Kubernetes-17：Kubernets包管理工具—>Helm介绍与使用

Kubernets包管理工具—>Helm

什么是Helm？

我们都知道，Linux系统各发行版都有自己的包管理工具，比如Centos的YUM，再如Ubuntu的APT。

Kubernetes也有自己的集群包管理工具，那就是Helm。

Helm本质就是让K8S的应用管理（Deployment,Service等）可配置，能动态生成。通过动态生成K8S资源清单文件（deployment.yaml,service.yaml），然后调用kubectl自动执行K8S部署。

Helm有两个重要的概念，chart 和 release

chart 是创建一个应用的信息集合，包括各种Kubernetes对象的配置模板、参数定义、依赖关系和文档说明等，chart是应用部署的自包含逻辑单元。可以将 chart 想象成apt、yum中的软件安装包。
release 是chart的运行实例，代表了一个正在运行的应用，当chart被安装到kubernetes集群，就生成一个release，chart能够多次安装到同一个集群，每次安装都是一个release。

Helm包含两个组件，Helm 客户端和 Tiller 服务器

Helm客户端负责chart和release的创建和管理，以及和Tiller的交互。
Tiller服务运行在 Kubernetes 集群中，它会处理Helm客户端的请求，与 Kubernetes API Server 交互

Helm 部署

越来越多的公司开始使用Helm这个Kubernetes包管理工具，Helm的安装也十分简单，下载 helm 命令行工具到Master节点即可，以下示例安装为 Helm v2.16.10 版本，包下载地址： https://github.com/helm/helm/releases

[root@Centos8 heml]# wget https://get.helm.sh/helm-v2.16.10-linux-amd64.tar.gz

[root@Centos8 heml]# tar zxvf helm-v2.16.10-linux-amd64.tar.gz -C /usr/local/

[root@Centos8 heml]# cd /usr/local/linux-amd64/

[root@Centos8 linux-amd64]# ln -s `pwd`/helm /usr/local/bin/

以上Helm命令安装完成，官方文档： https://helm.sh/docs/intro/install/#helm

为了安装tiller，还需要在这台机器上配置好kubectl工具和kubeconfig文件，确保kubectl工具可以在这台机器访问apiserver且正常使用。

因为Kubernetes ApiServer开启了RBAC访问控制，所以需要创建tiller使用的 service account:tiller并分配合适的角色给它。这里简单起见直接分配cluster-admin这个集群内置的CluserRole给它。创建rbac-config.yaml文件：

vim rbac-config.yaml

apiVersion: v1

kind: ServiceAccount

metadata:

  name: tiller

  namespace: kube-system

---

apiVersion: rbac.authorization.k8s.io/v1

kind: ClusterRoleBinding

metadata:

  name: tiller

subjects:

- kind: ServiceAccount

  name: tiller

  namespace: kube-system

roleRef:

  kind: ClusterRole

  name: cluster-admin

  apiGroup: rbac.authorization.k8s.io

[root@Centos8 rbac]# kubectl create -f rbac-config.yaml

serviceaccount/tiller created

clusterrolebinding.rbac.authorization.k8s.io/tiller created

在K8S集群中初始化helm

[root@Centos8 rbac]# helm init --service-account tiller --skip-refresh

Creating /root/.helm

Creating /root/.helm/repository

Creating /root/.helm/repository/cache

Creating /root/.helm/repository/local

Creating /root/.helm/plugins

Creating /root/.helm/starters

Creating /root/.helm/cache/archive

Creating /root/.helm/repository/repositories.yaml

Adding stable repo with URL: https://kubernetes-charts.storage.googleapis.com

Adding local repo with URL: http://127.0.0.1:8879/charts

$HELM_HOME has been configured at /root/.helm.

Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.

Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy.

To prevent this, run `helm init` with the --tiller-tls-verify flag.

