1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

pipeline {
    agent { label 'maven' }            // 在哪个 agent 上跑
    options {                           // 全局选项
        timeout(time: 30, unit: 'MINUTES')
        disableConcurrentBuilds()
    }
    parameters {                        // 手动参数
        string(name: 'BRANCH', defaultValue: 'main')
    }
    stages {                            // 阶段
        stage('Build') { steps { ... } }
        stage('Test')  { steps { ... } }
    }
    post {                              // 后置动作
        always { echo 'cleanup' }
        failure { mail to: 'team@xxx.com' }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

# docker-compose.yml
# 启动：docker compose up -d
# 查看日志：docker compose logs -f jenkins
version: "3.8"

services:
  jenkins:
    image: jenkins/jenkins:2.452.3-lts-jdk17
    container_name: jenkins-master
    restart: unless-stopped
    user: root                                    # 容器内用 root，方便调 docker
    ports:
      - "8080:8080"                               # Web UI
      - "50000:50000"                             # Agent JNLP
    volumes:
      - jenkins_data:/var/jenkins_home           # 配置持久化
      - /var/run/docker.sock:/var/run/docker.sock # 共享宿主机 docker daemon
      - /usr/bin/docker:/usr/bin/docker:ro        # docker CLI（容器内能用 docker 命令）
    environment:
      - JAVA_OPTS=-Xms2g -Xmx4g -Djava.awt.headless=true
      - JENKINS_OPTS=--httpPort=8080
    networks:
      - jenkins-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/login"]
      interval: 30s
      timeout: 10s
      retries: 10

  # 固定 maven agent（也可改成动态 K8s pod agent）
  maven-agent:
    image: jenkins/inbound-agent:3192.v713e3def_8641-1
    container_name: jenkins-maven-agent
    depends_on:
      jenkins:
        condition: service_healthy
    environment:
      - JENKINS_URL=http://jenkins:8080
      - JENKINS_SECRET=<从 Master UI 拷过来>
      - JENKINS_AGENT_NAME=maven-agent-1
    networks:
      - jenkins-net

  docker-agent:
    image: docker:24-dind
    container_name: jenkins-docker-agent
    privileged: true                              # DIND 必须
    environment:
      - DOCKER_TLS_CERTDIR=
    volumes:
      - docker_data:/var/lib/docker
    networks:
      - jenkins-net

volumes:
  jenkins_data:
  docker_data:

networks:
  jenkins-net:
    driver: bridge

1
2
3
4

docker compose up -d
docker compose logs -f jenkins | grep -A 1 "initial"
# 看到一行：Please use the following password to proceed to installation:
# 类似：2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p

1
2
3
4
5
6
7
8

# macOS
brew install k3d k3s

# Linux
curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash

# Windows（WSL2）
wsl -e bash -c "curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash"

1
2
3
4
5
6
7
8

k3d cluster create jenkins-demo \
  --image rancher/k3s:v1.29.4-k3s1 \
  --port "80:80@loadbalancer" \
  --port "443:443@loadbalancer" \
  --port "30000-30100:30000-30100@loadbalancer" \
  --agents 3 \
  --volume "/tmp/k3d-shared:/tmp/shared@all" \
  --k3s-arg "--disable=traefik@server:0"

1
2
3
4
5

kubectl get nodes
# 预期看到 4 个 node（1 server + 3 agent），全部 Ready

kubectl get pods -A
# kube-system 下有 coredns、metrics-server 等基础组件

1
2

volumes:
  - //var/run/docker.sock:/var/run/docker.sock

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

pipeline {
    agent none  // 顶层不指定 agent
    stages {
        stage('Build') {
            agent { label 'maven' }   // 拉 maven agent
            steps { sh 'mvn package' }
        }
        stage('Docker Build') {
            agent { label 'docker' }  // 拉 docker agent
            steps { sh 'docker build -t app:${TAG} .' }
        }
        stage('Deploy') {
            agent { label 'k8s' }     // 拉 k8s agent
            steps { sh 'kubectl apply -f deployment.yaml' }
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

agent {
    kubernetes {
        label 'maven-pod'
        yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: maven
    image: maven:3.9-eclipse-temurin-17
    command: ['cat']
    tty: true
    resources:
      requests: { cpu: '1', memory: '2Gi' }
      limits:   { cpu: '2', memory: '4Gi' }
'''
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// ❌ 错误写法
sh 'docker login -u admin -p Harbor12345 harbor.xxx.com'

