基于k8s与jenkins的GitOps(1)-部署gitlab

• 部署gitlab

• namespace

• redis

• secret

• postgresql

• gitlab

GitOps相关概念比较多，在很多文章中，也有相关介绍，由于个yaml文件比较多，就不进行详细描述了。

部署gitlab

namespace

# cd /data1/k8s/
# mkdir gitops
# mkdir gitlab
# vim namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: gitlab
# kubectl apply -f  namespace.yaml 
namespace/gitlab created

redis

# vim redis.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: gitlab-redis
  namespace: gitlab
  labels:
    app: gitlab-redis
spec:
  type: ClusterIP
  ports:
    - name: redis
      protocol: TCP
      port: 6379
      targetPort: redis
  selector:
    app: gitlab-redis
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: gitlab-redis
  namespace: gitlab
  labels:
    app: gitlab-redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitlab-redis
  template:
    metadata:
      name: gitlab-redis
      labels:
        app: gitlab-redis
    spec:
      containers:
        - name: gitlab-redis
          image: "sameersbn/redis:4.0.9-3"
          ports:
            - name: redis
              containerPort: 6379
              protocol: TCP
          resources:
            limits:
              cpu: 500m
              memory: 1Gi
            requests:
              cpu: 200m
              memory: 1Gi
          livenessProbe:
            exec:
              command:
                - redis-cli
                - ping
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            exec:
              command:
                - redis-cli
                - ping
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          volumeMounts:
            - name: redis-data
              mountPath: /data1/redis
      volumes:
        - name: redis-data
          hostPath:
            path: /data1/redis
# kubectl apply -f redis.yaml 
service/gitlab-redis created
deployment.apps/gitlab-redis created
# kubectl get pods -n gitlab
NAME                            READY   STATUS    RESTARTS   AGE
gitlab-redis-7cd9c4b899-984mh   1/1     Running   0          52s

secret

# vim secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: gitlab
  namespace: gitlab
data:
  db_pass: bWFnZWR1LmNvbQ==
  db_user: Z2l0bGFi
  gitlab_root_pass: bWFnZWR1LmNvbQ== 
  gitlab_secrets_db_key_base: bE92U1NTcHMwSDJVU2tBTS9VajhZVUZMRjhPS25xUGhwTG5ocG41N0drTQ==
  gitlab_secrets_otp_key_base: aVZ6Z01OUFoybjFKRk1US1ltUUVUS3lYL3VpbWpKaDBMeVhFemlmTmhVNA==
  gitlab_secrets_secret_key_base: VFVFNWk3SW1wT0lQSzN6cnZCTnFUU09UWjI3ZjRkTm56cVNXejF6eW5BWQ==
type: Opaque
# kubectl apply -f secret.yaml 
secret/gitlab created
# kubectl get secret -n gitlab
NAME                  TYPE                                  DATA   AGE
default-token-c7h4l   kubernetes.io/service-account-token   3      102s
gitlab                Opaque                                6      14s

用于连接数据库的密码db_pass与git的root密码gitlab_root_pass设置了同一密码，部署前可以使用base64加密方式修改为自己的设置的密码替换。

GITLAB_SECRETS_DB_KEY_BASE：用于加密 CI 密钥变量及数据库中的重要凭证。如果丢失这个密码，将无法使用已经存在的 CI 密钥。

GITLAB_SECRETS_OTP_KEY_BASE：用于加密数据库的 2FA 密钥。如果丢失这个密码，所有用户都无法通过 2FA 登录

GITLAB_SECRETS_SECRET_KEY_BASE：用于密码重置链接以及其他“标准”身份验证功能。如果丢失这个密码，电子邮件中的密码重置 token 将重置。

postgresql

# vim postgresql.yaml
---
## Service
kind: Service
apiVersion: v1
metadata:
  name: gitlab-postgresql
  namespace: gitlab
  labels:
    app: gitlab-postgresql
spec:
  ports:
    - name: postgres
      protocol: TCP
      port: 5432
      targetPort: postgres
  selector:
    app: postgresql
  type: ClusterIP
---
## Deployment
kind: Deployment
apiVersion: apps/v1
metadata:
  name: gitlab-pgsql
  namespace: gitlab
  labels:
    app: postgresql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgresql
  template:
    metadata:
      name: postgresql
      labels:
        app: postgresql
    spec:
      containers:
      - name: postgresql
        image: sameersbn/postgresql:12-20200524
        ports:
        - name: postgres
          containerPort: 5432
        env:
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: db_user
        - name: DB_PASS
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: db_pass
        - name: DB_NAME
          value: gitlabhq_production
        - name: DB_EXTENSION
          value: 'pg_trgm,btree_gist'
        resources: 
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 2
            memory: 2Gi
        livenessProbe:
          exec:
            command: ["pg_isready","-h","localhost","-U","postgres"]
          initialDelaySeconds: 30
          timeoutSeconds: 5
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          exec:
            command: ["pg_isready","-h","localhost","-U","postgres"]
          initialDelaySeconds: 5
          timeoutSeconds: 1
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        volumeMounts:
        - name: postgre-data
          mountPath: /data1/postgresql
      volumes:
      - name: postgre-data
        hostPath:
          path: /data1/postgresql
# kubectl apply -f postgresql.yaml 
service/gitlab-postgresql created
deployment.apps/gitlab-pgsql created
# kubectl get pods -n gitlab 
NAME                            READY   STATUS    RESTARTS   AGE
gitlab-pgsql-78667b8d48-mk5vn   1/1     Running   0          37s
gitlab-redis-7cd9c4b899-984mh   1/1     Running   0          2m33s

