前言
Spinnaker 是 Netflix 在2015年開源的一款持續交付平台，最初由 Netflix 開發，用於快速、可靠地發布軟件變更。Spinnaker 使開發人員可以更輕松地專注於編寫代碼，而無需擔心底層的雲基礎設施，它可以和 Jenkins 以及其他流行的構建工具無縫集成。但是由於 GFW 的原因導致在國內部署Spinnaker非常困難，當然，你可以使用代理，但這就與本文的初衷不符。經過多次嘗試，終於在不使用代理的情況下安裝spinnaker，廢話不多說，直接進入正題。
安裝Halyard
使用docker的方式安裝Halyard。
# useradd spinnaker
# cd /home/spinnaker
$ mkdir ~/.hal
$ docker run -d -p 8084:8084 -p 9000:9000 --name halyard --rm -v ~/.hal:/home/spinnaker/.hal -v ~/.kube:/home/spinnaker/.kube -it gcr.azk8s.cn/spinnaker-marketplace/halyard:1.31.1
啟動參數說明：/home/spinnaker/.hal目錄為halyard配置文件，/home/spinnaker/.kube為k8s集群認證目錄。
官網給出的鏡像地址 gcr.io 在國內是不能訪問的，需要將鏡像地址修改為gcr.azk8s.cn。
Spinnaker安裝前准備
spinnaker部署環境一共有三種:
- 在k8s分布式安裝(推薦使用)
- 本地單台機器安裝
- 本地git安裝
本文使用K8S方式。
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.0",GitCommit:"xxx", GitTreeState:"clean", BuildDate:"2019-09-18T14:36:53Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14+", GitVersion:"v1.14.8-xx.1", GitCommit:"51888f5", GitTreeState:"", BuildDate:"2019-10-16T08:29:13Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}
$ kubectl create namespace spinnaker
配置spinnaker配置文件
主要設置docker鏡像倉庫及存儲,以下為配置文件示例。
currentDeployment: default
deploymentConfigurations:
- name: default
version: local:1.17.6
providers:
appengine:
enabled: false
accounts: []
aws:
enabled: false
accounts: []
bakeryDefaults:
baseImages: []
defaultKeyPairTemplate: '{{name}}-keypair'
defaultRegions:
- name: huabei2
defaults:
iamRole: BaseIAMRole
ecs:
enabled: false
accounts: []
azure:
enabled: false
accounts: []
bakeryDefaults:
templateFile: azure-linux.json
baseImages: []
dcos:
enabled: false
accounts: []
clusters: []
dockerRegistry:
enabled: true
accounts:
# 鏡像倉庫地址
- name: dockerhub
requiredGroupMembership: []
providerVersion: V1
permissions: {}
# 你的鏡像倉庫地址
address: xxxx
# 鏡像倉庫認證
username: xxxxx
password: xxxxx
email: fake.email@spinnaker.io
sortTagsByDate: true
repositories:
# 此處是你的namespace下的項目
- namespace/appname
# 鏡像倉庫地址
primaryAccount: dockerhub
google:
enabled: false
accounts: []
bakeryDefaults:
templateFile: gce.json
baseImages: []
zone: us-central1-f
network: default
useInternalIp: false
huaweicloud:
enabled: false
accounts: []
bakeryDefaults:
baseImages: []
kubernetes:
enabled: true
accounts:
# 此處為k8s集群名稱
- name: k8s
requiredGroupMembership: []
providerVersion: V2
permissions: {}
dockerRegistries: []
configureImagePullSecrets: true
cacheThreads: 1
namespaces:
# 此處把你的namespace 加進去
- yournamespace
omitNamespaces: []
kinds: []
omitKinds: []
customResources: []
cachingPolicies: []
# 此處為k8s集群認證文件地址
kubeconfigFile: /home/spinnaker/.kube/config
oAuthScopes: []
onlySpinnakerManaged: false
# 與k8s集群名稱一致
primaryAccount: k8s
oracle:
enabled: false
accounts: []
bakeryDefaults:
templateFile: oci.json
baseImages: []
cloudfoundry:
enabled: false
accounts: []
deploymentEnvironment:
size: SMALL
type: Distributed
# k8s集群名稱
accountName: k8s
imageVariant: SLIM
updateVersions: false
consul:
enabled: false
vault:
enabled: false
customSizing: {}
sidecars: {}
initContainers: {}
hostAliases: {}
affinity: {}
tolerations: {}
nodeSelectors: {}
gitConfig:
upstreamUser: spinnaker
livenessProbeConfig:
enabled: false
haServices:
clouddriver:
enabled: false
disableClouddriverRoDeck: false
echo:
enabled: false
persistentStorage:
# 此處配置存儲，示例為s3
persistentStoreType: s3
azs: {}
gcs: {}
redis: {}
# s3存儲的認證信息
s3:
bucket: xxx
rootFolder: xxx
region: xxx
pathStyleAccess: false
accessKeyId: xxx
secretAccessKey: xxx
oracle: {}
features:
auth: false
fiat: false
chaos: false
entityTags: false
pipelineTemplates: true
artifacts: true
metricStores:
datadog:
enabled: false
tags: []
prometheus:
enabled: false
add_source_metalabels: true
stackdriver:
enabled: false
newrelic:
enabled: false
tags: []
period: 30
enabled: false
notifications:
slack:
enabled: false
twilio:
enabled: false
baseUrl: https://api.twilio.com/
github-status:
enabled: false
timezone: Asia/Shanghai
ci:
jenkins:
enabled: false
masters: []
travis:
enabled: false
masters: []
wercker:
enabled: false
masters: []
concourse:
