rcarrata / devsecops-demo

DevSecOps demo

DevSecOps Pipeline Demo

NOTE: Watch the end2end demo clicking the DevSecOps demo image above!

DevSecOps CICD pipeline demo using several technologies such as:

• OpenShift Pipelines
• OpenShift GitOps
• OpenShift Advanced Cluster Security for Kubernetes
• OpenShift Container Registry

Vulnerability and configuration management methods included in this demo are the following:

• Static application security testing (SAST), which analyzes code under development for vulnerabilities and quality issues.
• Software composition analysis (SCA), which examines dependent packages included with applications, looking for known vulnerabilities and licensing issues.
• Interactive application security testing (IAST) and dynamic application security testing (DAST) tools, which analyze running applications to find execution vulnerabilities.
• Configuration management with analysis and management of application and infrastructure configurations in DevOps. Traditionally this was not used as a way to improve security. But properly managing configurations in a GitOps process can strengthen security by improving change controls, identifying configuration defects that can reduce the attack surface, and signing and tracking authorship for better accountability and opportunities to improve.
• Image risk is any risk associated with a container image. This includes vulnerable dependencies, embedded secrets, bad configurations, malware, or images that are not trusted.

This pipeline also improve security adding the following Open Source components:

• SonarQube
• Nexus
• JUnit
• Gogs
• Git Webhook
• Gatling
• Zap Proxy

• NOTE: Tested and fully working for 4.7+ OpenShift Clusters, including >=4.9!

Overview

1. Continuous Integration

On every push to the spring-petclinic git repository on Gogs git server, the following steps are executed within the Tekton pipeline:

0. Code is cloned from Gogs git server and the unit-tests are run
1. Dependency report from the source code is generated and uploaded to the report server repository.
2. Unit tests are executed and in parallel the code is analyzed by Sonarqube for anti-patterns.
3. Application is packaged as a JAR and released to Sonatype Nexus snapshot repository
4. A container image is built in DEV environment using S2I, and pushed to OpenShift internal registry, and tagged with spring-petclinic:[branch]-[commit-sha] and spring-petclinic:latest

2. DevSecOps steps using Advanced Cluster Security for Kubernetes

Advanced Cluster Security for Kubernetes controls clusters and applications from a single console, with built-in security policies.

Using roxctl and ACS API, we integrated in our pipeline several additional security steps into our DevSecOps pipeline:

5. Image Scanning using ACS Scanner of the image generated and pushed in step 4.

6. Image Check of the build-time violations of the different security policies defined in ACS
7. Checks build-time and deploy-time violations of security policies in ACS of the YAML deployment files used for deploy our application.

NOTE: these 3 steps are executed in parallel for saving time in our DevSecOps pipeline.

8. Kubernetes kustomization files updated with the latest image [commit-sha] in the overlays for dev. This will ensure that our Application are deployed using the specific built image in this pipeline.

3. Continuous Delivery

Argo CD continuously monitor the configurations stored in the Git repository and uses Kustomize to overlay environment specific configurations when deploying the application to DEV and STAGE environments.

9. The ArgoCD applications syncs the manifests in our gogs git repositories, and applies the changes automatically into the namespaces defined:

and deploys every manifest that is defined in the branch/repo of our application:

4. PostCI - Pentesting and Performance Tests

Once our application is deployed, we need to ensure of our application is stable and performant and also that nobody can hack our application easily.

10. Our CI in Openshift Pipelines waits until the ArgoCD app is fully sync and our app and all the resources are deployed
11. The performance tests are cloned into our pipeline workspace
12. The pentesting is executed using the web scanner OWASP Zap Proxy using a baseline in order to check the possible vulnerabilities, and a Zap Proxy report is uploaded to the report server repository.
13. In parallel the performance tests are executed using the load test Gatling and a performance report is uploaded to the report server repository.

5. Notifications

ACS can be integrated with several Notifier for notify if certain events happened in the clusters managed. In our case, we integrated with Slack in order to receive notifications when some Policies are violated in order to have more useful information:

These policies notification can be enabled by each system policy enabled in our system, so you can create your own notification baseline in order to have only the proper information received in your systems.

NOTE: By now the integration is manual. WIP to automate it.

6. Image Signing and Pipeline Signing

The original demo can be extended to use Cosign to Sign Image artifacts and also to sign the Tekton Build Pipeline via Tekton Chaining.

