# Exercise 2: A Helm Release Strategy for 12 Services and 3 Environments

`PetPal` has 12 microservices deployed with copy-pasted YAML per environment (dev, staging, prod). Third-party components (ingress-nginx, cert-manager, external-secrets, kube-prometheus-stack) were installed by hand with `helm install` and nobody knows which values were used.

## Deliverables

1. **Chart strategy**: one shared "service" library chart vs a chart per service vs Kustomize — choose and justify; show the repository layout (charts, values per environment).
2. **Versioning**: how chart versions and app versions are bumped and published (OCI registry), and how a service pins the shared chart version.
3. **Third-party components**: how to recover the current values (`helm get values`), put them in Git, pin versions, and upgrade safely (read changelogs, `helm diff`, staging first).
4. **Secrets**: how services get secrets without putting them in values (External Secrets, SOPS) — and why values in release Secrets matter.
5. **Deployment flow**: from merged PR to prod with `helm upgrade --atomic` in CI **or** GitOps (Argo CD Applications / Flux HelmReleases) — compare and pick.
6. **Migrations**: how pre-upgrade hooks run DB migrations safely (expand/contract, idempotency, timeouts) and what happens on failure with `--atomic`.

## Requirements Checklist

- [ ] Layout with shared chart (or justified alternative), `values/{dev,staging,prod}/<service>.yaml`, minimal per-service overrides.
- [ ] SemVer for charts, `appVersion` set from the image tag, charts pushed to an OCI registry, versions pinned.
- [ ] `helm get values -n <ns> <release>` recovery, versions pinned in Git, `helm diff` reviewed, upgrades tested in staging.
- [ ] No secrets in values; ESO or SOPS; note that release Secrets contain rendered values.
- [ ] Deployment flow chosen with trade-offs (CI push vs GitOps pull, drift detection, rollback).
- [ ] Migration hooks idempotent, backward compatible (expand/contract), with `activeDeadlineSeconds`; `--atomic` rolls back app resources but not the database.