Gitlab+Jenkins Pipeline+Docker+k8s+Helm自动化部署实践（干货！）

123456789101112131415161718

FROM frolvlad/alpine-java:jdk8-slim#在build镜像时可以通过 --build-args profile=xxx 进行修改ARG profileENV SPRING_PROFILES_ACTIVE=${profile}#项目的端口EXPOSE 8000 WORKDIR /mnt#修改时区RUN sed -i ‘s/dl-cdn.alpinelinux.org/mirrors.ustc.edu.cn/g‘ /etc/apk/repositories \    && apk add --no-cache tzdata \    && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \    && echo "Asia/Shanghai" > /etc/timezone \    && apk del tzdata \    && rm -rf /var/cache/apk/* /tmp/* /var/tmp/* $HOME/.cacheCOPY ./target/your-project-name-1.0-SNAPSHOT.jar ./app.jarENTRYPOINT ["java", "-jar", "/mnt/app.jar"]

12345678910

helm                                    - chart包的目录名├── templates                           - k8s配置模版目录│   ├── deployment.yaml                 - Deployment配置模板，定义如何部署Pod│   ├── _helpers.tpl                    - 以下划线开头的文件，helm视为公共库定义文件，用于定义通用的子模版、函数、变量等│   ├── ingress.yaml                    - Ingress配置模板，定义外部如何访问Pod提供的服务，类似于Nginx的域名路径配置│   ├── NOTES.txt                       - chart包的帮助信息文件，执行helm install命令成功后会输出这个文件的内容│   └── service.yaml                    - Service配置模板，配置访问Pod的服务抽象，有NodePort与ClusterIp等|── values.yaml                         - chart包的参数配置文件，各模版文件可以引用这里的参数├── Chart.yaml                          - chart定义，可以定义chart的名字，版本号等信息├── charts                              - 依赖的子包目录，里面可以包含多个依赖的chart包，一般不存在依赖，我这里将其删除了

1234567

apiVersion: v2name: your-chart-namedescription: A Helm chart for Kubernetestype: applicationversion: 1.0.0appVersion: 1.16.0

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657

#部署Pod的副本数，即运行多少个容器replicaCount: 1#容器镜像配置image:  repository: registry.cn-hangzhou.aliyuncs.com/demo/demo  pullPolicy: Always  # Overrides the image tag whose default is the chart version.  tag: "dev"#镜像仓库访问凭证imagePullSecrets:  - name: aliyun-registry-secret#覆盖启动容器名称nameOverride: ""fullnameOverride: ""#容器的端口暴露及环境变量配置container:  port: 8000  env: []#ServiceAccount，默认不创建serviceAccount:  # Specifies whether a service account should be created  create: false  # Annotations to add to the service account  annotations: {}  name: ""podAnnotations: {}podSecurityContext: {}  # fsGroup: 2000securityContext: {}  # capabilities:  #   drop:  #   - ALL  # readOnlyRootFilesystem: true  # runAsNonRoot: true  # runAsUser: 1000#使用NodePort的service，默认为ClusterIpservice:  type: NodePort  port: 8000#外部访问Ingress配置，需要配置hosts部分ingress:  enabled: true  annotations: {}    # kubernetes.io/ingress.class: nginx    # kubernetes.io/tls-acme: "true"  hosts:    - host: demo.com      paths: ["/demo"]  tls: []  #  - secretName: chart-example-tls  #    hosts:  #      - chart-example.local  #.... 省略了其它默认参数配置

123456

# 登录Docker Registry生成/root/.docker/config.json文件sudo docker login --username=your-username registry.cn-shenzhen.aliyuncs.com# 创建namespace develop（我这里是根据项目的环境分支名称建立namespace）kubectl create namespace develop# 在namespace develop中创建一个secretkubectl create secret generic aliyun-registry-secret --from-file=.dockerconfigjson=/root/.docker/config.json  --type=kubernetes.io/dockerconfigjson --namespace=develop

