Hybrid cloud banking application deployment best practices for IBM Cloud and Satellite security and compliance
Financial services clients want to update their apps. Modernizing code development and maintenance (helping with scarce skills and allowing innovation and new technologies required by end users) and improving deployment and operations with agile and DevSecOps are examples.
Clients want flexibility to choose the best “fit for purpose” deployment location for their applications during modernization. This can happen in any Hybrid Cloud environment (on premises, private cloud, public cloud, or edge). IBM Cloud Satellite meets this need by letting modern, cloud-native applications run anywhere the client wants while maintaining a consistent control plane for hybrid cloud application administration.
In addition, many financial services applications support regulated workloads that require strict security and compliance, including Zero Trust protection. IBM Cloud for Financial Services meets that need by providing an end-to-end security and compliance framework for hybrid cloud application implementation and modernization.
This paper shows how to deploy a banking application on IBM Cloud for Financial Services and Satellite using automated CI/CD/CC pipelines consistently. This requires strict security and compliance throughout build and deployment.
Introduction to ideas and products
Financial services companies use IBM Cloud for Financial Services for security and compliance. It uses industry standards like NIST 800-53 and the expertise of over 100 Financial Services Cloud Council clients. It provides a control framework that can be easily implemented using Reference Architectures, Validated Cloud Services, ISVs, and the highest encryption and CC across the hybrid cloud.
True hybrid cloud experience with IBM Cloud Satellite. Satellite lets workloads run anywhere securely. One pane of glass lets you see all resources on one dashboard. They have developed robust DevSecOps toolchains to build applications, deploy them to satellite locations securely and consistently, and monitor the environment using best practices.
This project used a Kubernetes– and microservices-modernized loan origination application. The bank application uses a BIAN-based ecosystem of partner applications to provide this service.
Application overview
The BIAN Coreless 2.0 loan origination application was used in this project. A customer gets a personalized loan through a secure bank online channel. A BIAN-based ecosystem of partner applications runs on IBM Cloud for Financial Services.
BIAN Coreless Initiative lets financial institutions choose the best partners to quickly launch new services using BIAN architectures. Each BIAN Service Domain component is a microservice deployed on an IBM Cloud OCP cluster.
BIAN Service Domain-based App Components
Product Directory: Complete list of bank products and services.
Consumer Loan: Fulfills consumer loans. This includes loan facility setup and scheduled and ad-hoc product processing.
Customer Offer Process/API: Manages new and existing customer product offers.
Party Routing Profile: This small profile of key indicators is used during customer interactions to help route, service, and fulfill products/services.
Process overview of deployment
An agile DevSecOps workflow completed hybrid cloud deployments. DevSecOps workflows emphasize frequent, reliable software delivery. DevOps teams can write code, integrate it, run tests, deliver releases, and deploy changes collaboratively and in real time while maintaining security and compliance using the iterative methodology.
A secure landing zone cluster deployed IBM Cloud for Financial Services, and policy as code automates infrastructure deployment. Applications have many parts. On a RedHat OpenShift Cluster, each component had its own CI, CD, and CC pipeline. Satellite deployment required reusing CI/CC pipelines and creating a CD pipeline.
Continuous integration
IBM Cloud components had separate CI pipelines. CI toolchains recommend procedures and approaches. A static code scanner checks the application repository for secrets in the source code and vulnerable packages used as dependencies. For each Git commit, a container image is created and tagged with the build number, timestamp, and commit ID. This system tags images for traceability. Before creating the image, Dockerfile is tested. A private image registry stores the created image.
The target cluster deployment’s access privileges are automatically configured using revokeable API tokens. The container image is scanned for vulnerabilities. A Docker signature is applied after completion. Adding an image tag updates the deployment record immediately. A cluster’s explicit namespace isolates deployments. Any code merged into the specified Git branch for Kubernetes deployment is automatically constructed, verified, and implemented.
An inventory repository stores docker image details, as explained in this blog’s Continuous Deployment section. Even during pipeline runs, evidence is collected. This evidence shows toolchain tasks like vulnerability scans and unit tests. This evidence is stored in a git repository and a cloud object storage bucket for auditing.
They reused the IBM Cloud CI toolchains for the Satellite deployment. Rebuilding CI pipelines for the new deployment was unnecessary because the application remained unchanged.
Continuous deployment
The inventory is the source of truth for what artifacts are deployed in what environment/region. Git branches represent environments, and a GitOps-based promotion pipeline updates environments. The inventory previously hosted deployment files, which are YAML Kubernetes resource files that describe each component. These deployment files would contain the correct namespace descriptors and the latest Docker image for each component.
