前期使用GitHub/GitLab+Tekton+ArgoCD实现了GitOps的动手实验，现在计划换做Jenkins实现pinpeline的功能实现GitOps，因此先部署一个Jenkins环境，采用Docker方式部署。
参考官网：
https://www.jenkins.io/doc/book/installing/docker/

Jenkins节点准备部署在192.168.170.125这台服务器上。本可以直接使用Docker Hub存储库中推荐的官方jenkins/jenkins映像，此镜像包含Jenkins的当前长期支持（LTS）版本，但是，此镜像不包含Docker CLI，也没有与常用的Blue Ocean插件及其功能捆绑在一起。要使用Jenkins和Docker的全部功能，需要完成下面描述的安装过程。

由于需要在jenkins内使用docker命令，因此使用docker:dind镜像，具体启动指令如下：

docker run \
  --name jenkins-docker \
  --restart unless-stopped \
  --detach \
  --privileged \
  --network jenkins \
  --network-alias docker \
  --env DOCKER_TLS_CERTDIR=/certs \
  --volume jenkins-docker-certs:/certs/client \
  --volume jenkins-data:/var/jenkins_home \
  --publish 2376:2376 \
  docker:dind \
  --storage-driver overlay2 \
  --exec-opt native.cgroupdriver=cgroupfs \
  --insecure-registry=192.168.170.124

注意，上面设置了insecure registry的地址参数，这样可以以http方式访问本地Harbor，以及设置cgroupfs参数可以在pipeline中可以直接使用docker run来启动容器。

定制化Jenkins镜像：
Dockerfile:

FROM jenkins/jenkins:2.516.1-jdk21
USER root
RUN apt-get update && apt-get install -y lsb-release ca-certificates curl && \
    install -m 0755 -d /etc/apt/keyrings && \
    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && \
    chmod a+r /etc/apt/keyrings/docker.asc && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
    https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" \
    | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
    apt-get update && apt-get install -y docker-ce-cli && \
    apt-get clean && rm -rf /var/lib/apt/lists/*
USER jenkins
RUN jenkins-plugin-cli --plugins "blueocean docker-workflow json-path-api"

执行build指令：

docker build -t myjenkins-blueocean:2.516.1-1 .

运行上面定制化构建的带有blueocean插件的新镜像：

docker run \
  --name jenkins-blueocean \
  --restart=on-failure \
  --detach \
  --network jenkins \
  --env DOCKER_HOST=tcp://docker:2376 \
  --env DOCKER_CERT_PATH=/certs/client \
  --env DOCKER_TLS_VERIFY=1 \
  --publish 8080:8080 \
  --publish 50000:50000 \
  --volume jenkins-data:/var/jenkins_home \
  --volume jenkins-docker-certs:/certs/client:ro \
  --add-host=gitlab.example.com:192.168.170.125 \
  myjenkins-blueocean:2.516.1-1

注意，加了 --add-host=gitlab.example.com:192.168.170.125 这个参数是为了让Jenkins能够解析我的本地gitlab域名。
如果容器启动正常，在docker容器日志中查找解锁密码：

[root@k8s-node-2 jenkins]# docker ps
CONTAINER ID   IMAGE                           COMMAND                  CREATED          STATUS                       PORTS                                                                                                                   NAMES
cfefac62c1fb   myjenkins-blueocean:2.516.1-1   "/usr/bin/tini -- /u…"   5 seconds ago    Up 4 seconds                 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:50000->50000/tcp, [::]:50000->50000/tcp                            jenkins-blueocean
cff8abdbd843   docker:dind                     "dockerd-entrypoint.…"   35 minutes ago   Up 35 minutes                2375/tcp, 0.0.0.0:2376->2376/tcp, [::]:2376->2376/tcp                                                                   jenkins-docker
........
....
*************************************************************
*************************************************************

Jenkins initial setup is required. An admin user has been created and a password generated.
Please use the following password to proceed to installation:

91577330137f4bf195d4baaf8bd36a22

This may also be found at: /var/jenkins_home/secrets/initialAdminPassword

*************************************************************
*************************************************************
*************************************************************

