jnlp kubernetes从代理问题

Question

您好，我一直在尝试调查为什么jnlp k8s代理在脱机状态下挂起，并在master Jenkins中看到以下错误：

WARNING: Error in provisioning; agent=KubernetesSlave name: k8s-inbound-agent-36bxc, template=PodTemplate{id='53e3acbf-d96b-4ec7-bc87-de4e200d98e5'inheritFrom='', name='k8s-inbound-agent', namespace='jenkins', hostNetwork=false, instanceCap=40, idleMinutes=10, activeDeadlineSeconds=120, label='k8s-agent', serviceAccount='jenkins', nodeSelector='', nodeUsageMode=EXCLUSIVE, workspaceVolume=EmptyDirWorkspaceVolume [memory=false], volumes=[HostPathVolume [mountPath=/var/run/docker.sock, hostPath=/var/run/docker.sock], EmptyDirVolume [mountPath=/opt/jenkins, memory=false], EmptyDirVolume [mountPath=/home/jenkins/.ssh, memory=false], HostPathVolume [mountPath=/tmp/jenkins-agent, hostPath=/tmp/jenkins-agent]], containers=[ContainerTemplate{name='inbound-agent', image='hmctspublic.azurecr.io/jenkins/build-agent:db6hu6', workingDir='/home/jenkins/agent', command='/tini --', args='/bin/sh -c cat', ttyEnabled=true, resourceRequestCpu='2000m', resourceRequestMemory='4Gi', resourceLimitCpu='4000m', resourceLimitMemory='12Gi', livenessProbe=org.csanchez.jenkins.plugins.kubernetes.ContainerLivenessProbe@5a6d394c}, ContainerTemplate{name='jnlp', image='hmctspublic.azurecr.io/jenkins/minimal-agent:db6hu6', workingDir='/home/jenkins/agent', command='/bin/sh -c', args='cat', resourceRequestCpu='1000m', resourceRequestMemory='1Gi', resourceLimitCpu='2000m', resourceLimitMemory='6Gi', livenessProbe=org.csanchez.jenkins.plugins.kubernetes.ContainerLivenessProbe@7919636d}]}
java.lang.IllegalStateException: Pod has terminated containers: jenkins/k8s-inbound-agent-36bxc (jnlp)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.periodicAwait(AllContainersRunningPodWatcher.java:133)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.periodicAwait(AllContainersRunningPodWatcher.java:154)
    at org.csanchez.jenkins.plugins.kubernetes.AllContainersRunningPodWatcher.await(AllContainersRunningPodWatcher.java:94)
    at org.csanchez.jenkins.plugins.kubernetes.KubernetesLauncher.launch(KubernetesLauncher.java:156)
    at hudson.slaves.SlaveComputer.lambda$_connect$0(SlaveComputer.java:294)
    at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
    at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:71)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)

Nov 03, 2020 2:22:00 PM org.csanchez.jenkins.plugins.kubernetes.KubernetesSlave _terminate
INFO: Terminating Kubernetes instance for agent k8s-inbound-agent-36bxc
Nov 03, 2020 2:22:00 PM org.csanchez.jenkins.plugins.kubernetes.KubernetesSlave deleteSlavePod

上面的错误有什么原因吗？

Answer 1

访问http://your_server/configureSecurity/并为"Agents:TCP port for JNLP agents"选择"random“选项，这可能会有所帮助。

jenkins JNLP tcp port docs

Windows可以使用TCP端口来与入站(以前称为“

”)代理通信，例如基于Windows的代理。从Jenkins 2.0开始，默认情况下此端口处于禁用状态。

对于希望使用入站TCP代理的管理员，有两个端口选项：

TCP1.TCPRandom：端口是随机选择的，以避免在Jenkins主机上发生冲突。随机化端口的缺点是，它们是在Jenkins控制器启动时选择的，这使得管理允许TCP流量的防火墙规则变得困难。

2.已修复:端口由Jenkins管理员选择，并且在重新启动Jenkins控制器时保持一致。这使得管理允许基于TCP的代理连接到控制器的防火墙规则变得更容易。

从Jenkins 2.217开始，入站代理可以改为配置为使用WebSocket传输来连接到Jenkins。在这种情况下，不需要启用额外的TCP端口，也不需要特殊的安全配置。

相关问题：

1. Jenkins Kubernetes plugin failing to provision jnlp-slave pods

1. Kubernetes - Jenkins slaves are offline