Jenkins + docker + ssh 实现 CI/CD

# 基于 jenkins 官方镜像构建
FROM jenkins/jenkins:2.564-jdk21
# 切换到 root 用户
USER root
# 更新 apt 源，安装 lsb-release，lsb-release 是 Linux 上用来查看发行版标识信息的工具
RUN apt-get update && apt-get install -y lsb-release
# 添加 Docker 官方 GPG 密钥，有了这个密钥，才能从 Docker 官方源下载安装 Docker CE CLI
RUN curl -fsSLo /usr/share/keyrings/docker-archive-keyring.asc \
  https://download.docker.com/linux/debian/gpg
# 添加 Docker 官方源，这个源是 Docker 官方提供的，包含了 Docker CE CLI 的安装包
RUN echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/usr/share/keyrings/docker-archive-keyring.asc] \
  https://download.docker.com/linux/debian \
  $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list
# 更新 apt 源，安装 Docker CE CLI
RUN apt-get update && apt-get install -y docker-ce-cli
# 切换到 jenkins 用户
USER jenkins
# 安装 Jenkins 插件，blueocean 是 Jenkins 的蓝海项目，docker-workflow 是 Jenkins 的 Docker 工作流插件，json-path-api 是 Jenkins 的 JSON 路径 API 插件
RUN jenkins-plugin-cli --plugins "blueocean docker-workflow json-path-api"

version: '1.0'

services:
  jenkins-docker:
    # 1. 启动 docker in docker ，给 jenkins 提供 docker 能力
    image: docker:dind
    container_name: jt-docker-dind
    restart: always
    privileged: true # 给 docker 容器最高权限，可以执行 docker 命令，否则在容器中无法启动 docker
    volumes:
      - D:\work\env\docker\jenkins\certs:/certs/client
      - D:\work\env\docker\jenkins\data:/var/jenkins_home
    networks:
      - jt_jenkins_network
    ports:
      - 2376:2376
    environment:
      - DOCKER_TLS_CERTDIR=/certs  #开启 Docker TLS 安全认证，证书放在 /certs
       # ✅ 关键：让证书包含你的公网IP，这样外网才能连接
      - DOCKER_TLS_SAN=IP:[我的公网IP],IP:127.0.0.1,DNS:jenkins-docker
      # ✅ 关键：监听 0.0.0.0 而不是内部IP，允许公网连接
      - DOCKER_OPTS=--host=tcp://0.0.0.0:2376

  jenkins:
  # 构建 jenkins 容器，使用本地 dockerfile 构建的 jenkins 镜像
    build:
      context: .
      dockerfile: jenkins.dockerfile
    container_name: jt-jenkins
    # 在容器启动时，如果容器启动失败，则重启容器
    restart: on-failure
    volumes:
      - D:\work\env\docker\jenkins\data:/var/jenkins_home
      - D:\work\env\docker\jenkins\certs:/certs/client:ro  # ro = 只读
    networks:
      - jt_jenkins_network
    ports:
      - 8080:8080
      - 50000:50000
   # 设置 jenkins 容器的环境变量，使得 jenkins 容器可以访问 docker 容器
    environment:
      # 设置 jenkins 容器可以访问 docker 容器的地址
      - DOCKER_HOST=tcp://jenkins-docker:2376
      # 设置 jenkins 容器可以访问 docker 容器的证书路径
      - DOCKER_CERT_PATH=/certs/client 
      # 设置 jenkins 容器可以访问 docker 容器的 TLS 认证
      - DOCKER_TLS_VERIFY=1
    depends_on:
      - jenkins-docker

networks:
  jt_jenkins_network:
    driver: bridge

services:
  # 自动生成账号密码的初始化容器
  registry-auth:
    image: httpd:2.4.67
    container_name: jt-registry-auth
    restart: on-failure:3
    networks:
      - jt_registry_network
    volumes:
      - D:\work\env\docker\registry\registry\auth:/auth
    # 在这里改你的 用户名 和 密码
    command: >
      sh -c "
      mkdir -p /auth &&
      htpasswd -Bbn [用户名] [密码] > /auth/htpasswd
      "
  # 镜像仓库容器
  registry:
    image: registry:3.1.1
    container_name: jt-registry
    restart: on-failure:3
    networks:
      - jt_registry_network
    volumes:
      - D:\work\env\docker\registry\registry\lib:/var/lib/registry # 镜像数据、仓库元数据
      - D:\work\env\docker\registry\registry\auth:/auth  # 挂载密码文件夹
    ports:
      - 15000:5000
    environment:
      - REGISTRY_STORAGE_DELETE_ENABLED=true  # 允许删除镜像
      # 开启认证 ↓↓↓
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
    depends_on:
      - registry-auth
# 镜像仓库 UI 容器
  registry-ui:
    image: joxit/docker-registry-ui:2.6.0-debian
    container_name: jt-registry-ui
    restart: on-failure:3
    networks:
      - jt_registry_network
    ports:
      - 15001:80
    environment:
      - TZ=Asia/Shanghai
      - SINGLE_REGISTRY=true
      - REGISTRY_TITLE=JT 私有镜像仓库
      - DELETE_IMAGES=true                   # 允许界面删除镜像
      # - REGISTRY_URL=http://localhost:15001    # 指定ip可以访问镜像仓库，不配置则允许所有ip访问
      - NGINX_PROXY_PASS_URL=http://registry:5000
       # 开启 UI 登录 ↓↓↓
      - REGISTRY_SECURED=true
    depends_on:
      - registry

networks:
  jt_registry_network:
    driver: bridge

Name  : OpenSSH.Client~~~~0.0.1.0
State : Installed  # 已安装

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent # 未安装

{
	"auths": {
		"crpi-sbxf6opn90884xtq.cn-beijing.personal.cr.aliyuncs.com": {},
		"localhost:15000": {
			"auth": "anQ6anQxMjM0NTY="
		},
		"registry.jtworld.cn": {
			"auth": "anQ6anQxMjM0NTY="
		}
	},
	"credsStore": "desktop", // 删除该行
	"currentContext": "desktop-linux",
	"plugins": {
		"-x-cli-hints": {
			"enabled": "true"
		},
		"ai": {
			"hooks": "build,buildx build,run,compose"
		},
		"debug": {
			"hooks": "exec"
		},
		"scout": {
			"hooks": "pull,buildx build"
		}
	},
	"features": {
		"hooks": "true"
	}
}

github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

docker login --username=[用户名] --password=[密码] registry.jtworld.cn && docker pull rexxxry.xxxorld.cn/myboot:1.0 && docker run -id --name myboot -p 9080:9080 registry.jtworld.cn/myboot:1.0

kubectl create secret docker-registry jt-registry --docker-server=localhost:15000 --docker-username=[用户名] --docker-password=[密码] && kubectl apply -f D:\work\env\docker\K8s\myboot.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myboot
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myboot
  template:
    metadata:
      labels:
        app: myboot
    spec:
      containers:
      - name: myboot
        image: localhost:15000/myboot:1.0        # 你的镜像名
        ports:
        - containerPort: 9080  # 你的项目端口
---
apiVersion: v1
kind: Service
metadata:
  name: myboot
spec:
  selector:
    app: myboot
  ports:
  - port: 80         # Service 端口
    targetPort: 9080 # 容器端口（你的 9080）

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jt-ingress
spec:
  ingressClassName: nginx # 关键，绑定 ingress-nginx 控制器
  rules:
  - host: localhost # 本地域名，随便写
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myboot
            port:
              number: 80