Skip to content

Commit b25c495

Browse files
mlorenzofrgaurav-nelson
mlorenzofr
authored and
gaurav-nelson
committed
mbp-1024: Add Automated Secure Supply Chain to layered-zero-trust
Signed-off-by: Manuel Lorenzo <[email protected]>
1 parent ba289e3 commit b25c495

File tree

4 files changed

+284
-2
lines changed

4 files changed

+284
-2
lines changed

‎content/patterns/layered-zero-trust/_index.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@ The pattern consists of the following key components:
108108
* link:https://docs.redhat.com/es/documentation/red_hat_trusted_profile_analyzer/2.2[Red{nbsp}Hat Trusted Profile Analyzer (RHTPA)]
109109
** Provides the storage and management means for _Software Bill of Materials_ (SBOMs), with cross-referencing capabilities between SBOMs and CVEs/Security Advisories.
110110

111+
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines/1.20[Red{nbsp}Hat OpenShift Pipelines]
112+
** Provides a cloud-native continuous integration and continuous deployment (CI/CD) solution on {ocp}.
113+
111114
[id="architecture-diagram"]
112115
==== Architecture diagram
113116

@@ -186,3 +189,4 @@ The following technologies are used in this solution:
186189
* *Red{nbsp}Hat Quay*: Private registry for OCI images.
187190
* *Red{nbsp}Hat Trusted Artifact Signer*: Facilitates signing and verification of software artifacts.
188191
* *Red{nbsp}Hat Trusted Profile Analyzer*: Enables SBOM file analysis and vulnerability detection.
192+
* *Red{nbsp}Hat OpenShift Pipelines*: Enables a native CI/CD solution on {ocp}.

