<p>Recommended way is to have an agent on the target host that would do the deployment.</p>
<p>Possible options include Argo or Flux. Generally, ssh'ing from CICD pipeline into target host especially with Bastion or Jump Host infrastructure is insecure.</p>
<p>Note that it is recommended to push the helm chart itself to the registry as well and treat it same way as container image artifacts.</p>
<p>For an end-to-end example of how such agent pattern would work consider my detailed tutorial here - <a href="https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/" rel="nofollow noreferrer">https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/</a></p>
<p>Note, it's using simplified agent that we wrote. This is fine for some cases, but it's also trivial to reproduce similar approach with either Argo or Flux.</p>

CC BY-SA 4.0
2021-11-06T14:17:37.950Z
2021-11-06T14:17:37.950Z
taleodor
<p>What is worked:</p>
<p>Steps:</p>
<ul>
<li>directly go to server via SSH (behind the JH)</li>
<li>via SSH to another server</li>
<li>pull from Artifactory for testing only</li>
<li>executing HELM chart to pull from artifactory and deploy on k8s WORKS</li>
</ul>
<p>What I want todo:</p>
<p>Steps:</p>
<ul>
<li>run CI/CD</li>
<li>I already pushed image to artifactory (works)</li>
<li>execute HELM Charts that already worked similar on remote host, but from pipeline GitLab</li>
</ul>
<p>What I am confused</p>
<ul>
<li>I need bypass JH from GitLab (i can check a host)</li>
<li>Running helm chart from pipeline to execute on remote host to deploy k8s</li>
</ul>
<p>What is here best practice if I am on via JH?</p>
<ul>
<li>use SSH then execute</li>
<li>bastion host?</li>
</ul>

<kubernetes><gitlab><cicd><helm>
Gitlab pipeline + Jump host + execute HELM
Marin Sagovac
# Gitlab pipeline + Jump host + execute HELM

(Asked by: username_0 on 2021-11-05)

What is worked:

Steps:

* directly go to server via SSH (behind the JH)
* via SSH to another server
* pull from Artifactory for testing only
* executing HELM chart to pull from artifactory and deploy on k8s WORKS

What I want todo:

Steps:

* run CI/CD
* I already pushed image to artifactory (works)
* execute HELM Charts that already worked similar on remote host, but from pipeline GitLab

What I am confused

* I need bypass JH from GitLab (i can check a host)
* Running helm chart from pipeline to execute on remote host to deploy k8s

What is here best practice if I am on via JH?

* use SSH then execute
* bastion host?

**Tags:** kubernetes, gitlab, cicd, helm


---

## 1 answers

### Answer by username_1 on 2021-11-06. Score: 0

Recommended way is to have an agent on the target host that would do the deployment.

Possible options include Argo or Flux. Generally, ssh'ing from CICD pipeline into target host especially with Bastion or Jump Host infrastructure is insecure.

Note that it is recommended to push the helm chart itself to the registry as well and treat it same way as container image artifacts.

For an end-to-end example of how such agent pattern would work consider my detailed tutorial here - <https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/>

Note, it's using simplified agent that we wrote. This is fine for some cases, but it's also trivial to reproduce similar approach with either Argo or Flux.


---

