An approach to build a DevOps pipeline for IBM App Connect Designer Flows on Cloud Pak for Integration

Make sure that you have npm module and required dependencies installed on the build server.
https://www.npmjs.com/package/@ibm-app-connect/bar-build

For example, to install on Ubuntu:

apt install npm
npm install -g npx
npm install @ibm-app-connect/bar-build

npx bar-build <path-to-flow-yaml-file> <path-to-new-bar-file>

Now configure the deployment jobs for each environment. You may have a single parameterized job to deploy to different CP4I environments; however due to security and compliance reasons, you would probably have different deployment jobs for respective environments.

Before the Integration Server starts, the container is checked for the folder /home/aceuser/initial-config.
Refer to https://github.com/ot4i/ace-docker to understand how to supply the required configuration information for Integration Server.

Since we are going to deploy an ACE designer project and an ACE toolkit project on one integration server, we need to make sure integration server configurations are done for both projects as appropriate.
We can have a deployment project containing configuration information, Dockerfile and Jenkinsfile as depicted in the diagram below.

I have a sample deployment job that contains these two files and a Configurations folder.

The sample deployment job is checked-in to Github:
https://github.com/awasthan/Deploy_Slack_API_CP4I.git

• Dockerfile: This file will have instructions to build the image baked with BAR files
• Jenkinsfile: This file will have the pipeline script to deploy to the CP4I environment, and create the Horizontal Pod autoscalar policy etc…
• Configurations: To do other configurations on IntegrationServer, you must pre-install the configuration secret containing the required configurations. A generic template for configuration parameters and a script to generate secrets can be downloaded from the platform navigator while doing manual deployment.

In this sample project, I have done integration server configuration to connect to the cloud managed connector (for Slack connector used in designer flow) and have also configured the Integration server to connect to an IBM EventStreams instance.
Let us look at the setdbparms.txt file inside ‘Configurations’ folder.

The first two lines are for setting-up the truststore password and securityIdentity to be used by the ACE flow; while the third line is to setup security identity for the designer flow to connect to the Cloud managed connector. Follow the below link to create IBM Cloud API key:
https://www.ibm.com/support/knowledgecenter/en/SSTTDS_11.0.0/com.ibm.ace.icp.doc/run-designerflow-in-acesoftware/creatingapikey.html

Let us examine the Dockerfile.

Let us examine the parts of jenkinsfile. This pipeline has been parameterized to accept some parameters dynamically. It does following tasks:

• Checks-out the deployment project
• Pulls the specified versions (ACE_APP1_VERSION and ACE_APP2_VERSION) of BAR files from Nexus repository for ACE_APP1 and ACE_APP2.
• Logs-in to the OCP registry of a specified CP4I instance
• Builds the docker image using the Dockerfile and DEV BAR files and pushes to the OCP registry
• Executes the generateSecrets.sh script to create secret using the configuration files inside ‘Configurations’ folder
• Performs helm deployment. Notice the name of ACE image (image.aceonly) in helm install command. Since we are using ace only image, so value of ‘imageType’ has been specified as ‘ace’. If you are using ACE with MQ client or ACE with MQ server, the value of ‘imageType’ would be ‘acemqclient’ and ‘acemqserver’ respectively. Make sure to specify the image parameter based on imageType. Also notice that ‘designerFlowsOperationMode=all’ enables for local and cloud managed connectors.
• If it is a new helm release being installed, horizontal autoscalar policy (hpa) is being created
• If it is an upgrade to existing helm release, it only upgrades the helm release and horizontal autoscalar policy is left unchanged
• Performs the clean-up

timestamps {

node () {

wrap([$class: 'Xvfb']) {
	stage ('Deploy_Slack_API_CP4I - Checkout') {
 	 checkout([$class: 'GitSCM', branches: [[name: '*/master']], doGenerateSubmoduleConfigurations: false, extensions: [], submoduleCfg: [], userRemoteConfigs: [[credentialsId: 'jenkins-token', url: 'https://github.com/awasthan/Deploy_Slack_API_CP4I.git']]]) 
	}
	stage ('Deploy_Slack_API_CP4I - Build') {
 	
