CI / CD
https://gitlab.com/gitlab-examples
Gitlab(仓库) -> Gitlab Runner(持续集成/部署) -> Remote host(远程部署主机)
11.5.1. 远程服务器配置
为远程服务器创建 www 用户,我们将使用该用户远程部署,远程启动程序。
[root@netkiller ~]# groupadd -g 80 www [root@netkiller ~]# adduser -o --uid 80 --gid 80 -G wheel -c "Web Application" www [root@netkiller ~]# id www uid=80(www) gid=80(www) groups=80(www),10(wheel) [root@netkiller ~]# PASSWORD=$(cat /dev/urandom | tr -dc [:alnum:] | head -c 32) [root@netkiller ~]# echo www:${PASSWORD} | chpasswd [root@netkiller ~]# echo "www password: ${PASSWORD}" www password: 0Uz1heY9v9KJyRKbvTi0VlAzfEoFW9GH
mkdir -p /opt/netkiller.cn/www.netkiller.cn chown www:www -R /opt/netkiller.cn
11.5.2. 配置 CI / CD
进入项目设置界面,点击 Settings,再点击 CI / CD
|
点击 Expand 按钮 展开 Runners
|
这时可以看到 Set up a specific Runner manually, 后面会用到 http://192.168.1.96/ 和 zASzWwffenos6Jbbfsgu
11.5.2.1. 安装 GitLab Runner
Install GitLab Runner
curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.rpm.sh" | sudo bash dnf install gitlab-runner cp /etc/gitlab-runner/config.toml{,.original} systemctl enable gitlab-runner
11.5.2.2. 注册 gitlab-runner
使用 SSH 登录 Gitlab runner 服务器,运行 gitlab-runner register
[root@localhost ~]# gitlab-runner register Runtime platform arch=amd64 os=linux pid=92925 revision=ac2a293c version=11.11.2 Running in system-mode. Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/): http://192.168.1.96/ Please enter the gitlab-ci token for this runner: zASzWwffenos6Jbbfsgu Please enter the gitlab-ci description for this runner: [localhost.localdomain]: Please enter the gitlab-ci tags for this runner (comma separated): Registering runner... succeeded runner=zASzWwff Please enter the executor: docker, docker-ssh, shell, ssh, docker-ssh+machine, parallels, virtualbox, docker+machine, kubernetes: shell Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!
返回 gitlab 查看注册状态
|
11.5.2.3. 并发链接数设置
编辑 /etc/gitlab-runner/config.toml 配置文件,修改 concurrent 数量
[root@localhost ~]# grep con /etc/gitlab-runner/config.toml concurrent = 10
11.5.3. Shell 执行器
Registering Runners
11.5.3.1. 注册 Gitlab Runner 为 Shell 执行器
[root@gitlab ~]# gitlab-runner register Runtime platform arch=amd64 os=linux pid=1020084 revision=c1edb478 version=14.0.1 Running in system-mode. Enter the GitLab instance URL (for example, https://gitlab.com/): http://git.netkiller.cn/ Enter the registration token: DyKdKyaJaq5KN-irgNGz Enter a description for the runner: [gitlab]: Enter tags for the runner (comma-separated): Registering runner... succeeded runner=DyKdKyaJ Enter an executor: parallels, virtualbox, docker+machine, custom, docker, docker-ssh, shell, ssh, docker-ssh+machine, kubernetes: shell Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!
