VMware TGI Kubernetes, 16 Feb 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: TGI Kubernetes 026: Helm Yeah!

Description

0:02:39 - Create a Kubernetes cluster with Kubicorn
0:03:13 - Kooper
0:03:35 - Kris gets Pizza, hot sauce, and diet coke from Joe
0:05:49 - Prow prow.k8s.io
0:07:22 - GPU on GKE
0:07:30 - Helm summit https://t.co/rzbzqHHxKg
0:08:58 - Heptio ark release
0:11:42 - Vanilla k8s cluster
0:12:34 - Installing helm
0:24:22 - Exploring charts
0:27:31 - Text Template
0:31:22 - values.yaml and interpolating at runtime
0:32:40 - Installing tiller
0:33:02 - Cobra CLI library
0:34:01 - helm init
0:38:44 - Debugging tiller with RBAC
0:48:35 - Joe + Kris RBAC help
0:51:03 - helm install stable/wordpress
0:53:16 - Mapping deployment to chart
0:57:17 - Using --set
1:01:30 - Helm exploit
1:04:36 - Creating a helm chart
1:07:16 - emacs helm
1:09:10 - Bug in kubicorn
1:12:35 - Creating a repository
1:16:34 - Recap and goodbyes

Kris Nova is guest starring this week on TGIK!

Come hang out with Kris Nova as she does a bit of hands on exploration of Kubernetes and related topics. Some of this will be Kris talking about the things she knows well. Some of this will be Kris exploring something new with the audience. Ask questions, comment and help decide where things go.

This week Kris will be exploring Helm. We will start by installing Helm on a new Kubernetes cluster. We will be installing an existing helm chart, and creating a new one from scratch for the Java Prototype application.

Links:

A

Hey everybody and welcome to TGI K I am your host today, Chris Nova I am taking over for Joe, and today we're gonna be talking about helm and actually before I get started. I want to make sure this thing is even working because it's my first time doing this uh hi everyone hi Fabio, how's it going. If you guys can hear me and see me like give me like a big heart or something hi Chris from Paris from Antoine, hey, Antoine, how's it going.

A

Let's see I think I can chat to Joe, does never chat but I'm totally gonna chat.

A

Today, yay I got a Happy Hearts lets see: hey everyone, BAM cool Florida, hey angel Fabio, Noah, Hans Hans in Sweden, I wanna, make I know like don't wanna forget anyone, hello from Bonn, hey, Phillip, hey Sean, hey from Calgary I was thinking about going up to Canada soon hi from Hamburg I, don't even know where some of these places arc and no I really just want to make a map of like all of the TGI K people in the world and just have like a map up behind us of.

A

Like little pin drops of all the people all over the world- hey everyone jellal be x, pro hi from Madrid hello from Brazil its melting here. I wish it was melting here. It was like sunny for a couple days and now it's raining: lithuania, okay, that's cool hi from Cork hi Chris from down the hall from Joe Poland Napper, Ville yeah. We definitely got to get a map going or something plus 140g I came up, okay, cool, so how's everybody doing today.

A

It's Friday and we're gonna be talking about about helm, but before we get started, we're gonna do a couple of things. The first one is. We are going to deploy a kubernetes cluster with cuba, corn on Amazon Web Services. So let me switch over oh, oh also hold on I. Just looked in the mirror me like adjust this.

B

A

Think guys came here, the weird sounds or not. Okay, that looks a little bit better. Okay, so let's go over here. Can you guys see my terminal text? Size is good thumbs up cool, uh so I'm going to create a kubernetes cluster I want to call it TGI, Chris and Redick rate it in Amazon and we are going to apply our new clustering. So, while that's going on in the background, we're gonna talk about news and the kubernetes open source space.

A

Could you increase the font size yeah? Let me see so I can do that and then I can do this handy-dandy shortcut. That Joe showed me bam and bam that look good, so yeah so news. So the first thing I want to talk about. Is this new project called Cooper? Let's see if I can do this like super elegantly bam and bam, poof Cooper, so I purposely have not looked at any of these beforehand. So you guys are gonna, get to see a lot of this in the wild here.

A

So Cooper is a simple go library to create kubernetes operators and controllers. Oh hold on oh gee, thanks Joe, so Joe's joining and he is bringing me he's. Bringing me ghost pepper, sauce, a diet, coke and looks like some giant slices of pizza, thanks, Joe, okay cool so now, I get some pizza and I teach eik okay. So if somebody could, let me know if the font size is good in my terminal next time, I'm back in there again. That would be helpful.

A

So, let's look at this, so this is made by spa a home I just like to look at coop like kubernetes and open source organizations. Ya know beer also something's calling me who's. Calling me right now um and see what else they're up to before I, even look at the repo okay. So these guys I, don't even know what did they do? Let's see what they do.

A

Experience your new home Oh dope. It's like a smart home, something okay, now I'm super intrigued. Okay, Cooper is a simple girl library to create kubernetes operators and controllers. Ooh I was just talking about how I wanted one of these the other day, so Cooper's a set of utilities and packages as a library framework. Okay, so I want to point this out, because I have strong opinions about this. This is like the best github repo ever because it tells me like in the first sentence, what it is like: it's not some nebulous thing.

A

It actually says concretely, it's a library or it's a command-line tool or it's a rest service. So thanks Cooper, you guys are doing it right and it looks like they have a they're using Microsoft's brigade. They have a makefile. They have a good ole hack directory- oh my god, I love when I see an examples directory in a repo. It's like my favorite thing ever okay. So this is how we're really gonna learn about what this repo can do. They have command.

A

We found our main awesome, and this just looks like a controller that you've seen in the kubernetes code. Okay and I. Think Joe already did a TGI K on these, but this looks like it's just making it way easier. I would really like to do a TGI K on creating a controller with Cooper now, because this looks really exciting.

A

Okay, let's see what is next I, don't know. Oh yeah, so I wanted to show this other one. So this was what Aaron was demoing on the community call this week. This is a new thing called Pratt Kate Co Mateus says, while I'm playing with Cooper right now at joe says, increased font size on github. So that's way too big okay.

A

So this is the new prowl thing which this is pretty cool because it's got this command help. So this is like the live documentation of all of the fancy. Kubernetes commands that we see in the repos all the time when I saw this I was like. Oh, my gosh I want to come and live, read all of these and see all the cool stuff. We can do because it's like IRC all over again- and this is what jesse was saying on the community call, because we have like slash woof and slash bark.

