Environments and restore

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

The platform keeps the history of everything you apply. You can therefore freeze what is running while you prepare what comes next, go back to a previous version, or clone a tenant. To keep several environments side by side (dev, prod…), create one tenant per environment.

Which tool for which need

Need	Command
Keep several environments side by side	one tenant per environment: `sng tenant create acme-dev`, then `sng tenant use acme-dev`
Freeze what is running while you keep preparing	`sng env checkout <name>`
Release what has been prepared	`sng env refresh` or `sng env checkout main`
Go back to a frozen version	`sng env restore env/<tenant>/<name>`
A new environment that starts from a copy of the existing one	`sng env create-tenant <new-tenant>`

One tenant per environment

An environment is a tenant: each has its own manifests, permissions, quota, and domains. Name them acme-dev, acme-prod, acme-staging… (the bare names dev, prod, and staging are reserved, see Tenant names).

sng tenant use acme-dev
sng apply ./manifests          # applied in acme-dev
sng tenant use acme-prod       # switch to the other environment
sng apply ./manifests          # applied in acme-prod

What you get: App web in acme-dev and App web in acme-prod are two distinct resources, with their own permissions and their own quota.

To start from a copy of the existing one, see "Create a tenant from another one" below.

Freeze what is running

By default, each sng apply is implemented immediately. During a sensitive period (a launch, a demo), you can freeze the tenant: what is running no longer changes, but you keep applying your manifests, which are stored for later.

sng env checkout v2

The command outputs nothing when it succeeds; the tenant is frozen in less than a minute. Check:

sng env list

branch	v2
follow-main	false

branch is main when the tenant is not frozen, or <name> when it is frozen on version <name>.
follow-main is true when the frozen version automatically catches up with your new apply runs (see below).

Release what has been prepared

Three ways to resume:

sng env refresh                   # applies what has been prepared right away, then keeps following
sng env checkout v2 --follow      # stays on v2, but automatically catches up with each new apply
sng env checkout main             # goes back to normal operation

Command	Effect
`checkout NAME`	Freezes the tenant on version `NAME`, created from what is running if it does not exist
`checkout NAME --follow`	Same, but the version moves forward on its own with each new `apply`
`refresh`	Immediately catches up with pending `apply` runs and enables following
`checkout main`	Goes back to normal operation: each `apply` is implemented immediately

What you can expect: each command takes effect in less than a minute.

Go back to a previous version

Before a risky change, freeze the version that works (sng env checkout stable). If the change goes wrong, go back to it:

sng pull ./avant-restauration     # keep a record of what you are about to replace
sng env restore env/acme/stable

What you get:

your tenant's desired state becomes exactly that of the indicated version again;
manifests added since are deleted, modified ones are reverted;
your secrets are not touched: they are not part of the manifests.

REF is main (the latest applied version) or a frozen version, in the form env/<tenant>/<name> (<name> is the branch shown by sng env list).

No confirmation

sng env restore acts immediately, without asking for confirmation. Always run a sng pull first. The action requires env:admin (policy admin).

Create a tenant from another one

sng env create-tenant acme-staging              # copies what is running
sng env create-tenant acme-demo env/acme/v2     # copies a frozen version

What you get: a new tenant acme-staging (same naming rules as sng tenant create) that contains the same manifests. It starts in tier 3XS, with its own policies, and you are its administrator. As for any new tenant, opening a session may take a minute or two.

Secrets are not copied: declare them or set them in the new tenant (Secrets).

If it doesn't work

Message	Cause	Fix
`forbidden (no policy of this tenant allows it: see sng tenant policy list)`	`env:write` (checkout, refresh) or `env:admin` (restore, create-tenant) is missing	Ask a tenant administrator for the policy
`already on main`	`refresh` while the tenant is not frozen	Nothing to do: your `apply` runs are already implemented
`invalid organization: …`	Invalid or reserved name for the new tenant	See Tenant names
`conflict`	The name of the new tenant is already taken	Choose another one
`policies_pending` right after `create-tenant`	The new tenant is not ready yet	Retry in a minute

Which tool for which need​

One tenant per environment​

Freeze what is running​

Release what has been prepared​

Go back to a previous version​

Create a tenant from another one​

If it doesn't work​

See also​