# 一、Harbor安装
再新建一台虚拟机作为Harbor的安装部署：192.168.201.107

Harbor下载官网：https://github.com/goharbor/harbor/releases/tag/v2.14.0

![image.png](/static/img/7fcbf223d2ab614f2ca3c6f6dc34b169.image.webp)

```js
tar -zxvf harbor-offline-installer-v2.14.0.tgz
```

## 然后进入文件目录，修改配置文件

```js
cp harbor.yml.tmpl harbor.yml
vim harbor.yml
```


```yml
# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 192.168.201.107

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# https related config
#https:
  # https port for harbor, default is 443
 # port: 443
  # The path of cert and key files for nginx
  #certificate: /your/certificate/path
 # private_key: /your/private/key/path
  # enable strong ssl ciphers (default: false)
  # strong_ssl_ciphers: false

# # Harbor will set ipv4 enabled only by default if this block is not configured
# # Otherwise, please uncomment this block to configure your own ip_family stacks
# ip_family:
#   # ipv6Enabled set to true if ipv6 is enabled in docker network, currently it affected the nginx related component
#   ipv6:
#     enabled: false
#   # ipv4Enabled set to true by default, currently it affected the nginx related component
#   ipv4:
#     enabled: true

# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal


# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433

# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: 123456

# Harbor DB configuration
database:
  # The password for the user('postgres' by default) of Harbor DB. Change this before any production use.
  password: root123
  # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
  max_idle_conns: 100
  # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
  # Note: the default number of connections is 1024 for postgres of harbor.
  max_open_conns: 900
  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_lifetime: 5m
  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_idle_time: 0

# The default data volume
data_volume: /data

# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
#   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
#   # of registry's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
#   ca_bundle:

#   # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
#   # for more info about this configuration please refer https://distribution.github.io/distribution/about/configuration/
#   # and https://distribution.github.io/distribution/storage-drivers/
#   filesystem:
#     maxthreads: 100
#   # set disable to true when you want to disable registry redirect
#   redirect:
#     disable: false

# Trivy configuration
#
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
# 12 hours and published as a new release to GitHub.
trivy:
  # ignoreUnfixed The flag to display only fixed vulnerabilities
  ignore_unfixed: false
  # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
  #
  # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
  # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
  # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
  skip_update: false
  #
  # skipJavaDBUpdate If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the
  # `/home/scanner/.cache/trivy/java-db/trivy-java.db` path
  skip_java_db_update: false
  #
  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
  # It would work if all the dependencies are in local.
  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
  offline_scan: false
  #
  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
  security_check: vuln
  #
  # insecure The flag to skip verifying registry certificate
  insecure: false
  #
  # timeout The duration to wait for scan completion.
  # There is upper bound of 30 minutes defined in scan job. So if this `timeout` is larger than 30m0s, it will also timeout at 30m0s.
  timeout: 5m0s
  #
  # github_token The GitHub access token to download Trivy DB
  #
  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  # https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting
  #
  # You can create a GitHub token by following the instructions in
  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  #
  # github_token: xxx

jobservice:
  # Maximum number of job workers in job service
  max_job_workers: 10
  # Maximum hours of task duration in job service, default 24
  max_job_duration_hours: 24
  # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB"
  job_loggers:
    - STD_OUTPUT
    - FILE
    # - DB
  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
  logger_sweeper_duration: 1 #days

notification:
  # Maximum retry count for webhook job
  webhook_job_max_retry: 3
  # HTTP client timeout for webhook job
  webhook_job_http_client_timeout: 3 #seconds

# Log configurations
log:
  # options are debug, info, warning, error, fatal
  level: info
  # configs for logs in local storage
  local:
    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
    rotate_count: 50
    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
    # are all valid.
    rotate_size: 200M
