Skip to content

Latest commit

 

History

History
100 lines (72 loc) · 4.13 KB

devsecops-configuring-slsa-attestation.md

File metadata and controls

100 lines (72 loc) · 4.13 KB
copyright lastupdated keywords subcollection
years
2023, 2024
2024-10-09
DevSecOps, slsa, slsa attestation, IBM Cloud
devsecops

{{site.data.keyword.attribute-definition-list}}

Configuring collection of SLSA attestations for images

{: #cd-devsecops-slsa}

The tool tekton-chains collects evidence of the built images with SLSA attestations. {: shortdesc}

The tekton-chains tool monitors build-artifact stage of CI pipeline and attests the built images. The evidence collection tool runs for each image in the saved artifacts list_artifacts method and collects the attestation. Then, the tool creates the necessary evidences. For more information, see list_artifacts.

The tekton chains tool is deployed to IBM managed workers by default. For information about Private workers, see What is Tekton Chains?.

SLSA attestation parameters

{: #slsa-params}

You can set the following SLSA attestation parameters with the tekton-chains tool.

Parameter name Type Description Required or Optional
slsa-attestation ENUM Set this parameter to an enum value of 0 or 1. Set the value to 1 to enable the collection of SLSA attestation reports. The default value is 0 Required
icr-dockerconfigjson SECRET The base64-encoded Docker config.json file that stores credential information for IBM Container Registry. Set this parameter if the images must be stored in IBM Container Registry. Optional
artifactory-dockerconfigjson SECRET The base64-encoded Docker config.json file that stores credential information for Artifactory. Set this parameter if images are stored in Artifactory or other container registries. Optional
slsa-attestation-public-key SECRET The base64-encoded public key to verify SLSA attestation reports. Optional
{: caption="SLSA attestation parameters" caption-side="top"}

These secrets can be created manually by running:

kubectl create secret docker-registry mysecret \
--dry-run \
--docker-server=<container registry url>  \
--docker-username=<username> \
--docker-password=<artifactory token> \
--docker-email=<email> \
-o yaml

{: codeblock}

For IBM Container Registry, use iamapikey as the username and the IBM Cloud API key as the password.

This process outputs a response that is similar to the following code snippet:

apiVersion: v1
data:
  .dockerconfigjson: <your secret>
kind: Secret
metadata:
  creationTimestamp: null
  name: regcred
type: kubernetes.io/dockerconfigjson

{: codeblock}

In the pipeline properties, update the artifactory-dockerconfigjson or icr-dockerconfigjson parameter with the .dockerconfigjson value.

Evidence and attachments

{: #slsa-evid-attach}

Based on the values that you set based on the details in table 2, evidences get generated. The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for change requests.

Field Value
tool type tekton-chains
evidence type com.ibm.cloud.slsa
asset type image
attachments Attestation report generated by the tekton chains as JSON
{: caption="Evidence fields and values" caption-side="top"}

Debugging and logging

{: #slsa-debug-log}

Set the following parameter for debugging and logging.

Parameter name Default value Description
pipeline-debug 0 Debug flag 0 off; 1 on
{: caption="Debug parameters" caption-side="top"}

Accessing your scan results

{: #slsa-results}

You can access your scan results by using the following methods: