►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Helm 3 Deep Dive - Taylor Thomas, Microsoft Azure & Martin Hickey, IBM
It has landed. Helm v3 has released! For many people this has been a highly anticipated release, longing for the removal of Tiller. Helm v3 however is more than just this. In this session, you will learn about the new features and the new architecture to support these features. We will discuss the architecture and how the CLI and library has changed to improve usability We will also look at other features like the additions to charts and the new client security model. Worried about migration? That’s covered too! If this whets your appetite then this is the talk for you, especially if you are deep down the highway to Helm. Come along and join the discussion about the new Helm release.
https://sched.co/Uagg
A
Welcome
everyone
to
the
helm,
three
deep
dive
or,
as
I
like
to
say
it's
more
than
just
tiller
being
gone
so
well.
Yes,
thank
you.
Thank
you.
I
know
pitiful
jokes,
all
around,
but
I
could've,
both
of
everyone.
Here
we
have
a
couple
of
the
hecklers
I
mean
maintainer
zuv
helm
here
as
well,
and
I
would
like
to
remind
the
hecklers
that
heckling
can
irishman
in
a
public
forum
is
like
sticking
your
arm
down
a
bears
mouth,
so
don't
do
it
so.
A
B
A
So
onward
to
our
agenda,
so
what
we're
gonna
be
covering
today
is
just
a
few
announcements
about
the
project
itself.
Then
we'll
be
going
into
the
new
functionality.
That's
that's
in
helm,
3.
Some
of
the
architectural
changes
we've
done,
then
we'll
go
into
how
you
can
migrate,
which
has
been
a
common
question.
We've
been
getting
and
then
a
little
bit
about
how
the
security
model
has
changed
from
helmet
ooh
to
helm,
3,
so
I'll
give
it
over
to
Martin
to
talk
through
some
of
these
announcements.
A
B
First
and
foremost
in
case
you've
been
hiding
on
the
rock,
you
didn't
hear
hand
trigger
release.
Yay
come
on.
Let's
hear
some
love
here.
Please
come
on
all
we're
gonna
programs
evening
tailor.
Oh
yeah
we're
okay,
we're
gonna
rock
here;
okay,
so
just
we
know
what
it's
like
near
the
end
of
the
second
day
of
Q
Khan,
you're,
feeling
tired.
Maybe
you
socialize
too
much
last
night,
maybe
had
a
couple
of
vodka
pops
who
knows?
Can
everybody
stand
up
here?
B
A
B
B
Okay,
so
one
final
announcement
and
in
the
last
I
suppose
two
weeks
ago,
haven't
passed
the
security
audit,
and
this
was
a
third
party
security
audit
sponsored
by
the
CN
CF
and
it's
Matt.
Farina
mentioned
this
at
the
keynote
on
the
first
day,
he'll
passed
with
a
really
really
good
reference,
saying
that
it's
fit
for
production.
So
that
was
great
to
hear-
and
this
is
all
part
of
the
process
where
we're
trying
to
graduate
ad
hand
project
over
the
next
year,
so
hopefully
early
next
year,
it
graduates
as
a
project.
B
Okay,
so
our
own
new
functionality,
so
a
lot
of
new
functionality
has
been
brought
in
in
hmmm
tree
and
and
a
lot
of
this
has
been
around
usability
stability
and
also
make
inhale
more
bat
and
red
battle-hardened
for
production.
Now,
I'm
not
going
to
go
through
every
bit
of
functionality
today,
because
there's
quite
a
lot
of
it
there
and
we
want
to
get
through
just
a
lot
of
other
sections.
B
So
what
I'm
going
to
do
is
cover
what
I
have
up
here
and
I
look
at
the
changes
in
charts
or
to
repose
the
upgrade
strategy
and
test
frameworks
and
or
CIO
registry.
So
let's
kick
into
the
chart
updates.
So
what
I
put
up
here
is
a
chart
Yama
file,
and
you
can
see
it's
very
top.
I've
highlighted
three
things
for
the
top:
I've
highlighted
the
API
version,
so
in
Hallam
tree
we've
introduced
new
capability
into
charts
and
to
help
us
to
identify
the
difference
between
Helen
v2,
charts
and
Helen
beat
recharge.
B
We've
had
to
bump
the
API
version
and
it's
been
bumped
up
to
v2
now.
I
think
we
should
apologize
here
because
obviously
is
going
to
be
repeated
confusion
here.
