-
Notifications
You must be signed in to change notification settings - Fork 262
Allow for deploying Tiller as a sidecar. #79
Conversation
As a side note, I think this may also be of use to whoever justs wants to try |
6c5338c
to
df47c23
Compare
Thank you @stefanprodan, accepted both changes! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add the tillerSidecar
fields to the chart readme.
@stefanprodan done! |
chart/helm-operator/Chart.yaml
Outdated
@@ -1,6 +1,6 @@ | |||
apiVersion: v1 | |||
appVersion: "1.0.0-rc3" | |||
version: 0.2.1 | |||
version: 0.3.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please undo this change, the version will be bumped when we do a Helm-op release
Signed-off-by: Bruno Miguel Custódio <brunomcustodio@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Thanks @bmcstdio
If you release this, I might give you a kiss when I meet you next.
|
NOTE: In order for flux and the helm-operator to work successfully, an instance of tiller must be deployed into the cluster. This is a security vulnerability in that the tiller account executes with a highly privileged role. This should be removed once fluxcd/helm-operator#79 has been released. The current version of the helm-operator (1.0.0-rc3) does not include this PR.
In this PR I propose adding support in the Helm chart for deploying Tiller as a sidecar (restricted to
localhost
). This is inspired by a comment by @justinbarrick, and I believe that, although possibly being an advanced scenario, would be of use for some people ( like me 🙂 ). Tiller is eventually going away, but I believe this may be a useful addition while #8 isn't finished. I've kept this new feature undocumented because it's probably a good idea to "restrict" access to it to whoever finds themselves in need of fiddling withvalues.yaml
( and also because I am not quite sure this will get accepted as a feature 🙂 ).