Helmfile: TLS support?

[reidab]

I've got tiller configured to require a client cert on incoming connections, either provided via the --tls-ca-cert, --tls-cert, and --tls-key options to helm or by placing the relevant certs in $HELM_HOME and just providing --tls to helm.

Is there a way to enable TLS transport for the helm commands that helmfile execs?

[reidab]

It looks like this is possible by passing --args --tls to helmfile sync, but it still might make sense to be globally configurable.

[reidab]

Looking a bit more at this, --args only works for the commands that support it, so things like helmfile diff still don't work with a TLS-enabled tiller.

[rmartinez3]

Theres an issue currently opened at helm diff repo regarding this issue for the diff plugin.
https://github.com/databus23/helm-diff/issues/35

[maver1ck]

@mumoshu
There is also work to be done in helmfile.
delete command doesn't support args (so I can't pass --tls)

[maver1ck]

@mumoshu added PR for delete. WDYT ?

[mumoshu]

So this is possible today by using --args. To make it even more declarative, I'm going to add the following config syntax:

helmDefaults:
  tls:
    # when enabled, helmfile adds `--tls` flags to helm commands that supports tls(upgrade, test, diff)
    enabled: true
    # options
    key: path/to/key
    cert: path/to/cert
    ca: path/to/ca/cert

Any comments? Thanks!

[servo1x]

Any updates on this @mumoshu?

[georgejdli]

Ahh I was wondering why I kept getting:
Error: unknown flag: --tls
when trying to run helmfile repos command

Any updates on this @mumoshu?

[mumoshu]

We should have already been migrated to Helm 3 so I hope this isn't an issue today. Closing as resolved, but feel free to contribute anything that helps this if you're still on Helm 2!