[容器] Helm的安装和使用

helm安装与使用介绍

helm与EKS是无缝结合的，按照AWS教程即可

helm 与 Amazon EKS 配合使用教程

了解了下helm客户端和服务端tiller的区别

The Helm Client is a command-line client for end users. The client is responsible for the following domains:

Local chart development

Managing repositories

Interacting with the Tiller server

Sending charts to be installed

Asking for information about releases

Requesting upgrading or uninstalling of existing releases

The Tiller Server is an in-cluster server that interacts with the Helm client, and interfaces with the Kubernetes API server. The server is responsible for the following:

Listening for incoming requests from the Helm client

Combining a chart and configuration to build a release

Installing charts into Kubernetes, and then tracking the subsequent release

Upgrading and uninstalling charts by interacting with Kubernetes

1 helm的安装

# 参见helm官方社区的教程直接brew安装
$ brew install kubernetes-helm

2 介绍tiller的部署

tiller是helm的服务端，helm客户端指令给到tiller部署EKS上的服务。AWS为了安全考虑建议tiller部署在本地，helm与本地的tiller交互，但缺点是每次helm指令都需要保证tiller服务在线。作为初学者，我直接将tiller部署到EKS上了。

3 给tiller先设定RBAC (Role-based Access Control)

helm init会将tiller服务部署好，同时测试helm repo update也成功了，但是helm ls遇到了如下错误：

$ helm ls
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

原因是kubernetes对部署的服务有api权限控制，说白了就是tiller服务没有权限访问kubernetes的资源，需要赋予tiller一个role且绑定必要的权限，来做一下吧。

In Kubernetes, granting a role to an application-specific service account is a best practice to ensure that your application is operating in the scope that you have specified.

创建一个yaml描述文件，能看到该文件创建了一个ServiceAccount，同时做了一个ClusterRoleBinding。注意其中name、namespace取值要填写正确。

# rbac-config.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

应用该yaml文件

$ kubectl create -f rbac-config.yaml
serviceaccount "tiller" created
clusterrolebinding.rbac.authorization.k8s.io "tiller" created

4 helm init初始化tiller

$ helm init --service-account tiller

表明使用上面的含有权限的账户，然后再运行不会报错了

$ helm ls

上述指令默认将tiller安装到EKS上，同时tiller-namespace默认是kube-system，可以根据实际需求更改为本地部署或使用独立的tiller-namespace

5 使用helm部署nginx

EKS让参考helm官网的安装服务示例，helm上面的是mysql，但是验证mysql还需要client程序，blabla... 可以使用更简单的nginx来玩一下。

$ helm repo add bitnami https://charts.bitnami.com/bitnami
"bitnami" has been added to your repositories

$ helm repo list
NAME    URL
stable  https://kubernetes-charts.storage.googleapis.com
local   http://127.0.0.1:8879/charts
bitnami https://charts.bitnami.com/bitnami

$ helm install --name my-nginx bitnami/nginx
NAME:   my-nginx
LAST DEPLOYED: Thu Aug 29 17:58:29 2019
NAMESPACE: default
STATUS: DEPLOYED
... ...
NOTES:
Get the NGINX URL:

  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
        Watch the status with: 'kubectl get svc --namespace default -w my-nginx'

  export SERVICE_IP=$(kubectl get svc --namespace default my-nginx --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
  echo "NGINX URL: http://$SERVICE_IP/"

最后使用kubectl可以看到部署好的nignx服务，不过dns生效需要5分钟左右的时间，要耐心等一下。

$ kubectl get svc --namespace default -w my-nginx -o wide                                                                                                                      1 ↵
NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                                  PORT(S)        AGE       SELECTOR
my-nginx   LoadBalancer   10.100.171.65   a8d4d4bdbdbdbd.us-west-2.elb.amazonaws.com   80:31464/TCP   48s       app=my-nginx