artifactResolver artifacts: [artifact(artifactId: '${ACE_APP1}', extension: 'zip', groupId: 'com.ibm.esb', version: '${ACE_APP1_VERSION}'), artifact(artifactId: '${ACE_APP2}', extension: 'zip', groupId: 'com.ibm.esb', version: '${ACE_APP2_VERSION}')], targetDirectory: '/var/icp-builds/${ACE_APP1}'
sh label: '', script: '''#!/bin/sh
cd /var/icp-builds/${ACE_APP1}
unzip ${ACE_APP1}-${ACE_APP1_VERSION}.zip
chmod 777 *
cp ${ACE_APP1}_DEV_${ACE_APP1_VERSION}.bar /var/lib/jenkins/jobs/${JOB_NAME}/workspace
unzip ${ACE_APP2}-${ACE_APP2_VERSION}.zip
chmod 777 *
cp ${ACE_APP2}_DEV_${ACE_APP2_VERSION}.bar /var/lib/jenkins/jobs/${JOB_NAME}/workspace
cd ${WORKSPACE}
#cloudctl login -a ${ICP_CONSOLE_URL} -n ${Namespace} -u ${CP4I_User} -p ${CP4I_Password} –-skip-ssl-validation
oc login ${OCP_API_URL} -u ${OCP_USER} -p ${OCP_PASSWORD} --insecure-skip-tls-verify
oc project ${Namespace}
docker login ${OCP_Registry_External_URL} -u $(oc whoami) -p $(oc whoami -t)
docker build -t ${imagename}:${BUILD_NUMBER} .
docker tag ${imagename}:${BUILD_NUMBER} ${OCP_Registry_External_URL}/${Namespace}/${imagename}:${tag}-amd64
docker push ${OCP_Registry_External_URL}/${Namespace}/${imagename}:${tag}-amd64
cd Configurations
#Delete the secret if already exists. It would exist in case of upgrading the release
oc delete secret ${ReleaseName}-secret
./generateSecrets.sh ${ReleaseName}-secret
source /etc/profile
cd /opt/certs
helm init --client-only
helm repo add ibm-entitled-charts https://raw.githubusercontent.com/IBM/charts/master/repo/entitled/
if test ${DeploymentType} = \'install\'; then
helm ${DeploymentType} --name $ReleaseName ibm-entitled-charts/ibm-ace-server-icp4i-prod --version v3.1.0 --namespace ${Namespace} --set imageType=ace --set designerFlowsOperationMode=all --set image.aceonly=${OCP_Registry_Internal_URL}/${Namespace}/${imagename}:${tag} --set image.acemqclient=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-mqclient-server-prod:11.0.0.8-r1 --set image.acemq=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-mq-server-prod:11.0.0.8-r1 --set image.configurator=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-icp-configurator-prod:11.0.0.8-r1 --set image.connectors=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-lcp-prod:11.0.0.8-r1 --set image.designerflows=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-designer-flows-prod:11.0.0.8-r1 --set image.pullSecret=${IMAGE_PULL_SECRET} --set persistence.enabled=false --set persistence.useDynamicProvisioning=false --set integrationServer.name=${IntegrationServerName} --set integrationServer.configurationSecret=${ReleaseName}-secret --set integrationServer.truststoreCertNames=mykey --set aceonly.replicaCount=1 --set odTracingConfig.enabled=true --set odTracingConfig.odAgentImageRepository=${OCP_Registry_Internal_URL}/${Namespace}/icp4i-od-agent --set odTracingConfig.odAgentImageTag=1.0.2 --set odTracingConfig.odCollectorImageRepository=${OCP_Registry_Internal_URL}/${Namespace}/icp4i-od-collector --set odTracingConfig.odCollectorImageTag=1.0.2 --set odTracingConfig.odTracingNamespace=tracing --set license=accept --tls
oc project ${Namespace}
#Helm chart version 3.1.0 creates route, so commenting out below command to expose route
#oc expose svc ${ReleaseName}-ibm-ace-server-icp4i-prod --port=7800
oc autoscale deployment/${ReleaseName}-ibm-ace-server-icp4i-prod --min 1 --max 3 --cpu-percent=25
else
helm ${DeploymentType} $ReleaseName ibm-entitled-charts/ibm-ace-server-icp4i-prod --version v3.1.0 --namespace ${Namespace} --set imageType=ace --set designerFlowsOperationMode=all --set image.aceonly=${OCP_Registry_Internal_URL}/${Namespace}/${imagename}:${tag} --set image.acemqclient=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-mqclient-server-prod:11.0.0.8-r1 --set image.acemq=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-mq-server-prod:11.0.0.8-r1 --set image.configurator=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-icp-configurator-prod:11.0.0.8-r1 --set image.connectors=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-lcp-prod:11.0.0.8-r1 --set image.designerflows=${OCP_Registry_Internal_URL}/${Namespace}/ibm-ace-designer-flows-prod:11.0.0.8-r1 --set image.pullSecret=${IMAGE_PULL_SECRET} --set persistence.enabled=false --set persistence.useDynamicProvisioning=false --set integrationServer.name=${IntegrationServerName} --set integrationServer.configurationSecret=${ReleaseName}-secret --set integrationServer.truststoreCertNames=mykey --set aceonly.replicaCount=1 --set odTracingConfig.enabled=true --set odTracingConfig.odAgentImageRepository=${OCP_Registry_Internal_URL}/${Namespace}/icp4i-od-agent --set odTracingConfig.odAgentImageTag=1.0.2 --set odTracingConfig.odCollectorImageRepository=${OCP_Registry_Internal_URL}/${Namespace}/icp4i-od-collector --set odTracingConfig.odCollectorImageTag=1.0.2 --set odTracingConfig.odTracingNamespace=tracing --set license=accept --tls
fi
cd /var/icp-builds
rm -rf ${ACE_APP1}
rm -rf ${ACE_APP2}''' 
	}
}
cleanWs()
}
}

