Helm 面试题

helm install my-release bitnami/nginx
  → Helm CLI 读取 Chart
  → 合并 values.yaml 和用户自定义值
  → 渲染 Go Template
  → 将生成的 YAML 提交到 Kubernetes API
  → 创建 Release（存储在 Secret 中）

graph TD
    A["mychart/"] --> B["Chart.yaml<br/>Chart 元数据"]
    A --> C["values.yaml<br/>默认配置值"]
    A --> D["values.schema.json<br/>JSON Schema 校验（可选）"]
    A --> E["charts/<br/>子 Chart 依赖"]
    A --> F["templates/<br/>Go Template 模板文件"]
    F --> F1["_helpers.tpl<br/>可复用的模板辅助函数"]
    F --> F2["deployment.yaml<br/>Deployment 资源模板"]
    F --> F3["service.yaml<br/>Service 资源模板"]
    F --> F4["ingress.yaml<br/>Ingress 资源模板"]
    F --> F5["hpa.yaml<br/>HPA 资源模板"]
    F --> F6["NOTES.txt<br/>安装后的提示信息"]
    A --> G["crds/<br/>CRD 定义"]
    A --> H["README.md<br/>使用文档"]
    A --> I[".helmignore<br/>打包时忽略的文件列表"]

# if-else
XQOPEN if .Values.persistence.enabled XQCLOSE
persistence:
  enabled: true
  size: XQOPEN .Values.persistence.size XQCLOSE
XQOPEN end XQCLOSE

# range 循环
XQOPEN range .Values.ports XQCLOSE
- name: XQOPEN .name XQCLOSE
  containerPort: XQOPEN .containerPort XQCLOSE
XQOPEN end XQCLOSE

# with 作用域
XQOPEN with .Values.securityContext XQCLOSE
securityContext:
  runAsUser: XQOPEN .runAsUser XQCLOSE
  fsGroup: XQOPEN .fsGroup XQCLOSE
XQOPEN end XQCLOSE

# 默认值
replicas: XQOPEN .Values.replicaCount | default 1 XQCLOSE

# 大小写转换
name: XQOPEN .Values.appName | upper XQCLOSE
env: XQOPEN .Values.env | lower XQCLOSE

# 缩进对齐
XQOPEN .Files.Get "config.yaml" | indent 4 XQCLOSE

# include 引用
XQOPEN include "mychart.labels" . | nindent 4 XQCLOSE

# quote 和 squote
name: XQOPEN .Values.name | quote XQCLOSE

# tpl（字符串模板渲染）
XQOPEN tpl .Values.templateString . XQCLOSE

# Chart.yaml
dependencies:
- name: postgresql
  version: "12.x"
  repository: "https://charts.bitnami.com/bitnami"
  condition: postgresql.enabled  # 条件启用
  tags:
  - database
- name: redis
  version: "17.x"
  repository: "https://charts.bitnami.com/bitnami"
  condition: redis.enabled
  tags:
  - cache
- name: local-chart
  version: "0.1.0"
  repository: "file://../local-chart"  # 本地路径

# 下载依赖到 charts/ 目录
helm dependency update

# 构建依赖（更新 Chart.lock）
helm dependency build

# 列出依赖
helm dependency list

# 父 Chart values.yaml
postgresql:
  enabled: true
  auth:
    database: myapp
    username: myapp
redis:
  enabled: false

graph TD
    A["mychart/"] --> B["crds/"]
    B --> B1["crd-prometheus.yaml"]
    B --> B2["crd-servicemonitor.yaml"]
    A --> C["templates/"]
    C --> C1["prometheus.yaml<br/>引用 CRD 的资源"]

apiVersion: batch/v1
kind: Job
metadata:
  name: XQOPEN .Release.Name XQCLOSE-db-migrate
  annotations:
    "helm.sh/hook": post-upgrade
    "helm.sh/hook-weight": "5"           # 执行顺序（数值越小越先）
    "helm.sh/hook-delete-policy": hook-succeeded  # 成功后删除
spec:
  template:
    spec:
      containers:
      - name: migrate
        image: myapp/migrate:latest
        command: ["/bin/migrate.sh"]
      restartPolicy: Never

# 优先级从高到低
helm install myapp ./mychart \
  --set image.tag=prod-latest \              # 最高
  --values prod-values.yaml \                # 次高
  -f custom-values.yaml                      # 第三

