Phần 16: Helm, Kustomize, RBAC và bản đồ mở rộng

my-app/
├── Chart.yaml              # Metadata (name, version, appVersion)
├── values.yaml             # Default values
├── templates/
│   ├── deployment.yaml     # Template với {{ .Values.xxx }}
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── _helpers.tpl        # Template helpers
│   └── NOTES.txt           # Post-install message
└── charts/                 # Dependencies (sub-charts)

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "my-app.fullname" . }}
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    spec:
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        resources:
          {{- toYaml .Values.resources | nindent 10 }}

# values.yaml
replicaCount: 3
image:
  repository: my-app
  tag: "1.2.0"
resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    memory: "256Mi"

# Thêm repo
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Tìm chart
helm search repo nginx

# Cài chart
helm install my-release bitnami/nginx -n production

# Override values
helm install my-release ./my-app -f values-prod.yaml
helm install my-release ./my-app --set replicaCount=5

# Xem rendered YAML (dry-run)
helm template my-release ./my-app -f values-prod.yaml

# Upgrade
helm upgrade my-release ./my-app -f values-prod.yaml

# Rollback
helm rollback my-release 1    # Revision 1

# Xem history
helm history my-release

# Uninstall
helm uninstall my-release

# List releases
helm list -A

helm history my-release
# REVISION  STATUS      DESCRIPTION
# 1         superseded  Install complete
# 2         deployed    Upgrade complete

base/
├── kustomization.yaml
├── deployment.yaml
├── service.yaml
└── configmap.yaml

overlays/
├── dev/
│   ├── kustomization.yaml
│   └── patch-replicas.yaml
├── staging/
│   └── kustomization.yaml
└── prod/
    ├── kustomization.yaml
    ├── patch-replicas.yaml
    └── patch-resources.yaml

# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
- configmap.yaml
commonLabels:
  app: my-api

# overlays/prod/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
namespace: production
namePrefix: prod-
patches:
- path: patch-replicas.yaml
configMapGenerator:
- name: app-config
  literals:
  - LOG_LEVEL=warn
  - DB_HOST=prod-db.internal

# overlays/prod/patch-replicas.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-api
spec:
  replicas: 5

# Preview
kubectl kustomize overlays/prod/

# Apply
kubectl apply -k overlays/prod/

# Diff
kubectl diff -k overlays/prod/

[User/ServiceAccount] ── RoleBinding ── [Role]
                                           │
                                    rules: [resources, verbs]

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]                    # Core API group
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin
rules:
- apiGroups: ["", "apps", "batch"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]              # Giới hạn secret access

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: dev-pod-reader
  namespace: production
subjects:
- kind: User
  name: [email protected]
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: ci-bot
  namespace: ci
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: production
---
# Pod dùng ServiceAccount
spec:
  serviceAccountName: my-app-sa
  automountServiceAccountToken: false    # Không cần API access → tắt

# Kiểm tra user hiện tại có quyền gì
kubectl auth can-i get pods -n production
kubectl auth can-i delete deployments -n production

# Kiểm tra cho ServiceAccount
kubectl auth can-i get pods -n production --as=system:serviceaccount:production:my-app-sa

# Liệt kê tất cả RoleBinding
kubectl get rolebinding -n production
kubectl get clusterrolebinding

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

# Pod phải:
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]
      readOnlyRootFilesystem: true    # Recommended