To extend the pipeline run the extend.sh script

   ./extend.sh

This will install Noobaa(Object Storage), Quay, and create a pod for cosign secret generation and verification.It will also install the tekton chains operator and integrate with ACS policies to generate violations for non signed images.

After installation the pipeline will build images to quay and have a task that signs the image.

We also create a policy in ACS that will generate a violation for every unsigned image

Pipeline can be run normally via the Run the demo Instructions below.

After Pipeline is run Quay will show the image signed by Cosign

Since we have Tekton Chaining enabled, successfully completed Taskruns will also be annotated with cosign signatures and payload information.

And we can verify the signature and payload information of our last successful pipelinerun using the below command.

   ./demo.sh sign-verify

Security Policies and CI Violations

In this demo, we can control the security policies applied into our pipelines, scanning the images and analysing the different deployments templates used for deploy our applications.

We can enforce the different Security Policies in ACS, failing our CI pipelines if a violation of this policy appears in each step of our DevSecOps pipelines (steps 6,7,8).

This Security Policies can be defined at BUILD level (during the build/push of the image), or at DEPLOYMENT level (preventing to deploy the application).

For example this Security Policy, checks if a RH Package Manager (dnf,yum) is installed in your Image, and will FAIL the pipeline if detects that the image built contains any RH Package Manager:

This ensures that we have the total control of our pipelines, and no image is pushed into your registry or deployed in your system that surpases the Security Policies defined.

Fixing the image

To show a complete demo and show the transition from a "bad image" to an image that passes the build enforcement, we can update the Tekton task of the image build and fix the image. In this example, we will be enabling the enforcement of the "Red Hat Package Manager in Image" policy in ACS, which will fail our pipeline at the image-check as both yum and rpm package managers are present in our base image.

Update the tekton task:

1. Delete the s2i-java-11 task
   1. With the UI: From the OpenShift UI, make sure you are in the cicd project and then go to Pipelines > Tasks and delete the s2i-java-11 task.
   2. With the Tekton cli tkn task delete s2i-java-11
2. Apply the new update task: kubectl apply -f fix-image/s2ijava-mgr.yaml
3. Re-run the pipeline, your deployment now succeeds.

You can check the s2ijava-mgr.yaml file for more details. We have added a step to this Task which leverages buildah to remove the package managers from the image (search for "rpm" or "yum" in the file).

Deploy

Prerequisites

• A RHEL or Fedora box
• Openshift Cluster 4.7+
• oc binary
• Ansible 2.7+
• Git

• Install Ansible

• Install Kubernetes Ansible Module

ansible-galaxy collection install community.kubernetes
pip3 install kubernetes
pip3 install openshift

Install some extra Python dependency:

pip3 install jmespath

Bootstrap

Fully automated deployment and integration of every resource and tool needed for this demo.

oc login --token=yourtoken --server=https://yourocp

Run the installer:

./install.sh

Credentials & Resources

Check the resources deployed for this demo with:

./status.sh

• Gogs git server (username/password: gogs/gogs)
• Sonatype Nexus (username/password: admin/admin123)
• SonarQube (username/password: admin/admin)
• Argo CD (username/password: admin/[Login with OAuth using Dex])
• ACS (username/password: admin/stackrox)
• Repository Server (username/password: reports/reports)

Run the demo!

cd ..
./demo.sh start

NOTE: This pipeline will fail if you don't disable the "Fixable at least Important" policy enforcement behaviour of ACS. This is expected to demonstrate the failure when a violation of the system policy occurs.

Quick Video with the Demo

• Option I - Complete CICD End2End process (Success)

• Option II - Failure CICD pipeline due to the ACS violation policy

• Openshift Coffee Break - ACS for Kubernetes - DevSecOps Way

Promote Pipeline and Triggers

• Promote Pipeline
• Triggers in Dev Pipeline

Troubleshooting

• Check the Tshoot section

Credits

Big thanks for the contributors and reviews that helped so much in this demo! We grow as we share!

devsecops-demo's Issues

code analysis sometimes randomly fails

when the code analysis runs sometimes are failing raising this type of error:

