Docker & Kubernetes - Helm Package Manager with MySQL on GCP Kubernetes Engine

bogotobogo.com site search:

What is Helm?

Helm is a toolset to manage Kubernetes packages (also called Charts), which contain pre-configured Kubernetes resources.

Helm become very popular with cloud developers largely because it simplifies Kubernetes application management, the roll out of updates, and options to share applications.

Helm consists of two parts: the client (Helm) and the server (Tiller).

In this post, we'll learn how to install the Helm server and client. Then, we'll see how to configure MySQL via a Chart, and how to test the installed MySQL app.

Google Cloud Shell

Google Cloud Shell is loaded with development tools and it offers a persistent 5GB home directory and runs on the Google Cloud. Google Cloud Shell provides command-line access to our GCP resources. We can activate the shell: in GCP console, on the top right toolbar, click the Open Cloud Shell button:

In the dialog box that opens, click "START CLOUD SHELL".

gcloud is the command-line tool for Google Cloud Platform. It comes pre-installed on Cloud Shell and supports tab-completion.

Set our zone:

$ gcloud config set compute/zone us-central1-a
Updated property [compute/zone].

Run the following command to create a Kubernetes cluster:

$ gcloud container clusters create my-cluster --scopes "https://www.googleapis.com/auth/projecthosting,storage-rw"

kubeconfig entry generated for my-cluster.
NAME        LOCATION       MASTER_VERSION  MASTER_IP      MACHINE_TYPE   NODE_VERSION  NUM_NODES  STATUS
my-cluster  us-central1-a  1.11.6-gke.2    35.225.54.243  n1-standard-1  1.11.6-gke.2  3          RUNNING

Install Helm

Now that we have our Kubernetes cluster, let's install Helm (the client).

Helm comes preconfigured with an installer script that automatically grabs the latest version of the Helm client and installs it locally.

Let's get the script:

$ curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get > get_helm.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  7234  100  7234    0     0   120k      0 --:--:-- --:--:-- --:--:--  121k

We may want to change the permissions so that we have full access to the file and save it locally:

$ chmod 700 get_helm.sh

$ ./get_helm.sh
Downloading https://kubernetes-helm.storage.googleapis.com/helm-v2.12.3-linux-amd64.tar.gz
Preparing to install helm and tiller into /usr/local/bin
helm installed into /usr/local/bin/helm
tiller installed into /usr/local/bin/tiller
Run 'helm init' to configure helm.

Before we can initialize Helm and Tiller, we need to make a tiller service account. This is due to the introduction of Role Based Access Control (RBAC):

$ kubectl -n kube-system create sa tiller
serviceaccount "tiller" created

Then, we need to bind clusterrole (a set of rules around the cluster) to our service account:

$ kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller
clusterrolebinding.rbac.authorization.k8s.io "tiller" created

Install Tiller

Now that we installed Helm and a service account created, let's configure Helm's local environment so we can install Tiller:

$ helm init --service-account tiller
Adding stable repo with URL: https://kubernetes-charts.storage.googleapis.com
Adding local repo with URL: http://127.0.0.1:8879/charts
...
Tiller (the Helm server-side component) has been installed into your Kubernetes Cluster.
...

We may want to make sure that the Tiller server is running correctly:

$ kubectl get po --namespace kube-system
Adding stable repo with URL: https://kubernetes-charts.storage.googleapis.com
NAME                                                   READY     STATUS    RESTARTS   AGE
event-exporter-v0.2.3-85644fcdf-b8wk9                  2/2       Running   0          15m
fluentd-gcp-scaler-8b674f786-458bw                     1/1       Running   0          14m
fluentd-gcp-v3.2.0-6vbx2                               2/2       Running   0          14m
fluentd-gcp-v3.2.0-l6k47                               2/2       Running   0          14m
fluentd-gcp-v3.2.0-sn4lw                               2/2       Running   0          14m
heapster-v1.6.0-beta.1-568d48c8f5-kvkbx                3/3       Running   0          14m
kube-dns-548976df6c-mfsmv                              4/4       Running   0          15m
kube-dns-548976df6c-pg58l                              4/4       Running   0          14m
kube-dns-autoscaler-67c97c87fb-pbq8d                   1/1       Running   0          14m
kube-proxy-gke-my-cluster-default-pool-f3f5d251-4bgp   1/1       Running   0          14m
kube-proxy-gke-my-cluster-default-pool-f3f5d251-92mv   1/1       Running   0          14m
kube-proxy-gke-my-cluster-default-pool-f3f5d251-rfcg   1/1       Running   0          14m
l7-default-backend-7ff48cffd7-pxs89                    1/1       Running   0          15m
metrics-server-v0.2.1-fd596d746-7l2pn                  2/2       Running   0          14m
tiller-deploy-69458576b-d5dz8                          1/1       Running   0          2m

Helm version:

$ helm version
Client: &version.Version{SemVer:"v2.12.3", GitCommit:"eecf22f77df5f65c823aacd2dbd30ae6c65f186e", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.12.3", GitCommit:"eecf22f77df5f65c823aacd2dbd30ae6c65f186e", GitTreeState:"clean"}

Install a Chart

Now we installed the client and server sides of Helm. It's time to install a chart.