A

Oh man, those commands seem rough. Oh wow and /lg TM. We have retest tests, all which is pretty handy for anybody. Who's ever worked in a kubernetes repo before you know that I can get pretty noisy pretty quickly. So this is awesome if you guys want to come check it out, it's called prowl and it looks like it also has information on the configuration for each of the repositories and kubernetes as well. So that's pretty rad.

A

How do I get out of that? Our next one. Somebody on Twitter just mentioned this. It looks like our friends over at Google are now supporting GPUs, which is exciting because everybody knows ml is so hot right now, so I think we can get GPUs in gke which, like damn gke, doing it first again good job guys uh coming up next I wanted to talk about helm summit.

A

I've heard a lot of people talk about it and I actually haven't even really looked into what it is, but I found this today on the internet and I think this is going to give us a good idea of what we can see at the helm summit this year. So it's like a whole conference style track. It looks like it's single tracked: let's see what they have going on, so we have a breakfast and then we're talking about managing different environments using a helmet art that sounds pretty cool.

A

There's a new helm operator, so I think we're going to get more into operators and controllers later, because a couple of different people have mentioned operators and controllers in helm. Oh I, wonder if we could use Cooper for that, that would be cool. Ooh locky is doing a presentation on securing helm and I can have services with Aaron. So I used to work super closely with these guys so like getting to see their names is exciting. I missed them a lot. Let's see what else do we have that looks exciting?

A

Can you keep a secret, a partial, practical discussion about protecting helm secrets, tiller CRD and a controller that sounds pretty awesome. I would go see that one, so this is cool. This is like a whole like summit dedicated to helm and I. Guess I guess we'll talk about a little bit what helm is and what it isn't a little bit later and we'll keep going through news right now. So next, up on the news board, we have hefty o ark. We released version 7.0, let's see what our new features are.

A

We can now run the ark server in any namespace, which is cool I just found out recently that Ark runs both as a command line tool and as a server. So that's pretty rad out ability to delete backups and their associated data support both pre and post backup. Hooks, oh, is that like a way where we can like hook in and run arbitrary logic, Chris short, what's a hefty Oh, umm I'm gonna answer that actually, but I'm gonna put it at the end of my notes here, because that's a really good question.

A

Yeah, so what is this source code look like and.

C

This is what I do I like.

A

Instead of actually reading what something is I'm like, let's just go, look at the code. Oh it's just like a coconut. You suck, okay, cool.

A

Awesome cool, so you can add an extend arc. That's super handy! Also in kubernetes we release version 1.9 dot, three I'm gonna, pull that up and take a look as well.

B

A

I think there was one dot. Yeah 1.88 was also cut this week. uh Changelog there's gonna be a ton of releases release notes, like always so I'll try to go quit here.

A

We have some work on CR DS calico was bummed, looks like there was a bug fix, configurable a TT compaction frequency exposed metric server. Ooh, that's gonna, be handy, cube, API server, fixing loading of admission control, config file, sweet, o, fixed encryption, key encryption provider, rotation, that's cool, I love how fast the kubernetes codebase like really truly evolves. It's so fascinating to watch this thing. It's always like a live like you can go like have a cup of coffee and come back and kubernetes has changed awesome.

A

So anyway, that's all the news. I have I'm gonna answer chris shorts question on what is a hefty Oh Jo Craig could probably answer this better than I can I just know that there is hepped came from seven, which is the seven sides of the kubernetes wheel, which is intentionally designed not to fit well in any space which makes me super happy inside because anytime, you control somebody using euclidean geometry. That's pretty!

A

Rad cool, so let's move into two helm sarcasm as a service, yeah I'm sassy didn't Shh, so sweet Cupid corn has our cluster up and running. It looks like we have some nodes up and running and let's see, no resource is found. Okay, so completely vanilla, kubernetes cluster, also I'm gonna be doing some weird command line, e short cutting stuff, so I guess I'll show you guys.

A

My alias is now I have a CH 4 helm and oh hi, Olli Olli from Sweden and I have K for Quebec dual and then I have a ton of other like cops stuff. From back when I used to contribute to cops and I. Think, that's probably all you guys need to know. Oh this is my favorite alias ever because I can just type shrug and it'll just copy the shrug e to my clipboard, which is pretty handy okay.

A

So anyway we have kubernetes up and running. We have two nodes: Quebec tolls configured. We can talk to our service or talk to our API server and let's see what goes and happens when we run helm, helm command not found. So let's go and let's look at the helm, repo and let's talk about what helm is and where it came from and why it exists and everything. So, let's get a new browser up over here and I should be able to go BAM and P BAM and, of course, I have mountains.

A

For my background on my Google Chrome empty tab, github.com slash, kubernetes, slash, helm, the kubernetes package manager, the first time I learned about how I think was like the week before I was interviewing ideas and I was like I, better go figure out what the thing is before I go and talk to these people who I'm pretty sure like wrote the source code from the ground up. Oh and let me go back to you, two really quick to make sure I can see what people are saying.

A

Gabrielle says: TGI K on Cait storage, anytime soon uh I'm down. Let's do it! I can do a lot of these now, stealing TGI K from Joe, so the kubernetes package manager and I was like researching it, trying to figure out what it is and I think. The first thing that really ever jumped off at me was when I saw my first helm install command. Is there one here? There I think it used to be on the front page way back when I know, there's a docks yeah.

A

Let's look in here in Docs, there's installed, there's charts I think it might be charts that inde, let's see, is there at home, install right here, uh uh helm, install and then some arguments.

A

History of have do name, I, think that might be Joe. Could you share the history of hub? Do name uh I really want to find one or it's like helm, installs, stable, Mike, sequel or something anyway.

A

I can show you guys in my terminal once we get up and running, but I remember seeing that online where it said helm, install stable, slash, my sequel and I was like: oh I get it now, it's just like yum, it's just like apt to get it's just like all these other package managers I worked with before and then of course, I was like, but what in the hell is like going on or heck I don't know can I swear on here?

