5 environment mistakes

Quick reference

1. ❌ Prod secrets in staging — Staging is weaker, shared and logged, so a leak there reaches production. ✅ One secret per environment — Scoped values, separate rotation, separate blast radius.

2. ❌ Hand-edited config on a host — Nobody records it, and the next deploy erases it or keeps a lie. ✅ Change the manifest, then apply — Reviewed, repeatable and visible in the diff.

3. ❌ A snowflake server — One machine nobody can rebuild is one disk away from an outage. ✅ Rebuild from code in minutes — Replacement is routine, so failure is boring.

4. ❌ Previews that never expire — They keep running, keep costing money and keep a door open. ✅ Destroy on merge or close — A sweeper deletes anything older than seven days.

5. ❌ No seed data — An empty preview proves nothing about a real query. ✅ Seeded, synthetic fixtures — Every preview starts with the same known dataset.

Explained

The five

1. Production secrets in staging. Staging is weaker, shared and logged, so a leak there becomes a production incident with a staging entry point. Give each environment its own credentials and its own rotation.

1. Hand-edited config on a host. The change works, nobody records it, and the next deploy either erases it or preserves a state the repo does not describe. Change the manifest, then apply it.

1. A snowflake server. One machine that nobody can rebuild is one disk failure from an outage, and the rebuild recipe lives in someone's memory. Replace it from code in minutes.

1. Previews that never expire. They keep running, keep costing money and keep a URL and secrets reachable. Destroy on merge or close, and sweep anything older than seven days.

1. No seed data. An empty preview proves nothing about a real query, so the first realistic request fails in front of a reviewer. Seed a small synthetic dataset on every create.

The pattern

In one line

Set a ttl

$kubectl delete ns pr142