Creating packages for Kubernetes with Helm: chart structure and templating

1. Files needed to generate Kubernetes resource manifests. These include templates from a directory templatesand files with values ​​(default values ​​are stored in values.yaml). Also, this group includes the file requirements.yamland directory charts- all this is used to organize nested charts.
2. Accompanying files containing information that may be useful when searching for charts, getting to know them and using them. Most of the files in this group are optional.

• Chart.yaml - file with information about the chart;
• LICENSE - optional text file with a license of the chart;
• README.md - optional file with documentation;
• requirements.yaml - optional file with a list of charts-dependencies;
• values.yaml - file with default values ​​for templates;
• charts/ - optional directory with nested charts;
• templates/ - directory with Kubernetes-resources manifest templates;
• templates/NOTES.txt - optional text file with a note that is displayed to the user during installation and updating.

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    metadata:
      labels:
        app: {{ template "fullname" . }}
        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
        release: "{{ .Release.Name }}"
    spec:
      {{- if .Values.image.pullSecrets }}
      imagePullSecrets:
      {{- range .Values.image.pullSecrets }}
        - name: {{ . }}{{- end}}{{- end }}
      containers:
      - name: {{ template "fullname" . }}
        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
        env:
        - name: ALLOW_EMPTY_PASSWORD
        {{- if .Values.allowEmptyPassword }}
          value: "yes"
        {{- else }}
          value: "no"
        {{- end }}
        - name: MARIADB_HOST
        {{- if .Values.mariadb.enabled }}
          value: {{ template "mariadb.fullname" . }}{{- else }}
          value: {{ .Values.externalDatabase.host | quote }}{{- end }}
        - name: MARIADB_PORT_NUMBER
        {{- if .Values.mariadb.enabled }}
          value: "3306"
        {{- else }}
          value: {{ .Values.externalDatabase.port | quote }}{{- end }}
        - name: WORDPRESS_DATABASE_NAME
        {{- if .Values.mariadb.enabled }}
          value: {{ .Values.mariadb.db.name | quote }}{{- else }}
          value: {{ .Values.externalDatabase.database | quote }}{{- end }}
        - name: WORDPRESS_DATABASE_USER
        {{- if .Values.mariadb.enabled }}
          value: {{ .Values.mariadb.db.user | quote }}{{- else }}
          value: {{ .Values.externalDatabase.user | quote }}{{- end }}
        - name: WORDPRESS_DATABASE_PASSWORD
          valueFrom:
            secretKeyRef:
            {{- if .Values.mariadb.enabled }}
              name: {{ template "mariadb.fullname" . }}
              key: mariadb-password
            {{- else }}
              name: {{ printf "%s-%s" .Release.Name "externaldb" }}
              key: db-password
            {{- end }}
        - name: WORDPRESS_USERNAME
          value: {{ .Values.wordpressUsername | quote }}
        - name: WORDPRESS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: wordpress-password
        - name: WORDPRESS_EMAIL
          value: {{ .Values.wordpressEmail | quote }}
        - name: WORDPRESS_FIRST_NAME
          value: {{ .Values.wordpressFirstName | quote }}
        - name: WORDPRESS_LAST_NAME
          value: {{ .Values.wordpressLastName | quote }}
        - name: WORDPRESS_BLOG_NAME
          value: {{ .Values.wordpressBlogName | quote }}
        - name: WORDPRESS_TABLE_PREFIX
          value: {{ .Values.wordpressTablePrefix | quote }}
        - name: SMTP_HOST
          value: {{ .Values.smtpHost | quote }}
        - name: SMTP_PORT
          value: {{ .Values.smtpPort | quote }}
        - name: SMTP_USER
          value: {{ .Values.smtpUser | quote }}
        - name: SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "fullname" . }}
              key: smtp-password
        - name: SMTP_USERNAME
          value: {{ .Values.smtpUsername | quote }}
        - name: SMTP_PROTOCOL
          value: {{ .Values.smtpProtocol | quote }}
        ports:
        - name: http
          containerPort: 80
        - name: https
          containerPort: 443
        livenessProbe:
          httpGet:
            path: /wp-login.php
          {{- if not .Values.healthcheckHttps }}
            port: http
          {{- else }}
            port: https
            scheme: HTTPS
          {{- end }}{{ toYaml .Values.livenessProbe | indent 10 }}
        readinessProbe:
          httpGet:
            path: /wp-login.php
          {{- if not .Values.healthcheckHttps }}
            port: http
          {{- else }}
            port: https
            scheme: HTTPS
          {{- end }}{{ toYaml .Values.readinessProbe | indent 10 }}
        volumeMounts:
        - mountPath: /bitnami/apache
          name: wordpress-data
          subPath: apache
        - mountPath: /bitnami/wordpress
          name: wordpress-data
          subPath: wordpress
        - mountPath: /bitnami/php
          name: wordpress-data
          subPath: php
        resources:
{{ toYaml .Values.resources | indent 10 }}
      volumes:
      - name: wordpress-data
      {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.persistence.existingClaim | default (include "fullname" .) }}{{- else }}
        emptyDir: {}
      {{ end }}{{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}{{- end -}}{{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}{{- end }}{{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}{{- end }}

