Deployment Requests

In DeployClear, you never run terraform apply directly. You create a Deployment Request. This enforces that every change goes through a formal plan-then-apply cycle with human oversight.

Anatomy of a Request

A Request is a bundled definition of:

• The Block: The Terraform code to run.
• The Variables: The user-provided inputs to satisfy the Block's Manifest.
• The Jobs: The ephemeral runner executions handling the workload.

1. Creating a Request

Any user, including those with the Read-Only Member role, can create a deployment request.

1. Navigate to the Blocks page.
2. Select the Block you want to deploy.
3. Click the Deploy button.
4. An auto-generated form will appear based on the Block's manifest.yaml. Fill out the required variables (e.g., bucket_name = production-assets).
5. Click Submit Request.

2. The Planning Phase

Upon submission, DeployClear immediately spins up an ephemeral Cloudflare Container and executes the following sequence:

1. Injects configured Secrets.
2. Dynamically generates a backend-admin.tf to configure your State Server.
3. Retrieves the specific version of the Block you requested.
4. Executes terraform init.
5. Executes terraform plan -var="bucket_name=production-assets".

This entire sequence is recorded as the Plan Job. The output of the terraform plan is securely stored and presented in the dashboard.

3. The Approval Phase

Once the Plan Job succeeds, the Request enters a Pending Approval state.

This is the critical gatekeeping moment in DeployClear. A user with the DevOps, Admin, or Owner role must review the exact Plan output.

• If the plan attempts to destroy critical infrastructure, the DevOps engineer can click Reject. The Request is permanently closed.
• If the plan is safe, the DevOps engineer clicks Approve and Deploy.

4. The Apply Phase

When Approved, a brand new ephemeral runner spins up, executing terraform apply utilizing the exact variables from the request, completely insulated from local state drift.

Destroying Infrastructure

When a Block's purpose is fulfilled, it must be cleanly destroyed. The process mirrors deployment exactly:

1. From the Requests page, locate a deployed Request.
2. Click Destroy.
3. DeployClear generates a terraform plan -destroy job.
4. A DevOps engineer reviews the destruction plan and clicks Approve and Destroy to execute the terraform destroy command.

Next: Securing Provider Secrets →