Jenkins + Docker + K8s 完整部署方案

Jenkins + Docker + K8s 完整部署方案，包含：Docker 运行 Jenkins → K8s 权限配置 → Jenkins 插件 → Jenkinsfile 流水线 → 排错要点。

一、在 K8s 节点上用 Docker 启动 Jenkins

1. 启动命令（推荐）

bash

运行

docker run -d \
  --name jenkins \
  --restart=always \
  -u root \
  -p 8080:8080 \
  -p 50000:50000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /usr/bin/docker:/usr/bin/docker \
  -v jenkins_home:/var/jenkins_home \
jenkins/jenkins:lts

2. 查看初始密码

bash

运行

docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

访问：http://节点IP:8080

二、Jenkins 必装插件（直接复制导入）

进入：Manage Jenkins → Plugins → Available plugins搜索安装以下：

plaintext

Pipeline
Git
Docker
Docker Pipeline
Kubernetes CLI
Kubernetes Client API
Kubernetes Credentials
Config File Provider
Pipeline Utility Steps
Credentials Binding
Timestamper
Workspace Cleanup

安装完成后重启 Jenkins。

三、K8s 授权：让 Jenkins 能操作 K8s（关键）

新建文件：jenkins-rbac.yaml

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-deploy
  namespace: default

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: jenkins-deploy-role
rules:
- apiGroups: [""]
  resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "events"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins-deploy-binding
subjects:
- kind: ServiceAccount
  name: jenkins-deploy
  namespace: default
roleRef:
  kind: ClusterRole
  name: jenkins-deploy-role
  apiGroup: rbac.authorization.k8s.io

执行：

bash

运行

kubectl apply -f jenkins-rbac.yaml

获取 K8s 配置文件（用于 Jenkins 凭证）

bash

运行

# 获取 token 名称
kubectl get secret -n default | grep jenkins-deploy-token

# 导出 token
kubectl get secret jenkins-deploy-token-xxxx -n default -o jsonpath='{.data.token}' | base64 -d

把这个 token 保存，后面 Jenkins 要用。

四、Jenkins 凭证配置

Manage Jenkins → Credentials → System → Global credentials → Add Credentials

1. K8s 访问凭证

• Kind：Secret text
• Secret：粘贴上面的 token
• ID：k8s-token
• Description：k8s deploy token

2. Docker 镜像仓库凭证

• Kind：Username with password
• ID：docker-hub
• 填入你的 Docker Hub / Harbor 账号密码

五、完整可直接运行的 Jenkinsfile

groovy

pipeline {
    agent any
    environment {
        REGISTRY = "docker.io/你的用户名"
        APP_NAME = "myapp"
        IMAGE_TAG = "${BUILD_NUMBER}"
        IMAGE = "${REGISTRY}/${APP_NAME}:${IMAGE_TAG}"
        NAMESPACE = "default"
    }

    stages {
        stage('Git 拉取代码') {
            steps {
                git url: 'https://github.com/xxx/your-project.git', branch: 'main'
            }
        }

        stage('Maven 构建（可选）') {
            steps {
                // sh 'mvn clean package -DskipTests'
            }
        }

        stage('Docker 构建镜像') {
            steps {
                sh 'docker version'
                sh "docker build -t ${IMAGE} ."
            }
        }

        stage('推送镜像到仓库') {
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'docker-hub',
                    usernameVariable: 'DOCKER_USER',
                    passwordVariable: 'DOCKER_PWD'
                )]) {
                    sh "docker login -u ${DOCKER_USER} -p ${DOCKER_PWD}"
                    sh "docker push ${IMAGE}"
                }
            }
        }

        stage('部署到 K8s') {
            steps {
                withCredentials([string(
                    credentialsId: 'k8s-token',
                    variable: 'K8S_TOKEN'
                )]) {
                    sh '''
                        kubectl config set-cluster k8s --server=https://你的K8S_APISERVER:6443 --insecure-skip-tls-verify=true
                        kubectl config set-credentials jenkins --token=${K8S_TOKEN}
                        kubectl config set-context default --cluster=k8s --user=jenkins --namespace=${NAMESPACE}
                        kubectl config use-context default
                    '''

                    sh "kubectl set image deployment/${APP_NAME} ${APP_NAME}=${IMAGE} -n ${NAMESPACE}"
                    sh "kubectl rollout status deployment/${APP_NAME} -n ${NAMESPACE}"
                }
            }
        }
    }

    post {
        success {
            echo "✅ 部署成功：${IMAGE}"
        }
        failure {
            echo "❌ 部署失败"
        }
    }
}

六、配套 K8s Deployment 模板（deployment.yaml）

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: docker.io/xxx/myapp:1
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: myapp-svc
spec:
  type: NodePort
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080

先手动创建一次：

bash

运行

kubectl apply -f deployment.yaml

七、常见问题快速修复

1. docker.sock 权限不足

   bash

   运行

   chmod 777 /var/run/docker.sock
   

2. kubectl 不存在进入 Jenkins 容器安装：

   bash

   运行

   docker exec -it jenkins bash
   curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
   chmod +x kubectl
   mv kubectl /usr/local/bin/
   

3. K8s API 地址不知道

   bash

   运行

   kubectl cluster-info