The
API
version
used
to
be
v1
for
Hallam,
v1
and
Helen
v2
I
know
we
bumped
it
up
to
v2,
and
this
corresponds
more
to
Helen
Vitry.
So
yup
ology.
If
there's
been
confusion
on
this,
but
this
is
this-
is
the
way
we
had
to
do.
The
incremental
update
to
from
v1
to
v2.
B
The
second
thing:
I've
highlighted
is
a
new
new
property
field
called
type,
and
this
field
can
be
of
two
values:
it
can
either
be
application
or
library
and
why
we've
introduced
this
is
because
of
library.
Charts
have
been
introduced
as
a
first-class
citizen
into
in
in
helm
tree
so
you're
like
the
charts
the
same
as
common
charts
in
v2,
and
we
want
to
be
able
to
distinguish
between
the
board
of
them
and
if
anyone
has
used
common
charts
in
v2,
you'll
know
that
common
charts
by
default
normally
don't
have
any
deployment
objects.
B
And
if
you
try
to
install
them,
the
unfortunately
get
installed
as
an
error,
and
it's
it's
just
a
bit
clunky
and
then
you
have
to
install
it
back
out.
So
we
decided
we'd
like
to
be
able
to
differentiate
between
them
and
especially,
if
they're
being
used
as
subjects
are
so
charts
within
subjects.
The
final
thing
we've
done
around
when
we're
finding
through
turnaround
charts
is
the
dependencies.
So
previously
dependencies
were
defined
in
requirements,
but
we
decided
to
consolidate
that
and
move
the
requirements
into
the
chart,
our
Yamin
file,
so
that
means
in
v3
requirement.
B
Files
are
no
longer
rendered,
and
this
is
where
you
define
your
dependencies
and
the
last
thing
your
own
charts
is
value
validation.
So
we
got
a
lot
of
feedback
from
people
around
at
the
fact
that,
when
they're
using
charts,
what
values
are
to
be
set
or
not?
Sometimes
it's
a
case
of
maybe
you
haven't
read
the
read
me,
but
a
lot
of
times
this
may
be
to
read
me
is
out
of
date.
So
what
we've
done
here
is
we've
provided
the
hook
stat.
B
If
a
particular
chart
has
a
value,
schema
or
JSON
schema
field
defined,
then
this
jss
key
scheme
and
file
foil
can
be
used
to
check
the
values
shown
particular
commands.
The
commands
are
up
there,
your
install
upgrade,
etc,
and
if
you
want
to
have
a
JSON
file
in
your
weather,
your
chart
maintainer
or
our
shop
creator,
you
need
today
in
defining
the
file
name
the
file
as
values,
the
Scimitar
jason
and
place
it
in
the
root
of
the
so
wrong
to
repose.
B
So
it's
probably
if
you've
use
helm
before
you
know
that
there's
an
official
chart
repository
and
that's
what
I
helm
and
you
can
have
the
stable
or
they,
the
incubator
repose,
so
that
started
out
initially
as
as
a
place
where
users
or
chart
maintainer
could
place
the
charts
and
and
as
as
was
anticipated
over
time.
These
charts
have
grown.
The
amount
of
repose
have
grown,
especially
our
own
vendors,
like
bitNami,
etc,
have
come
in.
So
there's
a
lot
of
repos
out
there
now
and
all
charts
are
not
hosted
on
on
the
official
chart
repo.
B
So
the
idea
here
is
that
chart
repos
can
put
the
hooks
in
place
and
it's
a
one-stop
shop
for
you
to
check
where
those
charts
are
so
then,
when
you
find
where
the
repo
is,
you
can
include
your
repo
into
the
static
repo,
our
foil
in
helm,
and
then
you
can
install
your
chart
from
there
as
part
of
this
in
helm
tree.
Then
we've
expanded
the
search
capability
so
that
no
you
can
search
in
helm
home
and
find
out
where
your
particular
charts
are
also
out
of
the
box.
A
So
that
brings
us
to
the
next
one,
which
is
around
our
improved
upgrade
strategy,
so
in
helm
too
many
people
have
used
it.
A
lot
in
production
have
run
into
this,
where,
basically,
all
helm
two
was
doing
was
comparing
the
most
recent
chart
manifest
with
the
new
chart
manifest
you
were
trying
to
install,
and
so
it
would
ignore
things
that
were
were
added
after
the
fact
so
helm
3
changes
us
to
use
a
three-way
merge
strategy
where
it
includes
the
light
cluster
state.
Now
what
that
means
in
practice
is
it
looks
like
this.