Now let us look at the Jenkins pipeline Job for this.
Parameters have been defined for all the placeholders in above jenkinsfile.

Pipeline script has been configured to pull from Github.

Similarly you can configure deployment job for QA environment and so on.

Now let us deploy an IntegrationServer that contains version 18 of ‘Designer_Slack_Alert_API’ and version 20 for ‘Test.App’. Also note that, the base image of ACE being pulled in docker file is version 11.0.0.8.

Click on ‘Build with Parameters’ for the deployment job and supply the values for parameters.

Click on Build.

Below is the snippet of build logs.

Started by user anand
Obtained jenkinsfile from git https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] Start of Pipeline
[Pipeline] timestamps
[Pipeline] {
[Pipeline] node
[2020-05-27T07:09:14.586Z] Running on Jenkins in /var/lib/jenkins/jobs/Deploy_Slack_API_CP4I/workspace
[Pipeline] {
[Pipeline] wrap
[2020-05-27T07:09:14.606Z] Xvfb starting$ /usr/bin/Xvfb :0 -screen 0 1024x768x24 -fbdir /var/lib/jenkins/xvfb-6-..fbdir5015161639313609410
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Deploy_Slack_API_CP4I - Checkout)
[Pipeline] checkout
[2020-05-27T07:09:14.649Z] using credential jenkins-token
[2020-05-27T07:09:14.655Z] Cloning the remote Git repository
[2020-05-27T07:09:14.655Z] Cloning repository https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git
[2020-05-27T07:09:14.655Z]  > /usr/bin/git init /var/lib/jenkins/jobs/Deploy_Slack_API_CP4I/workspace # timeout=10
[2020-05-27T07:09:14.664Z] Fetching upstream changes from https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git
[2020-05-27T07:09:14.664Z]  > /usr/bin/git --version # timeout=10
[2020-05-27T07:09:14.669Z] using GIT_ASKPASS to set credentials 
[2020-05-27T07:09:14.670Z]  > /usr/bin/git fetch --tags --progress -- https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git +refs/heads/*:refs/remotes/origin/* # timeout=10
[2020-05-27T07:09:15.068Z]  > /usr/bin/git config remote.origin.url https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git # timeout=10
[2020-05-27T07:09:15.074Z]  > /usr/bin/git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
[2020-05-27T07:09:15.083Z]  > /usr/bin/git config remote.origin.url https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git # timeout=10
[2020-05-27T07:09:15.088Z] Fetching upstream changes from https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git
[2020-05-27T07:09:15.088Z] using GIT_ASKPASS to set credentials 
[2020-05-27T07:09:15.088Z]  > /usr/bin/git fetch --tags --progress -- https://github.ibm.com/anand-awasthi/Deploy_Slack_API_CP4I.git +refs/heads/*:refs/remotes/origin/* # timeout=10
[2020-05-27T07:09:15.394Z]  > /usr/bin/git rev-parse refs/remotes/origin/master^{commit} # timeout=10
[2020-05-27T07:09:15.404Z]  > /usr/bin/git rev-parse refs/remotes/origin/origin/master^{commit} # timeout=10
[2020-05-27T07:09:15.411Z] Checking out Revision ed1ed7e424c5b363649b905b68742cd826dc387f (refs/remotes/origin/master)
[2020-05-27T07:09:15.411Z]  > /usr/bin/git config core.sparsecheckout # timeout=10
[2020-05-27T07:09:15.416Z]  > /usr/bin/git checkout -f ed1ed7e424c5b363649b905b68742cd826dc387f # timeout=10
[2020-05-27T07:09:15.425Z] Commit message: "Update setdbparms.txt"
[2020-05-27T07:09:15.426Z]  > /usr/bin/git rev-list --no-walk 2ba014c20a475bf33ba2b35a0469034dd3b7903f # timeout=10
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Deploy_Slack_API_CP4I - Build)
[Pipeline] artifactResolver
[2020-05-27T07:09:15.496Z] INFO: define repo: [Repository id=nexus-release, type=default, url=http://127.0.0.1:8044/nexus/repository/releases/, isRepositoryManager=false]
[2020-05-27T07:09:15.496Z] INFO: set authentication for admin
[2020-05-27T07:09:15.509Z] deleted file:/var/icp-builds/Designer_Slack_Alert_API/Designer_Slack_Alert_API-18.zip
[2020-05-27T07:09:15.509Z] copy /var/nexus_repo/com/ibm/esb/Designer_Slack_Alert_API/18/Designer_Slack_Alert_API-18.zip to file:/var/icp-builds/Designer_Slack_Alert_API/Designer_Slack_Alert_API-18.zip
[2020-05-27T07:09:15.524Z] deleted file:/var/icp-builds/Designer_Slack_Alert_API/Test.App-20.zip
[2020-05-27T07:09:15.524Z] copy /var/nexus_repo/com/ibm/esb/Test.App/20/Test.App-20.zip to file:/var/icp-builds/Designer_Slack_Alert_API/Test.App-20.zip
[Pipeline] sh
[2020-05-27T07:09:15.793Z] Archive:  Designer_Slack_Alert_API-18.zip
[2020-05-27T07:09:15.793Z]   inflating: Designer_Slack_Alert_API_DEV_18.bar  
[2020-05-27T07:09:15.793Z] Archive:  Test.App-20.zip
[2020-05-27T07:09:15.793Z]   inflating: Test.App_DEV_20.bar     
[2020-05-27T07:09:15.793Z]   inflating: Test.App_QA_20.bar      
[2020-05-27T07:09:20.990Z] Login successful.
[2020-05-27T07:09:20.990Z] 
[2020-05-27T07:09:20.990Z] You have access to 72 projects, the list has been suppressed. You can list all projects with 'oc projects'
[2020-05-27T07:09:20.990Z] 
[2020-05-27T07:09:20.990Z] Using project "ace".
[2020-05-27T07:09:21.241Z] Already on project "ace" on server "redacted the value".

