k8s部署jenkins（手撕yaml）

 一、准备YAML文件

cat > ~/jenkins/Jenkins-rbac.yaml << EOF
apiVersion: v1
kind: Namespace
metadata:
  name: jenkins
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: jenkins
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: jenkins
rules:
- apiGroups:
  - '*'
  resources:
  - statefulsets
  - services
  - replicationcontrollers
  - replicasets
  - podtemplates
  - podsecuritypolicies
  - pods
  - pods/log
  - pods/exec
  - podpreset
  - poddisruptionbudget
  - persistentvolumes
  - persistentvolumeclaims
  - jobs
  - endpoints
  - deployments
  - deployments/scale
  - daemonsets
  - cronjobs
  - configmaps
  - namespaces
  - events
  - secrets
  verbs:
  - create
  - get
  - watch
  - delete
  - list
  - patch
  - update
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
  - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkins
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:jenkins
EOF

cat > ~/jenkins/Jenkins-Deployment.yaml << EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
  labels:
    app: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      containers:
      - name: jenkins
        image: jenkins/jenkins:lts-jdk11
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        - containerPort: 50000
          name: agent
          protocol: TCP
        #resources:
          #limits:
            #memory: 4Gi
            #cpu: "2000m"
          #requests:
            #memory: 4Gi
            #cpu: "2000m"
        env:
        - name: LIMITS_MEMORY
          valueFrom:
            resourceFieldRef:
              resource: limits.memory
              divisor: 1Mi
        - name: JAVA_OPTS
          value: -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true
        volumeMounts:
        - name: jenkins-home
          mountPath: /var/jenkins_home
      volumes:
      - name: jenkins-home
        persistentVolumeClaim:
          claimName: jenkins-home
---
apiVersion: v1
kind:  PersistentVolumeClaim
metadata:
  name: jenkins-home
  namespace: jenkins
spec:
  storageClassName: "jenkins-nfs-sc"
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 20Gi
EOF

cat > ~/jenkins/Jenkins-Service.yaml << EOF
apiVersion: v1
kind: Service
metadata:
  name: jenkins
  namespace: jenkins
  labels:
    app: jenkins
spec:
  selector:
    app: jenkins
  ports:
  - name: web
    port: 8080
    targetPort: web
  - name: agent
    port: 50000
    targetPort: agent
EOF

cat > ~/jenkins/jenkins-nfs-sc.yml << EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: jenkins-nfs-sc
provisioner: fuseim.pri/ifs 
parameters:
  archiveOnDelete: "false"
EOF

二、启动容器

kubectl apply -f jenkins-nfs-sc.yml
kubectl apply -f Jenkins-rbac.yaml -f Jenkins-Deployment.yaml -f Jenkins-Service.yaml

三、自签名证书

mkdir ~/jenkins/https && cd ~/jenkins/https

openssl req -x509 -nodes -days 36500 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=my.test.com"

# 要注意证书文件名称必须是 tls.crt 和 tls.key

# kubectl -n jenkins create secret tls jenkins-tls --cert=tls.crt --key=tls.key
secret/gitlab-tls created

# kubectl get secret -n jenkins |grep jenkins-tls

cat > ingress.yml << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins
  namespace: jenkins
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
spec:
  ingressClassName: nginx
  rules:
  - host: my.hhhjenkins.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: jenkins # 将所有请求发送到 jenkins 服务的 8080 端口
            port:
              number: 8080
  tls:
  - hosts:
    - my.test.com
    secretName: jenkins-tls
EOF

kubectl apply -f ingress.yml

kubectl get ing -n jenkins

登录密码：

kubectl get pods -n jenkins -l app=jenkins

kubectl logs -f jenkins-746b5b5d65-r9m8q -n jenkins #初始化密钥就在日志里面

访问地址：

my.test.com

http://my.test.com

https://my.test.com

配置NodePort（目的是让webhook钩子直接使用ip）

# kubectl edit svc jenkins -n jenkins

# kubectl get svc -n jenkins
NAME      TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                          AGE
jenkins   NodePort   10.100.241.123   <none>        8080:32767/TCP,50000:30750/TCP   9m38s