1
bkdl-7.1-stable.sh -ur latest base demo

1
helm repo add blueking https://hub.bktencent.com/chartrepo/blueking
2

3
helm repo update
4

5
helm repo list

1
# 请修改为你分配给蓝鲸平台的主域名
2
BK_DOMAIN=bk.hua-ri.cn
3

4
# 进入工作目录
5
cd ~/bkce7.1-install/blueking/
6

7
# 可使用如下命令添加域名。如果文件已存在，请手动编辑。custom=environments/default/custom.yaml
8

9
cat >> "$custom" <<EOF
10
imageRegistry: ${REGISTRY:-hub.bktencent.com}
11
domain:
12
  bkDomain: $BK_DOMAIN
13
  bkMainSiteDomain: $BK_DOMAIN
14
EOF

1
./scripts/generate_app_secret.sh ./environments/default/app_secret.yaml

1
./scripts/generate_rsa_keypair.sh ./environments/default/bkapigateway_builtin_keypair.yaml

1
./scripts/create_k8s_cluster_admin_for_paas3.sh

1
helmfile -f base-blueking.yaml.gotmpl -l seq=first sync
2
helmfile -f base-blueking.yaml.gotmpl -l seq=second sync
3
helmfile -f base-blueking.yaml.gotmpl -l seq=third sync
4
# helmfile -f base-blueking.yaml.gotmpl -l seq=fourth sync

1
kubectl exec -it -n blueking bk-ci-mysql-0 -- /bin/bash -c 'MYSQL_PWD="$MYSQL_ROOT_PASSWORD" mysql -u root -e "USE devops_ci_store; SELECT IMAGE_NAME,IMAGE_CODE,IMAGE_REPO_NAME FROM T_IMAGE WHERE IMAGE_CODE = \"bkci\" ;"'

1
kubectl exec -it -n blueking bk-ci-mysql-0 -- /bin/bash -c 'MYSQL_PWD="$MYSQL_ROOT_PASSWORD" mysql -u root -e "USE devops_ci_store; UPDATE  T_IMAGE SET IMAGE_REPO_NAME=\"hub.bktencent.com/bkci/ci\" WHERE IMAGE_CODE = \"bkci\" ;"'

1
kubectl exec -n blueking deploy/bk-ci-bk-ci-store -- \curl -vs http://bk-ci-bk-ci-store.blueking.svc.cluster.local/api/op/market/image/init -X POST \-H 'X-DEVOPS-UID: admin' -H 'Content-type: application/json' -d '{"imageCode":"bkci","imageName":"bkci","imageRepo":"hub.bktencent.com/bkci/ci","projectCode":"demo","userId":"admin"}' | jq .

1
# 创建Secret
2
BK_DOMAIN=$(yq e '.domain.bkDomain' environments/default/custom.yaml)
3

4
cd $HOME/$BK_DOMAIN
5

6
kubectl create secret tls $BK_DOMAIN -n blueking --cert=$HOME/$BK_DOMAIN/$BK_DOMAIN.pem --key=$HOME/$BK_DOMAIN/$BK_DOMAIN.key

1
#!/bin/bash
2

3
# 配置变量
4
NAMESPACE="blueking"
5
DOMAIN_FILE="environments/default/custom.yaml"
6
BK_DOMAIN=$(yq e '.domain.bkDomain' "$DOMAIN_FILE")  # 从配置文件中读取域名
7
TLS_HOST="*.$BK_DOMAIN"  # 泛域名
8
TLS_SECRET="$BK_DOMAIN"  # Secret 名称与域名一致
9

10
# 检查域名和 Secret 是否正确
11
if [[ -z "$BK_DOMAIN" ]]; then
12
  echo "Error: BK_DOMAIN is not set in $DOMAIN_FILE."
13
  exit 1
14
fi
15

16
# 获取命名空间中的所有 Ingress 资源
17
ingresses=$(kubectl get ingress -n "$NAMESPACE" -o jsonpath='{.items[*].metadata.name}')
18

19
# 遍历所有 Ingress 资源并更新 TLS 配置
20
for ingress in $ingresses; do
21
  echo "Updating Ingress: $ingress in namespace: $NAMESPACE"
22