// ✅ 正确写法
withCredentials([usernamePassword(
    credentialsId: 'harbor-creds',
    usernameVariable: 'HARBOR_USER',
    passwordVariable: 'HARBOR_PASS'
)]) {
    sh "docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} harbor.xxx.com"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

def credMap = [
    dev:     'k8s-dev-creds',
    staging: 'k8s-stg-creds',
    prod:    'k8s-prod-creds'
]
def credId = credMap[params.ENV]

withCredentials([file(credentialsId: credId, variable: 'KUBECONFIG')]) {
    sh "kubectl --kubeconfig=${KUBECONFIG} apply -f deployment.yaml"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

#!/bin/bash
# scripts/start-demo-env.sh
# 一键起 Jenkins + k3d + 必要工具
set -e

echo "==> 1. 启动 Jenkins Master + Agents"
docker compose up -d

echo "==> 2. 等待 Jenkins 就绪"
for i in {1..30}; do
  if curl -sf http://localhost:8080/login >/dev/null 2>&1; then
    echo "    Jenkins ready"
    break
  fi
  echo "    等待 Jenkins 启动... ${i}/30"
  sleep 5
done

echo "==> 3. 启动 k3d 集群"
k3d cluster create jenkins-demo \
  --image rancher/k3s:v1.29.4-k3s1 \
  --port "80:80@loadbalancer" \
  --port "443:443@loadbalancer" \
  --port "30000-30100:30000-30100@loadbalancer" \
  --agents 3 \
  --volume "/tmp/k3d-shared:/tmp/shared@all" \
  --k3s-arg "--disable=traefik@server:0" \
  --wait

echo "==> 4. 安装 Argo Rollouts"
kubectl create namespace argo-rollouts
kubectl apply -n argo-rollouts -f https://github.com/argoproj/argo-rollouts/releases/download/v1.7.0/install.yaml

echo "==> 5. 安装 Prometheus（轻量版）"
kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.72.0/bundle.yaml

echo "==> 6. 安装 Harbor（轻量）"
helm repo add harbor https://helm.goharbor.io
helm install harbor harbor/harbor \
  --namespace harbor --create-namespace \
  --set expose.type=nodePort \
  --set expose.nodePort.ports.http.nodePort=30002 \
  --set persistence.enabled=false \
  --set core.persistence.enabled=false \
  --set database.persistence.enabled=false \
  --set redis.persistence.enabled=false \
  --set jobservice.persistence.enabled=false \
  --set registry.persistence.enabled=false \
  --set trivy.persistence.enabled=false

echo "==> 7. 验证"
echo "    Jenkins:    http://localhost:8080"
echo "    k3d kubeconfig: k3d kubeconfig write jenkins-demo"
echo "    Harbor:     http://localhost:30002 (admin/Harbor12345)"
echo ""
echo "全部就绪！"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# casc/jenkins.yaml
jenkins:
  systemMessage: "团队 CI/CD 中心 - powered by Jenkins 2.452"
  numExecutors: 0                    # Master 不跑任务
  mode: EXCLUSIVE                    # 一个时间只跑一个 Job（防 OOM）
  securityRealm:
    local:
      users:
        - id: "admin"
          name: "Admin"
          password: "${ADMIN_PASSWORD}"   # 从环境变量读
  authorizationStrategy:
    loggedInUsersCanDoAnything:
      allowAnonymousRead: false
  remotingSecurity:
    enabled: true

credentials:
  system:
    domainCredentials:
      - credentials:
          - usernamePassword:
              scope: GLOBAL
              id: "harbor-creds"
              username: "admin"
              password: "${HARBOR_PASSWORD}"
              description: "Harbor 镜像仓库"
          - file:
              scope: GLOBAL
              id: "k8s-prod-kubeconfig"
              fileName: "kubeconfig"
              secretBytes:
                "${K8S_PROD_KUBECONFIG_BASE64}"

unclassified:
  location:
    url: "https://jenkins.xxx.com/"
    adminAddress: "devops@xxx.com"
  tool:
    jdk:
      installations:
        - name: "jdk17"
          properties:
            - installSource:
                installers:
                  - adoptOpenJdk:
                      id: "jdk-17.0.10+7"

