[{"_1":2,"_162":-5,"_163":-5},"loaderData",{"_3":4,"_18":19,"_26":27,"_141":142},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":22,"_24":11,"_25":22},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_28":29,"_30":-5,"_31":11,"_32":11,"_33":34,"_35":36,"_37":-5,"_38":11,"_39":40,"_89":-5,"_90":91,"_129":-5,"_130":11,"_131":22,"_132":11,"_133":11,"_134":-5,"_135":11,"_136":-5,"_137":138,"_139":92,"_140":-7},"canonicalUrl","https://hub.docker.com/r/hosamarnous/devsecops/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","hosamarnous","reponame","devsecops","cloudBuildSource","isAutobuildsAvailable","repo",{"_41":42,"_43":44,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":56,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":75,"_80":11,"_81":82,"_86":34,"_87":88},"categories",[],"content_types",[45],"image","date_registered","2018-08-25T07:40:30.791158Z","description","","is_private","last_updated","2018-08-25T11:57:35.011099Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[57],"application/vnd.docker.container.image.v1+json","name","pull_count",246,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# DevSecOps\n

\n
\n $\"Lotion\"$ \n
\n Sample Web Application with DevSecOps Pipeline \n
\n
\n

\n\n

Powered by IBM Kubernetes Service, IBM Application Security, and Jenkins

\n\n

\n \n $\"Travis$ \n \n

\n
\n\n## Learning Objectives?\n1. Understand basic Kubernetes and Docker concepts\n2. Using IBM Kubernetes Service\n3. Deploying application to Kubernetes\n4. Building and creating Dockerfile\n5. Container and Application Security\n5. Implementing a DevSecOps Continous Delivery pipeline using Jenkins, IBM Application Security, GitHub, and Aqua Micro-Scanner\n\n## Prerequisites\n1. Signup to [IBM Cloud](https://console.bluemix.net/)\n2. Signup to [IBM Application Security Free Trial](https://www.ibm.com/ae-en/marketplace/application-security-on-cloud)\n3. Signup to [Github](https://github.com/)\n4. Signup to [Docker Hub](https://hub.docker.com/)\n5. Install [Kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)\n6. Install [Docker](https://docs.docker.com/install/)\n7. Install [IBM Cloud CLI](https://console.bluemix.net/docs/cli/reference/ibmcloud/download_cli.html#install_use)\n8. Install [GitCli](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)\n## What are we building?\nSample Angular Application where building, security testing, and deployment of the application is automated. \n\n## Application Architecture\n![1](images/2.png)\n\n#### Featured technologies\n1. [Angular4](https://angular.io/):- Angular is a platform that makes it easy to build applications with the web. Angular combines declarative templates, dependency injection, end to end tooling, and integrated best practices to solve development challenges\n2. [Nodejs](https://nodejs.org/en/):- An open-source JavaScript run-time environment for executing server-side JavaScript code.\n3. [Typescript](https://www.typescriptlang.org/):- TypeScript is an open-source programming language developed and maintained by Microsoft. It is a strict syntactical superset of JavaScript, and adds optional static typing to the language\n4. [Docker](https://www.docker.com/):- Docker is an open platform for developers and sysadmins to build, ship, and run distributed applications, whether on laptops, data center VMs, or the cloud.\n5. [Kubernetes](https://kubernetes.io/):- Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications\n6. [Jenkins](https://jenkins.io/):- Jenkins is an open source automation server written in Java. Jenkins helps to automate the non-human part of the software development process, with continuous integration and facilitating technical aspects of continuous delivery.\n7. [IBM Application Security ](https://www.ibm.com/ae-en/marketplace/application-security-on-cloud):- IBM Application Security on Cloud is a cloud app security offering that helps secure your organization's Web, cloud, mobile, and other applications. It detects dozens of today's most pervasive security vulnerabilities and enhances your application security.\n8. [Aqua Micro Scanner](https://github.com/aquasecurity/microscanner):- Aqua Security's MicroScanner lets you check your container images for vulnerabilities. If your image has any known high-severity issue, MicroScanner can fail the image build, making it easy to include as a step in your CI/CD pipeline.