Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Helm chart for Kyverno - #835 #839

Merged
merged 2 commits into from
May 13, 2020
Merged

Conversation

mbarrien
Copy link
Contributor

@mbarrien mbarrien commented May 9, 2020

Adds a Helm chart for Kyverno, as a way to install it instead of https://github.com/nirmata/kyverno/blob/master/definitions/install.yaml. Closes #835.

It is written in a manner that allows it to be installed in different namespaces or with a different name, but because of Kyverno's code hard-coding assumptions about names, it MUST be installed in the Kyverno namespace and MUST be installed with the release name "kyverno"; you will not get a working installation if you use different names.

The chart supports providing generatecontroller resources to add to a default list, and supports creating a self signed cert via Helm.

Other things to point out (that can be reversed if so desired):

  • For the resourceFilters, we deconstruct it into a yaml list, one entry for each filter. For adding to the configmap, we just join them back together.
  • Following standard Helm chart practices, we make the RBAC optional, allowing the user to potentially create their own ClusterRoles, ClusterRoleBindings, and ServiceAccount.
  • Added a name to port 443, "https", and referred to the port by name in the service.
  • Added placeholders for liveness and readiness probes and resource limits; they default to empty.
  • Added support for annotations and labels, in case the user's cluster has org specific naming schemes.
  • Added support for tolerations, node affinity, node selector, and security contexts not originally present in the source yaml
  • Intentionally does not assume a configmap called init-config, instead opting for the naming convention of matching the full release name. If the user already has their own init-config, they can override in the values passed to Helm.

Note that this PR does not address where a chart would be hosted; in theory the chart should be packaged up and hosted in an actual Helm repo and where you want to host it is outside of my scope as an outside contributor right now. There is the Helm stable charts repo, but they have deprecated taking in new charts, instead moving to a distributed model where each org self hosts their own charts. I wrote the README.md to assume local installation from the charts directory.

@shravanshetty1
Copy link
Contributor

@mbarrien
I got a fresh installation of helm. I tried to install kyverno using helm by following the readme instructions, however i could not do it heres a screenshot.
Screenshot from 2020-05-13 00-08-31

@mbarrien
Copy link
Contributor Author

mbarrien commented May 12, 2020

Remove --name; just leave "kyverno" as is on the command line.
For the namespace, Helm 3 either requires the namespace to already exist, or to use --create-namespace flag.
Try helm install --create-namespace --namespace kyverno kyverno ./charts/kyverno

@shravanshetty1
Copy link
Contributor

helm install --create-namespace --namespace kyverno kyverno ./charts/kyverno

@mbarrien It works fine after i tried the above instruction. The tldr and installation section of the readme should be updated appropriately.

@mbarrien
Copy link
Contributor Author

Done.

@shravanshetty1 shravanshetty1 merged commit 6dbaf16 into kyverno:master May 13, 2020
@mbarrien mbarrien deleted the helm branch July 1, 2020 07:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Helm chart for Kyverno
2 participants