For more information on securing your installation see: https://v2.helm.sh/docs/securing_installation/

[root@Centos8 rbac]# kubectl get pod -n kube-system

NAME                              READY   STATUS              RESTARTS   AGE

tiller-deploy-8487d94bcf-nfc74    0/1     ContainerCreating   0          98s

[root@Centos8 ~]# kubectl describe pod tiller-deploy-8487d94bcf-nfc74 -n kube-system

    Back-off pulling image "gcr.io/kubernetes-helm/tiller:v2.16.10"

会发现tiller的Pod Running不起来，是因为导入镜像失败，因为网络的原因访问gcr.io访问不到，于是到docker hub中查询此image，发现确实有相同的image，pull过来改个名即可。

[root@Centos8 ~]# docker pull jessestuart/tiller:v2.16.10

Status: Downloaded newer image for jessestuart/tiller:v2.16.10

docker.io/jessestuart/tiller:v2.16.10

docker tag jessestuart/tiller:v2.16.10 gcr.io/kubernetes-helm/tiller:v2.16.10

然后传输到每一个node节点上：

[root@Centos8 ~]# docker save gcr.io/kubernetes-helm/tiller -o /usr/local/install-k8s/heml/tiller.tgz

[root@Centos8 ~]# scp /usr/local/install-k8s/heml/tiller.tgz 192.168.152.253:/usr/local/install-k8s/

node节点接收到后，再导入成image即可：

[root@TestCentos7 install-k8s]# docker load < tiller.tgz

Loaded image: gcr.io/kubernetes-helm/tiller:v2.16.10

再次查看tiller Pod的状态，已经变为Running：

[root@Centos8 ~]# kubectl get pod -n kube-system

tiller-deploy-8487d94bcf-nfc74    1/1     Running   0     1h

Helm的使用

Helm的使用与yum、apt等工具如出一辙，可以事先去helm hub中寻找想要安装的工具或应用：https://hub.helm.sh/，其页面会有具体的安装方法及步骤。

以安装redis为例：https://hub.helm.sh/charts/choerodon/redis

1、先添加redis的repo源

helm repo add choerodon https://openchart.choerodon.com.cn/choerodon/c7n

"choerodon" has been added to your repositories

2、更新一下helm repo

[root@Centos8 ~]# helm repo update

Hang tight while we grab the latest from your chart repositories...

...Skip local chart repository

...Successfully got an update from the "choerodon" chart repository

...Successfully got an update from the "stable" chart repository

Update Complete.

3、开始安装

[root@Centos8 ~]# helm install choerodon/redis --version 0.2.5

NAME:   exhaling-yak

LAST DEPLOYED: Sun Sep  6 22:57:51 2020

NAMESPACE: default

STATUS: DEPLOYED

RESOURCES:

==> v1/ConfigMap

NAME             DATA  AGE

exhaling-yak-cm  1     0s

==> v1/Deployment

NAME          READY  UP-TO-DATE  AVAILABLE  AGE

exhaling-yak  0/1    0           0          0s

==> v1/Pod(related)

4、可以看到，在default名称空间生成了ConfigMap、Deployment和Pod

[root@Centos8 ~]# kubectl get pod

NAME                           READY   STATUS             RESTARTS   AGE

exhaling-yak-cdc8cf8f9-xqtk9   0/1     ImagePullBackOff   0          40s

[root@Centos8 ~]# kubectl get deployment

NAME           READY   UP-TO-DATE   AVAILABLE   AGE

exhaling-yak   0/1     1            0           85s

[root@Centos8 ~]# kubectl get cm

NAME              DATA   AGE

exhaling-yak-cm   1      109s

Pod ImagePullBackOff 的原因是redis镜像没导入成功，再自行pull即可

3、Helm常用命令，大家可以通过 helm --help 进行了解

Helm自定义模板

以上拉取的都是别人自定义好的模板，自己也可以做一些模板上传或者收藏起来。在此测试创建hello-world模板

1.创建好模板所有文件所放置的目录

mkdir charts

cd charts/

mkdir templates     # 必须创建一个名字为 templates 的目录

2.编辑Chart.yaml

vim Chart.yaml # 必须创建一个名为 Chart.yaml 的文件，并指定 name 和 version 两个key的值

name: hello-world

version: 1.0.0

3.在 templates 目录下创建 deployment 及 service

vim templates/deployments.yaml

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

  name: hello-world

spec:

  replicas: 1

  template:

    metadata:

      labels:

        app: hello-world

    spec:

      containers:

