Deploying DevSecOps Application Lifecycle Management by using IBM Cloud Schematics

This deployment guide walks you through how to customize and deploy an instance of the DevSecOps Application Lifecycle Management deployable architecture by using IBM Cloud® Schematics.

Before you begin

Review planning topics

Make sure that you complete the prerequisites in the planning topics:

Create an IBM Cloud API key

The DevSecOps Application Lifecycle Management deployable architecture requires an IBM Cloud API key to deploy the toolchains. Cloud API keys are distinct from Service API keys. Service API keys cannot create pipelines in the toolchains and would cause the deployment process to fail. Create an API key. The deployment process provisions the toolchains into the account that owns the API key.

Two similar ibmcloud api key entries are used. ibmcloud_api_key is used for creating the toolchains by using Schematics and is set during the deployment process. The other entry, ibmcloud-api-key is required to run the toolchains and is created in a secrets provider.

Configure your workspace

Your workspace is an IBM Cloud® Schematics workspace that is configured to run the Terraform code that creates the toolchains.

To find the IBM Cloud Schematics workspaces you created, go to IBM Cloud® and click Menu Menu icon> Schematics > Workspaces. You can create and deploy the DevSecOps continuous integration (CI), continuous deployment (CD), and continuous compliance (CC) toolchains by using the default variables.

Workspace variables
Variable Description
Name The name of the workspace.
Resource Group The resource group where the workspace is created.
Location The location where the workspace is created.

Deploy the architecture

To deploy DevSecOps Application Lifecycle Management toolchains by using Schematics, complete the following steps:

  1. Go to the DevSecOps Application Lifecycle Management catalog entry in the IBM Cloud catalog.

  2. Select the latest version in the Architecture section.

  3. Select a variation, if more than one is available.

  4. Agree to the terms and conditions on the Overview page and click Review deployment options.

  5. Select Deploy with IBM Cloud Schematics.

  6. In the Configure your workspace section, review the workspace name and update if necessary.

  7. Specify a resource group that is used, by default, for all resource creation and service instance lookups. If you have more than one resource group in your account, choose a group. If not, you can use the default.

  8. Select a location.

  9. Scroll down to Set the input variables and complete the Required input variables.

    List of required values for deployment
    Required value Action Example
    toolchain_name This variable specifies the root name for the CI, CD and CC toolchain names. A fixed suffix will automatically be appended. Setting DevSecOps will generate toolchains with the names DevSecOps-CI-Toolchain, DevSecOps-CD-Toolchain and DevSecOps-CC-Toolchain. The full name of each toolchain can be set independently using ci_toolchain_name, cd_toolchain_name, and cc_toolchain_name. DevSecOps
    toolchain_region Enter the region identifier that is used, by default, for all resource creation and service instance lookup. us-south
    toolchain_resource_group Enter the resource group that is used, by default, for all resource creation and service instance lookups. If you have more than one resource group in your account, choose a group. If not, you can use the default. Default
    registry_namespace A unique namespace within the IBM Cloud Container Registry region where the application image is stored. my-registry-namespace
    cluster_name Name of the Kubernetes cluster where the application is deployed. This sets the same cluster name for both CI and CD toolchains. See ci_cluster_name and cd_cluster_name to set different cluster names. By default , the cluster namespace for CI will be set to dev and CD to prod. These can be changed using ci_cluster_namespace and cd_cluster_namespace. mycluster_free
    sm_location The region hosting the Secrets Manager instance. This applies to the CI, CD and CC Secret Manager integrations. us-south
    sm_name The name of an existing Secret Managers instance. This applies to the CI, CD and CC Secret Manager integrations. sm-instance
    sm_resource_group The name of the existing resource group containing the Secrets Manager instance for your secrets. This applies to the CI, CD and CC Secret Manager integrations. Default
    sm_secret_group The Secrets Manager secret group containing the secrets for the DevSecOps pipelines. Default

    For more information, see Required input variables.

  10. Optional. Click Optional input variables and modify any optional variables to extend the experience. For more information, see Optional input variables.

  11. Click Deploy.

  12. Click Generate plan to create the resource deployable architecture.