How do you implement an approval/manual gate before a production deploy?
CI/CD & GitOps · Basic level
Answer
I implement a production manual gate with an input step, environment approval, or a change-management integration. The gate should appear after automated tests and staging validation, be limited to authorized approvers, have a timeout, and record who approved the production deployment.
Technical explanation
A gate should be placed after objective validation, not used as a substitute for testing.
Approval metadata should be retained with the pipeline run, change request, and deployment audit trail.
Keep build execution away from the controller; agents should be disposable, labeled, and sized for the workload.
Treat the pipeline definition as production code: peer review it, test changes, version shared libraries, and avoid hidden UI-only job logic.
Use least-privilege credentials, immutable artifacts, deterministic versions, and clear post-build cleanup to make pipelines repeatable and auditable.
Design stages around fast feedback: fail cheap checks early, isolate workspaces, parallelize independent work, and publish evidence such as test reports and build metadata.
Hands-on example
1. Create or update a Jenkinsfile for the scenario: How do you implement an approval/manual gate before a production deploy.
2. Use a Declarative Pipeline skeleton: pipeline { agent { label 'linux && docker' } options { timestamps(); disableConcurrentBuilds() } stages { stage('Checkout') { steps { checkout scm } } stage('Test') { parallel { stage('Unit') { steps { sh 'make unit' } } stage('Lint') { steps { sh 'make lint' } } } } } post { always { junit 'reports/*.xml'; cleanWs() } failure { echo 'notify team' } } }.
3. Add a production gate: timeout(time: 30, unit: 'MINUTES') { input message: 'Deploy to prod?', ok: 'Deploy', submitter: 'sre-leads,release-managers' }; record the submitter in the deployment metadata.
4. Publish the immutable result: tag the image with the Git SHA, push to ECR/Nexus, archive test reports, and record build URL, commit SHA, artifact digest, approver, and deployment status.
5. Prove the design by rerunning the same commit twice: the second run should reuse safe caches, produce the same artifact version or detect it already exists, and avoid duplicate side effects.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More CI/CD & GitOps interview questions
- What is CI/CD, and what is the difference between continuous delivery and continuous deployment?
- What are the goals of a CI pipeline beyond just running tests?
- What is Jenkins, and what is the difference between a controller and an agent?
- What is the difference between a freestyle job and a pipeline job in Jenkins?
- What is the difference between a declarative and a scripted Jenkins pipeline?
- What is a Jenkinsfile, and why keep your pipeline as code in the repo?
- Explain the structure of a declarative pipeline (agent, stages, steps, post).
- What is the post section used for, and what are its conditions (success, failure, always)?