werf new feature: New werf plan command (v1.2.256+)

[shurup]

Briefly

The experimental deployment engine (#5657) now features a new werf plan command. It allows you to preview the changes that will be made to cluster resources after running werf converge.

This feature became available starting from werf v1.2.256, which is currently in the Alpha release channel.

Background & details

In contrast to the helm-diff plugin, which simply compares the output of helm template with the most recent release manifests, werf plan generates a deployment plan that is actually used for the werf converge command itself. Resource changes are calculated based on this plan.

The plan is built based on the rendered resources, resources available in the cluster, and the results of dry-run apply commands for Kubernetes. This ensures 100% accuracy since werf compares the actual cluster resources and the results of (practically) real-life resource changes performed in the cluster.

The advantage of such an approach is that you can get an accurate change plan regardless of whether there are incorrect manifests in the release, three-way merge errors, or cluster resources that were changed outside of Helm or werf.

Configuration

To use this command, you must enable the experimental deployment engine in werf. It can be done by setting the WERF_EXPERIMENTAL_DEPLOY_ENGINE=1 environment variable.

Since this feature is in its early implementation, any feedback is greatly appreciated!

Additional details

• werf v1.2.256 changelog
• f3a2b0b commit adding the werf plan command
• Learn more about the new werf deployment engine and its features in werf new feature: Nelm as new deployment engine (v1.2.234+) #5657

[shurup]

Starting from werf v1.2.260, werf plan hides diffs for Secrets.

Note that Pod environment variables, as well as secrets in custom resource fields, will not be hidden. Therefore, for security reasons, you will need to move all your secrets to Kubernetes Secret resources (where they belong) when using werf plan.

In the future, we also plan to make hiding secrets more consistent, with support for any field of any resource.

• werf v1.2.260 changelog