Method for realizing DevSecOps in container arrangement cluster

Abstract

The invention discloses a method for realizing DevSecOps in a container arrangement cluster. The method comprises the following steps: S1, Jenkins dynamically generates an assembly line container in the container arrangement cluster; s2, mounting network storage on an assembly line construction container, decompressing the Gitleaks and Dependency-Check installation packages, then putting the Gitleaks and Dependency-Check installation packages into a network storage directory, and enabling the assembly line to use the Gitleaks and Dependency-Check installation packages in a sharing mode; s3, the SonarQube is integrated with a Dependency-Check display report, and the Dependency-Check display report is integrated with the SonarQube; and S4, writing JenkinsFile, and connecting all tools in series for use. According to the method, DevOps in a traditional virtual machine environment is transformed into DevSecOps in a container orchestration cluster environment, so that the efficiency and accuracy of security examination are improved, the labor cost is reduced, the high efficiency and security of software delivery are realized, and the container orchestration cluster is protected from being damaged by security threats.

Description

Technical Field

[0001] The present invention relates to the technical field of container orchestration cluster environment, and in particular to a method for implementing DevSecOps in a container orchestration cluster. Background Art

[0002] In recent years, with the development and widespread application of container technology, container orchestration has become the main technology for managing large-scale microservice architectures. However, the challenges that come with it, such as security and continuous delivery, have become increasingly prominent. The concept of secure development and operation has emerged, aiming to integrate security into the entire software life cycle. Applying the DevSecOps concept to container orchestration clusters has become the key to improving the speed and security of software delivery, ensuring the security and stability of the system while ensuring rapid iteration and continuous delivery.

[0003] DevSecOps Toolchain: (1) Jenkins: a continuous integration tool used to link various tools and achieve automated release; (2) GitLab: code management tool used for application development code management; (3) Gitleaks: Code analysis tool for detecting and preventing hard-coded secrets in code repository, such as passwords, API keys, and tokens; (4) Sonatype Nexus: a repository management tool used to upload and pull Maven or npm dependencies related to the application development process; (5) SonarQube: a code quality tool used to detect quality issues such as defects and duplication in the code; (6) Dependency-Check: A component vulnerability testing tool that checks the code for any known, publicly disclosed security vulnerabilities.

[0004] (7) Trivy: An image security scanning tool that checks container images for any known, publicly disclosed security vulnerabilities. The present invention opens up the DevSecOps tool chain to realize the whole process of code pulling, code compilation, code security scanning, container image production, container image security scanning, and finally deployment to the container orchestration cluster. Summary of the invention

[0005] The purpose of the present invention is to propose a method for implementing DevSecOps in a container orchestration cluster in response to the above technical problems.

[0006] A method for implementing DevSecOps in a container orchestration cluster includes the following sub-steps: S1: Jenkins dynamically generates pipeline containers in the container orchestration cluster; S2: The pipeline building container mounts network storage, extracts the Gitleaks and Dependency-Check installation packages, and places them in the network storage directory for the pipeline to use through sharing; S3: SonarQube integrates Dependency-Check to display reports; S4: Write JenkinsFile to use various tools in series.

[0007] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, where the step S1 includes the following sub-steps: S11: Jenkins installs the kubernetes-plugin plugin; S12: Use kubeconfig to configure the Kubernetes cluster information; S12: Configure the specified image in the pipeline building container and the build environment required by the application; The build environment includes maven and nodejs.

[0008] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, where the step S3 includes the following sub-steps: S31: Search for Dependency-Check in the SonarQube plugin store and install it; S32: Browse the Dependency-Check report in SonarQube.

[0009] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, where the step S4 includes the following sub-steps: S41: Set the agent block: Specify the environment where the pipeline runs, use nodes with the maven label, and use containers with Maven and JDK to run each stage of the pipeline; S42: Set the stages block: Divide the pipeline into multiple stages, and each stage executes independent tasks; S43: Set the environment block: Define the environment variables used in the pipeline; The environment variables include Git repository information, application information, image repository information, and SonarQube information; S44: Set the options block: Define the control options of the pipeline; The control options include the number of build logs to be retained, prohibiting concurrent builds, and the maximum execution time of the pipeline.