/etc/gitlab-runner/config.toml 配置文件
[root@gitlab ~]# cat /etc/gitlab-runner/config.toml concurrent = 1 check_interval = 0 [session_server] session_timeout = 1800 [[runners]] name = "gitlab" url = "http://git.netkiller.cn/" token = "kVkzjDM74xZUN-aKbdPp" executor = "shell" [runners.custom_build_dir] [runners.cache] [runners.cache.s3] [runners.cache.gcs] [runners.cache.azure]
11.5.3.2. 生成 SSH 证书
持续集成和部署运行在 gitlab-runner 用户下,切换到 gitlab-runner 用户
[root@gitlab ~]# su - gitlab-runner Last login: Mon Jul 19 19:01:37 CST 2021
生成 SSH 证书
[gitlab-runner@gitlab ~]$ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/gitlab-runner/.ssh/id_rsa): Created directory '/home/gitlab-runner/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/gitlab-runner/.ssh/id_rsa. Your public key has been saved in /home/gitlab-runner/.ssh/id_rsa.pub. The key fingerprint is: SHA256:l90LYBeSF9l9JHXJUHeO+IyvscCziz4C8vFNpJoKEjo gitlab-runner@gitlab The key's randomart image is: +---[RSA 3072]----+ | ..o===B| | ..oo.**| | o.o . o| | .. = = | |. oS o + + | |... o . .o o . | |E o * o + . o | |.o + o o. + + | | .. oo.o.o | +----[SHA256]-----+ [gitlab-runner@gitlab ~]$
正常情况下,当我们链接一个 SSH 主机,会让我们输入 yes 确认继续链接。
[gitlab-runner@gitlab ~]$ ssh www@192.168.40.10 The authenticity of host '192.168.40.10 (192.168.40.10)' can't be established. ECDSA key fingerprint is SHA256:xmFF266MPdXhnlAljS+QWhQsw6jOw1sOwQXRr/PHi2w. Are you sure you want to continue connecting (yes/no/[fingerprint])?
配置 SSH
[gitlab-runner@gitlab ~]$ cat > ~/.ssh/config <<'EOF' Host * ServerAliveInterval=30 StrictHostKeyChecking no UserKnownHostsFile=/dev/null EOF chmod 600 -R ~/.ssh/config
授权远程执行 Shell
[gitlab-runner@gitlab ~]$ ssh-copy-id www@www.netkiller.cn
11.5.3.3. 数据库环境
在构建过程中,我们需要备份数据库/同步数据库,下面安装了一些所需的工具
[root@localhost ~]# dnf install -y mysql
设置数据库备份账号和密码,这里偷懒使用了 root 账号,生产环境请创建专用的备份账号。
[root@localhost ~]# su - gitlab-runner Last login: Wed Sep 1 19:17:48 CST 2021 [gitlab-runner@localhost ~]$ vim ~/.my.cnf [gitlab-runner@localhost ~]$ cat ~/.my.cnf [mysql] user=root password=test [mysqldump] user=root password=test
测试数据库是否畅通
[gitlab-runner@localhost ~]$ mysql -h mysql.netkiller.cn Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 37602 Server version: 8.0.21 Source distribution Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql>
11.5.3.4. Java 环境
JRE:java-11-openjdk
JDK:java-11-openjdk-devel
[root@gitlab ~]# dnf install -y java-11-openjdk java-11-openjdk-devel [root@gitlab ~]# dnf install -y maven
修改 Maven 镜像路
[root@gitlab ~]# vim /etc/maven/settings.xml <mirrors> <mirror> <id>aliyun</id> <name>aliyun maven</name> <url>http://maven.aliyun.com/nexus/content/groups/public/</url> <mirrorOf>central</mirrorOf> </mirror> </mirrors>
安装最新版 maven
如果需要安装最新版本 maven 使用下面脚本。
#!/bin/bash cd /usr/local/src/ wget https://mirrors.bfsu.edu.cn/apache/maven/maven-3/3.8.2/binaries/apache-maven-3.8.2-bin.tar.gz tar zxf apache-maven-3.8.2-bin.tar.gz mv apache-maven-3.8.2 /srv/ rm -f /srv/apache-maven ln -s /srv/apache-maven-3.8.2 /srv/apache-maven alternatives --install /usr/local/bin/mvn apache-maven-3.8.2 /srv/apache-maven-3.8.2/bin/mvn 0
[root@localhost src]# mvn -v Apache Maven 3.8.2 (ea98e05a04480131370aa0c110b8c54cf726c06f) Maven home: /srv/apache-maven-3.8.2 Java version: 17-ea, vendor: Red Hat, Inc., runtime: /usr/lib/jvm/java-17-openjdk-17.0.0.0.26-0.2.ea.el8.x86_64 Default locale: en_US, platform encoding: ANSI_X3.4-1968 OS name: "linux", version: "4.18.0-338.el8.x86_64", arch: "amd64", family: "unix"
apache-maven-3.8.2 配置