[�[1;31mERROR�[m] /workspace/source/spring-petclinic/src/test/java/org/springframework/samples/petclinic/service/ClinicServiceTests.java:[30,51] cannot access org.springframework.samples.petclinic.owner.Pet
  bad class file: /workspace/source/spring-petclinic/target/classes/org/springframework/samples/petclinic/owner/Pet.class
    class file contains wrong class: org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest
    Please remove or make sure it appears in the correct subdirectory of the classpath.
[�[1;34mINFO�[m] 1 error
[�[1;34mINFO�[m] -------------------------------------------------------------
[�[1;34mINFO�[m] 
[�[1;34mINFO�[m] �[1m------------------------------------------------------------------------�[m
[�[1;34mINFO�[m] �[1mSkipping petclinic�[m
[�[1;34mINFO�[m] This project has been banned from the build due to previous failures.
[�[1;34mINFO�[m] �[1m------------------------------------------------------------------------�[m
[�[1;34mINFO�[m] �[1m------------------------------------------------------------------------�[m
[�[1;34mINFO�[m] �[1;31mBUILD FAILURE�[m
[�[1;34mINFO�[m] �[1m------------------------------------------------------------------------�[m
[�[1;34mINFO�[m] Total time: 01:08 min
[�[1;34mINFO�[m] Finished at: 2021-07-22T06:09:15Z
[�[1;34mINFO�[m] Final Memory: 118M/1460M
[�[1;34mINFO�[m] �[1m------------------------------------------------------------------------�[m
[�[1;31mERROR�[m] Failed to execute goal �[32morg.apache.maven.plugins:maven-compiler-plugin:3.8.1:testCompile�[m �[1m(default-testCompile)�[m on project �[36mspring-petclinic�[m: �[1;31mCompilation failure�[m
[�[1;31mERROR�[m] �[1;31m/workspace/source/spring-petclinic/src/test/java/org/springframework/samples/petclinic/service/ClinicServiceTests.java:[30,51] cannot access org.springframework.samples.petclinic.owner.Pet�[m
[�[1;31mERROR�[m] �[1;31m  bad class file: /workspace/source/spring-petclinic/target/classes/org/springframework/samples/petclinic/owner/Pet.class�[m
[�[1;31mERROR�[m] �[1;31m    class file contains wrong class: org.springframework.boot.test.autoconfigure.orm.jpa.DataJpaTest�[m
[�[1;31mERROR�[m] �[1;31m    Please remove or make sure it appears in the correct subdirectory of the classpath.�[m
[�[1;31mERROR�[m] �[1;31m�[m
[�[1;31mERROR�[m] -> �[1m[Help 1]�[m
[�[1;31mERROR�[m] 
[�[1;31mERROR�[m] To see the full stack trace of the errors, re-run Maven with the �[1m-e�[m switch.
[�[1;31mERROR�[m] Re-run Maven using the �[1m-X�[m switch to enable full debug logging.
[�[1;31mERROR�[m] 
[�[1;31mERROR�[m] For more information about the errors and possible solutions, please read the following articles:
[�[1;31mERROR�[m] �[1m[Help 1]�[m http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException

Openshift GitOps for springpetclinic-dev stucks in wait sync up of ArgoCD

GROUP               KIND        NAMESPACE      NAME              STATUS     HEALTH   HOOK  MESSAGE
                    Service     devsecops-dev  spring-petclinic  Synced     Healthy        
apps                Deployment  devsecops-dev  spring-petclinic  OutOfSync  Healthy        
route.openshift.io  Route       devsecops-dev  spring-petclinic  Synced                    
time="2021-11-03T08:34:01Z" level=fatal msg="Operation has completed with phase: Running"

Please consider adding an open source license

Please, consider adding an open source license file to this project.

Upgrade Nexus Image to 3.36 and use redhat registry

Use the image registry.connect.redhat.com/sonatype/nexus-repository-manager:3.36.0-ubi-1

Check also the deployment to be used in the bootstrap demo

Installation failing on OCP 4.9.10 (ROSA)

./install.sh

INFO: Installing Demo
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [Install the ACS Demo] ********************************************************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************************************************************
ok: [localhost]

TASK [Install Gitops] **************************************************************************************************************************************************

TASK [ocp4-install-gitops : Create Namespaces] *************************************************************************************************************************
changed: [localhost]

TASK [ocp4-install-gitops : Install GitOps Operator] *******************************************************************************************************************
changed: [localhost]

