a3f11e5873
This change introduces a configuration option to control whether Tiller
listens on any IP addresses (the previous default), or binds only to
127.0.0.1 (the new default).
The same option is used for both the Armada and Tiller charts:
.conf.tiller.listen_on_any (default: false)
The affected tiller command line argument is:
-listen 127.0.0.1:port (if false)
-listen :port (if true)
Listening on any address allows Helm client direct access to Tiller, via
'helm --host pod_ip:port'.
Listening on localhost does prevent connections directly to the pod IP,
but it does not preclude the use of 'kubectl port-forward' to establish
a connection to Tiller.
The Tiller container in the Armada pod exists only to service Armada via
127.0.0.1. The Helm client automatically sets up port forwarding (if it
has access to the Kubernetes API). As a result, this change should be
non-impacting. However, the previous behavior can be restored by setting
.conf.tiller.listen_on_any=true.
Change-Id: Id308976bac21cc521e8470516ce49ebd1942da68
|
||
|---|---|---|
| .. | ||
| templates | ||
| .helmignore | ||
| Chart.yaml | ||
| requirements.yaml | ||
| values.yaml | ||