企业 DevOps + 协同办公 + 可观测性 + 网络基础设施平台-Part 15.12 DevOps Role

本部分生成企业级 DevOps 平台自动化部署代码

包含：

GitLab CE
Gerrit Code Review
Jenkins CI/CD
Nexus Repository
Harbor Registry
SonarQube代码质量扫描
LDAP统一认证
GitLab → Jenkins → Harbor → Kubernetes CI/CD链路

15.12.1 DevOps整体架构

复制代码

                         Developer


                             |

                             |

                          GitLab


                             |

                      GitLab Webhook


                             |

                             v


                         Jenkins


                             |

             +---------------+---------------+

             |                               |

        SonarQube                        Build


             |                               |

             +---------------+---------------+

                             |

                             v


                         Harbor


                             |

                             v


                       Kubernetes


                             |

                             v


                         ArgoCD

15.12.2 DevOps目录结构

创建：

复制代码

roles/devops/


├── defaults/

│   └── main.yml


├── tasks/

│   ├── main.yml

│   ├── gitlab.yml

│   ├── gerrit.yml

│   ├── jenkins.yml

│   ├── nexus.yml

│   ├── harbor.yml

│   └── sonarqube.yml


├── templates/


│   ├── docker-compose-gitlab.yml.j2

│   ├── docker-compose-jenkins.yml.j2

│   ├── docker-compose-nexus.yml.j2

│   ├── docker-compose-harbor.yml.j2

│   └── docker-compose-sonar.yml.j2


└── handlers/

    └── main.yml

15.12.3 DevOps变量

文件：

复制代码

roles/devops/defaults/main.yml

---

devops_root:

 /opt/devops



domain:

 company.com



gitlab_domain:

 gitlab.company.com



jenkins_domain:

 jenkins.company.com



nexus_domain:

 nexus.company.com



harbor_domain:

 harbor.company.com



sonar_domain:

 sonar.company.com



gitlab_image:

 gitlab/gitlab-ce:latest



jenkins_image:

 jenkins/jenkins:lts



nexus_image:

 sonatype/nexus3



harbor_version:

 v2.11.0



sonar_image:

 sonarqube:lts-community

15.12.4 DevOps Playbook

文件：

复制代码

playbooks/devops.yml

---

- name:

    Deploy DevOps Platform


  hosts:

    management


  become:

    true


  roles:


    - devops

15.12.5 DevOps入口

文件：

复制代码

roles/devops/tasks/main.yml

---

- import_tasks:

    gitlab.yml


- import_tasks:

    gerrit.yml


- import_tasks:

    jenkins.yml


- import_tasks:

    nexus.yml


- import_tasks:

    harbor.yml


- import_tasks:

    sonarqube.yml

Part 15.12.6 Docker基础目录创建

所有服务统一：

复制代码

/opt/devops/


├── gitlab

├── jenkins

├── nexus

├── harbor

└── sonar

任务：

复制代码

- name:

    create devops dirs


  file:


    path:

      "{{ devops_root }}/{{ item }}"


    state:

      directory


    mode:

      "0755"


  loop:


    - gitlab

    - jenkins

    - nexus

    - harbor

    - sonar

Part 15.12.7 GitLab CE部署

Compose模板

文件：

复制代码

roles/devops/templates/docker-compose-gitlab.yml.j2

services:


 gitlab:


  image:

    {{ gitlab_image }}


  container_name:

    gitlab


  restart:

    always


  hostname:

    "{{ gitlab_domain }}"


  ports:


   - "80:80"


   - "443:443"


   - "2222:22"



  volumes:


   - /opt/devops/gitlab/config:/etc/gitlab

   - /opt/devops/gitlab/logs:/var/log/gitlab

   - /opt/devops/gitlab/data:/var/opt/gitlab



  environment:


   GITLAB_OMNIBUS_CONFIG:

    |

      external_url 'https://{{ gitlab_domain }}'

      gitlab_rails['ldap_enabled'] = true

GitLab部署任务

文件：

复制代码

roles/devops/tasks/gitlab.yml

---

- name:

    deploy gitlab compose


  template:


    src:

      docker-compose-gitlab.yml.j2


    dest:

      /opt/devops/gitlab/docker-compose.yml



- name:

    start gitlab


  community.docker.docker_compose:


    project_src:

      /opt/devops/gitlab

GitLab验证

复制代码

docker ps | grep gitlab

访问：

复制代码

https://gitlab.company.com

15.12.8 Gerrit部署

架构：

复制代码

Developer


 |

Gerrit


 |

Git Repository


 |

Jenkins Trigger

Gerrit Compose

复制代码

services:


 gerrit:


  image:

   gerritcodereview/gerrit


  container_name:

   gerrit


  ports:


