gitlab使用k8s作為runner

這種安裝方式，手工化程度高，可能不是很方便，但可以比較清楚的理解gitlab-runner在k8s里的運(yùn)行細(xì)節(jié)。
現(xiàn)在我更推薦的方式，是用gitlab-runner chart的方式來安裝，這要用到k8s的helm。
在我簡書另外的文章里有介紹。
http://m.itdecent.cn/p/df330130a88c
歡迎提出意見。

經(jīng)過我上一篇的文章講解，gitlab就安裝好了。接下來，就可以進(jìn)入更深一層的學(xué)習(xí)了。前幾年，我作CI/CD時，都是將gitlab與jenkins組合。一個源代碼管理，一個作軟件編譯。
現(xiàn)在，都2020了試試不一樣的味道------直接使用gitlab自身的CI/CD來作軟件的編譯，鏡像的生成和上傳。
此篇，主要講講如何將gitlab的runner放在K8s中，意在打通流程。
主要參考URL：
https://www.cnblogs.com/wangxu01/articles/11730920.html

一，在K8S集群中生成專用于CI的namespace。

apiVersion: v1
kind: Namespace
metadata:
  name: kube-ops

gitlab-runner-ns.yaml

二，一個用于注冊、運(yùn)行和取消注冊 Gitlab CI Runner 的Token

apiVersion: v1
kind: Secret
metadata:
  name: gitlab-ci-token
  namespace: kube-ops
  labels:
    app: gitlab-ci-runner
data:
  GITLAB_CI_TOKEN: eTJCbzlicGZmanhiV2RUSlZkYmUK

gitlab-runner-token-secret.yaml
那個token的來歷：


2020-04-26 19_12_01-Admin Area · GitLab.png
echo "y2Bo9bpffjxbWdTJVdbe" |  base64 -w0
eTJCbzlicGZmanhiV2RUSlZkYmUK

三，在k8s里configmap里存儲一個用于注冊、運(yùn)行和取消注冊 Gitlab CI Runner 的小腳本

這里用到了第二步里面的token。

apiVersion: v1
data:
  run.sh: |
    #!/bin/bash
    unregister() {
        kill %1
        echo "Unregistering runner ${RUNNER_NAME} ..."
        /usr/bin/gitlab-ci-multi-runner unregister -t "$(/usr/bin/gitlab-ci-multi-runner list 2>&1 | tail -n1 | awk '{print $4}' | cut -d'=' -f2)" -n ${RUNNER_NAME}
        exit $?
    }
    trap 'unregister' EXIT HUP INT QUIT PIPE TERM
    echo "Registering runner ${RUNNER_NAME} ..."
    /usr/bin/gitlab-ci-multi-runner register -r ${GITLAB_CI_TOKEN}
    sed -i 's/^concurrent.*/concurrent = '"${RUNNER_REQUEST_CONCURRENCY}"'/' /home/gitlab-runner/.gitlab-runner/config.toml
    echo "Starting runner ${RUNNER_NAME} ..."
    /usr/bin/gitlab-ci-multi-runner run -n ${RUNNER_NAME} &
    wait
kind: ConfigMap
metadata:
  labels:
    app: gitlab-ci-runner
  name: gitlab-ci-runner-scripts
  namespace: kube-ops

gitlab-runner-scripts-cm.yaml

四， 使用k8s的ConfigMap 資源來傳遞 Runner 鏡像所需的環(huán)境變量

要注意CI_SERVER_URL對應(yīng)的值需要指向我們的 Gitlab 實(shí)例的 URL（可以是外網(wǎng)地址，也可以是 Kubernetes 集群內(nèi)部的 Service DNS 地址，因?yàn)?Runner 也是運(yùn)行在 Kubernetes 集群中的），并加上/ci（ http://192.168.1.111:8180/ci ）。

apiVersion: v1
data:
  REGISTER_NON_INTERACTIVE: "true"
  REGISTER_LOCKED: "false"
  METRICS_SERVER: "0.0.0.0:9100"
  CI_SERVER_URL: "http://192.168.1.111:8180/ci"
  RUNNER_REQUEST_CONCURRENCY: "4"
  RUNNER_EXECUTOR: "kubernetes"
  KUBERNETES_NAMESPACE: "kube-ops"
  KUBERNETES_PRIVILEGED: "true"
  KUBERNETES_CPU_LIMIT: "1"
  KUBERNETES_CPU_REQUEST: "500m"
  KUBERNETES_MEMORY_LIMIT: "1Gi"
  KUBERNETES_SERVICE_CPU_LIMIT: "1"
  KUBERNETES_SERVICE_MEMORY_LIMIT: "1Gi"
  KUBERNETES_HELPER_CPU_LIMIT: "500m"
  KUBERNETES_HELPER_MEMORY_LIMIT: "100Mi"
  KUBERNETES_PULL_POLICY: "if-not-present"
  KUBERNETES_TERMINATIONGRACEPERIODSECONDS: "10"
  KUBERNETES_POLL_INTERVAL: "5"
  KUBERNETES_POLL_TIMEOUT: "360"
kind: ConfigMap
metadata:
  labels:
    app: gitlab-ci-runner
  name: gitlab-ci-runner-cm
  namespace: kube-ops