A
So
if
you
have
a
current
state
of
a
cluster
like
here
on
the
Left,
where
you
have
this
engine,
X
pod
it
and
then
let's
say
you're
using
a
service
mesh
of
some
kind
or
anything
else
that
injects
a
sidecar,
it
will
inject
that
you
inject
the
sidecar
in
and
then
now
you
want
to
now.
You
want
to
update
your
your
nginx
container,
so
you
bump
into
2.10,
and
that's
your
new,
your
new
manifest.
What
would
happen
in
helm?
2
is.
A
You
would
end
up
with
just
the
containers
array
that
with
the
new
server
and
it
would
have
gotten
rid
of
the
old
sidecar
and
helm
3,
because
we're
using
the
three-way
merge
it
actually
pulls
it
in
and
keeps
the
sidecar
or
any
additional
data
that
you
added
out-of-band
into
the
main
chart.
So
it's
a
hopefully
way
more
useful
for
people
when
you
have
that
extra
state
that
you've
added
in.
In
addition
to
that,
we
also
have
the
update
to
the
test
framework.
A
So
there's
been
a
lot
of
work
done
and
there's
actually
gonna
be
more
work
in
the
future
versions
of
helm.
3
around
this
one
of
the
major
things
is,
instead
of
tests
having
to
be
bear
pods,
you
can
use
them
as
jobs.
Now
we
also
got
rid
of
the
difference
between
a
test
failure
and
test
success
hook
and
just
made
it
test.
A
The
nicest
thing
here
is
now:
you
can
run
the
test
item
potently,
so
you
can
run
it
again
and
again
and
again,
and
you
won't
run
into
the
name
collision
errors
if
you
would
use,
tell
them
tests
in
the
past.
If
that's
what
had
happened
so
the
last
thing,
which
is
a
super
interesting
one,
is
the
OCI
registry
support.
A
So
this
is
an
experimental
feature,
meaning
we
know
we
offer
no
backwards
compatibility
guarantees
here
and
you
can
use
the
feature
using
that
export
helm,
experimental
OCI
flag,
that
we
have
up
there,
but
this
allows
you
to
push
a
chart
into
something
like
a
docker
registry.
Anything
that's
OCI
compliant
now.
This
is
experimental
because
we're
still
working
with
the
OCI
spec
and
everyone
in
that
community
to
solidify
exactly
what
this
will
look
like,
but
we
have
the
experimental
support
in
there
right
now.
A
B
B
So
probably-
and
this
is
before
my
time
but
going
back
to
the
force
helm
summit
in
2018-
there
was
quite
a
lot
of
input
from
the
community
and
especially
that
somewhat
her
owned
right.
Can
we
get
rid
of
tiller?
Do
we
really
need
tiller
and
the
community
and
and
the
core
maintained
was
looked
at
and
said?
Actually,
maybe
we
don't
so
a
big
undertaking
was
what
was
brought
forward
in
early
2018
to
say
right.
B
So
thanks
the
community
for
pushing
that
in
and
thanks
to
everybody
who
worked
on
it
to
get
it
there,
because
this
was
a
big
piece
of
work.
So
as
part
of
this
as
well,
we
looked
around.
Where
does
our
configuration
get
stored?
So
initially
we
store,
probably
in
home,
dot,
helm
or
what
are
hell
impact
you
decided
to
use,
but
we
can
looked
and
said.
B
We
should
have
a
more
standard
way
of
doing
this
and
we
decided
to
support
the
xdg
base
specification
and
what
this
does
is
it
provides
you
a
properly
defined
way
of
where
your
configuration
go
and
it's
also
platform
independent.
So
in
this
situation,
I've
just
I've,
just
we've
just
shown
here-
Linux
pads
so
home
with
dark
ash
that
config
and
our
local
and
you
can
see
the
local
done
/
share,
and
you
can
see
that
within
that
then
you're
going
to
have
the
particular
applications
that
support
xdg
helm
in
this
case.
B
But
if
you
look
in
there,
you're-
probably
fine
more
applications
that
do
the
same
as
a
result
of
this
work
and
no
longer
needing
to
install
a
tiller
or
needing
to
have
configuration.
They
are
straight
out
in
the
box.
We
then
decided
that
Hellmuth
was
needed
any
longer
and
it
has
been
removed
because
no,
our
configuration
can
be
lazily
created
on
the
fly
as
we
need
be.
