N100FN100F
Published on

Environments that genuinely resemble each other

Acceptance is only worth something if it resembles production. What can change between environments, what must never change and how to keep that difference written down and small.

Service line Platform Engineering

When acceptance lies

An application passes every test in acceptance and fails in production. On investigation the difference emerges: a different operating system version, a different network configuration, a service that was simulated in acceptance and is not in production. Acceptance was not testing what was going to happen in production; it was testing something else.

What changes and what does not

What can change between environmentsA matrix of three environments: what never varies and what may vary if written down.PLATFORM · ENVIRONMENTSWhat can change and what cannotDevelopmentAcceptanceProductionNEVER VARIESArtefact (digest)identicalidenticalidenticalPlatform and versionsidenticalidenticalidenticalDeployment methodidenticalidenticalidenticalShape of the configurationidenticalidenticalidenticalMAY VARY, IF WRITTEN DOWNSizesmallersmallerfullDatatesttestrealSecret valuesownownownAddressesownownpublicThe same environments created with the same code, different parameters.Whatever was configured by hand ends up different.N100F · n100f.com

Between environments there are legitimate differences and dangerous ones.

They may vary, as long as they are written down:

  • The size (less capacity in development).
  • The data (in acceptance, test or anonymised data; never real personal data without protection).
  • The values of the secrets (same names, different values).
  • The publication addresses.

They must never vary:

  • The deployed artefact (the same digest, as we saw in the previous article).
  • The runtime platform and its versions.
  • The deployment method.
  • The shape of the configuration: the same keys, even if the values change.

How it is maintained

  • Per-environment configuration lives separately from the code and has the same structure in all of them.
  • The differences are in one place, generally the registry, and not scattered across scripts.
  • The environments are created with the same infrastructure code, with different parameters. If an environment was configured by hand, sooner or later it will differ from the others.
  • They are compared periodically: an automatic review detects what has drifted apart.

With identical artefacts and comparable environments, one last protection remains before publishing: validating everything that can be checked without anybody having to look at it.

How we apply it: Platform Engineering.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk