在 Helm 和 Tiller 之间设置 SSL答案

【问题标题】：Setting up SSL between Helm and Tiller在 Helm 和 Tiller 之间设置 SSL
【发布时间】：2018-12-21 01:16:52
【问题描述】：

我正在按照这些说明在 helm 和 tiller 之间设置 SSL 当我像这样helm-init 时，我得到一个错误

helm init --tiller-tls --tiller-tls-cert ./tiller.cert.pem --tiller-tls-key ./tiller.key.pem --tiller-tls-verify --tls-ca-cert ca.cert.pem
$HELM_HOME has been configured at /Users/Koustubh/.helm.
Warning: Tiller is already installed in the cluster.
(Use --client-only to suppress this message, or --upgrade to upgrade Tiller to the current version.)
Happy Helming!

当我检查我的豆荚时，我得到了

tiller-deploy-6444c7d5bb-chfxw                       0/1       ContainerCreating   0          2h

在描述了 pod 之后，我得到了

Warning  FailedMount  7m (x73 over 2h)  kubelet, gke-myservice-default-pool-0198f291-nrl2  Unable to mount volumes for pod "tiller-deploy-6444c7d5bb-chfxw_kube-system(3ebae1df-e790-11e8-98ae-42010a9800f9)": timeout expired waiting for volumes to attach or mount for pod "kube-system"/"tiller-deploy-6444c7d5bb-chfxw". list of unmounted volumes=[tiller-certs]. list of unattached volumes=[tiller-certs default-token-9x886]
  Warning  FailedMount  1m (x92 over 2h)  kubelet, gke-myservice-default-pool-0198f291-nrl2  MountVolume.SetUp failed for volume "tiller-certs" : secrets "tiller-secret" not found

如果我尝试像这样删除正在运行的 tiller pod，它就会卡住 helm reset --debug --force

我该如何解决这个问题？ --upgrade flag 和 helm init，但这也不起作用。

【问题讨论】：

标签： ssl kubernetes-helm

【解决方案1】：

我遇到了这个问题，但通过删除分蘖部署和服务并重新初始化来解决它。

我也在使用 RBAC，所以也添加了这些命令：

# Remove existing tiller:
kubectl delete deployment tiller-deploy -n kube-system
kubectl delete service tiller-deploy -n kube-system

# Re-init with your certs 
helm init --tiller-tls --tiller-tls-cert ./tiller.cert.pem --tiller-tls-key ./tiller.key.pem --tiller-tls-verify --tls-ca-cert ca.cert.pem
# Add RBAC service account and role
kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
# Re-initialize
helm init --service-account tiller --upgrade
# Test the pod is up
kubectl get pods -n kube-system

NAME                             READY     STATUS    RESTARTS   AGE
tiller-deploy-69775bbbc7-c42wp   1/1       Running   0          5m

# Copy the certs to `~/.helm`
cp tiller.cert.pem ~/.helm/cert.pem
cp tiller.key.pem ~/.helm/key.pem

验证 helm 仅通过 tls 响应

$ helm version
Client: &version.Version{SemVer:"v2.10.0", GitCommit:"9ad53aac42165a5fadc6c87be0dea6b115f93090", GitTreeState:"clean"}
Error: cannot connect to Tiller
$ helm version --tls
Client: &version.Version{SemVer:"v2.10.0", GitCommit:"9ad53aac42165a5fadc6c87be0dea6b115f93090", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.10.0", GitCommit:"9ad53aac42165a5fadc6c87be0dea6b115f93090", GitTreeState:"clean"}

感谢 https://github.com/helm/helm/issues/4691#issuecomment-430617255 https://medium.com/@pczarkowski/easily-install-uninstall-helm-on-rbac-kubernetes-8c3c0e22d0d7

【讨论】：