You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# IBM DevSecOps Application Lifecycle Management Stack
2
2
3
3
The following [deployable architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understand-module-da#what-is-da) automates the deployment of a sample NodeJS application on IBM Cloud, including all underlying IBM Cloud infrastructure. This architecture implements the best practices for in [reference architecture]().
4
4
5
5
This deployable architecture provides a comprehensive foundation for trust, observability, security, and regulatory compliance by configuring the IBM Cloud account to align with compliance settings, deploying key and secret management services, and deploying the infrastructure to support CI/CD/CC pipelines for secure application lifecycle management. These pipelines facilitate the deployment of the application, vulnerability checks, and auditability, ensuring a secure and trustworthy deployment of applications on IBM Cloud.
6
6
7
7
# Objective and Benefits
8
8
9
-
This deployable architecture is designed to showcase a fully automated deployment of a retrieval augmented generation application through IBM Cloud Project, providing a flexible and customizable foundation for your own application deployments on IBM Cloud. This architecture deploys the following [sample application]() by default.
9
+
This deployable architecture is designed to showcase a fully automated deployment of a Code Engine NodeJS application through IBM Cloud Project, providing a flexible and customizable foundation for your own application deployments on IBM Cloud. This architecture deploys the following [sample application]() by default.
10
10
11
11
By leveraging this architecture, you can accelerate your deployment and tailor it to meet your unique business needs and enterprise goals.
12
12
@@ -26,7 +26,7 @@ To deploy this architecture, follow these steps.
26
26
27
27
Before deploying the deployable architecture, ensure you have:
28
28
29
-
* Created an API key in the target account with sufficient permissions. The target account is the account that will be hosting the resources deployed by this deployable architecture. See [instructions](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=ui) Note the API key, as it will be used later. On evaluation environments, you may simply grant `Administrator` role on `IAM Identity Service`, `All Identity and Access enabled services` and `All Account Management` services. If you need to narrow down further access, for a production environment for instance, the minimum level of permissions is indicated in the [Permission tab](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/Retrieval_Augmented_Generation_Pattern-5fdd0045-30fc-4013-a8bc-6db9d5447a52-global#permissions) of the deployable architecture.
29
+
* Created an API key in the target account with sufficient permissions. The target account is the account that will be hosting the resources deployed by this deployable architecture. See [instructions](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=ui) Note the API key, as it will be used later. On evaluation environments, you may simply grant `Administrator` role on `IAM Identity Service`, `All Identity and Access enabled services` and `All Account Management` services. If you need to narrow down further access, for a production environment for instance, the minimum level of permissions is indicated in the [Permission tab]() of the deployable architecture.
30
30
31
31
* (Optional) Installed the IBM Cloud CLI's Project add-on using the `ibmcloud plugin install project` command. More information is available [here](https://cloud.ibm.com/docs/cli?topic=cli-projects-cli).
32
32
@@ -35,25 +35,121 @@ Before deploying the deployable architecture, ensure you have:
35
35
* Locate the [tile]() for the Deployable Architecture in the IBM Cloud Catalog.
36
36
* Click the "Add to project" button.
37
37
38
-
38
+
39
+
39
40
40
41
* Select **Create new** and enter the following details:
41
42
- Name and Description (e.g., "Retrieval Augmented Generation Pattern")
42
43
- Region and Resource Group for the project. e.g. for evaluation purposes, you may select the region the closest to you, and the Default resource group. For more insights on the recommended production topology, refer to the Enterprise account architecture Central administration account [white paper](https://cloud.ibm.com/docs/enterprise-account-architecture?topic=enterprise-account-architecture-admin-hub-account).
43
44
- Configuration Name (name of the automation in the project, e.g., "dev" or "prod", ideally matching the deployment target, but this can be any name)
44
45
45
-
46
+
46
47
47
48
* Click the **Add** button (or **Create** if this is the first project in the account) at the bottom right of the modal popup to complete.
48
49
49
50
## 3. Set the Input Configuration for the Stack
50
51
51
-
After completing `Step 2 - Deploy the Stack in a New Project from Catalog`, you are directed to a page allowing you to enter the configuration for you deployment:
52
+
After completing `Step 2 - Deploy the Stack in a New Project from Catalog`, you are directed to a page allowing you to enter the configuration for your deployment:
52
53
* Under Security -> Authentication, enter the API Key from the prereqs in the `api_key` field.
53
-
54
-
* Under Required, input a prefix. This prefix will be appended to the name of most resources created by automation, ensuring uniqueness and avoiding clashes when provisioning names in the same account.
55
-
* Under Optional, input the signing_key field. While not necessary for deploying Cloud resources, it is recommended and required to enable the building and deployment of the sample app.
54
+
55
+
56
+
57
+
* Under Required, select a region to deploy the resources and specify a name for the resource that is created.
58
+
* Under Optional, there are entries to specifiy an alternative resource prefix as well as plans for Secret Manager `sm_service_plan` and SCC `scc_service_plan`. Setting the option `use_existing_resource_group` to `true` changes the behaviour of `resource_group_name` from creating a new resource group to treating the specified resource group name as an existing resource group.
56
59
57
60
You may explore the other available inputs, such as the region and resource group name (under optional tab), leave them as is, or modify them as needed.