gitlab

# vim gitlab.yaml
---
kind: Service
apiVersion: v1
metadata:
  name: gitlab
  namespace: gitlab
  labels:
    app: gitlab
  annotations:
    kubernetes.io/elb.class: union
    kubernetes.io/elb.id: a27c8dfa-a0b1-4f70-8453-6d997b2959ba
    kubernetes.io/elb.mark: '0'
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80 
      targetPort: 80
      nodePort: 31080
    - name: ssh
      protocol: TCP
      port: 22
      targetPort: 22
      nodePort: 31022
  selector:
    app: gitlab
  type: NodePort
  externalTrafficPolicy: Cluster
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: gitlab
  namespace: gitlab
  labels:
    app: gitlab
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitlab
  template:
    metadata:
      name: gitlab
      labels:
        app: gitlab
    spec:
      containers:
      - name: gitlab
        image: 'sameersbn/gitlab:13.10.2'
        ports:
        - name: ssh
          containerPort: 22
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443
        env:
        - name: GITLAB_TIMEZONE
          value: Asia/Shanghai
        - name: GITLAB_SECRETS_OTP_KEY_BASE
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: gitlab_secrets_otp_key_base
        - name: GITLAB_SECRETS_DB_KEY_BASE
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: gitlab_secrets_db_key_base
        - name: GITLAB_SECRETS_SECRET_KEY_BASE
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: gitlab_secrets_secret_key_base
        - name: GITLAB_ROOT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: gitlab_root_pass
        - name: GITLAB_ROOT_EMAIL 
          value: kevin@aliyun.com
        - name: GITLAB_HOST           
          value: 'localhost'
        - name: GITLAB_PORT        
          value: '80' 
        - name: GITLAB_SSH_PORT   
          value: '22'
        - name: GITLAB_NOTIFY_ON_BROKEN_BUILDS
          value: 'true'
        - name: GITLAB_NOTIFY_PUSHER
          value: 'false'
        - name: DB_TYPE             
          value: postgres
        - name: DB_HOST         
          value: gitlab-postgresql           
        - name: DB_PORT          
          value: '5432'
        - name: DB_USER        
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: db_user
        - name: DB_PASS         
          valueFrom:
            secretKeyRef:
              name: gitlab
              key: db_pass
        - name: DB_NAME          
          value: gitlabhq_production
        - name: REDIS_HOST
          value: gitlab-redis              
        - name: REDIS_PORT      
          value: '6379'
        resources: 
          requests:
            cpu: 1
            memory: 1Gi
          limits:
            cpu: 2
            memory: 8Gi
        livenessProbe:
          httpGet:
            path: /
            port: 80
            scheme: HTTP
          initialDelaySeconds: 300
          timeoutSeconds: 5
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /
            port: 80
            scheme: HTTP
          initialDelaySeconds: 5
          timeoutSeconds: 30
          periodSeconds: 10
          successThreshold: 1
          failureThreshold: 3
        volumeMounts:
        - name: gitlab-data
          mountPath: /data1/gitlab
        - name: localtime
          mountPath: /etc/localtime
      volumes:
      - name: gitlab-data
        hostPath:
          path: /data1/gitlab
      - name: localtime
        hostPath:
          path: /etc/localtime
# kubectl apply -f gitlab.yaml 
service/gitlab created
deployment.apps/gitlab created
# kubectl get pods -n gitlab 
NAME                            READY   STATUS    RESTARTS   AGE
gitlab-646c58687d-nnzqf         1/1     Running   0          16m
gitlab-pgsql-78667b8d48-mk5vn   1/1     Running   0          16m
gitlab-redis-7cd9c4b899-984mh   1/1     Running   0          18m

在浏览器输入http://<nodeip>:31080/即可访问gitlab。

密码为自己设置的密码。