Release & Promotion
Narrator: Now that the developer has done their job, let see what the experience is for the full end-to-end, the path-to-production.
Every enterprise has a unique SDLC, a bespoke path to production, but there are some common attributes, you typically start with a dev environment, pre-production (e.g. staging) and then production. There are normally some rules and some triggers that promote a "build" from one environment to another. With in this golden path template we leverage ArgoCD - OpenShift GitOps to continously deploy to across dev, pre-prod and production but it does require an update to the gitops repository to cause the deployment. If you remember there were webhooks configured on the newly generated git repo for push, tag and release events. To promote this latest code change to pre-prod, you simply create a tag in GitLab which triggers a promotion-focused Tekton pipeline, which updates the gitops repository causing ArgoCD to deploy.
Promote to Pre-Prod
First access the GitLab UI, there is a convenient link on the Overview tab
Click on Tags
New Tag
Give the tag a name like v1.0
and click Create tag
Back to the portal and the CI tab to see the promotion pipeline in action
This pipeline has a special task called verify-enterprise-contract
Enterprise Contract (EC) is a special CLI that compliments Sigstore’s cosign. If you remember the build-sign-image task that produced and stored the .sig and .att artifacts into the container registry, EC evaluates that signature and attestation. EC is based on the rego policy language from Open Policy Agent and allows you to create custom rules to review cosign attest attestations. By default, EC works with the SLSA provence attestation coming out of Tekton Chains.
Enterprise Contract, as part of this promotion pipeline, is verifing that the container image did in fact come from the corporate standard/approved build system. In other words, this container image was not built on some random person’s laptop, it was built in the secure build system. The .att, .sbom and .sig are stored alongside the container image and a tool like skopeo can be used to move all items together.
The Hitchhiker’s Guide is particularly good way to get started understanding EC.
Once the release pipeline has completed, you can see your application has been promoted to pre-prod and is available via the Topology plug-in.
Promote to Prod
To promote to Production use the Create Release feature of the GitLab UI.
Give the release a title and click the Create release button
Another release pipeline will be triggered and if the Enterprise Contract passes then the container image will be promoted production.
If you have a failure with Enterprise Contract see the Tips section