gitlab-runner-cm.yaml

五，需要用于k8s權(quán)限控制的rbac文件

apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-ci
  namespace: kube-ops
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: gitlab-ci
  namespace: kube-ops
rules:
  - apiGroups: [""]
    resources: ["*"]
    verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: gitlab-ci
  namespace: kube-ops
subjects:
  - kind: ServiceAccount
    name: gitlab-ci
    namespace: kube-ops
roleRef:
  kind: Role
  name: gitlab-ci
  apiGroup: rbac.authorization.k8s.io

gitlab-runner-rbac.yaml

六，最核心的，是這個StatefulSet的yaml，用于在k8s集群里生成gitlab的runner。

這個Yaml里，用于了前端五步生成的相關(guān)資源。
相比于參考的URL，我更改了api的版本，label的位置及運(yùn)行的權(quán)限，這是我集群改錯來的。

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: gitlab-ci-runner
  namespace: kube-ops
  labels:
    app: gitlab-ci-runner
spec:
  updateStrategy:
    type: RollingUpdate
  replicas: 1
  selector:
    matchLabels:
      app: gitlab-ci-runner
  serviceName: gitlab-ci-runner
  template:
    metadata:
      labels:
        app: gitlab-ci-runner
    spec:
      volumes:
      - name: gitlab-ci-runner-scripts
        projected:
          sources:
          - configMap:
              name: gitlab-ci-runner-scripts
              items:
              - key: run.sh
                path: run.sh
                mode: 0755
      serviceAccountName: gitlab-ci
      containers:
      - image: gitlab/gitlab-runner:alpine-v12.10.1
        name: gitlab-ci-runner
        command:
        - /scripts/run.sh
        envFrom:
        - configMapRef:
            name: gitlab-ci-runner-cm
        - secretRef:
            name: gitlab-ci-token
        env:
        - name: RUNNER_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - containerPort: 9100
          name: http-metrics
          protocol: TCP
        volumeMounts:
        - name: gitlab-ci-runner-scripts
          mountPath: "/scripts"
          readOnly: true
      restartPolicy: Always

gitlab-runner-statefulset.yaml

七，將這些Yaml全部apply到k8s集群

如無意外，gitlab里就可以看到這個runner了。（為了簡化，我只生成了一個runner）


2020-04-26 19_27_02-Admin Area · GitLab.png

查看Pod的日志

# kubectl -n kube-ops logs -f gitlab-ci-runner-0

Registering runner gitlab-ci-runner-0 ...
Runtime platform                                    arch=amd64 os=linux pid=6 revision=ce065b93 version=12.10.1
Running in system-mode.                            
                                                   
Registering runner... succeeded                     runner=y2Bo9bpf
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded! 
sed: /home/gitlab-runner/.gitlab-runner/config.toml: No such file or directory
Starting runner gitlab-ci-runner-0 ...
Runtime platform                                    arch=amd64 os=linux pid=16 revision=ce065b93 version=12.10.1
Starting multi-runner from /etc/gitlab-runner/config.toml...  builds=0
Running in system-mode.                            
                                                   
Configuration loaded                                builds=0
listen_address not defined, metrics & debug endpoints disabled  builds=0
[session_server].listen_address not defined, session endpoints disabled  builds=0
Checking for jobs... received                       job=8 repo_url=http://192.168.1.111:8180/root/demo.git runner=txTmGMVS
ERROR: Could not create cache adapter               error=cache factory not found: factory for cache adapter "" was not registered
WARNING: Job failed: command terminated with exit code 1  duration=32.862623292s job=8 project=1 runner=txTmGMVS
WARNING: Failed to process runner                   builds=0 error=command terminated with exit code 1 executor=kubernetes runner=txTmGMVS
Checking for jobs... received                       job=10 repo_url=http://192.168.1.111:8180/root/demo.git runner=txTmGMVS
WARNING: Job failed: command terminated with exit code 1  duration=30.368854533s job=10 project=1 runner=txTmGMVS
WARNING: Failed to process runner                   builds=0 error=command terminated with exit code 1 executor=kubernetes runner=txTmGMVS
Checking for jobs... received                       job=12 repo_url=http://192.168.1.111:8180/root/demo.git runner=txTmGMVS
Job succeeded                                       duration=14.880245019s job=12 project=1 runner=txTmGMVS
Checking for jobs... received                       job=13 repo_url=http://192.168.1.111:8180/root/demo.git runner=txTmGMVS
Job succeeded                                       duration=8.795109726s job=13 project=1 runner=txTmGMVS

八，弄個最簡的.gitlab-ci.yml嘗嘗鮮

# This template uses jdk8 for verifying and deploying images
image: maven:3.6.3-jdk-8-slim

stages:
  - package
  - docker
  
package-build:
  stage: package
  script:
    - echo 'hello package build'
    
docker-build:
  stage: docker
  script:
    - echo 'hello docker build'

.gitlab-ci.yml


2020-04-26 19_31_21-docker-build (#13) · Jobs · Administrator _ demo · GitLab.png

九，下一篇，編譯軟件到Harbor倉庫。

。。。未完待續(xù)。。。

最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結(jié)合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點(diǎn)，簡書系信息發(fā)布平臺，僅提供信息存儲服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容