Jenkins JNLP方式启动 Agent

Jenkins Server配置

如果你是通过Nginx代理了jenkins，那么需要调整下Nginx的配置

map $http_upgrade $connection_upgrade {
       default upgrade;
       '' close;
}
server {
       listen       80;
       server_name  jenkins-server-domain;
       return 308   https://$host$request_uri;
}
server {
       listen       443 ssl http2;
       server_name  jenkins-server-domain;
       include      /etc/nginx/cert/jenkins-server-domain/ssl.conf;
       location / {
           proxy_pass              http://127.0.0.1:8080;
           proxy_set_header        Host            $host;
           proxy_set_header        Upgrade         $http_upgrade;
           proxy_set_header        Connection      $connection_upgrade;
           proxy_set_header        X-Real-IP       $remote_addr;
           proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header        X-Forwarded-Proto  $scheme;
       }
}

在Node管理中添加一个节点, 如下图

Jenkins Agent配置

• 首先需要安装jdk11, oraclejdk与openjdk均可,并创建所需要的用户与jenkins data目录

需要注意,如果你的jenkins server URL是HTTPS的,并且证书是自签的,jdk需要信任你的签发证书所使用的根证书,这一点确实没有SSH方式启动agent方便

groupadd -r jenkins
useradd -r -g jenkins -s /bin/bash -d /home/jenkins -m -c 'Jenkins Agent'
mkdir -p /data/jenkins /var/log/jenkins /usr/lib/jenkins
echo 7e24be8ddbd32fb9853f8fcd07556a6dcd64aaa1c06c187b170620b940c3b556 > /usr/lib/jenkins/secret-file   #这个secret需要换成自己的
curl -L https://jenkins-server-domain/jnlpJars/agent.jar -o /usr/lib/jenkins/agent.jar
chown -Rf jenkins:jenkins /data/jenkins /var/log/jenkins /usr/lib/jenkins
gpasswd -a jenkins docker

• 配置systemd启动jenkins-agent

PATH变量可以在jenkins用户下执行env获取

[root@defualt ~]# vim /etc/systemd/system/jenkins-agent.service
[Unit]
Description=Jenkins Agent
After=syslog.target network.target

[Service]
Type=simple
Environment="AGENTNAME=default-agentpool-1"
Environment="JAVA_HOME=/opt/java/jdk11.0.12"
Environment="PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/opt/java/jdk11.0.12/bin:/opt/maven/maven-3.6.3/bin:/opt/gradle/gradle-5.6.4/bin:/opt/node/bin:/opt/golang/bin:/home/jenkins/.local/bin:/home/jenkins/bin"
WorkingDirectory=/usr/lib/jenkins
ExecStart=/opt/java/jdk11.0.12/bin/java \
        -Dfile.encoding=UTF-8 \
        -Duser.timezone=Asia/Shanghai \
        -jar agent.jar \
        -jnlpUrl https://jenkins-server-domain/computer/${AGENTNAME}/jenkins-agent.jnlp \
        -workDir /data/jenkins \
        -secret @secret-file \
        -agentLog /var/log/jenkins/jenkins.log
PermissionsStartOnly=true
Restart=on-failure
RestartSec=5
LimitNOFILE=65535

User=jenkins
Group=jenkins

StandardOutput=null
StandardError=null

[Install]
WantedBy=multi-user.target

• 启动并设置开机自启

systemctl enable --now jenkins-agent.service

后记

• 这种方式与SSH不同的是jenkins server不用开通到agent的SSH 22端口的防火墙,也不用管理太多ssh key, agent掉线了会自动提示你怎么加入,这个界面就会有secret,不用手动管理这堆破东西
• 不好处就是配置起来步骤上比SSH麻烦, 如果jenkins server 是HTTPS的, 可能还需要导入签发用的根证书, agent才能连接上server; 如果有人把jenkins-agent服务停了,这个节点就不能用了, 不像SSH可以自动拉起来
• 网络环境特殊的情况下,这个方式确实比较好用

单纯记录了下自己的部署方式,如果各位有啥好用的办法,可以评论交流。