1
2
3

docker run -e CASC_JENKINS_CONFIG=/var/jenkins_home/casc/jenkins.yaml \
  -v $PWD/casc:/var/jenkins_home/casc:ro \
  jenkins/jenkins:2.452.3-lts-jdk17

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 备份脚本（简化版）
#!/bin/bash
BACKUP_DIR=/backup/jenkins/$(date +%Y%m%d)
mkdir -p $BACKUP_DIR

# 1. 备份 JCasC（已在 Git 里，这里只备份运行时配置）
docker exec jenkins-master bash -c \
  "java -jar /var/jenkins_home/war/WEB-INF/jenkins-cli.jar \
   -s http://localhost:8080 get-job my-job" > $BACKUP_DIR/my-job.xml

# 2. 备份插件清单
docker exec jenkins-master cat /var/jenkins_home/plugins.txt > $BACKUP_DIR/plugins.txt

# 3. 备份 jenkins_data（restic 增量）
restic backup /var/lib/docker/volumes/jenkins_data

# 4. 上传 S3
aws s3 sync $BACKUP_DIR s3://my-backup-bucket/jenkins/$BACKUP_DIR

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

my-microservice/                  # Spring Boot 3.x 多模块 Maven 项目
├── pom.xml                       # 父 POM
├── common-lib/                   # 公共库
│   ├── pom.xml
│   └── src/main/java/...
├── order-service/                # 订单服务
│   ├── pom.xml
│   ├── Dockerfile
│   └── src/
├── user-service/                 # 用户服务
│   ├── pom.xml
│   ├── Dockerfile
│   └── src/
├── Jenkinsfile                   # 我们的主角
└── sonar-project.properties      # SonarQube 配置

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231

// Jenkinsfile - 适用于 Spring Boot 多模块微服务
// 用法：放在项目根目录，Jenkins 创建 Pipeline Job 时选 "Pipeline script from SCM"

pipeline {
    agent none  // 顶层不指定，由各 stage 决定

    options {
        // 整体超时：30 分钟
        timeout(time: 30, unit: 'MINUTES')
        // 禁止并发构建（同一 Job 同一时间只能跑 1 个）
        disableConcurrentBuilds()
        // 构建历史保留：30 天最多 50 次
        buildDiscarder(logRotator(numToKeepStr: '50', daysToKeepStr: '30'))
        // 日志加时间戳
        timestamps()
        // ansi 颜色
        ansiColor('xterm')
    }

    parameters {
        // 手动参数
        choice(name: 'ENV', choices: ['dev', 'staging', 'prod'],
               description: '部署环境')
        string(name: 'BRANCH', defaultValue: 'main',
               description: '代码分支')
        string(name: 'IMAGE_TAG', defaultValue: '',
               description: '镜像 tag（留空用 commit SHA）')
        booleanParam(name: 'SKIP_TEST', defaultValue: false,
               description: '跳过测试')
        booleanParam(name: 'FORCE_DEPLOY', defaultValue: false,
               description: '强制部署（跳过健康检查）')
    }

    environment {
        // 全局环境变量
        APP_NAME       = 'order-service'
        HARBOR_PROJECT = 'myteam'
        K8S_NAMESPACE  = "${params.ENV}"
        GIT_COMMIT     = sh(returnStdout: true, script: 'git rev-parse --short HEAD').trim()
        IMAGE_TAG      = "${params.IMAGE_TAG?.trim() ? params.IMAGE_TAG : env.GIT_COMMIT}"
        IMAGE_NAME     = "harbor.xxx.com/${HARBOR_PROJECT}/${APP_NAME}"
        DOCKER_IMAGE   = "${IMAGE_NAME}:${IMAGE_TAG}"
    }

    stages {
        // ===== 阶段 1：Checkout =====
        stage('Checkout') {
            agent { label 'maven' }
            steps {
                checkout scm
                sh 'git status'
                sh 'git log -1 --oneline'
            }
        }

        // ===== 阶段 2：Build =====
        stage('Build') {
            agent { label 'maven' }
            steps {
                sh 'mvn -B -V -T 4 clean compile'
            }
            post {
                failure {
                    echo 'Build 失败，请检查代码编译错误'
                }
            }
        }

