I don’t know maybe, maybe it’s idiotic, looking for best practices here between staging/prod when it comes to actual images. I thought not rebuilding and using the latest (approved) from staging was a great idea, but would also need to keep a history, so it wouldn’t just use the image, it would literally push it to the prod-stack ECR and then use it.

Well separate ECR Repos

We create a separate Repo per stack and environment.

So that’s what we got now.

Depending on what

serviceImage

is this might work https://www.pulumi.com/docs/reference/pkg/aws/ecr/getimage/

Nah, single registry is out of the question, everything is isolated between environments. This is an exception.

I mean, whenever we push a branch the entire infrastructure is pushed, we want this because we do on-premise stuff as well.

The only exception is images. And only between staging<->prod and that’s because someone mentioned it’s poor practice to rebuild an image after it has been approved.

I think I found a way anyway. We can reference the repo from staging. And copy it over to production (for book keping) via CLI commands. Since we got the name of the image, can just pop that one inside the PodSpec as well. Though I’m actually preferring k8 to fetch it from the prod-ecr directly.