A

What in the heck is going on behind under the covers um so anyway, helm has written and go. Let's look and see, it's got two hundred and seventy two contributors, Matt butcher, Adam Michelle a lot of oh gosh, Matt and miss you. A lot of people knew Brandon. Phillips have contributed to this quote. So, let's figure out how to install this thing and let's take it for a test drive so install. We want to install for OS X, let's download it and let's change directory home, make dirt I'm, not gonna. Show you guys.

A

What's in my home directory sorry and let's move downloads, Aaron Schlessinger says you bleep now, just kidding or Jesse says YouTube bleep, not just kidding in an Aaron set. You should have gone with what in the helm? Oh my god guys so much I feel like I should just do like a seal. Club, really quick, just for like old times sake um anyway, so I'm gonna move downloads. What was this thing called? It was called helm that thing we want to move it right here and then look I, don't even need to look up.

A

My thar commands y'all, that's how you know I'm a true thought, leader in the Linux space helm and let's see okay, okay. So this is one thing that has always bothered me about helm.

A

Is that it kind of breaks the entire magic that I expect to be there, which was I untied a tarball called helm v2 and then it got created in a directory called Darwin amd64, which, if I, did that in my home directory with all of my other noise in there, that would have been really hard to know, but that's probably just reflection of me not knowing tar as well as I thought, I did whatever. Anyway, if you go into Darwin amd64, we have a readme and I think this is pretty similar to what you see.

A

Yeah I think this is almost verbatim what you see in the github repo. What else do we have in here? We have a license which I'm assuming that's Apache, let's see yep good ol Apache, and what else do we have? We have our helm executable. Let's make sure that works, awesome, so I'm gonna move this and to use your look open help and, let's see who it works. So I can go to my home directory run home and I'm gonna go back into TGI K, and this will be where we're working out of today.

A

You can tart. This is why I love Jessie, you can't are stripped components, one and it'll fix that problem jessie and then it removed the first stir. Well, I am so happy right now, okay, so we have helm installed.

A

Everybody is like brew, install kubernetes, home uh Ralph Willis for Mac, there's good old brew, install Cabrini's helm as well. So I guess my question here, and maybe you guys can answer, is if I, let's actually look and see, I want to know what bruins, if brew, installs something different than what the repo installs so helm. Or how do you do a version? Okay, you can just do helm version, so helm version, Oh gross, oh it's hanging what's going on here cannot find teller. Oh I was looking for a tiller pod.

A

Okay, that makes sense and I said gross ooh what'd. You do to my terminal, not because it was doing anything bad, but because I want to pipe it to JQ, oh dang, so that it was pretty colors, let's get tiller online, and then we can private digit to JQ um your regardlessly cuz. That's a word we're running two point. Eight point: oh so, let's move use your local Ben helm to we'll put it back in TGI K for now uh home, we'll call it from repo.

A

And now, let's brew, install helm and see what we get Helmand, it client only from Barrett. What is Barrett, what is Helmand it client only do you.

A

Brew headache Cabrini's home to see the homebrew file no formula with the name, helm, I, hate I, never use homebrew. Do you like? Do you like brew, update cask or something somebody tell me what to type I don't want to have to like make a fool of myself brew.

A

What is it brew update?

A

What does this thing? Do?

A

Brooo update, no reason to install from homebrew if you only want to see the version? Okay, that's a good point.

A

Kubernetes home, oh my god, so, okay! This is a good point like all of your guys's chats come in like 30 to 45 seconds after I type, so um bear with me, as sometimes it might be a little bit sluggish okay, so brew, install kubernetes, underbar, nope, home.

A

Hey it's downloading some stuff and then current really, let's see if I can split. My screen. Kurt wants us to do a brew and then I can readjust this edit kubernetes home and see what that does. That's my Emacs startup page Ruby mode requires installation of Ruby. Yes, uh two point eight point one interesting, and can we run it here now so how version two point eight point one.

A

So there is a difference between the two I had a feeling, because I also do that in all of my repos as well, which is cool that the homebrew version is more recent than the three new version. I feel like it's usually the other way around good job home team.

A

Okay, so we'll run with two point: eight point one today. So let's go and let's check out our Docs again. How do I do this bam and bam? Emacs? Yes, kami hacker! You are my soul. Mate. If you also use Emacs, does anything else in cube sphere? Do what helm does Lamade e yeah, so we have a tool called case on it. That will probably do a TGI K on soon. That also does like an abstraction on top of kubernetes primitives and allows you to deploy to kubernetes. It approaches it a little bit.

B

A

If you want to check that out- and if you want to pay me afterwards, we can talk more about it and I can connect with peeps. Here at the have do team. um What was I gonna. Do oh yeah I want to find like the getting started. Helmet helmet hand, pass kick yeah. Let's start here. Okay, helm is a tool that streamlines installing to managing kubernetes applications.

A

Think of it like aptiom homeroom for kubernetes. It has two parts.

A

Joe says, helm and case on are complementary: yeah. They they should run in tandem, are in concert with each other, so helm has two parts: a home, client and a helm. Sir ver, the home client is called helm and the server is called tiller, tiller yep. This is, like my diet. Coke add like be like Chris Nova, drink diet, coke tiller runs inside your kubernetes cluster and manages releases installations of your charts, whereas helm runs on your laptop / CI CD / wherever and the heck you want to run it a chart is a help.

A

Akka jatt contains at least two things a description of the package, which is the chart with a capital, C AML and one or more templates which contain kubernetes manifest files which these are like good old kubernetes, manifests that we see all over the wild. You know like deployment yeah mol, a stateful set um all that kind of stuff, Joe says I, don't know. If what does Joe's look? Weird, maybe he's just messaging me.

A

Anyway, these are the manifest you see everywhere. Oh Joe already did a TGI KNK sign. This is hard to like try to have a linear this line of thought on one page and still read everybody else on the other page. So let's get a chart up and running. This is where I think the rubber meets the road, and this always helped me out a lot when I was learning about helm. So there is this kubernetes slash, charts repository, let's see if we can't Shh. Oh it's trying to actually go there.

A

This is where a whole team of people I know lucky is one of the maintainer 'he's here, I, don't know who else, or at least he used to be I, know a handful of people like watch out for this repo and that what isn't is a nice table directory and here in stable? We have like all of these prefabricated home charts for all of these things that we, software engineers might want to use and compose our apps with or against, or whatever. Let's find a good one I really like to do.