[2020-05-27T07:09:21.792Z] WARNING! Using --password via the CLI is insecure. Use --password-stdin.
[2020-05-27T07:09:22.343Z] WARNING! Your password will be stored unencrypted in /var/lib/jenkins/.docker/config.json.
[2020-05-27T07:09:22.343Z] Configure a credential helper to remove this warning. See
[2020-05-27T07:09:22.343Z] https://docs.docker.com/engine/reference/commandline/login/#credentials-store
[2020-05-27T07:09:22.343Z] 
[2020-05-27T07:09:22.343Z] Login Succeeded
[2020-05-27T07:09:22.343Z] Sending build context to Docker daemon  180.7kB

[2020-05-27T07:09:22.343Z] Step 1/4 : FROM redacted the value /ace/ibm-ace-server-prod:11.0.0.8-r1-amd64

[2020-05-27T07:09:22.343Z]  ---> 50a1cbd42ca5
[2020-05-27T07:09:22.343Z] Step 2/4 : COPY *DEV*.bar /home/aceuser/initial-config/bars/
[2020-05-27T07:09:22.343Z]  ---> Using cache
[2020-05-27T07:09:22.343Z]  ---> 373147049480
[2020-05-27T07:09:22.343Z] Step 3/4 : EXPOSE 7600 7800 7843 9483
[2020-05-27T07:09:22.343Z]  ---> Using cache
[2020-05-27T07:09:22.343Z]  ---> 64a19443506e
[2020-05-27T07:09:22.343Z] Step 4/4 : ENV LICENSE accept
[2020-05-27T07:09:22.343Z]  ---> Using cache
[2020-05-27T07:09:22.343Z]  ---> 8b572918434d
[2020-05-27T07:09:22.343Z] Successfully built 8b572918434d
[2020-05-27T07:09:22.343Z] Successfully tagged slackalertace:6
[2020-05-27T07:09:22.593Z] The push refers to repository [redacted the value/ace/slackalertace]

