dev, sand and prod manifests in the application repo: How to deploy (something like) main->dev; 0.0.0-rc.0 -> sand; 0.0.0 -> prod?

[iakat]

Hi, I have a setup like this:

1. Terraform infra repo, setting up namespaces with fluxcd (Namespace+GitRepository+Kustomization+ImageUpdateAutomation+...)

• namespace: app-prod
• namespace: app-sand
• namespace: app-dev

2. Application repo, with manifests/ folder

• manifests/dev -> manifests/default + patches goes to app-dev
• ...

3. ImagePolicy update tags in manifests/stage/kustomization.yaml

• dev: main branch + ascending timestamp to always deploy the latest commit

The part I am struggling with is how to handle deployments to sand and prod. I would like to achieve:

• dev: main branch manifests, main branch code
• sand: main branch manifests, latest semver code (prereleases only!)
• prod: latest semver manifests, latest semver code (no prereleases)

This leads me to a few restrictions:

• GitRepository for prod should be a tag, but semver doesn't support any extraction, and I cannot filter things such as prereleases

I have GitLab CI building and pushing images to the registry for each git tag, and I'd like to keep it exactly the same.
Possible solutions:

• GitRepository to allow extracting semver from tags, so I could tag prod-x.y.z and latest semver would be deployed
• Something else?

Thank you if you've made it through this far! I am interested in hearing how others have solved any sort of similar issues.