A human gates production; automation gates everything else.
requireApproval pauses for a real approver; automation rules define retry-then-rollback as declared policy.
requireApproval: true
Pauses after rendering, before anything reaches the cluster, until a roles/clouddeploy.approver approves.
repairRolloutRule
Retry count + backoff, then automatic rollback to the last known-good release.
Zero retries configured → a 2-second transient DNS blip triggered a full rollback of an otherwise healthy release. 40 minutes were spent investigating a rollback with no real cause. Fix:
attempts: 2 with backoff.