Templates

Templates: {{ }}

Context value: .

Helm basic structure

• Field .Values- to access the parameters that are defined during the installation and update of the release. These include the values ​​of the options --set, --set-stringand --set-file, as well as the parameters of the files with values, the file values.yamland files corresponding to the values ​​of the options --values:
  
  

  containers:
  - name: main
    image: "{{ .Values.image }}:{{ .Values.imageTag }}"
    imagePullPolicy: {{ .Values.imagePullPolicy }}

• .Release- to use release data about rollout, installation or update, release name, namespace and values ​​of several more fields that can be useful when generating manifests:
  
  

  metadata:
    labels:
      heritage: "{{ .Release.Service }}"
      release: "{{ .Release.Name }}"
  subjects:
  - namespace: {{ .Release.Namespace }}
  

• .Chart- to access information about the chart . The fields correspond to the file contents Chart.yaml:
  
  

  labels:
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  

• Structure .Files- to work with files stored in the chart directory ; The structure and available methods can be found at the link . Examples:
  
  

  data:
    openssl.conf: |
  {{ .Files.Get "config/openssl.conf"| indent 4 }}

  
  

  data:
  {{ (.Files.Glob"files/docker-entrypoint-initdb.d/*").AsConfig | indent 2 }}
  

• .Capabilities- to access information about the cluster in which rollout is performed:
  
  

  {{- if .Capabilities.APIVersions.Has "apps/v1beta2" }}
  apiVersion: apps/v1beta2
  {{- else }}
  apiVersion: extensions/v1beta1
  {{- end }}
  

  
  

  {{- if semverCompare "^1.9-0" .Capabilities.KubeVersion.GitVersion }}
  apiVersion: apps/v1
  {{- else }}
  

Operators

{{- if .Values.agent.image.tag }}
image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag }}"
{{- else }}
image: "{{ .Values.agent.image.repository }}:v{{ .Chart.AppVersion }}"
{{- end }}

{{- range .Values.ports }}
- name: {{ .name }}
  port: {{ .containerPort }}
  targetPort: {{ .containerPort}}{{- else }}
...
{{- end}}

{{ range .Values.tolerations -}}
- {{ toYaml . | indent 8 | trim }}{{ end }}

{{- range $key, $value := .Values.credentials.secretContents }}
  {{ $key }}: {{ $value | b64enc | quote }}
{{- end }}

