Pipeline Tools and Features

SDO uses a Kubernetes cluster to build and deploy project software.  Here is a brief list of the Pipeline tools and their features

• Ansible Tower
  • A simple IT automation engine
  • Runs in multi-tenant mode
  • Repository for Ansible roles and scripts
• Artifactory
  • Universal binary artifact repository
  • Remote artifacts pulled through the DMZ
  • Each project has own set of repositories (by type)
• Bamboo
  • Licensing is under the ELA
  • Runs in multi-tenant mode
  • Tightly integrated with the Atlassian tools
  • Plug-ins may require licensing for any additional tools that projects introduce in their pipeline
  • Add tools to Bamboo through specializing the PBC (required whether there is a plug in or not)
• Bitbucket
  • Licensing is under the ELA
  • Runs in multi-tenant mode
  • Tightly integrated with the Atlassian tools
  • Plug-ins may require licensing for any additional tools that the projects introduce in their pipeline
• CxSAST
  • Licensing under the ELA
  • Runs in multi-tenant mode
  • Integrated with pipeline orchestration (Bamboo or Jenkins) if desired
• Jenkins
  • Free and open source – no licensing cost
  • Run in multi-tenant or multi-server mode (each project gets their own Jenkins instance)
  • A little more overhead involved with multi-server – each project runs in their own namespace but benefit from providing persistence for the project pipeline
  • Hundreds of plug-ins that allow integration with all of the SDO plug-ins and a lot more.
  • Adding tools and capabilities to Jenkins – more flexibility (configure as global tool, add the tool in the builder pod, add the tool as part of the Jenkins pipeline definition)
• JMeter
  • Free and open source - no licensing cost
  • Run in multi-tenant mode
  • Configurable in Bamboo or Jenkins pipeline
• Per Build Containers (PBCs)
  • Build containers are launched at build time.  No resources (computational or licensing) are allocated until a build starts.
  • Optimized PBC image (i.e. headless JDK) - ephemeral approach to pipeline execution.
  • Build customized PBCs for Java, C, C++, .Net, …
  • Automated pipeline build of PBC images based on dependency graph
  • Base set of PBCs provided to projects and projects can customize based on their requirements
• Selenium
  • Free and open source - no licensing cost
  • Run in multi-tenant environment
  • Configurable in Bamboo or Jenkins pipeline
• SonarQube
  • Free and open source - no licensing cost
  • Run in multi-tenant environment
  • Configurable in Bamboo or Jenkins pipeline
• Xray
  • A deep vulnerability scanner
  • Artifacts are scanned at arrival, when new vulnerabilities are issued, individual builds can be scanned, and IDE plugin so scanning can occur at development time.
  • Projects control what to do when certain level of vulnerabilities are detected.  Multiple ways of notifying team.

For a full list of the SDO Tools and Technologies with versions, visit eSDO - Secure DevOps Tools and Technologies