    # The directory on your host that store log
    location: /var/log/harbor

  # Uncomment following lines to enable external syslog endpoint.
  # external_endpoint:
  #   # protocol used to transmit log to external endpoint, options is tcp or udp
  #   protocol: tcp
  #   # The host of external endpoint
  #   host: localhost
  #   # Port of external endpoint
  #   port: 5140

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.14.0

# Uncomment external_database if using external database.
# external_database:
#   harbor:
#     host: harbor_db_host
#     port: harbor_db_port
#     db_name: harbor_db_name
#     username: harbor_db_username
#     password: harbor_db_password
#     ssl_mode: disable
#     max_idle_conns: 2
#     max_open_conns: 0

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment external_redis if using external Redis server
# external_redis:
#   # support redis, redis+sentinel
#   # host for redis: <host_redis>:<port_redis>
#   # host for redis+sentinel:
#   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
#   host: redis:6379
#   password:
#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
#   # there's a known issue when using external redis username ref:https://github.com/goharbor/harbor/issues/18892
#   # if you care about the image pull/push performance, please refer to this https://github.com/goharbor/harbor/wiki/Harbor-FAQs#external-redis-username-password-usage
#   # username:
#   # sentinel_master_set must be set to support redis+sentinel
#   #sentinel_master_set:
#   # tls configuration for redis connection
#   # only server-authentication is supported
#   # mtls for redis connection is not supported
#   # tls connection will be disable by default
#   tlsOptions:
#     enable: false
#   # if it is a self-signed ca, please set the ca path specifically.
#     rootCA:
#   # db_index 0 is for core, it's unchangeable
#   registry_db_index: 1
#   jobservice_db_index: 2
#   trivy_db_index: 5
#   idle_timeout_seconds: 30
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
#   ca_file: /path/to/ca

# Global proxy
# Config http proxy for components, e.g. http://my.proxy.com:3128
# Components doesn't need to connect to each others via http proxy.
# Remove component from `components` array if want disable proxy
# for it. If you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

# metric:
#   enabled: false
#   port: 9090
#   path: /metrics

# Trace related config
# only can enable one trace provider(jaeger or otel) at the same time,
# and when using jaeger as provider, can only enable it with agent mode or collector mode.
# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
# if using jaeger agetn mode uncomment agent_host and agent_port
# trace:
#   enabled: true
#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
#   sample_rate: 1
#   # # namespace used to differentiate different harbor services
#   # namespace:
#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
#   # attributes:
#   #   application: harbor
#   # # jaeger should be 1.26 or newer.
#   # jaeger:
#   #   endpoint: http://hostname:14268/api/traces
#   #   username:
#   #   password:
#   #   agent_host: hostname
#   #   # export trace data by jaeger.thrift in compact mode
#   #   agent_port: 6831
#   # otel:
#   #   endpoint: hostname:4318
#   #   url_path: /v1/traces
#   #   compression: false
#   #   insecure: true
#   #   # timeout is in seconds
#   #   timeout: 10

# Enable purge _upload directories
upload_purging:
  enabled: true
  # remove files in _upload directories which exist for a period of time, default is one week.
  age: 168h
  # the interval of the purge operations
  interval: 24h
  dryrun: false

# Cache layer configurations
# If this feature enabled, harbor will cache the resource
# `project/project_metadata/repository/artifact/manifest` in the redis
# which can especially help to improve the performance of high concurrent
# manifest pulling.
# NOTICE
# If you are deploying Harbor in HA mode, make sure that all the harbor
# instances have the same behaviour, all with caching enabled or disabled,
# otherwise it can lead to potential data inconsistency.
cache:
  # not enabled by default
  enabled: false
  # keep cache for one day by default
  expire_hours: 24

# Harbor core configurations
# Uncomment to enable the following harbor core related configuration items.
# core:
#   # The provider for updating project quota(usage), there are 2 options, redis or db,
#   # by default is implemented by db but you can switch the updation via redis which
#   # can improve the performance of high concurrent pushing to the same project,
#   # and reduce the database connections spike and occupies.
#   # By redis will bring up some delay for quota usage updation for display, so only
#   # suggest switch provider to redis if you were ran into the db connections spike around
#   # the scenario of high concurrent pushing to same project, no improvement for other scenes.
#   quota_update_provider: redis # Or db