‎content/patterns/layered-zero-trust/lzt-automated-secure-supply-chain.adoc‎

Lines changed: 278 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
---
2+
title: Secure supply chain - Automated approach
3+
weight: 40
4+
aliases: /layered-zero-trust/lzt-automated-secure-supply-chain/
5+
---
6+
7+
:toc:
8+
:imagesdir: /images
9+
:_mod-docs-content-type: ASSEMBLY
10+
include::modules/comm-attributes.adoc[]
11+
12+
[id="lzt-automated-secure-supply-chain"]
13+
= Use case: Automating the secure supply chain
14+
15+
[role="_abstract"]
16+
The xref:/patterns/layered-zero-trust/lzt-secure-multitier/index.html [Secure multitiered applications] use case describes how to implement a secure supply chain for application development by using Red{nbsp}Hat Trusted Artifact Signer (RHTAS) and the Red{nbsp}Hat Trusted Profile Analyzer (RHTPA). This use case demonstrates automation of the secure supply chain for application development by using link:https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines/1.20[{rh-pipelines-first}].
17+
18+
{pipelines-short} orchestrates the application building and certification process. The Zero Trust Validated Pattern (ZTVP) creates a pipeline in the cluster named `qtodo-supply-chain`. This pipeline builds the application from source code, generates a container image, and publishes the image to an OCI registry.
19+
20+
The pipeline performs the following actions:
21+
22+
* Generates a Software Bill of Materials (SBOM) containing the build contents.
23+
* Signs binaries and the build attestation.
24+
* Verifies the validity of the signatures.
25+
26+
[id="run-pipeline"]
27+
== Running the pipeline
28+
29+
Start the pipeline by using the {ocp} web console or the CLI.
30+
31+
[id="run-pipeline-console"]
32+
=== Running the pipeline from the web console
33+
34+
To start a pipeline execution from the {ocp} Web console:
35+
36+
.Procedure
37+
38+
. Log in to the {ocp} web console.
39+
. From the left navigation bar, select **Pipelines** -> **Pipelines**.
40+
. In the **layered-zero-trust-hub** project, find the **qtodo-supply-chain** pipeline.
41+
. Click the **Options** menu (⋮) and select **Start**.
42+
. Verify the parameters. Most default values are correct for single-cluster mode.
43+
. Configure the following workspaces:
44+
45+
* For **qtodo-source**, select **PersistentVolumeClaim** and ensure the PVC name is **qtodo-workspace-source**.
46+
* For **registry-auth-config**, select **Secret** and ensure the secret name is **qtodo-registry-auth**.
47+
. Click **Start**.
48+
49+
[id="run-pipeline-cli"]
50+
=== Running the pipeline from the CLI
51+
52+
Start a pipeline execution by creating a `PipelineRun` resource that references the `qtodo-supply-chain` pipeline.
53+
54+
.Procedure
55+
56+
. Create a file named `qtodo-pipeline.yaml` with the following content:
57+
+
58+
[source,yaml]
59+
----
60+
apiVersion: tekton.dev/v1
61+
kind: PipelineRun
62+
metadata:
63+
generateName: qtodo-manual-run-
64+
namespace: layered-zero-trust-hub
65+
spec:
66+
pipelineRef:
67+
name: qtodo-supply-chain
68+
taskRunTemplate:
69+
serviceAccountName: pipeline
70+
timeouts:
71+
pipeline: 1h0m0s
72+
workspaces:
73+
- name: qtodo-source
74+
persistentVolumeClaim:
75+
claimName: qtodo-workspace-source
76+
- name: registry-auth-config
77+
secret:
78+
secretName: qtodo-registry-auth
79+
----
80+
+
81+
Verify the values for the PVC storage and registry configuration.
82+
83+
. Create the `PipelineRun` resource:
84+
+
85+
[source,terminal]
86+
----
87+
$ oc create -f qtodo-pipeline.yaml
88+
----
89+
90+
.Verification
91+
92+
* Review the pipeline logs using the Tekton CLI:
93+
+
94+
[source,terminal]
95+
----
96+
$ tkn pipeline logs -n layered-zero-trust-hub -L -f
97+
----
98+
99+
[id="pipeline-tasks"]
100+
== Pipeline tasks
101+
102+
The pipeline includes the following tasks:
103+
104+
* **qtodo-clone-repository**: Clones the `qtodo` repository.
105+
* **qtodo-build-artifact**: Builds an `uber-jar` of the `qtodo` application.
106+
* **qtodo-sign-artifact**: Signs the generated JAR file.
107+
* **qtodo-verify-artifact**: Verifies the JAR signature.
108+
* **qtodo-build-image**: Builds a container image and uploads it to a registry.
109+
* **qtodo-sign-image**: Signs the container image.
110+
* **qtodo-generate-sbom**: Generates an SBOM from the image.
111+
* **qtodo-sbom-attestation**: Creates a signed attestation and attaches it to the image.
112+
* **qtodo-upload-sbom**: Uploads the SBOM file to RHTPA.
113+
* **qtodo-verify-image**: Verifies the attestation and signature.
114+
115+
[id="inspect-results"]
116+
== Inspecting pipeline results
117+
118+
Verify the status and output of the pipeline by using the web console or the CLI.
119+
120+
[id="inspect-results-ui"]
121+
=== Inspecting results from the web console
122+
123+
You can inspect the results of the pipeline execution from the {ocp} web console.
124+
125+
.Procedure
126+
127+
. Log in to the {ocp} web console.
128+
. From the left navigation bar, select **Pipelines** -> **Pipelines**.
129+
. In the **layered-zero-trust-hub** project, find the **qtodo-supply-chain** pipeline.
130+
. Click the *PipelineRun* link in the *Last run* column.
131+
. In the *Details* tab, view the summary of the pipeline execution and tasks.
132+
. Click on a task or the *Logs* tab to see the output of specific tasks.
133+
134+
[id="inspect-results-cli"]
135+
=== Inspecting results from the CLI
136+
137+
