1.基于GitLab代码仓库的持续集成基础配置和使用

GitLab 服务器: 192.168.1.250 = gitlab.weiyigeek.top
Gitlab-Runner 服务器: 192.168.1.3

#方式1: GitLab官方安装脚本
curl -L https://packages.gitlab.com/install/repositories/runner/gitlab-ci-multi-runner/script.rpm.sh | sudo bash
yum install -y gitlab-ci-multi-runner
gitlab-ci-multi-runner register


#方式2:清华大学镜像站源进行安装Gitlab-Runner
cat > /etc/yum.repos.d/gitlab-runner.repo <<END
[gitlab-runner]
name=gitlab-runner
baseurl=https://mirrors.tuna.tsinghua.edu.cn/gitlab-runner/yum/el7
repo_gpgcheck=0
gpgcheck=0
enabled=1
gpgkey=https://packages.gitlab.com/gpg.key
END
sudo yum makecache
sudo yum list gitlab-runner --showduplicates #查看可安装版本
sudo yum install gitlab-runner -y
# 此处您可以安装指定版本 其中 12.3.5 即为指定的版本号
# yum install gitlab-runner-12.3.5-1.x86_64 -y

1.安装GitLab Runner
2.在 Runner 设置时指定以下 URL： http://gitlab.weiyigeek.top/
3.在安装过程中使用以下注册令牌： qupxfdPtuzCckymoSCUu
4.启动 Runner!

[root@Gitlab-Runner ~]$gitlab-runner register
Runtime platform    arch=amd64 os=linux pid=20709 revision=4c96e5ad version=12.9.0
Running in system-mode.
Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/):
http://gitlab.weiyigeek.top/   #Gitlab地址
Please enter the gitlab-ci token for this runner:
qupxfdPtuzCckymoSCUu           #gitlab-ci令牌
Please enter the gitlab-ci description for this runner:
[initiator]: TestRunner       #Runner 描述
Please enter the gitlab-ci tags for this runner (comma separated):
TestRunner   #Runner 标签
Registering runner... succeeded  runner=qupxfdPt #表示注册成功
Please enter the executor: parallels, custom, docker, docker-ssh, docker+machine, docker-ssh+machine, kubernetes, shell, ssh, virtualbox:
shell #执行方式
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!

$nano /etc/gitlab-runner/config.toml

# 限制了整个GitLab Runner能并发处理job的数量
concurrent = 1
check_interval = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "TestRunner"
  url = "http://gitlab.weiyigeek.top/"
  #注册生成的Runner 令牌
  token = "5UmJ5uECw5k6H_phzeiW"
  executor = "shell"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]

[[runners]]
  name = "DockerRunner"
  url = "http://gitlab.weiyigeek.top/"
  token = "HrpstQA6eezWv5-9m5-d"
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
  [runners.docker]
    # 在这里需要添加上 harbor 的地址，才能允许 pull 私有 registry 的镜像
    allowed_images = ["192.168.1.1/*:*"]
    tls_verify = false
    image = "alpine-node:latest"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0

## 1.注册runner 会以引导的方式询问相关参数的设置-交互式
$ gitlab-runner register

## 2.查看已经注册的runner
$ gitlab-runner list
Runtime platform            arch=amd64 os=linux pid=81864 revision=4c96e5ad version=12.9.0
Listing configured runners    ConfigFile=/home/gitlab-runner/.gitlab-runner/config.toml

# 3.删除gitlab-runner相关配置
sudo gitlab-runner uninstall

# 4.安装并设置--user(例如设置为root)
sudo gitlab-runner install --working-directory /home/gitlab-runner --user root 

# 5.临时采用root权限运行runner(坑多，在Gitlab-CI中由于采用的gitlab-runner用户常常操作文件时候提醒权限不足)
sudo gitlab-runner run

#6.将GitLab Runner安装为系统服务：
sudo gitlab-runner install -n "<service-name>" -u <user-name>

#7.启动服务
sudo gitlab-runner start -n "<service-name>"