enabled: false
masters: []
gcb:
enabled: false
accounts: []
repository:
artifactory:
enabled: false
searches: []
security:
apiSecurity:
ssl:
enabled: false
# gate地址
overrideBaseUrl: https://spin-gate.xxx.com
uiSecurity:
ssl:
enabled: false
# deck地址
overrideBaseUrl: https://spinnaker.xxx.com
authn:
oauth2:
enabled: false
client: {}
resource: {}
userInfoMapping: {}
saml:
enabled: false
userAttributeMapping: {}
ldap:
enabled: false
x509:
enabled: false
iap:
enabled: false
enabled: false
authz:
groupMembership:
service: FILE
google:
roleProviderType: GOOGLE
github:
roleProviderType: GITHUB
file:
roleProviderType: FILE
ldap:
roleProviderType: LDAP
enabled: true
artifacts:
bitbucket:
enabled: false
accounts: []
gcs:
enabled: false
accounts: []
oracle:
enabled: false
accounts: []
github:
enabled: false
accounts: []
gitlab:
enabled: true
accounts:
- name: gitlab
token: xxx
gitrepo:
enabled: false
accounts: []
http:
enabled: false
accounts: []
helm:
enabled: false
accounts: []
s3:
enabled: false
accounts: []
maven:
enabled: false
accounts: []
templates: []
pubsub:
enabled: false
google:
enabled: false
pubsubType: GOOGLE
subscriptions: []
publishers: []
canary:
enabled: false
serviceIntegrations:
- name: google
enabled: false
accounts: []
gcsEnabled: false
stackdriverEnabled: false
- name: prometheus
enabled: false
accounts: []
- name: datadog
enabled: false
accounts: []
- name: signalfx
enabled: false
accounts: []
- name: aws
enabled: false
accounts: []
s3Enabled: false
- name: newrelic
enabled: false
accounts: []
reduxLoggerEnabled: true
defaultJudge: NetflixACAJudge-v1.0
stagesEnabled: true
templatesEnabled: true
showAllConfigsEnabled: true
plugins:
plugins: []
enabled: false
downloadingEnabled: false
spinnaker:
extensibility:
repositories: {}
webhook:
trust:
enabled: false
telemetry:
enabled: false
endpoint: https://stats.spinnaker.io
instanceId: xxx
connectionTimeoutMillis: 3000
readTimeoutMillis: 5000
本地安裝spinnaker
接下來的操作尤為重要，我們采用本地安裝的方式，需要將bom設置為local，安裝版本1.17.6.
$ pwd
/home/spinnaker
$ mkdir ~/.hal/.boms/bom -p
$ cd ~/.hal/.boms/bom
$ more 1.17.6.yml
version: 1.17.6
timestamp: '2020-01-14 08:44:42'
services:
echo:
version: local:2.9.1-20191216151527
commit: 771a15b2b7bd8d78f77caf3c3ecff950e187c1ae
clouddriver:
version: local:6.4.5-20200114034416
commit: 5f272cd8d3911423dfcf7e9448c31fe4aa045e2e
deck:
version: local:2.13.5-20200114034416
commit: 75cecc4cf1d52ff78fb1fb5e057b516c51be10fb
fiat:
version: local:1.8.3-20191202102650
commit: c62d038c2a9531042ff33c5992384184b1370b27
front50:
version: local:0.20.1-20191107034416
commit: 9415a443b0d6bf800ccca8c2764d303eb4d29366
gate:
version: local:1.13.0-20191029172246
commit: a453541b47c745a283712bb240ab392ad7319e8d
igor:
version: local:1.7.0-20191029183208
commit: 37fe1ed0c463bdaa87996a4d4dd81fee2325ec8e
kayenta:
version: local:0.12.0-20191023142816
commit: 5dcec805b7533d0406f1e657a62122f4278d665d
orca:
version: local:2.11.2-20191212093351
commit: b88f62a1b2b1bdee0f45d7f9491932f9c51371d9
rosco:
version: local:0.15.1-20191202163249
commit: 269dc830cf7ea2ee6c160163e30d6cbd099269c2
defaultArtifact: {}
monitoring-third-party:
version: local:0.16.0-20191007112816
commit: 59cbbec589f982864cee45d20c99c32d39c75f7f
monitoring-daemon:
version: local:0.16.0-20191007112816
commit: 59cbbec589f982864cee45d20c99c32d39c75f7f
dependencies:
redis:
version: 2:2.8.4-2
consul:
version: 0.7.5
vault:
version: 0.7.0
artifactSources:
debianRepository: https://dl.bintray.com/spinnaker-releases/debians
dockerRegistry: gcr.azk8s.cn/spinnaker-marketplace
googleImageProject: marketplace-spinnaker-release
gitPrefix: https://github.com/spinnaker
bom配置文件需要注意兩點，版本前需要加local，鏡像地址更換為國內地址！
配置完成之后，hal在deploy的時候不會去google拉取版本配置，而是從本地讀取，以echo為例，本地讀取目錄為~/.hal/.boms/echo/echo.yml，所以我們需要將相應的yml文件下載到本地相應目錄。
下載地址：https://github.com/spinnaker
以echo為例，下載文件為https://github.com/spinnaker/echo/tree/master/halconfig 內的文件，並放在本地目錄~/.hal/.boms/echo下。
下載完成后目錄結構如下：
├── bom/
│ ├── 1.17.6.yml
├── clouddriver/
│ ├── clouddriver.yml
│ └── ...