```
## 然后执行安装脚本

```js
sh install.sh
```

![image.png](/static/img/2dc5fac03d953d807d6f0f0ff8223d59.image.webp)

# 二、Harbor使用
创建一个项目

![image.png](/static/img/e5a8ba7e501d62c6468cb3d2ed18d3c4.image.webp)

拉取下harbor的镜像
```js
docker pull harbor的地址/项目名/镜像名称:版本
```
配置好harbor的镜像源地址

```js
vi /etc/docker/daemon.json
```
每台机器都配置上
```js
{
  "insecure-registries": ["192.168.201.107:80"],
  "registry-mirrors": [
    "https://w14ki3ju.mirror.aliyuncs.com",
    "https://registry.docker-cn.com",
    "https://docker.m.daocloud.io"
  ]
}
```
修改完成后，关闭harbor服务器后再重启docker

```js
docker-compose down
```
```js
systemctl restart docker
```


# 三、手动测试上传一个镜像到harbor
先给镜像加一个标识

```js
docker tag 0d93d97a7fee  192.168.201.107:80/mytest1/mytest1:v5.0
# 格式应为：<仓库地址>:<端口>/<项目名称>/<镜像名称>:<标签>
```

![image.png](/static/img/e92c267268b07058b086f674e97e269d.image.webp)



## 上传镜像到harbor

```js
docker push  192.168.201.107:80/mytest1/mytest1:v5.0
```
发现没有权限，需要先登录
![image.png](/static/img/9ce22063a44539abe122a12a0c6e3c23.image.webp)


```js
docker login 192.168.201.107:80 -u 用户名 -p 密码
```

![image.png](/static/img/d6ebd9d203ad3ca1407aae5d4b70cf68.image.webp)

登录后重新再执行一次命令，已经成功上传


![image.png](/static/img/2a414a258397e4ae35f1cdf2fef21825.image.webp)

![image.png](/static/img/20174e91e35a4b8a029c4ee873bdbd8d.image.webp)


尝试去harbor拉取镜像

```js
docker pull 192.168.201.107:80/mytest1/mytest1:v5.0
```

8.Harbor

# 一、Sonar Qube介绍

Sonar Qube是一个开源的代码分析平台，支持Java、Python、PHP、JavaScript、CSS等25种以上的语言，可以检测出重复代码、代码漏洞、代码规范和安全性漏洞的问题。

Sonar Qube可以与多种软件整合进行代码扫描，比如Maven，Gradle，Git，Jenkins等，并且会将代码检测结果推送回Sonar Qube并且在系统提供的UI界面上显示出来

# 二、安装Sonar Qube
采用docker-compose的方式安装

```yml
version: "3.1"  # 声明使用的Docker Compose语法版本

services:        # 定义容器服务列表
  db:            # 服务1：PostgreSQL数据库容器
    image: postgres  # 使用官方PostgreSQL镜像
    container_name: db  # 显式指定容器名称（而非自动生成）
    ports:
      - 5432:5432  # 将容器内5432端口映射到宿主机同端口
    networks:
      - sonarnet   # 连接到自定义网络
    environment:   # 设置环境变量（数据库配置）
      POSTGRES_USER: sonar      # 创建默认用户名为sonar
      POSTGRES_PASSWORD: sonar  # 设置用户密码为sonar

  sonarqube:      # 服务2：SonarQube代码质量分析平台
    image: sonarqube:8.9.6-community  # 指定SonarQube社区版8.9.3镜像
    container_name: sonarqube  # 显式命名容器
    depends_on:    # 声明依赖关系（先启动db服务）
      - db
    ports:
      - "9000:9000"  # 暴露Web管理界面端口
    networks:
      - sonarnet     # 使用同一自定义网络
    environment:     # SonarQube连接数据库的配置
      SONAR_JDBC_URL: jdbc:postgresql://db:5432/sonar  # 通过服务名db访问PostgreSQL
      SONAR_JDBC_USERNAME: sonar  # 使用db服务中定义的用户名
      SONAR_JDBC_PASSWORD: sonar  # 使用db服务中定义的密码

networks:        # 自定义网络配置
  sonarnet:      # 网络名称
    driver: bridge  # 使用桥接模式（默认网络驱动）
```

```js
‌双容器架构‌
PostgreSQL容器作为SonarQube的专用数据库
SonarQube容器提供代码扫描的Web服务
‌网络隔离‌
通过sonarnet自定义网络实现：

容器间可通过服务名直接通信（如jdbc:postgresql://db:5432）
与外部网络隔离增强安全性
‌关键配置‌

数据库认证信息通过环境变量动态注入
端口映射使宿主机可访问：
9000：SonarQube管理界面
5432：可选暴露数据库端口（生产环境建议移除）
‌版本控制‌

明确指定SonarQube版本（8.9.6社区版）
使用稳定的PostgreSQL官方镜像
启动命令建议：docker-compose up -d
访问地址：http://localhost:9000（首次启动需等待约2分钟初始化）
```
启动后日志报错，说虚拟内存不足需要更改,然后重新启动
```js
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
```


