Release Designer role does not allow create a Deployment

Document ID : KB000010861
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

We want to create a few roles for our application:
- Release Designer role - people from this group can create deployment plans/project/deployments
- Release Executor role - people from this group can run a deployment
- Release Approver - it is approval gate role to approve release on environment

We cannot accept "Environment Admin" role, because our goal is to split these role to have a designer, executor and approver.

Background:

Unfortunately if we set a user with below roles, this user can create new deployment project, new deployment plan cannot "Deploy" and get error: "User has no permissions"
- Release Template Designer
- Deployment Plan Designer
- Release Designer on environment
 What is the permission model you recommend for above scenario?

Environment:
Release Automation : 6.4.0.10072 and higher
Instructions:

1: What is Deploy?

 

    Deploy is going to create a run time entity i.e. a release from a blueprint. During the stage of Deploy, an “Executor” can’t do much but can only select environment on which he can deploy, can name the release etc.

 

2: Overview of Release Designer vs Release Template Designer

 

     Release is a nothing but a run-time entity created either from Templates or Deployment Plan. There is a still a difference raising from product team consideration and I would like to elaborate based on my knowledge.

 

What is Release Designer? Even if whole blue print i.e. Templates, Deployment plans are created still there is some design (properties an executor can select to decide what(name of the release), which stages (pre-deployment only or full deployment),  and where(environments to execute) release will execute) needed to be done at Release Executor end. However it is further fine grained in terms of pairing up with this permission with each environment what permission are bear by user.

 

What is “Release Template Designer followed by Deployment Plan Designer”?

 

To my best understanding everything except release is just a blue-print or a sort of template and not a run-time entity. This is why a user with “Release Template Designer + Deployment Plan Designer” permission are allowed to modify the blue-print which govern how the release will be executed but they don’t control where and when these release will be executed.

 

 Think of a use case where you have designer who design how various application or components will be deployed, for example a website, back office etc. they can work in close with Dev teams which owns various component of these applications collectively. As a release designer the user should be well aware of granularity of these components forming an application and there inter-dependencies.

 

 Executors, ideally should more be reliable for environments as they should not be aware of how things will and in what order will be deployed they will be more concern about environments, naming convention for releases etc.

 How to configure permission for Designer and Executor group?

designer.png

 

 

 

Executor.png

 

 

 

 

Additional Information:

Approver is an additional check which may be required in some scenario, where an additional approval is required it can be either in some critical environment like PROD or a ticketing system need to mark specific task complete before approval, or to make sure that maintenance window of that environment is right etc.