You can inspect the results of the pipeline execution by using the CLI.
138+
139+
.Procedure
140+
141+
. Verify that the pipeline completed successfully:
142+
+
143+
[source,terminal]
144+
----
145+
$ oc get pipelinerun -n layered-zero-trust-hub
146+
147+
NAME SUCCEEDED REASON STARTTIME COMPLETIONTIME
148+
qtodo-manual-run-p46f7 True Succeeded 7m4s 2m12s
149+
----
150+
151+
. Review the `TaskRuns` to see the results of each step:
152+
+
153+
[source,terminal]
154+
----
155+
$ oc get taskruns -n layered-zero-trust-hub
156+
157+
NAME SUCCEEDED REASON STARTTIME COMPLETIONTIME
158+
qtodo-manual-run-p46f7-qtodo-build-artifact True Succeeded 7m44s 5m17s
159+
qtodo-manual-run-p46f7-qtodo-build-image True Succeeded 4m55s 4m4s
160+
qtodo-manual-run-p46f7-qtodo-clone-repository True Succeeded 7m55s 7m44s
161+
...
162+
----
163+
164+
. Identify the pods associated with the tasks in the `layered-zero-trust-hub` namespace:
165+
+
166+
[source,terminal]
167+
----
168+
$ oc get pods -n layered-zero-trust-hub
169+
170+
NAME READY STATUS RESTARTS AGE
171+
qtodo-manual-run-p46f7-qtodo-build-artifact-pod 0/1 Completed 0 10m
172+
qtodo-manual-run-p46f7-qtodo-build-image-pod 0/1 Completed 0 7m21s
173+
...
174+
----
175+
176+
. Review the pod logs to view the output of a specific step. For example, to view image verification messages:
177+
+
178+
[source,terminal]
179+
----
180+
$ oc logs -n layered-zero-trust-hub qtodo-manual-run-p46f7-qtodo-verify-image-pod
181+
182+
Success: true
183+
Result: SUCCESS
184+
Violations: 0, Warnings: 0, Successes: 3
185+
Component: Unnamed
186+
ImageRef: quay-registry-quay-quay-enterprise.apps.example.com/ztvp/qtodo@sha256:df6506e93a141cfcaeb3b4686b558cddd963410a146b10c3cbd1319122f5f880
187+
188+
Results:
189+
✓ [Success] builtin.attestation.signature_check
190+
...
191+
✓ [Success] builtin.image.signature_check
192+
...
193+
----
194+
195+
[id="review-services"]
196+
== Reviewing integrated services
197+
198+
The supply chain results are visible in the services used during the build process.
199+
200+
[id="review-quay"]
201+
=== Reviewing images in Quay
202+
203+
If you used Quay as the image registry, you can review the built image inside the registry.
204+
205+
.Procedure
206+
207+
. Obtain the credentials for the Quay web interface:
208+
209+
* *Quay URL*:
210+
+
211+
[source,terminal]
212+
----
213+
$ echo "https://$(oc get route -n quay-enterprise \
214+
-l quay-component=quay-app-route \
215+
-o jsonpath='{.items[0].spec.host}')"
216+
----
217+
* *Quay username*: Use the value specified in `values-hub.yaml` or `quay-user`.
218+
* *Quay password*:
219+
+
220+
[source,terminal]
221+
----
222+
$ oc get secret -n layered-zero-trust-hub qtodo-quay-password -o json | jq '.data["password"] | @base64d'
223+
----
224+
225+
. Log in to the Quay web interface.
226+
. Select the **ztvp/qtodo** repository.
227+
. In the navigation menu, select **Tags**.
228+
. Verify that the `latest` tag is signed and that the `.att` attestation file is present.
229+
230+
image::/images/layered-zero-trust/quay-web-ui.png[Quay Web UI]
231+
232+
[id="review-rekor"]
233+
=== Reviewing Rekor verification records
234+
235+
Use the Rekor search interface to check verification records. Search by email address or record index.
236+
237+
.Procedure
238+
239+
* Get the URL for the Rekor search interface:
240+
+
241+
[source,terminal]
242+
----
243+
$ echo "https://$(oc get route -n trusted-artifact-signer -l app.kubernetes.io/component=rekor-ui -o jsonpath='{.items[0].spec.host}')"
244+
----
245+
246+
image::/images/layered-zero-trust/rekor-web-ui.png[Rekor's Search UI]
247+
248+
[id="review-rhtpa"]
249+
=== Reviewing RHTPA results
250+
251+
The RHTPA web UI uses OIDC for user authentication. If you are using *Keycloak* integrated with the pattern, use the following commands to obtain the credentials.
252+
253+
.Procedure
254+
255+
. Get the credentials:
256+
* *RHTPA URL*:
257+
+
258+
[source,terminal]
259+
----
260+
$ echo "https://$(oc get route -n trusted-profile-analyzer \
261+
-l app.kubernetes.io/name=server \
262+
-o jsonpath='{.items[0].spec.host}')"
263+
----
264+
* *RHTPA user*: `rhtpa-user`
265+
* *RHTPA user password*:
266+
+
267+
[source,terminal]
268+
----
269+
$ oc get secret keycloak-users -n keycloak-system -o json \
270+
| jq '.data["rhtpa-user-password"] | @base64d'
271+
----
272+
273+
. Review the SBOM in the RHTPA web interface:
274+
.. Log in to the RHTPA web interface using Keycloak credentials.
275+
.. In the navigation menu, select **SBOMs**.
276+
.. Select the container image name from the list of available SBOMs.
277+
278+
image::/images/layered-zero-trust/rhtpa-web-ui.png[RHTPA Web UI]

‎content/patterns/layered-zero-trust/lzt-secure-multitier.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Secure multi-tier applications
2+
title: Secure multitiered applications
33
weight: 20
44
aliases: /layered-zero-trust/lzt-secure-multitier
55
---
@@ -10,7 +10,7 @@ aliases: /layered-zero-trust/lzt-secure-multitier
1010
include::modules/comm-attributes.adoc[]
1111

1212
[id="lzt-secure-multitier"]
13-
= Use case: Secure multi-tier applications
13+
= Use case: Secure multitiered applications
1414

1515
This use case demonstrates securing a common application design pattern: a frontend application using a database for persistent storage.
1616

‎static/images/layered-zero-trust/quay-web-ui.png‎

55.1 KB
Loading

0 commit comments

Comments
 (0)