We are currently planning to set up GIT-based version control for our SailPoint tenants (3 environments) to better manage configuration changes and streamline deployments across environments. Our objective is to:
Maintain version control for all SailPoint configurations using GIT
Enable controlled migration of configuration changes across environments
Ensure that any configuration changes are reflected in GIT and can be deployed from GIT to the same or higher environments
We would like to understand:
Is there a recommended or defined approach for integrating SailPoint with GIT for configuration management?
Are there any best practices or standard processes that we should follow?
What tools or frameworks are typically used to automate synchronization between SailPoint tenants and GIT repositories?
Currently, we are considering a basic approach using VS Code with a local copy of configurations mapped to a GIT repository. This would involve manually committing and pushing changes to GIT and then deploying them to the respective environments. However, given my limited experience with GIT and as we are just getting started with SailPoint, we would like to explore more efficient and automated approaches to minimize manual effort and ensure consistency. We would greatly appreciate your guidance or any reference materials that can help us design a robust solution. Thank you for your support.
Config Hub allows you to backup all your tenant configuration objects such as sources, transforms, lifecycle states, roles, access profiles, rules, etc., storing up to 10 backups at a time. Then, with tenant connections, you can share (push or pull) configuration objects between tenants in the same region.
With the AWS S3 Cloud Storage option, you can store ALL your backups (config object versions) for all time, if you wish.
Backups and deployments take minutes, and this allows you to not only share new configurations, but also revert to past ones as well.
Before applying some kind of external programmatic back up solution, I highly recommend considering this approach first. It’s easy - no coding skills, additional connectors, or integrations needed.
If you are definitely wanting to use a SailPoint Connector to do this, you might have to use the SaaS Web Services connector. It is flexible and customizable, and you would be able to pull config objects out of a tenant with APIs, but it will take more effort to configure than Configuration Hub. From my research, the GitHub connector doesn’t support this type of integration at this time.
What do you think? Could this work for your deployment?
We are using the Config Hub for the backup and migration but let me try the SaaS Web Services Connector as well.
With GitHub, I think it can be done, if we can create separate branches, pipelines and CI/CD which can allow us to do versioning, can see who is deploying what and put the approval process in place before deploying anything to our tenants specially the production ones.
I will explore the connector approach also.
Thanks again!