Jenkins使用k8s插件在JNLP容器上运行。

huangapple
go评论112阅读模式
英文:

Jenkins using k8s plugin runs on JNLP container

问题

I've decided to run a podTemplate with one container of main.

  1. 为什么我的 pod 模板配置中包含 JNLP？它是什么作用？我是否可以只有我的容器和我的镜像而没有 JNLP？
  2. 如何将 JNLP 镜像覆盖为我的镜像，而不是传入的镜像？
  3. 如何在我的 pod/container "main" 上运行我的作业，而不是在 JNLP 上运行？

Jenkins使用k8s插件在JNLP容器上运行。
Jenkins使用k8s插件在JNLP容器上运行。

我的 Jenkins 配置代码 -

  1. config:
  2.   Jenkins:cluster: non-prod
  3.   Jenkins:secrets:
  4.     create: true
  5.     secretsList:
  6.       - name: jenkins-github-token-non-prod
  7.         value: /us-west-2-non-prod/jenkins/secrets/github-token
  8.       - name: jenkins-slack-token-non-prod
  9.         value: /us-west-2-non-prod/jenkins/secrets/slack-token
  10.   Jenkins:config:
  11.     chart: jenkins
  12.     namespace: default
  13.     repo: https://charts.jenkins.io
  14.     values:
  15.       agent:
  16.         enabled: true
  17.         podTemplates:
  18.           jenkins-slave-pod: |
  19.             - name: jenkins-slave-pod
  20.               label: jenkins-slave-pod
  21.               containers:
  22.                 - name: main
  23.                   image: '805787217936.dkr.ecr.us-west-2.amazonaws.com/aba-jenkins-slave:ecs-global-node_master_57'
  24.                   command: "sleep"
  25.                   args: "30d"
  26.                   privileged: true            
  27.         master.JCasC.enabled: true
  28.         master.JCasC.defaultConfig: true
  29.         kubernetesConnectTimeout: 5
  30.         kubernetesReadTimeout: 15
  31.         maxRequestsPerHostStr: "32"
  32.         namespace: default
  33.         image: "805787217936.dkr.ecr.us-west-2.amazonaws.com/aba-jenkins-slave"
  34.         tag: "ecs-global-node_master_57"
  35.         workingDir: "/home/jenkins/agent"
  36.         nodeUsageMode: "NORMAL"
  37.         imagePullSecretName:
  38.         componentName: "eks-global-slave"
  39.         websocket: false
  40.         privileged: false
  41.         runAsUser:
  42.         runAsGroup:
  43.         resources:
  44.           requests:
  45.             cpu: "512m"
  46.             memory: "512Mi"
  47.           limits:
  48.             cpu: "512m"
  49.             memory: "512Mi"
  50.         podRetention: "Never"
  51.         volumes: [ ]
  52.         workspaceVolume: { }
  53.         envVars: [ ]
  54.         command:
  55.         args: "${computer.jnlpmac} ${computer.name}"
  56.         sideContainerName: "jnlp"
  57.         TTYEnabled: true
  58.         containerCap: 10
  59.         podName: "jnlp"
  60.         idleMinutes: 0
  61.         connectTimeout: 100
  62.       serviceAccount:
  63.         annotations: {}
  64.       controller:
  65.         numExecutors: 1
  66.         additionalExistingSecrets: []
  67.         JCasC:
  68.           securityRealm: |
  69.             local:
  70.                   allowsSignup: false
  71.                   users:
  72.                     - id: "aba"
  73.                       password: "aba"            
  74.           configScripts:
  75.             credentials: |
  76.               credentials:
  77.                 system:
  78.                   domainCredentials:
  79.                     - credentials:
  80.                         - string:
  81.                             scope: GLOBAL
  82.                             id: slack-token
  83.                             description: "Slack access token"
  84.                             secret: "${jenkins-slack-token-non-prod-value}"
  85.                         - usernamePassword:
  86.                             id: "github-credentials"
  87.                             password: "aba"
  88.                             scope: GLOBAL
  89.                             username: "aba"              
  90.             plugin-config: |
  91.               jenkins:
  92.                 disabledAdministrativeMonitors:
  93.                   - "hudson.model.UpdateCenter$CoreUpdateMonitor"
  94.                   - "jenkins.diagnostics.ControllerExecutorsNoAgents"
  95.               security:
  96.                 updateSiteWarningsConfiguration:
  97.                   ignoredWarnings:
  98.                     - "core-2_263"
  99.                     - "SECURITY-2617-extended-choice-parameter"
  100.                     - "SECURITY-2170"
  101.                     - "SECURITY-2796"
  102.                     - "SECURITY-2169"
  103.                     - "SECURITY-2332"
  104.                     - "SECURITY-2232"