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596

image_tag = "default"  //定一个全局变量，存储Docker镜像的tag（版本）pipeline {    agent any    environment {        GIT_REPO = "${env.gitlabSourceRepoName}"  //从Jenkins Gitlab插件中获取Git项目的名称        GIT_BRANCH = "${env.gitlabTargetBranch}"  //项目的分支        GIT_TAG = sh(returnStdout: true,script: ‘git describe --tags --always‘).trim()  //commit id或tag名称        DOCKER_REGISTER_CREDS = credentials(‘aliyun-docker-repo-creds‘) //docker registry凭证        KUBE_CONFIG_LOCAL = credentials(‘local-k8s-kube-config‘)  //开发测试环境的kube凭证        KUBE_CONFIG_PROD = "" //credentials(‘prod-k8s-kube-config‘) //生产环境的kube凭证        DOCKER_REGISTRY = "registry.cn-hangzhou.aliyuncs.com" //Docker仓库地址        DOCKER_NAMESPACE = "your-namespace"  //命名空间        DOCKER_IMAGE = "${DOCKER_REGISTRY}/${DOCKER_NAMESPACE}/${GIT_REPO}" //Docker镜像地址        INGRESS_HOST_DEV = "dev.your-site.com"    //开发环境的域名        INGRESS_HOST_TEST = "test.your-site.com"  //测试环境的域名        INGRESS_HOST_PROD = "prod.your-site.com"  //生产环境的域名    }    parameters {        string(name: ‘ingress_path‘, defaultValue: ‘/your-path‘, description: ‘服务上下文路径‘)        string(name: ‘replica_count‘, defaultValue: ‘1‘, description: ‘容器副本数量‘)    }    stages {        stage(‘Code Analyze‘) {            agent any            steps {               echo "1. 代码静态检查"            }        }        stage(‘Maven Build‘) {            agent {                docker {                    image ‘maven:3-jdk-8-alpine‘                    args ‘-v $HOME/.m2:/root/.m2‘                }            }            steps {                echo "2. 代码编译打包"                sh ‘mvn clean package -Dfile.encoding=UTF-8 -DskipTests=true‘            }        }        stage(‘Docker Build‘) {            agent any            steps {                echo "3. 构建Docker镜像"                echo "镜像地址： ${DOCKER_IMAGE}"                //登录Docker仓库                sh "sudo docker login -u ${DOCKER_REGISTER_CREDS_USR} -p ${DOCKER_REGISTER_CREDS_PSW} ${DOCKER_REGISTRY}"                script {                    def profile = "dev"                    if (env.gitlabTargetBranch == "develop") {                        image_tag = "dev." + env.GIT_TAG                    } else if (env.gitlabTargetBranch == "pre-release") {                        image_tag = "test." + env.GIT_TAG                        profile = "test"                    } else if (env.gitlabTargetBranch == "master"){                        // master分支则直接使用Tag                        image_tag = env.GIT_TAG                        profile = "prod"                    }                    //通过--build-arg将profile进行设置，以区分不同环境进行镜像构建                    sh "docker build  --build-arg profile=${profile} -t ${DOCKER_IMAGE}:${image_tag} ."                    sh "sudo docker push ${DOCKER_IMAGE}:${image_tag}"                    sh "docker rmi ${DOCKER_IMAGE}:${image_tag}"                }            }        }        stage(‘Helm Deploy‘) {            agent {                docker {                    image ‘lwolf/helm-kubectl-docker‘                    args ‘-u root:root‘                }            }            steps {                echo "4. 部署到K8s"                sh "mkdir -p /root/.kube"                script {                    def kube_config = env.KUBE_CONFIG_LOCAL                    def ingress_host = env.INGRESS_HOST_DEV                    if (env.gitlabTargetBranch == "pre-release") {                        ingress_host = env.INGRESS_HOST_TEST                    } else if (env.gitlabTargetBranch == "master"){                        ingress_host = env.INGRESS_HOST_PROD                        kube_config = env.KUBE_CONFIG_PROD                    }                    sh "echo ${kube_config} | base64 -d > /root/.kube/config"                    //根据不同环境将服务部署到不同的namespace下，这里使用分支名称                    sh "helm upgrade -i --namespace=${env.gitlabTargetBranch} --set replicaCount=${params.replica_count} --set image.repository=${DOCKER_IMAGE} --set image.tag=${image_tag} --set nameOverride=${GIT_REPO} --set ingress.hosts[0].host=${ingress_host} --set ingress.hosts[0].paths={${params.ingress_path}} ${GIT_REPO} ./helm/"                }            }        }    }}

12

DOCKER_REGISTER_CREDS = credentials(‘aliyun-docker-repo-creds‘) //docker registry凭证KUBE_CONFIG_LOCAL = credentials(‘local-k8s-kube-config‘)  //开发测试环境的kube凭证

12

base64 /root/.kube/config > kube-config-base64.txtcat kube-config-base64.txt