Jenkins:如何在Nginx反向代理后面配置Jenkins,以便JNLP从站进行连接

Jenkins:如何在Nginx反向代理后面配置Jenkins,以便JNLP从站进行连接

问题描述:

我正在尝试建立一个Jenkins主节点和一个Jenkins从节点,其中Jenkins主节点位于另一台具有SSL终止功能的服务器上的Nginx反向代理之后. nginx的配置如下:

I am trying to set up a Jenkins master and a Jenkins slave node where the Jenkins Master is behind Nginx reverse proxy on a different server with SSL termination. The nginx configuration is as following:

upstream jenkins {
  server <server ip>:8080 fail_timeout=0;
}

server {
  listen 443 ssl;
  server_name jenkins.mydomain.com;
  ssl_certificate /etc/nginx/certs/mydomain.crt;
  ssl_certificate_key /etc/nginx/certs/mydomain.key;

  location / {
    proxy_set_header        Host $host:$server_port;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_redirect          http:// https://;
    proxy_pass              http://jenkins;
  }
}

server {
  listen 80;
  server_name jenkins.mydomain.com;
  return 301 https://$server_name$request_uri;
}

在Jenkins主全局安全性配置中,用于JNLP代理的TCP端口设置为50000.端口50000设置为可从主机上的任何位置访问.

The TCP port for JNLP agents is set as 50000 in Jenkins master Global Security configuration. Port 50000 is set to be accessible from anywhere on the host machine.

使用以下命令启动JNLP从站:

The JNLP slave is launched with the following command:

java -jar slave.jar -jnlpUrl https://jenkins.mydomain.com/computer/slave-1/slave-agent.jnlp -secret <secret>

JNLP从站无法连接到主站上已配置的JNLP端口:

The JNLP slave fails to connect to the configured JNLP port on the master:

INFO: Connecting to jenkins.mydomain.com:50000 (retrying:4)
java.net.ConnectException: Connection timed out
        at java.net.PlainSocketImpl.socketConnect(Native Method)
        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
        at java.net.Socket.connect(Socket.java:589)
        at java.net.Socket.connect(Socket.java:538)
        at hudson.remoting.Engine.connect(Engine.java:400)
        at hudson.remoting.Engine.run(Engine.java:298)

JNLP从属服务器连接到Jenkins主服务器需要什么配置?

What is the configuration required for the JNLP slave to connect to the Jenkins master?

JNLP端口似乎使用了二进制协议,而不是基于文本的HTTP协议,因此很遗憾,它不能像常规的那样通过NGINX进行反向代理.詹金斯页面可以.

The JNLP port seems to use a binary protocol, not a text-based HTTP protocol, so unfortunately it can't be reverse-proxied through NGINX like the normal Jenkins pages can be.

相反,您应该:

  1. 配置全局安全性>选中启用安全性"并设置固定" "JNLP从属代理的TCP端口".这将导致所有詹金斯页面 发出额外的HTTP标头来指定此端口:X-Hudson-CLI-Port, X-Jenkins-CLI-Port,X-Jenkins-CLI2-Port.

  1. Configure Global Security > Check "Enable security" and set a Fixed "TCP port for JNLP slave agents". This will cause all Jenkins pages to emit extra HTTP headers specifying this port: X-Hudson-CLI-Port, X-Jenkins-CLI-Port, X-Jenkins-CLI2-Port.

允许固定的TCP JNLP 通过任何防火墙进行端口移植,以便CLI客户端和JNLP代理可以 直接到达后端的Jenkins服务器.

Allow your fixed TCP JNLP port through any firewall(s) so CLI clients and JNLP agents can directly reach the Jenkins server on the backend.

将系统属性hudson.TcpSlaveAgentListener.hostName设置为 后端Jenkins服务器的主机名或IP地址.这 将导致所有页面发出额外的HTTP标头 (X-Jenkins-CLI-Host)包含此指定的主机名.这说明 CLI客户端要连接的地方,但应该不是JNLP代理.

Set the system property hudson.TcpSlaveAgentListener.hostName to the hostname or IP address of your Jenkins server on the backend. This will cause all pages to emit an extra HTTP header (X-Jenkins-CLI-Host) containing this specified hostname. This tells CLI clients where to connect, but supposedly not JNLP agents.

对于以下节点列表中的每个构建从属机器: 使用启动方法通过Java Web Start启动从属代理"的jenkins.mydomain.com/computer/,单击计算机,单击配置",单击启动方法"下右侧的高级..."按钮,然后适当地设置隧道连接通过"字段.阅读问号帮助.您可能只需要使用"HOST:"语法,其中HOST是后端Jenkins服务器的主机名或IP地址.

For each of your build slave machines in the list of nodes at jenkins.mydomain.com/computer/ that uses the Launch method "Launch slave agents via Java Web Start", click the computer, click Configure, click the Advanced... button on the right side under Launch method, and set the "Tunnel connection through" field appropriately. Read the question mark help. You probably just need the "HOST:" syntax, where HOST is the hostname or IP address of your Jenkins server on the backend.

参考文献:

  • https://issues.jenkins-ci.org/browse/JENKINS-11982
  • https://support.cloudbees.com/hc/en-us/articles/218097237-How-to-troubleshoot-JNLP-slaves-connection-issues-with-Jenkins
  • https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+CLI