mirror of
https://github.com/tektoncd/catalog.git
synced 2024-11-21 05:55:35 +00:00
task: Add generic RHACS task
This commit is contained in:
Yann Brillouet
tekton-robot
parent
f55c6b7c61
commit
edf9ec0987
144
task/rhacs-generic/0.1/README.md
Normal file
144
task/rhacs-generic/0.1/README.md
Normal file
@ -0,0 +1,144 @@
|
||||
# Red Hat Advanced Cluster Security generic Task
|
||||
|
||||
Allows users to customize and extend
|
||||
[`roxctl`](https://docs.openshift.com/acs/cli/command-reference/roxctl.html)
|
||||
command line based on their needs.
|
||||
|
||||
This task first exchanges a service account token against a short-lived RHACS
|
||||
authorization token, then performs the requested action.
|
||||
|
||||
**Note: this Task requires a 4.4.2 roxctl image (task default) or a more recent
|
||||
image version.**
|
||||
|
||||
## Prerequisites
|
||||
|
||||
This task requires an active installation of [Red Hat Advanced Cluster Security (RHACS)](https://www.redhat.com/en/resources/advanced-cluster-security-for-kubernetes-datasheet)
|
||||
or [StackRox](https://www.stackrox.io). It also requires configuration of a
|
||||
machine-to-machine integration.
|
||||
|
||||
<https://www.redhat.com/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes>
|
||||
|
||||
## Install the Task
|
||||
|
||||
```bash
|
||||
kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/rhacs-generic/0.1/raw
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
- **`rox_central_endpoint`**: The address:port tuple for StackRox Central.
|
||||
Default: **central.stackrox.svc:443**
|
||||
- **`insecure-skip-tls-verify`**: Skip verification the TLS certs of the Central
|
||||
endpoint and registry. Examples: _"true", **"false"**_.
|
||||
- **`rox_arguments`**: The command line that you would like to enter, in array
|
||||
form. (required)
|
||||
- `rox_ca_cert_file`: Path to the Central CA PEM file (if certificates are
|
||||
available). The path must be empty if no file is available, or prefixed with
|
||||
`/workspace/ca` otherwise.
|
||||
Examples: _**""**, "/workspace/ca/central-ca.pem"_
|
||||
- `rox_image`: The image providing the roxctl tool (optional).
|
||||
Default: quay.io/stackrox-io/roxctl:4.4.2
|
||||
(this is also the minimum version working with this task).
|
||||
- `output_file`: path to a file where to redirect roxctl standard output.
|
||||
Default: "" (redirects to stdout).
|
||||
- `error_file`: path to a file where to redirect roxctl standard error.
|
||||
Default: "" (redirects to stderr).
|
||||
|
||||
## Workspaces
|
||||
|
||||
- **data**: An [optional Workspace](https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md#optional-workspaces)
|
||||
which stores files used as parameters to the command line.
|
||||
- **ca**: An [optional Workspace](https://github.com/tektoncd/pipeline/blob/main/docs/workspaces.md#optional-workspaces)
|
||||
which stores the Red Hat Advanced Cluster Security Central CA PEM file.
|
||||
It is **strongly** recommended that this workspace be bound to a Kubernetes
|
||||
`Secret`.
|
||||
|
||||
## Usage
|
||||
|
||||
Check the [documentation](https://docs.openshift.com/acs/operating/manage-user-access/configure-short-lived-access.html#configure-short-lived-access_configure-short-lived-access)
|
||||
to configure the trust with the OIDC token issuer. This
|
||||
[example](../../rhacs-m2m-authenticate/0.1/samples/configure-m2m.md) describes
|
||||
a possible RHACS machine-to-machine integration configuration.
|
||||
|
||||
The `roxctl` [documentation](https://docs.openshift.com/acs/cli/command-reference/roxctl.html)
|
||||
describes the available commands and their options.