  105.                     - "SECURITY-1351"
  106.                     - "SECURITY-1350"
  107.                     - "SECURITY-2888"
  108.               unclassified:
  109.                 slackNotifier:
  110.                   teamDomain: "superops"
  111.                   baseUrl: "https://superops.slack.com/services/hooks/jenkins-ci/"
  112.                   tokenCredentialId: "slack-token"
  113.                 globalLibraries:
  114.                   libraries:
  115.                     - defaultVersion: "master"
  116.                       allowVersionOverride: true
  117.                       name: "aba-jenkins-library"
  118.                       implicit: true
  119.                       retriever:
  120.                         modernSCM:
  121.                           scm:
  122.                             git:
  123.                               credentialsId: "github-credentials"
  124.                               id: "shared-library-creds"
  125.                               remote: "https://github.com/aba-aba/aba-jenkins-library.git"
  126.                               traits:
  127.                                 - "gitBranchDiscovery"
  128.                                 - "cleanBeforeCheckoutTrait"
  129.                                 - "ignoreOnPushNotificationTrait"              
  130.         additionalPlugins:
  131.         - junit:1119.1121.vc43d0fc45561
  132.         - prometheus:2.0.11
  133.         - saml:4.352.vb_722786ea_79d
  134.         - role-strategy:546.ve16648865996
  135.         - blueocean-web:1.25.5
  136.         - github-branch-source:1677.v731f745ea_0cf
  137.         - git-changelog:3.23
  138.         - scriptler:3.5
  139.         - sshd:3.249.v2dc2ea_416e33
  140.         - rich-text-publisher-plugin:1.4
  141.         - matrix-project:785.v06b_7f47b_c631
  142.         - build-failure-analyzer:2.3.0
  143.         - testng-plugin:555.va0d5f66521e3
  144.         - allure-jenkins-plugin:2.30.2
  145.         - timestamper:1.18
  146.         - ws-cleanup:0.42
  147.         - build-timeout:1.21
  148.         - slack:616.v03b_1e98d13dd
  149.         - email-ext:2.91
  150.         - docker-commons:1.19
  151.         - docker-workflow:521.v1a_a_dd2073b_2e
  152.         - rundeck:3.6.11
  153.         - parameter-separator:1.3
  154.         - extended-choice-parameter:346.vd87693c5a_86c
  155.         - uno-choice:2.6.3
  156.         adminPassword: ""
  157.         ingress:
  158.           enabled: true
  159.           hostName: jenkins.non-prod.us-west-2.int.isappcloud.com
  160.           ingressClassName: nginx-int
  161.         installPlugins:
  162.         - kubernetes:3883.v4d70a_a_a_df034
  163.         - workflow-aggregator:590.v6a_d052e5a_a_b_5
  164.         - git:5.0.0
  165.         - configuration-as-code:1569.vb_72405
  167. <details>
  168. <summary>英文:</summary>
  170. I&#39;ve decided to run a podTemplate with one container of main.
  172. 1. Why does my pod template configuration include JNLP? What is needed for? can I have only my pod with my container with my image?
  173. 2. How do I overwrite the JNLP image with my image instead of inbound image?
  174. 3. How do I run my job on my pod/container of &#39;main&#39; and not JNLP?
  176. [![enter image description here][1]][1]
  177. [![enter image description here][2]][2]
  181. My Jenkins configuration as code -
  183. ```config:
  184.   Jenkins:cluster: non-prod
  185.   Jenkins:secrets:
  186.     create: true
  187.     secretsList:
  188.       - name: jenkins-github-token-non-prod
  189.         value: /us-west-2-non-prod/jenkins/secrets/github-token
  190.       - name: jenkins-slack-token-non-prod
  191.         value: /us-west-2-non-prod/jenkins/secrets/slack-token
  192.   Jenkins:config:
  193.     chart: jenkins
  194.     namespace: default
  195.     repo: https://charts.jenkins.io
  196.     values:
  197.       agent:
  198.         enabled: true
  199.         podTemplates:
  200.           jenkins-slave-pod: |
  201.             - name: jenkins-slave-pod
  202.               label: jenkins-slave-pod
  203.               containers:
  204.                 - name: main
  205.                   image: &#39;805787217936.dkr.ecr.us-west-2.amazonaws.com/aba-jenkins-slave:ecs-global-node_master_57&#39;
  206.                   command: &quot;sleep&quot;
  207.                   args: &quot;30d&quot;
  208.                   privileged: true            
  209.         master.JCasC.enabled: true