├── deck/
│ ├── settings.js
.......
正式部署spinnaker
完成了這些基本工作，就可以愉快的（無需代理）的部署spinnaker了。
# 設置hal使用本地文件系統的bom斑斑
$ hal config version edit --version local:1.17.6
$hal deploy apply
+ Get current deployment
Success
+ Prep deployment
Success
Problems in default.security:
- WARNING Your UI or API domain does not have override base URLs
set even though your Spinnaker deployment is a Distributed deployment on a
remote cloud provider. As a result, you will need to open SSH tunnels against
that deployment to access Spinnaker.
? We recommend that you instead configure an authentication
mechanism (OAuth2, SAML2, or x509) to make it easier to access Spinnaker
securely, and then register the intended Domain and IP addresses that your
publicly facing services will be using.
+ Preparation complete... deploying Spinnaker
+ Get current deployment
Success
+ Apply deployment
Success
+ Deploy spin-redis
Success
+ Deploy spin-clouddriver
Success
+ Deploy spin-front50
Success
+ Deploy spin-orca
Success
+ Deploy spin-deck
Success
+ Deploy spin-echo
Success
+ Deploy spin-gate
Success
+ Deploy spin-rosco
Success
+ Deploy spin-igor
Success
+ Run `hal deploy connect` to connect to Spinnaker.
查看spinnaker在k8s中的部署情況：
# kubens spinnaker
Context "xxxx" modified.
Active namespace is "spinnaker".
# kubectl get pods
NAME READY STATUS RESTARTS AGE
spin-clouddriver-7fb74cf5c6-c7g87 1/1 Running 0 10m
spin-deck-76b4df7b48-nnj8x 1/1 Running 0 10m
spin-echo-cccf9f7db-bn6t5 1/1 Running 0 10m
spin-fiat-7dc9547ff5-jqw7l 1/1 Running 0 10m
spin-front50-5744455478-qmg2x 1/1 Running 0 10m
spin-gate-6bbb57846c-tplqg 1/1 Running 0 10m
spin-igor-74bfbc6c57-xtbb8 1/1 Running 0 10m
spin-orca-78dc9844cb-6w4ww 1/1 Running 0 10m
spin-redis-6bf56c789c-lbq6l 1/1 Running 0 10m
spin-rosco-664b65f8d6-6n58m 1/1 Running 0 10m
配置ingress
配置ingress訪問spinnaker。
$ more spinnaker-ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: spinnaker
namespace: spinnaker
annotations:
kubernetes.io/ingress.class: web
nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
tls:
- secretName: ingress-niucache
hosts:
- spinnaker.xxx.com
- spin-gate.xxx.com
rules:
- host: spinnaker.xxx.com
http:
paths:
- path: /
backend:
serviceName: spin-deck
servicePort: 9000
- host: spin-gate.xxx.com
http:
paths:
- path: /
backend:
serviceName: spin-gate
servicePort: 8084
# kubectl get ingress
NAME HOSTS ADDRESS PORTS AGE
spinnaker spinnaker.xxx.com,spin-gate.xxx.com xx 80, 443 10m
訪問spinnaker
將域名做好解析之后就可以訪問spinnaker了。
至此，spinnaker安裝完成！
后記
為了繞過GW安裝spinnaker，真是煞費苦心，為了做個記錄，同時分享給有需要的朋友。標題寫的離線安裝，不是真正的離線，意思是無需代理，但是還需要可以連接互聯網下載鏡像的，但是如果鏡像都在本地的鏡像倉庫中，那就可以做到真正離線了。本文只是介紹了spinnaker的安裝，並沒有提及使用，個人覺得spinnaker最難的地方就是安裝，使用的話，大家可以參考官方文檔，已經很詳細了，如果以后有需要，再補充使用的文檔吧。