2025-08-07 10:23:18.249+0000 [id=47]	INFO	jenkins.InitReactorRunner$1#onAttained: Completed initialization
2025-08-07 10:23:18.284+0000 [id=39]	INFO	hudson.lifecycle.Lifecycle#onReady: Jenkins is fully up and running
2025-08-07 10:23:20.191+0000 [id=76]	INFO	h.m.DownloadService$Downloadable#load: Obtained the updated data file for hudson.tasks.Maven.MavenInstaller
2025-08-07 10:23:20.192+0000 [id=76]	INFO	hudson.util.Retrier#start: Performed the action check updates server successfully at the attempt #1
[root@k8s-node-2 jenkins]#

将上面日志中的密码填入下面的“管理员密码”：91577330137f4bf195d4baaf8bd36a22

后面选择推荐的插件安装，之后添加一个管理员账号，当然也可以跳过直接用admin：


完成！

补充：增加本地Gitlab服务器的CA证书
由于后续Jenkins需要连接本地Gitlab，这个Gitlab使用了域名以及https，为了能够识别这个服务器，需要将这个服务器的CA证书加载到Jenkins服务中。

[root@k8s-node-2 ssl]# pwd
/srv/gitlab/config/ssl
[root@k8s-node-2 ssl]# docker cp gitlab.example.com.crt jenkins-blueocean:/usr/local/share/ca-certificates/gitlab.crt
Successfully copied 3.07kB to jenkins-blueocean:/usr/local/share/ca-certificates/gitlab.crt
[root@k8s-node-2 ssl]# docker exec -u 0 -it jenkins-blueocean bash
root@cd7bde105582:/# update-ca-certificates
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

# 在实际诊断过程中发现CA证书无效，使用openssl c_client命令验证CA证书有效性，在 Jenkins 容器里执行：
> openssl s_client -connect gitlab.example.com:443 -servername gitlab.example.com -showcerts </dev/null | sed -n '1,200p'
查看最后一行，如果正常返回码应该是0，像下面返回10就是表示证书过期了：
Verify return code: 10 (certificate has expired)
如果要重新生成证书：
openssl req -x509 -new -sha256 -days 3650 \
  -key gitlab.example.com.key \
  -subj "/CN=gitlab.example.com" \
  -out gitlab.example.com.crt \
  -addext "subjectAltName=DNS:gitlab.example.com"
之后再重新执行上面的更新证书步骤进行证书更新。

#下面测试CA域名是否生效
root@cd7bde105582:/usr/local/share/ca-certificates# git ls-remote -h -- https://gitlab.example.com/yuweibing78/demo-springboot-with-helm-chart.git HEAD
Username for 'https://gitlab.example.com': ^C
root@cd7bde105582:/usr/local/share/ca-certificates#

root@cd7bde105582:/# exit
exit
[root@k8s-node-2 ssl]# docker restart jenkins-blueocean
jenkins-blueocean
[root@k8s-node-2 ssl]#

上面这种方式也只是一个临时方案，如果rm 这个docker那么这个配置也丢失了，彻底的方案是在构建这个Jenkins镜像的时候，加上拷贝CA文件这个动作：COPY gitlab.example.com.crt /usr/local/share/ca-certificates/gitlab.crt
如下：
Dockerfile:

FROM jenkins/jenkins:2.516.1-jdk21
USER root
COPY gitlab.example.com.crt /usr/local/share/ca-certificates/gitlab.crt
RUN apt-get update && apt-get install -y lsb-release ca-certificates curl && \
    install -m 0755 -d /etc/apt/keyrings && \
    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && \
    chmod a+r /etc/apt/keyrings/docker.asc && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
    https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" \
    | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
    apt-get update && apt-get install -y docker-ce-cli && \
    apt-get clean && rm -rf /var/lib/apt/lists/* && \
    update-ca-certificates
USER jenkins
RUN jenkins-plugin-cli --plugins "blueocean docker-workflow json-path-api"

执行build指令：

docker build -t myjenkins-blueocean:2.516.1-1 .