Lab 5.4: Add Kubernetes Manifest Security Scanning

Keyboard Time: 15 mins, Automation Wait Time: 8 mins

Scenarios: Instructor-Led, Self-Paced

Kubernetes Manifest SAST Security Scanning
GitLab can do kubernetes manifest scanning using Kubesec.
Target Outcomes
  1. configures the security scanning of fully rendered Kubernetes manifests for security problems.
CI Runner Required
While this project only uses the GitLab Agent Pull CD mode for deployment, it does need a runner if we want to do additional CI tasks in this project. In this case we want to add manifest scanning, which can only be done in the Environment Deployment project where the full manifests are constructed.

  1. Open ‘yourpersonalgroup/world-greetings-env-1’

  2. On the upper right of the Project page, Click Web IDE

  3. In the left side file browser, Click update-manifests.gitlab-ci.yml

    You will be editing YAML - be careful that tabbing is properly aligned. Only removing the comment character (“#”) should result in proper tabbing.

  4. Under include: uncomment - template: Security/SAST-IaC.latest.gitlab-ci.yml which should make the section look like this.:

    include: 
  - local: .gitlab/ci_templates/git-push.yaml
  - template: Security/SAST-IaC.latest.gitlab-ci.yml

  5. Under variables: uncomment the variables: heading and the two variable which should make the section look like this:

    variables:
  SCAN_KUBERNETES_MANIFESTS: "true"
  KUBESEC_HELM_CHARTS_PATH: $CI_PROJECT_DIR/constructed-manifests/

  6. In the left side file browser, Click packages/hello-world/base/deployment.yaml

  7. At the bottom of the file edit the securityContext: section to look like this (be sure to keep the same indentation starting by not moving the existing keyword securityContext and indenting sub levels by two spaces):

          securityContext:
        capabilities:
          add:
            - SYS_ADMIN

  8. Click Create commit…

  9. Select Commit to main branch (this is not the default)

  10. Under ‘Commit Message’, Type [skip ci] Adding Manifest Security Scanning

  11. Click Commit

  12. Below the Create commit… button, in the status bar, Click [the pipeline #]

  13. Expand the Downstream pipeline with the great than arrow (>).

  14. Under the new stage ‘Test‘, Locate the new job kics-iac-sast

  15. Click kics-iac-sast

  16. Near the bottom of the log, Locate gl-sast-report.json : found 1 files and directories

  17. On the left navigation, Click Security & Compliance => Vulnerability report

  18. If there are not any vulnerabilities listed, you can examine the page for Last updated followed by an elapsed time and a clickable pipeline id reference.

Accomplished Outcomes
  1. configures the security scanning of fully rendered Kubernetes manifests for security problems.