DEVOPS + ACR + 트리비

동료 기술 옹호자 및 전문가에게 인사드립니다.

이 기사에서는 AZURE DEVOPS PIPELINES를 사용하여 AQUASEC TRIVY로 AZURE CONTAINER REGISTRY에서 Docker 이미지를 스캔하는 방법을 설명합니다.

요구 사항:-

Azure 컨테이너 레지스트리

Azure 저장소 계정

Azure Resource Manager 서비스 연결

Docker Registry(Azure Container Registry) 서비스 연결

Dockerfile

샘플 HTML 파일

YAML(Azure DevOps 파이프라인)

Trivy 무시 파일(.trivyignore)

파이프라인은 무엇을 하는가:-

#
파이프라인 작업

1.
ACR에서 이미지 빌드 및 푸시

2.
Aquasec TRIVY 다운로드 및 설치

삼.
TRIVY 스캔을 실행하고 아티팩트 스테이징 디렉터리에 스캔 결과를 복사합니다.

4.
아티팩트 게시

5.
게시된 아티팩트 다운로드

6.
AQUASEC TRIVY 스캔 보고서를 날짜 시간 스탬프 디렉터리가 있는 BLOB 스토리지 컨테이너에 복사합니다.

TRIVY IGNORE 파일(.trivyignore)이 필요한 이유는 무엇입니까?

이미지 스캔 후 LOW, MEDIUM, HIGH 및 CRITICAL 취약점을 식별합니다. CVE(Common Vulnerabilities and Exposures)가 보고서에 나열됩니다. 어떤 이유로 애플리케이션 팀이 위험을 감수하고 Scan 보고서에서 LOW 및 MEDIUM 취약점을 건너뛰고자 하는 경우 .trivyignore 파일에 해당 CVE를 나열하고 파이프라인을 다시 실행하여 스캔하기만 하면 됩니다. 나열된 CVE는 더 이상 스캔 보고서에 없습니다.

코드 저장소:-

arindam0310018 / ACR-Trivy

다음은 Docker 파일의 내용입니다.

FROM nginx:1.15.9-alpine
COPY . /usr/share/nginx/html

다음은 HTML 파일의 내용입니다.

<html>
<head>
    <title>TEST - ARINDAM MITRA</title>
</head>

</style>
<body>
    <h1 style="font-size:50px; color:#000000; text-align: center">TEST - ARINDAM MITRA</h1>
</body>
</html>

다음은 YAML 파일(Azure DevOps)의 내용입니다.

trigger:
  none

resources:
- repo: self

###############################################
# All Declared Variables are listed below:-
###############################################
variables:
  dockerRegistryServiceConnection: '52409f6c-7855-4be2-a142-7192521b3e3f'
  imageRepository: 'amimagescantrivy'
  containerRegistry: 'ampocapplacr.azurecr.io'
  storageaccount: 'am4prodvs4core4shell'
  resourcegroup: 'Demo-Blog-RG'
  sacontainername: 'trivy-scan-reports'
  serviceconn: 'amcloud-cicd-service-connection' 
  dockerfilePath: '$(Build.SourcesDirectory)/ACR+Trivy/Dockerfile'
  target: $(build.artifactstagingdirectory)
  artifact: AM
  tag: '$(Build.BuildId)'

  vmImageName: 'ubuntu-latest'

stages:
- stage: BUILD
  displayName: Build and Push Stage
  jobs:
  - job: BUILD_JOB
    displayName: BUILD IMAGE
    pool:
      vmImage: $(vmImageName)
    steps:

#####################################
# Build and Push the Image to ACR:-
#####################################    
    - task: Docker@2
      displayName: BUILD AND PUSH IMAGE TO ACR
      inputs:
        command: buildAndPush
        repository: $(imageRepository)
        dockerfile: $(dockerfilePath)
        containerRegistry: $(dockerRegistryServiceConnection)
        tags: |
          $(tag)

