Homework

Design and implement a production-grade multi-environment deployment pipeline with encrypted secrets.

Task 1 — Production-Grade Directory Structure and Values Layering

Design a multi-environment Helm deployment for a web application with the following requirements:

• Three environments: dev, staging, and prod
• Two regions for production: us-east and eu-west
• A base values file shared across all environments
• Region-specific values files that layer on top of the environment file

Your directory structure must follow the layered pattern:

deploy/
  charts/
    webapp/              # your Helm chart
  values/
    base.yaml            # shared defaults
    envs/
      dev.yaml
      staging.yaml
      prod.yaml
    regions/
      us-east.yaml
      eu-west.yaml

The values files must differ across environments and regions on at least these dimensions:

Demonstrate the layering by rendering each variant and verifying the merge order:

# Dev (base + dev)
helm template webapp deploy/charts/webapp \
  -f deploy/values/base.yaml \
  -f deploy/values/envs/dev.yaml

# Prod US-East (base + prod + us-east)
helm template webapp deploy/charts/webapp \
  -f deploy/values/base.yaml \
  -f deploy/values/envs/prod.yaml \
  -f deploy/values/regions/us-east.yaml

# Prod EU-West (base + prod + eu-west)
helm template webapp deploy/charts/webapp \
  -f deploy/values/base.yaml \
  -f deploy/values/envs/prod.yaml \
  -f deploy/values/regions/eu-west.yaml

Task 2 — Helmfile with Encrypted Secrets

Build a complete Helmfile configuration that manages all environments from Task 1, including encrypted secrets. Your helmfile.yaml must:

1. Define dev, staging, prod-us-east, and prod-eu-west as named environments
2. Compose the correct values file layers for each environment (base + env + optional region)
3. Include a SOPS-encrypted secrets file per environment under deploy/values/secrets/
4. Use the secrets: field in Helmfile releases for automatic decryption

Your secrets files must contain at least:

• secrets.dbPassword — different per environment
• secrets.apiKey — different per environment
• secrets.tlsCert — present only in staging and production

Example Helmfile structure:

# helmfile.yaml
environments:
  dev:
    values:
      - namespace: dev
  staging:
    values:
      - namespace: staging
  prod-us-east:
    values:
      - namespace: prod
      - region: us-east
  prod-eu-west:
    values:
      - namespace: prod
      - region: eu-west

---

releases:
  - name: webapp-{{ .Environment.Name }}
    chart: deploy/charts/webapp
    namespace: {{ .Values.namespace }}
    createNamespace: true
    values:
      - deploy/values/base.yaml
      - deploy/values/envs/{{ ... }}.yaml   # your logic here
      {{- if .Values.region }}
      - deploy/values/regions/{{ .Values.region }}.yaml
      {{- end }}
    secrets:
      - deploy/values/secrets/{{ .Environment.Name }}.yaml

Demonstrate all of the following commands:

# Preview what each environment will deploy
helmfile -e dev template
helmfile -e prod-us-east template

# Show the diff before applying
helmfile -e staging diff

# Deploy
helmfile -e dev apply

# List managed releases
helmfile -e dev list

# Clean up
helmfile -e dev destroy

Task 3 — CI Pipeline Design

Write a GitHub Actions workflow (or equivalent CI configuration) that implements the following multi-environment deployment pipeline:

1. On push to any branch: run helmfile -e dev template and helm lint for all environments to validate the chart
2. On merge to main: automatically deploy to staging with helmfile -e staging apply
3. On Git tag (v*): deploy to both production regions with manual approval gates

The workflow must handle secrets correctly:

• The age private key is stored as a GitHub Actions secret (SOPS_AGE_KEY)
• The workflow writes the key to a temporary file and sets SOPS_AGE_KEY_FILE
• The key file is cleaned up after deployment

Provide the complete .github/workflows/deploy.yaml file and explain each step in inline comments.

Grading Rubric