Multi-Environment Architecture
DevOps IaC Part 2 — Day 12
Structure environment isolation patterns (Dev, Staging, Prod) with Terraform Workspaces & directory isolation
Enterprise infrastructure rarely runs in a single environment. Organizations need clean separation between Development, Staging, and Production environments. Today you will master Terraform Workspaces and understand the trade-offs between workspace-based state isolation and directory-based account isolation. You will build dynamic configurations that automatically adapt replica counts, resource sizes, and domain names based on the active workspace.
An interactive 20 min video walkthrough for Day 12 is currently in production. Follow the step-by-step interactive playbook below!
The official reference codebase for Day 12 is hosted in the repository. Clone the repository and navigate to day-12-multi-env-workspaces to run the working solution.
git clone https://github.com/777abhi/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-12-multi-env-workspacesArchitecture: Workspaces vs Directory Isolation
Analyze the two dominant multi-environment patterns in modern infrastructure engineering.
Evaluate blast radius, credential separation, and codebase DRYness across both approaches.
Pattern Terraform Workspaces Directory Separation ───────────────────────────────────────────────────────────────────────────── Codebase Duplication Zero (Single shared code) Slight (Root per env) State Path env:/<workspace>/state.tfstate Distinct bucket / account Account Boundary Shared AWS/K8s credentials Strict IAM boundary Ideal Use Case Ephemeral feature previews Hard Dev vs Prod borders
Authoring Workspace-Aware Configurations
Utilize terraform.workspace to parameterize replica counts and environment tiers.
Define lookup maps for replicas and memory limits per workspace.
# variables.tf
variable "replica_counts" {
type = map(number)
default = {
dev = 1
stage = 2
prod = 4
}
}
variable "memory_limits" {
type = map(string)
default = {
dev = "64Mi"
stage = "128Mi"
prod = "256Mi"
}
}Leverage lookup(var.replica_counts, terraform.workspace, 1) for automated sizing.
# main.tf
locals {
env = terraform.workspace
replicas = lookup(var.replica_counts, local.env, 1)
mem_limit = lookup(var.memory_limits, local.env, "64Mi")
}
resource "kubernetes_namespace" "env_ns" {
metadata {
name = "app-${local.env}"
labels = {
tier = local.env
}
}
}
resource "kubernetes_deployment" "app" {
metadata {
name = "frontend-${local.env}"
namespace = kubernetes_namespace.env_ns.metadata[0].name
}
spec {
replicas = local.replicas
selector {
match_labels = {
app = "frontend"
}
}
template {
metadata {
labels = {
app = "frontend"
}
}
spec {
container {
name = "nginx"
image = "nginx:alpine"
resources {
limits = {
memory = local.mem_limit
}
}
}
}
}
}
}
output "active_environment" {
value = local.env
}
output "configured_replicas" {
value = local.replicas
}Workspace Switching & State Isolation Test
Create dev and prod workspaces and verify that state changes remain fully isolated.
Create the dev workspace and apply the configuration with 1 replica.
cd /Users/abhinavsharma/Downloads/devops-terraform-roadmap/day-12-multi-env-workspaces
terraform init
terraform workspace new dev || terraform workspace select dev
terraform apply -auto-approveSwitch to prod and observe Terraform provisioning 4 replicas in app-prod.
terraform workspace new prod || terraform workspace select prod
terraform apply -auto-approve
kubectl get pods -n app-dev
kubectl get pods -n app-prodBlast Radius Rules & Enterprise Governance
Guidelines on preventing accidental production overwrites from the CLI.
While terraform workspace is ideal for temporary staging environments and preview branches, never use workspaces to share credentials between non-production and production AWS accounts.
If a developer is authenticated with Admin credentials and accidentally executes terraform apply while on the wrong workspace, production resources can be inadvertently altered. Enforce separate IAM roles and separate directory roots (or Atlantis / Terraform Cloud workspaces) for hard production boundaries.
- Understood the differences between Terraform Workspaces and directory-based separation.
- Declared environment-aware variables using terraform.workspace dynamic lookups.
- Created dev and prod workspaces with distinct replica counts and namespaces.
- Verified state isolation: destroying or updating dev does not impact prod.
- Audited blast radius security policies for enterprise cloud accounts.