Jenkins на Kubernetes: динамические агенты и учёт затрат

# 00-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: jenkins
  labels:
    name: jenkins
    purpose: ci-cd

kubectl apply -f k8s/00-namespace.yaml

# 01-rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: jenkins
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: jenkins
  namespace: jenkins
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "delete", "get", "list", "watch", "patch"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create", "delete", "get", "list", "watch", "patch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins
  namespace: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: jenkins
subjects:
  - kind: ServiceAccount
    name: jenkins
    namespace: jenkins

# 03-jenkins-master.yaml (фрагмент)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
spec:
  replicas: 1
  template:
    spec:
      serviceAccountName: jenkins
      containers:
        - name: jenkins
          image: jenkins/jenkins:lts-jdk21
          ports:
            - containerPort: 8080   # UI
            - containerPort: 50000  # JNLP agents
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: 2000m
              memory: 2Gi

# 04-jenkins-agent.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins-agent
  namespace: jenkins
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins
      component: agent
  template:
    metadata:
      labels:
        app: jenkins
        component: agent
    spec:
      containers:
        - name: jnlp
          image: jenkins/inbound-agent:latest-jdk21
          env:
            - name: JENKINS_URL
              value: "http://jenkins:8080"
            - name: JENKINS_AGENT_NAME
              value: "workspace-agent"
            - name: JENKINS_SECRET
              value: "REPLACE_WITH_AGENT_SECRET" # Обновите это значение!
            - name: JENKINS_AGENT_WORKDIR
              value: "/home/jenkins/agent"
          volumeMounts:
            - name: workspace
              mountPath: /home/jenkins/agent
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: workspace

# Отредактируйте секрет в 04-jenkins-agent.yaml, затем:
kubectl apply -f k8s/04-jenkins-agent.yaml

# Проверяем подключение агента
kubectl -n jenkins logs -l component=agent -f

INFO: Connected

pipeline {
  agent {
    kubernetes {
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: maven
            image: maven:3.9-eclipse-temurin-17
            command: ["sleep", "infinity"]
            resources:
              requests:
                memory: "512Mi"
                cpu: "250m"
              limits:
                memory: "1Gi"
                cpu: "1000m"
      '''
      defaultContainer 'maven'
    }
  }
  // ... stages
}

pipeline {
  agent {
    kubernetes {
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: node
            image: node:20.17.0
            command: ["sleep", "infinity"]
          - name: maven
            image: maven:3.9.9-eclipse-temurin-17
            command: ["sleep", "infinity"]
      '''
    }
  }
  stages {
    stage('Build') {
      steps {
        sh 'mvn clean compile -B'
      }
    }

    stage('Test') {
      steps {
        sh 'mvn test -B'
      }
    }

    stage('Package') {
      steps {
        sh 'mvn package -DskipTests -B'
      }
    }
  }
}

pipeline {
  agent {
    kubernetes {
      // ... динамический под для сборки
    }
  }
  stages {
    stage('Build') {
      steps {
        sh 'mvn clean package'
      }
    }
    stage('Archive to Workspace') {
      agent {
        label 'workspace-agent'
      }
      options {
        skipDefaultCheckout()
      }
      steps {
        // Копируем артефакты в постоянное рабочее пространство
        sh 'ls -al'
        // Выполняется на статическом агенте с постоянным хранилищем
      }
    }
  }
}

pipeline {
  agent {
    kubernetes {
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: maven
            image: maven:3.9-eclipse-temurin-17
            command: ["sleep", "infinity"]
            volumeMounts:
            - name: maven-settings
              mountPath: /root/.m2/settings.xml
              subPath: settings.xml
          volumes:
          - name: maven-settings
            secret:
              secretName: maven-settings
      '''
      defaultContainer 'maven'
    }
  }
  stages {
    stage('Build with Private Deps') {
      steps {
        sh 'mvn clean install' // Использует смонтированный settings.xml
      }
    }
  }
}

FROM maven:3.9-eclipse-temurin-17
COPY settings.xml /root/.m2/settings.xml
RUN mvn dependency:go-offline -f /path/to/pom.xml  # Предварительно скачиваем зависимости

// team-alpha-app/Jenkinsfile
pipeline {
  agent {
    kubernetes {
      cloud 'kubernetes'
      namespace 'team-alpha-builds'  // Пространство имён команды
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: maven
            image: maven:3.9-eclipse-temurin-17
            command: ["sleep", "infinity"]
      '''
    }
  }
  // ... stages
}

// team-beta-app/Jenkinsfile
pipeline {
  agent {
    kubernetes {
      cloud 'kubernetes'
      namespace 'team-beta-builds'  // Другое пространство имён
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:
          - name: node
            image: node:20-alpine
            command: ["sleep", "infinity"]
      '''
    }
  }
  // ... stages
}

# Квота ресурсов для пространства имён команды
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-alpha-quota
  namespace: team-alpha-builds
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"