Advanced Topics

# metadata.finalizers

apiVersion: v1
kind: Pod
metadata:
  name: app-with-cleanup
  finalizers:
  - "cleanup.example.com/release-ports"
  - "cleanup.example.com/close-connections"
spec:
  containers:
  - name: app
    image: myapp:1.0

# Manual removal (if stuck)
$ kubectl patch <resource> <name> -p '{"metadata":{"finalizers":[]}}' --type=merge

# Check for Finalizers
kubectl get <resource> <name> -o json | jq .metadata.finalizers

# Check for deletionTimestamp
kubectl get <resource> <name> -o json | jq .metadata.deletionTimestamp

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: databases.example.com
spec:
  group: example.com
  names:
    kind: Database
    plural: databases
  scope: Namespaced  # Custom resources live inside namespaces (use 'Cluster' for cluster-wide)

  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            properties:
              engine:
                type: string
                enum: ["postgres", "mysql", "mongodb"]
              version:
                type: string
              storage:
                type: string
                pattern: '^\d+Gi$'
              backup:
                type: object
                properties:
                  enabled:
                    type: boolean
                  frequency:
                    type: string
            required:
            - engine
            - version

          status:
            type: object
            properties:
              phase:
                type: string
                enum: ["Creating", "Ready", "Failed"]
              endpoint:
                type: string
              lastBackup:
                type: string

apiVersion: example.com/v1
kind: Database
metadata:
  name: production-db
  namespace: default
spec:
  engine: postgres
  version: "14"
  storage: 100Gi
  backup:
    enabled: true
    frequency: "daily"

---
# kubectl apply -f database.yaml
# kubectl get databases
# kubectl describe database production-db

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: image-policy
webhooks:
- name: image-policy.example.com
  clientConfig:
    service:
      name: webhook-service
      namespace: default
      path: "/validate"
    caBundle: LS0tLS1CRUdJTi... (base64)
  rules:
  - operations: ["CREATE", "UPDATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  admissionReviewVersions: ["v1"]
  sideEffects: None

---
# Webhook service that only allows whitelisted images
apiVersion: v1
kind: Service
metadata:
  name: webhook-service
spec:
  ports:
  - port: 443
    targetPort: 8443
  selector:
    app: image-policy-webhook

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: add-resource-quotas
webhooks:
- name: add-resources.example.com
  clientConfig:
    service:
      name: webhook-service
      namespace: default
      path: "/mutate"
    caBundle: LS0tLS1CRUdJTi...
  rules:
  - operations: ["CREATE"]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]

---
# Webhook that adds default resource limits
# Original pod:
#   spec:
#     containers:
#     - name: app
#       image: myapp:1.0

# After webhook mutation:
#   spec:
#     containers:
#     - name: app
#       image: myapp:1.0
#       resources:
#         requests:
#           cpu: 100m
#           memory: 128Mi
#         limits:
#           cpu: 500m
#           memory: 512Mi

# Enable sidecar injection
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    istio-injection: enabled

---
# VirtualService: Control routing (where traffic goes)
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: api
spec:
  hosts:
  - api
  http:
  - match:
    - uri:
        prefix: "/v1"
    route:
    - destination:
        host: api
        subset: v1
      weight: 90
    - destination:
        host: api
        subset: v2
      weight: 10  # 10% canary

---
# DestinationRule: Configure traffic policies for destination (how traffic behaves)
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: api
spec:
  host: api
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 50
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s

  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

---
# PeerAuthentication: Enforce mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT  # Enforce mTLS

Helm workflow:

# Add repository
helm repo add bitnami https://charts.bitnami.com/bitnami

# Search for charts
helm search repo postgres

# Install chart (creates release)
helm install my-db bitnami/postgresql

# List releases
helm list

# Upgrade release
helm upgrade my-db bitnami/postgresql --set replicaCount=3

# Rollback if needed
helm rollback my-db 1

# Add repository
helm repo add bitnami https://charts.bitnami.com/bitnami

# Update repository index
helm repo update

# Search for charts
helm search repo postgres

# Show chart information
helm show chart bitnami/postgresql
helm show values bitnami/postgresql

# Install with default values
helm install my-postgres bitnami/postgresql

# Install with custom values
helm install my-postgres bitnami/postgresql \
  --set auth.postgresPassword=secretpassword \
  --set replicaCount=3

