Attachment C- DevSecOps Tools and the Delivery Process.pptx

Health Services DevSecOps PWS

Attachment c:

DevSECOps tools AND DELIVERY Process

Overview As part of the VA’s pivot to DevSecOps, many teams are solutioning to determine the best technology for their project specific needs To provide a menu of approved tools for teams to consider, the VA is currently procuring multiple tools to support common functionality This activity is based on user need therefore feedback from project teams informs/drives the procurement activity The tools being made available have varying license capacity, ATO progress, and integration capability Teams need to consider these limitations during their solutioning phase as part of “best fit” criteria

VA’s DevOps Tool Suite Coming Soon Coming Soon

DevSecOps Tools & The Delivery Process

The first tool chain activity is typically identifying a tool for project discovery and solutioning processes

While the VA does not yet have specific tooling available to support this phase, teams should strive to understand user need and capture knowledge iteratively using JIRA or GitHub Issues

DevSecOps Tools & The Delivery Process The second tool chain activity is typically identifying a tool for project planning processes

The VA has provided both GitHub Issues and JIRA for project and requirements management

Team collaboration and automated process control/status functionality is available through either Slack or Teams

The third tool chain activity is typically identifying a tool for feature development

There are many options available to a project when selecting an IDE. The VA TRM should be referenced to determine availability before installing locally

GitHub is the recommended solution for projects seeking a source code repository

The fourth tool chain activity is typically identifying an engine for compiling, testing, and deploying new features to non-Prod environments There are many options available to a project when selecting a build server. Please reference the table below for a feature comparison

The fifth tool chain activity is typically identifying tools that support functional and security testing

There are many options available to a project when selecting testing tools. Teams should consider automated test frameworks like Selenium and Cucumber as well as which levels of automated testing they can support (Functional, Integration, or Unit). If projects are not ready for automated testing, manual test tools like Xray and TestRail are available for use

Automated security solutions are available for both container security using Tenable.io or Twistlock as well as automated code quality reviews using Code.scan or Codacy

The sixth tool chain activity is typically identifying tools that support Continuous Delivery

For deploying new features into a VAEC Production boundary, Jenkins is currently the most secure tool provided by the VA. This is largely based on security and ensuring that any secrets or credentials remain encrypted and stored within the production boundary.

GitHub Packages provide binary storage for deployment ready artifacts, including docker images. Using GitHub Packages provides a 1:1 relationship with the source code repository and provides robust traceability

The last tool chain activity is typically identifying tools that support Performance Monitoring & Alerting

For monitoring and alerting there are both SaaS options like DataDog and Pagerduty, as well as OSS tools including Prometheus and Kibana.

The VA is still in the process of providing data collection tools to support end-user feedback collection but to the extent possible this information should be iteratively collected and used to guide delivery objectives and priorities

Pipeline Stages

DevSecOps Pipeline Stages

Office of Information and Technology There are several automation steps that are recommended as part of a quality DevSecOps pipeline It is understood and expected that the final configuration of a DevSecOps pipeline is somewhat unique to each individual project It is desirable that pipeline configuration be maintained as code This will enable configuration management of build and test scripts As code helps to ensure that VA retains the ability to continue supporting products during/after projects team transitions

DevSecOps Pipeline Stages Office of Information and Technology

The following pipeline components have been developed within the VA and are available for Project teams to leverage

Container Orchestration Tools

DevSecOps Container Orchestration Tools

Office of Information and Technology There are several container orchestration tools being considered by the VA at this time Teams should consider several critical factors such as support, ATO, and cost when selecting an orchestration tool The table below illustrates features available for common containerization tools

How to request access to DOTS Tools

DOTS Service Desk

Office of Information and Technology

Interested in CI/CD Tools or DevSecOps in a Box?

Check out DOTS training recordings posted to the #engineering Slack channel in the VA OIT DevOps workspace Submit a request through the DevOps Tool Suite Service Desk under the Tools Support tab: https://vajira.max.gov/servicedesk/customer/portal/1 DevSecOps in a Box Jenkins Codacy DataDog

DOTS DevSecOps in a Box offering. Learn how you can work with the DOTS team to quickly incorporate CI/CD into your product team's daily operations with powerful DevSecOps tools like Jenkins, Twistlock, Codacy and Fortify.

CircleCI TwistLock – THIS WEEK!

If your team is interested in learning more, reach out to the DOTS team via the DOTS Service Desk and Select DevSecOps in a Box from the tool list menu!

Interested in getting started with Jira/Confluence?

Check out DOTS training recordings posted to the #jira_information Slack channel in the VA OIT DevOps workspace Submit a request through the DevOps Tool Suite Service Desk under the Jira Support tab: https://vajira.max.gov/servicedesk/customer/portal/1 Request a new Jira project and Confluence page for your product Request user access to an existing Jira project or Confluence page Request Jira support or troubleshooting Importing csv into Jira Sprint Planning Roles and Permissions Xray image3.png image4.png image5.png image6.png image8.png image9.png image10.png image11.png image12.png image13.png image14.png image15.png image16.png image17.png image7.png image18.png image19.png image20.png image21.png image1.png image2.png