Integrating with the JFrog build artifactory

Builds that are initiated through a CI/CD pipeline generate snapshots of deployable artifacts that must be uniquely labeled and stored in a build repository, from where they can be automatically and securely deployed to various target environments. Business Automation Workflow integrates with the JFrog build artifactory that stores and manages build artifacts, binaries, packages and files, which you can use to trigger an automated and secure continuous integration and continuous delivery (CI/CD) pipeline hosted in your preferred CI/CD tool.

When a new snapshot of your workflow project is created, the snapshot installation package, along with the dependent toolkits, is pushed to a folder in the preconfigured JFrog binary repository. The package is stored in a .zip format and can be used to trigger the CI/CD pipeline. To push the snapshot package to the JFrog binary repository, you can use any of the following methods:

The Push to binary repository snapshot menu action.
A toggle selection in the snapshot creation dialog, to push the snapshot to the binary artifactory when the snapshot is created.
The ‘bin_repo_sync’ Swagger API that is available under /ops/docs

Before you begin

Ensure that your environment can access the configured JFrog binary repository by using a network policy to open the external access.

Procedure

Complete the following configuration to push the version package to your JFrog binary repository.

For workflow authoring and Workflow Process Service authoring:

Create a custom.xml configuration file for the authentication alias, which has your JFrog user name and access token.

<?xml version="1.0" encoding="UTF-8"?>
<server>
   <authData id=" JFrog-J2C-Auth-Alias-Name " user="your_user_name" password="your_access_token"/>
</server>

Create a secret using your custom.xml:

kubectl create secret generic your-custom-secret-name --from-file=sensitiveCustom.xml=./custom.xml

Add the following configuration to your custom resource (CR) file:

bastudio_configuration:
    bastudio_custom_xml: |+
     <properties>
       <server>
           <build-artifactory-configuration  merge="mergeChildren">
              <build-artifactory-implementation>jfrog</build-artifactory-implementation>
              <build-artifactory-url>https://myartifactorycloud.jfrog.io/artifactory</build-artifactory-url>
              <build-artifactory-repo-name> my-repo-name </build-artifactory-repo-name>
              <build-artifactory-auth-alias-name>JFrog-J2C-Auth-Alias-Name</build-artifactory-auth-alias-name>
              <build-artifactory-package-type> [ivy|maven] </build-artifactory-package-type>
              <build-artifactory-group-id>my-group-id</build-artifactory-group-id>
           </build-artifactory-configuration>
       </server>
     </properties>
custom_secret_name: your-custom-secret-name

where <build-artifactory-url> is the REST API URL of your JFrog binary repository.

If SSL is enabled for JFrog, import the JFrog TLS certificate into Cloud Pak for Business Automation, and update your CR file.
```
oc create secret generic jfrog-ssl-secret --from-file=tls.crt=/root/jfrogSSL.cert

bastudio_configuration:
    tls:
      tlsTrustList: [jfrog-ssl-secret]
```
This step is not needed if the JFrog website is signed with a well known certificate authority (CA).
If you have applied network policies to your deployment to have restricted internet access, you must create a network policy to ensure that the workflow authoring server can access the external JFrog binary artifactory server. Create a network policy to allow the workflow authoring server to connect to the JFrog binary artifactory server by using the JFrog port. Apply the network policy as follows:
```
apiVersion: networking.k8s.io/v1

kind: NetworkPolicy
metadata:
  name: "bas-allow-jfrog"
spec:
  podSelector:
    matchLabels:
      com.ibm.cp4a.networking/egress-external-app-component: 'BAS'
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr:  # IP address your jfrog binary repository server. 
  - ports:
    - protocol: TCP
port: # Port of your jfrog binary repository server.
```
Wait for the operator to finish reconciling.
Verify the configuration:
1. In the bastudio pod, check /opt/ibm/wlp/usr/servers/defaultServer/TeamWorksConfiguration.running.xml to see that <build-artifactory-url>, <build-artifactory-auth-alias-name>, <build-artifactory-repo-name>, <build-artifactory-package-type>, and <build-artifactory-group-id> are merged into the file.
2. Also, check that the /opt/ibm/wlp/usr/shared/resources/sensitive-custom/sensitiveCustom1.xml file exists and has the <authData> of your JFrog user and token.