如何极狐GitLab Runner 使用特权身份运行，身为一个Linux运维程序员Context都没弄明白

最新推荐文章于 2024-06-14 17:37:13 发布

面试开源2024

最新推荐文章于 2024-06-14 17:37:13 发布

阅读量384

点赞数 5

分类专栏： 2024年程序员学习文章标签：运维 gitlab linux

本文链接：https://blog.csdn.net/m0_61409092/article/details/137534416

版权

2024年程序员学习专栏收录该内容

241 篇文章 0 订阅

订阅专栏

subject=CN = docker:dind client
/certs/client/cert.pem: OK
ip: can’t find device ‘nf_tables’
nf_tables 74274 0
nfnetlink 14519 4 ip_set,nf_tables,nf_conntrack_netlink
modprobe: can’t change directory to ‘/lib/modules’: No such file or directory
ip: can’t find device ‘ip_tables’
ip_tables 27126 4 iptable_raw,iptable_mangle,iptable_nat,iptable_filter
modprobe: can’t change directory to ‘/lib/modules’: No such file or directory
mount: permission denied (are you root?)
Could not mount /sys/kernel/security.
AppArmor detection and --privileged mode might break.
mount: permission denied (are you root?)
[root@anolis-7-9 ~]#



### 解决办法


1. 导出 helm gitlab 配置

将已配置的值导出到文件中

helm -n gitlab-test get values my-gitlab > my-gitlab.yaml

2. 查看 [gitlab runner 默认配置]( )

此处为节选，不同版本可能会存在差异，请以 https://artifacthub.io/packages/helm/gitlab/gitlab?modal=values 中的配置为准

gitlab-runner:
runners:
config: |
[[runners]]
[runners.kubernetes]
image = “ubuntu:22.04”
{{- if .Values.global.minio.enabled }}
[runners.cache]
Type = “s3”
Path = “gitlab-runner”
Shared = true
[runners.cache.s3]
ServerAddress = {{ include “gitlab-runner.cache-tpl.s3ServerAddress” . }}
BucketName = “runner-cache”
BucketLocation = “us-east-1”
Insecure = false
{{ end }}

3. 修改配置如下

gitlab-runner:
runners:
config: |
[[runners]]
[runners.kubernetes]

    # pod 使用特权身份运行
    privileged = true
    
    image = "ubuntu:22.04"
    {{- if .Values.global.minio.enabled }}
    [runners.cache]
      Type = "s3"
      Path = "gitlab-runner"
      Shared = true
      [runners.cache.s3]
        ServerAddress = {{ include "gitlab-runner.cache-tpl.s3ServerAddress" . }}
        BucketName = "runner-cache"
        BucketLocation = "us-east-1"
        Insecure = false
    {{ end }}

4. 更新配置

GitLab Runner 使用特权身份运行

helm upgrade -n gitlab-test --install my-gitlab gitlab/gitlab --timeout 600s -f my-gitlab.yaml --set gitlab-runner.runners.privileged=true --version 7.7.0

5. 等待所有 `gitlab-runner` 旧 `pod` 删除完成，新 `pod` 正常运行时，重试流水线，即可使用 `docker in docker`

[root@anolis-7-9 ~]# kubectl -n gitlab-test get pod | grep runner
my-gitlab-gitlab-runner-5f6ff5994c-wdw5l 1/1 Running 0 115m
runner-yr5wzqmq-project-4-concurrent-0-idibutkf 3/3 Running 0 4s
[root@anolis-7-9 ~]#

 注意此处查看的是 **svc-0** 的日志，即：services docker 的日志， 多个 services 时按顺序排序

[root@anolis-7-9 ~]# kubectl -n gitlab-test logs -f runner-yr5wzqmq-project-4-concurrent-0-idibutkf svc-0
time=“2023-12-23T16:34:27.467258283Z” level=info msg=“Starting up”
time=“2023-12-23T16:34:27.469102439Z” level=warning msg=“could not change group /var/run/docker.sock to docker: group docker not found”
time=“2023-12-23T16:34:27.469335776Z” level=warning msg=“Binding to IP address without --tlsverify is insecure and gives root access on this machine to everyone who has access to your network.” host=“tcp://0.0.0.0:2375”
time=“2023-12-23T16:34:27.469359429Z” level=warning msg=“Binding to an IP address, even on localhost, can also give access to scripts run in a browser. Be safe out there!” host=“tcp://0.0.0.0:2375”
time=“2023-12-23T16:34:28.469505651Z” level=warning msg=“Binding to an IP address without --tlsverify is deprecated. Startup is intentionally being slowed down to show this message” host=“tcp://0.0.0.0:2375”
time=“2023-12-23T16:34:28.469545042Z” level=warning msg=“Please consider generating tls certificates with client validation to prevent exposing unauthenticated root access to your network” host=“tcp://0.0.0.0:2375”

自我介绍一下，小编13年上海交大毕业，曾经在小公司待过，也去过华为、OPPO等大厂，18年进入阿里一直到现在。

深知大多数Linux运维工程师，想要提升技能，往往是自己摸索成长或者是报班学习，但对于培训机构动则几千的学费，着实压力不小。自己不成体系的自学效果低效又漫长，而且极易碰到天花板技术停滞不前！

因此收集整理了一份《2024年Linux运维全套学习资料》，初衷也很简单，就是希望能够帮助到想自学提升又不知道该从何学起的朋友，同时减轻大家的负担。