A

Wordpress yeah, 'la Maddie, we're gonna, look at what a chart is once we install one of these things and people are still talking about case on it. How does helm first draft? Oh my gosh, I love these questions. I feel like I'm at Microsoft again, so draft helps you deploy an app to your app to kubernetes, really quickly and really awesomely, using build packs Hellmann's via tooling, that actually packages up your chart and then it takes that and deploys it.

A

Alright, I guess it takes a prepackaged, try it and goes and deploys it, but yeah Sean. If you want to, there are some people in the chat, I think I saw Aaron in here. He could probably help you find better resources on helm versus draft, so yeah, let's go back to WordPress over here. So we have. This is the command I was talking about earlier. This is the one where I was like I get it. I know what helm is, and this is actually the chart I'm in a well. Actually you guys well.

A

Actually this is the chart that we will be installing if we run this command on the command line and we're gonna. Do it in just a second, but let's take a minute and let's talk about what's going on in this chart and how helm is going to be sort of interpreting and then later deploy in this chart. So the first thing that we saw in the readme was this Oh, so critical capital chart AML file and you can tell like this one alone: it's it's got 18 contributors, but it's 21 lines long.

A

So a lot of attention goes into this file. I. Think it's a critical component of defining your helm, chart and I. Think if I remember correctly, it's a lot of maida information that makes the chart yeah. So it's got like a description and it's got like it's super awesome, icon and stuff, and it's even got keywords. So this is like really taking the the package management stuff and really defining all of the cool components of what this app is and that's important to engineers using this.

A

So if we go back here, we can look at the templates directory, which was the second thing. Not all of these charts needed to be considered a chart. So in here we have these kubernetes resources again like we have deployment um all we have an ingress tamil. We have a PVC and secrets in a in a service, so I think probably the easiest ones for us to start are gonna be deployment.

A

So this is like the same deployment objects that you would see in the kubernetes documentation. But if you look, we also see this templating language here and I'm gonna. Just take a quick moment to like pull up this go for con talk. I did go for con Chris Nova, just so that I can demonstrate that what I talk about in this talk is a completely different use case of text template than helm uses, so I very much think that text template. This is my opinion for what it's worth I.

A

Think text template is the perfect thing to use here and I. Think it's a great idea, because we're interpreting at runtime not I, can't compile time. This whole presentation is me complaining that you shouldn't be using it at compile time, because then you get into interpreted language problems. This is a really good idea in my mind. So anyway, there's this whole package in go called text template and see if we can pull it up here, text template going.

A

Yeah so import text template, and it is this sort of like standardized it's in the standard library. So it's a standardized way of templating out text files and then parsing them and reasoning about them. The one thing that's really cool about text template is it's got this concept of functions, so you can actually call functions from your templating code and you can make those functions.

A

Do anything that the go programming language can do so you can actually put function, calls in your plain text files and then make them do like really cool things and get interpreted dynamically, which is what helm is doing here with this deployment file. So here we're calling in the template function and we're passing in the argument, full name and then I think that period is important.

A

Although I can't remember what for Chris you're also talked no I, didn't pull it up to make me seem cool, I pulled it up because, like I spent so much time, like kind of saying, stay away from text, template and I just want folks to know that. There's a big difference between using text template to interpret text files, which is like exactly what helm is doing versus like using text template to basically write your source code for you and then attempting to compile that the go compiler gives us all this wonderful, like input into.

A

What's going on, and whenever you stick text template in there. You kind of like sacrifice all the goodies that the go compiler gives us Shawn done, helm injection attacks, Oh we'll get there I want to pull that that repo up as well anyway as we go through here, we can look and we can see that we have a kubernetes resource. We're like we're, defining our replica count and we have our template. We have some arbitrary labels here, but this template full name keeps appearing over and over again.

A

So what I want folks to see is up here in the values yeah Mille. We have all of these key value pairs to find any amel and I bet if we grabbed for a full name. Full name is not in here, but it's just named that full name is like Matt or something.

A

Maybe I don't know I'm not finding full name in here. Let's find a different directive and see if we can't match it. Oh.

A

It's because of the values got it okay, so template means it's coming from something else and then, if you see dot values, that's right now! This is all coming back to me. I haven't like actually written a home chart and so long, if you see dot values, and then you see a directive after that, that's telling us it's coming out of that values file. We just looked at so we had what was it values image so now we should be able to go into values, dot, yeah mol. This is all connecting now and we're about.

A

We find image in here yeah. So it's the first directive defined here in line four and that's the the name of the image and.

C

A

Does is it sort of like replaces said in the sense that, like now, every time you put in values dot image, it's gonna interpolate that at runtime not at compile time into this into this kubernetes manifest. So we can come in and we can define like logic like we have this if statement here. So if you know there's some condition called Maria DB enabled we're gonna. Add a value to this kubernetes manifest. So in a weird way.

A

Helm is like using text template almost as a turing-complete programming language to generate a dynamic kubernetes, manifest based on arbitrary input, either from values y amal or we can override that which we'll look at a little bit later once we start deploying wordpress.

A

So let's go ahead and let's take this for a spin.

A

Helm, install stable wordpress could not find teller I did that on purpose by the way you guys so Ralph Willis one thing to remember: helm, installs with complete global cluster access by default, fine for secured local clusters, but def secure config before using in yo random cluster.

A

Okay, thanks for the input Ralph, so it looks like helm, is using the Cobra command-line package, which is where we're getting all of this output, from so big shout-out to my homeboy Steve for writing and creating Cobra and shout out to all the Cobra maintainer z' other than Steve, who keep that package alive and awesome to this day, which there's a good handful of you. uh So we want to initialize tiller what Oh Hellman net okay. What does this thing do how a minute initialize helm on both client and server so helm in it?

A

Let's just do help. There are all of our lovely flags and let's see what this thing does Hellman it help this command: installs, tiller, the home side, server component onto your kubernetes cluster and sets up a local configuration in home defaults, helm. So real, quick! Let's see if I have anything there, I do not so we're gonna, look and see. What's in that directory after we do a Hellman it, so we can run a Hellman it now.

A

Awesome so it said it created users, Nova, helm, helm repository and home repository cache home repository, local plugin starters, an archive repository animal. This is the exciting part, so it says adding stable repo with URL HTTP, colon backslash backslash, or a forward slash forward, slash, kubernetes, charts, storage, Google, api's comm and adding local repo on local host on port 8080, eight, seven, nine flash charts and it says, helm home which I did not define, has been configured at users, Nova and I.

