To create a dynamic environment, in your
.gitlab-ci.yml
file:
Define a job in the
deploy
stage.
In the job, define the following environment attributes:
name
: Use a related CI/CD variable like
$CI_COMMIT_REF_SLUG
. Optionally, add a static
prefix to the environment’s name, which
groups in the UI
all
environments with the same prefix.
url
: Optional. Prefix the hostname with a related CI/CD variable like
$CI_ENVIRONMENT_SLUG
.
Some characters cannot be used in environment names. For more information about the
environment
keywords, see the
.gitlab-ci.yml
keyword reference
.
In the following example, every time the
deploy_review_app
job runs the environment’s name and
URL are defined using unique values.
You can also specify a static part of the URL at
environment:url
, such as
https://$DYNAMIC_ENVIRONMENT_URL
. If the value of
DYNAMIC_ENVIRONMENT_URL
is
example.com
, the
final result is
https://example.com
.
The assigned URL for the
review/your-branch-name
environment is visible in the UI.
In the following example a review app creates a new environment for each merge request:
The
review
job is triggered by every push, and creates or updates an environment named
review/your-branch-name
. The environment URL is set to
$DYNAMIC_ENVIRONMENT_URL
.
When the
review
job finishes, GitLab updates the
review/your-branch-name
environment’s URL.
It parses the
deploy.env
report artifact, registers a list of variables as runtime-created,
expands the
environment:url: $DYNAMIC_ENVIRONMENT_URL
and sets it to the environment
URL.
review:script:-DYNAMIC_ENVIRONMENT_URL=$(deploy-script)# In script, get the environment URL.-echo "DYNAMIC_ENVIRONMENT_URL=$DYNAMIC_ENVIRONMENT_URL" >> deploy.env# Add the value to a dotenv file.artifacts:reports:dotenv:deploy.env# Report back dotenv file to rails.environment:name:review/$CI_COMMIT_REF_SLUGurl:$DYNAMIC_ENVIRONMENT_URL# and set the variable produced in script to `environment:url`on_stop:stop_reviewstop_review:script:-./teardown-environmentwhen:manualenvironment:name:review/$CI_COMMIT_REF_SLUGaction:stop
Note the following:
stop_review
doesn’t generate a dotenv report artifact, so it doesn’t recognize the
DYNAMIC_ENVIRONMENT_URL
environment variable. Therefore you shouldn’t set
environment:url
in the
stop_review
job.
If the environment URL isn’t valid (for example, the URL is malformed), the system doesn’t update
the environment URL.
If the script that runs in
stop_review
exists only in your repository and therefore can’t use
GIT_STRATEGY: none
, configure
merge request pipelines
for these jobs. This ensures that runners can fetch the repository even after a feature branch is
deleted. For more information, see
Ref Specs for Runners
.
For Windows runners, you should use the PowerShell
Add-Content
command to write to
.env
files.
Sometimes, instead of using an
industry standard
environment name, like
production
, you might want to use a code name, like
customer-portal
.
While there is no technical reason not to use a name like
customer-portal
, the name
no longer indicates that the environment is used for production.
To indicate that a specific environment is for a specific use,
you can use tiers:
# Trackableenvironment:productionenvironment:production/awsenvironment:development# Non Trackableenvironment:review/$CI_COMMIT_REF_SLUGenvironment:testing/aws
Only the
deployment jobs
are run.
In cases where a previous job generates artifacts that must be regenerated
on deploy, you must manually run the necessary jobs from the pipelines page.
For example, if you use Terraform and your
plan
and
apply
commands are separated
into multiple jobs, you must manually run the jobs to deploy or roll back.
Both jobs must have the same
rules
or
only/except
configuration. Otherwise,
the
stop_review
job might not be included in all pipelines that include the
deploy_review
job, and you cannot trigger
action: stop
to stop the environment automatically.
In your
.gitlab-ci.yml
file, specify in the
on_stop
keyword the name of the job that stops the environment.
In the following example:
A
review_app
job calls a
stop_review_app
job after the first job is finished.
The
stop_review_app
is triggered based on what is defined under
when
. In this
case, it is set to
manual
, so it needs a
manual action
from the GitLab UI to run.
The
GIT_STRATEGY
is set to
none
. If the
stop_review_app
job is
automatically triggered
,
the runner doesn’t try to check out the code after the branch is deleted.
To configure multiple
parallel
stop actions on an environment, specify the
on_stop
keyword across multiple
deployment jobs
for the same
environment
, as defined in the
.gitlab-ci.yml
file.
When an environment is stopped, the matching
on_stop
actions from only successful deployment jobs are run in parallel, in no particular order.
In the following example, for the
test
environment there are two deployment jobs:
deploy-to-cloud-a
deploy-to-cloud-b
When the environment is stopped, the system runs
on_stop
actions
teardown-cloud-a
and
teardown-cloud-b
in parallel.
deploy-to-cloud-a:script:echo "Deploy to cloud a"environment:name:teston_stop:teardown-cloud-adeploy-to-cloud-b:script:echo "Deploy to cloud b"environment:name:teston_stop:teardown-cloud-bteardown-cloud-a:script:echo "Delete the resources in cloud a"environment:name:testaction:stopwhen:manualteardown-cloud-b:script:echo "Delete the resources in cloud b"environment:name:testaction:stopwhen:manual
You can define a job that accesses an environment for various purposes, such as verification or preparation. This
effectively bypasses deployment creation, so that you can adjust your CD workflow more accurately.
