This commits adds the possibility to back Tiller (or the future
Tiller-less Helm CLI) with any SQL database (only postgres has been
tested so far) to store release information.
The main motivation for this commit was to use a storage backend that
would allow releases larger that 1MB in size (ConfigMap or Secret
drivers don't, because of limits on value size in the underlying etcd
key-value store).
Signed-off-by: Étienne Lafarge <etienne.lafarge@gmail.com>
Co-authored-by: Elliot Maincourt <e.maincourt@gmail.com> (@emaincourt)
Co-authored-by: Paul Borensztein <hi@0x01.fr> (@commit-master)
This adds the `--probe=[true|false]` flag to `tiller`, so that you can selectively disable the following probing HTTP endpoints:
- `/readiness`
- `/liveness`
- `/metrics`
One of expected use-cases of this feature would be to avoid consuming an extra port per `tiller`, which becomes more problematic in the [tillerless](https://github.com/rimusz/helm-tiller) setup.
The default is `--probe=true`, which starts the probing endpoints as before.
Implementation-wise, I intentionally made it so that the number of changed lines is as small as possible.
That is, I opted not to factor out the probes server starting logic into its own function, like `startProbesServer`.
Instead, I just added conditionals to the logging part and the server starting part.
As it isn't easily E2E testable, I've verified it to work by running the following commands manually.
With probing enabled(default):
```
$ ./tiller
[main] 2019/04/06 09:20:15 Starting Tiller v2.12+unreleased (tls=false)
[main] 2019/04/06 09:20:15 GRPC listening on :44134
[main] 2019/04/06 09:20:15 Probes listening on :44135
[main] 2019/04/06 09:20:15 Storage driver is ConfigMap
[main] 2019/04/06 09:20:15 Max history per release is 0
```
With probing disabled, you'll see no tiller is no longer listening on 44135:
```
$ ./tiller --probe=false
[main] 2019/04/06 09:20:07 Starting Tiller v2.12+unreleased (tls=false)
[main] 2019/04/06 09:20:07 GRPC listening on :44134
[main] 2019/04/06 09:20:07 Storage driver is ConfigMap
[main] 2019/04/06 09:20:07 Max history per release is 0
```
To ensure that tiller can disable the probing endpoints, I ran multiple tillers at once, with/without `--probe=false`:
The first test runs three tillers without `--probe=false`.
As expected, it results in two tillers failes due to the conflicting port, as you can see in the message `Probes server died: listen tcp :44135: bind: address already in use`.
```
$ bash -c 'for i in {0..2}; do (./tiller --listen=:$((44136+$i)) 2>&1 | sed "s/^/tiller $i: /" )& done; sleep 3 ; pkill tiller'
tiller 1: [main] 2019/04/06 09:57:49 Starting Tiller v2.12+unreleased (tls=false)
tiller 1: [main] 2019/04/06 09:57:49 GRPC listening on :44137
tiller 1: [main] 2019/04/06 09:57:49 Probes listening on :44135
tiller 1: [main] 2019/04/06 09:57:49 Storage driver is ConfigMap
tiller 1: [main] 2019/04/06 09:57:49 Max history per release is 0
tiller 0: [main] 2019/04/06 09:57:49 Starting Tiller v2.12+unreleased (tls=false)
tiller 0: [main] 2019/04/06 09:57:49 GRPC listening on :44136
tiller 0: [main] 2019/04/06 09:57:49 Probes listening on :44135
tiller 0: [main] 2019/04/06 09:57:49 Storage driver is ConfigMap
tiller 0: [main] 2019/04/06 09:57:49 Max history per release is 0
tiller 0: [main] 2019/04/06 09:57:49 Probes server died: listen tcp :44135: bind: address already in use
tiller 2: [main] 2019/04/06 09:57:49 Starting Tiller v2.12+unreleased (tls=false)
tiller 2: [main] 2019/04/06 09:57:49 GRPC listening on :44138
tiller 2: [main] 2019/04/06 09:57:49 Probes listening on :44135
tiller 2: [main] 2019/04/06 09:57:49 Storage driver is ConfigMap
tiller 2: [main] 2019/04/06 09:57:49 Max history per release is 0
tiller 2: [main] 2019/04/06 09:57:49 Probes server died: listen tcp :44135: bind: address already in use
```
The second test runs three tillers with `--probe=false`.