# Install with values file
helm install my-postgres bitnami/postgresql -f values.yaml

# List installed releases
helm list
helm list --all-namespaces

# Get release status
helm status my-postgres

# Upgrade release
helm upgrade my-postgres bitnami/postgresql --set replicaCount=5

# Rollback to previous version
helm rollback my-postgres

# Uninstall release
helm uninstall my-postgres

# values.yaml - Override default chart values
replicaCount: 3

auth:
  postgresPassword: "prod-password"
  database: "myapp_db"

primary:
  persistence:
    size: 100Gi
  resources:
    requests:
      cpu: 500m
      memory: 1Gi

apiVersion: v2
name: myapp
version: 1.0.0        # Chart version
appVersion: "2.3.1"   # Application version

dependencies:
  - name: postgresql
    version: "12.x.x"
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled

replicaCount: 2

image:
  repository: myapp
  tag: "1.0.0"

resources:
  requests:
    cpu: 100m
    memory: 128Mi

postgresql:
  enabled: true
  auth:
    database: myapp

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-myapp
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    spec:
      containers:
      - name: myapp
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        {{- if .Values.postgresql.enabled }}
        env:
        - name: DB_HOST
          value: {{ .Release.Name }}-postgresql
        {{- end }}

# Access values
{{ .Values.replicaCount }}
{{ .Values.image.tag | default "latest" }}

# Built-in objects
{{ .Chart.Name }}          # Chart name
{{ .Chart.Version }}       # Chart version
{{ .Release.Name }}        # Release name
{{ .Release.Namespace }}   # Target namespace

# Conditionals
{{- if .Values.ingress.enabled }}
# ingress config
{{- end }}

# Loops
{{- range .Values.hosts }}
- host: {{ . }}
{{- end }}

# Validate chart
helm lint ./myapp

# Render templates locally (dry-run)
helm template my-release ./myapp

# Render with custom values
helm template my-release ./myapp -f prod-values.yaml

# Debug installation
helm install my-release ./myapp --dry-run --debug

# Show computed values
helm get values my-release

# Show manifest
helm get manifest my-release

# Download dependencies
helm dependency update ./myapp

# Package and share
helm package ./myapp
# Creates: myapp-1.0.0.tgz

# Push to OCI registry (Docker Hub, Harbor, etc.)
helm push myapp-1.0.0.tgz oci://registry.example.com/charts

# templates/job-migration.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: "{{ .Release.Name }}-db-migration"
  annotations:
    # Run before install/upgrade
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation
spec:
  template:
    spec:
      containers:
      - name: migration
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        command: ["./migrate.sh"]
        env:
        - name: DB_HOST
          value: {{ include "myapp.fullname" . }}-postgresql
      restartPolicy: Never

# values-dev.yaml
replicaCount: 1
resources:
  requests:
    cpu: 100m
    memory: 128Mi

# values-prod.yaml
replicaCount: 5
resources:
  requests:
    cpu: 1000m
    memory: 2Gi

# Deploy
helm install myapp ./myapp -f values-prod.yaml

# templates/job.yaml
{{- if .Values.migrations.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: migration
spec:
  # ...
{{- end }}

# _helpers.tpl
{{- define "myapp.env" -}}
- name: ENVIRONMENT
  value: {{ .Values.environment }}
- name: LOG_LEVEL
  value: {{ .Values.logLevel }}
{{- end }}

# deployment.yaml
env:
  {{- include "myapp.env" . | nindent 2 }}

# base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 1  # Default, will be overridden
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:latest  # Will be overridden
        resources:
          requests:
            cpu: 100m
            memory: 128Mi

---
# base/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080

---
# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- deployment.yaml
- service.yaml

commonLabels:
  app: myapp
  managed-by: kustomize

# overlays/dev/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# Reference base
bases:
- ../../base

# Namespace for dev
namespace: dev

# Add labels
commonLabels:
  environment: dev

# Override image
images:
- name: myapp
  newName: myapp
  newTag: dev-latest

# Set replicas
replicas:
- name: myapp
  count: 1

# Add ConfigMap
configMapGenerator:
- name: myapp-config
  literals:
  - LOG_LEVEL=debug
  - ENVIRONMENT=development

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

bases:
- ../../base

namespace: production

commonLabels:
  environment: production

# Production image with specific tag
images:
- name: myapp
  newName: myapp
  newTag: v1.2.3

# Scale up for production
replicas:
- name: myapp
  count: 5

# Production config
configMapGenerator:
- name: myapp-config
  literals:
  - LOG_LEVEL=info
  - ENVIRONMENT=production

# Apply production-specific patches
patches:
- path: resources.yaml

---
# overlays/production/resources.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      containers:
      - name: myapp
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1Gi

