[RAG stack] Pipeline missing configuration for Cloud Object Storage Evidence Locker

[ocofaigh]

The following is seen in the code-ci-start stage of the CI pipeline:

Pipeline missing configuration for Cloud Object Storage Evidence Locker
Configure Cloud Object Storage as Evidence Locker in the pipeline
>
After reviewing your pipeline properties, we noticed that the Cloud Object Storage (COS) bucket is not set up as the evidence locker in your pipeline. To ensure optimal performance, we intend to make the COS Evidence Locker mandatory in the future.
>
https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cos-bucket-evidence

Due to this, the stage is marked as a failure:

[ocofaigh]

FYI, this is the error seen now:

4 Dec, 13:08:06 ===================================================================================================================================
4 Dec, 13:08:06 
4 Dec, 13:08:06 notice  Deprecation of Git Evidence Locker
4 Dec, 13:08:06 notice  The pipeline is configured with the Git-based evidence locker. Users are advised to migrate to the COS-based evidence locker as support for Git evidence locker will be discontinued.
4 Dec, 13:08:06 notice  Current evidence locker: https://us-south.git.cloud.ibm.com/OCOFAIGH/dev-9rmy-evidence-repo.git
4 Dec, 13:08:06 notice  No COS evidence locker found in your pipeline configuration.
4 Dec, 13:08:06 notice  Reference: Getting started with IBM Cloud Object Storage
4 Dec, 13:08:06 notice  Link: https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage
4 Dec, 13:08:06 
4 Dec, 13:08:06 ===================================================================================================================================

Have reached out to ALM team to see if there is a DA input we can set for this, or if we need to explicitly set an environment property

[ocofaigh]

I have what I need from ALM team - Ill update in my PR

[ocofaigh]

@imprateeksh The first step we need to take here is to add support in https://github.com/terraform-ibm-modules/terraform-ibm-rag-sample-da/blob/main/solutions/banking/main.tf to create:

• COS bucket in an existing COS instance (add a new input called existing_evidence_cos_instance_crn). I guess we can also support creating a new COS instance if existing instance is not passed, but in the stack we will re-use the existing instance the stack is already creating. COS is now required for evidence locker.
  • NOTE: This DA already supports creating COS instance, however thats for watsonx.ai and should not be re-used for evidence locker.
• If user passes a value for cos_kms_crn, use it to create a kms key for the cos bucket. Or if they pass a key using cos_kms_key_crn use that instead.
• add the following environment properties for BOTH CI and CD pipelines using the ibm_cd_tekton_pipeline_property resource:
  • cos-bucket-name
  • cos-endpoint

I will update the stack to pass the cos-api-key to ALM since we will use the cos_api_key_secret_name DA input for that