Problem description
Pulumi Deployments has no native deployment-level approval gate, and the documentation does not explain that the supported way to require sign-off before a deployment is to put an ESC Open approval on the environment that supplies the deployment's credentials. Because a deployment opens an ESC environment to obtain credentials, an Open approval ruleset on that environment effectively blocks the run until a reviewer approves. This relationship is not documented, so users assume Deployments simply can't be gated.
Suggestions for a fix
Write a step-by-step walkthrough: configure the deployment to source credentials from an ESC environment, add an Open approval ruleset to that environment, and show the resulting request/approve flow that gates the deployment. Explain the ESC dependency explicitly and cross-link from both the Deployments and ESC Approvals pages.
Reported from customer feedback on a Clari call (internal). Source: Slack thread.
Problem description
Pulumi Deployments has no native deployment-level approval gate, and the documentation does not explain that the supported way to require sign-off before a deployment is to put an ESC Open approval on the environment that supplies the deployment's credentials. Because a deployment opens an ESC environment to obtain credentials, an Open approval ruleset on that environment effectively blocks the run until a reviewer approves. This relationship is not documented, so users assume Deployments simply can't be gated.
Suggestions for a fix
Write a step-by-step walkthrough: configure the deployment to source credentials from an ESC environment, add an Open approval ruleset to that environment, and show the resulting request/approve flow that gates the deployment. Explain the ESC dependency explicitly and cross-link from both the Deployments and ESC Approvals pages.
Reported from customer feedback on a Clari call (internal). Source: Slack thread.