{{- with .config }}
  config:
  {{- with .region }}
    region: {{ . }}{{- end }}{{- with .s3ForcePathStyle }}
    s3ForcePathStyle: {{ . }}{{- end }}{{- with .s3Url }}
    s3Url: {{ . }}{{- end }}{{- with .kmsKeyId }}
    kmsKeyId: {{ . }}{{- end }}{{- end }}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ template "kiam.serviceAccountName.agent" . }}
...
{{- define "kiam.serviceAccountName.agent" -}}
{{- if .Values.serviceAccounts.agent.create -}}
  {{ default (include "kiam.agent.fullname" .) .Values.serviceAccounts.agent.name }}
{{- else -}}
  {{ default"default" .Values.serviceAccounts.agent.name }}
{{- end -}}
{{- end -}}

• The declared partials are global and can be used in all files of the directory templates.
• The main chart is compiled together with the dependent charts, so if two partial partial of the same name exist, the last loaded one will be used. When naming partial'a decided to add the name of the chart to avoid such conflicts: define "chart_name.partial_name".

Variables: $

{{ $provider := .Values.configuration.backupStorageProvider.name }}
...
{{ if eq $provider "azure" }}
envFrom:
- secretRef:name: {{ template "ark.secretName" . }}
{{ end }}

context: {{ . }}
dollar: {{ $ }}
with: 
{{- with .Chart }}
  context: {{ . }}
  dollar: {{ $ }}{{- end }}
template:
{{- template "flant" .Chart -}}{{ define "flant" }}
  context: {{ . }}
  dollar: {{ $ }}
  with: 
  {{- with .Name }}
    context: {{ . }}
    dollar: {{ $ }}{{- end }}{{- end -}}

context: #Базовая структура helm
dollar: #Базовая структура helmwith:
  context: #.Chart
  dollar: #Базовая структура helmtemplate:
  context: #.Chart
  dollar: #.Chartwith:
    context: habr
    dollar: #.Chart

{{- if .Values.ingress.enabled -}}{{- range .Values.ingress.hosts }}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "nats.fullname" $ }}-monitoring
  labels:
    app: "{{ template "nats.name" $ }}"
    chart: "{{ template "nats.chart" $ }}"
    release: {{ $.Release.Name | quote }}
    heritage: {{ $.Release.Service | quote }}
  annotations:
    {{- if .tls }}
    ingress.kubernetes.io/secure-backends: "true"
    {{- end }}{{- range $key, $value := .annotations }}{{ $key }}: {{ $value | quote }}{{- end }}
spec:
  rules:
    - host: {{ .name }}
      http:
        paths:
        - path: {{ default "/" .path }}
          backend:
            serviceName: {{ template "nats.fullname" $ }}-monitoring
            servicePort: monitoring
{{- if .tls }}
  tls:
  - hosts:
    - {{ .name }}
    secretName: {{ .tlsSecret }}{{- end }}
---
{{- end }}{{- end }}

Indentation

• {{- variable }} cuts the preceding spaces;
• {{ variable -}} clips subsequent spaces;
• {{- variable -}} - both options.

habr
{{- " flant " -}}
helm

Built-in functions

definitions.json: |
    {
      "users": [
        {
          "name": "{{ index .Values "rabbitmq-ha" "rabbitmqUsername" }}",
          "password": "{{ index .Values "rabbitmq-ha" "rabbitmqPassword" }}",
          "tags": "administrator"
        }
      ]
    }

httpGet:
{{- if (index .Values "pushgateway""extraArgs""web.route-prefix") }}
  path: /{{ index .Values "pushgateway""extraArgs""web.route-prefix" }}/#/status
{{- end }}