        // ===== 阶段 3：Test =====
        stage('Test') {
            agent { label 'maven' }
            when {
                expression { return !params.SKIP_TEST }
            }
            steps {
                sh 'mvn -B test'
                // 归档测试报告
                junit '**/target/surefire-reports/*.xml'
                // 代码覆盖率
                jacoco(execPattern: '**/target/jacoco.exec',
                       minimumLineCoverage: '0.60')
            }
        }

        // ===== 阶段 4：Code Scan =====
        stage('Code Scan') {
            agent { label 'maven' }
            steps {
                withSonarQubeEnv('sonarqube-server') {
                    sh 'mvn sonar:sonar -Dsonar.projectKey=${APP_NAME}'
                }
                // 等待 Quality Gate 结果（10 分钟超时）
                timeout(time: 10, unit: 'MINUTES') {
                    waitForQualityGate abortPipeline: true
                }
            }
        }

        // ===== 阶段 5：Package =====
        stage('Package') {
            agent { label 'maven' }
            steps {
                sh 'mvn -B -DskipTests clean package'
                // 归档 jar
                archiveArtifacts artifacts: '**/target/*.jar',
                                 fingerprint: true,
                                 allowEmptyArchive: false
            }
        }

        // ===== 阶段 6：Docker Build =====
        stage('Docker Build') {
            agent { label 'docker' }
            steps {
                sh """
                    docker build \
                        --build-arg JAR_FILE=${APP_NAME}/target/*.jar \
                        -t ${DOCKER_IMAGE} \
                        -t ${IMAGE_NAME}:latest \
                        .
                """
            }
        }

        // ===== 阶段 7：Push to Harbor =====
        stage('Push') {
            agent { label 'docker' }
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'harbor-creds',
                    usernameVariable: 'HARBOR_USER',
                    passwordVariable: 'HARBOR_PASS'
                )]) {
                    sh """
                        docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} harbor.xxx.com
                        retry 3 docker push ${DOCKER_IMAGE}
                        docker push ${IMAGE_NAME}:latest
                    """
                }
            }
        }

        // ===== 阶段 8：Deploy =====
        stage('Deploy') {
            agent { label 'k8s' }
            when {
                expression { return params.ENV != '' }
            }
            steps {
                script {
                    def credMap = [
                        dev:     'k8s-dev-creds',
                        staging: 'k8s-stg-creds',
                        prod:    'k8s-prod-creds'
                    ]
                    withCredentials([file(
                        credentialsId: credMap[params.ENV],
                        variable: 'KUBECONFIG'
                    )]) {
                        sh """
                            kubectl --kubeconfig=${KUBECONFIG} \
                                set image deployment/${APP_NAME} \
                                ${APP_NAME}=${DOCKER_IMAGE} \
                                -n ${K8S_NAMESPACE}

                            kubectl --kubeconfig=${KUBECONFIG} \
                                rollout status deployment/${APP_NAME} \
                                -n ${K8S_NAMESPACE} \
                                --timeout=5m
                        """
                    }
                }
            }
        }
    }

    // ===== 构建后操作 =====
    post {
        // 始终执行
        always {
            echo "构建结束：${currentBuild.currentResult}"
            // 清理 workspace
            cleanWs()
        }
        // 成功
        success {
            script {
                def msg = """
                    ✅ 构建成功
                    Job: ${env.JOB_NAME} #${env.BUILD_NUMBER}
                    分支: ${params.BRANCH}
                    环境: ${params.ENV}
                    镜像: ${DOCKER_IMAGE}
                    提交: ${env.GIT_COMMIT}
                    链接: ${env.BUILD_URL}
                """.stripIndent()
                dingtalk(
                    type: 'MARKDOWN',
                    title: '✅ Jenkins 构建成功',
                    text: msg,
                    at: []
                )
            }
        }
        // 失败
        failure {
            script {
                // 归档失败日志
                archiveArtifacts artifacts: '**/build.log',
                                 allowEmptyArchive: true
                // 钉钉告警
                dingtalk(
                    type: 'MARKDOWN',
                    title: '❌ Jenkins 构建失败',
                    text: """
                        ❌ 构建失败
                        Job: ${env.JOB_NAME} #${env.BUILD_NUMBER}
                        分支: ${params.BRANCH}
                        提交: ${env.GIT_COMMIT}
                        链接: ${env.BUILD_URL}
                        失败阶段: ${env.STAGE_NAME ?: '未知'}
                    """.stripIndent()
                )
            }
        }
        // 终止
        aborted {
            echo '构建被人工终止'
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