TASK [ocp4-install-gitops : Wait for GitOps CRD to exist] **************************************************************************************************************
FAILED - RETRYING: Wait for GitOps CRD to exist (30 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (29 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (28 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (27 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (26 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (25 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (24 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (23 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (22 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (21 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (20 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (19 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (18 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (17 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (16 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (15 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (14 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (13 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (12 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (11 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (10 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (9 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (8 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (7 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (6 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (5 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (4 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (3 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (2 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (1 retries left).
failed: [localhost] (item=applications.argoproj.io) => {"ansible_loop_var": "item", "api_found": false, "attempts": 30, "changed": false, "item": "applications.argoproj.io", "msg": "Failed to find API for resource with apiVersion "apiextensions.k8s.io/v1beta1" and kind "CustomResourceDefinition"", "resources": []}
FAILED - RETRYING: Wait for GitOps CRD to exist (30 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (29 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (28 retries left).
FAILED - RETRYING: Wait for GitOps CRD to exist (27 retries left).

CRDS and Pods appear to have been created so the reason for the failure is not clear.

[jwilms@jwilms ~]$ oc get crd | grep gitops
gitopsservices.pipelines.openshift.io 2021-12-15T00:56:50Z

And it also appears that everything is running ok in the openshift-gitops namespace:

[jwilms@jwilms ~]$ oc get pods
NAME READY STATUS RESTARTS AGE
pod/cluster-86f5997f56-jsm7z 1/1 Running 0 6m16s
pod/kam-8579df68c8-9d8pt 1/1 Running 0 6m15s
pod/openshift-gitops-application-controller-0 1/1 Running 0 6m14s
pod/openshift-gitops-applicationset-controller-76dfff754b-4rzxm 1/1 Running 0 6m14s
pod/openshift-gitops-dex-server-6cf4f8d67c-vswn4 1/1 Running 0 6m14s
pod/openshift-gitops-redis-7867d74fb4-shzfg 1/1 Running 0 6m15s
pod/openshift-gitops-repo-server-bb4f985c8-fksj5 1/1 Running 0 6m15s
pod/openshift-gitops-server-6cfc85cbb8-rbpgg 1/1 Running 0 6m14s

Add Tekton Chains and Sigstore to the demo

https://github.com/tektoncd/chains

https://gkovan.medium.com/a-zero-trust-approach-for-securing-the-supply-chain-of-microservices-packaged-as-container-images-89d2f5b7293b

https://github.com/ztsc/tekton

enable keycload / ocp sso instead of dex

Enable OAUTH in ArgoCD 1.2

oc -n openshift-gitops patch argocd openshift-gitops --type='json' -p='[{"op": "add", "path": "/spec/sso", "value": {"provider": "keycloak"} }]'

Enable the admin role in ArgoCD

oc patch cm/argocd-rbac-cm -n openshift-gitops --type=merge -p '{"data":{"policy.default":"role:admin"}}'

Explore GitSecrets of awslabs

Git Secrets could be a nice addon to the pipeline in order to ensure that the git repo have not any exposed secret. Additionally ACS includes out of the box config management for avoid expose any secret/CM in the k8s cluster.

fails due no dockerhub creds

Hi,

I tried to install the demo, but it seems it fails due that it tries to pull postgresql image from dockerhub. Nowadays dockerhub requires auth, so it fails as the demo doesn't add credentials.

This should be implemented into demo:

https://docs.openshift.com/container-platform/4.7/openshift_images/managing_images/using-image-pull-secrets.html#images-pulling-from-private-registries_using-image-pull-secrets

Failure in the installation of the Openshift GitOps

Due to the newer version of Openshift GitOps 1.3, the CRs changed. Further investigation it's required.

< TASK [ocp4-install-gitops : Wait for GitOps CRD to exist] >
 -----------------------------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

ok: [localhost] => (item=applications.argoproj.io)

FAILED - RETRYING: Wait for GitOps CRD to exist (1 retries left).
failed: [localhost] (item=applicationsets.argoproj.io) => {"ansible_loop_var": "item", "api_found": true, "attempts": 30, "changed": false, "item": "applicationsets.argoproj.io", "resources": []}
ok: [localhost] => (item=appprojects.argoproj.io)
ok: [localhost] => (item=argocds.argoproj.io)

Use Cosign and Sigstore to sign the images that are in the registry

• https://github.com/sigstore/cosign#registry-support

Possible Issue: Quay needs to be used, because the OCP Internal registry it's not supported.