Let's get the latest list of available charts:

$ helm repo update
Hang tight while we grab the latest from your chart repositories...
...Skip local chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈ Happy Helming!⎈

In this post, we'll use the stable/mysql chart. To install it:

$ helm install stable/mysql
MySQL can be accessed via port 3306 on the following DNS name from within your cluster:
giddy-numbat-mysql.default.svc.cluster.local
To get your root password run:
    MYSQL_ROOT_PASSWORD=$(kubectl get secret --namespace default giddy-numbat-mysql -o jsonpath="{.data.mysql-root-password}" | base64 --decode; echo)
To connect to your database:
1. Run an Ubuntu pod that you can use as a client:
    kubectl run -i --tty ubuntu --image=ubuntu:16.04 --restart=Never -- bash -il
2. Install the mysql client:
    $ apt-get update && apt-get install mysql-client -y
3. Connect using the mysql cli, then provide your password:
    $ mysql -h giddy-numbat-mysql -p
To connect to your database directly from outside the K8s cluster:
    MYSQL_HOST=127.0.0.1
    MYSQL_PORT=3306
    # Execute the following command to route the connection:
    kubectl port-forward svc/giddy-numbat-mysql 3306
    mysql -h ${MYSQL_HOST} -P${MYSQL_PORT} -u root -p${MYSQL_ROOT_PASSWORD}

Get Root Password

To get your root password, use the command provided in the helm install stable/mysql command output:

$ kubectl get secret --namespace default giddy-numbat-mysql -o jsonpath="{.data.mysql-root-password}" | base64 --decode; echo
4iYox5Kiah

Install an Ubuntu Pod

To use an a client, we will install an Ubuntu pod. We find it from the command provided in the helm install stable/mysql command output:

$ kubectl run -i --tty ubuntu --image=ubuntu:16.04 --restart=Never -- bash -il
If you don't see a command prompt, try pressing enter.
root@ubuntu:/#

Connecting to Mysql

Install the mysql client:

root@ubuntu:/# apt-get update && apt-get install mysql-client -y
...
Setting up mysql-client-5.7 (5.7.25-0ubuntu0.16.04.2) ...
Setting up mysql-client (5.7.25-0ubuntu0.16.04.2) ...
Processing triggers for libc-bin (2.23-0ubuntu10) ...
root@ubuntu:/#

Connect using the mysql cli, then provide your password:

root@ubuntu:/# mysql -h giddy-numbat-mysql -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 263
Server version: 5.7.14 MySQL Community Server (GPL)

Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

To get a basic view of the features of this MySQL chart, log out of the connection and enter the helm inspect stable/mysql command:

mysql> exit
Bye
root@ubuntu:/# exit
logout
$ helm inspect stable/mysql
      -----BEGIN RSA PRIVATE KEY-----
      ...
      -----END RSA PRIVATE KEY-----
```
> **Note**: Make sure your certificate data has the correct formatting in the values file.
## Manage certificate secrets outside of helm
1. Ensure the certificate secret exist before installation of this chart.
2. Set the name of the certificate secret in `ssl.secret`.
3. Make sure there are no entries underneath `ssl.certificates`.
To manually create the certificate secret from local files you can execute:
```
kubectl create secret generic mysql-ssl-certs \
  --from-file=ca.pem=./ssl/certificate-authority.pem \
  --from-file=server-cert.pem=./ssl/server-public-key.pem \
  --from-file=server-key.pem=./ssl/server-private-key.pem
```
> **Note**: `ca.pem`, `server-cert.pem`, and `server-key.pem` **must** be used as the key names in this generic secret.
If you are using a certificate your configurationFiles must include the three ssl lines under [mysqld]
```
[mysqld]
    ssl-ca=/ssl/ca.pem
    ssl-cert=/ssl/server-cert.pem
    ssl-key=/ssl/server-key.pem
```

We learned how to install, configure, and run a Helm client and server in the Kubernetes Engine. We also installed a Helm chart containing a MySQL application successfully.