Kubernetes上部署Jenkins并实现动态构建节点
一、Jenkins主节点的Kubernetes部署
通过以下配置文件，将Jenkins主节点以Deployment形式部署在Kubernetes集群中。
1. Deployment配置文件（jenkins-deploy.yaml）
apiVersion: apps/v1
kind: Deployment
metadata:
name: jenkins-master
namespace: kube-ops
spec:
replicas: 1
selector:
matchLabels:
app: jenkins-master
template:
metadata:
labels:
app: jenkins-master
spec:
serviceAccountName: jenkins-sa
containers:
- name: jenkins-container
image: jenkins/jenkins:lts
ports:
- containerPort: 8080
name: http
protocol: TCP
- containerPort: 50000
name: agent
protocol: TCP
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 500m
memory: 512Mi
livenessProbe:
httpGet:
path: /login
port: 8080
initialDelaySeconds: 120
timeoutSeconds: 5
failureThreshold: 12
readinessProbe:
httpGet:
path: /login
port: 8080
volumeMounts:
- name: jenkins-data
subPath: jenkins-home
mountPath: /var/jenkins_home
securityContext:
fsGroup: 1000
nodeSelector:
kubernetes.io/hostname: k8s-node01
volumes:
- name: jenkins-data
hostPath:
path: /data/jenkins
type: Directory说明：本例使用本地路径挂载持久化数据，仅适用于测试环境。生产环境应改用PersistentVolume或StorageClass实现动态存储。
2. Service暴露服务（jenkins-svc.yaml）
apiVersion: v1
kind: Service
metadata:
name: jenkins-service
namespace: kube-ops
labels:
app: jenkins-master
spec:
selector:
app: jenkins-master
type: NodePort
ports:
- name: web
port: 8080
targetPort: http
nodePort: 30002
- name: agent
port: 50000
targetPort: agent通过NodePort方式暴露Web界面（30002端口）和JNLP通信端口（50000），便于外部访问与节点通信。
3. 权限配置（jenkin-rbac.yaml）
apiVersion: v1
kind: ServiceAccount
metadata:
name: jenkins-sa
namespace: kube-ops
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: jenkins-cluster-role
rules:
- apiGroups: ["apps", "extensions"]
resources: ["deployments"]
verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
resources: ["services", "pods", "secrets", "configmaps"]
verbs: ["create", "delete", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: jenkins-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: jenkins-cluster-role
subjects:
- kind: ServiceAccount
name: jenkins-sa
namespace: kube-ops4. 部署流程
在目标节点执行以下命令：
mkdir -p /data/jenkins
chown -R 1000:1000 /data/jenkins
kubectl create namespace kube-ops
kubectl create -f jenkin-rbac.yaml
kubectl create -f jenkins-deploy.yaml
kubectl create -f jenkins-svc.yaml
# 查看Pod状态
kubectl get pods -n kube-ops
# 获取初始管理员密码
kubectl logs -n kube-ops jenkins-master-xxxxx | grep 'initialAdminPassword'
5. Jenkins初始化配置
访问 http://<任意节点IP>:30002 完成初始设置，包括插件安装与用户创建。
二、配置动态构建节点（基于Kubernetes）
1. 设置Jenkins基础URL
进入 Manage Jenkins → Configure System，填写Jenkins对外访问地址，例如：
http://jenkins.kube-ops.svc.cluster.local:8080（若Jenkins运行在集群内）
2. 安装Kubernetes插件
通过插件管理器安装 Kubernetes Plugin。
3. 配置Kubernetes云环境
在 Cloud 配置区域添加新云，选择 Kubernetes 类型：
- Kubernetes API Server URL：若Jenkins在集群内，使用
https://kubernetes.default.svc.cluster.local/；否则使用外网地址如https://<master-ip>:6443。 - Namespace：填写
kube-ops。 - Credentials：若连接失败，请确保将
jenkins-sa对应的Secret绑定到凭证中。
4. 创建Slave Pod模板
配置如下内容：
Label: test-jnlp
Pod Template:
Namespace: kube-ops
Container:
Image: jenkins/jnlp-slave:4.13.3-1-jdk11
Resources:
Limits: CPU=1000m, Memory=2Gi
Requests: CPU=500m, Memory=512Mi
Volume Mounts:
- /var/run/docker.sock → /var/run/docker.sock
- /root/.kube → /root/.kube说明：挂载宿主机Docker socket支持"Docker in Docker"模式；挂载 .kube 目录使Slave可执行 kubectl 命令。
5. 测试任务验证
创建一个自由风格项目，标签表达式设为 test-jnlp，构建步骤如下：
echo "启动动态构建节点测试"
echo "=== 检查Java版本 ==="
java -version
echo "=== 检查Docker ==="
docker info
echo "=== 检查Kubernetes ==="
kubectl version --short执行后观察Kubernetes中是否生成了临时Pod：
kubectl get pods -n kube-ops三、使用Pipeline实现动态Slave
1. Pipeline脚本示例
pipeline {
agent {
kubernetes {
label 'test-jnlp'
cloud 'kubernetes'
yaml '''
apiVersion: v1
kind: Pod
metadata:
labels:
k8s-app: jenkins-agent
name: jenkins-agent-pod
namespace: kube-ops
spec:
containers:
- name: jenkins-agent
image: jenkins/jnlp-slave:4.13.3-1-jdk11
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: 1000m
memory: 2Gi
requests:
cpu: 500m
memory: 512Mi
volumeMounts:
- name: docker-sock
mountPath: /var/run/docker.sock
- name: kube-config
mountPath: /root/.kube
volumes:
- name: docker-sock
hostPath:
path: /var/run/docker.sock
- name: kube-config
hostPath:
path: /root/.kube
'''
}
}
stages {
stage('Test') {
steps {
script {
sh 'java -version && sleep 30'
}
}
}
}
}2. 验证结果
触发Pipeline后，系统会自动创建临时Pod进行任务执行，完成后自动销毁。可通过Kubernetes事件日志确认生命周期。
