helm

func ConfigureClient ¶

func ConfigureClient(
	kubectlOptions *kubectl.KubectlOptions,
	helmHome string,
	tillerNamespace string,
	resourceNamespace string,
	setKubectlNamespace bool,
	rbacEntity RBACEntity,
) error

ConfigureClient will configure the local helm client to be able to communicate with the Tiller server installed in the provided Tiller namespace. Note that this supports the notion where Tiller is deployed in a different namespace from where resources should go. This is to address the risk where access to the tiller-secret will grant admin access by using the tiller server TLS certs.

func Deploy ¶

func Deploy(
	kubectlOptions *kubectl.KubectlOptions,
	tillerNamespace string,
	resourceNamespace string,
	serviceAccount string,
	tlsOptions tls.TLSOptions,
	clientTLSOptions tls.TLSOptions,
	helmHome string,
	localClientRBACEntity RBACEntity,
	imageSpec string,
) error

Deploy will deploy a new Tiller to the Kubernetes cluster configured with KubectlOptions following best practices. Specifically, this will:

• Require a Namespace and ServiceAccount, so that you will have to explicitly and consciously deploy a super user Tiller to get that.
• Generate a new set of TLS certs.
• Store the TLS certs into a Kubernetes Secret into a Namespace that only cluster admins have access to.
• Deploy Tiller using the generated TLS certs, Namespace, and ServiceAccount. Additionally, set the flags so that the release info is stored in a Secret as opposed to ConfigMap.

Additionally, if an RBAC entity is passed in, grant access to it and configure the local client at the specified helm home directory.

func GetDefaultHelmHome ¶ added in v0.2.0

func GetDefaultHelmHome() (string, error)

GetDefaultHelmHome returns the default helm home directory, ~/.helm

func GrantAccess ¶

func GrantAccess(
	kubectlOptions *kubectl.KubectlOptions,
	tlsOptions tls.TLSOptions,
	tillerNamespace string,
	rbacGroups []string,
	rbacUsers []string,
	serviceAccounts []string,
) error

GrantAccess grants the provided RBAC groups and/or service accounts access to the Tiller Pod available in the provided Tiller namespace. Specifically, this will:

• Download the corresponding CA keypair for the Tiller deployment from Kubernetes. Assumes the CA cert is in the kube-system namespace.
• Issue a new TLS certificate keypair using the CA keypair.
• Upload the new TLS certificate keypair to a new Secret in the Tiller namespace.
• Create a new RBAC role that grants read only pod access to the Tiller namespace, and read only access to the Secret containing the TLS certificate keypair.
• Remove the local copies of the downloaded and generated certificates.

func InstallTiller ¶ added in v0.3.1

func InstallTiller(
	kubectlOptions *kubectl.KubectlOptions,
	caKeyPairPath tls.CertificateKeyPairPath,
	tillerKeyPairPath tls.CertificateKeyPairPath,
	tillerNamespace string,
	serviceAccountName string,
	imageSpec string,
) (string, error)

InstallTiller will install Tiller onto the Kubernetes cluster. Returns the Tiller image being installed.

func NewHelmClient ¶ added in v0.3.1

func NewHelmClient(
	tillerHost string,
	connectionTimeout int64,
	helmHome string,
) (helm.Interface, error)

NewHelmClient constructs a new helm client that can be used to interact with Tiller.

func RevokeAccess ¶ added in v0.4.0

func RevokeAccess(
	kubectlOptions *kubectl.KubectlOptions,
	tillerNamespace string,
	rbacGroups []string,
	rbacUsers []string,
	serviceAccounts []string,
) error

RevokeAccess revokes access to a Tiller pod from a provided RBAC user, group, or serviceaccount in a provided Tiller namespace by deleting the secret, role, and rolebindings associated with said entities. Note that due to limitations in the Go TLS library used by helm, helm/tiller does not support checking certificate revocation lists. As a consequence, the signed TLS certificate will continue to be trusted by Tiller after running "kubergrunt helm revoke" since it was signed by the Tiller CA. However, the user's authorizations are removed by way of deleting the role and role binding and access is effectively removed. See https://github.com/helm/helm/issues/4273

func RunHelm ¶

func RunHelm(options *kubectl.KubectlOptions, args ...string) error

RunHelm will make a call to helm, setting the config and context to the ones specified in the provided options.

func RunHelmAndGetOutput ¶

func RunHelmAndGetOutput(options *kubectl.KubectlOptions, args ...string) (string, error)

RunHelmAndGetOutput will make a call to helm, setting the config and context to the ones specified in the provided options, and return the output of the command.

func SetupConnection ¶ added in v0.3.1

func SetupConnection(kubeClient *kubernetes.Clientset, kubectlOptions *kubectl.KubectlOptions, tillerNamespace string) (*helmkube.Tunnel, error)

SetupConnection will setup a tunnel to a deployed Tiller instance.

func Undeploy ¶

func Undeploy(
	kubectlOptions *kubectl.KubectlOptions,
	namespace string,
	helmHome string,
	force bool,
	undeployReleases bool,
) error

Undeploy will undeploy (uninstall) the helm server and related Secrets from the Kubernetes cluster.

func VerifyTiller ¶ added in v0.3.1

func VerifyTiller(
	kubectlOptions *kubectl.KubectlOptions,
	tillerNamespace string,
	helmHome string,
) error

VerifyTiller pings the Tiller host with the helm client configured using the settings in the provided helmHome to verify it is up.

func WaitForTiller ¶ added in v0.3.1

func WaitForTiller(
	kubectlOptions *kubectl.KubectlOptions,
	newImage string,
	tillerNamespace string,
	tillerDeploymentName string,
	timeout time.Duration,
	sleepBetweenRetries time.Duration,
) error

WaitForTiller will poll Kubernetes until Tiller is available, and then verify the Tiller instance is up. This is ported from the helm client: https://github.com/helm/helm/blob/master/cmd/helm/init.go#L322