[0010] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, the following sub-steps for step S42: S421: Code pulling: Pull the code of the specified branch from the Git repository; S422: Sensitive information scanning: Use the Gitleaks tool to scan for sensitive information in the code: If there is sensitive information, generate a report and continue the pipeline; If there is no sensitive information, continue scanning until all code has been scanned; S423: Code compilation: Use Maven to compile the Java code and package it into a JAR file; S424: Artifact dependency security check: Use the dependency-check tool to scan the generated JAR package to detect whether the dependent libraries are secure and generate a security report; S425: Code quality inspection: Use onar-scanner to scan the code quality and send the results to the SonarQube server for display and analysis; S426: Quality gate: Determine whether to continue the pipeline according to the rules of the SonarQube quality gate: If the quality gate is not passed, the pipeline will be paused or failed; If the quality gate is passed, the pipeline continues; S427: Code coverage: Use the Jacoco tool to generate a coverage report to check the code coverage and adjust the code test quality; S428: Artifact archiving: Archive the sensitive information inspection report, the compiled JAR file, and the dependency security check report for downloading and viewing; S429: Generate Dockerfile: Generate a Dockerfile to define a Docker image based on OpenJDK for building the compiled JAR package; S4210: Generate image: Use the generated Dockerfile to build a Docker image; S4211: Image push: After authentication, push the built Docker image to the container image repository; S4212: Generate Kubernetes: Dynamically generate a Kubernetes deployment file according to the configuration information of the application; S4213: Deployment: Execute the kubect command through the configured kubeconfig file to deploy the application to the Kubernetes cluster.

[0011] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, where the code of the specified branch includes git_branch, git_url, and git_auth; The git_branch and git_url are used to obtain the content of the code repository; The git_auth is an identity credential, and identity authentication is performed through git_auth; The sensitive information includes but is not limited to passwords and API keys; The Kubernetes deployment file is used to run the application in the container platform.

[0012] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, where the step S423 includes the following sub-steps: S4231: Select to skip the test and directly compile the code; S4232: Generate the JAR file in the target directory and pull the dependencies using the Nexus credential.

[0013] Beneficial effects of the present invention: Through a method for implementing DevSecOps in a container orchestration cluster, based on the container orchestration technology Kubernetes cluster, transform DevOps in the traditional virtual machine environment into DevSecOps in the container orchestration cluster environment, comprehensively apply the concept of secure software development, improve the efficiency and accuracy of security reviews, reduce labor costs, achieve the high efficiency and security of software delivery, improve the productivity of software development teams, and protect the container orchestration cluster from security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flowchart of a method for implementing DevSecOps in a container orchestration cluster. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0015] For a clearer understanding of the technical features, objectives, and effects of the present invention, the specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0016] As shown in the append Figure 1 drawing, a method for implementing DevSecOps in a container orchestration cluster includes the following sub-steps: S1: Jenkins dynamically generates a pipeline container in the container orchestration cluster; S2: The pipeline constructs a container to mount network storage, extracts the Gitleaks and Dependency-Check installation packages and places them in the network storage directory for the pipeline to use through sharing; S3: SonarQube integrates Dependency-Check to display reports; S4: Write JenkinsFile to chain up various tools for use.

[0017] Further, a method for implementing DevSecOps in a container orchestration cluster, the step S1 includes the following sub-steps: S11: Jenkins installs the kubernetes-plugin plugin; S12: Use kubeconfig to configure the Kubernetes cluster information; S12: Configure the specified images in the pipeline construction container and the build environment required by the application; The build environment includes maven and nodejs.