      - name: hello-world

        image: nginx:1.2.1

        imagePullPolicy: IfNotPresent

        ports:

        - containerPort: 80

vim services.yaml

apiVersion: v1

kind: Service

metadata:

  name: hello-world

spec:

  type: NodePort

  ports:

  - port: 80

    containerPort: 80

    nodePort: 30001

  selector:

    app: hello-world

此时整体目录结构为：

[root@Centos8 charts]# tree

.

├── Chart.yaml

└── templates

    ├── deployments.yaml

    └── services.yaml

4.安装此自定义chart

[root@Centos8 charts]# helm install .

NAME:   wishing-badger

LAST DEPLOYED: Mon Sep  7 20:55:42 2020

NAMESPACE: default

STATUS: DEPLOYED

RESOURCES:

==> v1/Pod(related)

NAME                          READY  STATUS             RESTARTS  AGE

hello-world-767c98894d-7lrzt  0/1    ContainerCreating  0         1s

==> v1/Service

NAME         TYPE      CLUSTER-IP      EXTERNAL-IP  PORT(S)       AGE

hello-world  NodePort  10.100.108.217  <none>       80:30001/TCP  0s

==> v1beta1/Deployment

NAME         READY  UP-TO-DATE  AVAILABLE  AGE

hello-world  0/1    1           0          0s

查看Pod、Deployment、Service

[root@Centos8 charts]# kubectl get pod

NAME                           READY   STATUS    RESTARTS   AGE

hello-world-767c98894d-7lrzt   1/1     Running   0          67s

[root@Centos8 charts]# kubectl get deployment

NAME          READY   UP-TO-DATE   AVAILABLE   AGE

hello-world   1/1     1            1           78s

[root@Centos8 charts]# kubectl get svc

NAME          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE

hello-world   NodePort    10.100.108.217   <none>        80:30001/TCP   81s

Helm常用命令及用法

1.更新镜像

第一种：手动更新

进入 deployments.yaml 修改 image 行，然后helm upgrade

vim templates/deployments.yaml

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

  name: hello-world

spec:

  replicas: 1

  template:

    metadata:

      labels:

        app: hello-world

    spec:

      containers:

      - name: hello-world

        image: hub.vfancloud.com/test/myapp

        imagePullPolicy: IfNotPresent

        ports:

        - containerPort: 80

[root@Centos8 charts]# helm upgrade wishing-badger .

Release "wishing-badger" has been upgraded.

LAST DEPLOYED: Mon Sep  7 21:07:04 2020

NAMESPACE: default

STATUS: DEPLOYED

RESOURCES:

==> v1/Pod(related)

NAME                          READY  STATUS             RESTARTS  AGE

hello-world-7466c45989-cxnps  0/1    Terminating        0         69s

hello-world-864f865db8-zjt79  0/1    ContainerCreating  0         0s

==> v1/Service

NAME         TYPE      CLUSTER-IP      EXTERNAL-IP  PORT(S)       AGE

hello-world  NodePort  10.100.108.217  <none>       80:30001/TCP  11m

==> v1beta1/Deployment

NAME         READY  UP-TO-DATE  AVAILABLE  AGE

hello-world  0/1    1           0          11m

查看index.html，版本为v1

[root@Centos8 charts]# curl http://10.100.108.217

Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

第二种：变量更新

创建一个变量文件 values.yaml，保存 image 及 tag

vim values.yaml

image:

  repository: hub.vfancloud.com/test/myapp

  tag: 'v2'

vim templates/deployments.yaml # 将 image 字段更改为以上文件的变量

apiVersion: extensions/v1beta1

kind: Deployment

metadata:

  name: hello-world

spec:

  replicas: 1

  template:

    metadata:

      labels:

        app: hello-world

    spec:

      containers:

      - name: hello-world

        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}

        imagePullPolicy: IfNotPresent

        ports:

        - containerPort: 80

开始更新

[root@Centos8 charts]# helm upgrade wishing-badger .