   - "8081:8080"


   - "29418:29418"


  volumes:


   - /opt/devops/gerrit:/var/gerrit/review_site

Task

复制代码

- name:

    deploy gerrit


  copy:


    content:

      "{{ lookup('template',
      'docker-compose-gerrit.yml.j2') }}"


    dest:

      /opt/devops/gerrit/docker-compose.yml

15.12.9 Jenkins部署

Jenkins Compose

文件：

复制代码

docker-compose-jenkins.yml.j2

services:


 jenkins:


  image:

    {{ jenkins_image }}


  container_name:

    jenkins


  restart:

    always


  ports:


   - "8080:8080"


   - "50000:50000"



  volumes:


   - /opt/devops/jenkins:/var/jenkins_home


   - /var/run/docker.sock:/var/run/docker.sock

Jenkins任务

复制代码

---

- name:

    deploy jenkins


  template:


    src:

      docker-compose-jenkins.yml.j2


    dest:

      /opt/devops/jenkins/docker-compose.yml



- name:

    start jenkins


  community.docker.docker_compose:


    project_src:

      /opt/devops/jenkins

Jenkins Pipeline示例

项目：

复制代码

Jenkinsfile

pipeline {


agent any



stages {


stage('Checkout'){


steps{


git 'https://gitlab.company.com/app.git'


}


}



stage('Build'){


steps{


sh 'docker build -t app:${BUILD_NUMBER} .'


}


}



stage('Push Harbor'){


steps{


sh '''

docker login harbor.company.com

docker push harbor.company.com/app:${BUILD_NUMBER}

'''


}


}



stage('Deploy'){


steps{


sh '''

kubectl rollout restart deployment app

'''


}


}



}


}

15.12.10 Nexus Repository

用途：

Maven
npm
Python
Docker

Compose：

复制代码

services:


 nexus:


  image:

    sonatype/nexus3


  ports:


   - "8081:8081"


  volumes:


   - /opt/devops/nexus:/nexus-data

Task：

复制代码

- name:

    deploy nexus


  community.docker.docker_compose:


    project_src:

      /opt/devops/nexus

15.12.11 Harbor Registry

生产建议：

Harbor组件：

复制代码

Harbor


├── Core

├── Portal

├── Registry

├── Trivy

├── Database

└── Redis

安装方式：

复制代码

wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-offline-installer.tgz

Ansible：

复制代码

- name:

    install harbor


  unarchive:


    src:

      harbor-offline-installer.tgz


    dest:

      /opt

生成配置：

复制代码

hostname:

 harbor.company.com


https:


 port:

 443

启动：

复制代码

./install.sh

15.12.12 SonarQube

Compose：

复制代码

services:


 sonarqube:


  image:

   sonarqube:lts-community


  ports:


   - "9000:9000"



  environment:


   SONAR_JDBC_URL:

    jdbc:postgresql://postgres:5432/sonar

部署：

复制代码

- name:

    start sonar


  community.docker.docker_compose:


    project_src:

      /opt/devops/sonar

15.12.13 LDAP统一认证

所有平台接入：

复制代码

LDAP


 |

+---------+---------+---------+

|         |         |         |

GitLab Jenkins Harbor Grafana

GitLab LDAP配置：

复制代码

gitlab_rails['ldap_servers'] = {

 'main' => {

  'label'=>'LDAP',

  'host'=>'ldap.company.com',

  'port'=>389,

  'base'=>'dc=company,dc=com'

 }

}

Jenkins:

安装插件：

复制代码

LDAP Plugin
Role Strategy Plugin

15.12.14 CI/CD完整链路

复制代码

代码提交


 ↓


GitLab


 ↓ webhook


Jenkins


 ↓


SonarQube


 ↓


Docker Build


 ↓


Harbor


 ↓


ArgoCD


 ↓


Kubernetes


 ↓


Production

15.12.15 DevOps健康检查

文件：

复制代码

scripts/check-devops.sh

#!/bin/bash


services=(

gitlab

jenkins

nexus

harbor

sonarqube

)



for s in ${services[@]}

do


docker ps | grep $s


done

15.12完成

✅ GitLab CE Role

✅ Gerrit Role

✅ Jenkins Role

✅ Nexus Role

✅ Harbor部署框架

✅ SonarQube Role

✅ Docker Compose模板

✅ LDAP统一认证设计

✅ Jenkins Pipeline模板

✅ GitLab→Jenkins→Harbor→K8s流程

✅ 健康检查脚本