11. Security

GitLab offers a wide support for security issues. In this lab, we will cover the GitLabs internal security templates first, and then we will show you how to include custom security tools into your pipeline.

Task 11.1: Security Template Lab

In this lab we will show you how to extend a job with another job from a shared template. Execute following tasks

Include the template Security/SAST.gitlab-ci.yml
Include the template templates/Secret-Detection.yml from the same repository
Include the template Security/License-Scanning.gitlab-ci.yml

Go to your GitLab project and check the pipeline for this lab. You should find the additional Jobs on the pipeline overview.

11.2: Security Template Lab Solution

Updated .gitlab-ci.yml file for this lab:

show solution

stages:
  - info
  - build
  - test
  - package
  - deploy

include:
  - project: '${CI_PROJECT_NAMESPACE}/${CI_PROJECT_NAME}'
    file:
      - 'templates/k8s.yml'
      - 'templates/Secret-Detection.yml'
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml

variables:
  GIT_STRATEGY: 'clone'
  COMPILE: 'false'
  IMAGE_HOST: 'quay.io'
  IMAGE_REPOSITORY: 'puzzle'
  IMAGE_NAME: 'example-spring-boot'

default:
  timeout: 5 minutes

info:
  stage: info
  retry: 2
  script:
    - echo "This is your first stage (ツ)"
    - echo "Username is ${USERNAME} with ${PASSWORD}"

build_application:
  stage: build
  tags:
    - build
    - mobiliar
  image: registry.access.redhat.com/ubi9/openjdk-17:latest
  script:
    - ./gradlew assemble

test_application:
  stage: test
  image: registry.access.redhat.com/ubi9/openjdk-17:latest
  script:
    - ./gradlew check
  artifacts:
    when: always
    reports:
      junit: build/test-results/test/**/TEST-*.xml

build_image:
  image: diemobiliar.azurecr.io/dlp-cicd-dockercli-image:254
  tags:
    - build
    - mobiliar
  services:
    - docker:dind
  stage: package
  before_script:
    - docker info
  script:
    - docker build --no-cache -t $IMAGE_NAME .
    - IMAGE_PATH=$IMAGE_HOST/$IMAGE_REPOSITORY/$IMAGE_NAME:${CI_COMMIT_SHA:0:8}
    - echo "docker image path is - $IMAGE_PATH"
    - docker tag $IMAGE_NAME $IMAGE_PATH
    # - docker login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} ${IMAGE_HOST}
    # - docker push $IMAGE_PATH

deploy_to_prod:
  stage: deploy
  when: manual
  only:
   - release
  script:
    - echo "Deployment triggered"

deploy_to_k8s:
  stage: deploy
  extends: .kubectl
  tags:
    - build
    - mobiliar
  script:
    - echo "deploy your stuff here with kubectl commands"
    - kubectl version --client --short

Task 11.3: Let the pipeline fail

To test the Secret Detection template we add a secret in our sample project. Create a new file in the root directory called private_key and copy the following content into it.

Commit and push the changes to trigger the pipeline.

Now the pipeline should fail because the GitLab Secret Analyzer will find a private key inside our repository.

security_pipeline_fail

Here you see the failed pipeline. By clicking the download menu ⍗ on the right side you can download the job artifacts. To get the report of the failed job, click on Download artifacts and secret_detection_default_branch:secret_detection. We will learn more on artifacts in the next lab.

Warning

If you ever push a secret into a repository, YOU MUST CONSIDER THIS SECRET AS INSECURE. Remove the secret from the repository and change all related secrets!

Now remove the private key from the repository to execute the next steps.

Task 11.4: Custom security tooling

In this section we’ll show you how to use custom security tools in your pipeline. For this example we use Trivy , a local Docker image security scanner.

Extend the existing build_image job inside .gitlab-ci.yml with the following configuration:

Add following commands into the before_script block to download Trivy:

export TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
echo $TRIVY_VERSION
wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar  -zxvf -

Then call Trivy in the script block (after the build command):

mkdir -p reports
./trivy i --exit-code 0 --severity CRITICAL -o reports/container-scanning-report_$CI_COMMIT_SHORT_SHA.txt $IMAGE_NAME

Commit and push the code to rerun the pipeline.

Check the Trivy log output of the build_image Job.

Info

You would do the security scanning in a separate job. Here we do not have an Image Registry to store the Container Image. This would be used to retrieve the Container Image in the next Job to do the scanning.

11.5: Custom security tooling Solution

Updated .gitlab-ci.yml file for this lab:

show solution

stages:
  - info
  - build
  - test
  - package
  - deploy

include:
  - project: '${CI_PROJECT_NAMESPACE}/${CI_PROJECT_NAME}'
    file:
      - 'templates/k8s.yml'
      - 'templates/Secret-Detection.yml'
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml

variables:
  GIT_STRATEGY: 'clone'
  COMPILE: 'false'
  IMAGE_HOST: 'quay.io'
  IMAGE_REPOSITORY: 'puzzle'
  IMAGE_NAME: 'example-spring-boot'

default:
  timeout: 5 minutes

info:
  stage: info
  retry: 2
  script:
    - echo "This is your first stage (ツ)"
    - echo "Username is ${USERNAME} with ${PASSWORD}"

build_application:
  stage: build
  tags:
    - build
    - mobiliar
  image: registry.access.redhat.com/ubi9/openjdk-17:latest
  script:
    - ./gradlew assemble

test_application:
  stage: test
  image: registry.access.redhat.com/ubi9/openjdk-17:latest
  script:
    - ./gradlew check
  artifacts:
    when: always
    reports:
      junit: build/test-results/test/**/TEST-*.xml

build_image:
  image: diemobiliar.azurecr.io/dlp-cicd-dockercli-image:254
  tags:
    - build
    - mobiliar
  services:
    - docker:dind
  stage: package
  before_script:
    - docker info
    - export TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
    - echo $TRIVY_VERSION
    - wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar  -zxvf -
  script:
    - docker build --no-cache -t $IMAGE_NAME .
    - mkdir -p reports
    - ./trivy i --exit-code 0 --severity CRITICAL -o reports/container-scanning-report_$CI_COMMIT_SHORT_SHA.txt $IMAGE_NAME
    - IMAGE_PATH=$IMAGE_HOST/$IMAGE_REPOSITORY/$IMAGE_NAME:${CI_COMMIT_SHA:0:8}
    - echo "docker image path is - $IMAGE_PATH"
    - docker tag $IMAGE_NAME $IMAGE_PATH
    # - docker login -u ${DOCKER_USERNAME} -p ${DOCKER_PASSWORD} ${IMAGE_HOST}
    # - docker push $IMAGE_PATH

deploy_to_prod:
  stage: deploy
  when: manual
  only:
   - release
  script:
    - echo "Deployment triggered"

deploy_to_k8s:
  stage: deploy
  extends: .kubectl
  tags:
    - build
    - mobiliar
  script:
    - echo "deploy your stuff here with kubectl commands"
    - kubectl version --client --short

Last modified September 25, 2023: small updates (06d27ec)