  210.         master.JCasC.defaultConfig: true
  211.         kubernetesConnectTimeout: 5
  212.         kubernetesReadTimeout: 15
  213.         maxRequestsPerHostStr: &quot;32&quot;
  214.         namespace: default
  215.         image: &quot;805787217936.dkr.ecr.us-west-2.amazonaws.com/aba-jenkins-slave&quot;
  216.         tag: &quot;ecs-global-node_master_57&quot;
  217.         workingDir: &quot;/home/jenkins/agent&quot;
  218.         nodeUsageMode: &quot;NORMAL&quot;
  219.         # name of the secret to be used for image pulling
  220.         imagePullSecretName:
  221.         componentName: &quot;eks-global-slave&quot;
  222.         websocket: false
  223.         privileged: false
  224.         runAsUser:
  225.         runAsGroup:
  226.         resources:
  227.           requests:
  228.             cpu: &quot;512m&quot;
  229.             memory: &quot;512Mi&quot;
  230.           limits:
  231.             cpu: &quot;512m&quot;
  232.             memory: &quot;512Mi&quot;
  233.         podRetention: &quot;Never&quot;
  234.         volumes: [ ]
  235.         workspaceVolume: { }
  236.         envVars: [ ]
  237.         # - name: PATH
  238.         #   value: /usr/local/bin
  239.         command:
  240.         args: &quot;${computer.jnlpmac} ${computer.name}&quot;
  241.         # Side container name
  242.         sideContainerName: &quot;jnlp&quot;
  243.         # Doesn&#39;t allocate pseudo TTY by default
  244.         TTYEnabled: true
  245.         # Max number of spawned agent
  246.         containerCap: 10
  247.         # Pod name
  248.         podName: &quot;jnlp&quot;
  249.         # Allows the Pod to remain active for reuse until the configured number of
  250.         # minutes has passed since the last step was executed on it.
  251.         idleMinutes: 0
  252.         # Timeout in seconds for an agent to be online
  253.         connectTimeout: 100
  254.       serviceAccount:
  255.         annotations: {}
  256.       controller:
  257.         numExecutors: 1
  258.         additionalExistingSecrets: []
  259.         JCasC:
  260.           securityRealm: |
  261.             local:
  262.                   allowsSignup: false
  263.                   users:
  264.                     - id: &quot;aba&quot;
  265.                       password: &quot;aba&quot;            
  266. #          securityRealm: |
  267. #            saml:
  268. #              binding: &quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect&quot;
  269. #              displayNameAttributeName: &quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name&quot;
  270. #              groupsAttributeName: &quot;http://schemas.xmlsoap.org/claims/Group&quot;
  271. #              idpMetadataConfiguration:
  272. #                period: 0
  273. #                url: &quot;https://aba.onelogin.com/saml/metadata/34349e62-799f-4378-9d2a-03b870cbd965&quot;
  274. #              maximumAuthenticationLifetime: 86400
  275. #              usernameCaseConversion: &quot;none&quot;
  276. #          authorizationStrategy: |-
  277. #            roleBased:
  278. #              forceExistingJobs: true
  279.           configScripts:
  280.             credentials: |
  281.               credentials:
  282.                 system:
  283.                   domainCredentials:
  284.                     - credentials:
  285.                         - string:
  286.                             scope: GLOBAL
  287.                             id: slack-token
  288.                             description: &quot;Slack access token&quot;
  289.                             secret: &quot;${jenkins-slack-token-non-prod-value}&quot;
  290.                         - usernamePassword:
  291.                             id: &quot;github-credentials&quot;
  292.                             password: &quot;aba&quot;
  293.                             scope: GLOBAL
  294.                             username: &quot;aba&quot;              
  295.             plugin-config: |
  296.               jenkins:
  297.                 disabledAdministrativeMonitors:
  298.                   - &quot;hudson.model.UpdateCenter$CoreUpdateMonitor&quot;
  299.                   - &quot;jenkins.diagnostics.ControllerExecutorsNoAgents&quot;
  300.               security:
  301.                 updateSiteWarningsConfiguration:
  302.                   ignoredWarnings:
  303.                     - &quot;core-2_263&quot;
  304.                     - &quot;SECURITY-2617-extended-choice-parameter&quot;
