Deployment and rollback

Production approval depends on release gates. The diagnostic server and ArcGIS CDF integration have different packaging/access controls.

Preflight

npm ci
npm run build
npm audit --audit-level=moderate
node scripts/cdf-cli.js validate-config -f config/environments/production.json
# On the built image/target host with configured sources and extensions:
node scripts/cdf-cli.js preflight -f config/environments/production.json -o preflight-report.json

Production config assumes preinstalled extensions at /app/extensions in the container. Native installations need their own extension path and installation step. Qualify real source IDs, geometry, CRS, field types, complete source size, freshness, permissions, and expected client queries.

Containers

Set CDF_API_TOKEN in your secret/environment mechanism first.

docker build -t duckdb-arcgis-provider:reviewed .
docker compose config
docker compose up --build -d

The default Node 24.13.0 Linux image preinstalls official spatial/httpfs/aws extensions for the exact DuckDB engine. It runs the actual server as non-root. Compose binds host loopback, mounts config/data read-only, and provides bounded scratch space.

CI runs Linux native tests at Node 22.14.0 and 24.13.0, fixture capacity/preflight checks, and a constrained read-only container smoke/scan on branch and merge-request pipelines. Registry publication runs only for protected default-branch/tag builds after those gates. Archive the generated runtime, image, scan and source reports. Override Docker NODE_IMAGE with a reviewed digest when releasing.

Replace demonstration data/configuration with approved sources. Verify /ready, an authenticated feature request, and each source's real connection. Scan the image and record/pin its immutable digest and base-image digest. Terminate TLS and enforce rate/connection/egress limits at your controlled proxy.

Optional CloudFS image

The default image includes official extensions only. WITH_CLOUDFS=true explicitly adds reviewed community code, verifies its build revision, and fails if a compatible signed binary is unavailable. Activation is currently blocked for the pinned DuckDB 1.5.6. Keep production runtime installation disabled; follow CloudFS qualification and inject provider credentials from Secrets after the compatibility gate passes.

Kubernetes

The chart provides Deployment, ClusterIP Service, and configuration ConfigMap with non-root/read-only security, scratch limits, probes, and configuration rollout checksum.

Create Secret arcgis-provider-api with a token key using your secret manager; do not put the token in Helm values. Override apiTokenSecret if using another name.

helm lint ./helm --strict
helm template provider ./helm
helm upgrade --install provider ./helm --namespace arcgis-provider --create-namespace --set image.repository=<registry/image> --set image.digest=sha256:<digest> --wait --timeout 5m

Provider tokens/Google JSON credentials can be injected with providerSecretEnv entries containing name, secretName, and key; values stay in existing Kubernetes Secrets. Reserved runtime/auth variable names are rejected. Changing credential values requires a worker restart. See CloudFS credentials.

Override config with real sources. Local data must be in the image; the chart does not provision data PVCs. Add workload identity/read-only storage access, TLS/Ingress, and network policies in your platform configuration. Optional ServiceMonitor/PrometheusRule assets use the existing API token Secret; see monitoring setup and P1 migration. Replicas have independent caches/metrics.

ArcGIS CDF integration

The selected target is ArcGIS Enterprise 12.1 on Linux, with Node 24.13.0. Follow the versioned package and certification procedure. The SDK and staging site are external prerequisites.

Generate a matching cdf createapp/createprovider scaffold. Keep its registration, manifests, runtime dependencies, and service JSON. Adapt its model export to use src/model.js and the supported core/configuration/dependencies. The old feature-service-config.json sketch is not a replacement for SDK-generated metadata.

Use that scaffold's cdf export workflow to produce a .cdpk, then register/create a read-only feature service using its version's administrator workflow. ZIP/npm archives are not CDF packages. Build native dependencies on the same OS family as the server.

If using a dataSource service parameter, bind it to the source the service may expose. The model reads req.params.dataSource; full-fetch is default, and opt-in pass-through requires staging certification. ArcGIS owns service permissions and GeoServices routes.

Verify ArcGIS Pro/web clients, metadata, extent, IDs, attribute types, queries/counts, restarts, and record/byte overflow errors on a real server. See Esri overview and provider contract.

See preflight, capacity, metrics and recovery for source release checks and measurable operational targets.

Rollback and operations

Record the previous image/CDF package, config, secret references, source snapshot, and validation evidence. Kubernetes: inspect helm history, then helm rollback provider <revision> -n arcgis-provider --wait. Compose: restore the previous image digest/config and recreate. CDF: restore provider package/service settings using the version-matched administrator workflow.

Recheck readiness and representative data/client queries after rollback. SIGTERM drains accepted work; the server's deadline is 30 seconds, so allow at least 35 seconds in the platform. Alert on errors, latency, saturation, restarts, and freshness.

The Azure helper prepares a source package only; it does not provision infrastructure or deploy ArcGIS.