From time to time I stumble upon changes in deployment-charts repo that have not been applied to the clusters.

We should come up with some alert (similar to unmerged puppet changes) if changes have not been applied for some time.

There are multiple ways to implement that:

• Periodically diff all releases against all clusters
  • - Needs privileges and is probably quite slow
• Write the git hash that was applied last to some namespace annotation or configmap
  • + Faster, does not need very broad privileges to check (just read on git and namespace objects)
  • - Not sure how to generate a "good" git hash for this as we share the repo for lots of stuff

First iteration could check for helmfile.d/admin only as thats more easy to forget and less easy to apply (or just skip and let some developer decide),