Kubernetes 配置管理工具：Kustomize & Helm #

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# 1. 资源引用
resources:
  - ../base                        # 引用 base 目录或远程 Git URL

# 2. 组件引用（可复用模块）
components:
  - ../components/monitoring

# 3. 名称前缀/后缀
namePrefix: prod-
nameSuffix: -v2

# 4. 公共标签和注解
labels:
  - pairs:
      env: production
      team: platform
    includeSelectors: true

commonAnnotations:
  managed-by: kustomize

# 5. 命名空间
namespace: production

# 6. 补丁（环境差异化）
patches:
  - path: replica_patch.yaml       # 文件补丁
  - target:                        # 目标选择器 + inline patch
      kind: Deployment
      name: myapp
    patch: |-
      - op: replace
        path: /spec/replicas
        value: 5

# 7. 自动生成 ConfigMap/Secret（内容变更自动触发哈希更新）
configMapGenerator:
  - name: myapp-config
    files:
      - app.properties
    literals:
      - LOG_LEVEL=info

secretGenerator:
  - name: myapp-secret
    literals:
      - DB_PASSWORD=supersecret
    envs:
      - .env

# 8. 镜像替换
images:
  - name: myapp
    newName: registry.example.com/myapp
    newTag: v1.2.3

# 9. 替换器（跨资源引用）
replacements:
  - source:
      kind: ConfigMap
      name: myapp-config
      fieldPath: data.APP_HOST
    targets:
      - select:
          kind: Ingress
        fieldPaths:
          - spec.rules.0.host

# base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 2
  template:
    spec:
      containers:
        - name: myapp
          image: myapp:v1.0.0
          resources:
            requests:
              cpu: "500m"
              memory: 512Mi

# overlays/prod/replica_patch.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp          # ← 必须与目标资源 name 一致，用于定位
spec:
  replicas: 5          # ← 覆盖为 5
  template:
    spec:
      containers:
        - name: myapp  # ← 列表合并的关键：同名容器会合并而非替换
          resources:
            limits:
              cpu: "2"
              memory: 2Gi

# overlays/prod/kustomization.yaml
resources:
  - ../../base

patches:
  - path: replica_patch.yaml       # 现代写法（推荐）
  # 旧写法（已 deprecated）：
  # patchesStrategicMerge:
  #   - replica_patch.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 5                          # ← 被 patch 覆盖
  template:
    spec:
      containers:
        - name: myapp
          image: myapp:v1.0.0          # ← 原值保留
          resources:
            requests:                  # ← 原值保留
              cpu: "500m"
              memory: 512Mi
            limits:                    # ← patch 新增
              cpu: "2"
              memory: 2Gi

# overlays/prod/json_patch.yaml
- op: replace                             # 替换 replicas
  path: /spec/replicas
  value: 3
- op: remove                               # 删除 readinessProbe
  path: /spec/template/spec/containers/0/readinessProbe
- op: add                                  # 新增注解
  path: /metadata/annotations/prometheus.io~1scrape
  value: "true"

# overlays/prod/kustomization.yaml
resources:
  - ../../base

patches:
  - target:
      group: apps
      version: v1
      kind: Deployment
      name: myapp
    path: json_patch.yaml
  # 旧写法（已 deprecated）：
  # patchesJson6902:
  #   - target:
  #       group: apps
  #       version: v1
  #       kind: Deployment
  #       name: myapp
  #     path: json_patch.yaml

# overlays/prod/kustomization.yaml
resources:
  - ../../base

patches:
  - target:
      version: v1
      kind: Deployment
      name: myapp
    patch: |-                          # ← 内联 YAML 补丁
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: myapp
      spec:
        replicas: 3

# overlays/prod/kustomization.yaml
resources:
  - ../../base

patches:
  - target:
      version: v1
      kind: Deployment
      name: myapp
    options:
      allowJsonPatch: true
    jsonPatch: |-                       # ← 内联 JSON Patch 数组
      - op: replace
        path: /spec/replicas
        value: 3
      - op: add
        path: /metadata/labels/managed-by
        value: kustomize

# overlays/prod/kustomization.yaml
resources:
  - ../../base

patches:
  - target:
      kind: Deployment             # ← 匹配所有 Deployment
    patch: |-
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        labels:
          environment: production

patches:
  - target:
      kind: Deployment
      labelSelector: tier=frontend   # ← 仅匹配 label tier=frontend 的 Deployment
    patch: |-
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        labels:
          tier: frontend
          team: web
    # 也可以配合 JSON Patch
    # jsonPatch: |-
    #   - op: replace
    #     path: /spec/replicas
    #     value: 5

patches:
  - target:
      kind: Service
      annotationSelector: expose=true   # 匹配 annotation expose=true 的 Service
    patch: |-
      apiVersion: v1
      kind: Service
      metadata:
        annotations:
          external-traffic-policy: Local