{{ ifand (index .Values field) (eq (len .Values.field)10) }}
...
{{ end }}

{{ ifindex . field }}
  {{ if eq (len .field)10 }}
  ...
  {{ end }}
{{ end }}

data:
  openssl.conf: |
{{ .Files.Get "config/openssl.conf"| indent 4 }}

data:
  db-password: {{ .Values.externalDatabase.password | b64enc | quote }}

Additional functions

metadata:
  labels:
{{ include "labels.standard" . | indent 4 }}{{- define "labels.standard" -}}
app: {{ include "hlf-couchdb.name" . }}
heritage: {{ .Release.Service | quote }}
release: {{ .Release.Name | quote }}
chart: {{ include "hlf-couchdb.chart" . }}{{- end -}}

sftp-user: {{ required "Please specify the SFTP user name at .Values.sftp.user" .Values.sftp.user | b64enc | quote }}
sftp-password: {{ required "Please specify the SFTP user password at .Values.sftp.password" .Values.sftp.password | b64enc | quote }}
{{- end }}
{{- if .Values.svn.enabled }}
svn-user: {{ required "Please specify the SVN user name at .Values.svn.user" .Values.svn.user | b64enc | quote }}
svn-password: {{ required "Please specify the SVN user password at .Values.svn.password" .Values.svn.password | b64enc | quote }}
{{- end }}
{{- if .Values.webdav.enabled }}
webdav-user: {{ required "Please specify the WebDAV user name at .Values.webdav.user" .Values.webdav.user | b64enc | quote }}
webdav-password: {{ required "Please specify the WebDAV user password at .Values.webdav.password" .Values.webdav.password | b64enc | quote }}
{{- end }}

containers:
{{- with .Values.keycloak.extraContainers }}{{ tpl . $ | indent 2 }}{{- end }}

keycloak:
  extraContainers: |
    - name: cloudsql-proxy
      image: gcr.io/cloudsql-docker/gce-proxy:1.11
      command:
        - /cloud_sql_proxy
      args:
        - -instances={{ .Values.cloudsql.project }}:{{ .Values.cloudsql.region }}:{{ .Values.cloudsql.instance }}=tcp:5432
        - -credential_file=/secrets/cloudsql/credentials.json
      volumeMounts:
        - name: cloudsql-creds
          mountPath: /secrets/cloudsql
          readOnly: true

apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template"mysqldump.fullname" . }}
  labels:
    app: {{ template"mysqldump.name" . }}
    chart: {{ template"mysqldump.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  backoffLimit: 1template:
{{ $file := .Files.Get "files/job.tpl" }}
{{ tpl $file . | indent 4 }}

spec:
  containers:
  - name: xtrabackup
    image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
    imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
    command: ["/bin/bash", "/scripts/backup.sh"]
    envFrom:
    - configMapRef:
        name: "{{ template "mysqldump.fullname" . }}"
    - secretRef:
        name: "{{ template "mysqldump.fullname" . }}"
    volumeMounts:
    - name: backups
      mountPath: /backup
    - name: xtrabackup-script
      mountPath: /scripts
  restartPolicy: Never
  volumes:
  - name: backups
{{- if .Values.persistentVolumeClaim }}
    persistentVolumeClaim:
      claimName: {{ .Values.persistentVolumeClaim }}
{{- else -}}
{{- if .Values.persistence.enabled }}
    persistentVolumeClaim:
      claimName: {{ template "mysqldump.fullname" . }}
{{- else }}
    emptyDir: {}
{{- end }}
{{- end }}
  - name: xtrabackup-script
    configMap:
      name: {{ template "mysqldump.fullname" . }}-script

Conclusion

• Charts developer guide ;
• Best practices ;
• Go-template documentation ;
• Sprig library documentation ;
• The official charts repository (as a knowledge base and best practices implemented).

PS

• “ Practical acquaintance with the package manager for Kubernetes - Helm ”;
• “ Package Manager for Kubernetes - Helm: Past, Present, Future ”;
• " Practice with dapp. Part 2. Deploying Docker images in Kubernetes with the help of Helm ”;
• “ Build and heat applications in Kubernetes using dapp and GitLab CI ”;
• “ Best CI / CD practices with Kubernetes and GitLab ” (review and video of the report) .