A

Think if I remember correctly, we could yeah helm hum here would actually display what helm home he could be. So it sounds like we could actually have like different helm homes that we could pass around between the different the different people at our or like, if I wanted, to have one for, like my personal kubernetes cluster and then like my work, kubernetes cluster or like whatever I totally could so, let's go ahead and helm, install stable, WordPress now, as I think tiller has been initialized.

A

Helmet no available release name found: okay, I, wonder what that means: did I typo that should work what's going on here. How do I update helm team helped me? How do oh hell help me? How do I update my releases.

A

All so, let's go ahead and take a look what's going on in kubernetes, why I'm waiting for one of them to respond? Okay, Barrett Harper's, has helm repo list uh looks like we have stable, is here.

A

Helm repo update, oh my god, all they have home, commands. Okay. So let's see we, so we had helm repo list. Let's just do this really quick. What is helm repo do helm, repo, add, let's remove update index chart repositories and then we had a lot of people are saying, helm, repo update.

A

So what does helm repo update help? What does this thing do.

A

Update gets the latest information about charts and respective chart repositories. Information is cached locally where it could be use. My commands account search. Ok, let's try that home repo update.

A

Successfully got an update from the stable charts repository, oh cool, and we got like a handy dandy little like kubernetes logo. Although I think this one only has six sides, so not a seven-second kubernetes logo, a tiller pod might not be ready, is what comb says.

A

Matt says so: Matthew Fisher he's bacon, gobbler everybody. There was this one time when we were at a company outing and that was eating a BLT I'm gonna totally embarrassing. That and I was like hey bacon. Gobbler. Are you God by taking that's my whole story?

A

Let's see that Eric can potentially occur when your clusters are back enabled, but tiller wasn't giving access. So, let's see are what do I want to do? I want to do. K get P o all namespaces okay. So we have tiller running in the cube system. Namespace, which cube system is like the root name space in kubernetes. um What are people saying? What is it the local repo process listing on 80 80 79? Wouldn't they start dying I just want to see if I can even okay.

A

So here we go, config max is forbidden for user system service account cube system default, cannot list config maps in the name space cube system. What's going on here, I have never seen this before.

A

Let's see, let's look at our tiller logs.

A

A

And cubed system, what's going on here, it started tiller, G RPC is listening, failed to get config Matt's tailor says: keep system is my summer home failed to get config Maps, eager, Otter, config maps generated name eager otter is taken, searching again, cannot list config Maps I have no idea what this pot is trying to do right now need to create a tiller user. Give tiller cluster admin access, give tiller cluster I think an access that sounds scary. I am willing to take commands to run in my kubernetes cluster.

A

If anybody thinks they cannot help me out here yet needs permissions. I think there's an equally think our back issue too. So we think it's an our back issue. How do we create a tiller user? I've never done this before I also never had this problem before.

A

Let's figure this out, I am kubernetes, create user. Are that.

A

Too short to paste.

A

We don't want to create a rule binding. We want to create a user user facing roles put in the admin service account for tiller.

A

Oh ding I just got a whole lot of like stuff here. Okay, so joe says, kubernetes helm and see what joe says here page not found. Oh, but I can probably find it. Let's see.

A

Sorry I'm reading right now- oh my god, it's like all like chat vomit coming at me at once, I'm gonna, try, this helm in its service account tiller. Let's see what this thing does: he'll, not found',.

A

There we go that's why.

A

Aaron stalling deployment tiller, deploy invalid value. Edina subdomain must consist of lower alphanumeric characters. Blank blank yeh chat, vomit thanks Ralph, alright I'm gonna. Try to create the service account per Patrick's suggestion here, so we're gonna, create service account, tiller, name, space, cube system.

A

So we're gonna create what have you doing now: we're opening up tiller to the names just the cube system namespace. This is interesting. Quebec will not found.

A

B

A

A

Unknown flag namespace: well, we can do n, I'm, probably running an old version of cube Act, all those what's going on here.

A

I hope people are still typing.

A

For some reason, you had the Unicode byte order character in your pace. Buffer, okay, hold on I want to get this our back stuff set up. First, then we're going to try it again: I'm gonna go with Patrick here, Patrick you in okay, cue, bechtel, create sirs count, tiller and Josh names basis, cubed system; okay, so that is good to go, and then we want to do queue. Bechtel create f where's, this config dot, yeah mall, Patrick where'd. You get this config dot UML for a moment and take a look at it.

A

Is this Joe's link here no kubernetes helm, we want so here's what Joe said. Let's go look here. He said in Docs. There is a.

A

Arabic Don, MD, yeah and then I think I can go bam and bam. So you guys can see ya.

A

Okay, so Joe says I can do keep back to create clustered role binding instead of the ammo file, and it looks like Patrick finally sent me his thing n thanks guys good looking out. So let's go with geo suggestion here.

A

No, that's weird! I! Don't want to do that.

A

Okay, create cluster role, binding tiller cluster role. Cluster admin service account equals Q system dang. Our back must be namespace name.

A

Cube system: that's why tiller BAM! So now, let's look at our pods. Actually I want to take it. P, OH, namespace, cube system. I want to kill this pod and recreate it. So okay delete P, Oh, namespace, keep system, and hopefully I, don't know it's that gonna get recreated.

A

Let's see yeah it's terminating and rerunning good old, kubernetes scheduler, helping me out again so now helm, LS, dang it service account cube system defaults. Can all this config maps in the namespace cube system, I thought I need to do. I probably need a remap. This new tiller pod home, let's see, is there a way to like uninit.

A

Uninstall helm reset uninstall tiller from a cluster. Oh great, now we're still getting in config Maps.

A

Tiller doesn't have the service account so yeah, so I want to reinstall tiller.

A

What I want to do here? Okay, edit, oh I, bet I- can edit the deployment directly.

A

Okay, edit, okay, get deploy and that's gonna be in cube system, so I bet I can edit it here. Okay, edit deployed tiller, deploy, cube system.

A

You guys are getting to watch me. How can kubernetes this is so exciting.

A

Antoine would you be quicker to trash the cluster? Do it again with the service account? What do you mean.

A

I can totally Trash the cluster so Antoine. Are you saying that we need to redeploy helm on a new cluster after we've created the service account? That seems a little bass-ackwards.

