Skip to content

Commit f15f140

Browse files
rcarratarcarrata
authored
Merge pull request #56 from MoOyeg/main
Added Feature for Image and Pipeline Signing
2 parents 771f912 + 7ac0a83 commit f15f140

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+2260
-16
lines changed

‎.gitignore

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎README.md

Lines changed: 46 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ DevSecOps CICD pipeline demo using several technologies such as:
1111

1212
Vulnerability and configuration management methods included in this demo are the following:
1313

14-
* **Static application security testing (SAST)**, which analyzes code under development for vulnerabilities and quality issues.
15-
* **Software composition analysis (SCA)**, which examines dependent packages included with applications, looking for known vulnerabilities and licensing issues.
16-
* **Interactive application security testing (IAST)** and **dynamic application security testing (DAST)** tools, which analyze running applications to find execution vulnerabilities.
17-
* **Configuration management** with analysis and management of application and infrastructure configurations in DevOps. Traditionally this was not used as a way to improve security. But properly managing configurations in a GitOps process can strengthen security by improving change controls, identifying configuration defects that can reduce the attack surface, and signing and tracking authorship for better accountability and opportunities to improve.
18-
* **Image risk** is any risk associated with a container image. This includes vulnerable dependencies, embedded secrets, bad configurations, malware, or images that are not trusted.
14+
- **Static application security testing (SAST)**, which analyzes code under development for vulnerabilities and quality issues.
15+
- **Software composition analysis (SCA)**, which examines dependent packages included with applications, looking for known vulnerabilities and licensing issues.
16+
- **Interactive application security testing (IAST)** and **dynamic application security testing (DAST)** tools, which analyze running applications to find execution vulnerabilities.
17+
- **Configuration management** with analysis and management of application and infrastructure configurations in DevOps. Traditionally this was not used as a way to improve security. But properly managing configurations in a GitOps process can strengthen security by improving change controls, identifying configuration defects that can reduce the attack surface, and signing and tracking authorship for better accountability and opportunities to improve.
18+
- **Image risk** is any risk associated with a container image. This includes vulnerable dependencies, embedded secrets, bad configurations, malware, or images that are not trusted.
1919

2020
This pipeline also improve security adding the following Open Source components:
2121

@@ -95,6 +95,38 @@ These policies notification can be enabled by each system policy enabled in our
9595

9696
NOTE: By now the integration is manual. WIP to automate it.
9797

98+
## 6. Image Signing and Pipeline Signing
99+
100+
The original demo can be extended to use Cosign to Sign Image artifacts and also to sign the Tekton Build Pipeline via Tekton [Chaining](https://github.com/tektoncd/chains).
101+
102+
To extend the pipeline run the extend.sh script
103+
104+
```sh
105+
./extend.sh
106+
```
107+
108+
This will install Noobaa(Object Storage), Quay, and create a pod for cosign secret generation and verification.It will also install the tekton chains operator and integrate with ACS policies to generate violations for non signed images.
109+
110+
After installation the pipeline will build images to quay and have a task that signs the image.
111+
<img align="center" width="750" src="docs/pics/pipeline-with-sign-task.png">
112+
113+
We also create a policy in ACS that will generate a violation for every unsigned image
114+
<img align="center" width="750" src="docs/pics/acs-trusted-signature-violation.png">
115+
116+
Pipeline can be run normally via the Run the demo Instructions below.
117+
118+
After Pipeline is run Quay will show the image signed by Cosign
119+
<img align="center" width="750" src="docs/pics/quay-with-signatures.png">
120+
121+
Since we have Tekton Chaining enabled, successfully completed Taskruns will also be annotated with cosign signatures and payload information.
122+
<img align="center" width="750" src="docs/pics/taskrun.png">
123+
124+
And we can verify the signature and payload information of our last successful pipelinerun using the below command.
125+
126+
```sh
127+
./demo.sh sign-verify
128+
```
129+
98130
## Security Policies and CI Violations
99131

100132
In this demo, we can control the security policies applied into our pipelines, scanning the images and analysing the different deployments templates used for deploy our applications.
@@ -114,9 +146,10 @@ This ensures that we have the total control of our pipelines, and no image is pu
114146
To show a complete demo and show the transition from a "bad image" to an image that passes the build enforcement, we can update the Tekton task of the image build and fix the image. In this example, we will be enabling the enforcement of the "Red Hat Package Manager in Image" policy in ACS, which will fail our pipeline at the image-check as both `yum` and `rpm` package managers are present in our base image.
115147

116148
Update the tekton task:
149+
117150
1. Delete the `s2i-java-11` task
118-
1. With the UI: From the OpenShift UI, make sure you are in the cicd project and then go to Pipelines > Tasks and delete the `s2i-java-11` task.
119-
2. With the Tekton cli `tkn task delete s2i-java-11`
151+
1. With the UI: From the OpenShift UI, make sure you are in the cicd project and then go to Pipelines > Tasks and delete the `s2i-java-11` task.
152+
2. With the Tekton cli `tkn task delete s2i-java-11`
120153
2. Apply the new update task: `kubectl apply -f fix-image/s2ijava-mgr.yaml`
121154
3. Re-run the pipeline, your deployment now succeeds.
122155

