0430.tar.gz root@n1:${resources}
scp ./init.sh root@n1:${resources}
scp ./docker-compose root@n1:${resources}

### 安装docker
ssh root@n1 "cd ${resources}; sh init.sh;"

### 安装k3s
ssh root@n1 "cd ${resources}/k3s_1.18.2; chmod a+x ./k3s ./install.sh;\
export INSTALL_K3S_EXEC=\"--docker --write-kubeconfig ~/.kube/config --write-kubeconfig-mode 666\";\
export INSTALL_K3S_SKIP_DOWNLOAD=true;\
\cp ./k3s /usr/local/bin/k3s && ./install.sh;
sleep 10;kubectl get nodes;"
### 注册:先从rancher取得import的指令
ssh root@n1 "docker load -i ${resources}/rancher.2.4.3.agent.0430.tar.gz;\
curl --insecure -sfL https://${rancher}:8443/v3/import/${ntoken}.yaml | kubectl apply -f -;"