Skip to main content

3. Lab Preparation

3.1: Overview​

Make sure to complete the Lab preparation steps from this section before proceeding with the Lab.

warning

You may get prompted for software updates during the lab. Please ignore these prompts and do NOT install any updates to avoid disrupting the lab environment.

If you get a security warning (Warning: Potential Security Risk Ahead) when accessing the Concert, Apache Tomcat UIs, please ignore it and proceed to the UI (click on Advanced and then Accept the Risk and Continue).

3.1.1: Using SSH from the Bastion Host​

You can connect from the Bastion host to other VMs using the jammer user with the SSH commands as shown below. This is for information only. You don't need to run these commands now.

Host: bastion-gym-lan
# Access the Concert VM
ssh jammer@concert
# Access the CFSSL VM
ssh jammer@bluebox
# Access the Apache Tomcat VM
ssh jammer@demo-apps

3.1.2: Capturing the Lab Credentials​

You will need to capture multiple pieces of information from the Concert and Apache Tomcat UIs to complete the lab. To facilitate this process, we will capture this information into a single text file. From the Bastion Remote Desktop, on the left panel click on Show Applications, select Text Editor, paste the content below into a new file named credentials.txt and save it. Keep this window open for easy access later.

Bookmarks:
  Lab guide:        https://ibm.github.io/waiops-tech-jam/labs/concert/introduction/
  Concert:          https://concert.ibmdte.local:12443
  Apache Tomcat:    https://demo-apps.ibmdte.local:8443/


Concert URL:        https://concert.ibmdte.local:12443
Concert API Key:    
concert_username:   ibmconcert
concert_password:   Passw0rd 

Apache Tomcat URL:                   https://demo-apps.ibmdte.local:8443
Java Keystore Password:              tomcat

GitHub Repository URL:               https://github.com/<github-username>/concert-operations-lab
GitHub Repository Name:              concert-operations-lab
GitHub API Endpoint:                 https://api.github.com/  
GitHub Username:                     
GitHub Personal Access Token (PAT):  

########################################

demo-apps IP address:
Private Key value for "jammer" user on demo-apps VM (copy the value BELOW this line)



########################################

bluebox IP address:
Private Key value for "jammer" user on bluebox VM (copy the value BELOW this line)




3.2 Login into IBM Concert for the First Time​

From the Bastion Remote Desktop, open the Firefox browser and click on the Concert bookmark to launch the Concert UI.

Login to the Concert UI using the credentials from your credentials file:

  • concert_username
  • concert_password

On the Concert welcome page, select the Resilience option on the right and select Skip in the next page:

danger

Again, make sure to choose Skip in the next page to bypass the setup wizard.

3.3: Obtaining the IBM Concert API Key​

  • In the Concert UI, on the top right corner, click on the API Key icon.
  • Click Generate API key.
  • After the API key is generated, save the value under API key into the credentials file.
  • Click on the X to close the window.

3.4: Configuring GitHub​

You will need a GitHub account to complete the lab. If you do not have one, please create one at GitHub.

3.4.1: Creating new GitHub repository​

You will need to create a new repository for your GitHub account. We will use this repository to demonstrate a Change Management process created by the Concert Automation Rules.

  • Login to your GitHub account and open the following repository URL on the browser
https://github.com/<github-username>
  • On the Repository menu option, click on the New button to create a new repository in your GitHub account.
  • Enter concert-operations-lab as the name for your new repository.
  • You can skip the description for the repository.
  • Click on the Create repository button to create the new repository.

  • Copy the URL of your new repository and save it into the credentials file after GitHub Repository URL. You will need it later to configure GitHub connection from Concert. The URL should look similar to:
https://github.com/<github-username>/concert-operations-lab

3.4.2: Enabling GitHub issues​

You will enable GitHub issues in your new repository to allow Concert to create issues for the expiring and expired Certificates.

  • In your new repository, click on the Settings tab.
  • Under the General section, scroll down to the Features section and select the checkbox for Issues (if not already enabled) as shown below:

3.4.3: Creating GitHub labels​

You will create 2 new labels for GitHub issues in your new repository to allow Concert Workflows to handle renewal for the expiring and expired Certificates.

  • In your new repository, click on the Issues tab.
  • From the Issues page, click the Labels tab down the left side.
  • Click New label green button on the top right.

First, create approved label with the following values :

  • Assign Name : approved
  • Assign Description : approved
  • Assign Color : #0e8a16
  • Click Create label button

3.4.4: Creating a Personal Access Token (PAT)​

You will create a Personal Access Token (PAT) in GitHub to allow Concert to connect to your new repository and create issues for the expiring and expired Certificates

  • In your GitHub account, click on your profile picture on the top right corner of the page and select Settings.
  • In the left navigation menu, scroll all way down and click Developer settings.
  • In the left navigation menu, click Personal access tokens > Tokens (classic).
  • Click Generate new token > Generate new token (classic).
  • Under Note, enter a name for your token, such as concert-lab.
  • Under Expiration, select 90 days.
  • Select the following scopes:
    • repo (Full control of private repositories)
    • write:packages (to push/pull images)
    • delete:packages (to delete images)
    • user (Update ALL user data)
  • Click Generate token on the bottom.
  • Copy the generated token into the credentials file after GitHub Personal Access Token (PAT). You will need it later to configure GitHub Authentication in Concert Workflows.
warning

Make sure to save the credentials file!. Keep the window open for easy access during the Lab.

