Preview Environment Simulator
See how a pull request becomes a temporary copy of your app, complete with a private URL, safe test data, review checks, and automatic cleanup.
Category: DevOps
What You Will Learn
- How a pull-request label or Git declaration creates preview-environment intent
- How GitHub Actions, Argo CD ApplicationSets, Helm, and Kubernetes reconcile that intent
- How a Neon database branch gives each preview environment isolated test data
- How single-service previews differ from coordinated full-stack UAT environments
- How data strategy, resource sizing, access policy, and TTL affect cost and isolation
- How to diagnose branch mismatches, quota failures, missing secrets, DNS issues, failed readiness gates and revision drift
- Which health, test, revision, configuration, and cost evidence should return to a pull request
- Why teardown must be automatic, observable, and driven through the same control path as creation
Topics covered: preview environments, gitops, kubernetes, argo cd, github actions, pull requests, uat, platform engineering, ephemeral environments, educational, interactive
// simulator
Preview Environment Simulator
See how a pull request becomes a temporary copy of your app, complete with a private URL, safe test data, review checks, and automatic cleanup.
Watch intent become an isolated environment
- 01Developer intent
- 02Webhook event
- 03GitHub Actions
- 04Argo CD console
- 05PR preview URL
Choose a pull request to request its own temporary environment.
DevOps Daily × Atomsized
Inspired by Atomsized's preview-platform workflow
This simulator was developed in partnership with Atomsized and is inspired by their published approach to pull-request previews and coordinated full-stack UAT environments. The walkthrough centers on Atomsized's full preview-environment workflow, following the application from pull-request intent through GitOps deployment, review, and automatic teardown.
The data layer uses a Neon database branch to show how isolated preview data can follow that same pull-request lifecycle.
A preview environment is a lifecycle, not a URL
1. Declare intent in Git
A label is enough for a single-service preview. A coordinated stack needs an explicit declaration of repositories and branch overrides so every revision is reviewable.
2. Return evidence to the PR
A green URL is incomplete evidence. Reviewers need the deployed commit and image, health gates, tests, configuration differences, logs, access policy, and expiry.
3. Reconcile deletion too
Closing a PR, removing its label, deleting its declaration, or reaching its TTL should remove ingress, workloads, data, and namespaces without leaving orphaned cost behind.
What a platform team must decide
Define who may open the environment, how preview secrets are sourced, whether data is synthetic or masked, which readiness gates block review, how DNS and certificates are issued, and which quota, TTL, budget, and orphan alerts enforce cleanup. These policies turn an ad hoc deployment script into a dependable internal platform capability.
Overview
A preview environment is a short-lived copy of your application that exists for one pull request. This simulator follows that copy through its whole life: a label on the pull request triggers a webhook, CI builds and pushes an image, an Argo CD ApplicationSet notices the labeled pull request and creates a namespace, and the environment gets data, DNS and TLS before reviewers see a private URL. When the pull request closes, the same flow runs in reverse and removes the review URL, the workloads, their dependencies and the namespace. With "Practice a failure" turned on, it injects a failure teams actually hit, one per pull request: a missing branch override, an unavailable preview secret, a deployed revision that drifted, a namespace quota that rejects the pods, a certificate stuck on the wrong DNS zone or a readiness gate failing on a migration, and asks you to pick a fix. Some of the offered fixes make the symptom disappear while creating a new risk, like copying a production secret or turning off a health gate. The point is to see why a preview environment is a GitOps workflow with guardrails, not just a deploy script with a random URL.
Try this
- Add the preview label to the pull request and follow the event through the webhook, GitHub Actions and the Argo CD console until the preview URL appears.
- Turn on "Practice a failure", open the order status pull request and, when "Preview secret unavailable" appears, try the production-secret shortcut first to read why it is the wrong fix.
- Record a review decision, then click "Close PR & clean up" and watch the environment move to its removed state.
Frequently asked questions
- What is a preview environment?
- A temporary, isolated copy of an application created for a single pull request, with its own URL, so reviewers can test the change before it is merged. It is deleted when the pull request closes.
- How does Argo CD create one environment per pull request?
- An ApplicationSet with a pull request generator watches the repository, and for each matching open pull request (often filtered by a label) it renders an Argo CD Application, usually into its own namespace.
- Should preview environments use production data?
- No. Use synthetic data or a masked snapshot. Copying production data or production secrets into a short-lived environment widens the blast radius of a leak for little testing benefit.
Try next
// game
Heroku-Style Name Generator
Generate names the way Heroku, Docker, Kubernetes, and petname do, see how the word lists combine, and learn when the birthday problem makes random names collide.
// simulator
How Docker Works Under the Hood
Watch what really happens when you run docker run -p 8080:80 nginx, one layer at a time. Step down the whole stack: the CLI, the daemon, the registry pull, containerd, the OCI runtime bundle, runc, the running container, and the shared Linux kernel. Every stage shows the real low-level command you can run yourself, so it doubles as a tour of the primitives that make a container: namespaces, cgroups, and runc. A container is not a small VM, and this shows you why.
// simulator
Webhook Delivery Simulator
Send a webhook through a production-style delivery flow. Change endpoint responses, watch retries and backoff, inspect real HMAC-SHA256 signatures, and redeliver the same message to see receiver-side deduplication.