# 三、启动后访问，然后修改密码，安装中文插件
http://192.168.201.106:9000/
默认账号和密码都是admin，第一次登录后需要修改密码


![image.png](/static/img/a382671d3967741269d95b0f3c18b27a.image.webp)

由于我版本是8.9.6插件已经是10.0版本无法安装，只能通过上传jar到容器内重启SonarQube完成

```js
docker cp sonar-l10n-zh-plugin-8.9.jar   5104b8dcff76:/opt/sonarqube/extensions/downloads
```


# 四、下载扫描器
https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner/


![image.png](/static/img/89c778df36e56ec925b8cc8f93aa4360.image.webp)

下载解压后，移动到Jenkins的数据卷中

```js
mv /songxuan/sonar-scanner-4.8.0.2856-linux/ ./
```

然后配置

```js
vi /jenkins/data/sonar-scanner-4.8.0.2856-linux/conf/sonar-scanner.properties
```


```js
# Configure here general information about the environment, such as the server connection details for example
# No information about specific project should appear here

#----- SonarQube server URL (default to SonarCloud)

sonar.host.url=http://192.168.201.106:9000

#sonar.scanner.proxyHost=myproxy.mycompany.com
#sonar.scanner.proxyPort=8002
sonar.sourceEncoding=UTF-8
```


然后生成一个令牌
![image.png](/static/img/135d6dab893401eccd8dfe42842cf01b.image.webp)

## 在项目所在目录执行以下命令
```js
/jenkins/data/sonar-scanner-4.8.0.2856-linux/bin/sonar-scanner \
  -Dsonar.sources=/jenkins/data/workspace/mytest1 \
  -Dsonar.projectname=mytest1 \
  -Dsonar.projectKey=mytest1 \
  -Dsonar.java.binaries=/jenkins/data/workspace/mytest1/target/ \
  -Dsonar.login=0e19bdffcf64ce49a7f2def0cc2a7d8460d2b6e3 \
  -Dsonar.host.url=http://192.168.201.106:9000
```

然后扫描该项目
![image.png](/static/img/45f452178c086bf8948c527aa546fc7a.image.webp)


# 五、集成到jenkins

到Jenkins下载Sonar Qube插件,安装后重启Jenkins


![image.png](/static/img/1fb8fe249dee8fd8f2cac6ac5643d5f3.image.webp)


![image.png](/static/img/7598e7e36ef1e837c05538e773646eec.image.webp)


![image.png](/static/img/ca478147e28273eeb7a654a4d3bd3f2c.image.webp)

# 六、再配置构建完成后的代码质量检测



![image.png](/static/img/4b4230ecdf50e49dd4451220425bf1e9.image.webp)

![image.png](/static/img/9c4b547379cfe33ccb750b9d5bf205f7.image.webp)