stage('Checkout') {
    agent { label 'maven' }
    steps {
        checkout([
            $class: 'GitSCM',
            branches: [[name: params.BRANCH]],
            userRemoteConfigs: [[
                url: 'git@github.com:myteam/order-service.git',
                credentialsId: 'github-ssh-key'
            ]],
            extensions: [
                // 拉 common-lib 子模块
                [$class: 'SubmoduleOption',
                 recursiveSubmodules: true,
                 parentCredentials: true],
                // 浅克隆（只拉最近 50 个 commit，加速）
                [$class: 'CloneOption',
                 depth: 50, shallow: true, noTags: false]
            ]
        ])
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// 1. 批模式：-B 减少 Jenkins 日志噪音
sh 'mvn -B clean package'

// 2. 版本校验：-V 强制用父 POM 版本（防 dep version 漂移）
sh 'mvn -B -V clean package'

// 3. 并行构建：-T 4（4 线程并行）
sh 'mvn -B -T 4 clean package'

// 4. 跳过测试：-DskipTests
sh 'mvn -B -DskipTests package'

// 5. 增量编译：am（also-make）只编译依赖模块
sh 'mvn -B -pl order-service -am clean package'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

stage('Test') {
    agent { label 'maven' }
    steps {
        sh 'mvn -B test'
        // JUnit 报告聚合
        junit allowEmptyResults: true,
              testResults: '**/target/surefire-reports/*.xml'

        // 覆盖率门槛
        jacoco(execPattern: '**/target/jacoco.exec',
               minimumLineCoverage: '0.60',
               minimumBranchCoverage: '0.50')
    }
}

1
2
3
4
5

# docker-compose.yml 给 maven agent 挂 .m2
services:
  maven-agent:
    volumes:
      - ~/.m2:/root/.m2  # 共享宿主机 .m2 目录

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

stage('Code Scan') {
    agent { label 'maven' }
    steps {
        // 1. 注入 SonarQube 配置（从 Jenkins 全局配置里拿 token）
        withSonarQubeEnv('sonarqube-server') {
            sh 'mvn sonar:sonar -Dsonar.projectKey=order-service'
        }
        // 2. 阻塞等结果（10 分钟超时）
        timeout(time: 10, unit: 'MINUTES') {
            // 3. Quality Gate 不通过 abortPipeline: true
            waitForQualityGate abortPipeline: true
        }
    }
}

1
2
3
4
5
6
7
8
9

sonar.projectKey=order-service
sonar.projectName=Order Service
sonar.projectVersion=1.0.0
sonar.sources=order-service/src/main/java
sonar.tests=order-service/src/test/java
sonar.java.binaries=order-service/target/classes
sonar.java.coveragePlugin=jacoco
sonar.coverage.jacoco.xmlReportPaths=order-service/target/site/jacoco/jacoco.xml
sonar.exclusions=**/generated/**,**/proto/**

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

stage('Docker Build') {
    agent { label 'docker' }
    steps {
        sh """
            docker build \
                --build-arg JAR_FILE=order-service/target/*.jar \
                -t ${DOCKER_IMAGE} \
                -t ${IMAGE_NAME}:latest \
                .
        """
    }
}

stage('Push') {
    agent { label 'docker' }
    steps {
        withCredentials([usernamePassword(
            credentialsId: 'harbor-creds',
            usernameVariable: 'HARBOR_USER',
            passwordVariable: 'HARBOR_PASS'
        )]) {
            sh """
                docker login -u ${HARBOR_USER} -p ${HARBOR_PASS} harbor.xxx.com
                docker push ${DOCKER_IMAGE}
                docker push ${IMAGE_NAME}:latest
            """
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

stage('Deploy') {
    agent { label 'k8s' }
    when {
        expression { return params.ENV != '' }
    }
    steps {
        script {
            // 凭据切换（多环境）
            def credMap = [
                dev:     'k8s-dev-creds',
                staging: 'k8s-stg-creds',
                prod:    'k8s-prod-creds'
            ]
            withCredentials([file(
                credentialsId: credMap[params.ENV],
                variable: 'KUBECONFIG'
            )]) {
                sh """
                    # 1. 替换镜像版本
                    kubectl --kubeconfig=\${KUBECONFIG} \\
                        set image deployment/${APP_NAME} \\
                        ${APP_NAME}=${DOCKER_IMAGE} \\
                        -n ${K8S_NAMESPACE}

