# Integrate into gitlab-ci
# Overview
To integrate R&S®Trusted Application Factory to be efficient, it must be put between the CI test suite and the backend. The tests must be configured to have TAF as their destination, and TAF must be configured so that its backend is the tested application.
These are examples of how to integrate R&S®Trusted Application Factory into a gitlab-ci test pipeline. It will use appsec_settings.yaml to configure itself.
Both examples use a classic TAF configuration file:
---
apiVersion: core/v1beta
kind: App
metadata:
name: my-api
spec:
name: appsec
alias: appsec:8080
log_level: warn
workflow: my-workflow
workflow_params:
exceptions: my-configurations
---
apiVersion: core/v1beta
kind: Workflow
metadata:
name: my-workflow
spec:
entrypoint: main
source: |-
package main
func main(icx_policy ICXConfiguration, exceptions SecurityExceptionConfiguration) {
ActionICXSecurityEngine(Args{"configuration": "${params.icx_policy}"})
ActionSecurityExceptionManagement(Args{"configuration": "${params.exceptions}"})
ActionLogAlert()
if security.exception.blocked == true {
ActionGenerateResponse(Args{"status": "403", "content": "<html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access ${http.request.path} on this server.</p></body></html>"})
} else {
ActionProxyRequest()
}
}
---
apiVersion: core/v1beta
kind: SecurityException
metadata:
name: my-configurations
spec:
rules:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Example 1: dummy API
Here the tested application is a dummy api (https://github.com/espebra/dummy-api), you should replace it according to your testing purposes.
test:
stage: test
image: $CI_REGISTRY_IMAGE/builder:v4
services:
- name: cr.trustedapphub.io/appsec-runtime:0.3.0
alias: appsec
variables:
APP_LOCAL_AUTH_KEY: "http://build:1337/" # Tested application
APP_LOCAL_AUTH_KEY: "changeme" # this key will be used to authenticate with appsecctl auth login command
APPSEC_HOST: "appsec:8080" # use this variable to configure your tests target
script:
# Launch tested backend
- ./dummy-api -host 0.0.0.0 -verbose &
# Inject TAF configuration and start it
- appsecctl auth login -l appsec -c "changeme"
- envsubst < ./appsec_settings.yaml | appsecctl -H appsec -k apply -f -
# Run tests
- gauge -d tests run specs -v
# Kill backend app
- pkill dummy-api
after_script:
# Display raised security events in the tests output, and propose exceptions
- appsecctl -H appsec -k logs --hints
artifacts:
paths:
- tests/reports/
when: always
tags:
- devsecops
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Example 2: a nodejs app
Here, the tested application is a nodejs application using mongodb.
test:
stage: test
image: $CI_REGISTRY_IMAGE/builder:v3
services:
- name: $CI_REGISTRY_IMAGE/appsec:v3
alias: waf
variables:
APP_LOCAL_AUTH_KEY: "http://build:1337/" # Tested application
APP_LOCAL_AUTH_KEY: "changeme" # this key will be used to authenticate with appsecctl auth login command
APPSEC_HOST: "waf:8080" # use this variable to configure your tests target
before_script:
- npm install
- mongod &
- npm start &
script:
- npm test
after_script:
- appsecctl auth login -l appsec -c "changeme"
- appsecctl -H waf -k logs --hints
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19