forked from tsheth/DockerbaseDSSC
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Jenkinsfile
209 lines (195 loc) · 9.01 KB
/
Jenkinsfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
pipeline {
agent any
stages {
stage('Git Checkout') {
parallel {
stage('Git Checkout') {
steps {
git(url: 'https://github.com/tsheth/docker-exploit-demo.git', credentialsId: 'git-creds')
}
}
stage('Static code analysis') {
steps {
sh '''echo "static code analysis for github code"
sleep 12'''
}
}
}
}
stage('Build') {
parallel {
stage('Build Cluster service') {
steps {
sh '''rm -rf DockerbaseDSSC
git clone https://github.com/tsheth/DockerbaseDSSC.git
cd DockerbaseDSSC
docker build -t cluster-service:latest .'''
}
}
stage('Provision VMware Environment') {
steps {
sh '''/usr/local/bin/terraform init
/usr/local/bin/terraform apply --auto-approve'''
}
}
stage('Build Java Location Service') {
steps {
sh '''rm -rf struts-app
git clone https://github.com/tsheth/struts-app.git
cd struts-app
docker build -t location-service:latest .'''
}
}
}
}
stage('Test') {
parallel {
stage('Performance Test') {
steps {
sh '''echo "local testing results"
sleep 20'''
}
}
stage('Docker image scanning') {
steps {
withCredentials(bindings: [
[$class: 'UsernamePasswordMultiBinding', credentialsId: 'dssc-login-creds', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD'],
[$class: 'UsernamePasswordMultiBinding', credentialsId: 'dssc-scan-creds', usernameVariable: 'SCAN_USERNAME', passwordVariable: 'SCAN_PASSWORD']
]) {
sh '''docker run -v /var/run/docker.sock:/var/run/docker.sock deepsecurity/smartcheck-scan-action --image-name cluster-service:latest --smartcheck-host="ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com" --smartcheck-user=$SCAN_USERNAME --smartcheck-password=$SCAN_PASSWORD --insecure-skip-tls-verify --insecure-skip-registry-tls-verify --preregistry-scan --preregistry-user $USERNAME --preregistry-password $PASSWORD --findings-threshold \'{"malware": 100, "vulnerabilities": { "defcon1": 100, "critical": 100, "high": 200 }, "contents": { "defcon1": 100, "critical": 100, "high": 200 }, "checklists": { "defcon1": 100, "critical": 100, "high": 200 }}\'
docker run -v $WORKSPACE:/root/app shunyeka/dssc-vulnerability-report:latest --smartcheck-host ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com --smartcheck-user $SCAN_USERNAME --smartcheck-password $SCAN_PASSWORD --insecure-skip-tls-verify --min-severity low ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com:5000/cluster-service:latest
mv $WORKSPACE/DSSCReport.xlsx $WORKSPACE/ClusterService-Vulnerability-report.xlsx
curl -F file=@$WORKSPACE/ClusterService-Vulnerability-report.xlsx -F "initial_comment=DSSC report for Cluster service image" -F channels=buildnotification -H "Authorization: Bearer xoxp-375765158032-376600608661-776771608885-6093db05ce4db6b26c68ca36bc42c4cf" https://slack.com/api/files.upload
'''
sh '''docker run -v /var/run/docker.sock:/var/run/docker.sock deepsecurity/smartcheck-scan-action --image-name location-service:latest --smartcheck-host="ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com" --smartcheck-user=$SCAN_USERNAME --smartcheck-password=$SCAN_PASSWORD --insecure-skip-tls-verify --insecure-skip-registry-tls-verify --preregistry-scan --preregistry-user $USERNAME --preregistry-password $PASSWORD --findings-threshold \'{"malware": 100, "vulnerabilities": { "defcon1": 100, "critical": 100, "high": 100 }, "contents": { "defcon1": 100, "critical": 100, "high": 100 }, "checklists": { "defcon1": 100, "critical": 100, "high": 100 }}\'
docker run -v $WORKSPACE:/root/app shunyeka/dssc-vulnerability-report:latest --smartcheck-host ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com --smartcheck-user $SCAN_USERNAME --smartcheck-password $SCAN_PASSWORD --insecure-skip-tls-verify --min-severity low ae586be628a2b4046be3989278a9d2b6-1694873914.us-east-2.elb.amazonaws.com:5000/location-service:latest