[0018] Further, a method for implementing DevSecOps in a container orchestration cluster, the step S3 includes the following sub-steps: S31: Search for Dependency-Check in the SonarQube plugin store and install it; S32: Browse the Dependency-Check reports in SonarQube.

[0019] Further, a method for implementing DevSecOps in a container orchestration cluster, the step S4 includes the following sub-steps: S41: Set the agent block: Specify the environment where the pipeline runs, use the nodes with the maven label, and use the containers with Maven and JDK to run each stage of the pipeline; S42: Set the stages block: Divide the pipeline into multiple stages, and each stage executes independent tasks; S43: Set the environment block: Define the environment variables used in the pipeline; The environment variables include Git repository information, application information, image repository information, and SonarQube information; S44: Set the options block: Define the control options of the pipeline; The control options include the number of retained build logs, prohibition of concurrent builds, and the maximum execution time of the pipeline.

[0020] Furthermore, a method for implementing DevSecOps in a container orchestration cluster, the following sub-steps for step S42: S421: Code Pulling: Pull the code of the specified branch from the Git repository; S422: Sensitive Information Scanning: Use the Gitleaks tool to scan for sensitive information in the code: If sensitive information exists, generate a report and continue the pipeline; If no sensitive information exists, continue scanning until all code has been scanned; S423: Code Compilation: Use Maven to compile the Java code and package it into a JAR file; S424: Artifact Dependency Security Check: Use the dependency-check tool to scan the generated JAR package, detect whether the dependency libraries are secure, and generate a security report; S425: Code Quality Inspection: Use onar-scanner to scan the code quality and send the results to the SonarQube server for display and analysis; S426: Quality Gate: Determine whether to continue the pipeline according to the rules of the SonarQube quality gate: If the quality gate is not passed, the pipeline will be paused or failed; If the quality gate is passed, the pipeline continues; S427: Code Coverage: Use the Jacoco tool to generate a coverage report to check the code coverage and adjust the code test quality; S428: Artifact Archiving: Archive the sensitive information inspection report, the compiled JAR file, and the dependency security check report for downloading and viewing; S429: Generate Dockerfile: Generate a Dockerfile to define a Docker image based on OpenJDK for building the compiled JAR package; S4210: Generate Image: Use the generated Dockerfile to build a Docker image; S4211: Image Push: After authentication, push the built Docker image to the container image repository; S4212: Generate Kubernetes: Dynamically generate a Kubernetes deployment file according to the configuration information of the application; S4213: Deployment: Through the configured kubeconfig file, execute the kubect command to deploy the application to the Kubernetes cluster.

[0021] Further, a method for implementing DevSecOps in a container orchestration cluster, wherein the code of the specified branch includes git_branch, git_url, and git_auth; The git_branch and git_url obtain the content of the code repository; The git_auth is an identity credential, and authentication is performed through git_auth; The sensitive information includes but is not limited to passwords and API keys; The Kubernetes deployment file is used to run the application in the container platform.

[0022] Further, a method for implementing DevSecOps in a container orchestration cluster, wherein the step S423 includes the following sub-steps: S4231: Select to skip the test and directly compile the code; S4232: Generate the JAR file in the target directory and pull the dependencies using the Nexus credentials.