**三路合并优势：** 手动修改过的 K8s 资源不会被直接覆盖，Helm 会识别集群状态差异并尝试智能合并。

**回滚：**
```bash
# 查看 Release 历史
helm history myapp
# REVISION  STATUS     CHART         APP VERSION  DESCRIPTION
# 1         deployed   mychart-1.0.0 1.0          Install complete
# 2         deployed   mychart-1.1.0 1.1          Upgrade complete
# 3         failed     mychart-1.2.0 1.2          Upgrade failed

# 回滚到版本 2
helm rollback myapp 2

# 指定回滚参数
helm rollback myapp 2 --wait --timeout 5m

helm install myapp ./mychart \
  --wait \                    # 等待所有 Pod 进入 Ready
  --timeout 10m \             # 超时时间
  --atomic \                  # 失败时自动回滚
  --create-namespace          # 自动创建命名空间

graph TD
    A["config/"] --> B["values.yaml<br/>公共基础配置"]
    A --> C["values-dev.yaml<br/>开发环境覆盖"]
    A --> D["values-staging.yaml<br/>预发布覆盖"]
    A --> E["values-prod.yaml<br/>生产覆盖"]

# 开发
helm install myapp ./mychart -f config/values.yaml -f config/values-dev.yaml

# 生产
helm upgrade myapp ./mychart \
  -f config/values.yaml \
  -f config/values-prod.yaml \
  --set image.tag=v1.2.3

replicaCount: 1
resources:
  requests:
    cpu: 100m
    memory: 128Mi
ingress:
  enabled: false

replicaCount: 5
resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: 2
    memory: 2Gi
ingress:
  enabled: true
  hosts:
  - app.prod.example.com

# 登录 OCI 注册表
helm registry login registry.example.com

# 推送 Chart 到 OCI
helm package mychart
helm push mychart-1.0.0.tgz oci://registry.example.com/helm-charts

# 从 OCI 安装
helm install myapp oci://registry.example.com/helm-charts/mychart --version 1.0.0

# 从 OCI 拉取
helm pull oci://registry.example.com/helm-charts/mychart --version 1.0.0

# 语法检查
helm lint ./mychart

# 带严格模式
helm lint ./mychart --strict

# 检查结果：YAML 格式、模板渲染、values 完整性

{
  "$schema": "https://json-schema.org/draft-07/schema",
  "type": "object",
  "required": ["image", "replicaCount"],
  "properties": {
    "image": {
      "type": "object",
      "required": ["repository", "tag"],
      "properties": {
        "repository": { "type": "string" },
        "tag": { "type": "string", "pattern": "^v?[0-9]+\\.[0-9]+" }
      }
    },
    "replicaCount": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100
    }
  }
}

apiVersion: v1
kind: Pod
metadata:
  name: "XQOPEN .Release.Name XQCLOSE-connection-test"
  annotations:
    "helm.sh/hook": test
spec:
  containers:
  - name: test
    image: curlimages/curl
    command:
    - curl
    - http://XQOPEN .Release.Name XQCLOSE-svc:80
  restartPolicy: Never

helm test myapp

# 生成 GPG 密钥
gpg --full-generate-key

# 签名 Chart
helm package --sign --key 'my-key' --keyring ~/.gnupg/secring.gpg ./mychart
# 生成 mychart-1.0.0.tgz + mychart-1.0.0.tgz.prov

# 验证签名
helm verify mychart-1.0.0.tgz

# 安装时验证
helm install myapp ./mychart-1.0.0.tgz --verify

# 配置信任密钥
helm repo add myrepo https://charts.example.com \
  --ca-file ca.crt \
  --cert-file client.crt \
  --key-file client.key

# 父 Chart values.yaml
global:
  imageRegistry: "registry.internal.company.com"
  env: production

subchart1:
  enabled: true
# 子 Chart 模板引用全局值
image: "XQOPEN .Values.global.imageRegistry XQCLOSE/myapp:XQOPEN .Values.image.tag XQCLOSE"

# 使用 kustomize 作为 PostRenderer
helm install myapp ./mychart \
  --post-renderer ./kustomize-wrapper.sh

#!/bin/bash
# kustomize-wrapper.sh
cat <&0 > /tmp/rendered.yaml
kubectl kustomize /tmp/rendered

# common/Chart.yaml
apiVersion: v2
name: common
type: library        # 标记为 Library Chart
version: 1.0.0
# common/templates/_helpers.tpl
XQOPEN- define "common.name" -XQCLOSE
XQOPEN- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" XQCLOSE
XQOPEN- end XQCLOSE

XQOPEN- define "common.labels" -XQCLOSE
app.kubernetes.io/name: XQOPEN include "common.name" . XQCLOSE
app.kubernetes.io/instance: XQOPEN .Release.Name XQCLOSE
XQOPEN- end XQCLOSE

XQOPEN- define "common.probe" -XQCLOSE
initialDelaySeconds: XQOPEN .delay | default 5 XQCLOSE
periodSeconds: XQOPEN .period | default 10 XQCLOSE
XQOPEN- end XQCLOSE

# mychart/Chart.yaml
dependencies:
- name: common
  version: 1.0.0
  repository: file://../common
# mychart/templates/deployment.yaml
XQOPEN include "common.labels" . XQCLOSE
livenessProbe:
  XQOPEN include "common.probe" . | nindent 2 XQCLOSE

# 查看 Release Secret
kubectl get secrets -n mynamespace | grep sh.helm.release

# 查看 Secret 中的 Release 数据
kubectl get secret sh.helm.release.v1.myapp.v1 -o jsonpath='{.data.release}' | base64 -d | base64 -d | gunzip