\n9. [Docker Cloud](https://cloud.docker.com/):- Docker Cloud is the name of the new cloud service by Docker that expands on the features of Tutum, brings a tighter integration with Docker Hub, and provides new updates and fixes\n10. [Github](https://github.com/):- GitHub Inc. is a web-based hosting service for version control using Git. It is mostly used for computer code\n\n### Setting a Cluster in IBM Kubernetes Service\n1. Go to [IBM Cloud console](https://console.bluemix.net/dashboard/apps/)\n2. Navigate to containers\n![1](images/3.png)\n\n3. Click on create new cluster\n![10](images/4.png)\n\n4. Name your cluster and create a cluster, wiat for few minutes to get it fully deployed. After it is fully deployed click on the cluster\n![11](images/5.png)\n \n* This shows overview of your deployed cluster \n5. Click on Access tab and follow the instruction on the website\n6. Install the container service plugin.\n```\n$ ibmcloud plugin install container-service -r Bluemix\n```\n7. Log in to your IBM Cloud account.\n```\n$ ibmcloud login -a https://api.eu-de.bluemix.net\n$ ibmcloud cs region-set eu-central\n```\n7. Set the context for the cluster in in your CLI.\n* Get the command to set the environment variable and download the Kubernetes configuration files.\n```\n$ ibmcloud cs cluster-config NameOfYourCluster\n```\n* Set the KUBECONFIG environment variable. Copy the output from the previous command and paste it in your terminal. The command output should look similar to the following.\n8. Verify that you can connect to your cluster by listing your worker nodes\n```\n$ kubectl get nodes\n```\n![6](images/6.png)\n\n> You will be able to access your cluster now hosted in IBM Kubernetes Service\n\n### Fork the repo\n1. Fork the [DevSecOps Repo](https://github.com/SaifRehman/devsecops-pipeline)\n2. Clone your forked repo locally\n\n### Deploy Jenkins to Kubernetes Cluster\n1. Navigate to ```jenkins``` folder \n2. Deploy ```Kubernetes Deployment``` and ```Kubernetes services```\n```\n$ kubectl create -f jenkins.yml\n```\n3. Check if its deployed and running \n```\n$ kubectl get pods\n```\n![7](images/7.png)\n\n> This mean jenkin pod is up and running sucessfully\n4. Check ip to access, go to your cluster and note down ip\n\n![8](images/8.png)\n\n> jenkins is hosted in port 30012\n\n5. You will be able to access jenkins http://ip:30012\n\n![9](images/9.png)\n\n6. Install required plugin to create our first pipeline. Go to ``` Manage Jenkins ```, then click on ``` Manage Plugins ```, select ``` available tab ```\n\n![10](images/10.png)\n\n> you will see something like this\n\n* Install plugin ```Custom Tools Plugin```\n* Install plugin ```GitHub Integration Plugin```\n* Install plugin ```IBM Application Security on Cloud```\n* Install plugin ```Pipeline```\n > Note: this jenkins has aready installed kubectl and docker \n### Configuring Aqua vulneribility Scanner\n1. Go to this link, sign up and get the token in your email ```https://microscanner.aquasec.com/signup```\n2. Replace ```xxx``` in line 19 with your api key\n\n![15](images/15.png)\n\n### Connecting Github to DockerCloud for autonomous image build and push\n1. Go to [Docker Cloud](https://cloud.docker.com/) and sign in, then click on ```repository tab ```\n2. Click on your name on top right side and select ``` Personal Settings```\n3. Select ```Service Providers```\n4. Then go ``` linked accounts ``` and activate github\n\n![11](images/11.png)\n\n5. Click on ```repositories``` on top tab, click on create\n\n![12](images/12.png)\n\n6. Give name to your docker image, then click on ```github icon```, select ```organization``` then select the repository you forked\n\n> You are all set! Lets double check!\n\n7. Go to your forked github repo, select ```settings```, select ```webhooks```, you will see a webhook created automagically ;)\n\n![13](images/13.png)\n\n> Now if you commit and push to github image build will be triggered automagically ;)\n\n8. Go to ```Docker cloud```, select your image and click on ```timeline```\n\n![14](images/14.png)\n\n### Connecting Jenkins with Kubernetes for automated deployment once image is built\n#### Confguring jenkins pod\n1. Configure kubectl in jenkins pod\n```\n$ kubectl get pods\n```\n> note down pod name\n\n2. Copy .pem and .yml file provided by IBM Kubernetes service to jenkins pod in ```/bin``` directory \n3. Note down where cluster configuration files are hosted\n```\n$ ibmcloud cs cluster-config mycluster\n```\n![16](images/16.png)\n4. copy both pem and .yml file\n```\n$ kubectl cp /Users/saifrehman/.bluemix/plugins/container-service/clusters/mycluster/kube-config-mel01-mycluster.yml /bin\n$ kubectl cp /Users/saifrehman/.bluemix/plugins/container-service/clusters/mycluster/ca-mel01-mycluster.pem /bin\n```\n> this is example, your files may have different names\n5. ssh to your cluster, and set the kubeconfig\n```\n$ kubectl exec -it podname /bin/bash\n$ export KUBECONFIG=/bin/kube-config-mel01-mycluster.yml\n```\n6. Go to service-deployent.yml file and replace image with name of your image you created ```yourid/imagename```\n> check line 14\n![17](images/17.png)\n\n#### Configure webhook\n1. Go to your forked github repo, select ```settings```, select ```webhooks```, create a webhook, select ```application.json```\n2. Set your ```project URL```. This is your jenkinsip:30012/github-webhook/ \n![22](images/22.png)\n\n#### Creating your first jenkins pipeline \n1. Go to your ```ip:30012``` which has your jenkins installation\n2. Click ```New Item```, name your project and select ```freestyle project```\n3. Select ```GitHub Project```, and add your github link\n \n![18](images/18.png)\n \n4. From ```Source Code Management``` select ```Git```. Add your repository git url\n\n![19](images/19.png)\n\n5. From ```Build Triggers```, select ```GitHub hook trigger for GITScm polling```\n![20](images/20.png)\n\n6. Click on add build step, select ```execute shell`` ....