Skip to content

Commit fa277c7

Browse files
RahulMR42RahulMR42
authored
Merge pull request #21 from oracle-devrel/imagescan
sample with image scan
2 parents bbc66b1 + 89f53ac commit fa277c7

24 files changed

+428
-1
lines changed

‎oci-build-examples/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ All about OCI devops build samples ..
55
<summary>Security & Quality - click to expand</summary>
66

77
* [Integrate sonarqube with OCI devops build runner.](./oci_buildrunner_with_sonarqube/)
8+
* [Container image scanning before deploy.](./oci_imagescan_before_deploy/)
89

910
</details>
1011

‎oci-build-examples/oci_buildrunner_with_sonarqube/deploy_spec.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ spec:
2121
containers:
2222
- name: graal-polyglot
2323
# enter the path to your image, be sure to include the correct region prefix
24-
image: us-ashburn-1.ocir.io/xxx/xxx/mr-devops/mr-devops-graal-polyglot-app-repo:${BUILDRUN_HASH}
24+
image: <OCI Region>-1.ocir.io/namespace/xxx/xx:${BUILDRUN_HASH}
2525
imagePullPolicy: Always
2626
ports:
2727
- containerPort: 3000

‎oci-build-examples/oci_imagescan_before_deploy/.dockerignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
images
2+
images/*

‎oci-build-examples/oci_imagescan_before_deploy/.gitignore

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
lib/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
pip-wheel-metadata/
24+
share/python-wheels/
25+
*.egg-info/
26+
.installed.cfg
27+
*.egg
28+
MANIFEST
29+
30+
# PyInstaller
31+
# Usually these files are written by a python script from a template
32+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
33+
*.manifest
34+
*.spec
35+
36+
# Installer logs
37+
pip-log.txt
38+
pip-delete-this-directory.txt
39+
40+
# Unit test / coverage reports
41+
htmlcov/
42+
.tox/
43+
.nox/
44+
.coverage
45+
.coverage.*
46+
.cache
47+
nosetests.xml
48+
coverage.xml
49+
*.cover
50+
*.py,cover
51+
.hypothesis/
52+
.pytest_cache/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
target/
76+
77+
# Jupyter Notebook
78+
.ipynb_checkpoints
79+
80+
# IPython
81+
profile_default/
82+
ipython_config.py
83+
84+
# pyenv
85+
.python-version
86+
87+
# pipenv
88+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
89+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
90+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
91+
# install all needed dependencies.
92+
#Pipfile.lock
93+
94+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
95+
__pypackages__/
96+
97+
# Celery stuff
98+
celerybeat-schedule
99+
celerybeat.pid
100+
101+
# SageMath parsed files
102+
*.sage.py
103+
104+
# Environments
105+
.env
106+
.venv
107+
env/
108+
venv/
109+
ENV/
110+
env.bak/
111+
venv.bak/
112+
113+
# Spyder project settings
114+
.spyderproject
115+
.spyproject
116+
117+
# Rope project settings
118+
.ropeproject
119+
120+
# mkdocs documentation
121+
/site
122+
123+
# mypy
124+
.mypy_cache/
125+
.dmypy.json
126+
dmypy.json
127+
128+
# Pyre type checker
129+
.pyre/
130+
toremov*

‎oci-build-examples/oci_imagescan_before_deploy/Dockerfile

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
FROM python:3.9
3+
4+
WORKDIR /code
5+
COPY ./requirements.txt /code/requirements.txt
6+
RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
7+
COPY ./main.py /code/
8+
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "80"]
9+