mv $WORKSPACE/DSSCReport.xlsx $WORKSPACE/LocationService-Vulnerability-report.xlsx
curl -F file=@$WORKSPACE/LocationService-Vulnerability-report.xlsx -F channels=buildnotification -H "Authorization: Bearer xoxp-375765158032-376600608661-776771608885-6093db05ce4db6b26c68ca36bc42c4cf" https://slack.com/api/files.upload'''
}
script {
slackSend color: "warning", message: "REPORT: ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} created Cluster service and scanned with security tool. To get more details go to http://jenkins.bryceindustries.net:8080/job/DockerbaseDSSC/job/master/${env.BUILD_NUMBER}/execution/node/3/ws/ClusterService-Vulnerability-report.xlsx"
slackSend color: "warning", message: "REPORT: ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} created Location service and scanned with security tool. To get more details go to http://jenkins.bryceindustries.net:8080/job/DockerbaseDSSC/job/master/${env.BUILD_NUMBER}/execution/node/3/ws/LocationService-Vulnerability-report.xlsx"
}
}
}
stage('Integration Test') {
steps {
sh '''echo "Integration test"
sleep 17'''
}
}
stage('Unit test') {
steps {
sh '''echo "Unit test"
sleep 24'''
}
}
}
}
stage('Classify image tag') {
steps {
sh '''echo "docker tag to classify image"
docker tag cluster-service:latest 983592080135.dkr.ecr.us-east-2.amazonaws.com/test-dssc:latest'''
}
}
stage('Push image stage') {
steps {
sh '''# docker login
#1 docker login to AWS ECR ohio (not working)
#docker login -u AWS -p $(aws ecr get-login-password --region us-east-2) https://983592080135.dkr.ecr.us-east-2.amazonaws.com
#2 more dynamic
#aws ecr get-login --region us-east-2 > aws-ecr-pass
#sed -i \'s/-e none//g\' aws-ecr-pass
#bash aws-ecr-pass
#rm aws-ecr-pass
#3 more dynamic
aws ecr get-login --region us-east-2 | sed \'s/-e none//g\' | bash
# Pushing docker image
docker push 983592080135.dkr.ecr.us-east-2.amazonaws.com/test-dssc:latest
'''
}
}
stage('Deploy to Staging') {
steps {
sh '''echo "ECS Application deployment started"
sleep 10'''
}
}
stage('Manual Test Success?') {
steps {
input 'Deployment Approval based on manual testing'
}
}
stage('Classify image for production') {
parallel {
stage('Classify image for production') {
steps {
sh '''# changing image name and tag
docker tag cluster-service:latest 983592080135.dkr.ecr.us-east-2.amazonaws.com/test-dssc:latest
#docker tag cluster-service:latest bryce.azurecr.io/bryce/cluster-service:latest
'''
}
}
stage('Destroy VMware Environment ') {
steps {
sh '''# /usr/local/bin/terraform destroy -target aws_instance.shellshock_host --auto-approve
/usr/local/bin/terraform destroy --auto-approve'''
}
}
}
}
stage('Approve for production deploy') {
steps {
input 'Approved for production deploy'
}
}
stage('Push Prod Image') {
parallel {
stage('Push Prod Image') {
steps {
sh '''# old
#docker login bryce.azurecr.io -u bryce -p +3BMjKEDQVvWuODOMM4SR2iZ1LWtOUMo
#docker push bryce.azurecr.io/bryce/cluster-service:latest
# docker login
# aws ecr get-login-password --region us-east-2 | sudo docker login --username AWS --password-stdin 983592080135.dkr.ecr.us-east-2.amazonaws.com
#2 sudo docker login -u AWS -p $(aws ecr get-login-password --region us-east-2) 983592080135.dkr.ecr.us-east-2.amazonaws.com
#3
#aws ecr get-login-password --region us-east-2 > aws-ecr-pass
#docker login -u AWS -p $(cat aws-ecr-pass) 983592080135.dkr.ecr.us-east-2.amazonaws.com
'''
}
}
stage('Push image to DR ECR region') {
steps {
sh '''echo "Pushing image to AWS DR region"
'''
}
}
}
}
stage('Virtual Patch Prod') {
steps {
sh '''echo "Deep Security virtual patching of server using recommendation scan"
sleep 10'''
}
}
stage('White list Apps') {
steps {
sh '''echo "Deep Security Application control whitelist application"
sleep 5'''
}
}
stage('Deplo to Prod') {
steps {
sh '''echo "Deploy application to production"
sleep 7'''
}
}
stage('Stop Whitelist App') {
steps {
sh '''echo "Deep security stop whitelisting of app using Application control"
sleep 3'''
}
}
}
}