cloud-gov-instructions cicd.instructions.md

Cloud.gov CI/CD Instructions

This document provides guidance for setting up continuous integration and continuous deployment (CI/CD) pipelines for cloud.gov applications.

Overview

Cloud.gov integrates with any CI/CD service. The core requirements are:

1. A service account with deployment credentials
2. The CF CLI installed in your CI/CD environment
3. Secure storage for credentials

Prerequisites

Before setting up CI/CD:

1. Production-ready application - Follow the production-ready guide
2. Version control - Code in Git with a manifest.yml
3. Continuous integration - Tests passing before deployment

Service Account Setup

Create a Service Account

Service accounts provide restricted credentials for automated deployments.

# Create a deployer service account (can push apps)
cf create-service cloud-gov-service-account space-deployer my-deployer

# Or create an auditor account (read-only)
cf create-service cloud-gov-service-account space-auditor my-auditor

Obtain Credentials

# Create a service key
cf create-service-key my-deployer deploy-key

# View the credentials
cf service-key my-deployer deploy-key

Output:

{
  "username": "deadbeef-aabb-1234-feha-0987654321000",
  "password": "oYasdfliaweinasfdliecV"
}

Important Notes

• Password expiration: Service account passwords expire every 90 days
• Rotate credentials: Delete and recreate service keys to rotate
• Least privilege: Service accounts are limited to the space where created
• Not for humans: Never use service accounts for interactive login

Rotate Expired Credentials

cf delete-service-key my-deployer deploy-key
cf create-service-key my-deployer deploy-key
cf service-key my-deployer deploy-key

Pre-Deployment Validation Chain

Run a deterministic validation chain before every deployment. Each step should exit non-zero on failure, blocking subsequent stages. This catches issues early and reduces the risk of deploying broken or insecure code.