#Path: secopsdev/.gitlab-ci.yml
#使用.gitlab-ci.yml配置你的项目,注意下面Tags是必须要指定的否则CI报错找不到Runner;
stages:
  - test
  - build
  - deploy
#每次
before_script:
  - echo "#Before script section" >> WeiyiGeek.txt
  - echo "For example you might run an update here or install a build dependency"
  - echo "Or perhaps you might print out some debugging details"

after_script:
  - echo "#After script section" >> WeiyiGeek.txt
  - echo "For example you might do some cleanup here"

test1:
  stage: test
  script:
    - echo "(1) Do a test here - 正在进行代码测试 阶段1 "
    - echo "For example run a test suite"
  tags:
    - TestRunner
    
test2:
  stage: test
  script:
    - echo "(2) Do another parallel test here - 正在进行代码测试 阶段2 并行测试 "
    - echo "For example run a lint test"
  tags:
    - TestRunner
    
build:
  stage: build
  script:
    - echo "(3) Building the app - 正在对项目进行编译 "
  tags:
    - TestRunner
    
deploy:
  stage: deploy
  script:
    - echo "(4) Deploy to staging server :" $url
    - echo "(4) Deploy to staging server :" $(env)
  environment:
    name: staging
    url: https://staging.weiyigeek.top
  only:
    - master
  tags:
    - TestRunner

Please enter the executor: parallels, custom, docker, docker-ssh, docker+machine, docker-ssh+machine, kubernetes, shell, ssh, virtualbox:

#Repo
/home/gitlab-runner/builds/5UmJ5uEC/0/WeiyiGeek/blog

#Cache
/home/gitlab-runner/cache/WeiyiGeek/blog

[runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
  [runners.docker]
    # 在这里需要添加上 harbor 的地址，才能允许 pull 私有 registry 的镜像
    allowed_images = ["192.168.1.1/*:*"]
    tls_verify = false
    image = "alpine-node:latest"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0

$ sudo docker images
REPOSITORY                          TAG
gitlab/gitlab-runner-helper     x86_64-3afdaba6
gitlab/gitlab-runner-helper     x86_64-cf91d5e1

volumes = ["/home/x1twbm/.ssh:/root/.ssh:ro"]

/home/gitlab-runner/cache/gitlab用户/项目名称/cache.zip
/home/gitlab-runner/cache/WeiyiGeek/blog/cache.zip

#全局缓存 global_cache
cache: &global_cache
  key: ${CI_JOB_NAME} #结合 GitLab CI/CD 中预定义的参数有不同的效果
  # 缓存 node_modules/目录 下次构建不会删除
  paths:  
    - node_modules/
  policy: pull-push #默认对缓存文件进行拉取与更新

#局部缓存 local_cache
local_cache:
  stage: build
  cache:   #如果在 job 内部也定义了 cache 配置，全局的配置就会被覆盖
    key: ${CI_JOB_NAME}
    policy: pull  #使用了pull 策略不会在 job 结束后进行文件的上传操作
    paths:
      - node_modules/ 
      - binaries/*.apk  #在binaries 目录下以 .apk 结尾的所有文件以及 .config 文件会被缓存下来。
  
#Cache 的继承
inherit_cache:
 cache:
    # 继承全局配置
    <<: *global_cache
    # 仅覆盖 cache:policy 的配置
    policy: pull


# Cache 的禁用
disable_cache
  cache: {}

[[runners]]
  limit = 10
  executor = "docker"
  [runners.cache]
    Type = "s3"
    Path = "path/to/prefix"
    Shared = true
    [runners.cache.s3]
      ServerAddress = "s3.example.com"
      AccessKey = "access-key"
      SecretKey = "secret-key"
      BucketName = "runner"
      Insecure = false

stages:
   - test1
   - test2
   - test3

cache:
   key: "$CI_COMMIT_REF_SLUG"
   paths:
     - Test.txt

job1:
   stage: test1
   script:
     - cat Test.txt
     - echo "aaaaaaaaaa" > Test.txt
     - cat Test.txt
   tags:
     - base-runner

job2:
   stage: test2
   cache:
     key: "$CI_COMMIT_REF_SLUG"
     paths:
       - Test.txt
     policy: pull  #关注点
   script:
     - cat Test.txt
     - echo "bbbbbbbbbbb" >> Test.txt
     - cat Test.txt
   tags:
     - base-runner

job3:
   stage: test3
   script:
     - ls
     - cat Test.txt
     - echo "cccccccc" >> Test.txt
     - cat Test.txt
   tags:
     - base-runner