B
B
Another
big
aspect
is
because
we
no
longer
have
a
tiller
and
everything
was
generally
running
under
the
name
space
of
tiller
and
these
objects
were
being
stored
under
that
namespace
they're,
now
being
stored
correctly
under
the
name
space
of
the
particular
release
that
you
want
to
deploy
it,
and
what
this
does
is
and
has
been
asked
for.
Awhile
is
uniqueness,
around
release
names
so
before
the
release
names
where
well,
you're,
probably
not
close
to
white,
but
they
were
tied
to
the
name
space
of
your
tiller.
B
So
if
you
had
one
Taylor
instance
running
in
the
cluster,
then
it
was
like
he
was
tossed
away
for
you,
but
what
it
is
now
is
it's
no
unique
just
to
the
particular
name
space.
So
that
means
then,
if
you
are
different,
lots
of
different
names
fits
your
different
releases.
Then
you
can
have
you.
Can
you
can
basically
repeat
the
names
if
you,
if
you
like,
if
you
like,
if
you
so
be
nice
one,
you
got
trigger-happy
there
in.
B
Back
with
me
is
also
the
real
subject.
So
when
we
moved
a
tiller
and
we
got
rid
of
gr
PC,
we
were
then
able
to
look
at,
say
and
write
with
gr
PC.
There
were
some
constraints
around
the
particular
types
we
could
use
and
so
many
objects
we
were
having
had
to
be
more
brought
down
into
more
vanilla
types.
So,
with
the
removal
Attila
know,
we
can
pass
a
lot
in
the
objects
around
and
what
it
means
is
the
release
object.
B
We
store
the
secret
in
the
data
field
with
the
secret
object
means
we
can
store,
as
particular
objects,
so
that
has
changed
quite
a
lot
and
also
the
name
it
release.
Nians
no
are
prefixed
with
the
name
of
shown
there,
as
he
shall
have
now
released
of
a1,
and
this
is
because
of
uniqueness
around
we
found
when
you're
trying
to
merge
from
V
migrate
from
v1
to
be
from
v2
to
v3.
You
can
have
issues
so,
while
you
were
putting
this
up
here
is
for
for
a
lot
of
people
out
there.
B
If
you
don't
go
through,
if
you
go
through
the
basic
to
the
standard,
see
alloy
of
hell,
you're,
okay,
if
you
have
gone
in
the
backdoor
and
you
went
to
closer
and
you've
been
taking
these
objects
that
are
based,
64
encoded
in
G.
Gzipped,
then
be
aware
of
this,
because
we,
this
is
where
the
big
changes
come
around
home
with
the
architecture
and
the
infrastructure
changes.
We
have
these
or
something
you
know
if
you
go
in
the
back
door
or
if
you're
born
in
through
the
the
boat
line
code
now.
A
A
Series
is
one
of
the
big
changes
and
just
to
lead
off
with
that,
as
we
kind
of
discussed
how
CDs
work,
we've
noticed
that
the
the
community
has
not
fully
solidified
on
a
general
practice
for
what
you're
supposed
to
do
with
managing
sea
RDS
and
ordering
and
there's
a
whole
bunch
of
things
that
that
need
to
happen
around
CRTs,
and
so
we
tried
to
back
off
to
the
minimal
thing
that
was
needed.
So,
basically
now
we
have
removed
the
idea
of
a
CR
deinstall
hook.
A
There's
some
interesting
technical
things
that
we
can
talk
about
outside
of
this
discussion
about
why
that
was
removed,
but
now
they're
in
the
CR
DS
directory.
So
you
you
place
your
CR
DS
there
and
they'll
get
Ottoman
it's
an
up,
cert
they'll
automatically
get
installed
or
if
they
exist,
though
nothing
will
happen.
A
The
good
thing
is
is
that
CR
D
install
hooks
are
ignored
just
with
a
warning
in
helm
3,
so
your
chart
can
still
support
helm
2
in
helm,
3
simultaneously
by
leaving
your
current
c
rd
of
stall
hooks
in
place
and
creating
the
new
CR
DS
directory
with
the
the
CR
DS
in
there
as
well.
So
just
note
that
those
c
rd
changes
are
there,
they're
automatically
applied
for
you
without
any
other
flags
or
changes,
and
if
you
want
to
skip
them,
there's
a
flag
for
that.
Just.
B
One
thing
on
that,
and
it's
kind
of
just
a
little
side
story:
I
was
talking
to
someone
in
dev
ops
in
my
office
about
a
week
or
so
ago,
and
the
pattern
here
about
porting,
your
your
your
CR
DS
in
there
and
they've
been
installed
from
from
the
onset
before
anything
else
is
rendered.
