Chapter 3. Updating code and viewing security insights

When you create a component with RHTAP, the system triggers a build pipeline. After the build pipeline completes, it deploys the latest version of the application to the development namespace. By default, the development namespace is rhtap-app-development.

To view the pipeline run:

Open RHTAP and go to the Catalog.
Select the modified component and go to the CI tab to view pipeline run details.
Optionally, use the following tabs for additional insights:
1. CD: View deployment data managed by ArgoCD.
2. Topology: Visualize your application deployment in the development namespace.

Note

In some cases, the pipeline run might not appear immediately after the component is built. If you do not see a pipeline run after one minute, update the component’s source code to trigger a new pipeline run.

3.1. Updating source code
Copy link

Go to the Catalog and select the component you want to update.
On the Overview tab, select View Source to open the project in GitLab or GitHub.
Optionally, select View Tech Docs to open the project’s documentation. The source is located in the docs/ directory of your repository. Updates to this directory trigger a pipeline run to refresh the Tech Docs.
Make the necessary changes to your code:
1. Clone your repository.
2. Modify your files. For example, update technical documentation or edit index.html.
3. Commit and push your changes.

Note

You can also use the GitLab or GitHub UI to make code changes directly in your browser.
For GitLab and Bitbucket users: To trigger pipeline runs automatically after code updates, you must set up webhooks and secrets in GitLab or Bitbucket.
- For instructions on setting up webhooks in GitLab and Bitbucket, see Configuring webhooks in GitLab and Bitbucket.
- For instructions on setting up secrets in GitLab, see: Configuring GitLab CI.
- For instructions on setting up secrets in Bitbucket, see: Configuring Jenkins.

3.2. Viewing security insights
Copy link

The system automatically triggers an on-push pipeline when you update your code and push changes. By default, RHTAP uses a standard build pipeline for containerized deployment meeting Software Artifacts (SLSA) level 3 specifications.

Figure 3.1. A successful pipeline run

The pipeline run performs the following tasks:

init: Configures rebuild flags, authentication, and creates an image repository secret.
clone-repository: Clones the repository to prepare for the build.
build-container:
- Creates a container image from the source code using Buildah and pushes it to a registry.
- Generates a Software Bill of Materials (SBOM) to document all components and dependencies.
- Publishes security artifacts like image signatures and attestations.
update-deployment: Updates the GitOps repository to deploy the new image.
acs tasks: Runs security checks to ensure compliance with policies.
show-sbom: Lists all software components and libraries for transparency.
summary: Cleans up resources and provides a summary of the pipeline run.

Note

Click any task in a pipeline run to view logs.

3.2.1. Red Hat Advanced Cluster Security tasks
Copy link

RHACS tasks in the pipeline succeed only if you have installed and configured RHACS during the RHTAP installation process. If RHACS is not installed or configured, pipeline skips these tasks.

Note

For detailed instructions on installing RHACS, refer Installing Red Hat Advanced Cluster Security for Kubernetes.
If you did not install and configure RHACS during the RHTAP installation process, refer Configure ACS.

Figure 3.2. The RHACS tasks in the pipeline run

The pipeline includes three RHACS tasks that use roxctl to perform security checks:

roxctl image scan - Identifies components and vulnerabilities in the image and returns results in the JSON format.
roxctl image check - Verifies build-time security violations in the image. For example, policy such as 'No log4j allowed' or restrictions against including curl, wget, or package managers in production images.
roxctl deployment check - Checks for build-time and deploy-time security violations in the YAML deployment files.

Visualizing RHACS reports

In RHDH, under the CI tab, the Pipeline Runs section displays detailed task reports in a structured pop-up interface. The pop-up includes:

Red Hat Advanced Cluster Security (conditionally shown on the availability of RHACS tasks): Displays individual tabs for all the RHACS tasks, summarizing identified security issues.
Others: Provides results from the PipelineRun, for example, IMAGE_URL, and IMAGE_DIGEST. This section displays only if multiple sections (for example, Enterprise Contract or RHACS) are available in the pop-up.

To view RHACS reports:

Select Catalog and select the component you want to review.
Select the CI tab > Actions column > View output icon and review the detailed RHACS reports for the selected component.
Figure 3.3. The detailed RHACS reports

Note
If you have the required permissions, you can manage vulnerabilities, policies, and review detailed vulnerability reports for a specific image in the RHACS console. For more information, see Viewing the dashboard.

Interpreting RHACS reports

Reports from RHACS tasks provide security insights that are critical for maintaining a strong security posture.

Here’s an example of interpreting roxctl image scan (Image Scan) reports. Use the same approach for roxctl image check (Image Check) and roxctl deployment check (Deployment Check) reports.

Vulnerability Breakdown: RHACS categorize detected vulnerabilities by severity (Critical, Important, Moderate, Low), status (fixable, non-fixable), and offer a summary of the scan results. This categorization includes the total number of vulnerabilities and components analyzed, alongside specific Common Vulnerabilities and Exposures (CVEs) identified.
Details Provided: For each identified vulnerability, the report includes:
- CVE ID: A unique identifier for the vulnerability.
- Severity: The level of threat posed by the vulnerability.
- Component: The software component affected by the vulnerability.
- Component Version: The version of the affected component.
- Remediation Suggestions: Recommendations for addressing the vulnerability, including the version in which the vulnerability is fixed, if applicable.

3.2.2. Understanding SBOM
Copy link

The show-sbom task creates a list of all software libraries used in the application. This helps identify vulnerabilities and assess security impacts.

Figure 3.4. The show-sbom task in the pipeline run

Viewing SBOM

Procedures

Select Catalog and select a component.
Select the CI tab and then select the link icon for the show-sbom task. The system displays the SBOM task logs. Review the SBOM in your browser and search for vulnerabilities such as log4j.
Figure 3.5. The SBOM details

Downloading an SBOM in the CLI

Prerequisites

You have installed the Cosign CLI tool.
The build-container and show-sbom tasks ran successfully.

Procedures

Expand the successful pipeline run and select the show-summary task.
Search and copy the SBOM image URL, and run the following command on your terminal.
Example cosign command
```
$ cosign download sbom <the-sbom-url-you-copied>
```
1. (Optional) Save the output to a file for detailed analysis:
  Example cosign command
  $ cosign download sbom <the-sbom-url-you-copied> > sbom.txt

Interpreting SBOMs

The SBOM includes information about each library used in your project, such as:

The source of the library, author or publisher
The library name
The library version
The license type

This information helps ensure individual libraries are safely-sourced, updated, and compliant.

Example SBOM

{
    "bomFormat": "CycloneDX",
    "specVersion": "1.4",
    "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220",
    "version": 1,
    "metadata": {
        ...
    },
    "components": [
        {
            "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8",
            "type": "library",
            "author": "Armin Ronacher <armin.ronacher@active-4.com>",
            "name": "Flask",
            "version": "2.1.0",
            "licenses": [
                {
                    "license": {
                        "id": "BSD-3-Clause"
                    }
                }
            ],
            "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*",
            "purl": "pkg:pypi/Flask@2.1.0",
            "properties": [
                {
                    "name": "syft:package:foundBy",
                    "value": "python-package-cataloger"
                    ...

Chapter 3. Updating code and viewing security insights

3.1. Updating source code
Copy link

3.2. Viewing security insights
Copy link