#job1 结果
Checking cache for test-wer-1...
#首次检查缓存未存在进行创建缓存
$ echo "aaaaaaaaaa" > Test.txt
$ cat Test.txt
aaaaaaaaaa
Creating cache test-wer-1...
Test.txt: found 1 matching files                                  
Uploading cache.zip to http://192.168.12.139:9000/runner/cache-path/project/1242/test-wer-1   #上传 cache 路径
Created cache
Job succeeded


#job2 结果
Checking cache for test-wer-1...
cache.zip is up to date  #缓存进行了下载              
Successfully extracted cache
$ cat Test.txt
aaaaaaaaaa
$ echo "bbbbbbbbbb" >> Test.txt
$ cat Test.txt
aaaaaaaaaa
bbb
Not uploading cache test-wer-1 due to policy # pull策略不上传缓存
Job succeeded


#job3 结果
Checking cache for test-wer-1...
cache.zip is up to date                            
Successfully extracted cache
$ cat Test.txt
aaaaaaaaaa
$ echo "ccccccccc" >> Test.txt
$ cat Test.txt
aaaaaaaaaa
ccccccccc
Creating cache test-wer-1...
Test.txt: found 1 matching files                
22.txt: found 1 matching files                     
Uploading cache.zip to http://192.168.12.139:9000/runner/cache-path/project/1242/test-wer-1  #上传 cache 路径
Created cache
Job succeeded

# 1.添加 GitLab Helm 存储库并更新索引
helm repo add gitlab https://charts.gitlab.io
helm repo update

# 2.查看 gitlab-runner 版本以及其 Helm values
helm search repo gitlab-runner           # 最新版本
helm search repo -l gitlab/gitlab-runner # 所有版本
  # NAME                    CHART VERSION   APP VERSION     DESCRIPTION
  # gitlab/gitlab-runner    0.41.0          15.0.0          GitLab Runner
helm show values gitlab/gitlab-runner --version 0.41.0 > gitlab-runner.yaml

# 3.按照需要修改该图表的配置
# https://docs.gitlab.com/runner/install/kubernetes.html#configuring-gitlab-runner-using-the-helm-chart
$ egrep -v "^$|^#|^[[:space:]]+#" gitlab-runner.yaml
imagePullPolicy: IfNotPresent
# 关键点.私有仓库认证票据
imagePullSecrets:
- name: "harbor-cloud-secret"
# 关键点.私有仓库地址
gitlabUrl: http://gitlab.weiyigeek.top
# 关键点.私有仓库runner注册Token
runnerRegistrationToken: "gu8nqhPNZXJ8xZxotTPr"
terminationGracePeriodSeconds: 3600
concurrent: 10
checkInterval: 30
logLevel: error
sessionServer:
  enabled: false
rbac:
  # 关键点.建议设置为true启用rbac
  create: true
  rules: []
  clusterWideAccess: false
  podSecurityPolicy:
    enabled: false
    resourceNames:
    - gitlab-runner
metrics:
  enabled: false
  portName: metrics
  port: 9252
  serviceMonitor:
    enabled: false
service:
  enabled: false
  type: ClusterIP
runners:
  config: |
    [[runners]]
      [runners.kubernetes]
        namespace = "{{.Release.Namespace}}"
        image = "ubuntu:20.04"
  cache: {}
  builds: {}
  services: {}
  helpers: {}
  nodeSelector: {}
securityContext:
  runAsUser: 100
  fsGroup: 65533
resources: {}
affinity: {}
# 修改点.此处指定节点运行
nodeSelector:
  kubernetes.io/hostname: weiyigeek-226
tolerations: []
hostAliases: []
podAnnotations: {}
podLabels: {}
secrets: []
configMaps: {}


# 4.如果是需要钱私有仓库中的镜像，需要首先创建一个 docker-registry 类型的 Secret 。
kubectl create secret docker-registry harbor-cloud-secret \
--docker-server=harbor-cloud \
--docker-username=weiyigeek \
--docker-password=WWW.weiyigeek.top \
--namespace=devops