# 限制历史版本数量
helm upgrade myapp ./mychart --history-max 5

# 手动清理历史
helm history myapp --max 10
helm delete myapp --keep-history  # 保留 Release 记录

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
spec:
  source:
    repoURL: https://git.example.com/helm-charts
    path: mychart
    targetRevision: HEAD
    helm:
      valueFiles:
      - values.yaml
      - values-prod.yaml
      parameters:
      - name: image.tag
        value: v1.2.3
      releaseName: myapp
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# secrets.yaml（加密文件）
apiVersion: v1
kind: Secret
metadata:
  name: mysecret
type: Opaque
stringData:
  password: ENC[AES256_GCM,data:encrypted-base64]

helm secrets install myapp ./mychart -f secrets.yaml

# Chart 中引用 ExternalSecret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: myapp-secret
  data:
  - secretKey: password
    remoteRef:
      key: /myapp/password

# 加密 Secret
kubeseal --format yaml < secret.yaml > sealed-secret.yaml
# Chart 中包含 SealedSecret，Helm 安装后由 sealed-secrets controller 解密

apiVersion: batch/v1
kind: Job
metadata:
  name: pre-upgrade-job
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-weight": "-5"  # 负数权重 = 更早执行
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: job
        image: busybox
        command: ["sh", "-c", "echo pre-upgrade check"]

# Chart.yaml
apiVersion: v2
name: mychart
version: 1.0.0
kubeVersion: ">= 1.21.0-0"  # 最低 K8s 版本

# 根据 K8s 版本选择 API 版本
XQOPEN- if .Capabilities.APIVersions.Has "apps/v1" XQCLOSE
apiVersion: apps/v1
XQOPEN- else XQCLOSE
apiVersion: extensions/v1beta1
XQOPEN- end XQCLOSE

# 检查特定 CRD 是否存在
XQOPEN- if .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" XQCLOSE
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
XQOPEN- end XQCLOSE

# 根据 K8s 版本选择特性
XQOPEN- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.Version XQCLOSE
topologySpreadConstraints:
- maxSkew: 1
  topologyKey: topology.kubernetes.io/zone
XQOPEN- end XQCLOSE

# templates/NOTES.txt
Thank you for installing XQOPEN .Chart.Name XQCLOSE.

Your application is running at:
  http://XQOPEN .Values.ingress.host XQCLOSE

Get the admin password:
  kubectl get secret XQOPEN .Release.Name XQCLOSE-admin -o jsonpath="{.data.password}" | base64 --decode

To test the connection:
  helm test XQOPEN .Release.Name XQCLOSE

# 查询已有 ConfigMap
XQOPEN- $cm := lookup "v1" "ConfigMap" .Release.Namespace "myconfig" XQCLOSE
XQOPEN- if $cm XQCLOSE
configData: XQOPEN $cm.data XQCLOSE
XQOPEN- else XQCLOSE
configData: {}
XQOPEN- end XQCLOSE

# 查询 Secret 是否存在（避免覆盖已有密钥）
XQOPEN- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-db" .Release.Name) XQCLOSE
XQOPEN- if not $existingSecret XQCLOSE
apiVersion: v1
kind: Secret
metadata:
  name: XQOPEN .Release.Name XQCLOSE-db
data:
  password: XQOPEN randAlphaNum 16 | b64enc XQCLOSE
XQOPEN- end XQCLOSE

XQOPEN- if and (.Values.ingress.enabled) (not .Values.ingress.host) XQCLOSE
XQOPEN- fail "ingress.host is required when ingress is enabled" XQCLOSE
XQOPEN- end XQCLOSE

XQOPEN- if and (.Values.persistence.enabled) (not .Values.storageClass) XQCLOSE
XQOPEN- fail "storageClass is required for persistent storage" XQCLOSE
XQOPEN- end XQCLOSE

# 版本兼容性检查
XQOPEN- if not (semverCompare ">=1.21-0" .Capabilities.KubeVersion.Version) XQCLOSE
XQOPEN- fail "Kubernetes version must be >= 1.21" XQCLOSE
XQOPEN- end XQCLOSE

# values.yaml
ingress:
  enabled: false
monitoring:
  enabled: true
serviceMonitor:
  enabled: "XQOPEN .Values.monitoring.enabled XQCLOSE"
# templates/ingress.yaml
XQOPEN- if .Values.ingress.enabled XQCLOSE
apiVersion: networking.k8s.io/v1
kind: Ingress
...
XQOPEN- end XQCLOSE
# templates/servicemonitor.yaml
XQOPEN- if .Values.serviceMonitor.enabled XQCLOSE
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
...
XQOPEN- end XQCLOSE

# helmfile.yaml
repositories:
- name: bitnami
  url: https://charts.bitnami.com/bitnami

releases:
- name: postgresql
  namespace: database
  chart: bitnami/postgresql
  version: 12.x
  values:
  - values/postgresql.yaml

- name: myapp
  namespace: myapp
  chart: ./charts/myapp
  values:
  - values/myapp.yaml
  needs:
  - database/postgresql

# 部署所有 Release
helmfile apply

# 查看差异
helmfile diff

# 自动生成 Release 名称
helm install --generate-name ./mychart
# Release: mychart-1712345678

# 使用模板生成名称
helm install --name-template "myapp-XQOPEN .Chart.Version XQCLOSE" ./mychart
# Release: myapp-1.0.0