# nginx_CD_chart

Helm charts for the demo stack, with three isolated environments: **dev**, **stg**, **prod**.

```
nginx_CD_chart/
├── nginx-chart/
│   ├── Chart.yaml
│   ├── values.yaml                     # base defaults (shared)
│   ├── templates/
│   │   ├── deployment.yaml
│   │   ├── service.yaml
│   │   └── _helpers.tpl
│   └── environments/
│       ├── dev/
│       │   ├── values.yaml             # dev overrides
│       │   ├── configmap.yaml          # dev ConfigMap (plain manifest)
│       │   └── secret.yaml             # dev Secret(s) (plain manifest)
│       ├── stg/
│       │   ├── values.yaml
│       │   ├── configmap.yaml
│       │   └── secret.yaml
│       └── prod/
│           ├── values.yaml
│           ├── configmap.yaml
│           └── secret.yaml
└── mysql-chart/
    ├── Chart.yaml
    ├── values.yaml                     # base defaults (shared)
    ├── templates/
    │   ├── statefulset.yaml
    │   └── service.yaml
    └── environments/
        ├── dev/
        │   ├── values.yaml
        │   ├── configmap.yaml
        │   └── secret.yaml
        ├── stg/
        │   ├── values.yaml
        │   ├── configmap.yaml
        │   └── secret.yaml
        └── prod/
            ├── values.yaml
            ├── configmap.yaml
            └── secret.yaml
```

## How it works

For each environment there is a folder under `environments/<env>/` containing three files:

| File | Purpose | How it is applied |
|------|---------|-------------------|
| `values.yaml` | Helm overrides for that env (namespace, replica count, image tag, storage size, resource names) | `helm -f` |
| `configmap.yaml` | Non-secret config (`ConfigMap`), e.g. nginx `default.conf` / mysql settings | `kubectl apply` |
| `secret.yaml` | Credentials (`Secret`), e.g. registry pull secret / mysql passwords | `kubectl apply` |

The chart's `templates/` stay generic and read the resource **names** from `values.yaml`
(`configMap.name`, `secret.name`), so the same templates render for every environment.

## Deploy an environment

Replace `<env>` with `dev`, `stg` or `prod`.

```bash
# 1. Namespace + ConfigMap + Secret (plain manifests for this env)
kubectl create namespace <env> --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -f nginx-chart/environments/<env>/configmap.yaml
kubectl apply -f nginx-chart/environments/<env>/secret.yaml
kubectl apply -f mysql-chart/environments/<env>/configmap.yaml
kubectl apply -f mysql-chart/environments/<env>/secret.yaml

# 2. The Helm releases (values merged on top of each chart's base values.yaml)
helm upgrade --install mysql ./mysql-chart -n <env> --create-namespace \
  -f mysql-chart/environments/<env>/values.yaml

helm upgrade --install nginx ./nginx-chart -n <env> --create-namespace \
  -f nginx-chart/environments/<env>/values.yaml
```

Example — deploy **stg**:

```bash
kubectl apply -f nginx-chart/environments/stg/configmap.yaml
kubectl apply -f nginx-chart/environments/stg/secret.yaml
helm upgrade --install nginx ./nginx-chart -n stg --create-namespace \
  -f nginx-chart/environments/stg/values.yaml
```

## Preview the rendered manifests

```bash
helm template nginx ./nginx-chart -f nginx-chart/environments/stg/values.yaml
helm template mysql ./mysql-chart -f mysql-chart/environments/prod/values.yaml
```

## Notes / things to change before real use

- `secret.yaml` files contain **plaintext** example credentials. For real use, commit
  encrypted secrets (e.g. SealedSecrets / SOPS) or create them from CI secrets — never
  store production passwords in git.
- `harbor-secret` (docker-registry pull secret) is provided per env with placeholder
  credentials; either replace the values or create it in-cluster with
  `kubectl create secret docker-registry ...` (command is in the file header).
- The base `values.yaml` defaults to the `dev` namespace, so always pass `-f environments/<env>/values.yaml`.