# 5.安装 GitLab Runner 到K8S集群
# For Helm 3
# $ helm install --namespace <NAMESPACE> gitlab-runner -f <CONFIG_VALUES_FILE> gitlab/gitlab-runner
  # * <NAMESPACE> 是要在其中安装 GitLab Runner 的 Kubernetes 命名空间。
  # * <CONFIG_VALUES_FILE> 是包含自定义配置的值文件的路径。
$ helm install --namespace devops gitlab-runner --version 0.41.0  -f ./gitlab-runner.yaml gitlab/gitlab-runner
  # NAME: gitlab-runner
  # LAST DEPLOYED: Mon Jun  6 16:01:00 2022
  # NAMESPACE: devops
  # STATUS: deployed
  # REVISION: 1
  # TEST SUITE: None
  # NOTES:
  # Your GitLab Runner should now be registered against the GitLab instance reachable at: "http://gitlab.weiyigeek.top"
  # Runner namespace "devops" was found in runners.config template.

$ helm upgrade --namespace devops gitlab-runner --version 0.41.0  -f ./gitlab-runner.yaml gitlab/gitlab-runner

# 6.验证安装状态
kubectl get pod -n devops -l app=gitlab-runner
  # NAME                             READY   STATUS    RESTARTS   AGE
  # gitlab-runner-6685dc55bd-86l2h   1/1     Running   0          15m

# .gitlab-ci.yml
stages:
  - test

default:
  image: alpine:3.16
  before_script:
    - uname -a && id 
    - echo "WeiyiGeek" > user.logs && date -R >> user.logs
   
Test:
  stage: test
  script:
    - echo -e "# Test Stage"
    - echo "https://www.weiyigeek.top"
    - cat user.logs
  tags:
    - devtest

# Runner为流水线作业生成的 runner-ijlvfrnc-project-75-concurrent-0rl7cg 工作Pod
~$ kubectl get pod -n devops -o wide
NAME                                           READY   STATUS            RESTARTS         AGE     IP              NODE       NOMINATED NODE   READINESS GATES
gitlab-runner-85bbdc5954-zmddx                 1/1     Running           0                20h     10.66.182.214   
runner-ijlvfrnc-project-75-concurrent-0rl7cg   0/2     PodInitializing   0                3s      10.66.182.235

ERROR: Registering runner... failed runner=qRGh2M86 status=500 Internal Server Error
PANIC: Failed to register this runner. Perhaps you are having network problems

#此处以第一种方式为列
使用 root 用户从 web 端登录到 gitlab 管理中心 http://${ip}/admin 。管理中心 --> 设置 --> 网络 –> 外发请求
#设置如下
* 勾选 允许Webhook和服务对本地网络的请求
* 勾选 允许系统钩子向本地网络发送的请求

==> /var/log/gitlab/gitlab-rails/production.log <==
Started PATCH "/admin/application_settings/network" for 10.0.30.2 at 2020-03-10 11:08:20 +0000
Processing by Admin::ApplicationSettingsController#network as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"[FILTERED]", "application_setting"=>
{"allow_local_requests_from_web_hooks_and_services"=>"[FILTERED]",
"allow_local_requests_from_system_hooks"=>"[FILTERED]", "outbound_local_requests_whitelist_raw"=>"",
"dns_rebinding_protection_enabled"=>"1"}}
Completed 500 Internal Server Error in 40ms (ActiveRecord: 14.5ms | Elasticsearch: 0.0ms)
OpenSSL::Cipher::CipherError ():
lib/gitlab/crypto_helper.rb:27:in `aes256_gcm_decrypt'
==> /var/log/gitlab/gitlab-rails/production_json.log <==
{"method":"PATCH","path":"/admin/application_settings/network","format":"html","controller":"Admin::
ApplicationSettingsController","action":"network","status":500,"error":"OpenSSL::Cipher::CipherError
: ","duration":40.08,"view":0.0,"db":14.47,"time":"2020-03-10T11:08:20.061Z","params":
[{"key":"utf8","value":"✓"},{"key":"_method","value":"patch"},{"key":"authenticity_token","value":"
[FILTERED]"},{"key":"application_setting","value":
{"allow_local_requests_from_web_hooks_and_services":"
[FILTERED]","allow_local_requests_from_system_hooks":"
[FILTERED]","outbound_local_requests_whitelist_raw":"","dns_rebinding_protection_enabled":"1"}}],"re
mote_ip":"10.0.30.2","user_id":1,"username":"root","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87
Safari/537.36","queue_duration":2.55,"correlation_id":"9rvflpksdj2"}

