Getting Started for System Administrators
System administrators own the parts of Digital.ai Release SaaS that sit in your own infrastructure and identity estate. This guide covers what Digital.ai manages for you, how to set up user authentication through the Digital.ai Platform, how to deploy and register your own Release Runners, and how to connect Release to your secrets management and security scanning tools.
Release SaaS is hosted and managed by Digital.ai. There is no server to install, no database to configure, and no upgrade to schedule. For the division of responsibilities, see What Digital.ai Manages.
Who This Guide Is For
This guide is for users who:
- Set up user authentication and identity provider integration for Release through the Digital.ai Platform.
- Issue and manage personal access tokens for API and CLI access.
- Deploy and register Release Runners in their own Docker or Kubernetes environments.
- Integrate Release with secrets management systems, such as HashiCorp Vault, CyberArk Conjur, AWS Secrets Manager, and Azure Key Vault.
- Integrate Release with security scanning and policy enforcement tools, such as Checkmarx, Black Duck, Fortify, and OPA.
- Plan the network access that Release SaaS needs to reach your internal tools.
For application-level administration, such as roles, permissions, and system settings, see Getting Started for Release Administrators.
For configuring CI/CD pipeline integrations and automated task plugins, see Getting Started for DevOps and Pipeline Engineers.
What Digital.ai Manages
In Release SaaS, Digital.ai operates the platform and takes on the tasks that a system administrator performs for an on-premises installation:
| Area | Owned by |
|---|---|
| Server installation and upgrades | Digital.ai |
| Database provisioning, backup, and high availability | Digital.ai |
| Certificates, server hardening, and HTTP security | Digital.ai |
| Plugin installation and upgrades | Digital.ai |
| Licensing | Digital.ai |
| Outbound mail service for notifications | Digital.ai |
| Monitoring, logging, and maintenance windows | Digital.ai |
| Identity provider configuration and user group membership | You, in the Digital.ai Platform |
| Release Runners in your own network | You |
| Credentials and endpoints for your external tools | You |
Each customer receives a dedicated instance. For the full description of the offering, see Release SaaS. For planned maintenance and version changes, see the Release Notes.
Setting Up User Authentication
Release SaaS authenticates users through the Digital.ai Platform. You connect your identity provider once in the Platform, and user identity and group membership synchronize into Release.
- Connect your identity provider in the Platform. See Manage Identity Providers.
- Create users, or let them be provisioned from your identity provider. See Manage Users.
- Assign each user to one of the preconfigured Release user groups, Release Admin, Release Editor, or Release Read Only. The matching global permissions apply in Release automatically. See User Group Permissions.
For how Release integrates with the Digital.ai Platform, see Set up Digital.ai Platform Authentication.
Personal Access Tokens
Users can generate a personal access token to authenticate to the REST API and the XL CLI without using login credentials. Use tokens for automation and service accounts rather than sharing user passwords. See Personal Access Token for Authentication.
Deploying Release Runner
Release Runner executes container-based plugin tasks. It runs in your infrastructure, separately from the Release server, and connects outbound to Release over TLS 1.2 or higher.
Digital.ai provides and manages a cloud runner, so container-based plugin tasks work without any setup. Deploy your own runner when task execution must reach infrastructure that is not accessible from the Release SaaS environment, such as a cluster inside a VPC or behind a firewall.
Because the runner connects outbound, Release does not need inbound access to your network. For an overview of what Release Runner does and how it works, see Overview of Release Runner and Lifecycle of Release Runner.
Runner on Docker
Create a runner authentication token in Release under Settings > Release Runners, then start the container with your Release SaaS URL and that token. See Run Release Runner with Docker.
Runner on Kubernetes
Install the runner with the xl kube install command from the XL CLI.
Runner Configuration
- Configure and Register Release Runners
- Configuration Parameters for Release Runner
- Runner Configuration Templates
- Configure Release Runner Registry Settings
- Set Up Custom Image Registry
Runner Troubleshooting
See Troubleshooting Release Runner.
Security and Compliance Integrations
The plugins in this section extend Release with secrets management, policy enforcement, and security scanning. Digital.ai installs and maintains them in your instance, so your work is limited to configuring the connection to your own systems.
Secrets Management
Secrets management plugins retrieve credentials from an external vault at runtime, so secrets are not stored as plaintext variables.
HashiCorp Vault
- HashiCorp Vault Plugin configures a connection to a HashiCorp Vault server and retrieves secrets from Vault as automated tasks in a release pipeline.
CyberArk Conjur
- Conjur Plugin retrieves a secret from a Conjur server and populates a release variable for use in subsequent tasks.
AWS Secrets Manager
The AWS Secrets Manager Plugin retrieves secrets from AWS Secrets Manager for use in release pipeline tasks.
Azure Key Vault
The Azure Key Vault Integration retrieves secrets from Azure Key Vault for use in release pipeline tasks.
Your vault must be reachable from the Release SaaS environment, or from a Release Runner that you run inside the network where the vault lives.
Policy Enforcement
Open Policy Agent (OPA) - The OPA Integration connects Release to an OPA server. It evaluates inputs against policies written in REGO, allowing you to enforce deployment gates and compliance checks as automated tasks in a release pipeline. For an end-to-end setup example, see Application Security Using OPA.
Security and Code Quality Scanning
Security and code quality plugins run scans as automated tasks in a release pipeline and can gate progression on scan results.
| Plugin | Tool | Guide |
|---|---|---|
| Checkmarx Plugin | Checkmarx | Checkmarx Plugin |
| Black Duck Plugin | Black Duck | Black Duck Plugin |
| Fortify SSC Plugin | Fortify Static Code Analyzer | Fortify SSC Plugin |
| Fortify on Demand Plugin | Fortify on Demand | Fortify on Demand Plugin |
| SonarQube Plugin | SonarQube | SonarQube Plugin |
| Change and Risk Prediction Plugin | AI-based change risk scoring | Change and Risk Prediction Plugin |
For the full list of security and compliance plugins, see Security and Compliance Plugins.
Network Access
Release SaaS reaches your tools over outbound connections from the Digital.ai-hosted environment, and your Release Runners reach Release over outbound connections from your network. Plan for both directions:
- Tools that Release calls directly, such as Jenkins, Jira, and a secrets vault, must be reachable from the Release SaaS environment.
- Tools that are only reachable inside your network should be driven by container-based plugin tasks on a Release Runner that you deploy there.
- Systems that push events to Release, such as a Git webhook, need outbound access to your Release SaaS URL.
For the network guidelines that apply to a trial instance, see Network Limitations.
Troubleshooting
Digital.ai monitors and maintains the Release SaaS infrastructure, so server logs and diagnostic bundles are not exposed to you.
- For runner issues, see Troubleshooting Release Runner.
- For authentication and user provisioning issues, check the identity provider and group configuration in the Digital.ai Platform first.
- For anything else, contact your assigned Digital.ai representative. See Support and Contact.
Once authentication and runners are in place, the Release Administrator configures roles, teams, and system settings. See Getting Started for Release Administrators.