58
61
59
62
Once ready, click the "Save" button at the top of the screen.
63
+
64
+
## 4. Deploy the Architecture
65
+
66
+
Navigate to the project deployment view by clicking the project name in the breadcrumb menu.
67
+
68
+
69
+
70
+
71
+
You should be directed to a screen looking like:
72
+
73
+
74
+
75
+
Note: in some rare occurences, the first member of the stack may not be marked as "Ready to validate". Refreshing the page in your browser window should solve this problem.
76
+
77
+
Two approaches to deploy the architecture:
78
+
1.**Fully Automated End-to-End**. Recommended for demo or non-critical environments. This approach allows Project to validate, approve, and deploy all stack members automatically.
79
+
2.**Member-by-Member**. Recommended for critical environments, such as production. This approach enables a detailed review of changes from each stack member before automation is executed, ensuring precise control over the deployment process.
80
+
81
+
### Approach 1: Fully Automated End-to-End
82
+
83
+
To enable auto-deployment:
84
+
1. Go to **Manage** > **Settings** > **Auto-deploy** and toggle **On**.
85
+
86
+
2. Return to the **Configurations** tab and click **Validate** under stack configuration.
87
+
88
+
89
+
The project will then validate, approve, and deploy each stack member, taking approximately one hour to complete.
90
+
91
+
### Approach 2: Member-by-Member
92
+
93
+
1. Click on validate
94
+
95
+
96
+
97
+
2. Wait for validation
98
+
99
+
100
+
101
+
3. Approve and click the deploy button
102
+
103
+
104
+
105
+
4. Wait for deployment
106
+
107
+
5. Repeat step 1 for the next configuration in the architecture. Note that as you progress in deploying the initial base configuration, you will be given the option to validate and deploy multiple configuration in parallel.
108
+
109
+
## 5. Post deployment steps
110
+
111
+
At this point, the infrastructure has been successfully deployed in the target account, and the initial build of the sample application has started in the newly-provisioned DevOps service.
112
+
113
+
### Monitoring the Build and Deployment
114
+
115
+
To monitor the build and deployment of the application, follow these steps:
116
+
1.**Access the DevOps Toolchains View**: Navigate to the [DevOps / Toolchains view](https://cloud.ibm.com/devops/toolchains) in the target account.
117
+
2.**Select the Resource Group and Region**: Choose the resource group and region where the infrastructure was deployed. The resource group name is based on the prefix and resource_group_name inputs of the deployable architecture.
118
+
3.**Select the Toolchain**: Select "DevSecOps CI Toolchain"
119
+
4.**Access the Delivery Pipeline**: In the toolchain view, select ci-pipeline under Delivery pipeline
120
+
5.**View the CI Pipeline Status**: The current status of the CI pipeline execution can be found under the "ci-webhook-trigger" section.
121
+
122
+
### Verifying the Application Deployment
123
+
124
+
Once the initial run of the CI pipeline complete, you should be able to view the application running in the created [Code Engine project](https://cloud.ibm.com/codeengine/projects).
125
+
126
+
127
+
### Limitations with the Trial Secret Manager Offering
128
+
129
+
The automation is configured to deploy a Trial version of Secret Manager by default to minimize costs. However, the Trial version has some limitations. If you want to avoid these limitations, you can opt to deploy a standard (paid) instance of Secret Manager under the **Optional settings** of the stack.
130
+
131
+
Here are the limitations of the Trial version:
132
+
***Account limitation**: Only one Trial instance of Secret Manager can be deployed at a time in a given account.
133
+
***Deployment error**: You will encounter an error in the Secret Manager deployment step if there is already a Trial instance deployed in the same account.
134
+
***Re-deployment failure**: If the automation provisions a Trial version of Secrets Manager, and is un-deployed and then re-deployed again with the Trial version in the same account, the "3 - Security Service - Secret Manager" deployment will fail. This is because you can only have one Trial version of Secrets Manager in an account, and even after deletion, the prior Trial version of Secrets Manager needs to be removed from the "reclamation" state as well.
135
+
136
+
## 6. Important Deployment Considerations
137
+
138
+
### API Key Requirements
139
+
140
+
The deployable architecture can only be deployed with an API Key associated with a user. It is not compatible with API Keys associated with a serviceId. Additionally, it cannot be deployed using the Project trusted profile support.
141
+
142
+
**What are reclamations?**
143
+
In IBM Cloud, when you delete a resource, it doesn't immediately disappear. Instead, it enters a "reclamation" state, where it remains for a short period of time (usually 7 days) before being permanently deleted. During this time, you can still recover the resource if needed.
144
+
145
+
To resolve the re-deployment failure, you will need to delete the Secret Manager service from the reclamation state by running the following commands:
146
+
```
147
+
ibmcloud resource reclamations # lists all the resources in reclamation state, get the reclamation ID of the secret manager service
### Notification of New Configuration Versions ("Needs Attention")
151
+
152
+
You may see notifications in IBM Cloud Project indicating that one or more configurations in the stack have new versions available. You can safely ignore these messages at this point, as they will not prevent you from deploying the stack. No specific action is required from you.
153
+
154
+
Please note that these notifications are expected, as we are rapidly iterating on the development of the underlying components. As new stack versions become available, the versions of the underlying components will also be updated accordingly.
0 commit comments