Phần 9 — Helm, Operator pattern và CRD

mychart/
├── Chart.yaml           # metadata: name, version, appVersion
├── values.yaml          # giá trị mặc định
├── values.schema.json   # validate values (tuỳ chọn)
├── templates/
│   ├── _helpers.tpl     # template fragment
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── configmap.yaml
│   ├── hpa.yaml
│   └── NOTES.txt        # in ra sau khi install
└── charts/              # subchart (dependencies)

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "mychart.fullname" . }}
  labels:
    {{- include "mychart.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "mychart.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "mychart.selectorLabels" . | nindent 8 }}
    spec:
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        {{- if .Values.env }}
        env:
        {{- range $k, $v := .Values.env }}
        - name: {{ $k }}
          value: {{ $v | quote }}
        {{- end }}
        {{- end }}

replicaCount: 2

image:
  repository: myorg/myapp
  tag: ""        # nếu rỗng dùng .Chart.AppVersion
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 100m
    memory: 128Mi

env:
  LOG_LEVEL: info

# Render local (không apply)
helm template mychart ./mychart -f values-prod.yaml > out.yaml

# Lint
helm lint ./mychart

# Install
helm install api ./mychart -f values-prod.yaml -n team-a --create-namespace

# Upgrade (idempotent)
helm upgrade --install api ./mychart -f values-prod.yaml -n team-a

# Lịch sử
helm history api -n team-a
helm rollback api 3 -n team-a

# Xoá
helm uninstall api -n team-a

# Đóng gói + push
helm package ./mychart
helm push mychart-1.0.0.tgz oci://registry.example.com/charts

# Chart.yaml
dependencies:
- name: postgresql
  version: 13.x.x
  repository: https://charts.bitnami.com/bitnami
  condition: postgresql.enabled

helm dependency update ./mychart   # pull subchart vào charts/

base/
├── deployment.yaml
├── service.yaml
└── kustomization.yaml
overlays/
  prod/
    ├── kustomization.yaml
    └── replica-count.yaml

# base/kustomization.yaml
resources:
- deployment.yaml
- service.yaml
commonLabels:
  app: api

# overlays/prod/kustomization.yaml
resources:
- ../../base
images:
- name: myorg/myapp
  newTag: 1.5.2
patches:
- path: replica-count.yaml
  target:
    kind: Deployment
    name: api

kubectl apply -k overlays/prod   # built-in từ kubectl 1.14+

dev → push commit Git → Argo CD/Flux pull, render, apply → cluster
              ↑
              CI build image, update digest trong manifest

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: backups.ops.example.com
spec:
  group: ops.example.com
  scope: Namespaced
  names:
    plural: backups
    singular: backup
    kind: Backup
    shortNames: [bk]
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            required: [target, schedule]
            properties:
              target:
                type: string
              schedule:
                type: string
                pattern: '^([0-9*/,-]+ ?){5}$'
              retention:
                type: integer
                minimum: 1
                default: 7
          status:
            type: object
            properties:
              lastRun:
                type: string
              phase:
                type: string
                enum: [Pending, Running, Succeeded, Failed]
    subresources:
      status: {}
    additionalPrinterColumns:
    - name: Target
      type: string
      jsonPath: .spec.target
    - name: Schedule
      type: string
      jsonPath: .spec.schedule
    - name: Phase
      type: string
      jsonPath: .status.phase

apiVersion: ops.example.com/v1
kind: Backup
metadata:
  name: nightly
spec:
  target: postgres
  schedule: "0 2 * * *"
  retention: 14

func Reconcile(req Request) (Result, error) {
    // 1. Lấy state mong muốn từ CRD
    backup := &BackupCRD{}
    if err := r.Get(ctx, req.NamespacedName, backup); err != nil {
        return ignoreNotFound(err)
    }
    // 2. Lấy state hiện tại (Job, Pod, ...)
    job := &batchv1.CronJob{}
    if err := r.Get(ctx, name(backup), job); apierrors.IsNotFound(err) {
        // 3. Tạo state thực để đạt desired
        if err := r.Create(ctx, buildCronJob(backup)); err != nil { return ... }
    } else {
        // hoặc patch nếu khác
    }
    // 4. Cập nhật .status
    backup.Status.LastRun = ...
    r.Status().Update(ctx, backup)
    return Result{}, nil
}

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: inject-sidecar
webhooks:
- name: sidecar.example.com
  rules:
  - operations: ["CREATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  clientConfig:
    service:
      name: sidecar-injector
      namespace: system
      path: "/mutate"
    caBundle: LS0tLS1...
  admissionReviewVersions: ["v1"]
  sideEffects: None
  failurePolicy: Fail

# Helm release status
helm list -A
helm status api -n team-a
helm get manifest api -n team-a       # YAML K8s thật sự deploy
helm get values api -n team-a

# Argo CD app
argocd app get api
argocd app diff api
argocd app sync api

# CRD
kubectl get crd
kubectl explain backup.spec

# Operator log
kubectl logs -n my-operator deploy/my-operator -f