Isn't
a
pattern,
that's
new
from
talking
to
the
to
the
DevOps
team,
what
they
often
do
with
their
CR
DS
is
they've,
actually
a
chart
for
the
CR
D
that
gets
installed
force
and
endeavour
application
charts
afterwards.
So
it's
not
an
anti-pattern.
A
Will
keep
building
on
it
as
the
community
kind
of
standardizes
on
specific
practices?
The
other
good
thing
is,
we
have
a
new
go
SDK,
so
essentially
the
CLI
is
just
a
wrapper
around
the
SDK,
with
some
data
massaging
that
makes
it
prettier
for
you
to
see
when
you,
when
you
print
it
out
on
a
CLI,
so
you
can
now
use
the
this
package
a
lot
easier.
If
you
ever
try
to
use
helm,
it
was
possible,
but
it
was
kind
of
a
little
bit
of
a
nightmare
to
spin
up.
A
Things
are
actually
a
lot
easier
now,
and
these
are
the
main
packages
to
care
about,
there's
a
whole
bunch
of
other
ones
in
there,
but
I
actually
wanted
to
show
really
quick
an
example.
Now
don't
worry,
these
slides
are
uploaded
on
the
schedule,
so
you
can
go
there
and
pull
this
down,
but,
as
you
can
see,
this
is
not
a
large
block
of
code.
So
this
is
just
a
simple
thing.
A
That's
basically
listing
all
the
all
the
releases
in
a
single
namespace,
and
so
it
only
requires
importing
to
helm
packages,
and
then
you
set
up
your
config
to
make
sure
it
reads
everything
improperly,
and
then
you
list
things
out.
This
allows
people
to
kind
of
compose
things
in
different
ways.
I've
talked
to
probably
several
of
you
who
are
in
this
audience
who
came
and
visited
us
at
the
booth
about
complex
deployment
patterns.
This
enables
you
to
do
that
by
allowing
you
to
kind
of
pull
out
the
functionality.
A
B
Just
an
example
of
community
and
its
own
dogfood
is
basically
the
tutor
tree
plug-in
when
it's
when
it's
traced,
when
it
stores
the
map-
and
we
talk
about
in
the
minute
we're
just
coming
on
today-
actually
is
that
we
need
store
and
release
objects
in
v3.
It
is
going
through
the
the
goal.
Sdk
so
unto
migrations,
okay,
first
and
foremost,
Yuki-
and
this
is
a
question
that
has
come
up
at
the
booth
the
last
today
as
an
open
community
as
well.
B
You
should
still
be
able
to
run
your
hand,
charts
render
deploy
them,
etc
using
home
tree
okay,
with
a
little
bit
of
a
caveat,
so
you
no
longer
held,
we
no
longer
create
namespaces
on
the
fly.
So
what
we
mean
by
that
is,
if
you
want
to
deploy
into
a
particular
namespace,
you
need
to
create
the
namespace
beforehand
and
the
reason
behind
that
is.
We
wanted
to
follow
more
the
pattern
of
cube,
CTL
and
kubernetes
ecosystem
and
when
new
orders
a
lot
a
discussion
out
there
at
the
moment.
A
B
B
No
I
didn't
can't
get
good
help
anymore.
Okay,
so
what
we
know
Cameroon
is
so.
We've
talked
in
the
architectural
changes
and
the
changes
we've
made
when
you
make
changes
like
this.
You
change
architecture
margin
from
train
server
to
client.
You
change
how
your
release
objects
are
stored,
underneath
the
hood
etc.
Your
expect
there's
going
to
be
differences
between
hell,
m2
and
he'll
tree.
Okay.
So
to
help
with
this
is
we
we
need
to
look
at
migrating.
So
how
do
you
migrate
that
closer?
Let's
manage
my
v2
or
helm
v2
and
by
Helen
tree?
B
So,
let's
all
worry.
It's
not.
There's
no
need
to
run
out
of
the
room
thinking
everything's
on
fire.
Yes,
we've
planned
for
migrations,
so
there's
particular
to
use
cases
where
we've
we've
looked
at
the
first
one
is
the
straggler
pattern
and
the
other
is
in
situ
what
I
mean
by
the
strangler
patran,
if
you've
heard
of
it
before
is
the
idea
here.
There's
you
manage
migrations
yourself
and
what
I
mean
by
that?
Is
you
start
your
hell
and
he'll
tree?