# Build and view output (doesn't apply)
kubectl kustomize overlays/dev

# Apply directly
kubectl apply -k overlays/dev

# Apply production
kubectl apply -k overlays/production

# Diff before applying
kubectl diff -k overlays/production

# Delete resources
kubectl delete -k overlays/dev

# Use case: Add logging sidecar only in production
# overlays/production/deployment-patch.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      # Add sidecar container
      containers:
      - name: logging-sidecar
        image: fluentd:latest
        volumeMounts:
        - name: logs
          mountPath: /var/log
      volumes:
      - name: logs
        emptyDir: {}

---
# overlays/production/kustomization.yaml
patches:
- path: deployment-patch.yaml

# Use case: Scale up to 10 replicas and enable feature flag in production
# overlays/production/kustomization.yaml
patches:
- target:
    kind: Deployment
    name: myapp
  patch: |-
    - op: replace
      path: /spec/replicas
      value: 10
    - op: add
      path: /spec/template/spec/containers/0/env/-
      value:
        name: FEATURE_FLAG
        value: "enabled"

# components/monitoring/kustomization.yaml
# Reusable monitoring configuration
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component

resources:
- servicemonitor.yaml

patches:
- patch: |-
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: not-important
    spec:
      template:
        metadata:
          annotations:
            prometheus.io/scrape: "true"
            prometheus.io/port: "8080"

---
# Enable monitoring in production
# overlays/production/kustomization.yaml
components:
- ../../components/monitoring

---
# Enable monitoring in staging too (reusable!)
# overlays/staging/kustomization.yaml
components:
- ../../components/monitoring

# GitRepository: Define the source
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: myapp-manifests
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/myorg/myapp-manifests.git
  ref:
    branch: main

---
# Kustomization: Define what to deploy
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: myapp-production
  namespace: flux-system
spec:
  interval: 5m
  path: ./kustomize/overlays/production
  prune: true          # Delete resources removed from Git
  sourceRef:
    kind: GitRepository
    name: myapp-manifests
  targetNamespace: production
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: myapp
      namespace: production

---
# Git repository structure:
# myapp-manifests/
# ├─ kustomize/
# │  ├─ base/
# │  │  ├─ deployment.yaml
# │  │  ├─ service.yaml
# │  │  └─ kustomization.yaml
# │  └─ overlays/
# │     ├─ dev/
# │     │  ├─ kustomization.yaml
# │     │  └─ patches.yaml
# │     ├─ staging/
# │     └─ production/
# │        └─ kustomization.yaml

# Old approach: PodSecurityPolicy
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
  - ALL
  allowedCapabilities: []
  volumes:
  - 'configMap'
  - 'emptyDir'
  - 'projected'
  - 'secret'
  - 'downwardAPI'
  - 'persistentVolumeClaim'
  hostNetwork: false
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'MustRunAs'
    seLinuxOptions:
      level: "s0:c123,c456"
  fsGroup:
    rule: 'MustRunAs'
    ranges:
      - min: 1
        max: 65535
  readOnlyRootFilesystem: true

---
# PodSecurityPolicyBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: restricted-psp
rules:
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  verbs: ["use"]
  resourceNames: ["restricted"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: restricted-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: restricted-psp
subjects:
- kind: ServiceAccount
  name: default
  namespace: default

# Deny all traffic by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# Allow specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      tier: backend
  policyTypes:
  - Ingress
  - Egress

  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend
    podSelector:
      matchLabels:
        tier: frontend
    ports:
    - protocol: TCP
      port: 8080

  egress:
  # Allow DNS
  - to:
    - namespaceSelector: {}
    - podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53

  # Allow to database
  - to:
    - podSelector:
        matchLabels:
          tier: database
    ports:
    - protocol: TCP
      port: 5432

  # Allow HTTPS external
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 443