setup-deployment

Edit the repository's deployment source of truth rather than the live runtime: update runtime config values, environment variables, health checks, and resource hints following existing environment patterns. Then validate with manifest linting, template rendering, or dry-run commands and confirm the rollback path.

Use Argo Rollouts or Flagger with automated Prometheus MetricAnalysis on P99 latency and 5xx error thresholds instead of naive rolling updates. Include empty vector coalescing (or on() vector(0)) to guard against false rollbacks during low-traffic windows.

Never commit raw secrets or base64-encoded credentials to deployment repositories. Use the External Secrets Operator with ExternalSecret manifests referencing a ClusterSecretStore to synchronize credentials from HashiCorp Vault or AWS Secrets Manager at runtime.

AI-generated manifests frequently inline example values that look like real secrets, default IAM policies to broad wildcard permissions, and omit rollback flags entirely. Scan all generated manifests for hardcoded credentials and require Security Engineer review of IAM policies before production.

Use ArgoCD ApplicationSet with matrix or list generators for multi-environment deployments, and configure explicit ignoreDifferences for dynamically mutated fields such as HPA-managed replica counts or webhook-injected annotations.

Use Wrangler's version-then-deploy model (wrangler versions upload followed by wrangler deployments create) for gradual canary rollouts rather than deploying directly to production. This gives you controlled traffic shifting and a cleaner rollback path.