Staging and Production

Layering BookNest's Staging and Production Overlays

Staging runs API 1.3 in its own namespace with one front-end replica, a throwaway generated password and no TLS listener, since it has no certificate:

overlays/staging/kustomization.yaml: staging's differences from the baseYAML

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: booknest-staging
resources: [../../k8s]
images: [{ name: localhost:33500/booknest-api, newTag: "1.3" }]
secretGenerator:
- { name: db-credentials, literals: [username=booknest, password=staging-only] }
patches:
- target: { kind: Deployment, name: web }
  patch: |-
    - { op: replace, path: /spec/replicas, value: 1 }
    - op: replace
      path: /spec/template/spec/containers/0/env/0/value
      value: api.booknest-staging.svc.cluster.local:3000
- target: { kind: Gateway, name: booknest }
  patch: '[{ "op": "remove", "path": "/spec/listeners/1" }]'

The namespace transformer does not rewrite strings, so the front end's API_UPSTREAM, which names the namespace, needs a patch of its own. Production only pins the tag and adds a label:

overlays/production/kustomization.yaml: productionYAML

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: booknest
resources: [../../k8s]
labels: [{ pairs: { environment: production } }]
images: [{ name: localhost:33500/booknest-api, newTag: "1.4" }]

Deploying staging, then checking what production would changeShell

kubectl create namespace booknest-staging >/dev/null
kubectl apply -k overlays/staging | grep -E 'secret|deployment'
kubectl -n booknest-staging rollout status deployment/api >/dev/null
kubectl -n booknest-staging get pods -l tier=api
kubectl diff -k overlays/production 2>/dev/null | grep '^[-+] ' | sort | uniq -c
kubectl apply -k overlays/production >/dev/null 2>&1
git add k8s/kustomization.yaml overlays
git commit -qm "Add Kustomize staging and production overlays"

Output

secret/db-credentials-7ctkcbf986 created
deployment.apps/api created
deployment.apps/web created
NAME                   READY   STATUS    RESTARTS      AGE
api-79974f67d6-jxm7l   1/1     Running   3 (32s ago)   48s
api-79974f67d6-lm79v   1/1     Running   3 (32s ago)   48s
     11 +    environment: production

apply -k sends everything at once, and with no hooks or init container the API crashed until PostgreSQL 1,289 was up. The server-side diff shows the production overlay changes only a label on eleven live objects.

MENU