Helm, Kustomize আর operator — package, overlay আর CRD

boighor/
├── Chart.yaml            # name, chart version, app version
├── values.yaml           # default values
└── templates/
    ├── _helpers.tpl      # reusable snippets, renders nothing itself
    ├── configmap.yaml
    ├── deployment.yaml
    ├── service.yaml
    └── NOTES.txt         # message printed after install

replicaCount: 1
image:
  repository: nginx
  tag: 1.27-alpine
greeting: Boighor dev
resources:
  requests: {cpu: 10m, memory: 16Mi}
  limits: {memory: 48Mi}

# templates/configmap.yaml
data:
  index.html: {{ .Values.greeting | quote }}

# templates/deployment.yaml
metadata:
  name: {{ .Release.Name }}-web
spec:
  replicas: {{ .Values.replicaCount }}
  ...
      containers:
        - name: web
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          resources:
            {{- toYaml .Values.resources | nindent 12 }}

      annotations:
        checksum/page: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum | trunc 12 }}

$ cat values-prod.yaml
replicaCount: 3
greeting: Boighor live

$ helm lint boighor
==> Linting boighor
[INFO] Chart.yaml: icon is recommended

1 chart(s) linted, 0 chart(s) failed

$ helm template boi ./boighor -f values-prod.yaml \
    --set image.tag=1.27.5-alpine | grep -E 'replicas:|image:|index.html'
  index.html: "Boighor live"
  replicas: 3
          image: "nginx:1.27.5-alpine"

// A tiny Helm-style renderer. Change the values, --set or template.
const chartValues = { replicaCount: 1, image: { tag: "1.27-alpine" }, greeting: "Boighor dev" };
const envFiles = { dev: {}, prod: { replicaCount: 3, greeting: "Boighor live" } };
const setFlags = { dev: {}, prod: { "image.tag": "1.27.5-alpine" } };
const template = [
  "replicas: {{ .Values.replicaCount }}",
  'image: "nginx:{{ .Values.image.tag }}"',
  "page: {{ .Values.greeting | quote }}",
  "memory: {{ .Values.memoryLimit }}",
];

const isObj = (x) => x !== null && typeof x === "object";
function merge(low, high) {            // the later source wins, key by key
  const out = { ...low };
  for (const k in high) out[k] = isObj(out[k]) && isObj(high[k]) ? merge(out[k], high[k]) : high[k];
  return out;
}
function setPath(obj, path, v) {       // "a.b" = 1 becomes { a: { b: 1 } }
  return merge(obj, path.split(".").reverse().reduce((acc, k) => ({ [k]: acc }), v));
}
const lookup = (obj, path) => path.split(".").reduce((o, k) => (o == null ? undefined : o[k]), obj);
function render(line, values) {
  return line.replace(/\{\{\s*\.Values\.([\w.]+)\s*(\|\s*quote\s*)?\}\}/g, (_, path, quote) => {
    const v = lookup(values, path);
    if (v === undefined) console.log("  (note: " + path + " is missing, rendered as empty, no error)");
    return quote ? JSON.stringify(String(v)) : (v ?? "");
  });
}
for (const env of ["dev", "prod"]) {
  let values = merge(chartValues, envFiles[env]);
  for (const [path, v] of Object.entries(setFlags[env])) values = setPath(values, path, v);
  console.log("--- " + env + " ---");
  for (const line of template) console.log(render(line, values));
}

$ helm install boi ./boighor -n abcl-kz --wait --timeout 60s
NAME: boi
NAMESPACE: abcl-kz
STATUS: deployed
REVISION: 1
NOTES:
boi is up with 1 replica(s).

$ kubectl get secrets -n abcl-kz
NAME                        TYPE                 DATA   AGE
sh.helm.release.v1.boi.v1   helm.sh/release.v1   1      32s

$ kubectl get secret sh.helm.release.v1.boi.v1 -n abcl-kz \
    -o jsonpath='{.metadata.labels}'
{"modifiedAt":"1793387662","name":"boi","owner":"helm","status":"deployed","version":"1"}

$ helm history boi -n abcl-kz
REVISION  STATUS      CHART          DESCRIPTION
1         superseded  boighor-0.1.0  Install complete
2         superseded  boighor-0.1.0  Upgrade complete
3         failed      boighor-0.1.0  Upgrade "boi" failed: context deadline exceeded
4         deployed    boighor-0.1.0  Rollback to 2

$ helm get values boi -n abcl-kz
USER-SUPPLIED VALUES:
greeting: Boighor v2
replicaCount: 2

$ helm uninstall boi -n abcl-kz
release "boi" uninstalled

$ helm history boi -n abcl-kz
Error: release: not found

$ helm install boi2 ./boighor --set replicaCount=three --dry-run=client | grep -E 'STATUS|replicas:'
STATUS: pending-install
  replicas: three

$ helm install boi2 ./boighor --set replicaCount=three --dry-run=server | grep -E 'STATUS|replicas:'
STATUS: pending-install
  replicas: three

