用 Helm 与 Kustomize 管理应用

curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash
helm version

helm repo add podinfo https://stefanprodan.github.io/podinfo
helm repo update
helm search repo podinfo/ --versions | head -5      # 查看可用版本
helm show values podinfo/podinfo | less              # 查看所有可配置项及默认值

helm install podinfo podinfo/podinfo \
  --namespace demo --create-namespace \
  --version 6.15.0 \
  --set replicaCount=2
helm list -n demo
kubectl -n demo get deploy,svc,pod
kubectl -n demo port-forward svc/podinfo 9898:9898 &
curl -s localhost:9898 | head

replicaCount: 3
ui:
  message: "来自 k8s-journey 的问候"
  color: "#34577c"
resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    memory: 128Mi

helm upgrade podinfo podinfo/podinfo -n demo --version 6.15.0 -f podinfo-values.yaml
helm get values podinfo -n demo          # 查看这个 Release 用了哪些自定义值
helm history podinfo -n demo             # REVISION 1、2

helm upgrade --install podinfo podinfo/podinfo -n demo \
  --version 6.15.0 -f podinfo-values.yaml --wait   # 不存在则安装，存在则升级；幂等，适合脚本
helm rollback podinfo 1 -n demo                   # 回滚到修订 1（会生成新的修订 3）
helm get manifest podinfo -n demo | less          # 查看实际下发的 YAML
helm uninstall podinfo -n demo

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "mychart.fullname" . }}
  labels:
    {{- include "mychart.labels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  template:
    spec:
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          resources:
            {{- toYaml .Values.resources | nindent 12 }}

helm lint mychart
helm template test mychart --set replicaCount=5 | grep replicas

myapp/
├── base/                    所有环境共用的原始 YAML
│   ├── kustomization.yaml
│   ├── deployment.yaml
│   └── service.yaml
└── overlays/
    ├── dev/
    │   └── kustomization.yaml     引用 ../../base，改副本数、加前缀
    └── prod/
        ├── kustomization.yaml
        └── patch-resources.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml
labels:
  - pairs:
      app.kubernetes.io/part-of: myapp
    includeSelectors: false

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: myapp-prod
resources:
  - ../../base
images:
  - {name: nginx, newTag: "1.27.3"}    # 把所有 nginx 镜像改成指定标签
replicas:
  - {name: web, count: 4}
patches:
  - path: patch-resources.yaml   # 策略性合并补丁（Strategic Merge Patch）
  - target: {kind: Service, name: web}   # JSON6902 补丁，精确操作某个字段
    patch: |-
      - op: replace
        path: /spec/type
        value: NodePort
configMapGenerator:
  - name: web-config
    literals:
      - LOG_LEVEL=warn

apiVersion: apps/v1
kind: Deployment
metadata: {name: web}
spec:
  template:
    spec:
      containers:
        - name: web
          resources:
            requests: {cpu: 200m, memory: 256Mi}
            limits: {memory: 256Mi}

kubectl kustomize overlays/prod          # 只渲染，查看结果
kubectl apply -k overlays/prod           # 渲染并应用
kubectl delete -k overlays/prod

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.36/deploy/local-path-storage.yaml
patches:
  - path: patch.yaml    # replicas: 2、控制平面亲和性与容忍、多个 StorageClass 的路径映射

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: demo
helmCharts:
  - name: podinfo
    repo: https://stefanprodan.github.io/podinfo
    version: 6.15.0
    releaseName: podinfo
    valuesInline:
      replicaCount: 2
patches:
  - target: {kind: Deployment, name: podinfo}
    patch: |-
      - op: add
        path: /spec/template/spec/priorityClassName
        value: high                 # 调度一课中创建的 PriorityClass

network/metallb/
├── helmwave.yml          声明仓库、Chart、版本、命名空间、values 文件
├── values.yml            对 Chart 默认值的覆盖（只写差异）
└── kustomization.yaml    Chart 之外的附加资源（引用 default-pool.yaml 等 CR）

repositories:
  - {name: metallb, url: https://metallb.github.io/metallb}
releases:
  - name: metallb
    namespace: metallb-system
    create_namespace: true
    chart: {name: metallb/metallb, version: 0.15.3}
    values: [values.yml]

apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata: {name: default, namespace: metallb-system}
spec:
  addresses:
    - 192.168.10.200-192.168.10.210    # 向数据中心管理员申请的空闲地址段

helmwave up --build        # build 生成执行计划（.helmwave/），up 执行安装或升级
kubectl wait -n metallb-system --for=condition=ready pod -l app.kubernetes.io/instance=metallb
kubectl apply -k .
# 卸载时反序
kubectl delete -k . && helmwave down

registries:
  - host: registry.example.com          # OCI Chart 所在的内部镜像仓库
lifecycle:
  pre_up:                               # 安装前先装 Gateway API CRD（Kustomize 远程引用）
    - kubectl apply -k gateway-api
  post_down:
    - kubectl delete -k gateway-api
releases:
  - name: kgateway-crds
    namespace: kgateway-system
    create_namespace: true
    chart:
      name: oci://registry.example.com/kgateway-dev/charts/kgateway-crds
      version: v2.1.1
  - name: kgateway
    namespace: kgateway-system
    chart:
      name: oci://registry.example.com/kgateway-dev/charts/kgateway
      version: v2.1.1
    values: [values.yml]
    depends_on: [kgateway-crds]         # 等 CRD Release 完成后再装控制器