这里添加生成令牌的
![image.png](/static/img/930e107fca11a078842d37ebc124e4da.image.webp)
![image.png](/static/img/a54c3421f9651fcc94aa9962ac1d6ca8.image.webp)

然后去配置流水线的配置
![image.png](/static/img/ac87f58fe001d8b5fb1d27e03788b20c.image.webp)

![image.png](/static/img/61c5817427744e1a6e67dc95516296b8.image.webp)


![image.png](/static/img/e8f26a53e327b4819dcdeac0cb7aafbd.image.webp)

```js
sonar.projectname=${JOB_NAME}
sonar.projectKey=${JOB_NAME}
sonar.sources=./
sonar.java.binaries=target
```

![image.png](/static/img/8d0deeeb40c1b09253272bef9c9c637f.image.webp)

最后完成了整个流程的自动化构建和质量检测

![image.png](/static/img/f5d077451efbb2e869a1996954d3ae3c.image.webp)

7.集成Sonar Qube完成Jenkins自动代码质量检测

# 一、添加tab，通过标签进行选择版本构建工程

![image.png](/static/img/4c824a413a763550751ffd5998d8ab48.image.webp)

然后新增一个步骤，添加shell命令的方式

![image.png](/static/img/48aa0d6740169f2bea803b08588b2c90.image.webp)

然后把shell命令的方式拉到前面

![image.png](/static/img/a5d885b9de4094b5b31e171fe71ce35f.image.webp)

然后填写

```js
git checkout $tag
```

# 二、然后在gitlab的项目中新建一个标签

![image.png](/static/img/69e9795a8c221c364072c99af15a7cc1.image.webp)
旧的代码将会是1.0版本

![image.png](/static/img/65dd18ff213bf16f6de2cf2e2c4312a4.image.webp)

然后再去IDEA更改，提交推送，推送后再去gitlab创建标签，就会把最新的代码放在新的标签版本中。


![image.png](/static/img/7ecb7f05d507ded0170503a6d4bbe2a3.image.webp)

![image.png](/static/img/6083deb654a7f01c3f625cd048d459cd.image.webp)
然后提交，再去Jenkins看已经完成了tag标配版本的控制

![image.png](/static/img/e200c0c8b8ef87dd7b6a934b638f7e65.image.webp)

![image.png](/static/img/620c4472314e3cc7ba4655cfc54d3590.image.webp)

Jenkins通过标签控制版本，如果新版本有漏洞bug时，可以进行回退

6.jenkins实现tag版本控制

# 一、jenkins创建任务

![image.png](/static/img/1714d762e938339e550f2480b865e454.image.webp)

![image.png](/static/img/5f4a81dca4eab7d46e9752abb5862a79.image.webp)

填写好git仓库地址，添加好账号保存

![image.png](/static/img/d7edb461c3972fcd16380a3285995875.image.webp)
然后点击构建任务，测试构建成功
![image.png](/static/img/b4f9ed706e7f4b0e115330adc5ee8c6f.image.webp)


# 二、配置Jenkins构建的操作

![image.png](/static/img/147bad5e4c9324c58998b7486009454a.image.webp)

![image.png](/static/img/3d2ed65b1305a7208bef353cf9fb3580.image.webp)

![image.png](/static/img/a5c4364eeb350f2bc3b985a2a3d3b8ee.image.webp)

![image.png](/static/img/833441f2f1736644ae6029396224b997.image.webp)

应用后保存
![image.png](/static/img/dd8cff0989433d03212ea2205f9e1971.image.webp)

构建完成后，发现该目录下已经生成jar包

![image.png](/static/img/ed3fce8ce6575cec03e2b13ef11dbcb3.image.webp)


# 三、添加构建后的操作

![image.png](/static/img/9b181b7be62bdcb54d77e2de3b791e84.image.webp)


![image.png](/static/img/3298faaa17bdfefed138e01ce99cb84c.image.webp)

最后已经复制到远程服务器
![image.png](/static/img/6628c2857789562cf48eecd7ca02c085.image.webp)