It results in all tillers running without errors, that indicates this feature is working as expected:
```
$ bash -c 'for i in {0..2}; do (./tiller --listen=:$((44136+$i)) --probe=false 2>&1 | sed "s/^/tiller $i: /" )& done; sleep 3 ; pkill tiller'
tiller 1: [main] 2019/04/06 09:58:18 Starting Tiller v2.12+unreleased (tls=false)
tiller 1: [main] 2019/04/06 09:58:18 GRPC listening on :44137
tiller 1: [main] 2019/04/06 09:58:18 Storage driver is ConfigMap
tiller 1: [main] 2019/04/06 09:58:18 Max history per release is 0
tiller 2: [main] 2019/04/06 09:58:18 Starting Tiller v2.12+unreleased (tls=false)
tiller 2: [main] 2019/04/06 09:58:18 GRPC listening on :44138
tiller 2: [main] 2019/04/06 09:58:18 Storage driver is ConfigMap
tiller 2: [main] 2019/04/06 09:58:18 Max history per release is 0
tiller 0: [main] 2019/04/06 09:58:18 Starting Tiller v2.12+unreleased (tls=false)
tiller 0: [main] 2019/04/06 09:58:18 GRPC listening on :44136
tiller 0: [main] 2019/04/06 09:58:18 Storage driver is ConfigMap
tiller 0: [main] 2019/04/06 09:58:18 Max history per release is 0
```
Resolves#3159
Signed-off-by: Yusuke KUOKA <ykuoka@gmail.com>
As many people have requested and discussed in #3159.
The variable name are kept the same as before. Corresponding command-line flag is named, and description are written, after the existing flag for gRPC.
The scope of this change is intentionally limited to the minimum. That is, I have not yet added `--probe=false`, because it shouldn't be a blocker if we can change the port number.
Signed-off-by: Yusuke KUOKA <ykuoka@gmail.com>
When reading through `cmd/tiller/tiller.go`, I noticed a comment around
`rootServer` mentions the usage of an `init` function. However, there is
no `init` function in this package. Update the comment to be more
accurate.
https://github.com/kubernetes/helm/pull/3183 added a keepalive to the Helm client of 30s period, while Tiller was never configured to permit this, keeping the default minimum keepalive period of 5 minutes, disconnecting any clients which ping more regularly than this.
This commit enforces a minimum that is lower than what Helm is configured for, preventing these disconnections, and thus fixes#3409.
* fix(helm): add TLS params back
During a recent refactor, several TLS flags stopped being processed for
a few of the commands. This fixes those commands, and documents how to
set up TLS.
* fix(tiller): add stricter certificate verification
The older version of Tiller allowed a weaker set of certificate checks
than we intended. This version requires a client certificate, and then
requires that that certificate be signed by a known CA. This works
around the situation where a user could provide a self-signed
certificate.
This adds a new configuration option to Tiller to limit the number of
records stored per release.
Tiller stores historical release information (helm history, helm
rollback). This makes it possible to set a maximum number of versions
per release.
To enable this feature, use `helm init --history-max NNN`. Note that
because of the restrictions on Deployment objects, you will have to
re-install Tiller to add a limit.
Along the way, I found an unreported bug in the Memory storage driver.
This fixes that bug and adds substantially more tests to catch
regressions.
Closes#2332
This change introduces the concept of Rudders - pluggable modules that
Tiller communicates with via grpc, which allow to decouple orchestration
logic from Tiller into separate service.
This commit consists of simple Rudder implementation which does exactly
the same thing as built in Tiller orchestrator - it creates all k8s
objects from provided manifest without orchestrating them.
--experimental-release flag is introduced to enable this behaviour.
This change allows to use the service and tiller outside of the cluster.
Following commits will add Rudder to helm deployment.
Yusuke Kuoka
Étienne Lafarge
SataQiu
Matthew Fisher
Adam Reese
Rimas
mattjmcnaughton
Ben Langfeld
Taylor Thomas
Matt Butcher
Yagnesh Mistry
Remington Reackhof
Adam Reese
Maciej Kwiek
fibonacci1729
sadlil
Manjunath A Kumatagi
adieu
Adnan Abdulhussein
Adnan Abdulhussein
Brian
Jim
Michelle Noorali