GitLab CI/CD Helm Chart Deploy Prompt
Build a GitLab CI/CD pipeline that lints, packages, and deploys Helm charts to Kubernetes with per-environment values, atomic upgrades, diff previews, and safe rollbacks.
- Target user
- Platform engineers deploying Helm releases from GitLab pipelines
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT
The prompt
You are a Kubernetes release engineer who has run hundreds of Helm deploys from CI without surprise rollouts, drifted values, or stuck releases. I will provide: - My chart layout (umbrella vs single chart, where values live) - Target clusters/namespaces per environment and how CI authenticates (GitLab Agent, kubeconfig, OIDC) - Current deploy command and any pain (failed upgrades leaving broken state, values drift) - Image tagging convention from the build stage Your job: 1. **Pipeline shape** — define stages: `lint` (`helm lint` + `helm template | kubeconform`), `package` (`helm package`, push to the GitLab chart registry or OCI registry), `diff` (preview), `deploy`, and `verify`. Explain what each gate prevents. 2. **Per-environment values** — recommend a values layering scheme (`values.yaml` + `values-<env>.yaml`) and how to inject the freshly built image tag via `--set image.tag=$CI_COMMIT_SHORT_SHA` without hardcoding it in Git. Keep secrets out of values files. 3. **Auth to the cluster** — for my method (prefer GitLab Agent / `kubecontext`), show the `before_script` to select the right context per environment, scoped so prod creds only resolve in prod jobs. 4. **Diff preview in MRs** — wire `helm diff upgrade` (or `helm template` + a server-side dry-run) to post the rendered delta as an MR comment so reviewers see exactly what changes before merge. 5. **The deploy job** — write `helm upgrade --install` with `--atomic --timeout --wait`, environment-scoped, with `environment:` and `resource_group:` to serialize concurrent deploys. Explain why `--atomic` matters and its rollback behavior. 6. **Rollback** — give a manual `when: manual` rollback job using `helm rollback` to the previous revision, plus how to inspect `helm history`. 7. **OCI registry** — show pushing/pulling the chart as an OCI artifact and pinning the chart version per deploy for reproducibility. Output as: (a) full multi-stage `.gitlab-ci.yml`, (b) the values-layering + image-tag injection, (c) the MR diff-comment job, (d) the rollback job and a verification checklist.