K8S实践Ⅹ（Helm）

一、Helm概述

1.Helm简介

helm类似于Linxu系统下的包管理工具，如yum、apt等，主要用于Kubernetes应用程序 Chart的创建、打包、发布以及创建和管理本地和远程的Chart仓库。

2.Helm组件

• helm：本地客户端工具，主要用于kubernetes应用chart的创建/打包/发布以及创建和管理和远程Chart仓库。
• Tiller：helm的服务端，部署于kubernetes内，Tiller接受helm的请求，并根据chart生成kubernetes部署文件（helm称为release），然后提交给 Kubernetes创建应用。Tiller还提供了Release的升级、删除、回滚等一系列功能。
• Chart：helm的软件包，采用tar格式，其中包含运行一个应用所需的所有镜像/依赖/资源定义等，还可能包含kubernetes集群中服务定义，类似于yum的rpm文件
• Release：在kubernetes中集群中运行的一个Chart实例，在同一个集群上，一个Chart可以安装多次，每次安装均会生成一个新的release。
• Repository：用于发布和存储Chart的仓库

二、Helm部署

1.安装Helm

# wget https://get.helm.sh/helm-v2.14.3-linux-amd64.tar.gz# tar -zxvf helm-v2.14.3-linux-amd64.tar.gz# cp linux-amd64/helm /usr/bin/

# helm versionClient: &version.Version{SemVer:"v2.14.3", GitCommit:"0e7f3b6637f7af8fcfddb3d2941fcc7cbebb0085", GitTreeState:"clean"}Error: could not find tiller

2.安装Tiller

• tiller所在的节点需要安装socat

• helm默认使用 "https://kubernetes-charts.storage.googleapis.com" 作为缺省的 stable repository 的地址，由于国内无法访问需要替换为阿里的

# helm init --upgrade -i registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.14.3  --stable-repo-url https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts

# kubectl get pod -n kube-system | grep tillertiller-deploy-6867df9fc6-f575p         1/1     Running   0          3m50s# helm versionClient: &version.Version{SemVer:"v2.14.3", GitCommit:"0e7f3b6637f7af8fcfddb3d2941fcc7cbebb0085", GitTreeState:"clean"}Server: &version.Version{SemVer:"v2.14.3", GitCommit:"0e7f3b6637f7af8fcfddb3d2941fcc7cbebb0085", GitTreeState:"clean"}

3.Tiller配置rbac

Role-based Access Control

# cat tiller-rbac.yaml apiVersion: v1kind: ServiceAccountmetadata:  name: tiller  namespace: kube-system---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: tillerroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: cluster-adminsubjects:  - kind: ServiceAccount    name: tiller    namespace: kube-system

为tiller设置账号

# kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

# kubectl get deploy -n kube-system tiller-deploy -o yaml | grep  serviceAccount      serviceAccount: tiller      serviceAccountName: tiller

4.卸载Tiller

如果需要卸载已部署的Tiller，可使用以下命令完成卸载。
helm reset或helm reset --force

三、helm的使用

1.helm命令补全

# source <(helm completion bash)# echo "source <(helm completion bash)" >> ~/.bashrc

2.添加仓库

# helm repo listNAME    URL                                                   stable  https://mirror.azure.cn/kubernetes/charts             local   http://127.0.0.1:8879/charts# helm repo add aliyun https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts"aliyun" has been added to your repositories# helm repo update Hang tight while we grab the latest from your chart repositories......Skip local chart repository...Successfully got an update from the "aliyun" chart repository...Successfully got an update from the "stable" chart repositoryUpdate Complete.

3.Helm常用命令

helm常用命令：- helm search:      搜索charts- helm fetch:       下载charts到本地目录- helm install:       安装charts- helm list:         列出charts的所有版本命令选项:  completion         为指定的shell生成自动补全脚本（bash或zsh）  create              创建一个新的charts  delete              删除指定版本的release  dependency         管理charts的依赖  fetch               下载charts并解压到本地目录  get                 下载一个release  history             release历史信息  home                显示helm的家目录  init                在客户端和服务端初始化helm  inspect             查看charts的详细信息  install               安装charts  lint                检测包的存在问题  list                 列出release  package            将chart目录进行打包  plugin              增删Helm 插件  repo               增删chart仓库  reset               卸载tiller  rollback            release版本回滚  search             搜索chart  serve              启动一个本地的http server  status              查看release状态信息  template            本地模板  test                release测试  upgrade            release更新  verify              验证chart的签名和有效期  version            打印客户端和服务端的版本信息

4.使用helm安装Monocular

Monocular是一个开源软件，用于管理kubernetes上以Helm Charts形式创建的服务，可以通过它的web页面来安装helm Charts

①安装Nginx Ingress

# cat ingress-values.yamlcontroller:  service:    type: NodePort    targetPorts:      http: 80      https: 443    nodePorts:       http: 32080       https: 32443  hostNetwork: truerbac:  create: true

# helm install --name nginx-ingress aliyun/nginx-ingress -f ingress-values.yaml

# kubectl get pod NAME                                            READY   STATUS    RESTARTS   AGEnginx-ingress-controller-658f4878bf-rvx29       1/1     Running   0          6m54snginx-ingress-default-backend-878d64884-z7qw9   1/1     Running   0          6m54s# kubectl get svc -l app=nginx-ingressNAME                            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGEnginx-ingress-controller        NodePort    10.108.114.19            80:32080/TCP,443:32443/TCP   7m34snginx-ingress-default-backend   ClusterIP   10.102.104.170           80/TCP                       7m34s

②安装Monocular

# helm repo add monocular https://helm.github.io/monocular# helm install monocular/monocular --name monocular

# kubectl get pod | grep monocularmonocular-mongodb-64df9c7fb6-tp55x                       1/1     Running     0          3m24smonocular-monocular-chartsvc-58cf779c5b-422bj            1/1     Running     2          3m23smonocular-monocular-chartsvc-58cf779c5b-8wrvr            1/1     Running     2          3m24smonocular-monocular-chartsvc-58cf779c5b-czppl            1/1     Running     1          3m23smonocular-monocular-prerender-565885d9dd-sql5k           1/1     Running     0          3m24smonocular-monocular-sync-initial-incubator-uuk6q-h7nhv   0/1     Completed   2          3m23smonocular-monocular-sync-initial-stable-4dsb2-qc5pn      1/1     Running     1          3m23smonocular-monocular-ui-6f8bbd67b-n55vb                   1/1     Running     0          3m23smonocular-monocular-ui-6f8bbd67b-xdql4                   1/1     Running     0          3m23s# kubectl get svcNAME                            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGEkubernetes                      ClusterIP   10.96.0.1                443/TCP                      8dmonocular-mongodb               ClusterIP   10.98.190.128            27017/TCP                    4m15smonocular-monocular-chartsvc    ClusterIP   10.108.54.177            8080/TCP                     4m15smonocular-monocular-prerender   NodePort    10.107.66.9              80:31915/TCP                 4m15smonocular-monocular-ui          NodePort    10.101.12.118            80:31939/TCP                 4m15snginx-ingress-controller        NodePort    10.108.114.19            80:32080/TCP,443:32443/TCP   48mnginx-ingress-default-backend   ClusterIP   10.102.104.170           80/TCP                       48m# kubectl get ingressNAME                  HOSTS   ADDRESS   PORTS   AGEmonocular-monocular   *                 80      4m8s

③访问测试

(未解决)访问ingress映射的端口32080时，出现无法访问

5.删除安装的chart

# helm delete --purge monocularrelease "monocular" deleted