|
||||
|
||||
**Example task uses:**
|
||||
|
||||
Declarative configuration preparation:
|
||||
```yaml
|
||||
- name: create-access-scope
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
params:
|
||||
- name: insecure-skip-tls-verify
|
||||
value: "true"
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- declarative-config
|
||||
- create
|
||||
- access-scope
|
||||
- --name=testScope
|
||||
- --description=test access scope
|
||||
- --included=testCluster=stackrox
|
||||
```
|
||||
|
||||
Deployment check:
|
||||
```yaml
|
||||
tasks:
|
||||
- name: check-deployment
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
params:
|
||||
- name: insecure-skip-tls-verify
|
||||
value: "true"
|
||||
- name: rox_endpoint
|
||||
value: central.stackrox.svc:443
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- deployment
|
||||
- check
|
||||
- --output=table
|
||||
- --file=/workspace/data/$(params.deployment)
|
||||
workspaces:
|
||||
- name: data
|
||||
workspace: shared-workspace
|
||||
```
|
||||
|
||||
Image scan:
|
||||
```yaml
|
||||
tasks:
|
||||
- name: scan-image
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
params:
|
||||
- name: insecure-skip-tls-verify
|
||||
value: "true"
|
||||
- name: rox_endpoint
|
||||
value: central.stackrox.svc:443
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- image
|
||||
- scan
|
||||
- --output=table
|
||||
- --image=$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)
|
||||
runAfter:
|
||||
- build-image
|
||||
|
||||
```
|
||||
|
||||
**Samples:**
|
||||
|
||||
* [pipeline.yaml](samples/pipeline.yaml) demonstrates use in a pipeline.
|
||||
* [pipelinerun.yaml](samples/pipelinerun.yaml) demonstrates use
|
||||
in a pipelinerun.
|
||||
|
||||
# Known Issues
|
||||
|
||||
107
task/rhacs-generic/0.1/rhacs-generic.yaml
Normal file
107
task/rhacs-generic/0.1/rhacs-generic.yaml
Normal file
@ -0,0 +1,107 @@
|
||||
---
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: rhacs-generic
|
||||
labels:
|
||||
apps.kubernetes.io/version: "0.1"
|
||||
annotations:
|
||||
tekton.dev/tags: security
|
||||
tekton.dev/categories: Security
|
||||
tekton.dev/displayName: "Perform an action with Red Hat Advanced Cluster Security"
|
||||
tekton.dev/platforms: "linux/amd64,linux/arm64,linux/ppc64le,linux/s390x,darwin/amd64,darwin/arm64,windows/amd64"
|
||||
tekton.dev/pipelines.minVersion: "0.50.0"
|
||||
spec:
|
||||
description: >-
|
||||
Performs an action with Red Hat Advanced Cluster Security.
|
||||
|
||||
Actions are performed using the associated command line tool: roxctl.
|
||||
params:
|
||||
- name: rox_image
|
||||
description: Image providing the roxctl tool.
|
||||
default: 'quay.io/stackrox-io/roxctl:4.4.2'
|
||||
- name: rox_central_endpoint
|
||||
description: The address:port tuple for RHACS Stackrox Central.
|
||||
type: string
|
||||
default: central.stackrox.svc:443
|
||||
- name: rox_arguments
|
||||
description: The roxctl command line arguments.
|
||||
type: array
|
||||
- name: rox_ca_cert_file
|
||||
description: |
|
||||
Path to the central CA PEM file.
|
||||
Leave empty if no file is available.
|
||||
Prefix the file path with /workspace/ca when available.
|
||||
type: string
|
||||
default: ''
|
||||
- name: insecure-skip-tls-verify
|
||||
description: |
|
||||
Do not verify TLS certificates.
|
||||
When set to "true", skip verifying the TLS certs of the Central endpoint.
|
||||
type: string
|
||||
default: "false"
|
||||
- name: output_file
|
||||
type: string
|
||||
description: |
|
||||
Path to a file where to write the roxctl standard output stream.
|
||||
If empty, the output stream goes to the container standard output.
|
||||
default: ""
|
||||
- name: error_file
|
||||
description: |
|
||||
Path to a file where to write the roxctl standard error stream.
|
||||
If empty, the error stream goes to the container standard error.
