FlexDeploy supports architecture where customers have strict network isolation between various environments. For example, production environment (and possibly more) is set up such that it cannot access source control, artifact repositories and the environment itself cannot be accessed from other environments via SSH or HTTPS. This is done mostly for security reasons. Customers employing this type of security architecture can install FlexDeploy in each of the isolated environments, then copy execution details in zip format from source environment to other environments. This would allow implementing a build once - deploy many approach and still maintain necessary security practices.

Assumptions

• FlexDeploy is installed on each isolated environment, and plugins are also installed as part of installation.

• All FlexDeploy installations participating in isolated network architecture must be at the same version. At times, even minor releases also introduce database changes, so strict version match is required.

• There will be only one such source server, but there can be one or more such target server.

• Builds are executed on source server and are imported to target server(s). Builds can not be performed on target server.

• Environments, Target Groups, Projects etc. will be configured on the source server. Configuration export will be done for import to target server.

• Topology

  • Target Groups and Environments must be configured on the source server and imported to any target servers.

  • Environments and Property Sets must also be assigned to Target Groups on the source server and imported to target server.

  • Endpoints can be created and assigned to Targets on the target server. Also, property values can be edited for Targets on the target server.

• Projects

  • Projects can not be created or configured on the target server. Projects can only run builds on the source server, which can then be imported to the target server where they can be deployed and tested.

  • Project and folder security is managed separately on source and target servers.

• Release

  • Releases and Snapshots can be created on the target server. However, since build can not be performed on Projects on the target server, these can only be created with existing project versions.

• Pipeline

  • Pipeline must be created on target server as it will handle deployments to different endpoints than source server. Note that source server may be deploying to zero or more environments depending on isolation requirements.

• Integrations

  • Integration Providers can not be created on the target server and will be imported from the source server. Integration Instances can be created on the target server.

• Security

  • All users, groups, and permissions are managed separately on source and target servers.

• Workflows cannot be configured on target server, hence must be imported from source server.

Configuration

The following assumes that you have upgraded to use setenvoverride.sh (or setenvoverride.bat) files. If you are still using setenv.sh, then changes will be slightly different. Configurations shown below must be performed in addition to following the installation document or automated installation process.

Configure source tomcat server will following command line option.

Source environment setenvoverride.sh

FLEXAGON_FD_JAVA_ARGS="-Dflexagon.fd.isolatednw.sourceserver=true"

Configure target tomcat server with following command line option. Target server will have limited capabilities (i.e. no builds can be performed), and it will use different sequences for generated id values.

Target environment setenvoverride.sh

FLEXAGON_FD_JAVA_ARGS="-Dflexagon.fd.isolatednw.targetserver=true"

Execution

• Make sure to configure source environment for Projects, Environments, Target Groups etc. Additionally, map Environments with Target Groups, making sure to include isolated environments managed by target servers only.

• Perform configuration export from source server and import onto target as and when necessary. This export can be done from Administration - Admin Operations page.

• Builds can be exported individually from each workflow execution page or as a group from Release Snapshots page.

• All export files (configuration, build, snapshot etc.) should be placed in fdexports sub-folder on server working directory on target server. Files will be automatically imported and deleted on successful import.

• If you are working with snapshot export and the release does not yet exist on the target server, then the release will be created with the status set to Not Started. This means that snapshot is only partially imported. You must associate a pipeline to that release and then start it. Snapshot import will complete after that automatically.

For more information on utilizing Isolated Networks see here.

Image Removed

Image Added

Note that very strict security restrictions in such configurations require manual copy of files, this is mainly driven by security practices of specific organizations.

Export from Source Server

FlexDeploy allows Configurations, Builds, and Snapshots to be exported. In order for these options to be enabled, FlexDeploy must be configured as an Isolated Network Source Server. See Configuration section above.

Export Configurations

FlexDeploy configurations can be exported which includes the environments, target groups, workflows, and projects of the server. The user must have administrator privileges to download the server configuration. To do this, go to the Administration → Admin Operations screen and change the operation name to Export Configurations, then click the Export button that appears.

Image Removed

Image Added

The configuration export zip contains the configuration for the whole server including the topology (environments, target groups), workflows, and projects.

Once the configurationis exported successfully, it can then be imported to an Isolated Network Target Server.

Export Snapshots

Snapshots can be exported from any release assuming that they were Initiated. To do this, navigate to the Releases screen and click on a release from the folder content.

Image RemovedImage Added

From here, go to the Execution tab, click on the actions menu of a snapshot that was Initiated, and then click Download Archive

Image RemovedImage Added

Info
The snapshot export may take some time depending on the amount of data on the server.

The exported snapshot will contain all of the server’s configuration at the time of the release, as well as any build executions associated with the snapshot for the projects and packages in the release.

Tip

Test automation, triggers, and tags will not be included with project exports and they cannot be reconfigured on the target server. Test and scan results will be exported if they are associated with a build execution, meaning test, utility, and deploy executions will not be exported. Additionally, credentials are also not exported, meaning all cloud accounts and source control management passwords associated with a project will have to be reconfigured on the target server. Project packages and build artifacts will only be exported if the chosen snapshot of a release contains the package.

Once the snapshot is exported successfully, it can then be imported to an Isolated Network Target Server.

Export Builds

Build workflow executions can be exported from any project assuming that they completed successfully. To do this, go to the Execution tab of a project and click on the id of a successful build.

Image RemovedImage Added

On the workflow summary section in the top right corner there is a download button that will export this build:

Image RemovedImage Added

Note
If the downloaded file is instead a .txt with the message “Failed - Needs authorization” (shown below) then log out and into FlexDeploy and try again.

Image RemovedImage Added

The exported build will contain all related execution data, artifacts, and package data associated with the execution. Once the build is exported successfully, it can then be imported to an Isolated Network Target Server.

Note
Note that the project configuration must also exist on the target server in order for the import to be successful. See Export Configurations.

Import on Target Server

First make sure you are connected to a target server. Then you must take an export and put it inside of your fdexports folder. This may be <flexdeploy_home>/application/fdexports depending on how FlexDeploy was installed. To do this, you may use any file transfer tool or method available and approved by your network and security teams.

Image RemovedImage Added

If FlexDeploy is running, it will automatically start the import process shortly and delete the zip file from your fdexports folder once import is completed. This may take a few minutes to get started. This same process can be done with exported builds, snapshots, or configurations.

Snapshots and configurations import may take longer, but builds should be imported fairly quick.

Configurations can be imported many times as configurations change on source server. Import process will handle the import with necessary create, update, delete.

Note
When a new plugin is installed on your source server, make sure to also install it on your target server prior to importing.

Snapshots will not import if there isn’t a pipeline associated with the release on the target server. To solve this problem, go to the releases page and click on the release. In the top left below the releases name, hover over the pipeline symbol and click on the edit pencil, lastly select a pipeline and click the checkbox to save. Then the snapshot will finish importing automatically. For more information on associating a pipeline with a release, see the pipeline and release documentation.