参考:

  • Make a Kubernetes Operator in 15 minutes with Helm
  • Deploy Monocular on OpenShift
  • Helm中文指南;
  • 使用Helm管理kubernetes应用;
  • https://helm.sh/docs/using_he...

参考官方文档https://docs.helm.sh/using_he...Openshift环境安装Helm Tiller时其指向Bloghttps://blog.openshift.com/ge...

Helm works straightforward on OpenShift Online, OpenShift Dedicated, OpenShift Container Platform (version >= 3.6) or OpenShift Origin (version >= 3.6). To learn more read this blog post.

安装helm客户端,版本参考https://github.com/helm/helm/...。如下所示,在m01主机安装当前最新文档版v2.12.3

cd /tmpcurl -s https://storage.googleapis.com/kubernetes-helm/helm-v2.12.3-linux-amd64.tar.gz \     | tar xzsudo mv linux-amd64/helm /usr/local/binsudo chmod a+x /usr/local/bin/helm

可选。默认stable仓库为https://kubernetes-charts.sto...,但此网被墙导致无法连接,可删掉并添加其他第三方仓库,如:

helm repo remove stable# 将阿里云仓库设置为stable仓库:helm init --client-only --stable-repo-url \                          https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts                          # 或为仓库设置不同的名称:helm repo add ali-stable https://kubernetes.oss-cn-hangzhou.aliyuncs.com/chartshelm repo add ali-incubator \              https://aliacs-app-catalog.oss-cn-hangzhou.aliyuncs.com/charts-incubatorhelm repo add bitnami https://charts.bitnami.com/bitnamihelm repo list

安装tiller

  1. 创建项目:

    oc new-project helm-tilleroc project helm-tillerexport TILLER_NAMESPACE=helm-tiller
  2. 默认镜像为gcr.io/kubernetes-helm/tiller,因网络原因,换成registry.cn-hangzhou.aliyuncs.com/google_containers/tiller

    export TILLER_NAMESPACE=helm-tilleroc process -f https://github.com/openshift/origin/raw/master/examples/helm/tiller-template.yaml \  -p TILLER_NAMESPACE="${TILLER_NAMESPACE}" -p HELM_VERSION=v2.12.3 | \  perl -i -ne 's#gcr.io/kubernetes-helm#registry.cn-hangzhou.aliyuncs.com/google_containers#g;print'  | \  oc create -f -
  3. 测试:

    % helm versionClient: &version.Version{SemVer:"v2.12.3", GitCommit:"eecf22f77df5f65c823aacd2dbd30ae6c65f186e", GitTreeState:"clean"}Server: &version.Version{SemVer:"v2.12.3", GitCommit:"eecf22f77df5f65c823aacd2dbd30ae6c65f186e", GitTreeState:"clean"}% helm list

注意helm init --dry-run -o yaml仅输出yaml文件而不会实际执行,观察可发现以上使用template创建tillerhelm init创建tiller的区别有:

  • helm init没有为tiller配置SARBAC权限绑定,且默认创建在kube-system名称空间中(--tiller-namespace kube-system);
  • helm inittiller创建了service,但template未创建,后续我们需要额外创建,此Servicekubeapps中被使用;

赋权:

# 仅赋予在本项目内的edit权限:% oc policy add-role-to-user edit "system:serviceaccount:${TILLER_NAMESPACE}:tiller"role "edit" added: "system:serviceaccount:helm-tiller:tiller"# 为使helm可管理整个集群,即在其他project项目也有权限,赋予:oc adm policy add-cluster-role-to-user cluster-admin \       system:serviceaccount:${TILLER_NAMESPACE}:tiller

若是K8S原生集群,则使用如下命令创建SA并赋权:

kubectl -n helm-tiller create sa tillerkubectl create clusterrolebinding tiller --clusterrole cluster-admin \                                         --serviceaccount=helm-tiller:tiller

为便于执行helm,将TILLER_NAMESPACE添加到环境变量中:

echo export TILLER_NAMESPACE=helm-tiller >> .bash_profile

创建service,此servicekubeapps程序所使用。

oc create -f - <<EOFapiVersion: v1kind: Servicemetadata:  creationTimestamp: null  labels:    app: helm    name: tiller  name: tiller-deploy  namespace: helm-tillerspec:  ports:  - name: tiller    port: 44134    targetPort: tiller  selector:    app: helm    name: tiller  type: ClusterIPstatus:  loadBalancer: {}EOF