GitOps平台搭建及实践总结

FROM jenkins/jenkins:2.356-jdk11
USER root
RUN apt-get update && apt-get install -y lsb-release
RUN curl -fsSLo /usr/share/keyrings/docker-archive-keyring.asc \
  https://download.docker.com/linux/debian/gpg
RUN echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/usr/share/keyrings/docker-archive-keyring.asc] \
  https://download.docker.com/linux/debian \
  $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list
RUN apt-get update && apt-get install -y docker-ce-cli python3 python3-pip && rm -rf /var/lib/apt/lists/*
RUN pip3 install --no-cache --upgrade pip setuptools -i https://pypi.tuna.tsinghua.edu.cn/simple
RUN pip install awscli -i https://pypi.tuna.tsinghua.edu.cn/simple
USER jenkins
RUN jenkins-plugin-cli --plugins "blueocean:1.25.5 docker-workflow:1.28"

docker build -t jenkins:jenkins:2.356-jdk11-aws .

docker network create jenkins

docker run \
  --name jenkins-docker \
  --detach \
  --privileged \
  --network jenkins \
  --network-alias docker \
  --env DOCKER_TLS_CERTDIR=/certs \
  --volume jenkins-docker-certs:/certs/client \
  --volume jenkins-data:/var/jenkins_home \
  --publish 2376:2376 \
  docker:dind \
  --storage-driver overlay2

docker run \
  --name jenkins-blueocean \
  --restart=on-failure \
  --detach \
  --network jenkins \
  --env DOCKER_HOST=tcp://docker:2376 \
  --env DOCKER_CERT_PATH=/certs/client \
  --env DOCKER_TLS_VERIFY=1 \
  --publish 8080:8080 \
  --publish 50000:50000 \
  --volume jenkins-data:/var/jenkins_home \
  --volume jenkins-docker-certs:/certs/client:ro \
  jenkins:jenkins:2.356-jdk11-aws

pipeline {
    agent any
    post {
      failure {
        updateGitlabCommitStatus name: 'build', state: 'failed'
      }
      success {
        updateGitlabCommitStatus name: 'build', state: 'success'
      }
    }
    options {
      gitLabConnection('gitlab')
    }
    triggers {
        gitlab(triggerOnPush: true, triggerOnMergeRequest: true, branchFilterType: 'All')
    }
    environment {
        AWS_ACCESS_KEY_ID     = credentials('aws-ak')
        AWS_SECRET_ACCESS_KEY = credentials('aws-sk')
    }
    stages {
        stage('Build') {
            agent {
                docker {
                    image 'maven:3.8.6-openjdk-8-slim'
                    args '-v $HOME/.m2:/root/.m2:z -u root'
                    reuseNode true
                }

            }
            steps {
                sh 'echo $HOME'
                sh 'mvn clean install -DskipTests=true -Dmaven.javadoc.skip=true -U -B -V'
            }
        }

        stage('Build docker image') {
            steps {
                script {
                    dockerImage = docker.build "1234555.dkr.ecr.cn-northwest-1.amazonaws.com.cn/app:dev"
                }
            }
        }

        stage('Login AWS ECR') {
            steps {
                sh "aws ecr get-login-password --region cn-northwest-1 | docker login --username AWS --password-stdin 123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn"
            }
        }

        stage('Push image to ECR') {
            steps {
                sh "docker push 123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn/app:dev"
            }
        }
        stage('Deploy') {
            steps {
                sshagent (credentials: ['backend-dev-ec2']) {
                    sh 'ssh -o StrictHostKeyChecking=no -l ec2-user hostname "cd docker_deploy/app && sh ./pull_image.sh && sh ./kill.sh && sh ./start.sh"'
                }
            }
        }
    }
}

pipeline {
    agent any
    post {
      failure {
        updateGitlabCommitStatus name: 'build', state: 'failed'
      }
      success {
        updateGitlabCommitStatus name: 'build', state: 'success'
      }
    }
    options {
      gitLabConnection('gitlab')
    }
    triggers {
        gitlab(triggerOnPush: true, triggerOnMergeRequest: true, branchFilterType: 'All')
    }
    environment {
        AWS_ACCESS_KEY_ID     = credentials('aws-ak')
        AWS_SECRET_ACCESS_KEY = credentials('aws-sk')
    }
    stages {
        stage('Build') {
            agent {
                docker {
                    image 'node:14'
                    reuseNode true
                }

