Chapter 2. Setting up OpenShift Pipelines in the web console to view Software Supply Chain Security elements

Procedures

1. In the Developer or Administrator perspective, switch to the relevant project where you want a visual representation of vulnerabilities.

2. Update your existing vulnerability scan task to ensure that it stores the output in the .json file and then extracts the vulnerability summary in the following format:

   # The format to extract vulnerability summary (adjust the jq command for different JSON structures).
   jq -rce \
       '{vulnerabilities:{
         critical: (.result.summary.CRITICAL),
         high: (.result.summary.IMPORTANT),
         medium: (.result.summary.MODERATE),
         low: (.result.summary.LOW)
         }}' scan_output.json | tee $(results.SCAN_OUTPUT.path)

   Note

   You might need to adjust the jq command for different JSON structures.

   1. (Optional) If you do not have a vulnerability scan task, create one in the following format:

      Example vulnerability scan task using Roxctl

      apiVersion: tekton.dev/v1
      kind: Task
      metadata:
        name: vulnerability-scan  1
        annotations:
          task.output.location: results  2
          task.results.format: application/json
          task.results.key: SCAN_OUTPUT  3
      spec:
        params:
          - description: Image to be scanned
            name: image
            type: string
        results:
          - description: CVE result format  4
            name: SCAN_OUTPUT
        steps:
          - name: roxctl
            image: 'quay.io/lrangine/crda-maven:11.0'  5
            env:
              - name: ROX_CENTRAL_ENDPOINT
                valueFrom:
                  secretKeyRef:
                    key: rox_central_endpoint    6
                    name: roxsecrets
              - name: ROX_API_TOKEN
                valueFrom:
                  secretKeyRef:
                    key: rox_api_token   7
                    name: roxsecrets
      
            name: roxctl-scan
            script: | 8
              #!/bin/sh
              curl -k -L -H "Authorization: Bearer $ROX_API_TOKEN" https://$ROX_CENTRAL_ENDPOINT/api/cli/download/roxctl-linux --output ./roxctl
              chmod +x ./roxctl
              ./roxctl image scan --insecure-skip-tls-verify -e $ROX_CENTRAL_ENDPOINT --image $(params.image) --output json  > roxctl_output.json
              jq -rce \
              "{vulnerabilities:{
              critical: (.result.summary.CRITICAL),
              high: (.result.summary.IMPORTANT),
              medium: (.result.summary.MODERATE),
              low: (.result.summary.LOW)
              }}" roxctl_output.json | tee $(results.SCAN_OUTPUT.path)

      1

      The name of your task.

      2

      The location for storing the task outputs.

      3

      The naming convention of the scan task result. A valid naming convention must end with the SCAN_OUTPUT string. For example, SCAN_OUTPUT, MY_CUSTOM_SCAN_OUTPUT, or ACS_SCAN_OUTPUT.

      4

      The description of the result.

      5

      The location of the container image to run the scan tool.

      6

      The rox_central_endpoint key obtained from Advanced Cluster Security for Kubernetes (ACS).

      7

      The rox_api_token obtained from ACS.

      8

      The shell script performs the vulnerability scanning and sets the scan output in the Task run results.

   Note

   This is an example configuration. Modify the values according to your specific scanning tool to set results in the expected format.

3. Update an appropriate Pipeline to add vulnerabilities specifications in the following format:

   ...
   spec:
     results:
       - description: The common vulnerabilities and exposures (CVE) result
         name: SCAN_OUTPUT
         value: $(tasks.vulnerability-scan.results.SCAN_OUTPUT)

Procedure

1. In the Developer or Administrator perspective, switch to the relevant project where you want a visual representation of SBOMs.

2. Add a task in the following format to view or download the SBOM information:

   Example SBOM task

   apiVersion: tekton.dev/v1
   kind: Task
   metadata:
     name: sbom-task 1
     annotations:
       task.output.location: results  2
       task.results.format: application/text
       task.results.key: LINK_TO_SBOM  3
       task.results.type: external-link  4
   spec:
     results:
       - description: Contains the SBOM link  5
         name: LINK_TO_SBOM
     steps:
       - name: print-sbom-results
         image: quay.io/image  6
         script: | 7
           #!/bin/sh
           syft version
           syft quay.io/<username>/quarkus-demo:v2 --output cyclonedx-json=sbom-image.json
           echo 'BEGIN SBOM'
           cat sbom-image.json
           echo 'END SBOM'
           echo 'quay.io/user/workloads/<namespace>/node-express/node-express:build-8e536-1692702836' | tee $(results.LINK_TO_SBOM.path) 8

   1

   The name of your task.

   2

   The location for storing the task outputs.

   3

   The SBOM task result name. Do not change the name of the SBOM result task.

   4

   (Optional) Set to open the SBOM in a new tab.

   5

   The description of the result.

   6

   The image that generates the SBOM.

   7

   The script that generates the SBOM image.

   8

   The SBOM image along with the path name.

3. Update the Pipeline to reference the newly created SBOM task.

   ...
   spec:
     tasks:
       - name: sbom-task
         taskRef:
           name: sbom-task 1
     results:
       - name: IMAGE_URL  2
         description: url
         value: <oci_image_registry_url> 3

   1

   The same name as created in Step 2.

   2

   The name of the result.

   3

   The OCI image repository URL which contains the .sbom images.

4. Rerun the affected OpenShift Pipeline.