  305.                     - &quot;SECURITY-2170&quot;
  306.                     - &quot;SECURITY-2796&quot;
  307.                     - &quot;SECURITY-2169&quot;
  308.                     - &quot;SECURITY-2332&quot;
  309.                     - &quot;SECURITY-2232&quot;
  310.                     - &quot;SECURITY-1351&quot;
  311.                     - &quot;SECURITY-1350&quot;
  312.                     - &quot;SECURITY-2888&quot;
  313.               unclassified:
  314.                 slackNotifier:
  315.                   teamDomain: &quot;superops&quot;
  316.                   baseUrl: &quot;https://superops.slack.com/services/hooks/jenkins-ci/&quot;
  317.                   tokenCredentialId: &quot;slack-token&quot;
  318.                 globalLibraries:
  319.                   libraries:
  320.                     - defaultVersion: &quot;master&quot;
  321.                       allowVersionOverride: true
  322.                       name: &quot;aba-jenkins-library&quot;
  323.                       implicit: true
  324.                       retriever:
  325.                         modernSCM:
  326.                           scm:
  327.                             git:
  328.                               credentialsId: &quot;github-credentials&quot;
  329.                               id: &quot;shared-library-creds&quot;
  330.                               remote: &quot;https://github.com/aba-aba/aba-jenkins-library.git&quot;
  331.                               traits:
  332.                                 - &quot;gitBranchDiscovery&quot;
  333.                                 - &quot;cleanBeforeCheckoutTrait&quot;
  334.                                 - &quot;ignoreOnPushNotificationTrait&quot;              
  335.         additionalPlugins:
  336.         - junit:1119.1121.vc43d0fc45561
  337.         - prometheus:2.0.11
  338.         - saml:4.352.vb_722786ea_79d
  339.         - role-strategy:546.ve16648865996
  340.         - blueocean-web:1.25.5
  341.         - github-branch-source:1677.v731f745ea_0cf
  342.         - git-changelog:3.23
  343.         - scriptler:3.5
  344.         - sshd:3.249.v2dc2ea_416e33
  345.         - rich-text-publisher-plugin:1.4
  346.         - matrix-project:785.v06b_7f47b_c631
  347.         - build-failure-analyzer:2.3.0
  348.         - testng-plugin:555.va0d5f66521e3
  349.         - allure-jenkins-plugin:2.30.2
  350.         - timestamper:1.18
  351.         - ws-cleanup:0.42
  352.         - build-timeout:1.21
  353.         - slack:616.v03b_1e98d13dd
  354.         - email-ext:2.91
  355.         - docker-commons:1.19
  356.         - docker-workflow:521.v1a_a_dd2073b_2e
  357.         - rundeck:3.6.11
  358.         - parameter-separator:1.3
  359.         - extended-choice-parameter:346.vd87693c5a_86c
  360.         - uno-choice:2.6.3
  361.         adminPassword: &quot;&quot;
  362.         ingress:
  363.           enabled: true
  364.           hostName: jenkins.non-prod.us-west-2.int.isappcloud.com
  365.           ingressClassName: nginx-int
  366.         installPlugins:
  367.         - kubernetes:3883.v4d70a_a_a_df034
  368.         - workflow-aggregator:590.v6a_d052e5a_a_b_5
  369.         - git:5.0.0
  370.         - configuration-as-code:1569.vb_72405b_80249
  371.         jenkinsUrlProtocol: https
  372.         prometheus:
  373.           enabled: true
  374.         resources:
  375.           limits:
  376.             cpu: &quot;4&quot;
  377.             memory: 8Gi
  378.           requests:
  379.             cpu: &quot;2&quot;
  380.             memory: 4Gi
  381.         sidecars:
  382.           configAutoReload:
  383.             resources:
  384.               requests:
  385.                 cpu: 128m
  386.                 memory: 256Mi
  387.         statefulSetAnnotations:
  388.           pulumi.com/patchForce: &quot;true&quot;
  389.           Name: eks-non-prod-us-west-2-jenkins
  390.           department: aba
  391.           division: enterprise
  392.           environment: non-prod
  393.           owner: devops
  394.           project: eks-non-prod-us-west-2-jenkins
  395.           team: infra
  396.         tag: 2.362-jdk11
  397.     version: 4.1.13
  398.   Jenkins:stackTags:
  399.     Name: eks-non-prod-us-west-2-jenkins
  400.     department: aba
  401.     division: enterprise
  402.     environment: non-prod
  403.     owner: devops
  404.     project: eks-non-prod-us-west-2-jenkins
  405.     team: infra
  406.   aws:region: us-west-2