            }
            steps {
                sh 'npm install'
                sh 'npm run build:dev'
                sh 'ls -al .'
            }
        }

        stage('Build docker image') {
            steps {
                sh 'ls -al .'
                script {
                    dockerImage = docker.build "123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn/management:dev"
                }
            }
        }

        stage('Login AWS ECR') {
            steps {
                sh "aws ecr get-login-password --region cn-northwest-1 | docker login --username AWS --password-stdin 850054557990.dkr.ecr.cn-northwest-1.amazonaws.com.cn"
            }
        }

        stage('Push image to ECR') {
            steps {
                sh "docker push 123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn/management:dev"
            }
        }
        stage('Deploy') {
            steps {
                sshagent (credentials: ['frontend-dev-ec2']) {
                    sh 'ssh -o StrictHostKeyChecking=no -l ec2-user hostname "cd docker_deploy/management && sh ./update.sh"'
                }
            }
        }
    }
}

docker run \
  --volume=/data/drone:/data \
  --env=DRONE_GITLAB_SERVER=http://10.28.24.205:9999 \
  --env=DRONE_GITLAB_CLIENT_ID=8059e29c3239abf1efb25c036c3a279b53584d492d1f894e28aefa5e4070bd04 \
  --env=DRONE_GITLAB_CLIENT_SECRET=28960f9a9f010dc93152e0fdf1555a79b21a90d0768c6b4e6eae44e9ba69ced3 \
  --env=DRONE_RPC_SECRET=03fd0a08827228406737a00b1eb94d35 \
  --env=DRONE_SERVER_HOST=10.28.24.205:8000 \
  --env=DRONE_SERVER_PROTO=http \
  --env=DRONE_USER_CREATE=username:admin:true \
  --publish=8000:80 \
  --publish=443:443 \
  --restart=always \
  --detach=true \
  --name=drone \
  drone/drone:2

docker run --detach \
  --volume=/var/run/docker.sock:/var/run/docker.sock \
  --env=DRONE_RPC_PROTO=http \
  --env=DRONE_RPC_HOST=10.28.24.209:8000 \
  --env=DRONE_RPC_SECRET=03fd0a08827228406737a00b1eb94d35 \
  --env=DRONE_RUNNER_CAPACITY=2 \
  --env=DRONE_RUNNER_NAME=runner-1 \
  --publish=3000:3000 \
  --restart=always \
  --name=runner \
  drone/drone-runner-docker:1

kind: pipeline
name: default
steps:
  - name: build
    image: maven:3-jdk-11
    volumes:
    - name: maven-cache
      path: /root/.m2
    commands:
      - ls -al ~/.
      - mvn install -DskipTests=true -Dmaven.javadoc.skip=true -B -V
  - name: docker
    image: ubase/docker:awscli
    environment:
      AWS_ACCESS_KEY_ID:
        from_secret: aws_ak
      AWS_SECRET_ACCESS_KEY:
        from_secret: aws_sk
      AWS_DEFAULT_REGION:
        from_secret: aws_region
    volumes:
      - name: dockersock
        path: /var/run/docker.sock
    commands:
      - docker build -t 123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn/app:dev .
      - aws ecr get-login-password --region cn-northwest-1 | docker login --username AWS --password-stdin 850054557990.dkr.ecr.cn-northwest-1.amazonaws.com.cn
      - docker push 123456.dkr.ecr.cn-northwest-1.amazonaws.com.cn/app:dev
  - name: notify
    image: drillster/drone-email
    settings:
      from: support<dev_support@gmail.com>
      host: smtp.feishu.cn
      port: 465
      username:
        from_secret: email_username
      password:
        from_secret: email_password
      recipients:
        - user@gmail.com
volumes:
  - name: maven-cache
    host:
      path: /var/lib/cache
  - name: dockersock
    host:
      path: /var/run/docker.sock