Skip to content

Helm ✓

Enabled by default in the Holmes CLI

The Holmes CLI enables this toolset by default when helm is installed. The Holmes server, which the Helm charts deploy, loads it only when the config enables it, as in Configuration below.

By enabling this toolset, HolmesGPT will be able to provide read access to a cluster's Helm charts and releases.

Configuration

In Kubernetes, the secrets rule is needed because Helm stores each release's record as a Secret. Unless namespaceScopedRBAC is true, the chart puts these rules in a ClusterRole, which lets Holmes read every Secret in the cluster. To limit Holmes to the namespace it runs in, use Release namespace only below.

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
    helm/core:
        enabled: true

After making changes to your configuration, run:

holmes toolset refresh

When using the standalone Holmes Helm Chart, merge this into your values.yaml, appending list entries (such as additionalEnvVars) to the lists already there:

toolsets:
    helm/core:
        enabled: true
customClusterRoleRules:
    - apiGroups: [""]
      resources: ["secrets", "pods", "services", "configmaps", "persistentvolumeclaims"]
      verbs: ["get", "list", "watch"]
    - apiGroups: [""]
      resources: ["namespaces"]
      verbs: ["get"]
    - apiGroups: ["apps"]
      resources: ["deployments", "statefulsets", "daemonsets"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["batch"]
      resources: ["jobs", "cronjobs"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["networking.k8s.io"]
      resources: ["ingresses"]
      verbs: ["get", "list", "watch"]

Apply the configuration:

helm upgrade holmes robusta/holmes -f values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), merge the keys under holmes: into the holmes: key of your generated_values.yaml (add one if it has none), appending list entries (such as additionalEnvVars) to the lists already there:

holmes:
  toolsets:
      helm/core:
          enabled: true
  customClusterRoleRules:
      - apiGroups: [""]
        resources: ["secrets", "pods", "services", "configmaps", "persistentvolumeclaims"]
        verbs: ["get", "list", "watch"]
      - apiGroups: [""]
        resources: ["namespaces"]
        verbs: ["get"]
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets"]
        verbs: ["get", "list", "watch"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list", "watch"]
      - apiGroups: ["networking.k8s.io"]
        resources: ["ingresses"]
        verbs: ["get", "list", "watch"]

Apply the configuration:

helm upgrade robusta robusta/robusta -f generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Release namespace only

With namespaceScopedRBAC: true, the chart renders all of Holmes's RBAC rules, not only these, as a Role and RoleBinding in the release namespace. Holmes can then read Secrets, Helm releases and every other resource only in that namespace, and cluster-scoped resources such as nodes not at all.

When using the standalone Holmes Helm Chart, merge this into your values.yaml, appending list entries (such as additionalEnvVars) to the lists already there:

namespaceScopedRBAC: true

toolsets:
    helm/core:
        enabled: true
customClusterRoleRules:
    - apiGroups: [""]
      resources: ["secrets", "pods", "services", "configmaps", "persistentvolumeclaims"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["apps"]
      resources: ["deployments", "statefulsets", "daemonsets"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["batch"]
      resources: ["jobs", "cronjobs"]
      verbs: ["get", "list", "watch"]
    - apiGroups: ["networking.k8s.io"]
      resources: ["ingresses"]
      verbs: ["get", "list", "watch"]

Apply the configuration:

helm upgrade holmes robusta/holmes -f values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), merge the keys under holmes: into the holmes: key of your generated_values.yaml (add one if it has none), appending list entries (such as additionalEnvVars) to the lists already there:

holmes:
  namespaceScopedRBAC: true

  toolsets:
      helm/core:
          enabled: true
  customClusterRoleRules:
      - apiGroups: [""]
        resources: ["secrets", "pods", "services", "configmaps", "persistentvolumeclaims"]
        verbs: ["get", "list", "watch"]
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets"]
        verbs: ["get", "list", "watch"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list", "watch"]
      - apiGroups: ["networking.k8s.io"]
        resources: ["ingresses"]
        verbs: ["get", "list", "watch"]

Apply the configuration:

helm upgrade robusta robusta/robusta -f generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Capabilities

The table below describes the specific capabilities provided by this toolset. HolmesGPT can decide to invoke any of these capabilities when answering questions or investigating issues.

Tool Name Description
helm_list Use to get all the current helm releases
helm_values Use to gather Helm values or any released helm chart
helm_status Check the status of a Helm release
helm_history Get the revision history of a Helm release
helm_manifest Fetch the generated Kubernetes manifest for a Helm release
helm_hooks Get the hooks for a Helm release
helm_chart Show the chart used to create a Helm release
helm_notes Show the notes provided by the Helm chart