Terraform Helm Provider

repository·main·Indexed 22 days ago

https://github.com/hashicorp/terraform-provider-helm

The Helm provider for Terraform enables the management of Helm Charts within Kubernetes clusters using Terraform HCL. It provides resources like helm_release for chart installation and the helm_template data source for rendering chart templates locally without cluster installation.

Tokens
9K
Snippets
32
Records
45
Agent score
75%

What's inside terraform-provider-helm

  1. Understand the issue lifecycle

    main

    Once an issue is reported on GitHub, it follows this lifecycle:

    1. Verification & Categorization: A collaborator verifies the issue and applies labels such as bug, enhancement, documentation, or question.
    2. Triage: The issue is assessed for criticality and work effort (size estimate). Once triaged, it is labeled as acknowledged.
    3. Backlog: The issue is queued for development. Fixes are linked to the issue number in the relevant commit messages.
    4. Resolution: The issue is closed once addressed, or closed if it is tracked elsewhere or deemed non-actionable.
  2. Use the helm_template data source to render chart templates

    main

    The helm_template data source allows you to render Helm chart templates locally without installing them into a cluster. It mimics the functionality of the helm template command. This is useful for inspecting manifests, validating templates, or exporting rendered YAML files to local storage using other Terraform resources (like local_file).

    To use it, you must provide a name (release name) and the chart (name or path). You can also specify a repository, version, and various set blocks to pass values into the templates.

    data "helm_template" "example" {
      name       = "my-release"
      chart      = "my-chart"
      repository = "https://charts.example.com"
      version    = "1.2.3"
    }
  3. Format CHANGELOG entries using release-note blocks

    main

    Entries should be user-facing and formatted using specific code block tags to categorize the change. Use the following syntax: ```release-note:<type> followed by the component and description.

    Available types include:

    • improvement
    • feature
    • bug

    You can include multiple entries in a single file by separating them with distinct code blocks.

    server: Add new option for configs
    plugin/nomad: New feature integration
    plugin/docker: Fix broken code
  4. Use in-cluster authentication

    main
    When running Terraform inside a Kubernetes cluster, the provider can automatically detect the local cluster configuration using the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT environment variables. In this scenario, no attributes are required in the kubernetes provider block.
  5. Install and use the Helm provider for Terraform

    main

    The Helm provider allows you to install and manage Helm Charts in your Kubernetes cluster using Terraform.

    To use the provider, configure the helm provider block with your Kubernetes configuration (such as config_path) and use the helm_release resource to define the chart, repository, and values to set.

    provider "helm" {
      kubernetes = {
        config_path = "~/.kube/config"
      }
    }
    
    resource "helm_release" "nginx_ingress" {
      name       = "nginx-ingress-controller"
    
      repository = "oci://registry-1.docker.io/bitnamicharts"
      chart      = "nginx-ingress-controller"
    
      set = [
        {
        name  = "service.type"
        value = "ClusterIP"
        }
      ]
    }
  6. Install Helm using the Docker helper script

    main

    After the Kubernetes cluster is running, you must install Helm. The repository provides a shell script install-helm-via-docker.sh that uses Docker to simplify the installation process.

    When running the script, ensure you specify the correct path to your kubeconfig file using the KUBE_DIR environment variable. The following example assumes the kubeconfig is stored in ./gke/kubedir.

    KUBE_DIR=./gke/kubedir HELM_VERSION=2.13.0 HELM_HOME=./helm-home HYPERKUBE_VERSION=v1.11.8 ./install-helm-via-docker.sh
  7. Upgrade Kubernetes credentials in the Helm provider block

    main

    When upgrading to v2.0.0, the way Kubernetes access is configured in the provider block has changed to encourage explicit configuration and prevent accidental application to the wrong cluster.

    Key changes:

    • The load_config_file attribute is removed.
    • The KUBECONFIG environment variable is no longer supported; use KUBE_CONFIG_PATH instead.
    • The config_path attribute no longer defaults to ~/.kube/config and must be set explicitly.

    Note: If running Terraform inside a Kubernetes cluster, no provider configuration is necessary as the provider will automatically detect the service account token.

  8. Use `set` block with `type` instead of `set_string`

    main

    The set_string block in the helm_release resource has been removed. It has been replaced by the standard set block, which now includes a type attribute. This allows you to explicitly define the type of a value, which is useful for ambiguous strings (e.g., strings that look like numbers, true, or false).

    resource "helm_release" "redis" {
      name       = "redis"
      repository = "https://charts.bitnami.com/bitnami"
      chart      = "redis"
    
      set {
        name  = "test.value"
        value = "123456"
        type  = "string"
      }
    }
  9. Replace `helm_repository` data source with `helm_release` configuration

    main

    The helm_repository data source has been removed because it performed stateful filesystem operations (similar to helm repo add) which is inconsistent with the purpose of data sources.

    To achieve the same result, configure repository information directly within the helm_release resource using the repository attribute. Alternatively, you can continue to use repositories that were added via the helm repo add CLI command before running Terraform.

    resource "helm_release" "redis" {
      name       = "redis"
      repository = "https://charts.bitnami.com/bitnami"
      chart      = "redis"
    }
  10. Use exec-based credential plugins for cloud providers

    main

    To handle short-lived authentication tokens (common in EKS or GKE), use the exec block within the kubernetes configuration. This allows the provider to call an external command to fetch valid credentials.

    Required fields:

    • api_version: The API version for decoding the credentials (e.g., client.authentication.k8s.io/v1beta1).
    • command: The executable command to run.

    Optional fields:

    • args: A list of arguments passed to the command.
    • env: A map of environment variables for the plugin execution.
    # Example: AWS EKS authentication
    provider "helm" {
      kubernetes = {
        host                   = var.cluster_endpoint
        cluster_ca_certificate = base64decode(var.cluster_ca_cert)
        exec = {
          api_version = "client.authentication.k8s.io/v1beta1"
          args        = ["eks", "get-token", "--cluster-name", var.cluster_name]
          command     = "aws"
        }
      }
    }
    
    # Example: Google GKE authentication
    provider "helm" {
        kubernetes = {
            host  = "https://${data.google_container_cluster.my_cluster.endpoint}"
            token = data.google_client_config.provider.access_token
            cluster_ca_certificate = base64decode(data.google_container_cluster.my_cluster.master_auth[0].cluster_ca_certificate)
            exec = {
                api_version = "client.authentication.k8s.io/v1beta1"
                command     = "gke-gcloud-auth-plugin"
            }
        }
    }