How do conventional CI/CD pipelines and Tanzu Application Platform software supply chains work together?
By: Kirti Apte (Broadcom), Corby Page (Broadcom)
Background
For enterprises today, application modernization and migration to microservices-based cloud-native applications is a top priority. Continuous Integration (CI) pipelines are an essential tool to automate and optimize application development and delivery processes. There are a plethora of choices available for CI pipeline tools, including Jenkins, Azure DevOps, Travis CI, GitLab, and GitHub Actions. The right CI tool can significantly improve your development productivity and help you deliver the software efficiently. CI pipelines ensure that code is built, tested, and deployed consistently.
Software supply chains extend beyond CI pipelines, considering not only the development process but also the security, integrity, and compliance of deployable software artifacts as they progress through the path to production. They address the challenges associated with third-party dependencies, licensing, runtime configuration, and the safe distribution of software to end-users.
In this blog, we will explore how conventional CI pipelines work together with software supply chains while migrating and modernizing your applications. The use of supply chains does not involve replacing conventional pipelines. Instead, supply chains provide a loosely coupled integration that complements your existing tools.
Key Concepts
Continuous Integration was introduced by Kent Beck over 20 years ago as a key element of agile development methodologies. It is a development practice where code commits trigger automated builds and unit testing, providing immediate feedback on whether the code is suitable for promotion to deployment environments. CI pipelines can be extended to encompass other operations, like code quality scanners, that provide feedback to developers on the state of their commit.
Software Supply Chains are tasked with the packaging and configuration of software artifacts for deployment while ensuring that these artifacts meet the governance, compliance, and security requirements of your enterprise for a production deployment.
Continuous Delivery is the practice of automating the deployment of your software into QA, staging, and even production environments. To ensure the software is ready for delivery from a functional standpoint, it should first proceed through a CI pipeline. To ensure software is ready for delivery from a governance standpoint, it should first proceed through a software supply chain.
Our Approach
We will demonstrate a solution using Azure DevOps as our CI/CD pipeline tool, and VMware Tanzu Application Platform’s supply chains based on the open-source software Cartographer. However, the solution is generic and can be applied to any conventional CI/CD pipeline.
Tanzu Application Platform is a transformative, self-managed platform that works on any cloud. It is designed to help App Teams through their app modernization journeys.
Tanzu Application Platform’s Secure Supply Chains offer the capability to seamlessly extend your Azure DevOps pipelines to automate security, compliance, and your path to production for workloads that are targeting Kubernetes runtimes. They enhance Azure DevOps by implementing a clear separation of responsibilities between the application development teams, and your platform/security teams.
Azure DevOps Responsibilities
Azure DevOps is used directly by application development teams to enable agile feature development and the publishing of application source code. Important capabilities of Azure DevOps include:
- Boards for feature tracking and release planning
- Repos for source control
- Test Plans for coordinating manual test activities
Additionally, Azure DevOps provides Pipelines for automated tasks to be executed on code commits. These tasks can include:
- Running code quality scanners on committed source
- Compiling source code and running automated unit tests
- Assigning tags to a Git revision, or promoting a commit to a Git branch
Secure Supply Chain Responsibilities
Tanzu Application Platform’s Secure Supply Chains are used by platform engineering and security teams to ensure a secure path to production for Kubernetes workloads. Once code has progressed through an Azure DevOps pipeline, it will enter the supply chain, where the platform team defines:
- An automated, repeatable process for building secure container images for application binaries
- Scan policies that determine which vulnerabilities in the binary images are allowed, and which will prevent promotion
- Configuration standards for the Kubernetes resources that will deploy the application into a Kubernetes cluster. These configurations could include CPU/Memory limits, autoscaling parameters, or embedded tools for security or observability.
Key Differences
Azure DevOps Pipelines are managed by application developers, and each pipeline is scoped per application.
Get Kirti Apte’s stories in your inbox
Join Medium for free to get updates from this writer.
Secure Supply Chains are managed by DevSecOps, and a supply chain is scoped across applications.
Why Secure Supply Chains?
There are key benefits to entrusting security and compliance to Secure Supply Chains:
Consistency. If application developers are asked to support these tasks in Azure DevOps Pipelines, it is very difficult to ensure that all teams are performing these tasks consistently and correctly. Secure Software Supply Chains ensure all of these tasks are consistent, automated, and repeatable.
Remediation. Secure Supply Chains support automatic remediation. If a security patch needs to be applied to container images, the scan policy changes, or Kubernetes resource configuration needs to change, the change can be made once, and it is automatically applied across all applications. There is no need to revisit individual Azure DevOps pipelines, and there is no activity required on the part of the application developers to effect the changes. This allows the DevSecOps team to iterate over their supply chain the same way that developers iterate over their code.
GitOps Deployment. The output of a Secure Supply Chain is a GitOps descriptor of the compliant deployment, which can be synced and scheduled to any Kubernetes cluster. This Git-driven approach allows the DevSecOps team to easily view and schedule a large portfolio of applications and manage promotion through staging and production environments. The Git model ensures access control, auditing, and rollback are supported across all workloads.
How Azure DevOps and Secure Supply Chains Work Together
Both Azure DevOps Pipelines and Secure Supply Chains are triggered through Git activity. When a developer commits source code to a development Git branch, that will trigger the Azure DevOps pipeline that is watching that branch of the repo. Once the pipeline has been completed, the final step is to promote the commits to the supply chain branch, where it will be picked up by the Secure Supply Chains to ensure compliance.
Tanzu Application Platform integrates with Azure Dev Ops to reduce cognitive load on developers and provide a curated, end-to-end experience.
- Leverage ADO Boards, Repos, Artifacts, and Test Plans to streamline agile development.
- Use ADO Pipelines to automate developer-managed tasks on commit.
- Use TAP Secure Supply Chains to automate a DevSecOps-defined path to production, with all of the security guardrails needed to ensure a compliant deployment.
Conclusion
An effective software supply chain includes a Continuous Integration (CI) pipeline as an integral part of the agile development process and a Continuous Deployment (CD) to deploy workloads efficiently. Together they ensure secure, reliable, and repeatable software delivery to the end users and customers.
I hope you find this topic interesting. Consider incorporating our integrated solution into your DevSecOps practices!