$ helm template boi ./boighor --set replicaCount=three > three.yaml
$ kubectl apply --dry-run=server -f three.yaml -n abcl-kz
configmap/boi-page created (server dry run)
service/boi-web created (server dry run)
Error from server (BadRequest): error when creating "three.yaml": Deployment in
version "v1" cannot be handled as a Deployment: json: cannot unmarshal string into
Go struct field DeploymentSpec.spec.replicas of type int32

# example-repo and example-chart are placeholders
helm repo add example-repo https://charts.example.com
helm search repo example-repo/example-chart --versions

# Read before you install; always pin an exact version
helm show values example-repo/example-chart --version 1.2.3 > values.yaml
helm template demo example-repo/example-chart --version 1.2.3 -f values.yaml \
  | grep -E '^kind:' | sort | uniq -c

# Charts stored in a registry can be pulled by exact version
helm pull oci://registry.example.com/charts/example-chart --version 1.2.3

# overlays/prod/kustomization.yaml
namespace: abcl-kz
namePrefix: prod-
labels:
  - pairs:
      env: prod
    includeSelectors: true
resources:
  - ../../base
images:
  - name: nginx
    newTag: 1.27.5-alpine
patches:
  - path: more-replicas.yaml
  - target:
      kind: Deployment
      name: web
    patch: |-
      - op: add
        path: /spec/template/metadata/annotations
        value:
          tier: prod
configMapGenerator:
  - name: page
    behavior: replace
    literals:
      - index.html=Boighor live

# overlays/prod/more-replicas.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: web
          resources:
            limits:
              memory: 64Mi

# Before the fix: both Services select all 4 pods
$ kubectl get endpointslices -n abcl-kz \
    -o custom-columns='NAME:.metadata.name,ENDPOINTS:.endpoints[*].addresses[0]'
NAME             ENDPOINTS
dev-web-pbjnj    10.1.0.75,10.1.0.74,10.1.0.76,10.1.0.73
prod-web-5qvxm   10.1.0.75,10.1.0.74,10.1.0.76,10.1.0.73

# After env label with includeSelectors: true
NAME             ENDPOINTS
dev-web-rvxv9    10.1.0.77
prod-web-psnd7   10.1.0.79,10.1.0.80,10.1.0.78

// A Kustomize-style overlay: the base stays untouched. Try name: "wbe".
const base = { kind: "Deployment", metadata: { name: "web" },
  spec: { replicas: 1, containers: [
    { name: "web", image: "nginx:1.27-alpine", limits: { memory: "48Mi" } },
    { name: "log", image: "alpine:3.20", debug: true } ] } };
const overlay = { namePrefix: "prod-", newTag: "1.27.5-alpine",
  patch: { metadata: { name: "web" }, spec: { replicas: 3, containers: [
    { name: "web", limits: { memory: "64Mi" } }, { name: "log", debug: null } ] } } };
const isObj = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
function merge(a, b) {
  if (Array.isArray(a) && Array.isArray(b)) {       // lists of named items: match by name
    const out = a.map((item) => { const p = b.find((x) => x.name === item.name); return p ? merge(item, p) : item; });
    return out.concat(b.filter((x) => !a.some((item) => item.name === x.name)));
  }
  if (!isObj(a) || !isObj(b)) return b;             // a plain value: the patch wins
  const out = { ...a };
  for (const k in b) { if (b[k] === null) delete out[k]; else out[k] = k in a ? merge(a[k], b[k]) : b[k]; }
  return out;
}
function build(res, ov) {
  if (ov.patch.metadata.name !== res.metadata.name)
    return console.log("error: no resource matches patch for " + ov.patch.metadata.name);
  const out = merge(res, ov.patch);
  out.metadata = { ...out.metadata, name: ov.namePrefix + res.metadata.name };
  out.spec.containers = out.spec.containers.map((c) =>
    c.image.startsWith("nginx:") ? { ...c, image: "nginx:" + ov.newTag } : c);
  return out;
}
const show = (o) => { console.log(o.metadata.name, "replicas=" + o.spec.replicas);
  for (const c of o.spec.containers) console.log("  ", c.name, c.image, JSON.stringify({ limits: c.limits, debug: c.debug })); };
show(base);
const final = build(base, overlay);
if (final) show(final);
console.log("base replicas after build:", base.spec.replicas);

$ helm template boi ./boighor > combo/rendered.yaml
$ cat combo/kustomization.yaml
namespace: abcl-kz
resources:
  - rendered.yaml
patches:
  - target:
      kind: Deployment
      name: boi-web
    patch: |-
      - op: replace
        path: /spec/replicas
        value: 2
      - op: add
        path: /spec/template/spec/containers/0/securityContext
        value:
          allowPrivilegeEscalation: false

$ kubectl kustomize combo | grep -E '^kind|replicas|allowPriv'
kind: ConfigMap
kind: Service
kind: Deployment
  replicas: 2
          allowPrivilegeEscalation: false

$ kubectl apply -k combo --dry-run=server
configmap/boi-page created (server dry run)
service/boi-web created (server dry run)
deployment.apps/boi-web created (server dry run)

