Config Drift Detector
Detect configuration drift across .env files, docker-compose.yml, Terraform vars, and k8s ConfigMaps — before it breaks production.
The Problem
Your .env.local, docker-compose.yml, Terraform variables, and k8s ConfigMaps all diverge silently. A teammate adds STRIPE_WEBHOOK_SECRET to the k8s deployment but forgets .env.example. Production works. Your local dev breaks. You spend 2 hours debugging.
What It Does
Config Drift Detector scans all your configured config sources, extracts their environment variable keys, and builds a drift matrix showing which keys are present in which sources and which are missing.
Features
- Status bar indicator shows drift count at a glance — green if clean, yellow if drifted
- Drift matrix webview — a table showing every key across every source with ✅/❌ per cell
- Auto-refresh on save — status bar updates whenever you save a config file
- Configurable sources — add any file:
.env, .env.example, docker-compose.yml, .tfvars, k8s YAML
- Ignore list — skip keys like
NODE_ENV that are intentionally different
Getting Started
- Open a workspace that has at least one config file (
.env, docker-compose.yml, etc.)
- The status bar shows
$(pulse) Config Drift on startup
- Click the status bar item or run Config Drift: Analyze Drift
- The drift matrix opens — red cells = keys missing from that source
Commands
| Command |
Description |
Config Drift: Analyze Drift |
Open the drift matrix webview |
Config Drift: Add Config Source |
Add a new config source to the comparison |
Configuration
| Setting |
Default |
Description |
configDrift.sources |
[".env", ".env.example", "docker-compose.yml"] |
Config source files to compare (relative to workspace root) |
configDrift.ignoredKeys |
["NODE_ENV"] |
Keys to skip when comparing sources |
Adding more sources
// .vscode/settings.json
{
"configDrift.sources": [
".env",
".env.example",
".env.production",
"docker-compose.yml",
"docker-compose.prod.yml",
"infra/variables.tf"
],
"configDrift.ignoredKeys": ["NODE_ENV", "LOG_LEVEL"]
}
| Format |
Keys extracted from |
.env / .env.* |
KEY=value pairs |
docker-compose.yml |
environment: section of all services |
Terraform .tfvars |
variable "KEY" blocks |
| k8s ConfigMap YAML |
data: keys |
Reading the Drift Matrix
Key | .env | .env.example | docker-compose.yml
─────────────────────────────────────────────────────────
DATABASE_URL | ✅ | ✅ | ✅
STRIPE_SECRET | ✅ | ❌ | ✅ ← DRIFTED
REDIS_URL | ✅ | ✅ | ❌ ← DRIFTED
PORT | ✅ | ✅ | ✅
Red rows (❌ in any column) = keys you need to sync.
Tips
- Run this check in CI by calling
vsce --list-files and checking .env.example parity with a script
- Commit
.env.example with all keys (empty values) as your "canonical" list
- Add this to your PR checklist: "Does
.env.example reflect all new env vars?"