They
can
coexist
in
the
same
cluster.
B
B
So
in
this
situation,
helm
tree
is
used
for
any
new
deployments
that
are
going
to
happen,
new
installs,
etc
and
then
Hannam
two's
deployed
releases
are
maintained
until
eventually,
over
a
period
of
time
you
might
start
phasing
out
or
squeezing
out
those
particular
v2
releases,
and
that
should
eventually
come
to
a
point
where
there
are
no
more
retool
releases
and
it's
just
hell
em
tree,
and
then
you
remove
lm2
from
the
particular
system
and
the
cluster.
The
other
one
is
in
situ
are
probably
I
suppose,
like
life
migrations.
B
The
idea
here
in
this
situation
is
that
you
want
elm
tree
to
manage
the
particular
v2
releases
that
have
been
deployed.
So
how
do
you
do
that?
So?
As
I
talked
earlier,
it
is
quite
a
few
changes
around
it
and
we
do
how
the
lease
objects
are
stored
with
where
the
configuration
is
etc,
and
that's
really
subject
aren't
the
same
anymore.
So
to
help
you
with
that,
we
developed
a
plugin
and
it's
inside
inhaler
morgue
and
it's
called
helm
tree.
You
see
it
up
there
or
the
hell
them
tree,
plugin
yeah.
B
So
here's
just
an
example
of
it.
You
can
see
here
that
no
abuse
helm
tree
just
to
distinguish
between,
so
it
would
be
normally
Hannah.
Anyway,
you
can
see
it's
a
plugin
as
I've
shown.
There's
a
tree
commands
on
us.
One
of
them
is
for
the
configuration
can't
move
config.
So
this
takes
the
exists
in
hand.
Configuration
and
this
configuration
can
be
things
like
your
plugins,
you've,
installed,
etc,
and
they
move
them
over
to
the
helm,
tree
locations
or
creator
locations
as
they
need
be
as
well.
B
The
next
one
day
in
is
the
conversion
of
your
releases,
or
these
are
the
releases
you
have
have
deployed
like
my
post
read
for
MySQL,
etc,
and
you
call
him
you
call
it
with
the
convert
command
and
the
name
of
your
particular
release,
and
then
it
will
take
all
that
release
history.
So,
however,
many
releases
that
versions
that
you
have
or
release
visions
you
have
it
will
propagate
through
them
and
move
them
over
into
helm
tree.
It
does
not
touch
the
kubernetes
objects
that
have
been
deployed.
B
All
it's
doing
is
taking
that
release
information
from
the
cluster
and
moving
it
into
the
format
and
location
for
helm
tree
to
see.
Now
we
call
this
life,
because
in
this
situation
your
helm
can
still
see
the
releases,
and
if
you
do
ahead,
an
LS
will
happen.
You'd
see
them,
and
if
you
do
your
harem
tree,
LS
you'll
see
okay.
B
The
point
here
is
when
you're
doing
this
and
you
start
migrating
over.
You
want
to
finish
that
migration,
because
if
you
start
deploying
again
with
him,
he'll
him
or
you
start
upgrading
some
of
those
releases
you're
going
to
get
into
an
indeterminant
stage.
No,
it's
okay!
If
this
happens,
because
if
you
haven't
removed
it
for
him,
yet
you
can
still
go
into
directly
into
the
cluster
and
remove
any
of
the
helm
tree
data
by
searching
for
secrets
with
an
owner
of
hell.
B
Okay
with
a
label
ordinary,
could
help
in
all
lower
case,
so
things
are
not
lost
there.
But
the
idea
here
is
that
you
use
the
plugin
move
over
your
particular
releases.
Make
sure
your
releases
look,
okay,
make
sure
they're
working
okay
and
then
basically
the
final
command
is
cleanup
which
will
go
in
it
will
remove
all
the
configuration
frenum
it
will
propagate
through
all
the
helm
releases
and
just
remove
that
release
information
from
the
cluster.
B
A
So
that
brings
us
to
the
last
point
here,
which
is
around
the
new
security
model.
This
is
gonna
just
be
a
brief
overview,
you'll
see
in
the
lower
right
hand
corner
and
if
you
download
the
slides,
there's
a
link
to
the
talk.
This
is
taken
from
by
Matt
Fisher,
another
one
of
the
core
maintainer
x'
that
goes
into
the
helm,
3
security
model
and
all
its
helm,
3
vs.,
helm,
security
model
and
all
its
gory
detail.