答案1

得分: 1

以下是翻译好的内容：

Kubernetes插件分配Jenkins代理在Kubernetes pod中。在这些pod中，总是有一个特殊的容器jnlp，它运行Jenkins代理。其他容器可以运行您选择的任意进程，并且可以在代理pod的任何容器中动态运行命令...
默认情况下，命令将在运行Jenkins代理的jnlp容器中执行。 (jnlp的名称是历史原因，为了兼容性而保留。)
...此外，在Kubernetes Pod模板部分，我们需要配置将用于启动代理pod的镜像。除非在不寻常情况下，我们不建议覆盖jnlp容器。

https://plugins.jenkins.io/kubernetes/

要自定义jnlp镜像，您可以在代理块中指定，然后在容器块中使用容器标签来运行该容器：

英文:

The kubernetes plugin has a summary of what the JNLP is used for. It's recommended to retain the JNLP container, and the name is JNLP mostly for historical reasons. It sounds like it's not JWS.

> The Kubernetes plugin allocates Jenkins agents in Kubernetes pods. Within these pods, there is always one special container jnlp that is running the Jenkins agent. Other containers can run arbitrary processes of your choosing, and it is possible to run commands dynamically in any container in the agent pod...
> Commands will be executed by default in the jnlp container, where the Jenkins agent is running. (The jnlp name is historical and is retained for compatibility.)
>...In addition to that, in the Kubernetes Pod Template section, we need to configure the image that will be used to spin up the agent pod. We do not recommend overriding the jnlp container except under unusual circumstances.

https://plugins.jenkins.io/kubernetes/

To customize the jnlp image you specify that in the agent block then using the container label in the container block to run on that container:

  1. pipeline {
  2. agent {
  3. kubernetes {
  4. yaml &#39;&#39;&#39;
  5. apiVersion: v1
  6. kind: Pod
  7. metadata:
  8. labels:
  9. some-label: some-label-value
  10. spec:
  11. containers:
  12. - name: jnlp
  13. image: &#39;jenkins/inbound-agent&#39;     // your image you want to override
  14. args: [&#39;\$(JENKINS_SECRET)&#39;, &#39;\$(JENKINS_NAME)&#39;]
  15. - name: maven
  16. image: maven:alpine
  17. command:
  18. - cat
  19. tty: true
  20. - name: busybox
  21. image: busybox
  22. command:
  23. - cat
  24. tty: true
  25. &#39;&#39;&#39;
  26. retries 2
  27. }
  28. }
  29. stages {
  30. stage(&#39;Run maven&#39;) {
  31. steps {
  32. container(&#39;maven&#39;) { // specify which container to run this on
  33. sh &#39;mvn -version&#39;
  34. }
  35. container(&#39;busybox&#39;) {
  36. sh &#39;/bin/busybox&#39;
  37. }
  38. }
  39. }
  40. }
  41. }

huangapple
  • 本文由 发表于 2023年2月23日 22:02:26
  • 转载请务必保留本文链接：https://go.coder-hub.com/75545833.html
  • docker
  • groovy
  • jenkins
  • kubernetes
  • kubernetes-helm
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定