Environment Agnostic: Context Injection

The Environment-Specific Value Problem

In a standard Kubernetes Deployment, environment variables are often hardcoded or managed through environment-specific overlays:

# In production values.yaml
env:
  - name: DB_HOST
    value: "prod-db.us-east-1.rds.amazonaws.com"

# In staging values.yaml
env:
  - name: DB_HOST
    value: "staging-db.us-east-1.rds.amazonaws.com"

# In local docker-compose.yaml
environment:
  DB_HOST: localhost

Three files. Three places to make mistakes. Three files to keep in sync as the application evolves. This is the configuration drift problem in its most common form.

How Score Eliminates This

Score enforces a strict rule: score.yaml must contain zero environment-specific values. The file is committed to source control and is identical across every environment. Environment-specific resolution happens entirely within the Score implementation at translation time.

The workflow is simple: the implementation reads score.yaml, reads a separate override file supplied by the platform team, and writes the generated manifests out to a target directory.

The platform-overrides.yaml is owned and managed by the platform team. It maps abstract resource types to concrete infrastructure:

# platform-overrides.yaml (managed by platform team, not committed by developers)
resources:
  db:
    outputs:
      host: prod-db.us-east-1.rds.amazonaws.com
      port: "5432"

The developer never sees this file. They never need to know the RDS endpoint. The generated Kubernetes manifest will contain the correct value, injected automatically. When the database migrates to a new endpoint, the platform team updates platform-overrides.yaml — the developer's score.yaml is untouched.

The Security Benefit

This pattern has an important security side effect: secrets never appear in developer-owned files. Database passwords, API keys, and connection strings live in platform-managed configuration, not in source-controlled score.yaml files. The developer declares "I need a secret called stripe-key" — the platform injects it from a secrets manager (Vault, AWS Secrets Manager, Kubernetes Secrets) at deploy time.