2.4. Integrating with your CI pipeline

Procedure

1. Log in to CircleCI and open an existing project or create a new project.
2. Click Project Settings.
3. Click Environment variables.

4. Click Add variable and create the following three environment variables:

   • Name: STACKROX_CENTRAL_HOST - The DNS name or IP address of Central.
   • Name: ROX_API_TOKEN - The API token to access Red Hat Advanced Cluster Security for Kubernetes.
   • Name: DOCKERHUB_PASSWORD - The password for your Docker Hub account.
   • Name: DOCKERHUB_USER - The username for your Docker Hub account.
5. Create a directory called .circleci in the root directory of your local code repository for your selected project, if you do not already have a CircleCI configuration file.

6. Create a config.yml configuration file with the following lines in the .circleci directory:

   version: 2
   jobs:
     check-policy-compliance:
       docker:
         - image: 'circleci/node:latest'
           auth:
             username: $DOCKERHUB_USER
             password: $DOCKERHUB_PASSWORD
       steps:
         - checkout
         - run:
             name: Install roxctl
             command: |
                 curl -H "Authorization: Bearer $ROX_API_TOKEN" https://$STACKROX_CENTRAL_HOST:443/api/cli/download/roxctl-linux -o roxctl && chmod +x ./roxctl
         - run:
             name: Scan images for policy deviations and vulnerabilities
             command: |
                 ./roxctl image check --endpoint "$STACKROX_CENTRAL_HOST:443" --image "<your_registry/repo/image_name>"
         - run:
             name: Scan deployment files for policy deviations
             command: |
                 ./roxctl image check --endpoint "$STACKROX_CENTRAL_HOST:443" --image "<your_deployment_file>"
                 # Important note: This step assumes the YAML file you'd like to test is located in the project.
   workflows:
     version: 2
     build_and_test:
       jobs:
         - check-policy-compliance

   where:

   <your_registry/repo/image_name>

   Specifies your registry and image path.

   <your_deployment_file>

   Specifies the path to your deployment file.

   注意

   If you already have a config.yml file for CircleCI in your repository, add a new jobs section with the specified details in your existing configuration file.

7. After you commit the configuration file to your repository, go to the Jobs queue in your CircleCI dashboard to verify the build policy enforcement.