helm安装nginx并配置https

想要使用helm首先得有个k8s集群，k8s集群搭建可以移步k8s集群搭建记录。

创建chart

首先创建nginx的chart包，目录结构如下：

| - nginx/
	| - charts/
	| - templates
		| - configmap.yaml
		| - deployment.yaml
		| - secret.yaml
		| - service.yaml
	| - Chart.yaml
	| - values.yaml 

charts文件夹是存放chart依赖的子chart，如果没有的话可以为空文件夹。
各文件内容如下：
Chart.yaml

apiVersion: v2
appVersion: 1.20.1
description: nginx Helm chart for Kubernetes
name: nginx
version: 1.0.0

Chart.yaml定义了chart的基本信息，除了apiVersion是根据k8s版本来之外，其他的随意填即可。

values.yaml

namespace: default
# Number of replicas to deploy
replicaCount: 1
# image conf parameters
image:
  pull_policy: "IfNotPresent"
  restart_policy: Always
# service parameters
service:
  type: NodePort
  port_name: nginx-public
  port: 8666
  targetPort: 8666
  nodePort: 30666

values.yaml文件可以将chart中需要使用到的参数灵活管理，可以根据需要提取变量。

secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: nginx-https-certificate
  namespace: {{ .Values.namespace }}
  annotations:
    "helm.sh/hook": pre-install
  labels:
    cloud.service/managed-by: nginx
    cloud.service/module: nginx
type: Opaque
data:
  nginx-crt: |
    #nginx-crt
  nginx-key: |
    #nginx-key

secret.yaml定义https所需要的证书参数，将值填到对应的地方。

configmap.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configmap
  namespace: {{ .Values.namespace }}
data:
  nginx-conf: |
    worker_processes auto;
    pid /run/nginx.pid;
    include /etc/nginx/modules-enabled/*.conf;
    
    events {
        worker_connections 1024;
    }
    http {
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        client_max_body_size 0;
        types_hash_max_size 2048;
        
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
        '$status $body_bytes_sent "$http_referer" '
        '"$http_user_agent" "$http_x_forwarded_for"';

        gzip on;
        gzip_disable "msie6";

        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        server {
            listen 8666 ssl;

            ssl_certificate     /etc/nginx/nginx.crt;  # pem文件的路径
            ssl_certificate_key  /etc/nginx/nginx.key; # key文件的路径

            # ssl验证相关配置
            ssl_session_timeout  5m;    #缓存有效期
            ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;    #加密算法
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2;    #安全链接可选的加密协议
            ssl_prefer_server_ciphers on;   #使用服务器端的首选算法

            server_name _;

            location / {
                proxy_pass 需要代理的路径;
                proxy_set_header Host $host:$server_port;
            }
        }
    }

service.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
  namespace: {{ .Values.namespace }}
  labels:
    managed-by: nginx
    module: nginx
spec:
  type: {{ .Values.service.type }}
  selector:
    name: nginx
  ports:
    - name: {{ .Values.service.port_name }}
      port: {{ .Values.service.port }}
      targetPort: {{ .Values.service.targetPort }}
      nodePort: {{ .Values.service.nodePort }}

如果想直接从外部访问，就需要将type设置为NodePort，具体可以看一下values.yaml。

deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace:  {{ .Values.namespace }}
  labels:
    managed-by: nginx
    module: nginx
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      name: nginx
  template:
    metadata:
      labels:
        name: nginx
    spec:
      restartPolicy: {{ .Values.image.restart_policy }}
      containers:
        - name: nginx
          image: nginx:1.21.1
          imagePullPolicy: {{ .Values.image.pull_policy }}
          ports:
            - name: {{ .Values.service.port_name }}
              containerPort: {{ .Values.service.port }}
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            - name: nginx-https-key
              mountPath: /etc/nginx/nginx.key
              subPath: nginx.key
            - name: nginx-https-crt
              mountPath: /etc/nginx/nginx.crt
              subPath: nginx.crt
          readinessProbe:
            tcpSocket:
              port: {{ .Values.service.port }}
            initialDelaySeconds: 5
            periodSeconds: 10
      volumes:
        - name: nginx-config
          configMap:
            name: nginx-configmap
            items:
              - key: nginx-conf
                path: nginx.conf
        - name: nginx-https-key
          secret:
            secretName: nginx-https-certificate
            items:
              - key: nginx-key
                path: nginx.key
        - name: nginx-https-crt
          secret:
            secretName: nginx-https-certificate
            items:
              - key: nginx-crt
                path: nginx.crt

安装chart

准备完chart之后就可以直接安装了，安装之前可以执行命令

$ helm install --dry-run --debug nginx nginx/

通过这个命令可以检查chart的配置是否有语法等问题，确认完没问题之后就可以直接安装了

$ helm install nginx nginx/ -n {namespace}

可以通过指定-n来指定名称空间。