search

Typositoire / concourse-helm3-resource

Concourse resource to deploy Helm v3 charts.
35 stars 62 forks source link
ci-cd concourse concourse-resource helm helm3 kubernetes resource

readme

Helm Resource for Concourse

CI Build

Deploy Helm Charts from Concourse.

Heavily based on the work of linkyard/concourse-helm-resource.

IMPORTANT NOTES

Docker Image

You can pull the resource image from typositoire/concourse-helm3-resource. "Dockerhub Pull Badge"

DEPRECATION OF DOCKER HUB

Starting with version 1.25.0, can you can no longer pull this resource from Docker Hub.

Starting with version 1.19.1, you can pull the resource from GitHub ghcr.io/typositoire/concourse-helm3-resource. Docker hub will eventually stop receiving new images.

Usage

resource_types:
- name: helm
  type: docker-image
  source:
    repository: ghcr.io/typositoire/concourse-helm3-resource

Source Configuration

Source options for Google Cloud

Source options for DigitalOcean

Source options for AWS EKS

Behavior

check: Check the release, not happy with dynamic releases.

in: Not Supported

out: Deploy a helm chart (V3 only)

Deploy an helm chart

Parameters

Example

Out

Define the resource:

Generic

resources:
- name: myapp-helm
  type: helm
  source:
    cluster_url: https://kube-master.domain.example
    cluster_ca: _base64 encoded CA pem_
    admin_key: _base64 encoded key pem_
    admin_cert: _base64 encoded certificate pem_
    repos:
      - name: some_repo
        url: https://somerepo.github.io/charts
    env_vars:
      HELM_DRIVER: sql
      HELM_DRIVER_SQL_CONNECTION_STRING: postgresql://helm-postgres:5432/helm?user=helm&password=changeme

DigitalOcean

resources:
- name: myapp-helm
  type: helm
  source:
    digitalocean:
      cluster_id: XXXXXXXXXXXXXX
      access_token: XXXXXXXXXXX
    repos:
      - name: some_repo
        url: https://somerepo.github.io/charts

Google cloud

resources:
- name: myapp-helm
  type: helm
  source:
    gcloud_cluster_auth: true
    gcloud_service_account_key_file: _plain service account json file_ or _path to json file
    gcloud_project_name: _project name_
    gcloud_k8s_cluster_name: _k8s cluster name_
    gcloud_k8s_zone: _k8s zone_
    repos:
      - name: some_repo
        url: https://somerepo.github.io/charts

Amazon EKS using IAM role

resources:
- name: myapp-helm
  type: helm
  source:
    aws:
      region: aws-region
      cluster_name: eks-cluster-name
      role:
        arn: arn:aws:iam::<aws_account_id>:role/<my_eks_role>
        session_name: EKSAssumeRoleSession

Amazon EKS using user

resources:
- name: myapp-helm
  type: helm
  source:
    aws:
      region: aws-region
      cluster_name: eks-cluster-name
      profile: eks_user
      user:
        access_key_id: <access_key_id>
        secret_access_key: <secret_access_key>

Add to job:

jobs:
  # ...
  plan:
  - put: myapp-helm
    params:
      chart: source-repo/chart-0.0.1.tgz
      values: source-repo/values.yaml
      override_values:
      - key: replicas
        value: 2
      - key: version
        path: version/number # Read value from version/number
      - key: secret
        value: ((my-top-secret-value)) # Pulled from a credentials backend like Vault
        hide: true # Hides value in output
      - key: image.tag
        path: version/image_tag # Read value from version/number
        type: string            # Make sure it's interpreted as a string by Helm (not a number)
      - key: configuration
        path: configuration/production.yaml # add path to --set-file helm option 
        type: file            # use --set-file helm option ( --set-file configuration=configuration/production.yaml )
  # ...

Deploying charts from ECR private helm registry using IAM role auth

jobs:
  # ...
  plan:
  - put: myapp-helm
    params:
      private_registry:
        ecr:
          region: us-west-2
          account_id: "01234567890"
          role:
            arn: "arn:aws:iam::09876543210:role/ecr_read_only"
      # region and account_id of the OCI url need to match the configuration in private_registry.ecr
      chart: oci://01234567890.dkr.ecr.us-west-2.amazonaws.com/myapp-helm-repo
      version: 1.2.3-myapp-helm-version
      namespace: myapp
      # limitation: concourse uses EKS deploy role, which does not have permission to create namespace on EKS.
      # for services, namespaces need to be created by service-lifecycle
      # for addons, namespeces are created by terraform from infra repo
      create_namespace: false
      release: myapp
      values: source-repo/values.yaml
      override_values:
      - key: image.tag
        value: oldest
  # ...

Deploying charts from ECR private helm registry using user auth

jobs:
  # ...
  plan:
  - put: myapp-helm
    params:
      private_registry:
        ecr:
          region: us-west-2
          account_id: "01234567890"
          profile: ecr_user
          user:
            access_key_id: <access_key_id>
            secret_access_key: <secret_access_key>
      # region and account_id of the OCI url need to match the configuration in private_registry.ecr
      chart: oci://01234567890.dkr.ecr.us-west-2.amazonaws.com/myapp-helm-repo
  # ...

If helm chart contains lookup function

resources:
- name: myapp-helm
  type: helm
  source:
    env_vars:
      HELM_DIFF_USE_INSECURE_SERVER_SIDE_DRY_RUN: true
    #...
jobs:
  # ...
  plan:
  - put: myapp-helm
    params:
      chart: ...
      show_diff: true
      diff_opts: "--dry-run=server"
      # ...
  # ...