                    # 2. 等待滚动更新完成
                    kubectl --kubeconfig=\${KUBECONFIG} \\
                        rollout status deployment/${APP_NAME} \\
                        -n ${K8S_NAMESPACE} \\
                        --timeout=5m
                """
            }
        }
    }
}

1
2
3

Payload URL:  http://jenkins.xxx.com/generic-webhook-trigger/invoke?token=order-service-token
Content type: application/json
Events:       push, pull_request

1
2

URL:    http://jenkins.xxx.com/project/order-service
Events: Push events, Merge request events

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

// Jenkinsfile 顶部
triggers {
    GenericTrigger(
        // token 唯一标识这个 job
        token: 'order-service-token',
        // 打印 payload 到控制台（调试用）
        printPostContent: true,
        // 解析 push 事件
        regexpFilterText: '$ref',
        regexpFilterExpression: '^refs/heads/(.*)$',
        // 提取分支名
        causeString: 'Triggered by push on branch',
        // 参数化注入
        genericVariables: [
            [key: 'BRANCH_FROM_PAYLOAD', value: '$.ref'],
        ]
    )
}

1
2
3
4
5
6
7
8

parameters {
    choice(name: 'ENV', choices: ['dev', 'staging', 'prod'],
           description: '部署环境')
    string(name: 'BRANCH', defaultValue: 'main',
           description: '代码分支')
    string(name: 'IMAGE_TAG', defaultValue: '',
           description: '镜像 tag（留空用 commit SHA）')
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

stage('Deploy') {
    steps {
        script {
            def credMap = [
                dev:     'k8s-dev-creds',
                staging: 'k8s-stg-creds',
                prod:    'k8s-prod-creds'
            ]
            def credId = credMap[params.ENV]
            if (!credId) {
                error("未知环境：${params.ENV}")
            }
            withCredentials([file(
                credentialsId: credId,
                variable: 'KUBECONFIG'
            )]) {
                sh "kubectl --kubeconfig=${KUBECONFIG} apply -f deploy/"
            }
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

post {
    success {
        script {
            withCredentials([string(
                credentialsId: 'dingtalk-webhook',
                variable: 'WEBHOOK'
            )]) {
                sh """
                    curl -X POST ${WEBHOOK} \
                        -H 'Content-Type: application/json' \
                        -d '{
                            "msgtype": "markdown",
                            "markdown": {
                                "title": "✅ 构建成功",
                                "text": "## ✅ ${env.JOB_NAME} #${env.BUILD_NUMBER}\n\n**环境**: ${params.ENV}\n**分支**: ${params.BRANCH}\n**提交**: ${env.GIT_COMMIT}\n\n[查看构建](${env.BUILD_URL})"
                            }
                        }'
                """
            }
        }
    }
    failure {
        // 失败也发，加 @ 负责人
        ...
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

stage('Deploy to Prod') {
    when {
        expression { return params.ENV == 'prod' }
    }
    steps {
        script {
            // 1. 部署到 prod
            deployToProd()
            // 2. 等 5 分钟（缓冲回滚）
            echo '等待 5 分钟观察监控...'
            sleep 300
            // 3. 人工确认
            timeout(time: 10, unit: 'MINUTES') {
                input(
                    message: '生产部署后 5 分钟观察期已到，是否确认发布？',
                    ok: '确认（继续）',
                    submitter: 'tech-lead,devops',
                    submitterParameter: 'APPROVER'
                )
            }
            // 4. 记录审批人
            echo "Prod 部署由 ${APPROVER} 确认"
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

jenkins-shared-library/                 # 独立 Git 仓库
├── vars/                               # 【声明式直接调用的方法】
│   ├── buildMaven.groovy               # 文件名 = 方法名
│   ├── buildNode.groovy
│   ├── buildPython.groovy
│   ├── dockerBuild.groovy
│   ├── dockerPush.groovy
│   ├── deployK8s.groovy
│   ├── deployArgoRollout.groovy
│   ├── notifyDingTalk.groovy
│   └── sonarScan.groovy
├── src/                                # 【普通 Groovy 类】
│   └── com/myteam/ci/
│       ├── Utils.groovy                # 工具类
│       ├── DockerUtils.groovy
│       └── K8sUtils.groovy
├── resources/                          # 【静态资源】
│   ├── com/myteam/ci/
│   │   └── Dockerfile-template.txt     # Dockerfile 模板
│   └── sonar/
│       └── sonar-template.properties
├── test/                               # 【单元测试】
│   └── com/myteam/ci/
│       └── UtilsTest.groovy
├── README.md
└── CHANGELOG.md

