Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
44 lines
1.8 KiB
Markdown
44 lines
1.8 KiB
Markdown
# Environments — Derived Rules
|
|
|
|
> Derives from `domains/devops/first-principles.md` P1 (Reproducibility), P6 (Configuration as Code), P7 (Immutability).
|
|
|
|
## Environment Parity (P1 Reproducibility)
|
|
|
|
- Dev, staging, prod are the same system, different data.
|
|
- The same artifact runs in all three. The same config schema, different values.
|
|
- "Works on my machine" is a parity failure. The machine is the pipeline.
|
|
|
|
## Configuration (P6 Configuration as Code)
|
|
|
|
- Config is in the repo (default values) + environment overrides (secrets, endpoints).
|
|
- No snowflake servers. No "this one is different because we edited it in prod."
|
|
- Config changes are PRs, not SSH sessions.
|
|
|
|
## Secrets (P9 Secret Hygiene via security)
|
|
|
|
- Secrets are per-environment. Dev secrets ≠ prod secrets.
|
|
- Secrets come from a secrets manager (Vault, AWS Secrets Manager, Doppler), not env files in prod.
|
|
- `.env` files are for local dev only. Prod uses the manager.
|
|
|
|
## Promotion (P5 Progressive Delivery via devops)
|
|
|
|
- Code moves dev → staging → prod. Never the reverse.
|
|
- A hotfix to prod is backported to staging and dev. Don't let them diverge.
|
|
- Promotion is automated. The pipeline decides when code is ready, not a human.
|
|
|
|
## Data (P1, domains/data P8 Lifecycle Awareness)
|
|
|
|
- Prod data is sacred. Never copy prod to dev without anonymization.
|
|
- Staging uses prod-like data (anonymized, sampled). Dev uses synthetic data.
|
|
- A test that runs against prod data is a test that can destroy prod data. Don't.
|
|
|
|
## What Violates Environment Discipline
|
|
|
|
| Violation | Principle |
|
|
|-----------|-----------|
|
|
| "It works on my machine" | P1 Parity |
|
|
| Manual config edit in prod | P6 Configuration as Code |
|
|
| Dev secret reused in prod | P9 Secret Hygiene |
|
|
| Copy prod DB to dev | P1, data P8 |
|
|
| Hotfix in prod not backported | P5 (divergence) |
|
|
| A snowflake server | P1, P6 | |