Chapter 2. Integrating with CI systems

Procedure

1. In the RHACS portal, go to Platform Configuration Policy Management.
2. Use global search to search for Lifecycle Stage:Build.

Procedure

1. In the RHACS portal, go to Platform Configuration Integrations.
2. Under the Image Integration section, look for highlighted Registry tiles. The tiles also list the number of items already configured for that tile.

Procedure

1. After you have generated the authentication token, export it as the ROX_API_TOKEN variable by entering the following command:

   $ export ROX_API_TOKEN=<api_token>

   Copy to Clipboard Toggle word wrap

2. (Optional): You can also save the token in a file and use it with the --token-file option by entering the following command:

   $ roxctl central debug dump --token-file <token_file>

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the registry.redhat.io registry.

   $ docker login registry.redhat.io

   Copy to Clipboard Toggle word wrap

2. Pull the latest container image for the roxctl CLI.

   $ docker pull registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8:4.9.0

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to CircleCI and open an existing project or create a new project.
2. Click Project Settings.
3. Click Environment variables.

4. Click Add variable and create the following three environment variables:

   • Name: STACKROX_CENTRAL_HOST - The DNS name or IP address of Central.
   • Name: ROX_API_TOKEN - The API token to access Red Hat Advanced Cluster Security for Kubernetes.
   • Name: DOCKERHUB_PASSWORD - The password for your Docker Hub account.
   • Name: DOCKERHUB_USER - The username for your Docker Hub account.
5. Create a directory called .circleci in the root directory of your local code repository for your selected project, if you do not already have a CircleCI configuration file.

6. Create a config.yml configuration file with the following lines in the .circleci directory:

   version: 2
   jobs:
     check-policy-compliance:
       docker:
         - image: 'circleci/node:latest'
           auth:
             username: $DOCKERHUB_USER
             password: $DOCKERHUB_PASSWORD
       steps:
         - checkout
         - run:
             name: Install roxctl
             command: |
                 curl -H "Authorization: Bearer $ROX_API_TOKEN" https://$STACKROX_CENTRAL_HOST:443/api/cli/download/roxctl-linux -o roxctl && chmod +x ./roxctl
         - run:
             name: Scan images for policy deviations and vulnerabilities
             command: |
                 ./roxctl image check --endpoint "$STACKROX_CENTRAL_HOST:443" --image "<your_registry/repo/image_name>" 

   1

   
         - run:
             name: Scan deployment files for policy deviations
             command: |
                 ./roxctl image check --endpoint "$STACKROX_CENTRAL_HOST:443" --image "<your_deployment_file>" 

   2

   
                 # Important note: This step assumes the YAML file you'd like to test is located in the project.
   workflows:
     version: 2
     build_and_test:
       jobs:
         - check-policy-compliance

   Copy to Clipboard Toggle word wrap

   1

   Replace <your_registry/repo/image_name> with your registry and image path.

   2

   Replace <your_deployment_file> with the path to your deployment file.

   Note

   If you already have a config.yml file for CircleCI in your repository, add a new jobs section with the specified details in your existing configuration file.

7. After you commit the configuration file to your repository, go to the Jobs queue in your CircleCI dashboard to verify the build policy enforcement.