|
||||
type: string
|
||||
default: ""
|
||||
stepTemplate:
|
||||
env:
|
||||
- name: ROX_INSECURE_CLIENT_SKIP_TLS_VERIFY
|
||||
value: $(params.insecure-skip-tls-verify)
|
||||
- name: ROX_CA_CERT_FILE
|
||||
value: $(params.rox_ca_cert_file)
|
||||
- name: ROX_ENDPOINT
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: ROX_CONFIG_DIR
|
||||
value: /rox-config
|
||||
- name: ROX_EXECUTION_ENV
|
||||
value: Tekton
|
||||
- name: ROX_OUTPUT_FILE
|
||||
value: $(params.output_file)
|
||||
- name: ROX_ERROR_FILE
|
||||
value: $(params.error_file)
|
||||
workspaces:
|
||||
- name: ca
|
||||
description: An optional workspace storing the Central CA PEM file.
|
||||
optional: true
|
||||
readOnly: true
|
||||
- name: data
|
||||
description: An optional workspace storing files to pass to the command line tool (as input or output).
|
||||
optional: true
|
||||
steps:
|
||||
- name: exchange-service-account-token
|
||||
image: $(params.rox_image)
|
||||
volumeMounts:
|
||||
- name: token-vol
|
||||
mountPath: /service-account-token
|
||||
- name: roxctl-config
|
||||
mountPath: /rox-config
|
||||
args:
|
||||
- central
|
||||
- m2m
|
||||
- exchange
|
||||
- --token-file=/service-account-token/token
|
||||
- name: roxctl-action
|
||||
image: $(params.rox_image)
|
||||
volumeMounts:
|
||||
- name: roxctl-config
|
||||
mountPath: /rox-config
|
||||
args: ["$(params.rox_arguments[*])"]
|
||||
volumes:
|
||||
- name: token-vol
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: rhacs
|
||||
path: token
|
||||
expirationSeconds: 3600
|
||||
- name: roxctl-config
|
||||
emptyDir: {}
|
||||
185
task/rhacs-generic/0.1/samples/pipeline.yaml
Normal file
185
task/rhacs-generic/0.1/samples/pipeline.yaml
Normal file
@ -0,0 +1,185 @@
|
||||
---
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Pipeline
|
||||
metadata:
|
||||
name: rox-pipeline
|
||||
spec:
|
||||
workspaces:
|
||||
- name: shared-workspace
|
||||
params:
|
||||
- name: deployment
|
||||
type: string
|
||||
description: filename of the deployment to be patched
|
||||
- name: git-url
|
||||
type: string
|
||||
description: url of the git repo for the code of deployment
|
||||
- name: git-revision
|
||||
type: string
|
||||
description: revision to be used from repo of the code for deployment
|
||||
default: main
|
||||
- name: IMAGE
|
||||
type: string
|
||||
description: image to be build from the code
|
||||
- name: rox_central_endpoint
|
||||
type: string
|
||||
description: The address:port tuple for RHACS Stackrox Central.