[2020-05-27T07:09:22.844Z] 793ad17cc0df: Preparing
[2020-05-27T07:09:22.844Z] cc462519999e: Preparing
[2020-05-27T07:09:22.844Z] 434b83712593: Preparing
[2020-05-27T07:09:22.844Z] d120f8762989: Preparing
[2020-05-27T07:09:23.095Z] cc462519999e: Layer already exists
[2020-05-27T07:09:23.095Z] d120f8762989: Layer already exists
[2020-05-27T07:09:23.095Z] 793ad17cc0df: Layer already exists
[2020-05-27T07:09:23.095Z] 434b83712593: Layer already exists
[2020-05-27T07:09:23.646Z] 6-amd64: digest: sha256:af0be5f1180d68a37bee2a71d2c82fa2c07f45acb44b252992c18e74bd9e64fb size: 1159
[2020-05-27T07:09:24.557Z] Error from server (NotFound): secrets "slackalertace-rel6-secret" not found
[2020-05-27T07:09:24.557Z] Creating secret
[2020-05-27T07:09:24.557Z] oc create secret generic slackalertace-rel6-secret --from-literal=mqsc= --from-literal=adminPassword= --from-literal=appPassword= --from-literal=keystorePassword= --from-literal=keystoreKey-mykey= --from-literal=keystoreCert-mykey= --from-literal=keystorePass-mykey= --from-file=truststorePassword=./truststorePassword.txt --from-file=truststoreCert-mykey=./truststoreCert-mykey.crt --from-literal=odbcini= --from-file=policy=./policy.xml  --from-literal=policyDescriptor= --from-file=serverconf=./server.conf.yaml  --from-file=setdbparms=./setdbparms.txt 
[2020-05-27T07:09:25.469Z] secret/slackalertace-rel6-secret created
[2020-05-27T07:09:25.469Z] /var/lib/jenkins/jobs/Deploy_Slack_API_CP4I/workspace@tmp/durable-769894d3/script.sh: 21: /var/lib/jenkins/jobs/Deploy_Slack_API_CP4I/workspace@tmp/durable-769894d3/script.sh: source: not found
[2020-05-27T07:09:25.469Z] $HELM_HOME has been configured at /var/lib/jenkins/.helm.
[2020-05-27T07:09:25.469Z] Not installing Tiller due to 'client-only' flag having been set
[2020-05-27T07:09:25.469Z] Happy Helming!
[2020-05-27T07:09:25.469Z] "ibm-entitled-charts" has been added to your repositories
[2020-05-27T07:09:29.592Z] NAME:   slackalertace-rel6
[2020-05-27T07:09:29.592Z] E0527 07:09:29.408641   57608 portforward.go:303] error copying from remote stream to local connection: readfrom tcp4 127.0.0.1:44995->127.0.0.1:37758: write tcp4 127.0.0.1:44995->127.0.0.1:37758: write: broken pipe
[2020-05-27T07:09:30.504Z] LAST DEPLOYED: Wed May 27 07:09:27 2020
[2020-05-27T07:09:30.504Z] NAMESPACE: ace
[2020-05-27T07:09:30.504Z] STATUS: DEPLOYED
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] RESOURCES:
[2020-05-27T07:09:30.504Z] ==> v1/Role
[2020-05-27T07:09:30.504Z] NAME                                               AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-ibm-ace-server-icp4i-prod-role  3s
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] ==> v1/RoleBinding
[2020-05-27T07:09:30.504Z] NAME                                                      AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-ibm-ace-server-icp4i-prod-rolebinding  3s
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] ==> v1/Job
[2020-05-27T07:09:30.504Z] NAME                                           COMPLETIONS  DURATION  AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-ibm-ace--623f-icp4i-o-f857  0/1          2s        2s
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] ==> v1/Route
[2020-05-27T07:09:30.504Z] NAME                      AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-http   2s
[2020-05-27T07:09:30.504Z] slackalertace-rel6-https  2s
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] ==> v1/ConfigMap
[2020-05-27T07:09:30.504Z] NAME                                           DATA  AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-ibm-ace--623f-create--d350  2     3s
[2020-05-27T07:09:30.504Z] 
[2020-05-27T07:09:30.504Z] ==> v1/Service
[2020-05-27T07:09:30.504Z] NAME                                                      TYPE       CLUSTER-IP     EXTERNAL-IP  PORT(S)                     AGE
[2020-05-27T07:09:30.504Z] slackalertace-rel6-ibm-ace-server-icp4i-prod-ace-metrics  ClusterIP  172.21.105.71