I've been struggling with our team's DevOps and GitOps workflow for a couple of years now, and I'm looking for advice on how to make it more efficient. Here's how it currently works: team members push their code to feature branches and then request me to merge them into the develop and staging branches, which are linked to specific environments. After merging, I wait for the pipeline to finish and then confirm the deployment through chat.
Promotion to production follows a sequential process: we merge feature branches into a release branch before moving to production. The environment setup is as follows:
1. The develop branch is used for the development environment (not on local devices).
2. The staging branch mirrors the develop branch but has a different commit hash due to various merges.
3. The release branch corresponds to the UAT environment.
4. The master branch is for production.
Unfortunately, not all feature branches that get merged into develop and staging make it to the master branch and tend to go stale. I want to change this to be a more self-service process, but the team seems reluctant to adapt. While I know automations could simplify things, they seem to rely on me too much for GitOps and just want to commit and push. Ideally, I'd prefer to have only the master branch and manage environments and promotions directly through it, maintaining the same git commit hash throughout the process. Any suggestions?
3 Answers
I use a main branch with directories, and all my merge requests handle those branches directly. It keeps things simple without any unnecessary complicating setups. I rely on a declarative config that automatically gets read and acted upon; super straightforward!
We follow a trunk-based workflow where there's just one main branch. Feature branches are short-lived and merge directly into main via pull requests with some policy checks. This main branch auto-deploys to our dev environment throughout the day. We also have a nightly job that promotes changes from main to staging, but only if there's a non-breaking build, which could also be triggered manually.
In my setup, the GitOps repo is solely based on the main branch. We structure it so that cluster-wide services and application dependencies are clearly defined. When a feature branch is created with a specific label, a job automatically generates an environment in the infra repo for the corresponding services, keeping everything neat without extra overhead for me or my team!
How do you ensure security between production and the other environments in your setup?