Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

Chapter 5. Promoting a build

The OpenShift GitOps Operator uses Argo CD to enable continuous deployment by using your git repository as a single source of truth for infrastructure configurations. When you update your git repository, Argo CD deploys the application update across development, staging, and production environments.

Note

The promotion procedures provide an example deployment workflow. Customize it to fit your organization’s requirements.

Promote a build by updating your git repository.

Procedure

  1. In Red Hat Developer Hub (RHDH), select Catalog.
  2. From the Kind drop-down list, select Resource, and then select a git repository.
  3. Open the Overview tab and select View Source to access the repository.

  4. (Optional) Alternatively, select Catalog, open the Overview tab, and select View TechDocs.

    1. In the Home > Repository section, select the git repository.

  5. Clone your git repository.

    Note

    Ensure that the local clone is up-to-date.

  6. Create a new branch.
  7. Navigate to the component/<app_name>/overlays directory, which contains subdirectories for development, stage, and prod.

  8. Follow the steps in the table to promote the application:

    Expand
    To move your applicationDo this

    From development to stage environment

    1. Open the development/deployment-patch.yaml file and copy the container image URL (for example, quay.io/<username>/imageName:imageHash).
    2. Open the stage/deployment-patch.yaml file and replace the container image URL with the one you copied.
    Note

    To include additional configuration changes (for example, replicas), copy them from the development/deployment-patch.yaml file to the stage/deployment-patch.yaml file.

    From stage to production environment

    1. Open the stage/deployment-patch.yaml file and copy the containers image URL (for example, quay.io/<username>/imageName:imageHash).
    2. Open the prod/deployment-patch.yaml file and replace the container image URL with the one you copied.
    Note

    To include additional configuration changes (for example, replicas), copy them from the stage/deployment-patch.yaml file to the prod/deployment-patch.yaml file.

  9. Commit and push your updates.

  10. Create a pull request (PR) to start a promotion pipeline. The pipeline validates the changes against Conforma policies.

    1. Check the pipeline run in the CI tab of RHDH.
  11. Merge the PR to trigger Argo CD, which applies the changes and promotes the build to the next environment.

Verification

  • Use the Topology tab in RHDH to confirm the application distribution across namespaces.
  • Use the CD tab to view deployment details, including the status, updates, commit message (for example, "Promote stage to prod"), and container image changes.

5.1. About Conforma compliance
リンクのコピー

Conforma is a suite of tools designed to maintain software supply chain security. It helps maintain the integrity of container images by verifying that they meet defined requirements before promoting them to production. If an image does not comply with the set policies, Conforma generates a report identifying the issues that must be resolved.

The promotion pipeline includes several tasks to ensure secure and compliant deployments:

  • git-clone: Clones the repository into the workspace using the git-clone task.
  • gather-deploy-images: Extracts the container images from deployment YAML files for validation.
  • verify-enterprise-contract: Validates the container images using Conforma policies and Sigstore’s cosign tool.
  • deploy-images: Deploys images to the target environment.
  • download-sbom-from-url-in-attestations: Retrieves software bill of materials (SBOMs) for images by downloading OCI blobs referenced in image attestations.
  • upload-sbom-to-trustification: Uploads SBOMs to Trustification using the BOMbastic API.

The Red Hat Advanced Developer Suite - software supply chain build process generates a signed in-toto attestation of the build pipeline, which cryptographically verifies the build’s integrity. Conforma then evaluates the build against defined policies, ensuring it complies with the organizational security standards.

The insights from Conforma compliance reports help prioritize security and compliance tasks:

  • Review policy compliance: Confirm that your application meets standards such as Supply Chain Levels for Software Artifacts (SLSA). Address any compliance gaps based on the recommendations in the report.
  • Streamline review: Use filters in the reports to focus on critical issues, enabling a faster and more efficient review process.

Conforma compliance reports provide detailed insights into application security and adherence to policies:

  • Policy compliance overview: Displays the checks performed, their status, (success, warning, or failure), and messages explaining warnings or failures.

  • Details provided: Policy reports detail:

    • Successful checks: Lists the policies that passed validation.
    • Warnings and failures: Highlights policies that triggered warnings or failed checks, with explanations.
    • Rule compliance: Shows how the application adheres to individual policy rules, such as source code references or attestation validations.

5.2. Viewing Conforma compliance reports
リンクのコピー

The Pipeline Runs section, located under the CI tab in Red Hat Developer Hub, displays detailed compliance reports in a structured pop-up interface.

Procedure

  • Follow the steps that correspond to your CI provider:

    Expand
    CI ProviderStepsReport Display

    Tekton (default CI provider)

    1. Select Catalog and select the component you want to review.
    2. Select the CI tab, and in the Actions column, select the View output icon.

    The report displays in a structured pop-up interface.

    Other CI providers (for example, Jenkins or GitLab)

    1. Navigate to the application’s build logs.
    2. Search for the text Step: verify-enterprise-contract.

    The report is displayed in the build logs.

    Figure 5.1. The Conforma report (Tekton example)

    The Conforma report (Tekton example)
    View larger image
    The Conforma report (Tekton example)

Revised on 2026-02-04 23:24:05 UTC

Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る