[0023] The core code for setting the content of JenkinsFile in Specific Embodiment 1 is as follows: stages { stage('Code Pull') { steps { checkout([$class: 'GitSCM', branches: [[name: "${git_branch}"]], extensions: [], userRemoteConfigs: [[credentialsId: "${git_auth}", url: "${git_url}"]]])}} stage('Sensitive Information Scanning') { steps { container('maven') { sh """ / data / gitleaks detect -v --report-format=json --report-path=gitleaks.json --exit-code 0 --no-git """}}} stage('Code Compilation') { steps { container('maven') { withCredentials([usernamePassword(credentialsId: "${nexus_auth}", passwordVariable: 'password', usernameVariable: 'username')]) { sh "mvn -Dmaven.test.skip=true -Drepo.user=${username} -Drepo.pass='${password}' clean package"}}}} stage('Product Dependency Security Check') { steps { container('maven') { sh """ / data / dependency-check / bin / dependency-check.sh --nvdApiKey ${nvdApiKey} --project "${fc_project}" --scan "${app_jar_url}""""}}} stage('Code Quality Inspection') { steps { container('maven') { withCredentials([string(credentialsId : "${sonarqube_token}",variable :'secrettext',)]) { withSonarQubeEnv('sonarqube') { sh """sonar-scanner \\ -Dsonar.login=${secrettext} \\ -Dsonar.projectKey=${sonar_project} \\ -Dsonar.projectName=${sonar_project} \\ -Dsonar.projectVersion=${time} \\ -Dsonar.sources=. \\ -Dsonar.java.binaries=. \\-Dsonar.exclusions="** / test / **,** / target / **,** / node_modules / **,dependency-check-report.html" \\ -Dsonar.java.coveragePlugin=jacoco \\ -Dsonar.jacoco.reportPaths=. / target / coverage-reports / jacoco-unit.exec\\ -Dsonar.dynamicAnalysis=reuseReports \\ -Dmaven.test.failure.ignore=true \\ -Dsonar.sourceEncoding=UTF-8 \\ -Dsonar.dependencyCheck.htmlReportPath=. / dependency-check-report.html"""}}}}} stage('Quality Gate') { steps { container('maven') { timeout(unit: 'MINUTES', activity: true, time: 5) { waitForQualityGate 'true'}}}} stage('Code Coverage') { steps { container('maven') { jacoco(changeBuildStatus: true, classPattern: 'target / classes', execPattern: 'target / coverage-report / jacoco.exec', maximumClassCoverage: '0', maximumMethodCoverage: '0', skipCopyOfSrcFiles: true, sourceInclusionPattern: '', sourcePattern:'src / main / java')}}} stage('Artifact Archiving') { steps { container('maven') { / / Sensitive information check report archiveArtifacts 'gitleaks.json' / / Backend archiveArtifacts '** / target / *.jar' / / Artifact dependency check report archiveArtifacts 'dependency-check-report.html'}}} stage('Generate Dockerfile') { steps { container('maven') { withCredentials([usernamePassword(credentialsId: "${harbor_auth}", passwordVariable: 'password', usernameVariable: 'username')]) { sh "docker login -u ${username} -p '${password}' ${image_registry}" / / Jar package deployment sh """ echo ' FROM openjdk:8 RUN mkdir / app ADD ${app_jar_url} / app / WORKDIR / app EXPOSE ${port} ENTRYPOINT ["java", "-jar", "${app_jar_name}"] '>Dockerfile """}}}} stage('Generate Image') { steps { container('maven') { sh "docker build -t ${image_name}."}}} stage('Push Image') { steps { container('maven') { withCredentials([usernamePassword(credentialsId: "${harbor_auth}", passwordVariable: 'password', usernameVariable: 'username')]) { sh """ docker login -u ${username} -p '${password}' ${image_registry} docker push ${image_name} """}}}} stage('Generate Deployfile') { steps { container('maven') { sh """ echo ' kind: Deployment apiVersion: apps / v1 metadata: name: ${app_name} # Application name namespace: ${fc_project} # Project name labels: app: ${app_name} spec: replicas: 1 selector: matchLabels: app: ${app_name} template: metadata: labels: app: ${app_name} spec: volumes: - name: host-time hostPath: path: / etc / localtime type: '' containers: - name: ${app_name} # Application name image: ${image_name} # Image name and version number ports: - name: tcp-${port} # Application listening port name containerPort: ${port} # Application monitoring port protocol: TCP # Application listening port protocol TCP / UDP env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: NODE_IP valueFrom: fieldRef: fieldPath: status.hostIP - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName livenessProbe: tcpSocket: port: ${port} # Application monitoring port initialDelaySeconds: 300 # The first health check time, in seconds periodSeconds: 10 # Average health check interval, in seconds timeoutSeconds: 10 # How many seconds to wait after the probe times out resources: limits: cpu: 500m # Maximum CPU for the application, unit m: millicore, 1000m = 1 core memory: 512Mi # Maximum memory capacity for the application, unit Mi (MB)|Gi (GB) requests: cpu: 100m # CPU requested for application startup, unit m: millicore, 1000m = 1 core memory: 512Mi # Memory capacity requested for application startup, unit Mi (MB)|Gi (GB) volumeMounts: - name: host-time readOnly: true mountPath: / etc / localtime imagePullPolicy: IfNotPresent imagePullSecrets: - name: ${image_secret} # Private image repository key '>deploy.yaml cat deploy.yaml """}}} stage('Deployment') { steps { container('maven') { withCredentials([kubeconfigContent(credentialsId : "${kubernetesConfigId}" ,variable : 'kubeconfig' ,)]) { sh """ echo "${kubeconfig}">kubeconfig kubectl --kubeconfig=kubeconfig apply -f deploy.yaml """}}}}} environment { BUILD_TIMESTAMP_replace = "${BUILD_TIMESTAMP}".replace("-","").replace(":","").replace(" ","") time = "${BUILD_TIMESTAMP_replace}".substring(0,"${BUILD_TIMESTAMP_replace}".length() -3) / / Maintain pipeline parameter information / / Container orchestration cluster information / / 1. User account fc_username = "" / / 2. Project name fc_project = "" / / 3. Application name app_name = "" / / 4. Application description app_description = "" / / 5. Application port (port occupied by the program at startup) port = "" / / 6. Image repository Secret key name image_secret = "" / / Code information / / 1. Git code http address (https: / / xxxxxxxxxxxxx.git) git_url = "" / / 2. Git branch: Fill in according to the actual situation, such as master, dev, etc. git_branch = "" / / 3. Git credential ID git_auth = "" / / Image repository information / / 1. Image repository address image_registry = "" / / 2. Image repository credential ID harbor_auth = "" / / 3. Image name (default standard format, no need to change) image_name = "${image_registry} / ${fc_project} / ${app_name}:${git_branch}-${time}" / / Nexus account information / / Nexus credential ID (used for maven to pull dependencies for authentication) nexus_auth = "" / / SonarQube information / / 1. SonarQube project name, in the format of project name: component name: environment sonar_project = "${fc_project}:${app_name}:${git_branch}" / / 2. SonarQube scan token credential ID sonarqube_token = "" / / Artifact dependency security check / / Obtain nvdApiKey: https: / / nvd.nist.gov / developers / request-an-api-key nvdApiKey = "" / / Maintain backend pipeline information / / 1. Relative path of the generated jar package after compilation (e.g., xx / target / x.jar) app_jar_url = "" / / 2. Name of the generated jar package after compilation (e.g., x.jar) app_jar_name = "" / / Deployment / / 1. Kubernetes configuration credential ID kubernetesConfigId = ""} options { buildDiscarder(logRotator(numToKeepStr: '10')) disableConcurrentBuilds() timeout(time: 10, unit: 'MINUTES') }}。