23
  # 检查 Ingress 是否已存在 TLS 配置
24
  if kubectl get ingress "$ingress" -n "$NAMESPACE" -o jsonpath='{.spec.tls}' | grep -q "$TLS_HOST"; then
25
    echo "TLS configuration for $TLS_HOST already exists in Ingress $ingress. Skipping."
26
    continue
27
  fi
28

29
  # 更新 Ingress 的 TLS 配置
30
  kubectl patch ingress "$ingress" -n "$NAMESPACE" --type=json -p='[
31
    {
32
      "op": "add",
33
      "path": "/spec/tls",
34
      "value": [
35
        {
36
          "hosts": ["'"$TLS_HOST"'"],
37
          "secretName": "'"$TLS_SECRET"'"
38
        }
39
      ]
40
    }
41
  ]' || { echo "Failed to update Ingress $ingress"; exit 1; }
42

43
  echo "Updated Ingress $ingress with TLS configuration for $TLS_HOST."
44
done
45

46
echo "All Ingress resources in namespace $NAMESPACE have been updated with TLS configuration for $TLS_HOST."

1
yq -i '.bkDomainScheme = "https"' environments/default/custom.yaml
2

3
# 将bkHttpSchema: https替换为bkHttpSchema: http
4
sed -i 's|bkHttpSchema: http|bkHttpSchema: https|' environments/default/bkci/bkci-custom-values.yaml.gotmpl

1
# 重启第一批服务
2
helmfile -f base-blueking.yaml.gotmpl -l seq=first sync
3

4
# bk-apigateway 部分 pod 不会重启，主动删除等重建
5
kubectl delete pod -n blueking -l 'app.kubernetes.io/instance=bk-apigateway,app.kubernetes.io/component in (api-support-fe, dashboard-fe)'
6

7
# 等待 bk-apigateway 全部 pod 重启成功后进行下一步
8
kubectl get pod -n blueking -l 'app.kubernetes.io/instance=bk-apigateway,app.kubernetes.io/component in (api-support-fe, dashboard-fe)'
9

10
# bkrepo 部分 pod 不会重启，主动删除等重建
11
kubectl delete pod -n blueking -l 'app.kubernetes.io/instance=bk-repo,bk.repo.scope=backend'
12

13
# 等待 bkrepo 全部 pod 重启成功后进行下一步
14
# 这里一定要等所有pod重启成功后，才开始下一步，否则会导致服务异常
15
# repo系列服务会因为阿里云EKS csi插件问题，导致服务卡住，需要手动删除卡在ContainerCreating的pod，让pod重启
16
watch -n 1 kubectl get pod -n blueking -l 'app.kubernetes.io/instance=bk-repo,bk.repo.scope=backend'
17

18
# 重启第二批服务
19
helmfile -f base-blueking.yaml.gotmpl -l seq=second sync
20
# 持续观察等 bk-repo-repository pod 全部Ready
21
watch -n 1 kubectl get pod -n blueking -l 'app.kubernetes.io/instance=bk-repo,app.kubernetes.io/component=repository'
22

23
# 重启第三批服务
24
helmfile -f base-blueking.yaml.gotmpl -l seq=third sync
25
 # bk-paas-webfe-web pod 不会重启，主动删除等重建
26
kubectl delete pod -n blueking -l 'app.kubernetes.io/instance=bk-paas,app.kubernetes.io/name=webfe'
27

28
# 重启蓝盾服务
29
helmfile -f 03-bkci.yaml.gotmpl sync
30
# 这里蓝盾系列服务可能不会重启，需要手动删除老pod
31
kubectl get pods -n blueking --field-selector=status.phase=Running| grep 'bk-ci-bk-ci' |awk '{print $1}' | xargs kubectl delete pod -n blueking

1
# 停止agent服务
2
./stop.sh
3

4
BK_DOMAIN="deveops.bk.blazehu.com"
5

6
# 修改.agent.properties文件，开启https
7
sed -i '' 's|http://$BK_DOMAIN|https://$BK_DOMAIN|g' .agent.properties
8
# 修改telegraf.conf文件，开启https
9
sed -i '' 's|http://$BK_DOMAIN|https://$BK_DOMAIN|g' telegraf.conf
10

11
# 启动agent
12
./start.sh
13
# 这里需要注意，仔细查看.agent.properties里devops.agent.user， 这里是哪个用户就用哪个用户启动agent