工业物联网平台 Jenkins+GitLab CI/CD 流水线构建：从 Webhook 触发到 K8s 落地的深度实践

# Jenkins LTS部署，挂载docker.sock，允许流水线内部构建docker镜像
docker run -d --name jenkins \
  -p 8080:8080 -p 50000:50000 \
  -v jenkins_home:/var/jenkins_home \
  -v /var/run/docker.sock:/var/run/docker.sock \
 jenkins/jenkins:lts

# GitLab CE私有化部署
docker run -d --name gitlab \
  -p 443:443 -p 80:80 -p 22:22 \
  -v gitlab_config:/etc/gitlab \
  -v gitlab_logs:/var/log/gitlab \
  -v gitlab_data:/var/opt/gitlab \
 gitlab/gitlab-ce:latest

pipeline {
    agent any
    options {
        timestamps()
        buildDiscarder(logRotator(numToKeepStr: '20')) // 限制构建历史保存数量
    }
    environment {
        DOCKER_REGISTRY = "harbor.example.com"
        PROJECT_NAME = "iot-collector-service"
        KUBECONFIG = credentials('k8s‑kubeconfig')
        SONAR_TOKEN = credentials('sonar‑token')
        // 使用git短commit作为镜像标签，便于版本追溯
        GIT_COMMIT_SHORT = sh(returnStdout:true, script:'git rev‑parse --short HEAD').trim()
    }
    stages {
        stage('拉取代码') {
            steps {
                git(
                    url: 'http://gitlab.example.com/iot-platform/iot-collector-service.git',
                    branch: 'main',
                    credentialsId: 'gitlab‑ssh‑credentials'
                )
            }
        }
        stage('编译构建') {
            steps {
                sh 'mvn clean package -DskipTests'
            }
            post {
                success {
                    archiveArtifacts artifacts: 'target/*.jar', fingerprint: true
                }
            }
        }
        stage('单元测试') {
            steps {
                sh 'mvn test'
            }
            post {
                always {
                    junit 'target/surefire‑reports/*.xml'
                    publishCoverage adapters: [jacocoAdapter('target/site/jacoco/jacoco.xml')], sourceFileResolver: sourceFiles('STORE_LAST_BUILD')
                }
            }
        }
        stage('代码质量检查‑SonarQube') {
            steps {
                sh '''mvn sonar:sonar \
‑Dsonar.projectKey=${PROJECT_NAME} \
‑Dsonar.host.url=http://sonarqube.example.com \
‑Dsonar.login=${SONAR_TOKEN}'''
            }
        }
        stage('构建推送Docker镜像') {
            steps {
                script {
                    def imageName = "${DOCKER_REGISTRY}/${PROJECT_NAME}:${GIT_COMMIT_SHORT}"
                    sh "docker build -t ${imageName} ."
                    sh "docker push ${imageName}"
                }
            }
        }
        stage('部署‑测试环境K8s滚动更新') {
            steps {
                sh "kubectl set image deployment/${PROJECT_NAME} ${PROJECT_NAME}=${DOCKER_REGISTRY}/${PROJECT_NAME}:${GIT_COMMIT_SHORT} -n test"
                sh "kubectl rollout status deployment/${PROJECT_NAME} -n test"
            }
        }
        stage('冒烟测试') {
            steps {
                sh 'curl -X POST http://test.example.com/api/health-check'
            }
        }
        stage('人工确认‑发布生产环境') {
            input {
                message: "确认发布生产环境采集服务？"
                ok: "确认发布"
            }
            steps {
                sh "kubectl set image deployment/${PROJECT_NAME} ${PROJECT_NAME}=${DOCKER_REGISTRY}/${PROJECT_NAME}:${GIT_COMMIT_SHORT} -n prod"
                sh "kubectl rollout status deployment/${PROJECT_NAME} -n prod"
            }
        }
    }
    post {
        success {
            echo "流水线执行成功"
            sh '''curl -X POST https://qyapi.weixin.qq.com/cgi‑bin/webhook/send?key=xxx \
‑d '{"msgtype":"text","text":{"content":"IoT采集服务部署成功，镜像版本：${GIT_COMMIT_SHORT}"}}' '''
        }
        failure {
            echo "流水线执行失败，请排查日志"
            sh '''curl -X POST https://qyapi.weixin.qq.com/cgi‑bin/webhook/send?key=xxx \
‑d '{"msgtype":"text","text":{"content":"IoT采集服务流水线执行失败，请查看Jenkins日志！"}}' '''
        }
    }
}

stages:
  - build
  - test
  - deploy

build_job:
  stage: build
  image: maven:3.8‑openjdk‑17
  script:
    - mvn clean package -DskipTests
  artifacts:
    paths:
      - target/*.jar

test_job:
  stage: test
  image: maven:3.8‑openjdk‑17
  script:
    - mvn test
  artifacts:
    reports:
      junit: target/surefire‑reports/*.xml

deploy_job:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/iot-collector-service iot-collector-service=harbor.example.com/iot-collector-service:${CI_PIPELINE_ID} -n prod
  only:
    - main

{
  "insecure‑registries": ["harbor.example.com"]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins‑sa
  namespace: test
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins‑rolebinding
  namespace: test
subjects:
‑ kind: ServiceAccount
  name: jenkins‑sa
  namespace: test
roleRef:
  kind: Role
  name: edit
  apiGroup: rbac.authorization.k8s.io