jnlp kubernetes从代理问题

Question

您好，我一直在尝试调查为什么 jnlp k8s 代理会在离线状态下挂起，并在主 Jenkins 中看到以下错误：

WARNING: Error in provisioning; agent=KubernetesSlave name: k8s-inbound-agent-36bxc, template=PodTemplate{id='53e3acbf-d96b-4ec7-bc87-de4e200d98e5'inheritFrom='', name='k8s-inbound-agent', namespace='jenkins', hostNetwork=false, instanceCap=40, idleMinutes=10, activeDeadlineSeconds=120, label='k8s-agent', serviceAccount='jenkins', nodeSelector='', nodeUsageMode=EXCLUSIVE, workspaceVolume=EmptyDirWorkspaceVolume [memory=false], volumes=[HostPathVolume [mountPath=/var/run/docker.sock, hostPath=/var/run/docker.sock], EmptyDirVolume [mountPath=/opt/jenkins, memory=false], EmptyDirVolume [mountPath=/home/jenkins/.ssh, memory=false], HostPathVolume [mountPath=/tmp/jenkins-agent, hostPath=/tmp/jenkins-agent]], containers=[ContainerTemplate{name='inbound-agent', image='hmctspublic.azurecr.io/jenkins/build-agent:db6hu6', workingDir='/home/jenkins/agent', command='/tini --', args='/bin/sh -c cat', ttyEnabled=true, resourceRequestCpu='2000m', resourceRequestMemory='4Gi', resourceLimitCpu='4000m', resourceLimitMemory='12Gi', livenessProbe=org.csanchez.jenkins.plugins.kubernetes.ContainerLivenessProbe@5a6d394c}, ContainerTemplate{name='jnlp', image='hmctspublic.azurecr.io/jenkins/minimal-agent:db6hu6', workingDir='/home/jenkins/agent', command='/bin/sh -c', args='cat', resourceRequestCpu='1000m', resourceRequestMemory='1Gi', resourceLimitCpu='2000m', resourceLimitMemory='6Gi', livenessProbe=org.csanchez.jenkins.plugins.kubernetes.ContainerLivenessProbe@7919636d}]}
java.lang.IllegalStateException: Pod has terminated containers: jenkins/k8s-inbound-agent-36bxc (jnlp)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.periodicAwait(AllContainersRunningPodWatcher.java:133)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.periodicAwait(AllContainersRunningPodWatcher.java:154)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.await(AllContainersRunningPodWatcher.java:94)
    at org.csanchez.jenkins.plugins.kubernetes.KubernetesLauncher.launch(KubernetesLauncher.java:156)
    at hudson.slaves.SlaveComputer.lambda$_connect$0(SlaveComputer.java:294)
    at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
    at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:71)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)

Nov 03, 2020 2:22:00 PM org.csanchez.jenkins.plugins.kubernetes.KubernetesSlave _terminate
INFO: Terminating Kubernetes instance for agent k8s-inbound-agent-36bxc
Nov 03, 2020 2:22:00 PM org.csanchez.jenkins.plugins.kubernetes.KubernetesSlave deleteSlavePod

上面的错误有什么原因吗？

Answer 1

转到http://your_server/configureSecurity/ 并为"Agents:TCP port for JNLP agents" 选择“random”选项，这可能会有所帮助。

jenkins JNLP tcp port docs

Jenkins 可以使用 TCP 端口与入站（以前称为 作为“JNLP”）代理，例如基于 Windows 的代理。从 Jenkins 2.0 开始，由 默认禁用此端口。

对于希望使用入站 TCP 代理的管理员，两个端口选项是：

1. 随机：随机选择 TCP 端口以避免 Jenkins 主服务器上的冲突。随机端口的缺点是它们是在 Jenkins 控制器启动期间选择的，因此很难管理允许 TCP 流量的防火墙规则。

2. 固定：端口由 Jenkins 管理员选择，并且在 Jenkins 控制器重新启动时保持一致。这使得管理允许基于 TCP 的代理连接到控制器的防火墙规则变得更加容易。

从 Jenkins 2.217 开始，入站代理可以改为配置为使用 连接到 Jenkins 的 WebSocket 传输。在这种情况下没有额外的 TCP 端口需要启用，不需要特殊的安全配置。

相关问题：

1. Jenkins Kubernetes plugin failing to provision jnlp-slave pods

2. Kubernetes - Jenkins slaves are offline