【CI/CD·Jenkins篇】环境搭建：从零部署 Jenkins 主从架构

{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"前言"}]},{"type":"paragraph","content":[{"type":"text","text":"本篇带你从零搭建一个生产可用的 Jenkins 主从架构。不是"装上就跑"的玩具版本，而是包含安全加固、多节点配置、Docker 集成的完整方案。跟着做下来，你就有了一个能支撑团队日常 CI/CD 的平台。"}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"一、架构规划"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"目标架构"}]},{"type":"code_block","attrs":{},"content":[{"type":"text","text":"┌─────────────────────────────────────┐n│ Jenkins Master│n│- Web UI (管理界面)│n│- Job Scheduling (任务调度)│n│- Plugin Management (插件管理) │n│- Credential Store (凭据管理)│n└──────────────┬──────────────────────┘n │ JNLP/SSH 协议n┌──────────┼──────────────────┐n▼▼▼n┌────────┐ ┌────────┐ ┌────────┐n│ Agent 1│ │ Agent 2│ │ Agent 3│n│ Java │ │ Docker │ │ K8s│n│ 构建节点│ │ 镜像构建│ │ 部署节点│n└────────┘ └────────┘ └────────┘"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"环境规划"}]},{"type":"paragraph","content":[{"type":"text","text":"| 角色 | 配置 | OS | 用途 |"}]},{"type":"paragraph","content":[{"type":"text","text":"|------|------|-----|------|"}]},{"type":"paragraph","content":[{"type":"text","text":"| Master | 4C 8G 100G | Ubuntu 22.04 | 管理调度 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Agent-1 | 4C 8G 50G | Ubuntu 22.04 | Java 构建 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Agent-2 | 4C 8G 50G Docker | Ubuntu 22.04 | Docker 镜像构建 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Agent-3 | 4C 4G 30G kubectl | Ubuntu 22.04 | K8s 部署 |"}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"二、Master 节点部署"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"方式一：Docker 部署（推荐生产环境）"}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# 创建数据目录nmkdir -p /data/jenkins_homenchown -R 1000:1000 /data/jenkins_homenn# 启动 Jenkins Masterndocker run -d n--name jenkins-master n--restart unless-stopped n-p 8080:8080 n-p 50000:50000 n-v /data/jenkins_home:/var/jenkins_home n-v /etc/localtime:/etc/localtime:ro n--memory=4g n--cpus=4 njenkins/jenkins:lts-jdk17nn# 获取初始密码ndocker exec jenkins-master cat /var/jenkins_home/secrets/initialAdminPassword"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"方式二：直接安装（适合没有 Docker 的环境）"}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# 安装 JDK 17napt update && apt install -y openjdk-17-jdknn# 添加 Jenkins 源ncurl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | ntee /usr/share/keyrings/jenkins-keyring.asc > /dev/nullnecho "deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] nhttps://pkg.jenkins.io/debian-stable binary/" | ntee /etc/apt/sources.list.d/jenkins.list > /dev/nullnn# 安装napt updatenapt install -y jenkinsnn# 启动nsystemctl enable jenkinsnsystemctl start jenkinsnn# 查看初始密码ncat /var/lib/jenkins/secrets/initialAdminPassword"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"初始化配置"}]},{"type":"ordered_list","attrs":{"order":1},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"浏览器访问 "},{"type":"text","marks":[{"type":"code"}],"text":"http://your-server-ip:8080"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"输入初始密码"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"选择"安装推荐插件"（Install suggested plugins）"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"创建管理员账号"}]}]}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"踩坑提示"},{"type":"text","text":"：不要用 root 用户直接运行 Jenkins 二进制版。Jenkins 安装时会自动创建 jenkins 用户，用 systemd 管理生命周期。如果用 Docker 部署，数据目录 owner 必须是 UID 1000。"}]}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"三、安全加固"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"1. 