To make one release resource dependent on another, you can change its deployment order so that the dependent one is deployed after the primary one has been successfully deployed. But what if you want a release resource to depend on a resource that is not part of that release or is not even managed by werf (e.g., created by some operator)?
In this case, the
<name>.external-dependency.werf.io/resource annotation can help you set the dependency on an external resource. The annotated resource will not be deployed until the defined external dependency is created and ready.
kind: Deployment metadata: name: app annotations: secret.external-dependency.werf.io/resource: secret/dynamic-vault-secret
In the example above, werf will wait for the
dynamic-vault-secret to be created before proceeding to deploy the
app deployment. We assume that
dynamic-vault-secret is created by the operator from your Vault instance and is not managed by werf.
Let’s take a look at another example:
kind: Deployment metadata: name: service1 annotations: service2.external-dependency.werf.io/resource: deployment/service2 service2.external-dependency.werf.io/namespace: service2-production
Here, werf will not start deploying
service1 until the deployment of
service2 in another namespace has been successfully completed. Note that
service2 can either be deployed as part of another werf release or be managed by some other CI/CD software (i.e., outside of werf’s control).