$ helmfile apply
Adding repo stable https://releases.wikimedia.org/charts/
"stable" has been added to your repositories

Updating repo
Hang tight while we grab the latest from your chart repositories...
...Skip local chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈ Happy Helming!⎈ 

helmfile.yaml: basePath=.
Comparing staging stable/blubberoid
blubberoid, blubberoid-staging, Deployment (apps) has changed:
  # Source: blubberoid/templates/deployment.yaml
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: blubberoid-staging
    labels:
      app: blubberoid
      release: staging
      heritage: Tiller
  spec:
    selector:
      matchLabels:
        app: blubberoid
        release: staging
    replicas: 1
    template:
      metadata:
        labels:
          app: blubberoid
          release: staging
+       annotations:
+         checksum/tls: 3cd9d8586150bdf086306ee69b4669786aa48680a86e3c43fb892212a1c94e1e
      spec:
        containers:
          # The main application container
          - name: blubberoid-staging
            image: "docker-registry.discovery.wmnet/wikimedia/blubber:2019-07-23-155043-production"
            args: ["--policy", "/etc/blubberoid/policy.yaml"]
            imagePullPolicy: IfNotPresent
            ports:
              - containerPort: 8748
            livenessProbe:
              tcpSocket:
                port: 8748
              
            readinessProbe:
              httpGet:
                path: /?spec
                port: 8748
              
            env:
              - name: SERVICE_IDENTIFIER
                value: blubberoid-staging
            volumeMounts:
              - name: policy-volume
                mountPath: /etc/blubberoid
            resources:
              requests:
                cpu: 100m
                memory: 100Mi
                
              limits:
                cpu: 1
                memory: 100Mi
                
+         - name: blubberoid-staging-tls-proxy
+           image: docker-registry.discovery.wmnet/envoy-tls-local-proxy:1.11.2-1
+           imagePullPolicy: IfNotPresent
+           env:
+             - name: SERVICE_NAME
+               value: staging
+             - name: SERVICE_PORT
+               value: "8748" # env variables need to be strings
+             - name: PUBLIC_PORT
+               value: "4666"
+           ports:
+             containerPort: 4666
+           volumeMounts:
+             - name: tls-certs-volume
+               mountPath: /etc/envoy/ssl
+               readOnly: true
        volumes:
          - name: policy-volume
            configMap:
              name: staging-policy
+         - name: tls-certs-volume
+           configMap:
+             name: blubberoid-staging-tls-proxy-certs
blubberoid, blubberoid-staging, NetworkPolicy (networking.k8s.io) has changed:
  # Source: blubberoid/templates/networkpolicy.yaml
  # Pre kubernetes 1.8 NetworkPolicy objects could not be updated
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: blubberoid-staging
  spec:
    podSelector:
      matchLabels:
        app: blubberoid
        release: staging
    policyTypes:
      - Ingress
    ingress:
      - ports:
        - port: 8748
          protocol: TCP
+       - port: 4666
+         protocol: TCP
blubberoid, blubberoid-staging-tls-proxy-certs, ConfigMap (v1) has been added:
- 
+ # Source: blubberoid/templates/configmap.yaml
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: blubberoid-staging-tls-proxy-certs
+   labels:
+     app: blubberoid
+     chart: blubberoid-0.0.13
+     release: staging
+     heritage: Tiller
+ data:
+   service.crt: |-
[CUT]
+   service.key: |-
[CUT]
blubberoid, blubberoid-staging-tls-service, Service (v1) has been added:
- 
+ # Source: blubberoid/templates/service.yaml
+ kind: Service
+ apiVersion: v1
+ metadata:
+   name: blubberoid-staging-tls-service
+   labels:
+     app: blubberoid
+     release: staging
+     heritage: Tiller
+ spec:
+   type: NodePort
+   selector:
+     app: blubberoid
+     release: staging
+   ports:
+     - name: blubberoid-staging-https
+       protocol: TCP
+       port: 4666
+       nodePort: 4666
identified at least one change, exiting with non-zero exit code (detailed-exitcode parameter enabled)

Upgrading stable/blubberoid

List of releases in error :
RELEASE
staging
in ./helmfile.yaml: failed processing release staging: helm exited with status 1:
  Error: UPGRADE FAILED: no ConfigMap with the name "blubberoid-staging-tls-proxy-certs" found