What is worked:


  • directly go to server via SSH (behind the JH)
  • via SSH to another server
  • pull from Artifactory for testing only
  • executing HELM chart to pull from artifactory and deploy on k8s WORKS

What I want todo:


  • run CI/CD
  • I already pushed image to artifactory (works)
  • execute HELM Charts that already worked similar on remote host, but from pipeline GitLab

What I am confused

  • I need bypass JH from GitLab (i can check a host)
  • Running helm chart from pipeline to execute on remote host to deploy k8s

What is here best practice if I am on via JH?

  • use SSH then execute
  • bastion host?

Recommended way is to have an agent on the target host that would do the deployment.

Possible options include Argo or Flux. Generally, ssh'ing from CICD pipeline into target host especially with Bastion or Jump Host infrastructure is insecure.

Note that it is recommended to push the helm chart itself to the registry as well and treat it same way as container image artifacts.

For an end-to-end example of how such agent pattern would work consider my detailed tutorial here - https://worklifenotes.com/2021/05/22/helm-cd-with-reliza-hub-tutorial/

Note, it's using simplified agent that we wrote. This is fine for some cases, but it's also trivial to reproduce similar approach with either Argo or Flux.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.