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

// vars/buildMaven.groovy
import com.myteam.ci.Utils

def call(Map args) {
    // 参数校验
    if (!args.projectName) {
        error "buildMaven 必须传 projectName 参数"
    }
    def projectName = args.projectName
    def goals = args.goals ?: 'clean package'
    def skipTests = args.skipTests ?: false
    def useJacoco = args.useJacoco ?: true

    // 打印分隔
    Utils.printBanner("Maven Build: ${projectName}")

    // 1. 编译
    sh "mvn -B -V -T 4 -pl ${projectName} -am clean compile"

    // 2. 测试
    if (!skipTests) {
        sh "mvn -B -pl ${projectName} -am test"
        junit allowEmptyResults: true,
              testResults: "**/${projectName}/target/surefire-reports/*.xml"
        if (useJacoco) {
            jacoco(execPattern: "**/${projectName}/target/jacoco.exec",
                   minimumLineCoverage: '0.60')
        }
    }

    // 3. 打包
    sh "mvn -B -pl ${projectName} -am -DskipTests clean package"
    archiveArtifacts artifacts: "${projectName}/target/*.jar",
                     fingerprint: true
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

// vars/deployK8s.groovy
import com.myteam.ci.K8sUtils

def call(Map args) {
    def env = args.env
    def appName = args.appName
    def image = args.image
    def namespace = args.namespace ?: env
    def replicas = args.replicas ?: 3
    def waitTime = args.waitTime ?: '5m'

    // 环境校验
    if (!['dev', 'staging', 'prod'].contains(env)) {
        error "deployK8s env 必须是 dev/staging/prod，当前：${env}"
    }

    // 凭据切换
    def credMap = [
        dev:     'k8s-dev-creds',
        staging: 'k8s-stg-creds',
        prod:    'k8s-prod-creds'
    ]

    withCredentials([file(
        credentialsId: credMap[env],
        variable: 'KUBECONFIG'
    )]) {
        Utils.printBanner("Deploy ${appName} to ${env}")

        // 1. 替换镜像
        sh """
            kubectl --kubeconfig=\${KUBECONFIG} \
                set image deployment/${appName} \
                ${appName}=${image} \
                -n ${namespace}
        """

        // 2. 等待 rollout
        sh """
            kubectl --kubeconfig=\${KUBECONFIG} \
                rollout status deployment/${appName} \
                -n ${namespace} \
                --timeout=${waitTime}
        """

        // 3. 健康检查
        K8sUtils.healthCheck(
            kubeconfig: env.KUBECONFIG,
            appName: appName,
            namespace: namespace
        )
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

// src/com/myteam/ci/Utils.groovy
package com.myteam.ci

class Utils implements Serializable {
    private static final long serialVersionUID = 1L

    static void printBanner(String text) {
        def line = '*' * (text.length() + 8)
        println ""
        println line
        println "*** ${text} ***"
        println line
    }

    static String getGitShortSha() {
        return sh(returnStdout: true, script: 'git rev-parse --short HEAD').trim()
    }

    static Map parseEnv(String envStr) {
        def parts = envStr.split('/')
        return [
            cluster: parts[0],
            namespace: parts.size() > 1 ? parts[1] : 'default'
        ]
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

// order-service/Jenkinsfile
@Library('jenkins-shared-library@1.0.0') _   // 锁版本！

pipeline {
    agent none
    stages {
        stage('Build') {
            agent { label 'maven' }
            steps {
                buildMaven(
                    projectName: 'order-service',
                    goals: 'clean package',
                    skipTests: false
                )
            }
        }
        stage('Deploy') {
            agent { label 'k8s' }
            steps {
                deployK8s(
                    env: 'dev',
                    appName: 'order-service',
                    image: "${DOCKER_IMAGE}"
                )
            }
        }
    }
}

