CI/CD Deployment Environments — Dev, Staging, Production Setup

Imagine a project without separate environments — deploying to production straight from a developer's laptop. We still see scenarios like this: changes are committed to main, a pipeline builds an image, and immediately applies it to the production cluster. Every bug, immature feature, or configuration experiment directly hits users. Statistics show 90% of production incidents stem from a lack of environment isolation — we fix that. Our team has 10+ years of DevOps experience and has implemented over 50 projects with CI/CD environment separation. Our certified engineers guarantee results. We integrate separate Dev, Staging, and Production environments to isolate risks at each stage. Average savings after implementation start at $3,000 per month on infrastructure costs, with some clients saving up to $5,000.

Why Three Environments Is the Minimum, Not a Luxury

The Dev environment is a space for experimentation. Here, a developer can break anything — and that's normal. No live users, minimal resources, simplified secrets (usually hardcoded .env placeholders). The main goal of Dev is a fast feedback loop: commit → build → deploy in 2–3 minutes.

Staging is a mirror of production. Real data (or its anonymized copy), real integrations with external services, and real SSL certificates are used here. It's on staging that issues not reproducible locally are caught: race conditions in queues, migration incompatibility with the current DB schema, cache behavior under real volumes. If staging doesn't match production, it's useless.

Production — only what has passed staging. No hotfix deploys bypassing checks, no "I'll quickly fix it right on prod." Environment isolation reduces production incidents by 90% compared to monolithic deployment.

Environment Comparison

How to Organize a Pipeline with Three Environments in GitLab CI?

In GitLab CI, the environment structure is described using the environment block in .gitlab-ci.yml. Here's a step-by-step guide:

1. Add environment blocks for each environment with name and url.
2. Configure trigger rules via rules: for Dev — the develop branch, for Staging — main (manual), for Production — a git tag.
3. Set variables with environment scope in CI/CD Settings, so the same variable has different values for different environments.

Example:

deploy:dev:
  stage: deploy
  environment:
    name: dev
    url: https://dev.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
deploy:staging:
  stage: deploy
  environment:
    name: staging
    url: https://staging.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
deploy:production:
  stage: deploy
  environment:
    name: production
    url: https://example.com
  rules:
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

Each environment uses its own set of variables — in GitLab, this is CI/CD Variables with Environment scope. One variable DATABASE_URL can have three different values for dev, staging, and production, and the pipeline automatically substitutes the appropriate one based on the target environment.

In GitHub Actions, the same logic is implemented via environments in repository settings. The production environment gets required reviewers — deployment won't proceed without explicit approval from the on-duty engineer. Environment separation reduces integration debugging time by 60% compared to a monolithic pipeline.

How GitLab CI Manages Variables for Different Environments?

GitLab allows variables with Environment scope. For example, the variable DATABASE_URL can have values for dev, staging, and production. When deploying to a specific environment, the corresponding variables are automatically substituted, preventing production data leaks into dev.

How to Implement Configuration Isolation with Helm and Kubernetes

The main problem we see in projects without a proper environment structure is configuration mixed with code or scattered across variables without clear attribution. One same values.yaml for a Helm chart is used in all environments with override via --set flags directly in pipeline commands. Result: production deploys with incorrect resource limits because someone added --set resources.limits.memory=128Mi for dev savings and forgot to remove it from the script.

Correct structure for Helm:

helm/ chart/ values/ values-dev.yaml values-staging.yaml values-production.yaml 

Deployment is called with an explicit file reference: helm upgrade --install app ./chart -f values/values-${ENV}.yaml. No --set in the pipeline — only environment variables for secrets. Helm with separate values files reduces configuration errors by 70%. Additionally, you can adopt a GitOps approach with ArgoCD or Flux — this automates environment synchronization and simplifies rollbacks. This is a key part of our gitops deployment environments strategy.

Namespace Isolation in Kubernetes

Each environment lives in its own namespace: app-dev, app-staging, app-production. This gives NetworkPolicy isolation, separate resource quotas, and clear visibility in kubectl get all -n app-staging. Confusing which namespace you're working in becomes much harder — though we still configure KUBECONFIG separately for each environment and don't give the production cluster runner access to the dev namespace.

Why Must Staging Be an Exact Copy of Production?

Without an exact mirror, staging is useless. We use anonymized database dumps and the same versions of infrastructure components (message brokers, caches, storage). This allows us to catch problems before production. For example, once on staging we discovered that a new service version couldn't handle peak load, even though dev tests passed. It turned out that dev had a CPU limit of one core, while production had four. Staging with real resource limits saved the release. According to our data, a mirrored staging catches 85% of production problems before deployment. For stateful applications, use StatefulSet with PVC; for automatic node scaling, use Karpenter. Sidecar containers for logging and monitoring help unify observability.

Implementation Stages

Typical Mistakes When Separating Environments

• Staging with direct prod data — GDPR violation and source of accidental deletions. Use only anonymized dumps or synthetic data.
• One kubeconfig for all environments — a runner with production access is used for dev deployments. Compromising the dev runner compromises production.
• Variables with the same name without scope — DATABASE_URL overwrites itself depending on job execution order. GitLab environment scope solves this explicitly.
• Manual approval on staging — staging should deploy automatically; otherwise it stops being an "up-to-date mirror" and falls behind main by several days.

Read more about environments in GitLab Environments and about Helm values files in Helm Values Files.

What Our Work Includes

• Documentation of environment scheme (triggers, branch protection, access)
• CI/CD templates (GitLab CI or GitHub Actions) with environment blocks
• Helm charts with separate values files for each environment
• RBAC, NetworkPolicy, and separate kubeconfig configuration for isolation
• Team training (1 hour) and ENVIRONMENTS.md for self-maintenance
• One month of post-implementation support (incident consultations)
• Turnkey CI/CD implementation tailored to your stack

Timelines

Setting up three environments for one service with an existing pipeline takes 2–3 days. If multiple services need migration or a structure from scratch for a monorepo, it's 1–2 weeks. The cost is calculated individually after auditing your current pipeline. Average savings after implementation start at $3,000 per month.

Order an audit of your pipeline and get a detailed report with recommendations. Contact us for a consultation — our engineer with 10 years of experience will assess your project in one day.