3.5: Creating a target environment in Concert​

An environment in Concert groups related applications and inventory data. We will define a new environment to capture certificates coming from Apache Tomcat.

  • In the Concert UI, click on the top Resilience tab.
  • On the left side menu, select Inventory > Environment inventory.
  • Click Define environment > From resources.
  • Enter development as the Name for the environment.
  • Select the Purpose of this environment as Development.
  • Click the Create button.

3.6: Creating GitHub connection from Concert​

You will use the personal access token that you created previously to configure a GitHub Connection. Concert will leverage this connection to create GitHub issues for the expiring and expired Certificates in the Concert defined environment.

  • In the Concert UI, click on the top Resilience tab.
  • On the left side menu, select Administration > Integrations.
  • Select the Connections tab.
  • Click on Create connection.
  • Search for GitHub and click on the GitHub tile.
  • Enter a unique Name for the connection such as github-connection.
  • Skip the Description field.
  • Under Parameters, provide the following details:
    • Host: https://api.github.com/
    • Personal Access Token: the GitHub Personal Access Token (PAT) you created during the previous step.
  • Click on Validate connection to verify the connection is successful.
  • Click the Create button.

3.7: Creating Automation Rules in Concert​

Concert reports all Certificates present in an Environment and classifies them into four categories such as Valid Certificates, Expired Certificates, Certificates Expiring Soon and Certificates with Open Ticket. Using automation rules, we will automate the issue/ticket creation in GitHub to quickly address expiring and expired Certificates impacting an Environment. Note that Concert can also integrate with other ticketing systems such as Jira, Salesforce, ServiceNow, etc.

note

In addition to automation rules, Concert can leverage ingestion jobs to pull data from external issue tracking systems in order to automatically update ticket status. This configuration is out of scope for this lab.

  • From the same Administration > Integrations page you are now, select the Automation rules tab.
  • Click the Create automation rule button on the right.

  • Enter a Name for the automation rule such as github-issue-cert-mgmt.

  • Skip the Description for the automation rule.

  • Under Trigger type:

    • Select An expiring or expired certificate is detected.
    • For Environment, select development from the list. development is the Concert environment which all Certificates will be discovered.

  • Under Conditions:

    • For Time until certificate expiration, select 7 days from the drop down list. This is the only condition that will trigger the issue creation.

  • Under Action type:

    • Select Open a GitHub issue
    • In Target organization type your GitHub username.
    • In Target repository type concert-operations-lab.
    • Skip the Labels field.
    • In Connection, select the GitHub connection created during the previous step.
    • Skip the Assignees field.

Your configuration should look similar to the screenshot below. Your github name will be different:

  • Click Create to create the automation rule.

After the rule is created, it will appear in the list of automation rules. Click on the twistie before the rule name to expand the section and see more details. Review the conditions that will trigger the issue creation.

3.8: Installing the Workflows​

You will download custom Workflows from a public Box folder and save them on the Bastion local disk. Later you will upload them to Concert Workflows.

From the Bastion Remote Desktop, open a new tab in the Firefox browser.

  • Open the link https://ibm.box.com/v/certificate-lab

  • In the Box folder, you will find three Workflows :

    • Linux_Keystore_Cert_Discovery.zip
    • Linux_Keystore_Cert_Renewal.zip

  • Download the two Workflows and save them on Bastion's Downloads folder.

Next, you will create two new Folders in Concert Workflows.

  • Click on the Workflows tab on the top and select the Workflows tile.
  • Click on the three vertical dots on the top right corner and select Create folder

  • Enter a name for the folder such as certificatesDiscovery
  • Enter a description for the folder such as Folder for Certificates Discovery and click on Create button.

Now, one more time:

  • Click on the three vertical dots on the top right corner and select Create folder
  • Enter a name for the folder such as certificatesRenewal
  • Enter a description for the folder such as Folder for Certificates Renewal and click on Create button.

At this stage, you will have 2 new Folders created Concert Workflows.

Finally, you will import the Workflows from Bastion's Downloads folder:

  • Click on certificatesDiscovery folder in Concert Workflows
  • Click on Import button in Concert Workflows, navigate to Bastion's Downloads folder, choose Linux_Keystore_Cert_Discovery.zip and click Open button to complete the Import

  • At this stage, you will have Linux_Keystore_Cert_Discovery workflow imported to certificatesDiscovery folder

Next, you will upload Linux_Keystore_Cert_Renewal workflow imported to certificatesRenewal folder.

  • Go up one level to the main folder in Concert Workflows by clicking on User.
  • Click on certificatesRenewal folder in Concert Workflows
  • Click on Import button in Concert Workflows, navigate to Bastion's Downloads folder, choose Linux_Keystore_Cert_Renewal.zip and click Open button to complete the Import

  • At this stage, you will have Linux_Keystore_Cert_Renewal workflow imported to certificatesRenewal folder

Now, you have the two Workflows uploaded to specific folders in Concert Workflows. In the next section, you will configure the Workflows and execute them.

3.9: Summary​

So far you have been able to accomplish the following:

  1. Have enabled GitHub issues and created new labels.
  2. Have created a GitHub connection from Concert.
  3. Have created one Automation Rule in Concert.
  4. Have uploaded new Workflows in Concert Workflows.

Please continue to the next section of the lab.