<p>In My CICD, I am:</p>

<p>generating a new image with a unique tag. foo:dev-1339 and pushing it to my image repo (ECR).
Then I am using a rolling update to update my deployment.</p>

<p><code>kubectl rolling-update frontend --image=foo:dev-1339</code></p>

<p>But I have a conflict here.</p>

<p>What if I also need to update some part of my deployment object as stored in a deployment.yaml file. Lets say harden a health check or add a parameter?</p>

<p>Then when I re <code>apply</code> my deployment object as a whole it will not be in sync with the current replica set, the tag will get reverted and I will lose that image update as it exists in the cluster.</p>

<p>How do I avoid this race condition?</p>

Josh Beauregard
<p>A typical solution here is to use a templating layer like <a href="https://helm.sh/" rel="nofollow noreferrer">Helm</a> or <a href="https://kustomize.io" rel="nofollow noreferrer">Kustomize</a>.</p>

<p>In Helm, you'd keep your Kubernetes YAML specifications in a directory structure called a <em>chart</em>, but with optional templating.  You can specify things like</p>

<pre><code>image: myname/myapp:{{ .Values.tag | default "latest" }}
</code></pre>

<p>and then deploy the chart with</p>

<pre><code>helm install myapp --name myapp --set tag=20191211.01
</code></pre>

<p>Helm keeps track of these values (in Secret objects in the cluster) so they don't get tracked in source control.  You could check in a YAML-format file with settings and use <code>helm install -f</code> to reference that file instead.</p>

<p>In Kustomize, your CI tool would need to create a <code>kustomize.yaml</code> file for per-deployment settings, but then could <a href="https://github.com/kubernetes-sigs/kustomize/blob/master/docs/plugins/builtins.md#field-name-images" rel="nofollow noreferrer">set</a></p>

<pre><code>images:
  - name: myname/myapp
    newTag: 20191211.01
</code></pre>

<p>If you trust your CI tool to commit to source control then it can check this modified file in as part of its deployment sequence.</p>
