Make "Deploy" stage opt-in for Auto DevOps

Problem to solve

Since we've recently moved the domain name setting to the cluster level in https://gitlab.com/gitlab-org/gitlab-ce/issues/52363 this will now mean that if a cluster is configured for a group and the domain name is set then automatically all new repos in that group will start deploying their code to an internet facing URL.

This is likely to surprise some users and also a consequence I think it would end up being a bad idea for us to dogfood group level clusters ourselves in gitlab-com. Surprising and confusing users is one thing we've dealt with a lot in Auto DevOps already but this will be much worse if we end up leaking somebody's private GitLab project to the internet without them realising or opting in.

I was intending to add a group clusters so we'd be able to re-use it for version.gitlab.com and license.gitlab.com but I think it's possibly too risky if all new repos can end up on the internet without users opting in at all.

Target audience

Further details

Proposal

Consider making the deploy stage opt-in somehow. Even if we are insisting on keeping Auto DevOps enabled by default we could still make it so that they need to change a setting for the deploy stage to be enabled. deploy is fundamentally different from all other stages because it puts your code on the internet. We could still get the benefits of people discovering other Auto DevOps features but just make it one simple step for them to deploy to production.

What does success look like, and how can we measure that?

It should not be possible for users to be surprised that their app is deployed and available on the internet.

Links / references

Slack thread with a lot of context https://gitlab.slack.com/archives/C0NFPSFA8/p1549654769927300