To do so, add either
action: prepare
,
action: verify
, or
action: access
to the
environment
section of your job:
build:stage:buildscript:-echo "Building the app"environment:name:stagingaction:prepareurl:https://staging.example.com
This gives you access to environment-scoped variables, and can be used to protect builds from unauthorized access. Also,
it’s effective to avoid the
prevent outdated deployment jobs
feature.
The following example shows how to start your environment names with
review
.
The
$CI_COMMIT_REF_SLUG
variable is populated with the branch name at runtime:
deploy_review:stage:deployscript:-echo "Deploy a review app"environment:name:review/$CI_COMMIT_REF_SLUG
If you
set up alerts for Prometheus metrics
,
alerts for environments are shown on the environments page. The alert with the highest
severity is shown, so you can identify which environments need immediate attention.
When the issue that triggered the alert is resolved, it is removed and is no
longer visible on the environments page.
If the alert requires a
rollback
, you can select the
deployment tab from the environment page and select which deployment to roll back to.
In a typical Continuous Deployment workflow, the CI pipeline tests every commit before deploying to
production. However, problematic code can still make it to production. For example, inefficient code
that is logically correct can pass tests even though it causes severe performance degradation.
Operators and SREs monitor the system to catch these problems as soon as possible. If they find a
problematic deployment, they can roll back to a previous stable version.
GitLab Auto Rollback eases this workflow by automatically triggering a rollback when a
critical alert
is detected. GitLab selects and redeploys the most recent successful deployment.
Limitations of GitLab Auto Rollback:
The rollback is skipped if a deployment is running when the alert is detected.
A rollback can happen only once in three minutes. If multiple alerts are detected at once, only
one rollback is performed.
GitLab Auto Rollback is turned off by default. To turn it on:
On the left sidebar, select
Search or go to
and find your project.
Select
Settings > CI/CD
.
Expand
Automatic deployment rollbacks
.
Select the checkbox for
Enable automatic rollbacks
.
If you deploy to your environments with the help of a deployment service (for example,
the
Kubernetes integration
), GitLab can open
a terminal session to your environment. You can then debug issues without leaving your web browser.
The Web terminal is a container-based deployment, which often lack basic tools (like an editor),
and can be stopped or restarted at any time. If this happens, you lose all your
changes. Treat the Web terminal as a debugging tool, not a comprehensive online IDE.
Web terminals:
Are available to project Maintainers and Owners only.
When a new deployment happens in your project,
GitLab creates
a special Git-ref to the deployment
.
Since these Git-refs are populated from the remote GitLab repository,
you could find that some Git operations, such as
git-fetch
and
git-pull
,
become slower as the number of deployments in your project increases.
To maintain the efficiency of your Git operations, GitLab keeps
only recent deployment refs (up to 50,000) and deletes the rest of the old deployment refs.
Archived deployments are still available, in the UI or by using the API, for auditing purposes.
Also, you can still fetch the deployed commit from the repository
with specifying the commit SHA (for example,
git checkout <deployment-sha>
), even after archive.
GitLab preserves all commits as
keep-around
refs
so that deployed commits are not garbage collected, even if it’s not referenced by the deployment refs.
Environment scoping for CI/CD variables was
moved
from GitLab Premium to GitLab Free in 12.2.
Environment scoping for Group CI/CD variables
added
to GitLab Premium in 13.11.
By default, all
CI/CD variables
are available to any job in a pipeline. Therefore, if a project uses a
compromised tool in a test job, it could expose all CI/CD variables that a deployment job used. This is
a common scenario in supply chain attacks. GitLab helps mitigate supply chain attacks by limiting
the environment scope of a variable.
You can limit the environment scope of a CI/CD variable by
defining which environments it can be available for.
For example, if the environment scope is
production
, then only the jobs
with the environment
production
defined would have this specific variable.
The default environment scope is a wildcard (
*
), which means that
any job can have this variable, regardless of whether an environment is defined.
If the environment scope is
review/*
, then jobs with environment names starting
with
review/
would have that variable available.
In most cases, these features use the
environment specs
mechanism, which offers
an efficient way to implement scoping in each environment group.
For example, if there are four environments:
production
staging
review/feature-1
review/feature-2
Each environment can be matched with the following environment spec:
Environment Spec
production
staging
review/feature-1
review/feature-2
*
Matched
Matched
Matched
Matched
production
Matched
staging
Matched
review/*
Matched
Matched
review/feature-1
Matched
You can use specific matching to select a particular environment.
You can also use wildcard matching (
*
) to select a particular environment group,
like
Review Apps
(
review/*
).
The most specific spec takes precedence over the other wildcard matching. In this case,
the
review/feature-1
spec takes precedence over
review/*
and
*
specs.
For example, the environment might start in a stage that also has a job that failed.
Then the jobs in later stages job don’t start. If the job with the
action: stop
for the environment is also in a later stage, it can’t start and the environment isn’t deleted.
To ensure the
action: stop
can always run when needed, you can:
If your project is configured to
create a dynamic environment
,
you might encounter this error because the dynamically generated parameter can’t be used for creating an environment.
For example, your project has the following
.gitlab-ci.yml
:
Since
$ENVIRONMENT
variable does not exist in the pipeline, GitLab tries to
create an environment with a name
production/
, which is invalid in
the environment name constraint
.
To fix this, use one of the following solutions:
Remove
environment
keyword from the deployment job. GitLab has already been
ignoring the invalid keyword, therefore your deployment pipelines stay intact
even after the keyword removal.
GitLab might drop this support in the future for the performance concern.
You can open an issue in
GitLab Issue Tracker
to discuss the behavior of this feature.
If you didn't find what you were looking for,
search the docs
.
If you want help with something specific and could use community support,
post on the GitLab forum
.
For problems setting up or using this feature (depending on your GitLab
subscription).