Klaster OKD 4.19 (OpenShift) – Jenkins serwer automatyzacji CI/CD (Continuous Integration / Continuous Delivery & Deployment)

# aktualizacja i podstawy
sudo apt update && sudo apt -y upgrade
sudo apt -y install curl ca-certificates gnupg fontconfig

# Java 21 (wymagana), Jenkins wymaga Java 21 lub nowszej.
sudo apt -y install openjdk-21-jre
java -version

# dodanie repozytorium Jenkins (LTS) i instalacja
sudo mkdir -p /etc/apt/keyrings

sudo wget -O /etc/apt/keyrings/jenkins-keyring.asc \
  https://pkg.jenkins.io/debian-stable/jenkins.io-2026.key

echo "deb [signed-by=/etc/apt/keyrings/jenkins-keyring.asc] \
  https://pkg.jenkins.io/debian-stable binary/" | \
  sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null

sudo apt update
sudo apt -y install jenkins

# uruchom i sprawdź status
sudo systemctl enable --now jenkins
sudo systemctl status jenkins --no-pager

# firewall (jeśli masz)
sudo ufw allow 8080/tcp
sudo ufw reload

# pierwszy login (hasło startowe)
sudo cat /var/lib/jenkins/secrets/initialAdminPassword
http://jenkins.okdlab.local:808

sudo mkdir -p /etc/ssl/okdlab/ca
sudo chmod 700 /etc/ssl/okdlab/ca
cd /etc/ssl/okdlab/ca

# Root CA key
sudo openssl genrsa -out okdlab-root-ca.key 4096
sudo chmod 600 okdlab-root-ca.key

# Root CA cert (CA:TRUE)
sudo openssl req -x509 -new -sha256 -days 3650 \
  -key okdlab-root-ca.key \
  -out okdlab-root-ca.crt \
  -subj "/C=PL/ST=OKDLab/L=OKDLab/O=OKDLab/OU=DevOps/CN=OKDLab Root CA"

sudo chmod 644 okdlab-root-ca.crt
openssl x509 -in /etc/ssl/okdlab/ca/okdlab-root-ca.crt -noout -text | egrep -i "CA:TRUE|Subject:|Issuer:"

sudo mkdir -p /etc/ssl/okdlab
sudo chmod 700 /etc/ssl/okdlab
cd /etc/ssl/okdlab

# key dla jenkins
sudo openssl genrsa -out jenkins.key 4096
sudo chmod 600 jenkins.key

sudo tee jenkins-csr.cnf >/dev/null <<'EOF'
[ req ]
prompt             = no
default_md         = sha256
distinguished_name = dn
req_extensions     = v3_req

[ dn ]
C  = PL
ST = OKDLab
L  = OKDLab
O  = OKDLab
OU = DevOps
CN = jenkins.okdlab.local

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = jenkins.okdlab.local
IP.1  = 192.168.40.37
EOF

# CSR:
sudo openssl req -new -key jenkins.key -out jenkins.csr -config jenkins-csr.cnf

# Extfile do podpisu (żeby SAN weszło do certu):
sudo tee jenkins-cert.ext >/dev/null <<'EOF'
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:jenkins.okdlab.local,IP:192.168.40.37
EOF

# Podpis CA:
sudo openssl x509 -req -in jenkins.csr \
  -CA /etc/ssl/okdlab/ca/okdlab-root-ca.crt \
  -CAkey /etc/ssl/okdlab/ca/okdlab-root-ca.key \
  -CAcreateserial \
  -out jenkins.crt \
  -days 825 -sha256 \
  -extfile jenkins-cert.ext

sudo chmod 644 jenkins.crt

# Weryfikacja:
openssl verify -CAfile /etc/ssl/okdlab/ca/okdlab-root-ca.crt /etc/ssl/okdlab/jenkins.crt
openssl x509 -in /etc/ssl/okdlab/jenkins.crt -noout -issuer -subject

# Na bastionie:
scp root@jenkins:/etc/ssl/okdlab/ca/okdlab-root-ca.crt /tmp/okdlab-root-ca.crt
sudo cp /tmp/okdlab-root-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

echo | openssl s_client -connect jenkins.okdlab.local:443 -servername jenkins.okdlab.local 2>/dev/null \
| openssl x509 -noout -subject -issuer -fingerprint -sha256 -dates

# Sprawdź jaki cert faktycznie serwuje Jenkins (z bastiona)
subject=C=PL, ST=OKDLab, L=OKDLab, O=OKDLab, OU=DevOps, CN=jenkins.okdlab.local
issuer=C=PL, ST=OKDLab, L=OKDLab, O=OKDLab, OU=DevOps, CN=jenkins.okdlab.local
sha256 Fingerprint=6B:AA:7A:B5:08:EE:67:29:F8:E8:5E:2E:10:11:41:20:85:35:71:98:8E:F6:CE:D5:B0:8F:E9:B5:45:02:5A:87
notBefore=Feb 20 17:38:31 2026 GMT
notAfter=May 25 17:38:31 2028 GMT

# Sprawdź fingerprint certu, który masz w trust store (bastion)
openssl x509 -in /etc/pki/ca-trust/source/anchors/jenkins.okdlab.local.crt -noout -fingerprint -sha256

sudo systemctl edit jenkins
# wklei to co poniżej

[Service]
Environment="JENKINS_LISTEN_ADDRESS=127.0.0.1"
Environment="JENKINS_PORT=8080"

sudo apt -y install nginx

nano /etc/nginx/sites-available/jenkins

server {
  listen 443 ssl;
  server_name jenkins.okdlab.local;

  ssl_certificate     /etc/ssl/okdlab/jenkins.crt;
  ssl_certificate_key /etc/ssl/okdlab/jenkins.key;

  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
  }
}

sudo ln -s /etc/nginx/sites-available/jenkins /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx