Recommended approach for varying preview environments

[michaelhays]

Context

We've been using Infisical for a couple of months, and have been quite happy with the DX.

We have 5 environments, which correspond to our 5 APP_ENV values:

• development
• test
• preview
• staging
• production

Infisical has been excellent for managing the secrets in each of these environments.

Problem

However, one workflow that we haven't quite figured out is how to handle differing secrets per preview environment. We use Vercel Preview Deployments, and create a new preview deployment for each of our feature branches. This includes an isolated database, so the DATABASE_URL varies for each deployment.

Other than the DATABASE_URL, the secrets in the preview environment in Infisical are identical between preview deployments. What is the recommended approach to handling this use case?

Current workaround

We could create a new Infisical environment for every preview deployment that we create, so that we can vary the DATABASE_URL between each of these.

	development	test	preview	preview-feat-1	preview-feat-2	staging	production
API_KEY_1	a1	b1	c1	c1	c1	d1	e1
API_KEY_2	a2	b2	c2	c2	c2	d2	e2
DATABASE_URL	mysql://dev	mysql://test		mysql://prev-feat-1	mysql://prev-feat-2	mysql://stag	mysql://prod

However, this seems pretty tedious logistically, and complicates our clean 5-environment structure we have now.

Ideal solution

The ideal solution for us seems to be "sub-environments", so that we could vary environment specific secrets within the preview Infisical environment. That way, we could reuse the preview secrets across all of our previews, but vary DATABASE_URL between e.g. "preview > feat-1", and "preview > feat-2".

	development	test	preview	staging	production
API_KEY_1	a1	b1	c1	d1	e1
API_KEY_2	a2	b2	c2	d2	e2
DATABASE_URL	mysql://dev	mysql://test	{VARIES}	mysql://stag	mysql://prod

What do you think?

[maidul98]

Hello @michaelhays, if i understand you'd like to import the same set of secret keys across different environments and want to very the secret value between these preview environments? If so, have you taken a look into our secret imports https://infisical.com/docs/documentation/platform/secret-reference#secret-imports?

This will allow you to import common secret and override their values for the different preview environments. Let me know if you have questions!

[michaelhays]

Hey @maidul98, thanks for the response!

From what I understand, you're recommending the following approach:

	development	test	preview	preview-feat-1	preview-feat-2	staging	production
API_KEY_1	a1	b1	c1	c1	c1	d1	e1
API_KEY_2	a2	b2	c2	c2	c2	d2	e2
DATABASE_URL	mysql://dev	mysql://test		mysql://prev-feat-1	mysql://prev-feat-2	mysql://stag	mysql://prod

And so for every new pull request, we'll create a new environment (e.g. preview-feat-3), and import the secrets from the preview "base" environment.

This works, but since the only secret we need to vary is the DATABASE_URL, there's a lot of repetition across the different preview environments above, which becomes more of an issue when you have dozens of feature branches.

What I'd love to be able to accomplish would be something like this:

	development	test	preview	staging	production
API_KEY_1	a1	b1	c1	d1	e1
API_KEY_2	a2	b2	c2	d2	e2
DATABASE_URL	mysql://dev	mysql://test	{VARIES}	mysql://stag	mysql://prod

Then, within the {VARIES} secret, we could have different secrets based on a "sub-environment", like preview -> feat-1.

I realize this is likely a large feature request, but wanted to start a discussion around it, since I imagine a lot of people will have a similar use case to mine.