Git 与 GitLab、Jenkins 自动化部署实战指南

git使用[rootserver1 ~]# yum install -y git[rootserver1 ~]# mkdir demo[rootserver1 ~]# cd demo/[rootserver1 demo]# git inithint: Using master as the name for the initial branch. This default branch namehint: will change to main in Git 3.0. To configure the initial branch namehint: to use in all of your new repositories, which will suppress this warning,hint: call:hint:hint: git config --global init.defaultBranch namehint:hint: Names commonly chosen instead of master are main, trunk andhint: development. The just-created branch can be renamed via this command:hint:hint: git branch -m namehint:hint: Disable this message with git config set advice.defaultBranchName falseInitialized empty Git repository in /root/demo/.git/[rootserver1 demo]# git statusOn branch masterNo commits yetnothing to commit (create/copy files and use git add to track)[rootserver1 demo]# git status -s[rootserver1 demo]# echo test README.md[rootserver1 demo]#[rootserver1 demo]# lsREADME.md[rootserver1 demo]# git status -s?? README.md[rootserver1 demo]# git add README.md[rootserver1 demo]# git status -sA README.md[rootserver1 demo]# git config --global user.email user_uuwestos.org[rootserver1 demo]# git config --global user.name user_uu[rootserver1 demo]# git commit -m add README.md[master (root-commit) fc209da] add README.md1 file changed, 1 insertion()create mode 100644 README.md[rootserver1 demo]# echo hello README.md[rootserver1 demo]# git status -sM README.md[rootserver1 demo]# git add README.md[rootserver1 demo]# git status -sM README.md[rootserver1 demo]# echo world README.md[rootserver1 demo]# git status -sMM README.md[rootserver1 demo]# git commit -m v1[master 6c356af] v11 file changed, 1 insertion()[rootserver1 demo]# git status -sM README.md[rootserver1 demo]# git add .[rootserver1 demo]# git status -sM README.md[rootserver1 demo]# git commit -m v2[master 31e4e11] v21 file changed, 1 insertion()[rootserver1 demo]# git status -s查看日志[rootserver1 demo]# git reflog31e4e11 (HEAD - master) HEAD{0}: commit: v26c356af HEAD{1}: commit: v1fc209da HEAD{2}: commit (initial): add README.md更详细地查看[rootserver1 demo]# git log --oneline忽略隐藏文件[rootserver1 demo]# touch .a[rootserver1 demo]#[rootserver1 demo]# git status -s?? .a[rootserver1 demo]# vim .gitignore[rootserver1 demo]# cat .gitignore.*[rootserver1 demo]# git status -s[rootserver1 demo]# echo helloworld test.txt[rootserver1 demo]# git add test.txt[rootserver1 demo]# git commit -m add test.txt[master ac4b79d] add test.txt1 file changed, 1 insertion()create mode 100644 test.txt撤销文件修改[rootserver1 demo]# rm -f test.txt[rootserver1 demo]# git status -sD test.txt[rootserver1 demo]# git checkout -- test.txt取消暂存区文件[rootserver1 demo]# git rm test.txtrm test.txt[rootserver1 demo]# git status -sD test.txt[rootserver1 demo]# git reset HEAD test.txtUnstaged changes after reset:D test.txt[rootserver1 demo]# git status -sD test.txt[rootserver1 demo]# git checkout -- test.txt版本回退[rootserver1 demo]# git rm test.txtrm test.txt[rootserver1 demo]# git commit -m delete test.txt[master 7b3bb7e] delete test.txt1 file changed, 1 deletion(-)delete mode 100644 test.txt[rootserver1 demo]# git reflog7b3bb7e (HEAD - master) HEAD{0}: