helm项目管理

一、部署与helm基本操作1.源码二进制方式安装 Helm 配置 bash 命令补全[rootmaster ~]# wget https://get.helm.sh/helm-v4.1.3-linux-amd64.tar.gz#下载 Helm 二进制压缩包Helm 是 K8s 包管理器[rootmaster ~]# tar zxf helm-v4.1.1-linux-amd64.tar.gz[rootmaster ~]# lslinux-amd64[rootmaster linux-amd64]# cp -p helm /usr/local/bin/#/usr/local/bin/系统全局 PATH 目录放在这里任意目录敲 helm 命令都能识别,把 helm 二进制程序放到全局命令路径完成 helm 主体安装[rootmaster linux-amd64]# echo source (helm completion bash) ~/.bashrc# helm completion bashhelm 生成 bash 命令补全脚本# source ()进程替换直接加载补全脚本# ~/.bashrc追加写入用户家目录的 bash 配置文件永久生效#实现 helm 命令 Tab 自动补全[rootmaster linux-amd64]# source ~/.bashrc#重新加载 bash 配置文件不用重新登录终端立刻启用补全功能2.在线安装 helm-push 插件[rootmaster ~]# helm plugin install https://github.com/chartmuseum/helm-push --verifyfalse [rootmaster ~]# helm plugin listNAME VERSION TYPE APIVERSION PROVENANCE SOURCEcm-push 0.11.1 cli/v1 v13.添加仓库与安装chart生成 release[rootmaster ~]# helm repo add bitnami https://charts.bitnami.com/bitnami# 添加 bitnami 仓库最常用的Helm公共仓库[rootmaster ~]#helm repo list# 查看本地已经添加的仓库[rootmaster ~]# helm search repo bitnami/nginx# 在本地仓库索引搜索bitnami下的nginx相关[rootmaster ~]# helm search repo bitnami/nginx -l#-l--versions列出这个 chart所有可用版本默认只展示最新版[rootmaster ~]# helm install webserver bitnami/nginx#webserverRelease 名称本次部署实例名 #bitnami/nginxchart 包 #安装后自动生成 Deployment、Service 等一堆资源helm status webserver#查看这个 release 的状态、版本、NOTES 信息helm list -A#列出当前命名空间下所有 release加-A看全命名空间helm uninstall webserver#卸载 release删除这一套 K8s 资源卸载后helm list就看不到了helm pull bitnami/nginx#指定版本下载 helm pull bitnami/nginx --version 23.0.3helm pull把 chart 压缩包.tgz下载到本地不安装适合离线部署、改 values 自定义helm install直接从仓库在线安装 charthelm pull只是下载 chart 压缩包到本地不部署命令作用helm repo add添加 chart 仓库别名和地址helm repo list查看已添加仓库helm search repo xxx本地索引搜索 charthelm search repo xxx -l列出 chart 全部版本helm install 名字 repo/chart安装生成 releasehelm status 名字查看 release 详情helm list查看 release 列表helm uninstall 名字卸载 releasehelm pull repo/chart下载 chart 包到本地4.通过pull把 chart 包下载到本地不安装后续本地自己安装[rootk8s-master ~]# helm listNAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSIONwebserver default 1 2026-10-24 00:10:24.212724556 0800 CST deployed nginx-22.1.1 1.29.1[rootk8s-master ~]# helm pull bitnami/nginx --version 22.1.1[rootk8s-master ~]# ls公共 文档 anaconda-ks.cfg ceph-csi-3.17 cri-dockerd ingress-v1.5.1 loadbalancer.yml nginx-22.1.1.tgz webserver.yml[rootk8s-master ~]# tar zxf nginx-22.1.1.tgz [rootk8s-master ~]# cd nginx[rootk8s-master nginx]# vim values.yaml#更改参数13 global:14 imageRegistry: reg.LLJ.org25 allowInsecureImages: true292 podSecurityContext:293 enabled: false294 fsGroupChangePolicy: Always295 supplementalGroups: []296 fsGroup: 1001317 containerSecurityContext:318 enabled: false319 seLinuxOptions: {}320 runAsUser: 1001321 runAsGroup: 1001322 runAsNonRoot: true323 privileged: false324 readOnlyRootFilesystem: false325 allowPrivilegeEscalation: false326 capabilities:327 drop: [ALL]328 seccompProfile:329 type: RuntimeDefault[rootmaster nginx]# helm install webserver /root/nginx#告诉 helm不要去 