Enhance explanation with the devsecops pipeline description

Use the following devsecops description

ArgoCD server is exposing a not valid certificate and Task for Wait Application is failing

The GitOps / ArgoCD Server have not the proper certificate SAN for the openshift-gitops-server.openshift-gitops, and for this reason is failing to login and to do the app sync. Needs to be updated with insecure or use the http instead of https inside of the cluster.

step-login-wait
+ [ -z ]
+ yes
+ argocd login openshift-gitops-server.openshift-gitops:443 --username=admin --password=czX6GbpBg4UaODnM1yKvdlRm8FsYE3fW
WARNING: server certificate had error: x509: certificate is valid for openshift-gitops, openshift-gitops-grpc, openshift-gitops.openshift-gitops.svc.cluster.local, not openshift-gitops-server.openshift-gitops. Proceed insecurely (y/n)? 'admin:login' logged in successfully
Context 'openshift-gitops-server.openshift-gitops:443' updated

step-sync
+ argocd app sync dev-spring-petclinic --revision HEAD --
time="2022-02-25T13:14:53Z" level=fatal msg="Failed to establish connection to openshift-gitops-server.openshift-gitops:443: x509: certificate is valid for openshift-gitops, openshift-gitops-grpc, openshift-gitops.openshift-gitops.svc.cluster.local, not openshift-gitops-server.openshift-gitops"

Add Signing Commits in Git server

Include signing of the commits in Git Servers using PGP:

• in Gitea -> https://docs.gitea.io/en-us/signing/
• in GitHub -> https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

Few issues with OCP 4.11

Hello,

I tried to deploy this demo on a 4.11 OCP cluster.

Pre-requisites are installed :

$ pip3 list | grep -e kubernetes -e openshift -e jmespath 
jmespath            1.0.1
kubernetes          24.2.0
openshift           0.13.1

$ ansible --version 
ansible [core 2.13.4]
  config file = None
  configured module search path = ['/Users/slallema/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/homebrew/Cellar/ansible/6.4.0/libexec/lib/python3.10/site-packages/ansible
  ansible collection location = /Users/slallema/.ansible/collections:/usr/share/ansible/collections
  executable location = /opt/homebrew/bin/ansible
  python version = 3.10.7 (main, Sep 14 2022, 22:38:23) [Clang 14.0.0 (clang-1400.0.29.102)]
  jinja version = 3.1.2
  libyaml = True

I have a first issue with the install.sh phase and the ocp4-post-acs task :

TASK [ocp4-post-acs : Get the secret that contains the token of sa pipeline] ***************************************************************
ok: [localhost] => {"ansible_facts": {"token_sa_pipeline_secret": []}, "changed": false}

TASK [ocp4-post-acs : Get token in the secret for the sa pipeline and decode] **************************************************************
fatal: [localhost]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: list object has no element 0\n\nThe error appears to be in '/Users/slallema/GIT/github.com/slallemand/devsecops-demo/bootstrap/roles/ocp4-post-acs/tasks/post_ci.yaml': line 68, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Get token in the secret for the sa pipeline and decode\n  ^ here\n"}

PLAY RECAP *********************************************************************************************************************************
localhost                  : ok=70   changed=6    unreachable=0    failed=1    skipped=3    rescued=0    ignored=0   

Anyway, i did try to start the pipeline with the ./demo.sh start but the pipeline is failing at the build-image task.
I have those errors :

STEP-GEN-ENV-FILE

2022/10/05 13:03:28 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/": unable to create destination directory: mkdir /.docker: permission denied
UID uid=1001(1001) gid=0(root) groups=0(root),1000660000
Generated Env file
------------------------------
MAVEN_CLEAR_REPO=false
MAVEN_MIRROR_URL=http://nexus:8081/repository/maven-public/
------------------------------
STEP-GENERATE

2022/10/05 13:03:29 warning: unsuccessful cred copy: ".docker" from "/tekton/creds" to "/": unable to create destination directory: mkdir /.docker: permission denied
UID uid=1001(1001) gid=0(root) groups=0(root),1000660000 s2i build spring-petclinic/target image-registry.openshift-image-registry.svc:5000/openshift/java:11 --image-scripts-url image:///usr/local/s2i --as-dockerfile /gen-source/Dockerfile.gen --environment-file /env-params/env-file
STEP-BUILD

Error: error writing "0 0 4294967295\n" to /proc/29/uid_map: write /proc/29/uid_map: operation not permitted
level=error msg="error writing \"0 0 4294967295\\n\" to /proc/29/uid_map: write /proc/29/uid_map: operation not permitted"
level=error msg="(unable to determine exit status)"
STEP-PUSH-TAG

