Skip to content

Secret and SAST analyzer support for OpenShift

Proposal

The analyzers that are maintained by groupstatic analysis should support OpenShift deployments. We can follow an implementation plan similar to how groupcomposition analysis updated their analyzers and tests to support Openshift deployments

Tasks

Verify

  1. Ensure you can log in to the Red Hat Open Shift instance using the credentials from the Secure Openshift in the GitLab engineering 1Password vault
  2. Import the analyzer QA test projects into the previously mentioned Open Shift instance
  3. In the Open Shift instance, run the test project's pipeline to see if any errors occur. If no errors have occurred you can skip the Update set of tasks.

Update

  1. Make the necessary changes to your analyzer (most likely a Dockerfile change) to support Open Shift.
  2. Push the changes to a branch.
  3. Copy the tmp image built from your commit with the changes to support Open ShiftScreen_Shot_2021-04-01_at_4.22.19_PM
  4. In your analyzers' test project(s) run a pipeline w/ SAST_ANALYZER_IMAGE set to the tmp image that was copied in the step above.Screen_Shot_2021-04-01_at_4.24.58_PM
  5. If no errors have occurred then move onto Report, otherwise repeat Step 1-5 until you have a working pipeline.

Report

  1. Mark the assigned analyzer as done and update the bullet point with this template: - [ ] analyzer | link-to-passing-open-shift-job | {no changes needed, or link to MR}

Assignments

@rossfuhrman:

@dsearles:

@zrice:

Documentation

Edited by Zach Rice