Helm

#Current shell

source <(helm completion bash)

#Basic

helm init --service-account tiller

helm init --upgrade

helm reset

helm delete --purge

helm search | helm search [mariadb]

helm list [--all]

helm inspect stable/mariadb

cat << EOF > config.yaml

mariadbUser: user0

mariadbDatabase: user0db

EOF

helm install -f config.yml stable/mariadb [--name my-db]

helm status [my-db]

helm upgrade -f config.yaml my-db stable/mariadb

helm get values my-db

helm history my-db

helm rollback my-db 1

helm delete my-db

#Repo

helm repo list

helm repo add dev https://example.com/dev-charts

helm repo add incubator https://kubernetes-charts-incubator.storage.googleapis.com/

helm repo update

#Charts

helm create my-chart

helm lint

helm package my-chart

helm install ./my-chart-0.1.0.tgz

helm serve --repo-path ./charts

#Plugins

helm plugin install https://github.com/technosophos/helm-template

helm plugin install http://domain/path/to/plugin.tar.gz

helm plugin install https://github.com/rimusz/helm-tiller

#Tillerless

helm tiller start [my-team-namespace] (starts new shell)

helm tiller stop (exit shell first)

CI/CD

helm tiller start-ci [my-team-namespace]

export HELM_HOST=localhost:44134

helm tiller stop

#RBAC

Service account with cluster-admin role

cat << EOF > rbac-config.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: tiller

  namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: tiller

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: cluster-admin

subjects:

  - kind: ServiceAccount

    name: tiller

    namespace: kube-system

EOF

kubectl create -f rbac-config.yaml

Deploy Tiller in a namespace, restricted to deploying resources only in that namespace

kubectl create namespace tiller-world

kubectl create serviceaccount tiller --namespace tiller-world

cat << EOF > role-tiller.yaml

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: tiller-manager

  namespace: tiller-world

rules:

- apiGroups: ["", "batch", "extensions", "apps"]

  resources: ["*"]

  verbs: ["*"]

EOF

kubectl create -f role-tiller.yaml

cat << EOF > rolebinding-tiller.yaml

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: tiller-binding

  namespace: tiller-world

subjects:

- kind: ServiceAccount

  name: tiller

  namespace: tiller-world

roleRef:

  kind: Role

  name: tiller-manager

  apiGroup: rbac.authorization.k8s.io

EOF

kubectl create -f rolebinding-tiller.yaml

helm init --service-account tiller --tiller-namespace tiller-world

helm install nginx --tiller-namespace tiller-world --namespace tiller-world

Deploy Tiller in a namespace, restricted to deploying resources in another namespace

kubectl create namespace myorg-system

kubectl create serviceaccount tiller --namespace myorg-system

cat << EOF > role-tiller.yaml

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: tiller-manager

  namespace: myorg-users

rules:

- apiGroups: ["", "batch", "extensions", "apps"]

  resources: ["*"]

  verbs: ["*"]

EOF

kubectl create -f role-tiller.yaml

cat << EOF > rolebinding-tiller.yaml

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: tiller-binding

  namespace: myorg-users

subjects:

- kind: ServiceAccount

  name: tiller

  namespace: myorg-system

roleRef:

  kind: Role

  name: tiller-manager

  apiGroup: rbac.authorization.k8s.io

EOF

kubectl create -f rolebinding-tiller.yaml

cat << EOF > role-tiller-myorg-system.yaml

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  namespace: myorg-system

  name: tiller-manager

rules:

- apiGroups: ["", "extensions", "apps"]

  resources: ["configmaps"]

  verbs: ["*"]

EOF

kubectl create -f role-tiller-myorg-system.yaml

cat << EOF > rolebinding-tiller-myorg-system.yaml

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: tiller-binding

  namespace: myorg-system

subjects:

- kind: ServiceAccount

  name: tiller

  namespace: myorg-system

roleRef:

  kind: Role

  name: tiller-manager

  apiGroup: rbac.authorization.k8s.io

EOF

kubectl create -f rolebinding-tiller-myorg-system.yaml

Deploy Helm in a namespace, talking to Tiller in another namespace

cat << EOF > helm-user.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: helm

  namespace: helm-world

---

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

  name: tiller-user

  namespace: tiller-world

rules:

- apiGroups:

  - ""

  resources:

  - pods/portforward

  verbs:

  - create

- apiGroups:

  - ""

  resources:

  - pods

  verbs:

  - list

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

  name: tiller-user-binding

  namespace: tiller-world

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: Role

  name: tiller-user

subjects:

- kind: ServiceAccount

  name: helm

  namespace: helm-world

EOF

kubectl create -f helm-user.yaml

#References

https://helm.sh/docs/using_helm/#using-helm

Page updated

Google Sites

Report abuse