#######################################
# Download and Install Aquasec Trivy:-
#######################################
    - task: CmdLine@2
      displayName: DOWNLOAD AND INSTALL AQUASEC TRIVY
      inputs:
        script: |
         sudo apt-get install wget apt-transport-https gnupg lsb-release
         wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
         echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
         sudo apt-get update
         sudo apt-get install trivy
         trivy -v
         pwd

##################################################################################
# Execute Trivy Scan and Copy the Scan Results in Artifacts Staging Directory:-
##################################################################################
    - task: CmdLine@2
      displayName: RUN AQUASEC TRIVY SCAN AND COPY TO ARTIFACTS STAGING DIRECTORY
      inputs:
        script: |
          trivy image --exit-code 0 --severity LOW,MEDIUM $(containerRegistry)/$(imageRepository):$(tag) > low-med.txt
          trivy image --exit-code 1 --severity HIGH,CRITICAL $(containerRegistry)/$(imageRepository):$(tag) > high-critical.txt
          ls -l
          cp -rvf *.txt $(target)

##########################
# Publish the Artifacts:-
##########################
    - task: PublishBuildArtifacts@1
      displayName: PUBLISH ARTIFACTS
      inputs:
        targetPath: '$(target)'
        artifactName: '$(artifact)'

######################################
# Download the Published Artifacts:-
######################################
    - task: DownloadBuildArtifacts@1
      displayName: DOWNLOAD ARTIFACTS
      inputs:
        buildType: 'current'
        downloadType: 'single'
        downloadPath: '$(System.ArtifactsDirectory)'

#########################################################
# The Below Code Snippet did not work because it is 
# only supported by "Windows" Build Agent
#########################################################    
    # - task: AzureFileCopy@4
    #   displayName: COPY AQUASEC TRIVY SCAN REPORTS TO BLOB STORAGE
    #   inputs:
    #     SourcePath: '$(System.ArtifactsDirectory)'
    #     azureSubscription: 'amcloud-cicd-service-connection'
    #     Destination: 'AzureBlob'
    #     storage: '$(storageaccount)'
    #     ContainerName: '$(sacontainername)/$(Date)'

###################################################################################
# Cmd in Line 118 - It works on Linux Build Agent because of the Date Format
# Cmd in Line 119 - It works on Windows Build Agent because of the Date Format
###################################################################################
    - task: AzureCLI@1
      displayName: COPY AQUASEC TRIVY SCAN REPORTS TO BLOB STORAGE
      inputs:
        azureSubscription: '$(serviceconn)'
        scriptType: ps
        scriptLocation: inlineScript
        inlineScript: |
          az storage blob upload-batch -d $(sacontainername)/$(date "+%d-%m-%Y_%H-%M-%S") --account-name $(storageaccount) --account-key $(az storage account keys list -g $(resourcegroup) -n $(storageaccount) --query [0].value -o tsv) -s $(System.ArtifactsDirectory)/AM
#         az storage blob upload-batch -d trivy-scan-reports/$(Get-Date -Format dd-MM-yyyy_HH-mm) --account-name $(storageaccount) --account-key $(az storage account keys list -g $(resourcegroup) -n $(storageaccount) --query [0].value -o tsv) -s $(System.ArtifactsDirectory)/AM

아래는 Trivy 무시 파일(.trivyignore)의 내용입니다.

# All LOW and MEDIUM Vulnerabilities has been ignored (Except 2)!!!
#CVE-2018-5711
#CVE-2018-14048
CVE-2018-14498
CVE-2019-1547
CVE-2019-1549
CVE-2019-1551
CVE-2019-1563
CVE-2019-7317
CVE-2019-11038
CVE-2019-12904
CVE-2019-13627
CVE-2020-1971
CVE-2020-14155
CVE-2020-15999
CVE-2020-24977
CVE-2020-28928
CVE-2021-3449
CVE-2021-23841
CVE-2021-23839

파이프라인 결과:-