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: backups.abcl-kz.example.com   # must be plural.group
spec:
  group: abcl-kz.example.com
  scope: Namespaced
  names:
    kind: Backup
    plural: backups
    singular: backup
    shortNames: [bk]
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      additionalPrinterColumns:
        - {name: Database, type: string, jsonPath: .spec.database}
        - {name: Schedule, type: string, jsonPath: .spec.schedule}
        - {name: Keep, type: integer, jsonPath: .spec.keep}
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              required: [database, schedule]
              properties:
                database: {type: string}
                schedule: {type: string}
                keep:
                  type: integer
                  minimum: 1
                  default: 7
            status:
              type: object
              properties:
                lastBackup: {type: string}

$ kubectl get backups -n abcl-kz
error: the server doesn't have a resource type "backups"

$ kubectl apply -f backup-crd.yaml
customresourcedefinition.apiextensions.k8s.io/backups.abcl-kz.example.com created

$ kubectl api-resources --api-group=abcl-kz.example.com
NAME      SHORTNAMES   APIVERSION                     NAMESPACED   KIND
backups   bk           abcl-kz.example.com/v1alpha1   true         Backup

$ cat daily.yaml
apiVersion: abcl-kz.example.com/v1alpha1
kind: Backup
metadata:
  name: orders-daily
spec:
  database: orders
  schedule: "0 2 * * *"

$ kubectl apply -f daily.yaml -n abcl-kz
backup.abcl-kz.example.com/orders-daily created

$ kubectl get backups -n abcl-kz
NAME           DATABASE   SCHEDULE    KEEP
orders-daily   orders     0 2 * * *   7

$ kubectl get all -n abcl-kz
No resources found in abcl-kz namespace.

# keep: 0, and schedule is missing
$ kubectl apply -f bad.yaml -n abcl-kz
The Backup "orders-bad" is invalid:
* spec.keep: Invalid value: 0: spec.keep in body should be greater than or equal to 1
* spec.schedule: Required value

# A CronJob with ownerReferences pointing at the Backup
$ kubectl get cronjob orders-daily-job -n abcl-kz \
    -o jsonpath='{.metadata.ownerReferences[0].kind}/{.metadata.ownerReferences[0].name}'
Backup/orders-daily

$ kubectl delete cronjob orders-daily-job -n abcl-kz
cronjob.batch "orders-daily-job" deleted from abcl-kz namespace
$ kubectl get cronjob -n abcl-kz
No resources found in abcl-kz namespace.

# Created again, then the owner is deleted
$ kubectl delete backup orders-daily -n abcl-kz
$ kubectl get cronjob -n abcl-kz     # about 16 s later
No resources found in abcl-kz namespace.

# With one Backup still present, delete the CRD itself
$ kubectl delete crd backups.abcl-kz.example.com
customresourcedefinition.apiextensions.k8s.io "backups.abcl-kz.example.com" deleted
$ kubectl get backups -n abcl-kz
Error from server (NotFound): Unable to list "abcl-kz.example.com/v1alpha1, Resource=backups":
the server could not find the requested resource (get backups.abcl-kz.example.com)

# Pseudocode, not a real program
reconcile(name):
    backup = get Backup name
    if backup is gone: return                   # owner GC handles children
    want = cronJobFrom(backup.spec)             # with ownerReference
    have = get CronJob for this backup
    if have is missing: create want
    else if have differs from want: update have
    set backup.status                           # never touch spec here
    on any error: return it, so the queue retries with backoff

// A reconcile loop for a fictional Backup resource, over simulated hours.
const spec = { everyHours: 3, keep: 2 };           // desired state, as in the Backup
const cluster = { cronJob: null, copies: [] };     // actual state in this toy world
const script = {                                   // what happens at which hour
  4: () => { cluster.cronJob = null; return "someone deletes the CronJob"; },
  7: () => { spec.keep = 1; return "Backup spec changes: keep=1"; },
  9: () => { cluster.cronJob = null; return "CronJob deleted while controller is down"; },
};
const controllerDown = new Set([7, 8, 9]);         // no reconcile in these hours

function reconcile() {
  const actions = [];
  if (!cluster.cronJob) {
    cluster.cronJob = { every: spec.everyHours };
    actions.push("create CronJob");
  } else if (cluster.cronJob.every !== spec.everyHours) {
    cluster.cronJob.every = spec.everyHours;
    actions.push("update CronJob");
  }
  while (cluster.copies.length > spec.keep) actions.push("prune " + cluster.copies.shift());
  return actions;
}
for (let hour = 0; hour <= 12; hour++) {
  const event = script[hour] ? script[hour]() : "";
  const down = controllerDown.has(hour);
  const actions = down ? [] : reconcile();
  if (cluster.cronJob && hour > 0 && hour % cluster.cronJob.every === 0)
    cluster.copies.push("copy-" + String(hour).padStart(2, "0"));
  console.log("h" + String(hour).padStart(2, "0"),
    down ? "[down]" : "[up]  ",
    "cron=" + (cluster.cronJob ? "yes" : "no "),
    "copies=[" + cluster.copies.join(",") + "]",
    event && "| " + event,
    actions.length ? "| " + actions.join("; ") : "");
}