commit: delete test.txtac4b79d HEAD{1}: commit: add test.txt31e4e11 HEAD{2}: commit: v26c356af HEAD{3}: commit: v1fc209da HEAD{4}: commit (initial): add README.md[rootserver1 demo]# git reset --hard ac4b79dHEAD is now at ac4b79d add test.txt注意log不能查看而reflog中保存有记录[rootserver1 demo]# git log --onelineac4b79d (HEAD - master) add test.txt31e4e11 v26c356af v1fc209da add README.mdgitee远程代码仓库上传公钥[rootserver1 ~]# ssh-keygen[rootserver1 ~]# cd .ssh[rootserver1 .ssh]# lsid_rsa id_rsa.pub[rootserver1 .ssh]# cat id_rsa.pub测试连通性Rocky 虚拟机执行首次连接会提示主机指纹输入yes出现欢迎文字代表 ssh 认证成功[rootserver1 ~]# ssh -T gitgitee.com新建仓库按照gitee建议设置git全局[rootserver1 ~]# cd demo[rootserver1 demo]# git config --global user.name uu[rootserver1 demo]# git config --global user.email 17456376uu_2026user.noreply.gitee.com删除旧# origin git remote remove origin添加gitee远程# git remote add origin gitgitee.com:uu_2026/demo.git查看远程确认# git remote -v推送master分支# git push -u origin master测试克隆仓库[rootserver1 demo]# cd[rootserver1 ~]# rm -fr demo[rootserver1 ~]# git clone gitgitee.com:uu_2026/demo.gitCloning into demo...remote: Enumerating objects: 12, done.remote: Counting objects: 100% (12/12), done.remote: Compressing objects: 100% (5/5), done.remote: Total 12 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)Receiving objects: 100% (12/12), done.[rootserver1 ~]# cd demo[rootserver1 demo]# lsREADME.md test.txtgitlab部署rocky9虚拟机最小需求8G内存Index of /gitlab-ce/yum/el9/Packages/g/ | 清华大学开源软件镜像站 | Tsinghua Open Source Mirror安装依赖[rootserver1 ~]# dnf install -y curl policycoreutils-python-utils openssh-server perl安装本地 gitlab rpm 包[rootserver1 ~]# dnf install -y gitlab-ce-18.11.12-ce.0.el9.x86_64.rpm修改 GitLab 配置文件 gitlab.rb[rootserver1 ~]# vim /etc/gitlab/gitlab.rbexternal_url http://192.168.164.171重新配置并初始化 gitLab[rootserver1 ~]# gitlab-ctl reconfigure查看初始 root 密码密码文件24 小时后自动删除[rootserver1 ~]# cat /etc/gitlab/initial_root_password查看 GitLab 所有组件状态所有服务全部显示run代表正常。[rootserver1 ~]# gitlab-ctl status浏览器访问 登录浏览器打开http://192.168.164.171登录后立刻修改 root 密码初始密码 24h 过期改成简体中文新建项目添加密钥测试连通性[rootserver1 ~]# ssh -T git192.168.164.171克隆项目[rootserver1 ~]# git clone git192.168.164.171:root/demo.gitCloning into demo...remote: Enumerating objects: 3, done.remote: Counting objects: 100% (3/3), done.remote: Compressing objects: 100% (2/2), done.remote: Total 3 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)Receiving objects: 100% (3/3), done.[rootserver1 ~]# lsdemo[rootserver1 ~]# cd demo/[rootserver1 demo]# echo www.westos.org index.html[rootserver1 demo]# lsREADME.md index.html[rootserver1 demo]# git add index.html[rootserver1 demo]# git commit -m add index.html[main eeb0cd4] add index.html1 file changed, 1 insertion()create mode 100644 index.html[rootserver1 demo]# git push -u origin mainEnumerating objects: 4, done.Counting objects: 100% (4/4), done.Delta compression using up to 4 threadsCompressing objects: 100% (2/2), done.Writing objects: 100% (3/3), 305 bytes | 305.00 KiB/s, done.Total 3 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)To 192.168.164.171:root/demo.git8785cab..eeb0cd4 main - mainbranch main set up to track origin/main.jenkins部署官网Linux注意另开一台虚拟机[rootserver1 ~]# dnf install java-21-openjdk-devel -y[rootserver1 ~]# yum install -y fontconfig[rootserver1 ~]# lsjenkins-2.580.1-1.noarch.rpm[rootserver1 ~]# rpm -ivh jenkins-2.580.1-1.noarch.rpmwarning: jenkins-2.580.1-1.noarch.rpm: Header V4 RSA/SHA512 Signature, key ID 14abfc68: NOKEYVerifying... ################################# [100%]Preparing... ################################# [100%]Updating / installing...1:jenkins-2.580.1-1 ################################# [100%]启动服务[rootserver2 ~]# systemctl enable --now jenkins.serviceCreated symlink /etc/systemd/system/multi-user.target.wants/jenkins.service → /usr/lib/systemd/system/jenkins.service.[rootserver2 ~]# netstat -antlp|grep :8080tcp6 0 0 :::8080 :::* LISTEN 12904/java登录192.168.164.172:8080[rootserver2 ~]# cat /var/lib/jenkins/secrets/initialAdminPassworde5e158591df04549adbefb247a3243e7替换国内插件源cd /var/lib/jenkins# 全局替换下载地址把国外地址换成清华镜像sed -i s|https://updates.jenkins.io/download|https://mirrors.tuna.tsinghua.edu.cn/jenkins|g updates/default.json# 重启jenkins生效systemctl restart jenkins安装推荐插件无需新建用户直接使用admin账户配置修改密码新建项目# dnf install git -y# ssh-keygen[rootserver2 ~]# cat /etc/password[rootserver2 ~]# usermod -s /bin/bash jenkins[rootserver2 ~]# su - jenkins[jenkinsserver2 ~]$ pwd/var/lib/jenkins[jenkinsserver2 ~]$ ssh-keygen[jenkinsserver2 ~]$ cd .ssh/[jenkinsserver2 .ssh]$ lsid_rsa id_rsa.pub[jenkinsserver2 .ssh]$ cat id_rsa.pub将公钥上传到gitlab私钥上传到jenkins[rootserver2 ~]# vim /etc/ssh/ssh_configInclude /etc/ssh/ssh_config.d/*.confHost *StrictHostKeyChecking no查看控制台输出安装插件Gitlab设置项目Triggers注意URL用于gitlab中的URL生成Secret token用于gitlab中的secret令牌设置项目中的webhooks打开webhooks出站请求测试推送返回绿色200通信成功触发自动构建自动化构建docker镜像在server2上安装docker-ce[rootserver2 ~]# cd /etc/yum.repos.d/[rootserver2 yum.repos.d]# vim /etc/yum.repos.d/docker.repo[docker]namedocker-cebaseurlhttps://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/rhel/9/x86_64/stable/gpgcheck0[rootserver2 yum.repos.d]# dnf install -y docker-ce修改内核参数[rootserver2 ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1[rootserver2 ~]# sysctl --system[rootserver2 ~]# systemctl enable --now docker配置docker默认仓库[rootserver2 ~]# vim /etc/docker/daemon.json{registry-mirrors: [https://reg.westos.org]}[rootserver2 ~]# systemctl restart docker拷贝仓库证书[rootdocker1 ~]# cd docker[rootdocker1 docker]# scp -r certs.d/ 192.168.164.172:/etc/docker/[rootserver2 ~]# ls /etc/docker/certs.d/reg.westos.org/ca.crt/etc/docker/certs.d/reg.westos.org/ca.crt注意添加解析登录私有harbor仓库[rootserver2]# docker login reg.westos.org测试[rootserver2 ~]# docker pull reg.westos.org/nginx/nginx:1.29安装CloudBees Docker Build and Publish插件配置项目构建注意取消勾选Force Pull在server1上提交Dockerfile[rootserver1 ~]# cd demo[rootserver1 demo]# vim DockerfileFROM nginxCOPY index.html /usr/share/nginx/html[rootserver1 demo]# git status -s?? Dockerfile[rootserver1 demo]# git add Dockerfile[rootserver1 demo]# git commit -m add Dockerfile[main a1d22b2] add Dockerfile1 file changed, 3 insertions()create mode 100644 Dockerfile[rootserver1 demo]# git push -u origin main此时gitlab会主动触发jenkins构建任务观察jenkins的任务输出注意这是报错权限不足将jenkins系统用户加入docker组即可[rootserver2 ~]# usermod -aG docker jenkins[rootserver2 ~]# systemctl restart jenkins[rootserver2 ~]# id jenkinsuid993(jenkins) gid993(jenkins) groups993(jenkins),992(docker)通过ssh插件交付任务在server3上安装docker-ce[rootserver3 ~]# cd /etc/yum.repos.d/[rootserver3 yum.repos.d]# vim /etc/yum.repos.d/docker.repo[docker]namedocker-cebaseurlhttps://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/rhel/9/x86_64/stable/gpgcheck0[rootserver3 yum.repos.d]# dnf install -y docker-ce修改内核参数[rootserver3 ~]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1[rootserver3 ~]# sysctl --system[rootserver3 ~]# systemctl enable --now docker配置docker默认仓库[rootserver3 ~]# vim /etc/docker/daemon.json{registry-mirrors: [https://reg.westos.org]}[rootserver3 ~]# systemctl restart docker拷贝仓库证书[rootdocker1 ~]# cd docker[rootdocker1 docker]# scp -r certs.d/ 192.168.164.173:/etc/docker/[rootserver3 ~]# ls /etc/docker/certs.d/reg.westos.org/ca.crt/etc/docker/certs.d/reg.westos.org/ca.crtjenkins安装ssh插件进入系统配置添加ssh主机新建docker_test项目构建后控制台查看输出安装RABC插件基于角色的访问控制Jenkins 这个插件名字就叫Role-based Authorization Strategy不直接给用户分配权限先定义角色、给角色分配权限再把用户加入角色。修改默认授权策略新建测试用户新建角色管理用户登入用户uu测试只有read权限jenkins结合ansible参数化构建server2上安装ansible新建gitlab项目克隆项目[rootserver1 ~]# git clone git192.168.164.171:root/playbook.gitCloning into playbook...remote: Enumerating objects: 3, done.remote: Counting objects: 100% (3/3), done.remote: Compressing objects: 100% (2/2), done.remote: Total 3 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)Receiving objects: 100% (3/3), done.[rootserver1 ~]# cd playbook/[rootserver1 playbook]# vim ansible.cfg[defaults]command_warningsFalseremote_userdevops[privilege_escalation]becomeTruebecome_methodsudobecome_userrootbecome_ask_passFalse[rootserver1 inventory]# vim test[test]192.168.164.173 http_port8000[rootserver1 inventory]# vim prod[prod]192.168.164.174 http_port8080[rootserver1 inventory]# cd ..[rootserver1 playbook]# vim playbook.yaml---- hosts: alltasks:- name: install the latest version of Apacheyum:name: httpdstate: latest- name: configure apachetemplate:src: httpd.conf.j2dest: /etc/httpd/conf/httpd.confnotify: restart apache- name: Start service httpd, if not startedservice:name: httpdstate: startedenabled: yeshandlers:- name: restart apacheservice:name: httpdstate: restarted[rootserver1 playbook]# yum install -y httpd[rootserver1 playbook]# cp /etc/httpd/conf/httpd.conf .[rootserver1 playbook]# mv httpd.conf httpd.conf.j2[rootserver1 playbook]# vim httpd.conf.j2Listen {{ http_port }}推送项目[rootserver1 playbook]# git add .[rootserver1 playbook]# git status -sA ansible.cfgA httpd.conf.j2A inventory/prodA inventory/testA playbook.yaml[rootserver1 playbook]# git commit -m add playbook.yaml[main 8060206] add playbook.yaml5 files changed, 400 insertions()create mode 100644 ansible.cfgcreate mode 100644 httpd.conf.j2create mode 100644 inventory/prodcreate mode 100644 inventory/testcreate mode 100644 playbook.yaml[rootserver1 playbook]# git push -u origin mainEnumerating objects: 9, done.Counting objects: 100% (9/9), done.Delta compression using up to 4 threadsCompressing objects: 100% (6/6), done.Writing objects: 100% (8/8), 5.38 KiB | 5.38 MiB/s, done.Total 8 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)To 192.168.164.171:root/playbook.git1449385..8060206 main - mainbranch main set up to track origin/main.jenkins新建项目playbookGeneral源码管理Build Steps选择参数构建