[0024] This solution is a method for implementing DevSecOps in a container orchestration cluster. Based on the Kubernetes cluster of container orchestration technology, it transforms DevOps in the traditional virtual machine environment into DevSecOps in the container orchestration cluster environment. By comprehensively applying the concept of secure development, it improves the efficiency and accuracy of security reviews, reduces labor costs, realizes the efficiency and security of software delivery, improves the productivity of software development teams, and protects the container orchestration cluster from security threats.

[0025] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. What is described in the above embodiments and the specification only illustrates the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and all these changes and improvements fall within the scope of the present invention claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing DevSecOps in a container orchestration cluster, characterized in that, It includes the following sub-steps: S1: Jenkins dynamically generates a pipeline container in the container orchestration cluster; S2: The pipeline building container mounts network storage, extracts the Gitleaks and Dependency-Check installation packages and places them in the network storage directory for the pipeline to use through sharing; S3: SonarQube integrates Dependency-Check to display reports; S4: Write a JenkinsFile to use each tool in series.

2. The method for implementing DevSecOps in a container orchestration cluster according to claim 1, wherein The step S1 includes the following sub-steps: S11: Jenkins installs the kubernetes-plugin plugin; S12: Use kubeconfig to configure the Kubernetes cluster information; S12: Configure the specified image in the pipeline building container and the build environment required by the application; The build environment includes maven and nodejs.

3. A method for implementing DevSecOps in a container orchestration cluster according to claim 1, wherein, The step S3 includes the following sub-steps: S31: Search for Dependency-Check in the SonarQube plugin store and install it; S32: Browse the Dependency-Check report in SonarQube.

4. A method for implementing DevSecOps in a container orchestration cluster according to claim 1, characterized in that, The step S4 includes the following sub-steps: S41: Set the agent block: Specify the environment where the pipeline runs, use the node with the maven label, and use a container with Maven and JDK to run each stage of the pipeline; S42: Set the stages block: Divide the pipeline into multiple stages, and each stage executes an independent task; S43: Set the environment block: Define the environment variables used in the pipeline; The environment variables include Git repository information, application information, image repository information, and SonarQube information; S44: Set the options block: Define the control options of the pipeline; The control options include the number of retained build logs, prohibiting concurrent builds, and the maximum execution time of the pipeline.

5. A method for implementing DevSecOps in a container orchestration cluster according to claim 4, wherein, The step S42 includes the following sub-steps: S421: Code pulling: Pull the code of the specified branch from the Git repository; S422: Sensitive information scanning: Use the Gitleaks tool to scan the sensitive information in the code: If there is sensitive information, generate a report and continue the pipeline; If there is no sensitive information, continue scanning until all code scanning is completed; S423: Code compilation: Use Maven to compile Java code and package it into a JAR file; S424: Artifact dependency security check: Use the dependency-check tool to scan the generated JAR package to detect whether the dependent libraries are secure and generate a security report; S425: Code quality inspection: Use onar-scanner to scan the code quality and send the results to the SonarQube server for display and analysis; S426: Quality gate: Judge whether to continue the pipeline according to the rules of the SonarQube quality gate: If the quality gate fails, the pipeline will pause or fail; If the quality gate passes, the pipeline continues; S427: Code coverage: Use the coverage report generated by the Jacoco tool to check the code coverage and adjust the code test quality; S428: Artifact archiving: Archive the sensitive information inspection report, the compiled JAR file, and the dependency security inspection report for downloading and viewing; S429: Generate Dockerfile: Generate a Dockerfile to define a Docker image for building the compiled JAR package based on OpenJDK; S4210: Generate image: Use the generated Dockerfile to build a Docker image; S4211: Image push: After authentication, push the built Docker image to the container image repository; S4212: Generate Kubernetes: Dynamically generate a Kubernetes deployment file according to the configuration information of the application; S4213： Deployment: Through the configured kubeconfig file, execute the kubect command to deploy the application to the Kubernetes cluster.

6. A method for implementing DevSecOps in a container orchestration cluster according to claim 5, characterized in that, The code of the specified branch includes git_branch, git_url, and git_auth; The git_branch and git_url obtain the content of the code repository; The git_auth is an identity credential, and authentication is performed through git_auth; The sensitive information includes but is not limited to passwords and API keys; The Kubernetes deployment file is used to run the application in the container platform.

7. A method for implementing DevSecOps in a container orchestration cluster according to claim 5, wherein The step S423 includes the following sub-steps: S4231: Select to skip the test and directly compile the code; S4232: Generate the JAR file in the target directory and pull the dependencies using the Nexus credentials.

Images