わたしの部屋

1
kubectl get nodes -o wide
2
kubectl get storageclass
3
kubectl get ingress -A
4
kubectl -n kube-system get secret hyperbola-cc-wildcard-tls

1
kubectl create namespace jenkins
2

3
kubectl -n kube-system get secret hyperbola-cc-wildcard-tls -o json \
4
  | jq 'del(
5
      .metadata.creationTimestamp,
6
      .metadata.resourceVersion,
7
      .metadata.uid,
8
      .metadata.managedFields,
9
      .metadata.ownerReferences
10
    ) | .metadata.namespace="jenkins"' \
11
  | kubectl apply -f -
12

13
kubectl -n jenkins get secret hyperbola-cc-wildcard-tls

1
apiVersion: v1
2
kind: Namespace
3
metadata:
4
  name: jenkins
5
---
6
apiVersion: v1
7
kind: PersistentVolumeClaim
8
metadata:
9
  name: jenkins-home-10gi
10
  namespace: jenkins
11
spec:
12
  accessModes: [ReadWriteOnce]
13
  storageClassName: local-path
14
  resources:
15
    requests:
16
      storage: 10Gi
17
---
18
apiVersion: v1
19
kind: ServiceAccount
20
metadata:
21
  name: jenkins
22
  namespace: jenkins
23
---
24
apiVersion: rbac.authorization.k8s.io/v1
25
kind: Role
26
metadata:
27
  name: jenkins-agent-manager
28
  namespace: jenkins
29
rules:
30
  - apiGroups: [""]
31
    resources: ["pods", "pods/log", "pods/exec"]
32
    verbs: ["create", "delete", "get", "list", "watch", "patch"]
33
  - apiGroups: [""]
34
    resources: ["events"]
35
    verbs: ["get", "list", "watch"]
36
---
37
apiVersion: rbac.authorization.k8s.io/v1
38
kind: RoleBinding
39
metadata:
40
  name: jenkins-agent-manager
41
  namespace: jenkins
42
subjects:
43
  - kind: ServiceAccount
44
    name: jenkins
45
    namespace: jenkins
46
roleRef:
47
  apiGroup: rbac.authorization.k8s.io
48
  kind: Role
49
  name: jenkins-agent-manager
50
---
51
apiVersion: apps/v1
52
kind: Deployment
53
metadata:
54
  name: jenkins
55
  namespace: jenkins
56
spec:
57
  replicas: 1
58
  strategy:
59
    type: Recreate
60
  selector:
61
    matchLabels:
62
      app: jenkins
63
  template:
64
    metadata:
65
      labels:
66
        app: jenkins
67
    spec:
68
      serviceAccountName: jenkins
69
      securityContext:
70
        fsGroup: 1000
71
        fsGroupChangePolicy: OnRootMismatch
72
      containers:
73
        - name: jenkins
74
          image: jenkins/jenkins:latest
75
          imagePullPolicy: IfNotPresent
76
          env:
77
            # Jenkins 使用中国标准时间（UTC+8）显示构建记录和日志
78
            - name: TZ
79
              value: Asia/Shanghai
80
            - name: JAVA_OPTS
81
              value: -Duser.timezone=Asia/Shanghai
82
          ports:
83
            - name: http
84
              containerPort: 8080
85
            - name: agent
86
              containerPort: 50000
87
          volumeMounts:
88
            - name: jenkins-home
89
              mountPath: /var/jenkins_home
90
          startupProbe:
91
            httpGet: { path: /login, port: http }
92
            periodSeconds: 10
93
            failureThreshold: 60
94
          readinessProbe:
95
            httpGet: { path: /login, port: http }
96
            periodSeconds: 10
97
            failureThreshold: 6
98
          livenessProbe:
99
            httpGet: { path: /login, port: http }
100
            periodSeconds: 20
101
            failureThreshold: 3
102
      volumes:
103
        - name: jenkins-home
104
          persistentVolumeClaim:
105
            claimName: jenkins-home-10gi
106
---
107
apiVersion: v1
108
kind: Service
109
metadata:
110
  name: jenkins
111
  namespace: jenkins
112
spec:
113
  selector:
114
    app: jenkins
115
  ports:
116
    - name: http
117
      port: 8080
118
      targetPort: http
119
    - name: agent
120
      port: 50000
121
      targetPort: agent
122
---
123
apiVersion: networking.k8s.io/v1
124
kind: Ingress
125
metadata:
126
  name: jenkins
127
  namespace: jenkins
128
  annotations:
129
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
130
    traefik.ingress.kubernetes.io/router.priority: "1000"
131
spec:
132
  ingressClassName: traefik
133
  tls:
134
    - hosts: [jenkins.hyperbola.cc]
135
      secretName: hyperbola-cc-wildcard-tls
136
  rules:
137
    - host: jenkins.hyperbola.cc
138
      http:
139
        paths:
140
          - path: /
141
            pathType: Prefix
142
            backend:
143
              service:
144
                name: jenkins
145
                port:
146
                  name: http

1
kubectl apply -f jenkins.yaml
2
kubectl -n jenkins rollout status deployment/jenkins --timeout=10m
3
kubectl -n jenkins get pod,pvc,svc,ingress -o wide

1
kubectl -n jenkins exec deployment/jenkins -- \
2
  cat /var/jenkins_home/secrets/initialAdminPassword

1
curl -I http://jenkins.hyperbola.cc/
2
curl -I https://jenkins.hyperbola.cc/login
3
kubectl -n jenkins logs deployment/jenkins --tail=100

1
kubectl -n jenkins get deployment jenkins \
2
  -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'
3

4
kubectl auth can-i create pods \
5
  --as=system:serviceaccount:jenkins:jenkins \
6
  -n jenkins

1
podTemplate(yaml: '''
2
apiVersion: v1
3
kind: Pod
4
spec:
5
  serviceAccountName: jenkins
6
  containers:
7
    - name: shell
8
      image: alpine:3.22
9
      command: [sleep]
10
      args: [99d]
11
      tty: true
12
''') {
13
    node(POD_LABEL) {
14
        container('shell') {
15
            sh 'echo "Agent Pod: $(hostname)" && uname -a'
16
        }
17
    }
18
}

1
kubectl -n jenkins get pods -w

1
kubectl -n jenkins scale deployment/jenkins --replicas=0
2
kubectl -n jenkins wait --for=delete pod -l app=jenkins --timeout=5m
3

4
# 在 PVC 实际挂载位置执行；先核对输出，再删除。
5
find /var/jenkins_home/plugins -mindepth 1 -maxdepth 1 \
6
  -name 'blueocean*' -print
7

8
kubectl -n jenkins scale deployment/jenkins --replicas=1
9
kubectl -n jenkins rollout status deployment/jenkins --timeout=10m

1
kubectl -n jenkins get all
2
kubectl -n jenkins logs -f deployment/jenkins
3
kubectl -n jenkins rollout restart deployment/jenkins
4
kubectl -n jenkins rollout status deployment/jenkins