@@ -188,20 +221,20 @@ NOTE: This pipeline will fail if you don't [disable the "Fixable at least Import
188221

189222
## Quick Video with the Demo
190223

191-
* [Option I - Complete CICD End2End process (Success)](https://youtu.be/uA7nUYchY5Q)
224+
- [Option I - Complete CICD End2End process (Success)](https://youtu.be/uA7nUYchY5Q)
192225

193-
* [Option II - Failure CICD pipeline due to the ACS violation policy](https://youtu.be/jTRImofd6wQ?t=380)
226+
- [Option II - Failure CICD pipeline due to the ACS violation policy](https://youtu.be/jTRImofd6wQ?t=380)
194227

195-
* [Openshift Coffee Break - ACS for Kubernetes - DevSecOps Way](https://youtu.be/43Mr30mXq0I?t=1955)
228+
- [Openshift Coffee Break - ACS for Kubernetes - DevSecOps Way](https://youtu.be/43Mr30mXq0I?t=1955)
196229

197230
## Promote Pipeline and Triggers
198231

199-
* [Promote Pipeline](docs/promote.md)
200-
* [Triggers in Dev Pipeline](doc/triggers.md)
232+
- [Promote Pipeline](docs/promote.md)
233+
- [Triggers in Dev Pipeline](doc/triggers.md)
201234

202235
# Troubleshooting
203236

204-
* [Check the Tshoot section](docs/tshoot.md)
237+
- [Check the Tshoot section](docs/tshoot.md)
205238

206239
# Credits
207240

‎bootstrap/deploy_demo.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@
2828
- name: 'Install the ACS Post Content'
2929
include_role:
3030
name: "ocp4-post-acs"
31+

‎bootstrap/deploy_signing.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
- name: 'Extend Original Demo for Image and TaskRun Signing'
3+
hosts: localhost
4+
connection: local
5+
tasks:
6+
- name: 'Install NooBaa'
7+
include_role:
8+
name: "ocp4-install-noobaa"
9+
10+
- name: 'Install and configure Quay'
11+
include_role:
12+
name: "ocp4-install-quay"
13+
14+
- name: 'Install and Enable the infra for Signing and Tekton Chaining'
15+
include_role:
16+
name: "ocp4-install-signing"
17+
18+

‎bootstrap/roles/ocp4-install-noobaa/defaults/main.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
noobaa_storage_class: ""
2+
noobaa_size: "50Gi"
3+
backing_store_name: "noobaa-pv-backing-store"

‎bootstrap/roles/ocp4-install-noobaa/tasks/main.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2+
- import_tasks: noobaa-create.yaml

