helm安装与使用介绍

helm与EKS是无缝结合的，按照AWS教程即可

helm 与 Amazon EKS 配合使用教程

了解了下helm客户端和服务端tiller的区别

The Helm Client is a command-line client for end users. The client is responsible for the following domains:

• Local chart development
• Managing repositories
• Interacting with the Tiller server
• Sending charts to be installed
• Asking for information about releases
• Requesting upgrading or uninstalling of existing releases

The Tiller Server is an in-cluster server that interacts with the Helm client, and interfaces with the Kubernetes API server. The server is responsible for the following:

• Listening for incoming requests from the Helm client
• Combining a chart and configuration to build a release
• Installing charts into Kubernetes, and then tracking the subsequent release
• Upgrading and uninstalling charts by interacting with Kubernetes

1 helm的安装

# 参见helm官方社区的教程直接brew安装
$ brew install kubernetes-helm

2 介绍tiller的部署

tiller是helm的服务端，helm客户端指令给到tiller部署EKS上的服务。AWS为了安全考虑建议tiller部署在本地，helm与本地的tiller交互，但缺点是每次helm指令都需要保证tiller服务在线。作为初学者，我直接将tiller部署到EKS上了。

3 给tiller先设定RBAC (Role-based Access Control)

helm init会将tiller服务部署好，同时测试helm repo update也成功了，但是helm ls遇到了如下错误：

$ helm ls
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

原因是kubernetes对部署的服务有api权限控制，说白了就是tiller服务没有权限访问kubernetes的资源，需要赋予tiller一个role且绑定必要的权限，来做一下吧。

In Kubernetes, granting a role to an application-specific service account is a best practice to ensure that your application is operating in the scope that you have specified.

创建一个yaml描述文件，能看到该文件创建了一个ServiceAccount，同时做了一个ClusterRoleBinding。注意其中name、namespace取值要填写正确。

# rbac-config.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

应用该yaml文件

$ kubectl create -f rbac-config.yaml
serviceaccount "tiller" created
clusterrolebinding.rbac.authorization.k8s.io "tiller" created

4 helm init初始化tiller

$ helm init --service-account tiller

表明使用上面的含有权限的账户，然后再运行不会报错了

$ helm ls

上述指令默认将tiller安装到EKS上，同时tiller-namespace默认是kube-system，可以根据实际需求更改为本地部署或使用独立的tiller-namespace

5 使用helm部署nginx

EKS让参考helm官网的安装服务示例，helm上面的是mysql，但是验证mysql还需要client程序，blabla... 可以使用更简单的nginx来玩一下。

$ helm repo add bitnami https://charts.bitnami.com/bitnami
"bitnami" has been added to your repositories

$ helm repo list
NAME    URL
stable  https://kubernetes-charts.storage.googleapis.com
local   http://127.0.0.1:8879/charts
bitnami https://charts.bitnami.com/bitnami

$ helm install --name my-nginx bitnami/nginx
NAME:   my-nginx
LAST DEPLOYED: Thu Aug 29 17:58:29 2019
NAMESPACE: default
STATUS: DEPLOYED
... ...
NOTES:
Get the NGINX URL:

  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
        Watch the status with: 'kubectl get svc --namespace default -w my-nginx'

  export SERVICE_IP=$(kubectl get svc --namespace default my-nginx --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
  echo "NGINX URL: http://$SERVICE_IP/"

最后使用kubectl可以看到部署好的nignx服务，不过dns生效需要5分钟左右的时间，要耐心等一下。

$ kubectl get svc --namespace default -w my-nginx -o wide                                                                                                                      1 ↵
NAME       TYPE           CLUSTER-IP      EXTERNAL-IP                                  PORT(S)        AGE       SELECTOR
my-nginx   LoadBalancer   10.100.171.65   a8d4d4bdbdbdbd.us-west-2.elb.amazonaws.com   80:31464/TCP   48s       app=my-nginx