Jenkins 服务器部署与核心插件集成方案

# 更新系统包
sudo apt update && sudo apt upgrade -y

# 安装基础工具
sudo apt install -y curl wget git vim net-tools unzip \
    apt-transport-https ca-certificates gnupg lsb-release

# 优化内核参数
cat > /etc/sysctl.d/99-kubernetes.conf << EOF
vm.max_map_count = 262144
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
fs.file-max = 2097152
fs.inotify.max_user_watches = 524288
EOF

sysctl --system

# 安装 Git
sudo apt install -y git

# 配置 Git 用户信息
git config --global user.name "Jenkins CI"
git config --global user.email "jenkins@company.com"

# 验证安装
git --version

# 生成 SSH 密钥对
ssh-keygen -t rsa -b 4096 -C "jenkins@company.com" -f ~/.ssh/id_rsa_jenkins

# 查看公钥
cat ~/.ssh/id_rsa_jenkins.pub

# 将公钥添加到 GitLab/GitHub 的 SSH Keys 设置中

# 添加 Docker GPG 密钥
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
    sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

# 添加 Docker 仓库
echo "deb [arch=$(dpkg --print-architecture) \
    signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] \
    https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
    sudo tee /etc/apt/sources.list.d/docker.list

# 安装 Docker
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# 启动 Docker
sudo systemctl enable docker
sudo systemctl start docker

# 将 Jenkins 用户添加到 docker 组
sudo usermod -aG docker jenkins

kubectl apply -f - << EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-admin
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins-admin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: jenkins-admin
  namespace: default
EOF

# 获取 Token
kubectl get secret $(kubectl get serviceaccount jenkins-admin \
    -o jsonpath="{.secrets[0].name}") \
    -o jsonpath="{.data.token}" | base64 --decode

# 使用 Docker Compose 部署
mkdir -p /opt/sonarqube/{data,extensions,logs}
cd /opt/sonarqube

cat > docker-compose.yml << 'EOF'
version: '3.8'
services:
  sonarqube:
    image: sonarqube:10.3-community
    container_name: sonarqube
    ports:
      - "9000:9000"
    environment:
      SONAR_JDBC_USERNAME: sonar
      SONAR_JDBC_PASSWORD: sonar123
      SONAR_JDBC_URL: jdbc:postgresql://sonar-db:5432/sonar
    volumes:
      - ./data:/opt/sonarqube/data
      - ./extensions:/opt/sonarqube/extensions
      - ./logs:/opt/sonarqube/logs
    depends_on:
      - sonar-db
  
  sonar-db:
    image: postgres:15
    container_name: sonar-postgresql
    environment:
      POSTGRES_USER: sonar
      POSTGRES_PASSWORD: sonar123
      POSTGRES_DB: sonar
    volumes:
      - postgresql-data:/var/lib/postgresql/data
EOF

docker compose up -d

pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: maven
    image: maven:3.9-eclipse-temurin-17
  - name: docker
    image: docker:24-dind
    securityContext:
      privileged: true
'''
        }
    }

    environment {
        DOCKER_REGISTRY = 'registry.company.com'
        IMAGE_NAME = 'myapp'
        SONAR_HOST_URL = 'http://sonarqube:9000'
    }

    stages {
        stage('Checkout') {
            steps { checkout scm }
        }

        stage('Code Quality') {
            steps {
                withSonarQubeEnv('sonarqube-server') {
                    sh 'mvn clean verify sonar:sonar'
                }
            }
        }

        stage('Quality Gate') {
            steps {
                timeout(time: 1, unit: 'HOURS') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }

        stage('Build') {
            steps { sh 'mvn package' }
        }

        stage('Build Docker Image') {
            steps {
                script {
                    docker.build("${DOCKER_REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER}")
                }
            }
        }

        stage('Push Image') {
            steps {
                script {
                    docker.withRegistry("https://${DOCKER_REGISTRY}", 'docker-credentials') {
                        docker.image("${DOCKER_REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER}").push()
                    }
                }
            }
        }

        stage('Deploy to Dev') {
            steps {
                sh '''
                kubectl set image deployment/myapp-dev \
                  myapp=${DOCKER_REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER}
                '''
            }
        }

        stage('Approval') {
            steps {
                input message: 'Deploy to production?', ok: 'Approve'
            }
        }

        stage('Deploy to Prod') {
            steps {
                sh '''
                kubectl set image deployment/myapp-prod \
                  myapp=${DOCKER_REGISTRY}/${IMAGE_NAME}:${BUILD_NUMBER}
                '''
            }
        }
    }
}