A

I'm gonna read this our back thing that Joe said and see. If I can't figure this out. Okay,.

A

So in kubernetes granting a role to an application-specific service account is best practice tiller and role based access control. Here we go. This is what I want to go through. You Bechdel, create service account until their namespace cube system in our back config dot, yeah mole, oh, this seems complicated helm. Why don't you just work for me.

A

Cue Bechtel create.

A

I wish you guys could like when you chatted like I, never know if you're like talking to me right now or me. Like five minutes ago, I'm gonna, try to read this thing and figure out deploy teller in a namespace restrict to deploying resources. Only in that namespace.

A

Might have to Joe's gonna come in and help me yeah.

C

A

C

Right, let's get you going painful for everybody to watch I'm! Sorry, alright! So go back where you had Kubek told edit deployment. That's in your your buffer, yeah.

A

C

Not get so you had the Edit.

A

B

C

So Frank, where it says service account default.

A

C

It gets really warm in here.

A

Yeah I don't see it, it.

C

Should be up the let's see it should be in the template for the for their deployment.

C

B

Just added there, okay, so.

C

Yeah, it should be a peer to I shouldn't be of containers yet so right under image. Pull policy do service account : tiller. At the end of the line.

A

Service account tiller and yeah.

C

I think that's right. Let's see if that works. Okay,.

A

Should we restart the tiller bun.

C

Do a redeployment with it, so you should be fine. Okay,.

A

C

It's not value.

A

C

Darn it this is, this is the problem with the yeah memos that you're not sure really heck to put Oh doesn't.

A

C

The container put it above the containers because it applies to the entire pod.

A

You do so here, yeah.

C

A

Account chili yeah.

C

A

My car back skills are not there.

C

We go okay, cool.

A

A

Okay, so tiller is there and it's been running for eight seconds so.

C

I think you're certain.

A

C

I'll leave you alone, J.

A

Joe to the rescue banks, they.

C

Gonna do a shot of hot sauce, yeah.

A

I know I should totally do a shot of hot sauce.

A

Awesome: okay, so helm install stable, WordPress, yay.

A

Let's see what we got here: okay, so the output, so we got a name, looks like home generated random name for us. We have a last deployed it's in our default namespace and we have a couple of things here that it's created, yeah, hey Joe, also, it looks like I need to watch the teaching okay on our back, so yeah we've created the deployment and we've got a pod. We've got some secrets. We got some config maps. So let's map this to what we have defined in our helm, charts.

A

And then, like now, everybody's chats are coming through on my end, uh so yeah, let's go back to our chart communities, slash, charts, slash, stable, slash, WordPress, I, think that'll work, nope I got it cuz, it's like coop mani, slash, chart, slash, blob or whatever.

A

Stable WordPress, rad, okay, so helm, install stable WordPress. We go into our templates here and it looks like we have our do, which we should be able to now map the interpolated version of this back to what helm just created for us here in our default namespace. So let's get Pio in our default namespace and we should see we have a couple of pods here, but we also want to check out the deployment kay get deploy. I, don't know why I'm doing in default! Cuz it'll!

A

Just do that for me, but whatever so are we looking for the maria DB or the wordpress one.

A

Suite so let this thing k edit, deploy they're both in there awesome. So now we should be able to map this deployment here and actually looking to see what home did for us awesome. So it generated a name for us.

A

It gave us labels to map to our other primitives. We have replicas equal to one. What I really want to look at, though, is the username and password stuff cuz. I didn't define any of that, so I'm curious how helm created WordPress without asking any of my username or password. Ok,.

C

So here we go so this is what happened was.

A

We have allow empty passwords, we have Maria DB root, password, it's listening on 3306 and here's our WordPress stuff; okay, so we have user on example, calm and first-name lastname.

A

Yeah everybody sent Joe one Bitcoin cuz I was just like what in the hell is going on: okay, cool, so.

A

Let's see where our chart is getting our username and password from so here we have database user. Let me close this out of there. We have database password.

A

Okay, so here it looks like we have default is equal to empty string. Otherwise it's going to pull in values, WordPress user name and we have values, WordPress emails, so I bet. If we go and we look here, we can find WordPress user name yep there, it's where it's defined. So if we wanted to I think we could nuke this deployment and/or. This release I think to use proper helm parlance and redeploy this release with some of our flags overwritten at runtime.

A

Oh, my god, Matt Fisher, said one would say what in hell was going on with sunglasses. Okay, so let's do helm LS, which is going to show us all of our releases. So we now have Solomon ocelot and we can do I think helm, delete.

A

Actually, I did I. Have this helm, RM command, but I totally use all the time that is just like this, alias for, like nuking all of my helm releases, which is pretty handy.

A

Okay, so Solomon also added and if we actually I don't want to show you guys what's in my batch profile, I can share the the alias for that on Twitter afterwards, but it's just it just loops over all of the helm releases and does a delete on all of them. Tips fedora, okay, so now I can do to a helm, install stable actually before we do that.

A

Let's get help up on our screen, so we can pass in I think we can pass in a name, yep and I think we can do set here where yeah here we go and it's a string array. So this is like a good old go parlance, so we can come in and do key value to one and key value to okay, so I can come in and I can do helm, install stable, WordPress.

A

Name we'll call this Chris WordPress I can do a set and I can do type helm, RM.

A

Set and we'll see what we want to overwrite here, so we want to do WordPress, username.

A

So we want to do. Wordpress username is equal to Chris and we want to do how do I switch back to Chrome.

A

Wordpress password and WordPress email and that's really all I, probably need to set I think we could come in and set more if we wanted to.

A

Password so plain text, password, there's, probably I'm, assuming there's got to be a better way to set a password here. If anybody from the home team wants to jump in, but we'll just set our password to one two, three four for now and we'll do WordPress email is equal to Nova as kept do dot-com. Oh, we have one two, three, four, five, six to stick with t, gik tradition, read.

A

Wrong type for value expected string, got float64, Oh, cuz it okay, so yeah. This is another thing about the whole interpreted text template anything at runtime is like types are always a little bit weird and it's gonna interpret them as it may so. I think we can cast that to a string and it should fit.