This method was difficult for several reasons. For applications, changing so many image tag values and namespaces with YAML replacement tools like YQ was crude and complicated. Satellite uses direct upload, with each YAML file counted as a “version”. A version for the entire application, not just one component or microservice, is preferred.
Thet switched to a Helm chart deployment process because they wanted a change. Namespaces and image tags could be parametrized and injected at deployment time. Using these variables simplifies YAML file parsing for a given value. Helm charts were created separately and stored in the same container registry as BIAN images. They are creating a CI pipeline to lint, package, sign, and store helm charts for verification at deployment time. To create the chart, these steps are done manually.
Helm charts work best with a direct connection to a Kubernetes or OpenShift cluster, which Satellite cannot provide. To fix this, That use the “helm template” to format the chart and pass the YAML file to the Satellite upload function. This function creates an application YAML configuration version using the IBM Cloud Satellite CLI. They can’t use Helm’s helpful features like rolling back chart versions or testing the application’s functionality.
Constant Compliance
The CC pipeline helps scan deployed artifacts and repositories continuously. This is useful for finding newly reported vulnerabilities discovered after application deployment. Snyk and the CVE Program track new vulnerabilities using their latest definitions. To find secrets in application source code and vulnerabilities in application dependencies, the CC toolchain runs a static code scanner on application repositories at user-defined intervals.
The pipeline checks container images for vulnerabilities. Due dates are assigned to incident issues found during scans or updates. At the end of each run, IBM Cloud Object Storage stores scan summary evidence.
DevOps Insights helps track issues and application security. This tool includes metrics from previous toolchain runs for continuous integration, deployment, and compliance. Any scan or test result is uploaded to that system, so you can track your security progression.
For highly regulated industries like financial services that want to protect customer and application data, cloud CC is crucial. This process used to be difficult and manual, putting organizations at risk. However, IBM Cloud Security and Compliance Center can add daily, automatic compliance checks to your development lifecycle to reduce this risk. These checks include DevSecOps toolchain security and compliance assessments.
IBM developed best practices to help teams implement hybrid cloud solutions for IBM Cloud for Financial Services and IBM Cloud Satellite based on this project and others:
Continuous Integration
Share scripts for similar applications in different toolchains. These instructions determine your CI toolchain’s behavior. NodeJS applications have a similar build process, so keeping a scripting library in a separate repository that toolchains can use makes sense. This ensures CI consistency, reuse, and maintainability.
Using triggers, CI toolchains can be reused for similar applications by specifying the application to be built, where the code is, and other customizations.
Continuous deployment
Multi-component applications should use a single inventory and deployment toolchain to deploy all components. This reduces repetition. Kubernetes YAML deployment files use the same deployment mechanism, so it’s more logical to iterate over each rather than maintain multiple CD toolchains that do the same thing. Maintainability has improved, and application deployment is easier. You can still deploy microservices using triggers.
Use Helm charts for complex multi-component applications. The BIAN project used Helm to simplify deployment. Kubernetes files are written in YAML, making bash-based text parsers difficult if multiple values need to be customized at deployment. Helm simplifies this with variables, which improve value substitution. Helm also offers whole-application versioning, chart versioning, registry storage of deployment configuration, and failure rollback. Satellite configuration versioning handles rollback issues on Satellite-specific deployments.
Constant Compliance
IBM strongly recommend installing CC toolchains in your infrastructure to scan code and artifacts for newly exposed vulnerabilities. Nightly scans or other schedules depending on your application and security needs are typical. Use DevOps Insights to track issues and application security.
They also recommend automating security with the Security and Compliance Center (SCC). The pipelines’ evidence summary can be uploaded to the SCC, where each entry is treated as a “fact” about a toolchain task like a vulnerability scan, unit test, or others. To ensure toolchain best practices are followed, the SCC will validate the evidence.
Inventory
With continuous deployment, it’s best to store microservice details and Kubernetes deployment files in a single application inventory. This creates a single source of truth for deployment status; maintaining environments across multiple inventory repositories can quickly become cumbersome.
Evidence
Evidence repositories should be treated differently than inventories. One evidence repository per component is best because combining them can make managing the evidence overwhelming. Finding specific evidence in a component-specific repository is much easier. A single deployment toolchain-sourced evidence locker is acceptable for deployment.
Cloud object storage buckets and the default git repository are recommended for evidence storage. Because COS buckets can be configured to be immutable, They can securely store evidence without tampering, which is crucial for audit trails.
[…] IBM Deployment lifecycle […]