As I’ve explained in this ticket, we want deploys from our non-PCI compliant development environment to a PCI compliant environment. This both requires network segregation and management approval.
While I don’t think we’ll get anything more optimal than duplicate Octopus Deploy instances for the network segregation problem, we would love to be able to do the management approval by just restricting who can promote a release to stage and production.
Our current implementation is a custom intervention step in the stage and production environments that needs to be handled by people in a specific group. While this sort of works, there’s as far as I understand nothing that can restrict developers from changing this behaviour by disabling the step or not adding it in the first place. Therefore, it would be nice if we could just restrict who can push the “Promote” button for a given release to the stage and production environments.
We can move the management approval to the Octopus Deploy instance in the PCI environment, but we would like to do it earlier, since what’s deployed in the non-PCI production environment may have dependencies on what’s deployed to the PCI environment, so they should preferably be done at the same time.
We also can’t restrict who can create a release, since every environment up to stage should be within developer’s full control. Developers also need to be able to administer the projects, environments, etc.
Can you please guide us in figuring out how this management approval can be implemented as securely and smoothly as possible?
Thanks!
