Skip to main content
Deployment approvals let you require review before changes are applied to an environment. Instead of deploying immediately, Ryvn creates a preview showing exactly what will change. Someone with access to the environment reviews the preview and approves it, then the deployment executes. This is essential for customer cloud deployments where customers should have visibility and control over changes to their infrastructure. It’s also useful for production environments where you want a human checkpoint before any changes go live.

​
Enabling approvals

An environment’s requireApproval setting controls whether its tasks wait for manual approval:
  • true — every task requires approval before it runs, even for services set to auto-approve.
  • false — tasks run automatically, even for services that would otherwise require approval.
  • unset (default) — each service’s own approval setting decides.
Enable approval requirements on an environment by setting requireApproval: true.

​
Terraform service behavior

Terraform services have their own autoApprove setting at the service level. An explicit environment requireApproval always wins over it:
  • requireApproval: true forces approval even when the service sets autoApprove: true.
  • requireApproval: false forces auto-approve even when the service sets autoApprove: false—useful for internal dev environments where you want every service to skip approval without editing each service.
  • When requireApproval is left unset, the service’s autoApprove setting decides.
Environment requireApproval: true overrides service autoApprove: true. This ensures customers always have approval authority over their environments.

​
Reviewing and approving

When a deployment is triggered on an environment with approvals enabled, you’ll find the pending approval in the installation’s Activity tab.
1

Open the Activity tab

Go to Environments → select your environment → select the installation → Activity
2

Find the pending approval

Look for the task showing “Preview Complete” with an Approve button.
3

Review the preview

Click the task to see what will change. For Terraform services, this shows the full terraform plan output. For Helm and Kubernetes services, you’ll see a diff of the rendered manifests.
The full diff is visible only to the operator, developer, and admin roles.
4

Approve

Click Approve to proceed. You can add a reason that will appear in the audit trail.
After approval, the deployment executes automatically.

​
Vendor and customer access

The most common use case for approvals is vendor-to-customer deployments: you (the vendor) push changes, and your customer approves them before they’re applied to their cloud account. Customer stacks give customer users scoped access to the stack environment. They can view the stack, review previews, and approve deployments without gaining access to unrelated environments or vendor administration.
Customer stacks are in beta. Reach out to Ryvn for access. Alternatively, you can invite users with a scoped role.
Set up customer access from Customers in the dashboard:
1

Create the customer

Open Customers, click Create customer, and enter the customer’s display name.
2

Add customer users

Open the customer, click Create user, and enter an email address. Share the generated sign-up link with the customer. You can regenerate the link from the user list if needed.
3

Create a stack

From the customer page, create a stack from the blueprint you want to deploy. Ryvn creates the stack environment and grants the customer’s users access to it.
4

Require approval

Set requireApproval: true on the stack environment using GitOps or the environment settings described above. The customer can then review and approve pending changes from their stack portal.

​
Common questions

No. Force deploy still creates a preview that requires approval when the environment has requireApproval enabled.
Rollbacks also require approval. The rollback creates a preview showing what changes will be applied.
No. They remain pending until approved or superseded by a new deployment.
The Activity tab shows all approvals with the user who approved, timestamp, and any reason provided.