# 四、构建成docker镜像并启动
更改生成tar包固定的名字
![image.png](/static/img/ebb44b426a725c76416d2bb9298e5ac5.image.webp)

先在idea创建一个docker的目录
![image.png](/static/img/bb70712d9e4e18d23ecf2b02fc51b6ac.image.webp)

创建一个Dockerfile文件

```js
FROM java:8-jdk
COPY mytest1.jar   /songxuan/
WORKDIR /songxuan
CMD java  -jar mytest1.jar
```

创建一个docker-compose.yml

```js
version: '3.1'
services:
  mytest1:
    build:
      context: ./
      dockerfile: Dockerfile
    image: mytest1:v1.0
    container_name: mytest1
    ports:
      - 8081:8080
```

![image.png](/static/img/59315d936377b342cdfbfb886e525d40.image.webp)

然后进行提交更新推送
![image.png](/static/img/b5bb5a22fda62a4f4e0beeaa540e335a.image.webp)

然后发现Jenkins挂载的数据卷目录已经有docker的文件目录了

![image.png](/static/img/b688d97ad8341554cea07e439afebcd7.image.webp)


gitlab项目中也有docker的目录了

![image.png](/static/img/4208ae9bf80c93762b140e18f488d480.image.webp)

# 五、再去Jenkins配置，把docker目录下的文件也复制到远程服务器



![image.png](/static/img/ae3148290014664aab4df0fd1f1b7bdf.image.webp)



# 六、再配置要传递执行的命令

```js
cd /songxuan/docker/
mv /songxuan/target/*jar  /songxuan/docker/
docker-compose down
docker-compose up -d --build
docker image prune -f
```

![image.png](/static/img/b4178f912b738c31b9ffd65b89ad2d2e.image.webp)






IDEA的文件有问题，重新修改pom.xml

```js
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.example.mytest1</groupId>
    <artifactId>mytest1</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>mytest1</name>
    <description>mytest1</description>
    <properties>
        <java.version>1.8</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <spring-boot.version>2.6.13</spring-boot.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <finalName>mytest1</finalName>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.8.1</version>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <version>${spring-boot.version}</version>
                <configuration>
                    <mainClass>com.example.mytest1.mytest1.Mytest1Application</mainClass>
                    
                </configuration>
                <executions>
                    <execution>
                        <id>repackage</id>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

</project>

```
最后完成整个基本CI/CD流程

![image.png](/static/img/b09c6bad824e17e02b467ce817ce4b32.image.webp)

5.jenkins实现CI操作2


```yml
apiVersion: autoscaling/v2  # 使用v2版本API支持多指标
kind: HorizontalPodAutoscaler
metadata:
  name: cpu-mem-hpa        # HPA资源名称
  namespace: default       # 可选：指定命名空间
spec:
  scaleTargetRef:          # 指定要扩缩的目标资源
    apiVersion: apps/v1    # 目标资源的API版本
    kind: Deployment       # 资源类型(支持Deployment/StatefulSet等)
    name: your-deployment  # 需要替换为实际Deployment名称
  
  minReplicas: 1          # 最小副本数(必须≥1)
  maxReplicas: 5          # 最大副本数限制
  
  metrics:                # 定义扩缩容指标(可多指标)
  - type: Resource        # 资源类型指标(CPU/内存)
    resource:
      name: cpu           # 监控CPU指标
      target:
        type: Utilization # 使用率类型
        averageUtilization: 95  # 目标利用率阈值(百分比)
  
  - type: Resource        # 第二个资源指标
    resource:
      name: memory        # 监控内存指标
      target:
        type: Utilization
        averageUtilization: 95  # 内存使用率阈值
```


```js
配置了基于CPU和内存的双指标HPA，任一指标达到95%利用率时触发扩容
最小副本数设为1，最大副本数限制为5个pod
需要替换your-deployment为实际要监控的Deployment名称
使用autoscaling/v2 API版本支持多指标扩缩容
```