# 构建并预览输出
kustomize build overlays/prod
# 或（kubectl 内置）
kubectl kustomize overlays/prod

# 直接应用
kubectl apply -k overlays/prod

# 查看 diff（不实际部署）
kustomize build overlays/prod | kubectl diff -f -

# 验证 kustomization.yaml 语法
kustomize build overlays/prod --enable-alpha-plugins

# 远程 base（Git URL）
kustomize build https://github.com/org/repo//base?ref=main

# macOS
brew install helm

# Linux（官方脚本）
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# 添加常用仓库
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add stable https://charts.helm.sh/stable
helm repo update

apiVersion: v2                    # Helm 3 必须为 v2
name: mychart
version: 1.2.3                    # Chart 版本（SemVer 2）
appVersion: "2.0.0"               # 应用版本（信息性）
description: My application chart
type: application                 # application 或 library
kubeVersion: ">= 1.25.0"         # K8s 版本约束

dependencies:                     # Chart 依赖
  - name: redis
    version: "18.x"
    repository: https://charts.bitnami.com/bitnami
    condition: redis.enabled      # 条件开关

maintainers:
  - name: devops-team
    email: devops@example.com

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "mychart.fullname" . }}
  labels:
    {{- include "mychart.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "mychart.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "mychart.selectorLabels" . | nindent 8 }}
    spec:
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          ports:
            - containerPort: {{ .Values.service.port }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          {{- if .Values.env }}
          env:
            {{- range .Values.env }}
            - name: {{ .name }}
              value: {{ .value | quote }}
            {{- end }}
          {{- end }}

# 副本数
replicaCount: 3

# 镜像配置
image:
  repository: registry.example.com/myapp
  pullPolicy: IfNotPresent
  tag: ""                         # 默认使用 Chart.AppVersion

# 服务配置
service:
  type: ClusterIP
  port: 80

# Ingress 配置
ingress:
  enabled: true
  className: nginx
  hosts:
    - host: myapp.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: myapp-tls
      hosts:
        - myapp.example.com

# 资源配置
resources:
  limits:
    cpu: 1000m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

# HPA 配置
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

# 环境变量
env:
  - name: LOG_LEVEL
    value: info
  - name: DB_HOST
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: host

# templates/migrate-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "mychart.fullname" . }}-migrate
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-weight": "-5"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      containers:
        - name: migrate
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          command: ["python", "manage.py", "migrate"]
      restartPolicy: Never

# 搜索 Chart
helm search hub nginx                    # 搜索 Artifact Hub
helm search repo nginx                   # 搜索已添加的仓库

# 安装 / 升级 / 回滚
helm install myrelease ./mychart                    # 本地安装
helm install myrelease myrepo/mychart               # 仓库安装
helm install myrelease oci://ghcr.io/org/mychart    # OCI Registry
helm install myrelease ./mychart -f values-prod.yaml  # 指定 values
helm install myrelease ./mychart --set image.tag=v2 # 命令行覆盖

helm upgrade myrelease ./mychart -f values-prod.yaml  # 升级
helm upgrade --install myrelease ./mychart             # 不存在则安装
helm rollback myrelease 2                              # 回滚到 revision 2

# 查看状态
helm list                                # 列出所有 Release
helm status myrelease                    # 查看 Release 状态
helm history myrelease                   # 查看升级历史
helm get values myrelease                # 查看生效的 values
helm get manifest myrelease              # 查看渲染后的 YAML

# 调试
helm template myrelease ./mychart        # 本地渲染模板（不安装）
helm template myrelease ./mychart -f values-prod.yaml --debug  # 调试模式
helm lint ./mychart                      # 检查 Chart 语法
helm install myrelease ./mychart --dry-run  # 模拟安装

# 打包与发布
helm package ./mychart                   # 打包为 .tgz
helm push mychart-1.0.0.tgz oci://ghcr.io/org/charts  # 推送到 OCI

# 测试
helm test myrelease                      # 运行 Chart 测试 Pod

# 卸载
helm uninstall myrelease                 # 卸载 Release
helm uninstall myrelease --keep-history  # 卸载但保留历史

# overlays/prod/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

helmCharts:
  - name: myapp
    repo: https://charts.example.com
    version: 1.2.3
    releaseName: myapp-prod
    namespace: production
    valuesFile: values-prod.yaml      # Helm values
    additionalValuesFiles:
      - values-common.yaml

patches:
  - target:
      kind: Deployment
      name: myapp-prod
    patch: |-
      - op: add
        path: /metadata/annotations/prometheus.io~1scrape
        value: "true"

# Helm 渲染输出 → Kustomize 后处理（添加标签/补丁）
helm template myrelease ./mychart -f values-prod.yaml > base/release.yaml
kustomize build overlays/prod | kubectl apply -f -

# Argo CD Application 使用 Helm
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
spec:
  source:
    repoURL: https://charts.example.com
    chart: myapp
    targetRevision: 1.2.3
    helm:
      valueFiles:
        - values-prod.yaml
      parameters:
        - name: image.tag
          value: "v2.0.0"
  destination:
    server: https://kubernetes.default.svc
    namespace: production