Jenkins on VMware一键落地实践（企业级CI/CD环境构建全链路拆解）

# deploy-jenkins.yml —— 调用vSphere模块创建VM并注入cloud-init
- name: Provision Jenkins master VM
  vmware.vmware_rest.vcenter_vm:
    hostname: "{{ vcenter_host }}"
    username: "{{ vcenter_user }}"
    password: "{{ vcenter_pass }}"
    datacenter: "Production-DC"
    cluster: "CI-Cluster"
    name: "jenkins-prod-01"
    guest_OS: "centos9_64Guest"
    memory: 8192
    cpu_count: 4
    disks:
      - capacity: 100
    networks:
      - name: "VM-Network-Prod"
        ip_addresses: ["10.20.30.150"]
        subnet_mask: "255.255.255.0"
        gateway: "10.20.30.1"
        dns_servers: ["10.20.30.2"]

# 执行于Jenkins主节点
sudo cat /var/lib/jenkins/secrets/initialAdminPassword
sudo sed -i 's/#JAVA_ARGS="-Djava.awt.headless=true"/JAVA_ARGS="-Djava.awt.headless=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=false"/' /etc/sysconfig/jenkins
sudo systemctl restart jenkins

# vSphere VM template for CI agent
resource_pool: "/Datacenter/host/CI-Cluster/Resources/Build-Pool"
cpu_allocation:
  reservation_mhz: 2000
  shares_level: high
memory_allocation:
  limit_mb: 4096

<!-- Jenkins HA健康检查端点配置 -->
<healthCheckUrl>http://jenkins-master:8080/login?from=%2F&amp;login=1</healthCheckUrl>

{
  "resource_type": "SecurityPolicy",
  "display_name": "ci-cd-isolation-policy",
  "category": "Environment",
  "rules": [
    {
      "display_name": "Block-Test-to-Prod",
      "source_groups": ["nsx_policy_group:test-env"],
      "destination_groups": ["nsx_policy_group:prod-env"],
      "action": "DENY",
      "logged": true
    }
  ]
}

# 使用vVOL策略动态绑定PVC（vSphere CSI Driver）
kubectl apply -f - <<EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pipeline-pvc
spec:
  storageClassName: "vvol-sc"  # 绑定vVOL策略：tier=performance, snapshot=true
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 20Gi
EOF

# 在Jenkins agent启动时执行CIS检查
esxcli system settings advanced set -o /UserVars/ESXiShellTimeOut -i 300
esxcli system security lockdownmode set --enable true

# cloud-config.yaml
#cloud-config
packages:
  - openjdk-17-jdk
  - git
runcmd:
  - systemctl enable docker
  - curl -fsSL https://get.docker.com | sh

# agent-docker-vm.sh
cloud-init --ds nocloud --file user-data.yaml \
  && systemctl enable containerd docker \
  && docker run -d --name agent-core \
     -v /var/run:/var/run \
     -v /etc/agent:/etc/agent \
     registry.example.com/agent:v2.3.0

# 启用 Guest OS 指标驱动的 DRS 规则
$vm = Get-VM "web-app-01"
$spec = New-Object VMware.Vim.VirtualMachineConfigSpec
$spec.memoryAllocation = New-Object VMware.Vim.ResourceAllocationInfo
$spec.memoryAllocation.expandableReservation = $true
$vm.ExtensionData.Reconfigure($spec)

→ Git Push → HTTP POST → vRO REST Host Listener → Workflow Trigger → 参数解析 → 执行部署流水线

{
  "workflowId": "a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8",
  "parameters": {
    "repoName": "{{repository.full_name}}",
    "branch": "{{ref}}",
    "commitId": "{{head_commit.id}}"
  }
}

pipeline {
  agent {
    kubernetes {
      cloud 'vsphere-instant'
      // 触发vSphere Instant Clone API创建临时VM
      yaml '''
        apiVersion: jenkins.io/v1
        kind: VsphereInstantClone
        spec:
          templateVM: 'jenkins-agent-ubuntu2204-base'
          datastore: 'ds-nvme-prod'
      '''
    }
  }
}

# 创建版本化快照并发布到Content Library
New-ContentLibraryItem -Name "test-env-v2.1" `
  -ContentType Ovf `
  -Description "QA-ready snapshot with JDK17 & Spring Boot 3.2" `
  -SourcePath "C:\templates\qa-ovf-template.ovf"

# vCenter 状态查询片段（含重试与幂等校验）
response = requests.get(
    f"https://{vc_host}/rest/vcenter/vm/{vm_id}",
    headers={"vmware-api-session-id": session_id},
    timeout=10
)
assert response.json()["vm"]["power_state"] == "POWERED_ON"  # 蓝/绿环境就绪断言

// 关键采样策略：对失败请求 100% 采样，成功请求按 QPS 动态降采
sdktrace.WithSampler(
  sdktrace.ParentBased(
    sdktrace.TraceIDRatioBased(0.001),
    sdktrace.WithFallback(sdktrace.NeverSample()),
    sdktrace.WithRemoteParentSampled(sdktrace.AlwaysSample()),
  ),
)

[Agent] → OTLP Exporter → [Collector] → (Jaeger UI / Tempo)