mdsamsulhaque
bbf501269d
- Move env-specific config into environments/<env>/{values,configmap,secret}.yaml
for both nginx-chart and mysql-chart (dev, stg, prod)
- Make templates env-agnostic: resource names come from values
(configMap.name, secret.name)
- nginx deployment mounts env ConfigMap and loads env Secret via envFrom
- mysql statefulset reads DB config from ConfigMap, passwords from Secret
- Remove mysql-chart/templates/secret.yaml (secrets are now per-env manifests)
- Add README with layout and deploy commands
106 lines
4.1 KiB
Markdown
106 lines
4.1 KiB
Markdown
# nginx_CD_chart
|
|
|
|
Helm charts for the demo stack, with three isolated environments: **dev**, **stg**, **prod**.
|
|
|
|
```
|
|
nginx_CD_chart/
|
|
├── nginx-chart/
|
|
│ ├── Chart.yaml
|
|
│ ├── values.yaml # base defaults (shared)
|
|
│ ├── templates/
|
|
│ │ ├── deployment.yaml
|
|
│ │ ├── service.yaml
|
|
│ │ └── _helpers.tpl
|
|
│ └── environments/
|
|
│ ├── dev/
|
|
│ │ ├── values.yaml # dev overrides
|
|
│ │ ├── configmap.yaml # dev ConfigMap (plain manifest)
|
|
│ │ └── secret.yaml # dev Secret(s) (plain manifest)
|
|
│ ├── stg/
|
|
│ │ ├── values.yaml
|
|
│ │ ├── configmap.yaml
|
|
│ │ └── secret.yaml
|
|
│ └── prod/
|
|
│ ├── values.yaml
|
|
│ ├── configmap.yaml
|
|
│ └── secret.yaml
|
|
└── mysql-chart/
|
|
├── Chart.yaml
|
|
├── values.yaml # base defaults (shared)
|
|
├── templates/
|
|
│ ├── statefulset.yaml
|
|
│ └── service.yaml
|
|
└── environments/
|
|
├── dev/
|
|
│ ├── values.yaml
|
|
│ ├── configmap.yaml
|
|
│ └── secret.yaml
|
|
├── stg/
|
|
│ ├── values.yaml
|
|
│ ├── configmap.yaml
|
|
│ └── secret.yaml
|
|
└── prod/
|
|
├── values.yaml
|
|
├── configmap.yaml
|
|
└── secret.yaml
|
|
```
|
|
|
|
## How it works
|
|
|
|
For each environment there is a folder under `environments/<env>/` containing three files:
|
|
|
|
| File | Purpose | How it is applied |
|
|
|------|---------|-------------------|
|
|
| `values.yaml` | Helm overrides for that env (namespace, replica count, image tag, storage size, resource names) | `helm -f` |
|
|
| `configmap.yaml` | Non-secret config (`ConfigMap`), e.g. nginx `default.conf` / mysql settings | `kubectl apply` |
|
|
| `secret.yaml` | Credentials (`Secret`), e.g. registry pull secret / mysql passwords | `kubectl apply` |
|
|
|
|
The chart's `templates/` stay generic and read the resource **names** from `values.yaml`
|
|
(`configMap.name`, `secret.name`), so the same templates render for every environment.
|
|
|
|
## Deploy an environment
|
|
|
|
Replace `<env>` with `dev`, `stg` or `prod`.
|
|
|
|
```bash
|
|
# 1. Namespace + ConfigMap + Secret (plain manifests for this env)
|
|
kubectl create namespace <env> --dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl apply -f nginx-chart/environments/<env>/configmap.yaml
|
|
kubectl apply -f nginx-chart/environments/<env>/secret.yaml
|
|
kubectl apply -f mysql-chart/environments/<env>/configmap.yaml
|
|
kubectl apply -f mysql-chart/environments/<env>/secret.yaml
|
|
|
|
# 2. The Helm releases (values merged on top of each chart's base values.yaml)
|
|
helm upgrade --install mysql ./mysql-chart -n <env> --create-namespace \
|
|
-f mysql-chart/environments/<env>/values.yaml
|
|
|
|
helm upgrade --install nginx ./nginx-chart -n <env> --create-namespace \
|
|
-f nginx-chart/environments/<env>/values.yaml
|
|
```
|
|
|
|
Example — deploy **stg**:
|
|
|
|
```bash
|
|
kubectl apply -f nginx-chart/environments/stg/configmap.yaml
|
|
kubectl apply -f nginx-chart/environments/stg/secret.yaml
|
|
helm upgrade --install nginx ./nginx-chart -n stg --create-namespace \
|
|
-f nginx-chart/environments/stg/values.yaml
|
|
```
|
|
|
|
## Preview the rendered manifests
|
|
|
|
```bash
|
|
helm template nginx ./nginx-chart -f nginx-chart/environments/stg/values.yaml
|
|
helm template mysql ./mysql-chart -f mysql-chart/environments/prod/values.yaml
|
|
```
|
|
|
|
## Notes / things to change before real use
|
|
|
|
- `secret.yaml` files contain **plaintext** example credentials. For real use, commit
|
|
encrypted secrets (e.g. SealedSecrets / SOPS) or create them from CI secrets — never
|
|
store production passwords in git.
|
|
- `harbor-secret` (docker-registry pull secret) is provided per env with placeholder
|
|
credentials; either replace the values or create it in-cluster with
|
|
`kubectl create secret docker-registry ...` (command is in the file header).
|
|
- The base `values.yaml` defaults to the `dev` namespace, so always pass `-f environments/<env>/values.yaml`.
|