KUBERNETES: TỪ CƠ BẢN ĐẾN NÂNG CAO

Module 8: Helm, Operators & GitOps

xdev.asia

🎯 Mục tiêu bài học

Hiểu Helm 4 là package manager cho Kubernetes, cấu trúc chart, cách install/upgrade/rollback, Helm 4 features mới (WASM, server-side apply), và khi nào dùng Kustomize thay Helm.

1. Helm là gì?

Helm là package manager cho Kubernetes — tương tự apt cho Ubuntu, brew cho macOS. Helm đóng gói Kubernetes resources vào "charts" có thể share, version, và parameterize.

Lợi ích:

• Đóng gói ứng dụng phức tạp (nhiều resources) thành 1 unit
• Parameterization qua values.yaml
• Release history và rollback
• Dependency management
• Ecosystem: hàng nghìn community charts (artifact hub)

2. Helm 4 — November 2025 (10th Anniversary)

Breaking changes từ Helm 3:

• WebAssembly (WASM) Plugins: plugins compile sang WASM, portable across OS, sandboxed execution
• Server-Side Apply (SSA): dùng K8s SSA thay client-side merge — giải quyết field ownership conflicts
• 60% performance improvement: đặc biệt với large charts (1000+ resources)
• OCI enhancements: multi-arch charts, provenance, attestation
• Built-in helm diff: xem sự khác biệt trước khi upgrade
• Helm 3 tiếp tục nhận security fixes đến tháng 11/2026

3. Helm Chart Structure

myapp/
├── Chart.yaml           # chart metadata
├── values.yaml          # default configuration values
├── values.schema.json   # JSON Schema validation cho values (optional)
├── charts/              # chart dependencies
│   └── postgresql/      # embedded dependency
├── templates/           # Kubernetes manifest templates
│   ├── _helpers.tpl     # named templates, shared logic
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   └── NOTES.txt        # hiển thị sau install
└── .helmignore          # ignore files khi đóng gói

# Chart.yaml
apiVersion: v2
name: myapp
description: My Application Helm Chart
type: application
version: 0.2.0        # chart version (SemVer)
appVersion: "1.2.3"   # version của app được đóng gói
dependencies:
- name: postgresql
  version: "15.5.x"
  repository: "https://charts.bitnami.com/bitnami"
  condition: postgresql.enabled

4. values.yaml và Templates

# values.yaml
replicaCount: 3
image:
  repository: myregistry.io/myapp
  tag: "1.2.3"
  pullPolicy: Always
service:
type: ClusterIP
port: 80
resources:
requests:
cpu: "100m"
memory: "128Mi"
limits:
cpu: "500m"
memory: "256Mi"
postgresql:
enabled: true
auth:
database: myapp

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "myapp.fullname" . }}
  labels:
    {{- include "myapp.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "myapp.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "myapp.selectorLabels" . | nindent 8 }}
    spec:
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        resources:
          {{- toYaml .Values.resources | nindent 10 }}

5. Helm Commands

# Thêm repository
helm repo add stable https://charts.helm.sh/stable
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
Tìm kiếm chart
helm search repo nginx
helm search hub postgresql   # tìm trên Artifact Hub
Install
helm install my-nginx bitnami/nginx -n production
helm install my-nginx bitnami/nginx 

--namespace production 

--create-namespace 

--set replicaCount=3 

--values custom-values.yaml
Xem installed releases
helm list -n production
helm list --all-namespaces
Upgrade
helm upgrade my-nginx bitnami/nginx 

--namespace production 

--set image.tag=1.28
Helm 4: xem diff trước khi upgrade (built-in)
helm diff upgrade my-nginx bitnami/nginx --set image.tag=1.28 -n production
Rollback
helm rollback my-nginx 1 -n production  # rollback về revision 1
helm history my-nginx -n production     # xem revision history
Uninstall
helm uninstall my-nginx -n production
Dry run
helm install my-nginx bitnami/nginx --dry-run --debug

6. OCI Registry

# Helm 4: OCI registry là first-class citizen
# Đăng nhập registry
helm registry login myregistry.io --username myuser
Push chart lên OCI registry
helm package ./myapp                        # tạo myapp-0.2.0.tgz
helm push myapp-0.2.0.tgz oci://myregistry.io/helm-charts
Pull và install từ OCI
helm install my-release oci://myregistry.io/helm-charts/myapp --version 0.2.0
Không cần helm repo add với OCI!

7. Helm Hooks

# templates/db-migration.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-db-migration"
  annotations:
    "helm.sh/hook": pre-upgrade,pre-install   # chạy TRƯỚC khi install/upgrade
    "helm.sh/hook-weight": "-5"               # thứ tự (nhỏ hơn chạy trước)
    "helm.sh/hook-delete-policy": hook-succeeded  # xóa job sau khi thành công
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migration
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        command: ["python", "manage.py", "migrate"]

Helm hooks có thể dùng cho: database migration (pre-install), smoke test (post-install), backup (pre-delete).

8. Helm Tests

# templates/tests/test-connection.yaml
apiVersion: v1
kind: Pod
metadata:
  name: "{{ .Release.Name }}-test-connection"
  annotations:
    "helm.sh/hook": test
spec:
  restartPolicy: Never
  containers:
  - name: test
    image: busybox:1.36
    command: ['wget', '--spider', 'http://{{ include "myapp.fullname" . }}:{{ .Values.service.port }}']

helm test my-nginx -n production
# Pod "my-nginx-test-connection" created
# Pod "my-nginx-test-connection" succeeded
# Tests succeeded!

9. Helmfile — Manage Multiple Releases

# helmfile.yaml
repositories:
- name: bitnami
  url: https://charts.bitnami.com/bitnami
- name: grafana
  url: https://grafana.github.io/helm-charts
environments:
staging:
values:
- environments/staging.yaml
production:
values:
- environments/production.yaml
releases:


name: postgresql
namespace: database
chart: bitnami/postgresql
version: "15.5.x"
values:

postgresql-values.yaml



name: monitoring
namespace: monitoring
chart: prometheus-community/kube-prometheus-stack
values:

monitoring-values.yaml



name: myapp
namespace: production
chart: ./myapp
needs:

database/postgresql   # deploy sau postgresql
values:
myapp-values.yaml
"{{ .Environment.Name }}-values.yaml"

helmfile apply                    # deploy tất cả
helmfile sync -e production       # sync trong environment production
helmfile diff                     # xem sự khác biệt
helmfile destroy                  # uninstall tất cả

10. Helm vs Kustomize

• Dùng Helm khi: phân phối chart cho người dùng khác, cần parameterization phức tạp, cần dependency management, ecosystem charts (bitnami, community)
• Dùng Kustomize khi: overlay đơn giản (dev/staging/prod), built-in kubectl (không cần cài thêm), GitOps workflows, patch YAML mà không cần template

# Kustomize: không cần cài thêm
kubectl apply -k ./overlays/production
Hoặc xem output mà không apply
kubectl kustomize ./overlays/production

Tóm tắt

• Helm 4 (Nov 2025): WASM plugins, SSA, 60% perf, built-in diff
• Chart structure: Chart.yaml, values.yaml, templates/
• OCI registry: first-class support, không cần repo add
• Hooks: pre/post install/upgrade/delete cho lifecycle operations
• Helmfile: orchestrate multiple Helm releases
• Helm vs Kustomize: Helm cho phân phối, Kustomize cho simple overlays