#命令行输入 gitlab-rails console ，然后输入ApplicationSetting.current reset_runners_registration_token! 即可，这样在保存修改的时候就不会再报 500的问题了。
╭─root@gitlab ~
╰─# gitlab-rails console
--------------------------------------------------------------------------------
GitLab: 12.3.5 (2417d5becc7)
GitLab Shell: 10.0.0
PostgreSQL: 10.9
--------------------------------------------------------------------------------
Loading production environment (Rails 5.2.3)
irb(main):001:0> ApplicationSetting.current.reset_runners_registration_token!
=> true
irb(main):002:0> exit

ERROR: Registering runner... failed runner=xxxxxxx status=couldn't execute POST against https://x.x.x.x/api/v4/runners: Post https://x.x.x.x/api/v4/runners: x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs

build:
  stage: build
  script: echo "Building the app"
  #告诉 Runner 我们应用哪个标签
  tags:
    - TestRunner

#1.将gitlab-runner用户加入docker组
$usermod -aG docker gitlab-runner

#2.gitlab-runner加入的组出现docker即没问题
$groups gitlab-runner
gitlab-runner : gitlab-runner docker

#因runner运行时的执行者是gitlab-runner账户，需要在gitlab-runner账号下设置访问https类网站时，免验证
[root@gitlab-runner ~]# su - gitlab-runner
[gitlab-runner@gitlab-runner ~]$ git config --global http."sslVerify" false
#查看
[gitlab-runner@gitlab-runner ~]$ cat /home/gitlab-runner/.gitconfig 
[http]
  sslVerify = false

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
time="2020-04-17T11:12:33Z" level=error msg="failed to dial gRPC: cannot connect to the Docker daemon. Is 'docker daemon' running on this host?: dial unix

Running with gitlab-runner 15.0.0 (febb2a09)
  on gitlab-runner-6685dc55bd-86l2h H9xf-29K
Preparing the "kubernetes" executor
00:00
Using Kubernetes namespace: devops
Using Kubernetes executor with image alpine:3.16 ...
Using attach strategy to execute scripts...
Preparing environment
00:00
ERROR: Error cleaning up configmap: resource name may not be empty
ERROR: Job failed (system failure): prepare environment: setting up scripts configMap: generating scripts config map: configmaps is forbidden: User "system:serviceaccount:devops:default" cannot create resource "configmaps" in API group "" in the namespace "devops". Check https://docs.gitlab.com/runner/shells/index.html#shell-profile-loading for more information

## 方式1 ##
# 更改gitlab-runner图表配置文件指定启用rbac支持。
## For RBAC support:
rbac:
  create: true

## 方式2 ##
# 1.在devops名称空间中创建一个serviceaccount名为gitlab-runner并为该服务用户绑定admin角色(生产环境中建议指定最小资源操作权限)
kubectl create serviceaccount gitlab-runner --namespace devops
kubectl create clusterrolebinding gitlab-runner --clusterrole=admin --serviceaccount=devops:gitlab-runner

# 2.更改图表配置文件指定serviceAccountName为gitlab-runner
## For RBAC support:
rbac:
  create: false
  serviceAccountName: gitlab-runner

# 3.更新部署 gitlab-runner 
helm upgrade --namespace devops gitlab-runner --version 0.41.0  -f ./gitlab-runner.yaml gitlab/gitlab-runner

Getting source from Git repository
00:01
Fetching changes with git depth set to 50...
Initialized empty Git repository in /builds/WeiyiGeek/devops/.git/
Created fresh repository.
remote: You are not allowed to download code from this project.
fatal: unable to access 'http://gitlab.weiyigeek.top/WeiyiGeek/devops.git/': The requested URL returned error: 403
ERROR: Job failed: command terminated with exit code 1