---
name: devsecops-alm-devsecops-alm-toolchain-operations-prereqs
title: Prerequisites for provisioning DevSecOps toolchain operations
description: Use these steps to provision DevSecOps toolchain operations. These steps are not required for a Terraform deployment of the DevSecOps toolchains.
last-updated: 2025-03-27
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops-alm?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Prerequisites for provisioning DevSecOps toolchain operations
{: #devsecops-alm-ops-req}

Use these steps to provision DevSecOps toolchain operations. These steps are not required for a Terraform deployment of the DevSecOps toolchains.

## Create a continuous delivery service
{: #devsecops-alm-cd}

Continuous delivery supports the repositories and pipelines in the toolchain. To create a continuous delivery service, see [Continuous Delivery](https://cloud.ibm.com/catalog/services/continuous-delivery){: external}.

You can evaluate the continuous delivery service for 30 days by using the lite plan.
{: note}

## Create a Kubernetes cluster
{: #devsecops-alm-k8}

If you are using the Kubernetes variation of the DevSecOps Application Lifestyle Management deployable architecture, you need to create either a [Kubernetes cluster](https://cloud.ibm.com/kubernetes/catalog/cluster/create){: external}, or a [Red Hat OpenShift cluster](https://cloud.ibm.com/kubernetes/catalog/create?platformType=openshift){: external}.

While you are evaluating the service, you can use the free pricing plan. The cluster might take some time to provision. As the cluster is created, it progresses through the following stages: Deploying, Pending, and Ready. For more information, see [Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started&format=markdown).

## Code Engine project
{: #devsecops-alm-k8-codeengine}

If you are using the Code Engine variation of the DevSecOps Application Lifestyle Management deployable architecture, you must have an account with permissions to create a Code Engine project. You can use an existing project, otherwise a project will be created automatically. For more information, see [Managing user access](https://cloud.ibm.com/docs/codeengine?topic=codeengine-iam&format=markdown) and [Managing projects](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project&format=markdown).

## Create a Container Registry namespace
{: #devsecops-alm-namespace}

1. Create a [Container Registry namespace](https://cloud.ibm.com/registry/namespaces){: external}. Container Registry provides a multi-tenant private image registry that you can use to store and share your container images with users in your IBM Cloud account.
2. Select the location for your namespace, and click **Create**.

For more information, see [Getting started with Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-started&format=markdown).

## Create a GPG signing key and a GPG public key
{: #devsecops-alm-signkey}

Create an image signing key with the proper encoding to sign your application Docker images.

This key is required for the CI pipeline. The default secret name entry is `signing-key`. For more information, see [Generating a GPG key](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-image-signing&format=markdown).

The public key can be created using an existing GPG private key. It is required for the artifact signature validation step as part of the CD pipeline run. This can be generated during a CI pipeline run by adding the `print-code-signing-certificate` property and setting the value to `1`. The public key cert will be displayed in the logs of the CI pipeline run under the `build-artifact` step. The output should then be stored in a secrets provider. This is set by default from version `1.1.0`. For more information, see [Generating a GPG public key](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-publickey&format=markdown).

Alterntively, the DevSecOps Application Lifecycle Management deployable architecture can auto generate these keys. For more information, refer to [Update](https://cloud.ibm.com/docs/devsecops-alm?topic=devsecops-alm-release-notesdevsecops-alm-nov2024&format=markdown) and [Variables](https://cloud.ibm.com/docs/devsecops-alm?topic=devsecops-alm-devsecops-alm-vars&format=markdown).

## Create an IBM Cloud API key
{: #devsecops-alm-apikey}

Create an [API key](https://cloud.ibm.com/iam/apikeys){: external}.

Save the API key value by either copying, downloading it, or adding it to your vault. The default secret name entry is `ibmcloud_api_key`.

## Create an IBM Cloud® Object Storage instance (optional)
{: #devsecops-alm-cos}

Create an IBM Cloud Object Storage instance and bucket.

For more information, see [Configuring IBM Cloud Object Storage for storing evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-config&format=markdown), and [What is IBM Cloud Object Storage?](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cloud-object-storage&format=markdown)

The default IBM Cloud Object Storage API key is `cos_api_key`.