helm安裝與使用介紹
helm與EKS是無縫結(jié)合的赌蔑，按照AWS教程即可
了解了下helm客戶端和服務(wù)端tiller的區(qū)別
The Helm Client is a command-line client for end users. The client is responsible for the following domains:
- Local chart development
- Managing repositories
- Interacting with the Tiller server
- Sending charts to be installed
- Asking for information about releases
- Requesting upgrading or uninstalling of existing releases
The Tiller Server is an in-cluster server that interacts with the Helm client, and interfaces with the Kubernetes API server. The server is responsible for the following:
- Listening for incoming requests from the Helm client
- Combining a chart and configuration to build a release
- Installing charts into Kubernetes, and then tracking the subsequent release
- Upgrading and uninstalling charts by interacting with Kubernetes
1 helm的安裝
# 參見helm官方社區(qū)的教程直接brew安裝
$ brew install kubernetes-helm
2 介紹tiller的部署
tiller是helm的服務(wù)端滞伟，helm客戶端指令給到tiller部署EKS上的服務(wù)。AWS為了安全考慮建議tiller部署在本地掀泳，helm與本地的tiller交互土浸，但缺點(diǎn)是每次helm指令都需要保證tiller服務(wù)在線。作為初學(xué)者啤它，我直接將tiller部署到EKS上了。
3 給tiller先設(shè)定RBAC (Role-based Access Control)
helm init會將tiller服務(wù)部署好，同時(shí)測試helm repo update也成功了变骡，但是helm ls遇到了如下錯(cuò)誤：
$ helm ls
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"
原因是kubernetes對部署的服務(wù)有api權(quán)限控制离赫，說白了就是tiller服務(wù)沒有權(quán)限訪問kubernetes的資源，需要賦予tiller一個(gè)role且綁定必要的權(quán)限塌碌，來做一下吧渊胸。
In Kubernetes, granting a role to an application-specific service account is a best practice to ensure that your application is operating in the scope that you have specified.
創(chuàng)建一個(gè)yaml描述文件，能看到該文件創(chuàng)建了一個(gè)ServiceAccount台妆，同時(shí)做了一個(gè)ClusterRoleBinding蹬刷。注意其中name、namespace取值要填寫正確频丘。
# rbac-config.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: tiller
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tiller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: tiller
namespace: kube-system
應(yīng)用該yaml文件
$ kubectl create -f rbac-config.yaml
serviceaccount "tiller" created
clusterrolebinding.rbac.authorization.k8s.io "tiller" created
4 helm init初始化tiller
$ helm init --service-account tiller
表明使用上面的含有權(quán)限的賬戶办成，然后再運(yùn)行不會報(bào)錯(cuò)了
$ helm ls
上述指令默認(rèn)將tiller安裝到EKS上，同時(shí)tiller-namespace默認(rèn)是kube-system搂漠，可以根據(jù)實(shí)際需求更改為本地部署或使用獨(dú)立的tiller-namespace
5 使用helm部署nginx
EKS讓參考helm官網(wǎng)的安裝服務(wù)示例迂卢，helm上面的是mysql，但是驗(yàn)證mysql還需要client程序桐汤，blabla... 可以使用更簡單的nginx來玩一下而克。
$ helm repo add bitnami https://charts.bitnami.com/bitnami
"bitnami" has been added to your repositories
$ helm repo list
NAME URL
stable https://kubernetes-charts.storage.googleapis.com
local http://127.0.0.1:8879/charts
bitnami https://charts.bitnami.com/bitnami
$ helm install --name my-nginx bitnami/nginx
NAME: my-nginx
LAST DEPLOYED: Thu Aug 29 17:58:29 2019
NAMESPACE: default
STATUS: DEPLOYED
... ...
NOTES:
Get the NGINX URL:
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
Watch the status with: 'kubectl get svc --namespace default -w my-nginx'
export SERVICE_IP=$(kubectl get svc --namespace default my-nginx --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
echo "NGINX URL: http://$SERVICE_IP/"
最后使用kubectl可以看到部署好的nignx服務(wù)，不過dns生效需要5分鐘左右的時(shí)間怔毛，要耐心等一下员萍。
$ kubectl get svc --namespace default -w my-nginx -o wide 1 ?
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
my-nginx LoadBalancer 10.100.171.65 a8d4d4bdbdbdbd.us-west-2.elb.amazonaws.com 80:31464/TCP 48s app=my-nginx
