Answers: <p>Recommended way is to have an agent on the target host that would do the deployment.</p>
  <p>Possible options include Argo or Flux. Generally, ssh'ing from CICD pipeline into target host especially with Bastion or Jump Host infrastructure is insecure.</p>
  <p>Note that it is recommended to push the helm chart itself to the registry as well and treat it same way as container image artifacts.</p>
  <p>For an end-to-end example of how such agent pattern would work consider my detailed tutorial here - <a href="https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/" rel="nofollow noreferrer">https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/</a></p>
  <p>Note, it's using simplified agent that we wrote. This is fine for some cases, but it's also trivial to reproduce similar approach with either Argo or Flux.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-06T14:17:37.950Z
Answers: 2021-11-06T14:17:37.950Z
Answers: taleodor
Body: <p>What is worked:</p>
  <p>Steps:</p>
  <ul>
  <li>directly go to server via SSH (behind the JH)</li>
  <li>via SSH to another server</li>
  <li>pull from Artifactory for testing only</li>
  <li>executing HELM chart to pull from artifactory and deploy on k8s WORKS</li>
  </ul>
  <p>What I want todo:</p>
  <p>Steps:</p>
  <ul>
  <li>run CI/CD</li>
  <li>I already pushed image to artifactory (works)</li>
  <li>execute HELM Charts that already worked similar on remote host, but from pipeline GitLab</li>
  </ul>
  <p>What I am confused</p>
  <ul>
  <li>I need bypass JH from GitLab (i can check a host)</li>
  <li>Running helm chart from pipeline to execute on remote host to deploy k8s</li>
  </ul>
  <p>What is here best practice if I am on via JH?</p>
  <ul>
  <li>use SSH then execute</li>
  <li>bastion host?</li>
  </ul>
  
Tags: <kubernetes><gitlab><cicd><helm>
Title: Gitlab pipeline + Jump host + execute HELM
UserDisplayName: Marin Sagovac
ThreadText: # Gitlab pipeline + Jump host + execute HELM
  
  (Asked by: username_0 on 2021-11-05)
  
  What is worked:
  
  Steps:
  
  * directly go to server via SSH (behind the JH)
  * via SSH to another server
  * pull from Artifactory for testing only
  * executing HELM chart to pull from artifactory and deploy on k8s WORKS
  
  What I want todo:
  
  Steps:
  
  * run CI/CD
  * I already pushed image to artifactory (works)
  * execute HELM Charts that already worked similar on remote host, but from pipeline GitLab
  
  What I am confused
  
  * I need bypass JH from GitLab (i can check a host)
  * Running helm chart from pipeline to execute on remote host to deploy k8s
  
  What is here best practice if I am on via JH?
  
  * use SSH then execute
  * bastion host?
  
  **Tags:** kubernetes, gitlab, cicd, helm
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-11-06. Score: 0
  
  Recommended way is to have an agent on the target host that would do the deployment.
  
  Possible options include Argo or Flux. Generally, ssh'ing from CICD pipeline into target host especially with Bastion or Jump Host infrastructure is insecure.
  
  Note that it is recommended to push the helm chart itself to the registry as well and treat it same way as container image artifacts.
  
  For an end-to-end example of how such agent pattern would work consider my detailed tutorial here - <https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/>
  
  Note, it's using simplified agent that we wrote. This is fine for some cases, but it's also trivial to reproduce similar approach with either Argo or Flux.
  
  
  ---
  
  