A
But
this
is
just
the
quick
review
of
it,
so
in
helm
to
the
security
for
kubernetes
was
what
we'd
expected
to
be,
but
in
helm
we
had
things
like
the
tiller
certificate
management
and
the
are
back
for
the
for
the
service
account
running
tiller
and
then,
when
we
removed
tiller
helm,
three
security
model
now
just
basically
removes
those,
and
the
only
thing
that
helm
is
responsible
for
is
the
chart.
Security
basically
checking
the
chief
a
chart
is
signed
that
it's
actually
signed
properly.
A
It's
also
good
to
note
that
those
who
are
maintaining
charts
it's
good
to
make
sure
that
your
chart
is
up-to-date
and
secure
sneak,
which
is
a
company.
That's
here
actually
just
recently
released
a
audit
of
most
of
the
charts
and
the
stable
repository
and
identified
some
common
flaws
that
people
can
can
easily
address
to
avoid
security
problems.
So
that's
something!
That's
still.
You
have
to
worry
about
as
a
chart
maintainer
but
in
helm.
A
Basically,
the
security
model
has
switched
to
something
basically
now
that
it's
a
per
user
basis
or
in
other
words
it's
delegated
to
the
kubernetes
user
per
user
security.
So
if
I'm,
a
user
accessing
helm,
it's
going
to
have
the
same
permissions
as
if
I
was
doing
it
with
coop
control,
so
you
can
have
whatever
our
back
rule
set
up
and
helm.
Will
we'll
listen
to
those
same
rules
so.
B
It's
based
off,
essentially
it's
based
off
your
coop
config.
So
this
is
something
actually
that's
coming
up
in
the
community
where
people
they
know
do
an
install
and
they
deploy
out
your
app
and
MySQL
and
they
give
it
a
particular
namespace
and
so
they'll
come
back
and
go
hem
trees
seem
to
deploy
it's
no
longer.
There.
I
went
Helen
unless
there's
no
sign
of
it.
B
Okay,
so
it's
bear
in
my
know,
is
when
you
do
in
a
commander
with
helm,
you
need
to
stay
state
the
namespace,
because
what
is
going
to
use
it's
going
to
use
the
default
namespace
in
cube
config.
If
you
deployed
your
release
in
a
different
in
space,
for
example,
test
or
something
like
that,
unless
you
go
specify
that
namespace
for
an
LS
to
see
what
has
been
deployed
on
to
that
in
space
or
you
do
a
dot
that
all
that
namespace.
B
That's
all
that
namespace
you're
not
going
to
see
it.
So
don't
worry
if
you,
if
you
can't
see
it,
you
just
need
to
make
sure
that
you
need
to
look
in
the
namespaces
and
Sam
if
you're
going
in
the
back
door
and
looking
at
the
secrets,
you
need
to
look
across
the
namespaces.
So
just
bear
that
in
mind
that
it's
following
that
pattern.
So.
B
Well,
I
was
talking
to
someone
yesterday,
a
lovely
person,
I
called
Mary,
and
she
was
asking
about
Helmand
and
doing
basically
it
do
an
interview
wrong
dish
around
for
a
piece
around
Helen
and
she
she
asked
a
really
nice
questionable.
What
would
be
two
takeaways,
what
a
bid
three
takeaways
and
I
kind
of
had
to
think
about
at
a
time
but
I
suppose
the
first
one
is
the
obvious
one
which
is
Taylor,
no
more
tiller.
So,
as
I
said
earlier,
there
is
do
you
know
what
I
mean.
B
It
was
the
thing
that
you
true,
that
sort-
maybe
I
don't
know,
but
it's
gone,
oh
and
that
basically
everything's
you,
as
I
mentioned
a
minute
ago,
is
dawn
around
cube,
config
and
particularly
in
spaces,
and
to
just
realize
that
when
you're
deploying
and
when
you're
looking
for
the
details
afterwards,
the
second
won't
be
is
we
have
a
migration
plan
and
that's
going
to
be
very
important
for
people.
Yes,
some
people
might
like
to
do
the
migration
themselves,
as
I
mentioned
earlier,
using
a
stronger
pattern,
but
we
have
to
plug
in
there.
B
So
please
go
and
use
that
give
us
feedback
etc.
You
know
tell
us,
tell
us
how
it
is
going,
but
that
there
are
ways
around
the
to
as
long
as
you
don't
deploy
all
of
us
who
just
realize
there
are
always
risk
which,
with
migrations
and
the
final
one
I
think,
is
that
a
lot
of
people
asked
about
a
new
mention
earlier
than
to
be
able
to
be
programmatically
our
border
SDK.