[root@localhost ~]# vim /srv/apache-maven/conf/settings.xml <mirrors> <!-- mirror | Specifies a repository mirror site to use instead of a given repository. The repository that | this mirror serves has an ID that matches the mirrorOf element of this mirror. IDs are used | for inheritance and direct lookup purposes, and must be unique across the set of mirrors. | <mirror> <id>mirrorId</id> <mirrorOf>repositoryId</mirrorOf> <name>Human Readable Name for this Mirror.</name> <url>http://my.repository.com/repo/path</url> </mirror> --> <mirror> <id>maven-default-http-blocker</id> <mirrorOf>external:http:*</mirrorOf> <name>Pseudo repository to mirror external repositories initially using HTTP.</name> <url>http://0.0.0.0/</url> <blocked>true</blocked> </mirror> </mirrors>
apache-maven-3.8.2 默认会阻止其他镜像,需要会去掉 maven-default-http-blocker 配置
切换到 gitlab-runner 用户,随便运行一下 mvn 命令,这样就会产生 ~/.m2 文件夹
[root@gitlab ~]# su - gitlab-runner [gitlab-runner@gitlab ~]$ mvn -v
mvnd
mvnd 是一个实验产品,用于替代 maven 编译速度比较快
cd /usr/local/src wget https://github.com/apache/maven-mvnd/releases/download/0.7.1/mvnd-0.7.1-linux-amd64.zip unzip mvnd-0.7.1-linux-amd64.zip mv mvnd-0.7.1-linux-amd64 /srv/mvnd-0.7.1 ln -s /srv/mvnd-0.7.1 /srv/mvnd alternatives --remove mvnd /usr/local/bin/mvnd alternatives --install /usr/local/bin/mvnd mvnd-0.7.1 /srv/mvnd-0.7.1/bin/mvnd 0
修改配置文件 mvnd.properties 制定 JAVA_HOME
[root@localhost cloud.netkiller.cn]# grep java.home /srv/mvnd/conf/mvnd.properties java.home=/usr/lib/jvm/java
11.5.3.5. NodeJS
[root@netkiller ~]# dnf install -y nodejs
安装 cnpm
[root@netkiller ~]# npm config set registry https://registry.npm.taobao.org [root@netkiller ~]# npm config get registry https://registry.npm.taobao.org/ [root@netkiller ~]# npm install -g cnpm
yarn
[root@netkiller ~]# curl -sL https://dl.yarnpkg.com/rpm/yarn.repo -o /etc/yum.repos.d/yarn.repo [root@netkiller ~]# dnf install -y yarn
yarn config set registry https://registry.npm.taobao.org
pm2 进程管理
[root@netkiller ~]# npm install -g pm2
设置 pm2 启动开启
[root@netkiller ~]# pm2 startup [root@netkiller ~]# pm2 save --force [root@netkiller ~]# systemctl enable pm2-root [root@netkiller ~]# systemctl start pm2-root [root@netkiller ~]# systemctl status pm2-root
11.5.3.6. Python 环境
[root@localhost ~]# dnf install -y python39
11.5.3.7. 远程执行 sudo 提示密码
[gitlab-runner@gitlab api.netkiller.cn]$ ssh www@192.168.40.10 "sudo ls" Warning: Permanently added '192.168.40.10' (ECDSA) to the list of known hosts. sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
解决方案一
ssh -t www@www.netkiller.cn "echo <yourpassword> |sudo -S <yourcommand>"
解决方案二
cat > /etc/sudoers.d/www <<-EOF www ALL=(ALL) NOPASSWD: ALL EOF
11.5.4. tags 的使用方法
tags 是给 Gitlab Runner 打个标签,我的用法是多次注册,例如 shell 执行器的标签是 shell, Docker 执行器的标签是 docker,这样便可以在.gitlab-ci.yml文件中来选择使用那个执行器来触发操作。
下面是 Shell 执行器
[root@localhost ~]# gitlab-runner register Runtime platform arch=amd64 os=linux pid=268363 revision=58ba2b95 version=14.2.0 Running in system-mode. Enter the GitLab instance URL (for example, https://gitlab.com/): http://git.netkiller.cn/ Enter the registration token: k_SsvMQV397gAMaP_q1v Enter a description for the runner: [localhost.localdomain]: development Enter tags for the runner (comma-separated): shell Registering runner... succeeded runner=k_SsvMQV Enter an executor: docker, docker-ssh, virtualbox, docker-ssh+machine, kubernetes, custom, parallels, shell, ssh, docker+machine: shell Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!
下面是 Docker 执行器
[root@localhost ~]# gitlab-runner r