2022/10/05 13:03:31 Skipping step because a previous step failed
STEP-PUSH-LATEST

2022/10/05 13:03:32 Skipping step because a previous step failed

Could that be relative to the install error ?
Any idea on that ?

image-check issue for internal registry

Hi,
Getting this in image-check task on OCP 4.10 during pipelinerun.
oc -n cicd logs petclinic-build-dev-75x4fy-image-check-pod -c step-rox-image-check
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 65.2M 100 65.2M 0 0 247M 0 --:--:-- --:--:-- --:--:-- 247M
Getting roxctl
ERROR: Checking image failed: could not check build-time alerts: rpc error: code = Internal desc = image enrichment error: error getting metadata for image: image-registry.openshift-image-registry.svc:5000/cicd/spring-petclinic@sha256:4b6e957cb83f6e5687b71c012343308fb15ac0bce23c1be85d9e2a29d340b29c error: getting metadata from registry: "Autogenerated https://image-registry.openshift-image-registry.svc:5000 for cluster development": Failed to get the manifest digest : Head "https://image-registry.openshift-image-registry.svc:5000/v2/cicd/spring-petclinic/manifests/sha256:4b6e957cb83f6e5687b71c012343308fb15ac0bce23c1be85d9e2a29d340b29c": http: non-successful response (status=401 body=""). Retrying after 3 seconds...

I found this: https://access.redhat.com/solutions/6993372
So wondering how this is working on your side..
Thanks

change images from dockerhub to quay and registry.redhat.io

change images used in this demo from dockerhub to quay and registry.redhat.io

Failure uploading the zap proxy report into the upload server

+ ls -lhrt /zap/wrk
total 76K

-rw-r--r--. 1 zap zap 75K Aug 20 10:41 petclinic-build-devm9hqv.html
+ echo 'Uploading the report into the report server'
Uploading the report into the report server

+ curl -u reports:reports -F path=petclinic-build-devm9hqv.html -F file=/zap/wrk/petclinic-build-devm9hqv.html -X POST http://reports-repo:8080/upload
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100   335  100    36  100   299   7200  59800 --:--:-- --:--:-- --:--:-- 67000
{"message":"Internal Server Error"}

Pipeline petclinic-build-dev - task scan image error

Since I have a free docker.io account, I am getting this error. Is it possible to avoid this?

PodPpetclinic-build-dev-cw8uq2-deploy-check-s7lww-pod-9ts67
NamespaceNScicd
5 minutes ago
Generated from kubelet on ip-10-0-184-15.us-west-1.compute.internal
5 times in the last 13 minutes
Failed to pull image "centos": rpc error: code = Unknown desc = Error reading manifest latest in docker.io/library/centos: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit

Upgrade Sonarqube Image to 9.1.0-community

Due to the image of the Sonarqube image have more than 90 days, we need to update towards the 9.1.0-community with tag "sonarqube:9.1.0-community", and test it in the devsecops demo.

Image Scan fails due to roxctl cli output changes

Due to updates and deprecations in roxctl the format output is no longer supporting pretty for the formatting:

## Scanning image image-registry.openshift-image-registry.svc:5000/cicd/spring-petclinic@sha256:48cea137aab4dfad9189f0d733b8c11ef1466ef74f78043d11a9fa8c527fef7c
Flag --format has been deprecated, please use --output/-o to specify the output format. NOTE: The new JSON / CSV format contains breaking changes, make sure you adapt to the new structure before migrating.
ERROR:	invalid arguments: invalid output format "pretty" used. You can only specify json or csv
## Go to https://central-stackrox.apps.cluster-m7mtg.m7mtg.xxx.opentlc.com:443/main/vulnerability-management/image/sha256:48cea137aab4dfad9189f0d733b8c11ef1466ef74f78043d11a9fa8c527fef7c to check more info

Integrate the ACS OAuth into demo

Integrate the ACS OAuth into DevSecOps demo to authenticate with the OAuth Credentials instead of hardcoded password - https://redhat-scholars.github.io/acs-workshop/acs-workshop/11-integrations.html#integrate_acs_oauth

OCP 4.11 install

The pipelines operator was not coming up in my OCP 4.11 install. I had to deinstall the operator, and install it from the OperatorHub. Then, relaunching the install.sh worked.

Did not have time to investigate really the cause, but I thought I'd share the issue.