►
Description
This video explains the Group-level Protected Environments feature that will be released in GitLab 14.3.
See the documentation for more information. https://docs.gitlab.com/ee/ci/environments/protected_environments.html#group-level-protected-environments
00:00 Intro
00:52 Admin | Preparation
03:49 Developer | Create a new project and pipeline
06:44 Admin | Set up Group-level Protected Environments
08:57 Admin | Reporter setup
10:23 Operator | Execute a production deployment
A
A
So
simply
this
feature
is
about
segregation
of
duties
between
operators
and
the
developers.
So,
typically
in
large
organizations,
they
want
developers
to
only
write
code
and
they
they
shouldn't
touch
production
environments,
whereas
operators
they
shouldn't,
touch
code
base,
but
they
have
an
access
to
the
production
environments
and
the
managing
infrastructure.
A
A
A
Okay,
the
other
one
is
operator
group
public
credit
group.
Okay.
So
we
now
see
these
two
groups
under
the
root
group
and
we're
going
to
add
users
to
each
group.
We
need
to
assign
developers
to
developer
group
and
the
operator
still
operator
group,
so
I'm
gonna
go
into
the
operator
group
and
then
members.
A
A
By
the
demo
user,
this
takashista
is
a
developer
in
this
world
developer,
developer
role
in
this
demonstration,
then
I
just
assigned
to
developer
group
as
a
maintainer.
So,
let's,
let's
talk
about
a
hypothetical
situation
that
the
one
of
the
developers
is
going
to
create
a
new
project
and
a
developer
group
and
then
create
a
ci
cd
pipeline
that
deploys
to
production
environment.
So
I'm
going
to
switch
my
user
account.
A
A
A
A
A
A
Create
a
new
configuration
at
this
root
variable
that
only
like
all
production
environments
under
this
group
can
be
deployed
by
people
in
operator
group.
So
to
do
so,
we
have
to
execute
this
api
to
create
an
entry,
and
this
is
a
like.
I
create
a
new
rule
at
this
root
level
that
what
I
just
said,
so
I'm
we're
going
to
execute
this
call
we're
going
to
create
a
new
entry
that
the
request
was
successful.
A
A
A
So
as
an
operator
I
want
to
deploy,
I
want
to
execute
the
production
deployment
job,
so
I'm
going
to
pipeline
page
and
then
clicking
the
production
job,
but
still
it's
not
executable,
even
I'm
operator.
So
there's
a
there's.
An
additional
configuration
is
needed
that,
in
order
to
execute
a
pipeline
job
in
this
project
in
this
developer
project,
this
operator
has
to
at
least
be
a
reporter
role
or
above
to
do
so.
We
are
going
to.
A
This
developer
group
and
then
subjection
from
members.
So
what
are
we
going
to
do
is
basically
add
operator
people
into
debug
book
loop
as
reporter
so
operator.
Operators
do
not
have
a
permission
to
write
code
under
developer
group,
but
they
only
can
audit
pipeline
jobs
and
then
execute
deployment
jobs
to
the
production.