A

Let's see, executing wrong type for value. Expected string got floated to 64. Let's try this actually make it a string yeah that worked okay. So we have a couple more deployments now we have Murray need to be in WordPress again and I bet if we take it, deploy namespace default and we edit our WordPress deployment again. I bet we can come in here and if we search for Chris yep, so our name worked and let's search for.

A

Nova did that work. Yep no vet have do comm right there, okay cool! So now, let's try to figure out how to actually get to the WordPress URL, because I think it created a service and did ingress and stuff for us to to get the WordPress URL note. It may take a few minutes for the load, balancer IP to be available watch the status with. So this is uh I. Think this information here that we're seeing in the notes is defined in the chart as well.

A

So let's go look at the chart and make sure that's the case.

A

Shard dot yeah them all.

A

You want notes where I know this isn't in the templates. Maybe yeah notes, text Marco says: do you have configs for the Emacs somewhere that looks fabulous, F I know what it still to see how it looks like yeah I have a dot? U max! It's in my personal github I think I have a home directory. You probably Jesse's dot files um cuz. You know I store my whole home directory and get because that's the thing that people do I get the WordPress URL, so yeah. So again we're seeing this text template thing.

A

What it's got some conditional logic and then we've got this little range loop, so it's gonna loop over it, but this is what's being processed when we run our helm. Install command- that's generating this here so like this is cool. If you want to like package up your apps and you want to like give, you know somebody an easy helm, install command for running your app and then you can kind of give them some information about how to access it. So this is sort of like putting an abstraction layer.

A

On top of the kubernetes resources, so this starts to look and feel more like an app unless, like you know, a service or deployment a secret, a database, all this other stuff, that's happening under the scenes. So.

A

Let's watch our namespace for a public IP to come up, so that's still pending we're waiting in Amazon and I bet. We can keep cheating this. Oh, this is a minus W. Already there yeah it's already there, so we'll keep watching that. So another thing I wanted to look at now that we've given tiller access to the cube system namespace on our cluster. Is this exploit that somebody pointed out the other day for home? I haven't actually ran this thing before, but I figured. We should just take a look and see what's going on here.

A

And I'm really excited to see what happens at the helm summit this year as well. In regard to this, so we have this helm spoi, and what does it say? This is a really simple docker image that demonstrates whether an attacker will be able to escalate their privileges via tillers gr, PC, API, so I think what's happening is the helm. Client is talking to tiller via G, RPC and I think by default it does not run with TLS.

A

So I think this is just an exploit I'm not going to run this container, because I have no idea what's going on in this thing right here, but I think this is an exploit to show that you could. You could totally manipulate the G RPC tiller API without being an authenticated user, which seems slightly concerning. So what is this docker file doing so it's downloading the helm, tarball and it's saying helm host equals tiller, deploy, okay, interesting, so it's just basically downloading helm and then re running it against it.

A

Okay, so home team, since you're here on the call, have you guys do you guys have any plans for this or what is the future of home? 3, look like for a TLS encryption by default on the tiller, G RPC server and in the meantime, let's see if you have a public IP address still pending yeh Fisher says: yes, I knew that's what you were gonna say: that's why I asked you.

A

Pat McGrath does the helm, CLI just send data to the tiller pod. The tiller pod then does the equivalent quebec dole create apply. I think that's the way. This thing works and I. Think tiller also has its own internal data store and then keep me honest here Matt, if that's not the case, but I think that we track the releases on the tiller side of the fence as well in all of the maida information, with a release right, I thought we could find out. If we went into cube system.

A

We only have the one pod and then we just have our kubernetes at CD, so I don't see a database pod running so if it's due in any caching, it's probably happening internally in that pod.

A

Let's see if we have WordPress, okay, that's still pending, so Amazon's load balancers are taking their sweet time today, let's go and let's look at proxy off won't be enough. If the user has access to the cluster.

A

Let's look at creating her own helmet right where we're waiting for our WordPress chart to come on cuz, let's say: I'm, a user and I've got an application and I want to run it in kubernetes and I want to create a chart. I think helm by default offers a way for you to come in and actually create a helmet straight from the command line. Think it'll stop it out, for you is that not how man it is at home, create yeah I, create a new chart with a given name.

A

So let's go to TGI K and let's make dirt call it chart and let's go into chart and let's do helm, create dash dash, help and see. What we can do here home, create foo will create a directory structure. That looks like something like this, so I can do helm, create, let's call it Chris's app and let's see what we have here. So we have Chris's app okay. So this is going to sub out our default stuff for us too.

A

So if I wanted to make a helm, shard I would just go to like you know, whatever. Let's make one for Cuba corn really quick, go source, github, calm, no Cuba corn. What branch am I on get checkout master? Oh, this is what I was working on and I don't want to save that and let's get checkout B, we'll call this home charge and, let's do helm, create Cuba coin BAM.

A

So now we should have a Cuba corn directory and in here we have chart style. So let's look and see what this thing is.

A

Helm chart for kubernetes, so I could come in and I could define like a description for Cuba corn I could add a name. I could add a version, let's see what else we have here. What is charts I know boy. This boiler stuff is so critical like if I had to actually create animal files. I probably would be slightly deterred here, so in charts, let's see nothing in there. Let's go to templates. So here we have some at Fisher says at David.

A

Most users aren't concerned about downtime of a few milliseconds in case of a panic crash. There's only one available by default. Kubernetes handles to restart policy of the pod.

A

So let's look and see. What's in our notes, stupid you to do okay, so we have like some more text template e stuff. Here we have like some examples of like things you can export and it may take a few minutes for the load balancer IP, to be available. Okay,.

B

A

This is kind of making the assumption that we're gonna be running just like a generic web app and that we're gonna have some load, balancer IP and while we're here in Emacs, navigating this file, I'm gonna take it upon myself to show the other helm.

A

This helm, which was the original helm, which is the Emacs helm that I've been using it for years and years and years, which is how I navigate my file system within Emacs after it's running, so we can also look at. We looked at notes text. Let's look at purrs, TPL I have no idea what TPL is Oh.

A

Joe says it looks like kids created an LP and there's own different from your known some. This configuration with a cubic horn. Oh I, think this is probably our cloud provider issue. The cloud provider and Cupid chords. Don't really work. Okay, I can go in and manually configure that ELB then do two. This is why I should have used the hefty Oh AWS QuickStart for my cluster, but let's keep looking at at these files and then we'll move back over to our ELB and thanks for the tip Joe.