|
||||
default: central.stackrox.svc:443
|
||||
- name: rox_image
|
||||
type: string
|
||||
description: The Red Hat Advanced Cluster Security container image
|
||||
default: quay.io/stackrox-io/roxctl:4.4.2
|
||||
|
||||
tasks:
|
||||
# fetch central CA
|
||||
- name: fetch-central-ca
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
workspaces:
|
||||
- name: data
|
||||
workspace: shared-workspace
|
||||
params:
|
||||
- name: insecure-skip-tls-verify
|
||||
value: 'true'
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- central
|
||||
- cert
|
||||
- '--output=/workspace/data/central-ca.pem'
|
||||
|
||||
# checkout source code
|
||||
- name: fetch-repository
|
||||
taskRef:
|
||||
name: git-clone
|
||||
kind: ClusterTask
|
||||
workspaces:
|
||||
- name: output
|
||||
workspace: shared-workspace
|
||||
params:
|
||||
- name: url
|
||||
value: $(params.git-url)
|
||||
- name: subdirectory
|
||||
value: ""
|
||||
- name: deleteExisting
|
||||
value: "true"
|
||||
- name: revision
|
||||
value: $(params.git-revision)
|
||||
runAfter:
|
||||
- fetch-central-ca
|
||||
|
||||
# Test access scope creation
|
||||
- name: create-access-scope
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
workspaces:
|
||||
- name: ca
|
||||
workspace: shared-workspace
|
||||
params:
|
||||
- name: rox_ca_cert_file
|
||||
value: /workspace/ca/central-ca.pem
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- declarative-config
|
||||
- create
|
||||
- access-scope
|
||||
- --name=testScope
|
||||
- --description=test access scope
|
||||
- --included=testCluster=stackrox
|
||||
runAfter:
|
||||
- fetch-repository
|
||||
|
||||
# validate deployment against defined RHACS policies
|
||||
- name: police-deployment
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
params:
|
||||
- name: rox_ca_cert_file
|
||||
value: /workspace/ca/central-ca.pem
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- deployment
|
||||
- check
|
||||
- --output=table
|
||||
- --file=/workspace/data/$(params.deployment)
|
||||
workspaces:
|
||||
- name: data
|
||||
workspace: shared-workspace
|
||||
- name: ca
|
||||
workspace: shared-workspace
|
||||
runAfter:
|
||||
- fetch-repository
|
||||
- build-image
|
||||
|
||||
- name: build-image
|
||||
taskRef:
|
||||
name: buildah
|
||||
kind: ClusterTask
|
||||
params:
|
||||
- name: IMAGE
|
||||
value: $(params.IMAGE)
|
||||
- name: TLSVERIFY
|
||||
value: "false"
|
||||
workspaces:
|
||||
- name: source
|
||||
workspace: shared-workspace
|
||||
runAfter:
|
||||
- fetch-repository
|
||||
|
||||
# scan image for vulns using RHACS
|
||||
- name: scan-image
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
workspaces:
|
||||
- name: ca
|
||||
workspace: shared-workspace
|
||||
params:
|
||||
- name: rox_ca_cert_file
|
||||
value: /workspace/ca/central-ca.pem
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- image
|
||||
- scan
|
||||
- --output=table
|
||||
- --image=$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)
|
||||
runAfter:
|
||||
- build-image
|
||||
|
||||
# validate image against RHACS policies
|
||||
- name: police-image
|
||||
taskRef:
|
||||
name: rhacs-generic
|
||||
kind: Task
|
||||
params:
|
||||
- name: insecure-skip-tls-verify
|
||||
value: "true"
|
||||
- name: rox_endpoint
|
||||
value: $(params.rox_central_endpoint)
|
||||
- name: rox_image
|
||||
value: $(params.rox_image)
|
||||
- name: rox_arguments
|
||||
value:
|
||||
- image
|
||||
- check
|
||||
- --output=table
|
||||
- --image=$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)
|
||||
runAfter:
|
||||
- scan-image
|
||||
28
task/rhacs-generic/0.1/samples/pipelinerun.yaml
Normal file
28
task/rhacs-generic/0.1/samples/pipelinerun.yaml
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: PipelineRun
|
||||
metadata:
|
||||
name: rox-pipelinerun
|
||||
spec:
|
||||
pipelineRef:
|
||||
name: rox-pipeline
|
||||
params:
|
||||
- name: deployment
|
||||
value: k8s/deployment.yaml
|
||||
- name: git-url
|
||||
value: https://github.com/openshift/pipelines-vote-api.git
|
||||
- name: git-revision
|
||||
value: pipelines-1.7
|
||||
- name: IMAGE
|
||||
value: image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/pipelines-vote-ui
|
||||
- name: insecure-skip-tls-verify
|
||||
value: "true"
|
||||
workspaces:
|
||||
- name: shared-workspace
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 500Mi
|
||||
6
task/rhacs-generic/OWNERS
Normal file
6
task/rhacs-generic/OWNERS
Normal file
@ -0,0 +1,6 @@
|
||||
approvers:
|
||||
- dhaus67
|
||||
- rhybrillou
|
||||
reviewers:
|
||||
- dhaus67
|
||||
- rhybrillou
|
||||
Loading…
Reference in New Issue
Block a user