1
2
3
4
5
6

# 共享库仓库打 tag
git tag -a v1.0.0 -m "stable"
git push origin v1.0.0

# Jenkinsfile 锁版本
@Library('jenkins-shared-library@1.0.0') _

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

// test/com/myteam/ci/UtilsTest.groovy
package com.myteam.ci

import org.junit.Test
import static org.junit.Assert.assertEquals

class UtilsTest {
    @Test
    void testParseEnv() {
        def result = Utils.parseEnv('prod/order')
        assertEquals 'prod', result.cluster
        assertEquals 'order', result.namespace
    }

    @Test
    void testParseEnvWithoutNamespace() {
        def result = Utils.parseEnv('dev')
        assertEquals 'dev', result.cluster
        assertEquals 'default', result.namespace
    }
}

1

./gradlew test   # 或 mvn test

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# docker-compose.yml
docker-agent:
  image: docker:24-dind
  privileged: true                              # DIND 必须特权模式
  environment:
    - DOCKER_TLS_CERTDIR=                       # 关闭 TLS（容器内用）
  volumes:
    - docker_data:/var/lib/docker               # 独立 docker 数据卷
  networks:
    - jenkins-net

1
2
3
4
5
6

# docker-compose.yml
maven-agent:
  image: maven:3.9-eclipse-temurin-17
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - /usr/bin/docker:/usr/bin/docker:ro

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# syntax=docker/dockerfile:1.7
# 多阶段构建：第一阶段用 JDK 编译，第二阶段用 JRE 跑

# ===== Stage 1: Build =====
FROM eclipse-temurin:17-jdk AS builder
WORKDIR /build

# 1. 先复制 POM（利用 Docker 缓存）
COPY pom.xml ./
COPY common-lib/pom.xml common-lib/
COPY order-service/pom.xml order-service/
RUN mvn -B -T 4 -q dependency:go-offline

# 2. 复制源码
COPY . .

# 3. 打包
RUN mvn -B -pl order-service -am -DskipTests clean package

# ===== Stage 2: Runtime =====
FROM eclipse-temurin:17-jre-jammy
WORKDIR /app

# 4. 安装必要工具
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl tini && \
    rm -rf /var/lib/apt/lists/*

# 5. 复制 jar
COPY --from=builder /build/order-service/target/*.jar app.jar

# 6. 标签元数据
LABEL org.opencontainers.image.title="order-service" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${GIT_SHA}" \
      org.opencontainers.image.source="https://github.com/myteam/order-service"

# 7. 健康检查
HEALTHCHECK --interval=30s --timeout=3s --start-period=60s --retries=3 \
  CMD curl -f http://localhost:8080/actuator/health || exit 1

# 8. 用 tini 作为 init 进程（处理僵尸进程）
ENTRYPOINT ["/usr/bin/tini", "--", "java", \
            "-XX:+UseContainerSupport", \
            "-XX:MaxRAMPercentage=75.0", \
            "-Djava.security.egd=file:/dev/./urandom", \
            "-jar", "/app/app.jar"]

EXPOSE 8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

charts/order-service/
├── Chart.yaml
├── values.yaml
├── values-dev.yaml
├── values-staging.yaml
├── values-prod.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    ├── ingress.yaml
    ├── configmap.yaml
    ├── serviceaccount.yaml
    ├── hpa.yaml
    ├── pdb.yaml
    └── _helpers.tpl

1
2
3
4
5
6
7
8
9

apiVersion: v2
name: order-service
description: Order Service for MyTeam
type: application
version: 1.0.0
appVersion: "1.0.0"
maintainers:
  - name: MyTeam DevOps
    email: devops@xxx.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

replicaCount: 3

image:
  repository: harbor.xxx.com/myteam/order-service
  pullPolicy: IfNotPresent
  tag: ""  # 留空，CI 覆盖

imagePullSecrets:
  - name: harbor-pull-secret

service:
  type: ClusterIP
  port: 8080
  targetPort: 8080

ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  hosts:
    - host: order-service.xxx.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - hosts:
        - order-service.xxx.com
      secretName: order-service-tls

resources:
  requests:
    cpu: 500m
    memory: 1Gi
  limits:
    cpu: 2000m
    memory: 2Gi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

probes:
  liveness:
    path: /actuator/health/liveness
    initialDelaySeconds: 60
    periodSeconds: 10
  readiness:
    path: /actuator/health/readiness
    initialDelaySeconds: 30
    periodSeconds: 5

env:
  - name: SPRING_PROFILES_ACTIVE
    value: prod
  - name: JAVA_OPTS
    value: "-Xms512m -Xmx1536m"