禁用注册"}]},{"type":"paragraph","content":[{"type":"text","text":"Manage Jenkins → Security → Security Realms → 选择 "Jenkins' own user database" → 取消勾选 "Allow users to sign up"。"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"2. 配置授权策略"}]},{"type":"paragraph","content":[{"type":"text","text":"Manage Jenkins → Security → Authorization → 选择 "Matrix-based security"："}]},{"type":"code_block","attrs":{},"content":[{"type":"text","text":"用户/组OverallJobnadmin ✓ 全部✓ 全部ndevelopers Read Build, Read, Cancelndeploy-bot Read Build, Read, Cancel, Release"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"3. 配置 CSRF 防护"}]},{"type":"code_block","attrs":{"language":"groovy"},"content":[{"type":"text","text":"// 在 Manage Jenkins → Script Console 中执行nhudson.security.csrf.DefaultCrumbIssuer.DISABLE_CSRF_PROTECTION = false"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"4. 系统配置文件加固"}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# /data/jenkins_home/config.xml 关键配置ntruennnntrue"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"5. 限制构建权限"}]},{"type":"paragraph","content":[{"type":"text","text":"在 Job 配置中勾选 "Enable project-based security"，限制只有特定用户/组能触发构建。"}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"四、Agent 节点配置"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"方式一：SSH 方式连接 Agent（推荐）"}]},{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"Master 端配置："}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# 在 Master 上生成 SSH 密钥（用 jenkins 用户）ndocker exec -u jenkins jenkins-master ssh-keygen -t rsa -b 4096 -f ~/.ssh/jenkins_agent_key -N ""nn# 查看公钥ndocker exec -u jenkins jenkins-master cat ~/.ssh/jenkins_agent_key.pub"}]},{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"Agent 端配置："}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# 在 Agent 服务器上n# 创建 jenkins 用户nuseradd -m -s /bin/bash jenkinsnn# 配置 SSH 公钥nmkdir -p /home/jenkins/.sshnecho "刚才复制的公钥内容" >> /home/jenkins/.ssh/authorized_keysnchmod 700 /home/jenkins/.sshnchmod 600 /home/jenkins/.ssh/authorized_keysnchown -R jenkins:jenkins /home/jenkins/.sshnn# 安装 JDK（Agent 最低要求）napt update && apt install -y openjdk-17-jdknn# 安装 Docker（如果是 Docker 构建节点）ncurl -fsSL https://get.docker.com | shnusermod -aG docker jenkinsnn# 安装 Gitnapt install -y gitnn# 创建工作目录nmkdir -p /home/jenkins/workspacenchown -R jenkins:jenkins /home/jenkins/workspace"}]},{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"在 Jenkins Web UI 中添加 Agent："}]},{"type":"paragraph","content":[{"type":"text","text":"Manage Jenkins → Nodes → New Node："}]},{"type":"code_block","attrs":{},"content":[{"type":"text","text":"Node name: agent-dockernType: Permanent Agent"}]},{"type":"paragraph","content":[{"type":"text","text":"配置参数："}]},{"type":"paragraph","content":[{"type":"text","text":"| 参数 | 值 | 说明 |"}]},{"type":"paragraph","content":[{"type":"text","text":"|------|-----|------|"}]},{"type":"paragraph","content":[{"type":"text","text":"| # of executors | 2 | 并发构建数 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Remote root directory | /home/jenkins | Agent 工作目录 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Labels | docker build | 标签，Pipeline 中用 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Usage | Use this node as much as possible | 尽量使用此节点 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Launch method | Launch agents via SSH | SSH 连接 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Host | 192.168.1.101 | Agent IP |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Credentials | jenkins-ssh-key | SSH 密钥凭据 |"}]},{"type":"paragraph","content":[{"type":"text","text":"| Host Key Verification | Non verifying Verification | 测试环境可关闭 |"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"方式二：JNLP 方式（Agent 在防火墙后）"}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# 在 Agent 上执行n# 从 Jenkins UI 获取 agent.jar 和 secretnwget http://jenkins-master:8080/jnlpJars/agent.jarnnjava -jar agent.jar -jnlpUrl http://jenkins-master:8080/computer/agent-1/slave-agent.jnlp n-secret YOUR_SECRET -workDir /home/jenkins/workspace"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"配置为系统服务"}]},{"type":"code_block","attrs":{"language":"bash"},"content":[{"type":"text","text":"# /etc/systemd/system/jenkins-agent.servicen[Unit]nDescription=Jenkins AgentnAfter=network.targetnn[Service]nType=simplenUser=jenkinsnExecStart=/usr/bin/java -jar /home/jenkins/agent.jar -jnlpUrl http://jenkins-master:8080/computer/agent-1/slave-agent.jnlp -secret YOUR_SECRET -workDir /home/jenkins/workspacenRestart=alwaysnRestartSec=10nn[Install]nWantedBy=multi-user.targetnn# 启动nsystemctl daemon-reloadnsystemctl enable jenkins-agentnsystemctl start jenkins-agent"}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"五、验证主从连通性"}]},{"type":"paragraph","content":[{"type":"text","text":"创建一个测试 Pipeline："}]},{"type":"code_block","attrs":{"language":"groovy"},"content":[{"type":"text","text":"// Jenkinsfile - 测试主从架构npipeline {nagent {nlabel 'docker-build'// 使用 docker 构建节点的标签n}nnstages {nstage('环境检查') {nsteps {nsh 'java -version'nsh 'docker --version'nsh 'git --version'nsh 'hostname'necho "当前节点: ${env.NODE_NAME}"necho "工作目录: ${env.WORKSPACE}"n}n}nnstage('测试构建') {nsteps {n// 简单的测试项目nsh '''necho "public class Hello { public static void main(String[] a) { System.out.println("Hello from Jenkins Agent"); } }" > Hello.javanjavac Hello.javanjava Hellon'''n}n}nnstage('测试 Docker') {nsteps {nsh 'docker run --rm alpine echo "Docker works on agent"'n}n}n}n}"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"踩坑提示"},{"type":"text","text":"：如果 Agent 连接失败，检查以下几项：n1. Master 到 Agent 的 SSH 端口是否可达（"},{"type":"text","marks":[{"type":"code"}],"text":"telnet agent-ip 22"},{"type":"text","text":"）n2. Agent 上的 "},{"type":"text","marks":[{"type":"code"}],"text":"authorized_keys"},{"type":"text","text":" 权限是否正确（700/600）n3. Master 的 Jenkins 用户是否被 Agent 的 "},{"type":"text","marks":[{"type":"code"}],"text":"sshd_config"},{"type":"text","text":" 允许登录（检查 AllowUsers）n4. Agent 的 Java 版本是否与 Master 兼容"}]}]},{"type":"horizontal_rule"},{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"六、本篇要点回顾"}]},{"type":"ordered_list","attrs":{"order":1},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"Jenkins 主从架构：Master 负责管理调度，Agent 负责执行构建"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"推荐用 Docker 部署 Master，Agent 用 SSH 方式连接最可靠"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"安全加固四件套：禁注册、配授权策略、开 CSRF、限制 Job 权限"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"Agent 通过 Label 标签区分用途，Pipeline 中用 "},{"type":"text","marks":[{"type":"code"}],"text":"agent { label 'xxx' }"},{"type":"text","text":" 指定"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"type":"text","text":"部署后用测试 Pipeline 验证 Java/Docker/Git 环境完整性"}]}]}]},{"type":"paragraph","content":[{"type":"text","marks":[{"type":"strong"}],"text":"下一篇预告"},{"type":"text","text":"：《Pipeline 基础：Declarative 与 Scripted 语法详解》——环境搭好了，接下来学习 Jenkins 最核心的流水线编写技能。"}]}]}","createTime":1786330772,"ext":{"closeTextLink":0,"comment_ban":0,"description":"","focusRead":0},"favNum":0,"html":"","isOriginal":0,"likeNum":0,