bitnami 仓库下载直接读取本地这个目录里的 chart使用你修改后的 values.yaml部署 release 名字叫 webserver如果此时还写helm install webserver bitnami/nginx它又会去远程拉原版 chart你刚才改的全部失效tips方式A远程仓库chart用默认values不读取本地修改 helm install webserver bitnami/nginx 方式B本地chart目录加载你改过的values.yaml你现在用的 helm install webserver /root/nginx[rootmaster nginx]# helm upgrade webserver /root/nginx#更新[rootmaster nginx]# helm rollback webserver 1#回退二、学会构建helm项目[rootmaster mnt]# helm create LLJ[rootmaster LLJ]# vim Chart.yaml[rootmaster LLJ]# vim values.yaml[rootmaster mnt]# helm lint LLJ/#检查 chart 语法、yaml 格式、字段合法性只校验不部署[rootmaster mnt]# helm package LLJ/#打包把 chart 目录压缩成.tgz归档包就是 chart 包),名字规则{name}-{version}.tgz[rootmaster mnt]# helm install llj llj-1.0.0.tgz三、学会使用helm仓库1.oci模式a.本主机使用[rootk8s-master ~]# helm registry login reg.LLJ.org --username admin --password llj --ca-file /etc/docker/certs.d/reg.LLJ.org/ca.crtlevelWARN msgusing --password via the CLI is insecure. Use --password-stdinLogin Succeeded[rootk8s-master ~]# cp /etc/docker/certs.d/reg.LLJ.org/ca.crt /etc/pki/ca-trust/source/anchors/cp是否覆盖/etc/pki/ca-trust/source/anchors/ca.crt Y[rootk8s-master ~]# update-ca-trust[rootk8s-master mnt]# helm push llj-1.0.0.tgz oci://reg.LLJ.org/helmrepoPushed: reg.LLJ.org/helmrepo/llj:1.0.0Digest: sha256:c22b06f6419b5d9cf94b8fa573c9f4e3d3b303448cf4be7f32637507496f997eb.其他主机使用[rootk8s-master mnt]# helm pull oci://reg.LLJ.org/helmrepo/llj --version 1.0.0Pulled: reg.LLJ.org/helmrepo/llj:1.0.0Digest: sha256:c22b06f6419b5d9cf94b8fa573c9f4e3d3b303448cf4be7f32637507496f997e[rootk8s-master mnt]# helm install llj oci://reg.LLJ.org/helmrepo/llj --version 1.0.0Pulled: reg.LLJ.org/helmrepo/llj:1.0.0Digest: sha256:c22b06f6419b5d9cf94b8fa573c9f4e3d3b303448cf4be7f32637507496f997e2.chart先安装harbor的2.5.4版本并设定安装模式helm-charts之后的版本没有这个选项1.构建harbor仓库a.安装docker-ce[rootnode3 yum.repos.d]# vim /etc/yum.repos.d/docker.repo[docker]name dockerbaseurl https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/gpgcheck 0[rootnode3 yum.repos.d]# dnf install docker-ce-29.3.1-1.el9 -y[rootnode3 yum.repos.d]# vim /etc/modules-load.d/docker_mod.confbr_netfilter[rootnode3 yum.repos.d]# modprobe -a br_netfilter[rootnode3 yum.repos.d]# vim /etc/sysctl.d/docker.confnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1[rootnode3 yum.repos.d]# systemctl enable --now docker2.安装harbor#生成给证书[rootnode3 ~]# mkdir /data/certs -p[rootnode3 ~]# openssl req -newkey rsa:4096 \-nodes -sha256 -keyout /data/certs/timinglee.org.key \-addext subjectAltName DNS:charts.timinglee.org \-x509 -days 365 -out /data/certs/timinglee.org.crtCountry Name (2 letter code) [XX]:CNState or Province Name (full name) []:ShannxiLocality Name (eg, city) [Default City]:XianOrganization Name (eg, company) [Default Company Ltd]:helmOrganizational Unit Name (eg, section) []:chartsCommon Name (eg, your name or your servers hostname) []:charts.timinglee.orgEmail Address []:chartstiminglee.org[rootnode3 ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/[rootnode3 ~]# cd /opt/harbor/[rootnode3 harbor]# cp harbor.yml.tmpl harbor.yml[rootnode3 harbor]# vim harbor.ymlhostname: charts.timinglee.org# http related confighttp:# port for http, default is 80. If https enabled, this port will redirect to https portport: 80# https related confighttps:# https port for harbor, default is 443port: 443# The path of cert and key files for nginxcertificate: /data/certs/timinglee.org.crtprivate_key: /data/certs/timinglee.org.keyharbor_admin_password: lee[rootnode3 harbor]# ./install.sh --with-chartmuseum3.登录harbor建立charts项目4.添加仓库到本地helm的repo中[rootnode3 harbor]# scp /data/certs/timinglee.org.crt root172.25.254.100:/etc/pki/ca-trust/source/anchors/ca.crttiminglee.org.crt[rootmaster mnt]# update-ca-trust[rootmaster mnt]# helm repo add timinglee https://charts.timinglee.org/chartrepo/chartstiminglee has been added to your repositories5.上传项目[rootmaster mnt]# helm cm-push timinglee-1.0.0.tgz timinglee -u admin -p leePushing timinglee-1.0.0.tgz to timinglee...Done.[rootmaster mnt]# helm search repo timingleeNo results found[rootmaster mnt]# helm repo update timingleeHang tight while we grab the latest from your chart repositories......Successfully got an update from the timinglee chart repositoryUpdate Complete. ⎈Happy Helming!⎈[rootmaster mnt]# helm search repo timingleeNAME CHART VERSION APP VERSION DESCRIPTIONtiminglee/timinglee 1.0.0 v1 use nginx create webserver[rootmaster mnt]# helm search repo timinglee/timinglee -lNAME CHART VERSION APP VERSION DESCRIPTIONtiminglee/timinglee 1.0.0 v1 use nginx create webserver、[rootmaster mnt]# helm install timinglee timinglee/timinglee --version 1.0.0NAME: timingleeLAST DEPLOYED: Sun Apr 26 15:43:45 2026NAMESPACE: defaultSTATUS: deployedREVISION: 1DESCRIPTION: Install completeNOTES:1. Get the application URL by running these commands:http://myapp1.timinglee.org/四、用处对比ChartMuseumcm-pushOCI 仓库helm push 原生依赖需要 helm-push 插件Helm3 内置无插件存储Chart 独立仓库和容器镜像共用 Harbor 项目地址格式helm repo 别名oci://xxx搜索支持 helm search repo不支持 search repo鉴权repo add 时带账号密码helm registry login适用专门做 Chart 仓库、需要检索 Chart企业统一制品库HarborOCI 统一制品仓镜像 Chart 放同一个 Harbor一套平台统一管理不用单独部署、维护 ChartMuseum 服务。Harbor 一个项目既能存容器镜像又能存 Helm Chart减少运维组件。一套权限体系RBAC用户、角色、项目权限共用。比如给开发分配项目只读权限他既能拉镜像也能拉 Chart不用分别在镜像仓、Chart 仓配置两套账号权限。复用 Harbor 全部能力漏洞扫描、镜像签名、复制同步跨机房同步、保留策略、审计日志、HTTPS 证书对镜像和 Chart 都生效。如果用独立 ChartMuseum这些能力要单独搭建。Helm 原生支持不用额外插件推送 Chart 用helm pushHelm3 自带ChartMuseum 必须安装helm-push插件cm-push离线环境容易装失败。标准统一生态统一都遵循 OCI Artifact 规范都有 sha256 digest 摘要用来校验完整性、防篡改。以后 SBOM、策略文件等云原生包也都可以放这里。流水线更简单CI/CD 流水线只需要对接一个制品仓库地址、一套登录逻辑不用写两套推送逻辑镜像推 Harbor、Chart 单独推 ChartMuseum。缺点没有index.yaml索引不支持helm search repo没法本地检索 Chart使用方式改变不需要helm repo add安装时直接写oci://地址。ChartMuseum 是专门用来存放 Helm Chart 的独立 HTTP 仓库服务只做 Chart 仓库不是镜像仓库自动维护index.yaml索引文件 上传.tgz包之后它自动更新索引Helm 靠这个索引实现helm repo update、helm search repo查询。配套插件helm-push也就是你前面用的helm cm-push这个插件就是专门给 ChartMuseum 设计上传用的必须装插件才能推送。存储后端灵活 本地磁盘、MinIO、阿里云 OSS、S3 都可以作为存储。鉴权支持 BasicAuth账号密码、JWT