當在 Kubernetes 中已經部署很多應用時，後續需要對每個應用的 yaml 檔案進行維護操作，這個過程會變的很繁瑣，我們可以使用 Helm 來簡化這些工作。Helm 是 Kubernetes 的一個包管理工具，用來簡化 Kubernetes 應用的部署和管理。

部署 Helm 客戶端與服務端

部署客戶端

在 GitHub上 Helm Realese 下載最新的二進位制檔案

$ tar -zxvf helm-v2.11.0-linux-amd64.tar.gz
$ mv linux-amd64/helm /usr/local/bin/helm
$ helm help

部署服務端（tiller ）

$ helm init --upgrade --tiller-image sapcc/tiller:v2.11.0
Creating /root/.helm 
Creating /root/.helm/repository 
Creating /root/.helm/repository/cache 
Creating /root/.helm/repository/local 
Creating /root/.helm/plugins 
Creating /root/.helm/starters 
Creating /root/.helm/cache/archive 
Creating /root/.helm/repository/repositories.yaml 
Adding stable repo with URL: https:
 
//kubernetes-charts.storage.googleapis.com 
Adding local repo with URL: http://127.0.0.1:8879/charts 
$HELM_HOME has been configured at /root/.helm.

Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.

Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users
 
' policy.
To prevent this, run `helm init` with the --tiller-tls-verify flag.
For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation
Happy Helming!

檢視

$ kubectl get pod -n kube-system -l app=helm
NAME                             READY   STATUS    RESTARTS   AGE
tiller-deploy-69c9dc58bd-jvzkr   1/1     Running   0          3m2s
$ helm version
Client: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}

配置 RBAC

$ vi rbac-config.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

$ kubectl create -f rbac-config.yaml
serviceaccount/tiller created
clusterrolebinding.rbac.authorization.k8s.io/tiller created
$ kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
deployment.extensions/tiller-deploy patched

備註：上述我們為 Tiller 管理員提供了對整個群集的訪問許可權，如果不需要授予 Tiller 叢集管理員訪問許可權，可以指定 Role 和 RoleBinding 來將 Tiller 的範圍限制為特定的 namespace 中，官方文件是新建一個 namespace 做的(https://docs.helm.sh/using_helm/#role-based-access-control) 。

部署一個程式

建立一個配置檔案

$ helm create helm-test
Creating helm-test

$  tree.
├── helm-test
│   ├── charts
│   ├── Chart.yaml
│   ├── templates
│   │   ├── deployment.yaml
│   │   ├── _helpers.tpl
│   │   ├── ingress.yaml
│   │   ├── NOTES.txt
│   │   └── service.yaml
│   └── values.yaml

檔案說明：

• charts 目錄中檔案是本 chart 依賴的 chart，當前是空的 。
• Chart.yaml 這個 yaml 檔案用於描述 Chart 的基本資訊，如名稱，版本等。
• templates 是 Kubernetes manifest 檔案模板目錄，模板使用 chart 配置的值生成 Kubernetes manifest 檔案，還包含部署 Pod 依賴的 deploymnet，ingress，service 物件。
• templates/NOTES.txt 純文字檔案，可在其中填寫 chart 的使用說明。
• value.yaml 是 chart 配置的預設值。

檢視 value.yaml （可以知道部署的是一個 Nginx 服務） 

# cat values.yaml 
# Default values for helm-test.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

image:
  repository: nginx
  tag: stable
  pullPolicy: IfNotPresent

nameOverride: ""
fullnameOverride: ""

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - chart-example.local
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

部署應用

$ helm install ./helm-test
NAME:   famous-bison
LAST DEPLOYED: Fri Nov  2 19:50:16 2018
NAMESPACE: default
STATUS: DEPLOYED

RESOURCES:
==> v1/Service
NAME                    AGE
famous-bison-helm-test  0s

==> v1beta2/Deployment
famous-bison-helm-test  0s

==> v1/Pod(related)

NAME                                     READY  STATUS             RESTARTS  AGE
famous-bison-helm-test-8568b9cb46-969pn  0/1    ContainerCreating  0         0s


NOTES:
1. Get the application URL by running these commands:
  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=helm-test,app.kubernetes.io/instance=famous-bison" -o jsonpath="{.items[0].metadata.name}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl port-forward $POD_NAME 8080:80

檢視

$ kubectl get pods  --all-namespaces
NAMESPACE     NAME                                        READY   STATUS    RESTARTS   AGE
default       musty-shark-helm-test-578886d7b9-sdppq      1/1     Running   0          82s
$ kubectl get  services  --all-namespaces    
NAMESPACE     NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)           AGE
default       kubernetes                ClusterIP   10.96.0.1        <none>        443/TCP           3d3h
default       musty-shark-helm-test     ClusterIP   10.102.19.244    <none>        80/TCP            2m29s

Helm 命令

$ helm list
NAME            REVISION        UPDATED                         STATUS          CHART           APP VERSION     NAMESPACE
famous-bison    1               Fri Nov  2 19:50:16 2018        DEPLOYED        helm-test-0.1.0 1.0             default  
$ helm list
NAME            REVISION        UPDATED                         STATUS          CHART           APP VERSION     NAMESPACE
famous-bison    1               Fri Nov  2 19:50:16 2018        DEPLOYED        helm-test-0.1.0 1.0             default  
$ helm package helm-test
Successfully packaged chart and saved it to: /opt/helm/helm-test-0.1.0.tgz
$ helm delete famous-bison
release "famous-bison" deleted

Helm 倉庫

Helm 也包含 Repo 倉庫的功能與 Docker Registry 比較類似

$ helm repo list
NAME    URL                                             
stable  https://kubernetes-charts.storage.googleapis.com
local   http://127.0.0.1:8879/charts

不過這個映象同樣是被 Ban ，我們也可以自己搭建自己的倉庫用於自定義的包版本管理。通過 helm search 命令可以找到我們想要的 chart 包，然後通過 helm install 命令來安裝。

$ helm search redis
NAME                                    CHART VERSION   APP VERSION     DESCRIPTION                                                 
stable/prometheus-redis-exporter        0.3.2           0.21.1          Prometheus exporter for Redis metrics                       
stable/redis                            4.2.6           4.0.11          Open source, advanced key-value store. It is often referr...
stable/redis-ha                         3.0.0           4.0.11          Highly available Kubernetes implementation of Redis         
stable/sensu                            0.2.3           0.28            Sensu monitoring framework backed by the Redis transport

安裝

$ helm install stable/redis

備註：

官方應用同步源