‎oci-build-examples/oci_imagescan_before_deploy/README.md

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
A sample illustration of build with a container image vulnerability validation,before the deployment invoke.
2+
------
3+
4+
![](images/global_view.png)
5+
6+
Objective
7+
---
8+
9+
- Create an OCI devops build pipeline to build a container image for OKEdeployment.
10+
11+
- Use an OCI Vulnerability scanner and scan the image.
12+
13+
- If the image is valid proceed for deployment.
14+
15+
* Specific instruction to clone only this example.
16+
17+
```
18+
$ git init oci_imagescan_before_deploy
19+
$ cd oci_imagescan_before_deploy
20+
$ git remote add origin <url to this git repo>
21+
$ git config core.sparsecheckout true
22+
$ echo "oci-build-examples/oci_imagescan_before_deploy/*">>.git/info/sparse-checkout
23+
$ git pull --depth=1 origin main
24+
25+
```
26+
27+
Procedure to use the illustration
28+
29+
-------
30+
31+
- Create OCI devops project / necessary policies - https://docs.oracle.com/en-us/iaas/Content/devops/using/home.htm.
32+
33+
- Set the policies for Build /Deploy / Connection policies.
34+
35+
36+
![](images/oci_project.png)
37+
38+
- Create an OCI Build pipeline (with no stages for now)
39+
40+
![](images/oci_buildpipeline.png)
41+
42+
- Create an OCI Artifact repo (For container)
43+
44+
- https://docs.oracle.com/en-us/iaas/Content/Registry/home.htm
45+
46+
47+
![](images/oci_container_repo.png)
48+
49+
- Create a policy (identity) to enable vulnerable scanning for repo.
50+
51+
- Refer to below for the policy statement.
52+
53+
```
54+
allow service vulnerability-scanning-service to read repos in compartment <COMPARTMENT Name>
55+
allow service vulnerability-scanning-service to read compartments in compartment <COMPARTMENT Name>
56+
```
57+
58+
- Create an Artifact with the container repo URL (POSTFIX with a BUILDHASH VARIABLE)
59+
60+
61+
![](images/oci_artifact.png)
62+
63+
- Add a manage build stage to the build pipeline.
64+
65+
- https://docs.oracle.com/en-us/iaas/Content/devops/using/managing_build_pipelines.htm
66+
67+
68+
![](images/build_stage.png)
69+
70+
- You may use the GITHUB repo or OCI Code repo to hold the code base (clone this repo and use accordingly).
71+
72+
- Add another upload artifact stage by using the artifact created.
73+
74+
![](images/upload_artifact.png)
75+
76+
- Add a scanner to the OCI Container repo that we had created.
77+
78+
![](images/repo_scanner.png)
79+
80+
- https://docs.oracle.com/en-us/iaas/scanning/using/scanning-images.htm#scanning_images
81+
82+
- The scan may take a while, so add a waiting stage to the build pipeline.
83+
84+
![](images/wait_stage.png)
85+
86+
- Add another manage build stage but with a custom yaml path as scan_check.yaml.
87+
88+
- You can use the same repo (Github or OCI code repo) but with the custom yaml file.
89+
90+
91+
![](images/scan_check.png)
92+
93+
- Set the below values as build params.
94+
95+
```
96+
SCAN_CHECK_BASELINE - None
97+
98+
REPO_NAME - Container Repo name
99+
100+
COMPARTMENT_ID - Compartment OCID
101+
102+
```
103+
104+
![](images/build_param.png)
105+
106+
107+
All set for test...
108+
109+
-----
110+
111+
- If your docker images are safe they will follow the build pipeline and invoke the deployment.
112+
113+
![](images/build_ok.png)
114+
115+
116+
117+
- If not it will fail and won't proceed for deployment.
118+
119+
![](images/scan_failed.png)
120+
121+
Tail end
122+
123+
-----
124+
125+
- To complete the flow, and create a deployment pipeline, you can use the reference spec file (deployment_spec mentioned here) - https://docs.oracle.com/en-us/iaas/Content/devops/using/deployment_pipelines.htm.You may declare the artifacts and build parameters as variables.
126+
127+
- You may add OCI CLI Steps to delete the image from the repo if found invalid.
128+
129+
Contributors
130+
===========
131+
132+
- Author: Rahul M R.
133+
- Collaborators: NA
134+
- Last release: June 2022
135+
136+
### Back to examples.
137+
----
138+
139+
- 🍿 [Back to OCI Devops Build sample](./../README.md)
140+
- 🏝️ [Back to OCI Devops sample](./../../README.md)
141+

‎oci-build-examples/oci_imagescan_before_deploy/build_spec.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
version: 0.1
2+
component: build
3+
timeoutInSeconds: 6000
4+
runAs: root
5+
shell: bash
6+
env:
7+
# these are local variables to the build config
8+
variables:
9+
key: "value"
10+
11+
# the value of a vaultVariable is the secret-id (in OCI ID format) stored in the OCI Vault service
12+
# you can then access the value of that secret in your build_spec.yaml commands
13+
vaultVariables:
14+
# EXAMPLE_SECRET: "YOUR-SECRET-OCID"
15+
16+
# exportedVariables are made available to use as parameters in sucessor Build Pipeline stages
17+
# For this Build to run, the Build Pipeline needs to have a BUILDRUN_HASH parameter set
18+
exportedVariables:
19+
- BUILDRUN_HASH
20+
21+
steps:
22+
- type: Command
23+
name: "Define unique image tag"
24+
timeoutInSeconds: 40
25+
command: |
26+
export BUILDRUN_HASH=`echo ${OCI_BUILD_RUN_ID} | rev | cut -c 1-7`
27+
echo "BUILDRUN_HASH: " $BUILDRUN_HASH
28+
29+
- type: Command
30+
timeoutInSeconds: 600
31+
name: "Build the app"
32+
command: |
33+
cd ${OCI_PRIMARY_SOURCE_DIR}
34+
docker build --pull --rm -t sample_python_fastap_image .
35+
36+
onFailure:
37+
- type: Command
38+
command: |
39+
echo "Handling Failure"
40+
echo "Failure successfully handled"
41+
timeoutInSeconds: 40
42+
runAs: root
43+
44+
45+
outputArtifacts:
46+
- name: sample_python_fastap_image
47+
type: DOCKER_IMAGE
48+
# this location tag doesn't effect the tag used to deliver the container image
49+
# to the Container Registry
50+
location: sample_python_fastap_image:latest

0 commit comments

Comments
 (0)