‎bootstrap/roles/ocp4-install-noobaa/tasks/noobaa-create.yaml

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
- name: Get cluster version
2+
k8s_info:
3+
api_version: config.openshift.io/v1
4+
kind: ClusterVersion
5+
name: version
6+
register: r_cluster_version
7+
8+
- name: Set ocp4_cluster_version fact
9+
set_fact:
10+
ocp4_cluster_version: "{{ r_cluster_version.resources[0].status.history[0].version }}"
11+
12+
- name: Obtain Channel from Version
13+
set_fact:
14+
ocp4_channel: "{{ ocp4_cluster_version.split('.') }}"
15+
16+
- name: Set Openshift Channel
17+
set_fact:
18+
ocp4_channel: "stable-{{ ocp4_channel[0] + '.' + ocp4_channel[1] }}"
19+
20+
- name: Print OpenShift version
21+
debug:
22+
msg: "{{ ocp4_channel }}"
23+
24+
- name: Adapt to the openshift_cluster_version LESS than 4.9
25+
when: ocp4_cluster_version is version_compare('4.9', '<')
26+
block:
27+
- name: Create OpenShift Objects to install Noobaa
28+
k8s:
29+
state: present
30+
definition: "{{ lookup('template', item ) | from_yaml }}"
31+
loop:
32+
- ./templates/odf-namespace.yaml.j2
33+
- ./templates/operatorgroup-storage.yaml.j2
34+
- ./templates/ocs-subscription.yaml.j2
35+
36+
- name: Wait for NooBaa CRD to exist
37+
kubernetes.core.k8s_info:
38+
api_version: "apiextensions.k8s.io/v1beta1"
39+
kind: CustomResourceDefinition
40+
name: "noobaas.noobaa.io"
41+
register: crds
42+
until: crds.resources|length > 0
43+
retries: 30
44+
delay: 10
45+
46+
- name: Adapt to the openshift_cluster_version MORE than 4.9
47+
when: ocp4_cluster_version is version_compare('4.9', '>=')
48+
block:
49+
- name: Create OpenShift Objects to install Noobaa
50+
k8s:
51+
state: present
52+
definition: "{{ lookup('template', item ) | from_yaml }}"
53+
loop:
54+
- ./templates/odf-namespace.yaml.j2
55+
- ./templates/operatorgroup-storage.yaml.j2
56+
- ./templates/odf-subscription.yaml.j2
57+
58+
- name: Wait for NooBaa CRD to exist
59+
kubernetes.core.k8s_info:
60+
api_version: "apiextensions.k8s.io/v1"
61+
kind: CustomResourceDefinition
62+
name: "noobaas.noobaa.io"
63+
register: crds
64+
until: crds.resources|length > 0
65+
retries: 30
66+
delay: 10
67+
68+
- name: Create Noobaa Object
69+
k8s:
70+
state: present
71+
definition: "{{ lookup('template', item ) | from_yaml }}"
72+
loop:
73+
- ./templates/noobaa-object.yaml.j2
74+
75+
- name: Wait Until NooBaa Object is Ready
76+
shell: |
77+
oc get noobaas.noobaa.io/noobaa -n openshift-storage -o jsonpath='{.status.phase}'
78+
register: noobaa_status
79+
retries: 10
80+
delay: 20
81+
until:
82+
- noobaa_status.stdout == "Ready"
83+
84+
- name: Get Default Openshift Storage Class
85+
shell: |
86+
oc get sc -o=jsonpath='{.items[?(@.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")].metadata.name}'
87+
register: default_openshift_storage_class
88+
when: noobaa_storage_class == ""
89+
90+
- name: Get any other Storage Class
91+
shell: |
92+
oc get sc -o name | head -n 1 | cut -d "/" -f2
93+
register: other_openshift_storage_class
94+
when: (default_openshift_storage_class.stdout |default("") == "" ) and (noobaa_storage_class == "")
95+
96+
- name: Use default storage class if it was set
97+
ansible.builtin.set_fact:
98+
noobaa_storage_class: "{{ default_openshift_storage_class.stdout }}"
99+
when: (default_openshift_storage_class.stdout |default("") != "" ) and (noobaa_storage_class == "")
100+
101+
- name: Try other possible storage class if no defined/default storage class
102+
ansible.builtin.set_fact:
103+
noobaa_storage_class: "{{ other_openshift_storage_class.stdout }}"
104+
when: (default_openshift_storage_class.stdout |default("") == "" ) and (noobaa_storage_class == "") and (other_openshift_storage_class|default("") != "")
105+
106+
- name: Create NooBaa Backing Store
107+
k8s:
108+
state: present
109+
definition: "{{ lookup('template', item ) | from_yaml }}"
110+
loop:
111+
- ./templates/noobaa-backingstore.yaml.j2
112+
113+
- name: Wait Until NooBaa Object is Ready
114+
shell: |
115+
oc get BackingStore/"{{ backing_store_name }}" -n openshift-storage -o jsonpath='{.status.phase}'
116+
register: backing_store
117+
retries: 10
118+
delay: 20
119+
until:
120+
- backing_store.stdout == "Ready"
121+
122+
- name: Patch Bucket Class with Backing Store
123+
shell: |
124+
oc patch bucketclass noobaa-default-bucket-class --patch '{"spec":{"placementPolicy":{"tiers":[{"backingStores":["{{backing_store_name}}"]}]}}}' --type merge -n openshift-storage
125+

‎bootstrap/roles/ocp4-install-noobaa/templates/noobaa-backingstore.yaml.j2

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: noobaa.io/v1alpha1
2+
kind: BackingStore
3+
metadata:
4+
finalizers:
5+
- noobaa.io/finalizer
6+
labels:
7+
app: noobaa
8+
name: noobaa-pv-backing-store
9+
namespace: openshift-storage
10+
spec:
11+
pvPool:
12+
numVolumes: 1
13+
resources:
14+
requests:
15+
storage: {{ noobaa_size }}
16+
storageClass: {{ noobaa_storage_class }}
17+
type: pv-pool

‎bootstrap/roles/ocp4-install-noobaa/templates/noobaa-object.yaml.j2

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: noobaa.io/v1alpha1
2+
kind: NooBaa
3+
metadata:
4+
name: noobaa
5+
namespace: openshift-storage
6+
spec:
7+
dbResources:
8+
requests:
9+
cpu: '0.1'
10+
memory: 1Gi
11+
dbType: postgres
12+
coreResources:
13+
requests:
14+
cpu: '0.1'
15+
memory: 1Gi

‎bootstrap/roles/ocp4-install-noobaa/templates/ocs-subscription.yaml.j2

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: operators.coreos.com/v1alpha1
2+
kind: Subscription
3+
metadata:
4+
name: ocs-operator
5+
namespace: openshift-storage
6+
spec:
7+
channel: {{ ocp4_channel }}
8+
installPlanApproval: Automatic
9+
name: ocs-operator
10+
source: redhat-operators
11+
sourceNamespace: openshift-marketplace

0 commit comments

Comments
 (0)