K8s clusterrole and clusterrolebinding

• clusterrole:
  • whole cluster level access provider
  • list of permissions:
    • nodes, crds, all namespaces

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ClusterRole-dev
rules:
- apiGroups: [""]
  resources: ["pods", "nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["app"]
  resources: ["deployment"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

• clusterrolebinding
  • whole cluster level access provider
  • scope:
    • serviceaccount
    • user
    • Group
    • everywhere we can assign clusterrole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clusterrolebinding-dev
roleRef:
  kind: ClusterRole
  name: ClusterRole-dev
subjects:
  - kind: ServiceAccount
    name: devops
    namespace: dev

 kubectl get clusterrolebinding,clusterrole | grep dev

List subjects kinds will suppourt CRB

• user
• group
• ServiceAccount

Keyrules

• no deny. its only allow RBAC
• CLusterrole+ clusterrolebinding will access in all namespaces
• ClusterRole+ rolebinding this will allow only one namespace
• nodes, namespace, pvs, crds this scope for cluster role

K8s Crds (Custom Resource Definition)

• A crd lets you add your own object type in k8s
• inbuild k8s types are pod, deployment and service
• crd you can add types like website, Database or backup …etc
• kubectl use to access your CRD build-type

Terms

• CRD: this is Definition a new Type we can add like website
• CR (Custom Resource): This is actual object of that type: “Mysite is website”
• controller/Operator: A program that watch objects and does real works (creates pods, service…etc)

lets create website Type Crd

• Offical Docs

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: websites.demo.example.com # <p> The name of the CRD must be in the form: <plural>.<group>
spec:
  group: demo.example.com
  scope: Namespaced
  names:
    plural: websites
    singular: website
    kind: Website
    shortNames:
      - ws
  versions:
    - name: v1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              required:
                - url
              properties:
                url:
                  type: string
                description:
                  type: string
                replicas:
                  type: integer
                  minimum: 1
                  maximum: 5
                  default: 1
      additionalPrinterColumns:
        - name: URL
          type: string
          jsonPath: .spec.url
        - name: Replicas
          type: integer
          jsonPath: .spec.replicas
        - name: Age
          type: date
          jsonPath: .metadata.creationTimestamp

Let create CR

apiVersion: demo.example.com/v1
kind: Website
metadata:
  name: my-site
spec:
  url: "https://www.example.com"
  description: "My personal website"
  replicas: 3

check Website

• kubectl get websites

apiVersion: demo.example.com/v1
kind: Website
metadata:
  name: bad-site
spec:
  url: "https://www.example.com"
  description: "My personal website"
  replicas: 10

# Error
The Website "bad-site" is invalid: spec.replicas: Invalid value: 10: spec.replicas in body should be less than or equal to 5

Manage permissions for crd

- apiGroups: ["demo.example.com"]
  resources: ["Website"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---

Helm:

• Helm is package manager for Kubernetes. like apt to use for ubuntu or npm is used for nodejs or yum/dnf for rehat

Helm is Problem sloves:

• A real application need many k8s mainfests: Deployment, service, CM, Secrets …etc
• You can copy-paste multiple yaml file for Different ENVs (dev, stage, QA)

QT-Application
  --> frontend
    --> deploy
    --> svc
    --> pods
    --> cm 
    --> secrets
  --> backend
    --> deploy
    --> svc
    --> pods
    --> cm 
    --> secrets
    --> crd
    --> cr's
  --> db
    --> deploy
    --> svc
    --> pods
    --> cm 
    --> secrets

• changing image tags and increase/decrease replicas need edit multiple files
• There is no single “install”, “upgrade”, or “rollback” for whole application
• Sharing an application files or folder yaml is not possible

Helm Gives you

• Templating: One set of templates, many enviroments driven by values
• Packaging: bundle all mainfests into one version unit (a Chart)
• Release Management: Install, upgrade , rollback and uninstall as a one operation
• Dependancy Management: A chart can depends on other charts (frontend + db )
• Sharing: publish charts to repositories or OCI repositries

Helm Architecture:

• Helm cli directly talk to k8s api server
• Release history is stored as screct named sh.helm.release.v1.<releasename>.v<revision> in the release’s namespace.

KeyConcepts:

1. Chart: A package: a folder or .tgz which will containing template and default values and metadata.
2. Release: one install instance of a chart . we can instance same chart twice. you will get two version.
3. Revision: every install, upgrade …etc its create new version. a number of version of a release
4. Values: configuration injected into templates. Defaults will be values.yaml and can be overridden.
5. Template: A k8s mainfests with Go Template plcaeholders
6. subcharts/Dependency: A chart that aanother chart

qt-application
    chart.yaml
        name: qt-application
        dependency:
            name: frontend
            chart: subcharts/front-end
    subcharts:
        front-end
        backend
        db

Install helm Click_Here for Offical docs

Ubuntu

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
chmod 700 get_helm.sh
./get_helm.sh

Windows

winget install Helm.Helm
# or 
choco install kubernetes-helm --version=3.17.4 -y

Verify version helm version

Deploy existing charts

# Add repositries
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Search for charts
helm search repo nginx
# Less will scroll 
helm search repo nginx --versions | less
# Head will top 10 
helm search repo nginx --versions | head
# Tail last 10 version 
helm search repo nginx --versions | tail

# Inspect chart before install
helm show chart bitnami/nginx

helm show readme bitnami/nginx 

## Install nginx helm chart
helm install my-nginx bitnami/nginx --version 25.2.11 --namespace web --create-namespace

helm upgrade -i my-nginx bitnami/nginx --version 25.2.11 --namespace web --create-namespace

# Helm list 
helm list -A
helm list -n web

# check status
helm status my-nginx -n web

# Remove it
helm uninstall  my-nginx -n web

Task:

1. deploy jenkins in k8s https://charts.jenkins.io/
2. try to pratice all above cmds.

Next topics

• helm
• monitoring
• eks
• aks