A

Okay. So we have these TBL files. What else do we have? We have ingress TM on service, dog, ml and I think these are just yeah default q brunette ease resources. Let's see service die animal yeah, okay cool, so the keone gives us a starting place and I bet. If we look in values that yeah Mel there's just going to be some example key value pairs here as well yeah, so we have looks like we have nginx configured. We have some service you stuff configured ingress as well, okay, so this is cool.

A

It gives you kind of a starting point for running like a basic web app in kubernetes cool. So now, let's go. Do some AWS black magic and see if we can't actually I don't want to manually. Do this I'm gonna take this upon myself to open up an issue and keep it going for cloud providers which I think there might already be one, but we cannot just open one anyway.

A

Creates you'll be in the wrong zone.

A

Okay, we tried to create- and you know be- it was the wrong zone and we look at the cloud provider implementation here. Okay, so I'll take a look at that. I really want to do a TG I can keep according to so this would actually might be a good one for like me to fix this, and then we can come in and do a TGI K there as well.

A

So let's go back and we have our one deployment running here and I want to do a little bit of exploring our helm repositories because I think with helm. You can also set up your own repositories as well, so by default we have the charts repository, which is what we saw when we initialized helm and in here we have stable and we have incubator, I, think the incubator. These are all of the packages that are like, for whatever reason considered not stable and I.

A

Think the stable ones are the ones that are a little bit more hardened and field tested and battle tested that are production, ready, Justin, says I would love to see a TGI K on Cuba, corn, yeah I. Think that's a good idea. I think I should fix this cloud provider bug and then totally do a TGI K on cluster API and cloud provider e things in Cuba, corn, dope, dope, so yeah repositories. So let's figure out how to list repositories.

A

We looked at this earlier, so we can do helm repo list and right now we have stable, which is what is this is the kubernetes charts? Google API is calm and we have local, so I think there's got to be a way. It looks look at the docs where we could actually create our own repository that we could use internally as on our organization.

A

So, where Doc's chart repository, let's see what we have here, the chart repository guide. This section explains how to create and work with helm chart repositories that I have level chart, repose a location where package charts can be stored and shared prerequisites. We've gone through the quick chart and we kind of know what a chart or we've gone through the QuickStart and we kind of know what a chart is so I think we're probably good there so to create a chart repository.

A

It's an HTTP server that houses an index that yeah mol file and optionally some package charts when you're ready to share your charts. The preferred way to do so is by uploading your chart to a repository okay, so just like with apt-get or yum like you could have like the official community standard repo, but you can also have like your repo as well. It looks like people are talking, Pat says at Fisher, but if the CLI is just that he dated to the tiller pod using to your Pyrrhus he as chris mentioned earlier.

A

How does our back get applied? I can understand our back. You apply for the tiller pod curious. What Matt says there so the chart repository structured. So it's an HTTP server and if we go to our HTTP or HTTPS, it looks like server. We expect there to be a charge directory and in the charts directory. We expect there to be an index that um all and then we have some tarballs.

A

What are these tar balls now, in the case of an index file containing information about one chart, the Alpine chart and provide the download URL for that? Okay, so these are tar balls of the chart, so this would be a tar ball of like. Let's look at the word press one again of this directory here. Okay, the index file is a yellow file called index and lit contains some metadata about the package, including the contents of a charts chart AML file, a valid chart.

A

Repository must have an index file and this is an example of one here. Okay, so it's another yamo file and we have this directive called entries and in here we have alpine and we have engine X. So this is a lot of Yi animal for us to be defining but I think it's gonna encapsulate all the things, but we're going to need to what a chart is and what it means to us.

A

So there might be a little bit of an exercise of going through and writing out one of these index dot, yeah Moe files, so that you could go and create your own helm, repository interesting, hosting chart repositories. Okay, so it looks like we can also host these with Google, Cloud storage and github pages. So that's pretty handy, so I think I could go in and I could create a helmet for Cuba corn and we could deploy it from one of these Google Cloud storage repositories or from github pages or I'm.

A

Even thinking we could do an engine X server running in kubernetes, with an.

B

A

Actually, host our helm repository within the same kubernetes cluster that helm is running I, don't know if that that kind of actually I don't know, seems like an interesting pattern um cool what is managing chart repositories now that you have a charg repository I'm, basically just reading Doc's online at this point, but I kind of want to see what we can do here. Cuz I might want to set up a repo for Cuba corn.

A

If that's gonna help people get a Cuba corn server up and running, but we can store, charts and a chart repository and we can add new charts to an existing repo. Okay. This is all stuff. I would want to do and you can share it with others. Ok cool, so this is what I wanted. So after you build your repo, you can add it here and you can give it a name, and then you can see it in repo list. Ok, cool!

A

Are there any other components of home? You guys would like to see today. Let's just see what else we can find here. If anything jumps out at us, we have helm lint and wonder what helm length is. Let's see, can I do home, lint, stable, WordPress no chart found for linting missing, chart I animal I bet that was looking locally. Oh.

A

Hell naw thats a good one, I use that in the past so helm search. We can actually it'll do keyword, search for all of our configured repos and look those up. So if we do a home search word yeah, it's gonna find stable WordPress and if we do a home search, let's just do okay, so we have Stangl or stable MongoDB and stable MongoDB replica set. So it looks like we have like helm search. We can add repos. We can delete repos we've discovered that tiller needs to be authenticated.

A

If you have our back configured thanks Joe for helping us out, we've gone through and we've seen that you can delete a helm, release and reinstall it, you can do helm set to override the values Gamal at runtime and we've seen that you can create your own chart and host your own repository. If you choose to package up your own.

A

Applications using home, so I think that's gonna, be all I have for today. Forty gik, unless anybody has anything else, they'd like to see, looks like Matt and Pat are still going at it in chat, and if anybody has anything else, feel free to jump out at me, Pat says: helm, CLI, I, don't think. There's a CLI.

A

There is no CLI sub command, I, don't know what you're saying Pat, okay well I! Think that's all we have for today. So thanks everybody for coming in next week on t GI k, I think either joe and I are gonna, do it thanks Chris and Joe from Taylor I'm, not sure what we want to do. Maybe I can do my cubic or next week. Maybe we can get Joe back in here. It's always exciting on TGA K. So thanks for stopping in everyone.