Using Protected Environments and Manual Approvals in GitLab CI/CD for Secure Production Deployments

In the world of automation, manual steps are often seen as inefficient, yet for CI/CD pipelines a manual job can be an effective way to enforce deployment controls and meet compliance requirements. This guide shows how to define manual jobs for two key scenarios: controlling who can deploy and adding manual approval steps.

Deployment Environment Protection

Deploying to production is critical and should be protected. Projects with Kubernetes clusters can benefit from continuous deployment (CD) where merges trigger automatic production deployments. For projects without CD, a pipeline with a manual job can control production releases, reducing the risk of accidental deployments.

Protected environments prevent anyone from deploying to production without proper permission. When configuring a protected environment, you can assign roles, groups, or users that are allowed to deploy. The manual job then references this protected environment, limiting who can run it.

deploy_prod:
  stage: deploy
  script:
    - echo "Deploy to production server"
  environment:
    name: production
    url: https://example.com
  when: manual
  only:
    - master

In the example above, the environment keyword refers to a protected environment defined in project settings, which contains a list of users permitted to run the job. Unauthorized users will see a disabled button and cannot execute the job.

Add Approval Step

Sometimes workflow activities need explicit approval before they run, even if they are not deployment steps. An approval stage can be inserted before deployment, prompting authorized users to take action.

stages:
  - build
  - approve
  - deploy

build:
  stage: build
  script:
    - echo Hello!

approve:
  stage: approve
  script:
    - echo Hello!
  environment:
    name: production
    url: https://example.com
  when: manual
  allow_failure: false
  only:
    - master

deploy:
  stage: deploy
  script:
    - echo Hello!
  environment:
    name: production
    url: https://example.com
  only:
    - master

Setting allow_failure: false makes the manual job a blocking step, pausing the pipeline until an authorized user clicks the start button. Only users listed for the environment can approve, providing a robust tool for compliance and production control.

What Is GitOps?

GitOps combines infrastructure as code and continuous delivery, allowing developers and operations to share a common repository that serves as the source of truth for both applications and their underlying infrastructure. By treating the Git repository as the definitive source, any change to infrastructure is committed alongside application changes.

This approach lets developers and operators use familiar branching and merge request workflows. After merging to the main branch, CI/CD pipelines automatically deploy both application and infrastructure updates, aligning development and operations practices.

Why Choose GitOps?

Organizations of all sizes are adopting GitOps because it ties business agility directly to the ability to deliver high‑quality software quickly. By integrating change management into the Git workflow, GitOps creates an efficient, repeatable process that becomes a standard practice for modern, high‑performing software teams.