Release "wishing-badger" has been upgraded.

LAST DEPLOYED: Mon Sep  7 21:17:31 2020

NAMESPACE: default

STATUS: DEPLOYED

RESOURCES:

==> v1/Pod(related)

NAME                          READY  STATUS             RESTARTS  AGE

hello-world-5759c969fc-w9s88  0/1    ContainerCreating  0         0s

hello-world-864f865db8-zjt79  1/1    Terminating        0         10m

==> v1/Service

NAME         TYPE      CLUSTER-IP      EXTERNAL-IP  PORT(S)       AGE

hello-world  NodePort  10.100.108.217  <none>       80:30001/TCP  21m

==> v1beta1/Deployment

NAME         READY  UP-TO-DATE  AVAILABLE  AGE

hello-world  1/1    1           1          21m

查看index.html，版本为v2

[root@Centos8 charts]# curl http://10.100.108.217

Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>

或者通过命令行直接修改 image 的 tag 标签，来更新镜像版本

[root@Centos8 charts]# helm upgrade wishing-badger --set image.tag='v3' .

Release "wishing-badger" has been upgraded.

LAST DEPLOYED: Mon Sep  7 21:27:04 2020

NAMESPACE: default

STATUS: DEPLOYED

RESOURCES:

==> v1/Pod(related)

NAME                          READY  STATUS             RESTARTS  AGE

hello-world-5759c969fc-w9s88  1/1    Terminating        0         9m33s

hello-world-6454b8dcc8-pjgk9  0/1    ContainerCreating  0         0s

==> v1/Service

NAME         TYPE      CLUSTER-IP      EXTERNAL-IP  PORT(S)       AGE

hello-world  NodePort  10.100.108.217  <none>       80:30001/TCP  31m

==> v1beta1/Deployment

NAME         READY  UP-TO-DATE  AVAILABLE  AGE

hello-world  0/1    1           0          31m

查看index.html，已经更新为v3

[root@Centos8 charts]# curl http://10.100.108.217

Hello MyApp | Version: v3 | <a href="hostname.html">Pod Name</a>

2.查看release历史版本

[root@Centos8 charts]# helm history wishing-badger

REVISION    UPDATED                     STATUS        CHART                APP VERSION    DESCRIPTION

1           Mon Sep  7 20:55:42 2020    SUPERSEDED    hello-world-1.0.0    Install complete

2           Mon Sep  7 21:07:04 2020    DEPLOYED      hello-world-1.0.0    Upgrade complete

3.删除release

[root@Centos8 charts]# helm delete wishing-badger

release "wishing-badger" deleted

以上命令提示此 release 删除，但其实并没有完全“删除”，而是将它放回了“回收站”

原因是怕你将来有一天想要回滚，“回收站”查看方法：

[root@Centos8 charts]# helm list --deleted

NAME              REVISION    UPDATED             STATUS     CHART      APP VERSION    NAMESPACE

wishing-badger    5      Mon Sep  7 21:27:04 2020  DELETED    hello-world-1.0.0     default

如果想要彻彻底底的删除，在执行 delete 时加上 --purge 即可

4.回滚release

helm rollback [name] [版本]

[root@Centos8 charts]# helm rollback wishing-badger 2

Rollback was a success.

将 wishing-badger 回滚到第二个版本

查看index.html，已回退到第二个版本，version 为 v1

[root@Centos8 charts]# curl http://10.109.145.22

Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>