Look,
you
know
in
him
too.
There
wasn't
a
clear
division
really
between
the
CLA
and
the
package.
B
Really
you
know
it
was
a
little
bit
Lodi
in
there.
You
had
to
go
in
there
and
you
had
to
make
it
work.
So
a
lot
of
great
work
has
been
done
around
that
to
separate
it
out.
Make
it
a
proper
standalone
package
make
the
CLA
that
if
you
want
to
go
on
and
see
what
the
pattern,
how
to
use
the
package,
yes
going
to
slash
CLA,
you
get
that
in
there
and
then
slash
packages
in
details
on
that.
B
So
I
think
for
me:
that's
the
tree
takeaways
and
before
I
handover,
robots
next
to
Taylor,
I'd
also
say
to
people:
okay,
dogs,
dogs,
dogs,
all
right
now,
I've
never
been
the
greatest
advocate
of
a
dachshund.
My
like
all
my
life
I've
been
a
developer.
I
always
was
probably
please
write
to
talks
at
the
end
and
I'm
kind
of
putting
something
together
for
look.
We've
put
a
lot
into
the
docs
and
why
I'm
saying
ducks
to
people
is
definitely
over
the
last
two
weeks
open
the
community.
B
A
lot
of
questions
have
come
in
our
own
stuff
that
have
been.
You
know
what
I
mentioned
area,
but
I
cannot
find
my
my
deployment
anymore.
I
would
tell
them
less
different
stuff,
like
that.
We've
pulled
a
lot
of
effort
into
the
docs.
The
bee
tree
talks
or
the
million
ducks
you
land
on
the
page.
You'll
see
a
link
above.
If
you
want
to
get
to
your
v2
ducks
or
you
can
go
v2
without
have
not
ACH
last
Doc's
go
and
have
a
look.
Please,
because
lot
of
grey
work
has
been
done
on
us.
B
There's
a
nice
little
introduction
section,
which
shows
you
the
quick
start,
and
all
that
and
the
other
thing
that
I
didn't
take
vote
will
see.
Everyone
still
thinks
you
have
to
go
helm
in
it.
If
you
go
into
that,
intro
section
start
you'd
see
that
we're
not
giving
over
to
to
not
reading
the
docs
who
go
in
and
look
at
and
see.
How
can
we
improve
this
for
the
next
person
that's
coming
in
or
whatever
so,
with
that
I'll
hand
over
to
sue.
A
Taylor
yeah,
the
common
question
we
get
is
what
net?
What's
next?
To
be
honest,
we
don't
have
a
specific
roadmap
for
some
of
these
things.
The
main
thing
we
want
to
get
back
to
is
accepting
new
feature
ads
because
we've
been
locked
down
for
this
beta
phase
and
not
really
accepting
new
feature
ads
where
we
want
to
get
back
to
that.
A
So,
as
we
come
out
of
this
holiday
season,
we're
going
to
be
going
straight
into
that
and,
as
we
follow
what's
going
on
between
with
kubernetes
api
stabling
and
what
we're
doing
and
what
we're
doing
we're
gonna
be
able
to
see
where
we
want
to
take
helm
for
its
next
step.
But
the
first
thing
is
just
going
to
be
getting
those
new
features
out,
so
we
just
have
a
little
bit
of
time
left.
These
are.
A
A
D
A
A
B
B
A
I
was
actually
there
for
that
debate,
because
I
kind
of
proposed
the
initial
one
when
we
started
our
helm,
3
planning
and
the
main
thing
around
not
using
a
CR
D,
is
that
it
was
simpler
to
have
something
with
secrets,
because
you
have
pluggable
secret
back
secret,
backends
and
in
helm
releases
you
often
have
credentials,
and
so
with
a
pluggable
secret
backend
somebody
can
be
encrypting
their
credentials
or
encrypting
their
@cd.
It
doesn't
really
matter,
and
so
now
that
gets
in
that
picks
up
on
that
encryption
by
default.
A
There
was
no
need
to
create
a
custom
mounting,
because
we
also
would
have
had
to
have
two
separate
types
of
objects
that
would
have
had
to
keep
updating
references
to
each
other.
So
anyway,
we're
gonna
have
to
end
now.
We
will
first
go
off
to
the
side
and
then,
when
the
next
talk
comes
in,
we'll
go
out
to
the
back.
So
thank
you
very
much.
Thank
you.