microk8sでhelmを使う

毎度、ググっても出てこない小ネタを取り扱っております。
本記事は個人的な見解であり、筆者の所属するいかなる団体にも関係ございません。

# 0. はじめに
MicroK8sはいろいろコマンドが追加されるので、microk8s.helmなんていうコマンドが追加されているのを発見したのでちょっと使って見る。

# 1. helmコマンドを叩いてみる

```
~$ helm
Command 'helm' not found, but can be installed with:

sudo snap install helm
```
まあ、そんなものないって言われる

```
$ microk8s.helm
Helm not available, try enabling it with 'microk8s.enable helm'
```
microk8s.helmを叩いてみる。
enableしろと言われる。

enableした。

```
$ microk8s.enable helm
Enabling Helm
Fetching helm version v2.14.3.
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 25.3M  100 25.3M    0     0  16.0M      0  0:00:01  0:00:01 --:--:-- 16.0M
Helm is enabled
```

kubectl get all -Aしてみたけど、これだけでは何も動いてないようだ。
再度、microk8s.helmコマンドを叩いてみる。

```
~$ microk8s.helm
The Kubernetes package manager

To begin working with Helm, run the 'helm init' command:

	$ helm init

This will install Tiller to your running Kubernetes cluster.
It will also set up any necessary local configuration.

Common actions from this point include:

- helm search:    search for charts
- helm fetch:     download a chart to your local directory to view
- helm install:   upload the chart to Kubernetes
- helm list:      list releases of charts

Environment:

- $HELM_HOME:           set an alternative location for Helm files. By default, these are stored in ~/.helm
- $HELM_HOST:           set an alternative Tiller host. The format is host:port
- $HELM_NO_PLUGINS:     disable plugins. Set HELM_NO_PLUGINS=1 to disable plugins.
- $TILLER_NAMESPACE:    set an alternative Tiller namespace (default "kube-system")
- $KUBECONFIG:          set an alternative Kubernetes configuration file (default "~/.kube/config")
- $HELM_TLS_CA_CERT:    path to TLS CA certificate used to verify the Helm client and Tiller server certificates (default "$HELM_HOME/ca.pem")
- $HELM_TLS_CERT:       path to TLS client certificate file for authenticating to Tiller (default "$HELM_HOME/cert.pem")
- $HELM_TLS_KEY:        path to TLS client key file for authenticating to Tiller (default "$HELM_HOME/key.pem")
- $HELM_TLS_ENABLE:     enable TLS connection between Helm and Tiller (default "false")
- $HELM_TLS_VERIFY:     enable TLS connection between Helm and Tiller and verify Tiller server certificate (default "false")
- $HELM_TLS_HOSTNAME:   the hostname or IP address used to verify the Tiller server certificate (default "127.0.0.1")
- $HELM_KEY_PASSPHRASE: set HELM_KEY_PASSPHRASE to the passphrase of your PGP private key. If set, you will not be prompted for the passphrase while signing helm charts

Usage:
  helm [command]

Available Commands:
  completion  Generate autocompletions script for the specified shell (bash or zsh)
  create      create a new chart with the given name
  delete      given a release name, delete the release from Kubernetes
  dependency  manage a chart's dependencies
  fetch       download a chart from a repository and (optionally) unpack it in local directory
  get         download a named release
  help        Help about any command
  history     fetch release history
  home        displays the location of HELM_HOME
  init        initialize Helm on both client and server
  inspect     inspect a chart
  install     install a chart archive
  lint        examines a chart for possible issues
  list        list releases
  package     package a chart directory into a chart archive
  plugin      add, list, or remove Helm plugins
  repo        add, list, remove, update, and index chart repositories
  reset       uninstalls Tiller from a cluster
  rollback    roll back a release to a previous revision
  search      search for a keyword in charts
  serve       start a local http web server
  status      displays the status of the named release
  template    locally render templates
  test        test a release
  upgrade     upgrade a release
  verify      verify that a chart at the given path has been signed and is valid
  version     print the client/server version information

Flags:
      --debug                           enable verbose output
  -h, --help                            help for helm
      --home string                     location of your Helm config. Overrides $HELM_HOME (default "/home/user/.helm")
      --host string                     address of Tiller. Overrides $HELM_HOST
      --kube-context string             name of the kubeconfig context to use
      --kubeconfig string               absolute path to the kubeconfig file to use
      --tiller-connection-timeout int   the duration (in seconds) Helm will wait to establish a connection to tiller (default 300)
      --tiller-namespace string         namespace of Tiller (default "kube-system")

Use "helm [command] --help" for more information about a command.
```

普通のhelmコマンドが入ったらしい。
helm initする

```
$ helm init

Command 'helm' not found, but can be installed with:

sudo snap install helm
```
間違えた。
間違えたので、aliasを書いておく。

```
~$ sudo snap alias microk8s.helm helm
Added:
  - microk8s.helm as helm
```

動いた。問題なさそう

```
$ helm init
Creating /home/user/.helm 
Creating /home/user/.helm/repository 
Creating /home/user/.helm/repository/cache 
Creating /home/user/.helm/repository/local 
Creating /home/user/.helm/plugins 
Creating /home/user/.helm/starters 
Creating /home/user/.helm/cache/archive 
Creating /home/user/.helm/repository/repositories.yaml 
Adding stable repo with URL: https://kubernetes-charts.storage.googleapis.com 
Adding local repo with URL: http://127.0.0.1:8879/charts 
$HELM_HOME has been configured at /home/user/.helm.

Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.

Please note: by default, Tiller is deployed with an insecure 'allow unauthenticated users' policy.
To prevent this, run `helm init` with the --tiller-tls-verify flag.
For more information on securing your installation see: https://docs.helm.sh/using_helm/#securing-your-helm-installation
```

tillerが動いた。

```
$ kubectl get all -A
NAMESPACE        NAME                                        READY   STATUS    RESTARTS   AGE
kube-system      pod/tiller-deploy-75f6c87b87-b592m          1/1     Running   0          41s

NAMESPACE     NAME                    TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                  AGE
kube-system   service/tiller-deploy   ClusterIP   10.152.183.33   <none>        44134/TCP                41s

NAMESPACE        NAME                                   READY   UP-TO-DATE   AVAILABLE   AGE
kube-system      deployment.apps/tiller-deploy          1/1     1            1           41s

NAMESPACE        NAME                                              DESIRED   CURRENT   READY   AGE
kube-system      replicaset.apps/tiller-deploy-75f6c87b87          1         1         1       41s
```

# 2. tillerサービスアカウントがなってなかった。

helm init時に

```
$ helm init --service-account=tiller
```

としてればよかったのに **`--service-account=tiller`** を付けなかったので、

```
UPGRADE FAILED
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"
Error: UPGRADE FAILED: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"
```

とか言われてしまった。
以下のように直す。

```
kubectl create serviceaccount -n kube-system tiller
kubectl create clusterrolebinding tiller-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl --namespace kube-system patch deploy tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'
```

https://github.com/helm/helm/issues/5100#issuecomment-533787541
これでもよかったかも？

```
helm init --upgrade --service-account tiller
```