\n7. Paste in following code \n```sh\n#!/bin/bash\nsleep 1000\necho 'hello'\nif [ ! -d \"facial-recognition\" ]; then\n su - root -c 'git clone https://github.com/SaifRehman/facial-recognition.git'\nfi\nsu - root -c \"cd facial-recognition && git pull && export KUBECONFIG=/bin/kube-config-mel01-mycluster.yml && kubectl delete deployments angular && kubectl apply -f service-deployment.yml\"\n```\n![21](images/21.png)\n> you will have different github link, and different KUBECONFIG\n8. Click on ``` Apply```, then click on ```Save```\n\n### Configure IBM Application Security with jenkins\n1. Sign in [IBM Application Security](https://appscan.ibmcloud.com/AsoCUI/serviceui/home)\n2. Click on hamburger menu and select ```settings/api```\n3. Click generate, note down both ```id``` and ```secret```\n\n![23](images/23.png)\n> Note:- dont share the credentials :)\n> It will ask you to download ```DomainVerification.html```. download that and add it ```src``` folder\n\n4. Go to your jenkins instance\n5. Click on ```Credential```, then click on ```system```, then click on ``` Global credentials (unrestricted)```, select ```add credential```\n6. Select ```IBM Application Security on Cloud Credentials``` from ```kind```\n![24](images/24.png)\n7. Add valid credential you obtained.\n8. Click ok\n9. Go to jenkins homepage. Select your freestyle project you created. Click on ```configure```\n10. scroll down and click on. Click on ``` Add Build step```, select ```Run Security Test```\n11. Select the credentials you set before\n12. Give application name, and test name\n13. Select ```dynamic analyzer ``` from test type \n\n![25](images/25.png)\n\n14. Click on ``` Apply```, then click on ```Save```\n> you are all set :)\n\nGo to **IBM Application Security on Cloud**, then go to ```My Scan``` from hamburger menu. you can see all your scans which were automatically generated\n\n![26](images/26.png)\n\nYou can now download a sample report and look at it \n\n![27](images/27.png)\n\n### Future work \n1. Implement docker image build in jenkins\n2. More to come, cant think of any now :P\n\n# Conclusion\nYou were able to create a end to end simple continuous deployment pipeline with test driven security.\n\n","has_starred","hub_user","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":22,"_84":11,"_85":11},"read","write","admin","user","storage_size",28847219,"orgData","recentTags",[92],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":101,"_51":118,"_119":95,"_120":34,"_121":57,"_58":122,"_123":124,"_125":109,"_126":118,"_127":67,"_128":22},"content_type","creator",3871562,"full_size",25853387,"id",33886423,"images",[102],{"_103":104,"_105":106,"_107":49,"_108":109,"_110":111,"_112":113,"_114":49,"_115":-5,"_116":97,"_64":67,"_117":-5},"architecture","amd64","digest","sha256:f30f479dbbe1a610b9c3ab437f6b1a5b9bef44b511a63288e57f7e7a3d5a3144","features","last_pulled","2026-10-19T15:11:58.189096118Z","last_pushed","2018-08-25T11:30:06Z","os","linux","os_features","os_version","size","variant","2018-08-25T11:57:34.238815Z","last_updater","last_updater_username","media_type","latest","repository",5932149,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_39":143,"_150":151,"_137":160,"_161":11},{"_41":144,"_43":145,"_46":47,"_48":49,"_50":11,"_51":52,"_53":54,"_55":146,"_58":36,"_33":34,"_59":60,"_61":45,"_62":63,"_64":65,"_66":67,"_68":-5,"_69":63,"_70":71,"_72":11,"_73":34,"_74":147,"_80":11,"_81":149,"_86":34,"_87":88},[],[45],[57],{"_76":11,"_77":148},[79],{"_83":22,"_84":11,"_85":11},"tags",{"_152":65,"_153":-5,"_154":-5,"_155":156},"count","next","previous","results",[157],{"_93":45,"_94":95,"_96":97,"_98":99,"_100":158,"_51":118,"_119":95,"_120":34,"_121":57,"_58":122,"_123":124,"_125":109,"_126":118,"_127":67,"_128":22},[159],{"_103":104,"_105":106,"_107":49,"_108":109,"_110":111,"_112":113,"_114":49,"_115":-5,"_116":97,"_64":67,"_117":-5},[],"canDeleteTags","actionData","errors"]

\n \n \n \n Sample Web Application with DevSecOps Pipeline \n \n \n

Powered by IBM Kubernetes Service, IBM Application Security, and Jenkins

\n
\n $\"Lotion\"$ \n
\n Sample Web Application with DevSecOps Pipeline \n
\n
\n

hosamarnous/devsecops

Tags for hosamarnous/devsecops