Provide full list of images used for each version of CP4AIOps

I am submitting this request on behalf of Bank of America. Every time IBM development delivers a new version of NOI or Cloud Pak for AIOps, BofA is required to download the images into their internal Artifactory to run security scans on those images. They have difficultly downloading the oc ibm-pak utility because it requires the same process - downloading and scanning. They are looking for a simpler and less error prone way to confirm the list of images for each software release so they can regularly download those images into Artifactory to be used for installs/upgrades. Each time they have had to do this in the past, they ask IBM for an Excel spreadsheet which includes the full list of images for a particular version. 

Here is the feedback directly from BofA sent over email:

It’s not so simple for us to run that process here at the bank. (https://www.ibm.com/docs/en/cloud-paks/cloud-pak-aiops/4.10.0?topic=offline-bastion-host#mirror)

Issue #1:
It requires downloading and using a custom binary built by IBM. This requires us to get that software approved. We aren’t allowed to just download and use any piece of software we want and of course there is a process that has to be followed.

I could just mirror the repo and build the binary myself from the source code but…you guessed it…that’s a separate process that has to be followed.

Issue #2
The command requires connecting to github to download case files and any dependencies. This requires routing those requests through the bank’s proxy servers. Since this is a command line process, it requires registering a service account with the bank’s app proxy. The requires us to go through the “Permit to Send” process. As you can imagine it’s not a quick nor easy process. I’ve tried to use every trick to be able to do this type of command line behavior using my id which has access to github through the proxy but no luck.

It would be super helpful if IBM could provide an image list either statically defined or dynamically generated for each product that I can access directly via the Web. That way I don’t have to deal with Issue #1 or #2 because anytime your binary changes, I’m going to have to get it certified and approved and use. And then anytime your case logic may change (i.e. reference different URL paths) them I’m going to have go through the “Permit to Send” process again.

An awful lot of work just to get a simple list of images that are required for a particular product.