Secure Pipelines Demo

Sample spring application with Jenkins pipeline script to demonstrate secure pipelines

Pre Requesites

Setup minikube

minikube start --nodes=1 --cpus=4 --memory 8192 --disk-size=35g --embed-certs=true --driver=hyperkit

Stup Jenkins server

helm repo add jenkins https://charts.jenkins.io
helm repo update
helm install jenkins jenkins/jenkins

Get admin user password of Jenkins

  kubectl exec --namespace default -it svc/jenkins -c jenkins -- /bin/cat /run/secrets/chart-admin-password && echo

Note: Make a note of the password

[Optional] Forward Jenkins server port to access from local machine

kubectl port-forward svc/jenkins 8080:8080
open http://localhost:8080

Add additonal plugins to Jeninks server (Manage Jenkins -> Manage plugins)
- BlueOcean
- Configuration as Code
- OWASP Dependency-Track

Refer Dependency Track v4 Installation Guide

Note: dependency-track will take some time to start (~1hr on low end Mac)

Login to Dependency track -> Administration -> Access Management -> Teams -> Click on Automation -> Copy the API Keys -> Also add the Permissions - PROJECT_CREATION_UPLOAD, POLICY_VIOLATION_ANALYSIS, VULNERABILITY_ANALYSIS
Login to Jenkins -> Manage Jenkins -> Configure System -> Scroll to bottom -> Configure the Dependency-Track URL and API key -> Also enable Auto Create Projects -> Test Connection -> Save

Create a new Jenkins pipeline with this repo and trigger build

Login to Jenkins -> New Item -> Enter name and choose Pipeline -> Choose GitHub project and set project URL
Under pipeline section, Choose Pipeline script from SCM
Choose git as SCM and provide repo details
Save

Refer the below screenshot for the stages in the pipeline

Image Malware scanning - ClamAV