-
Notifications
You must be signed in to change notification settings - Fork 14
/
cloudbuild.yaml
139 lines (127 loc) · 4.57 KB
/
cloudbuild.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
# Overview: Cloud Build build pipeline with Cloud Deploy release using git tag.
substitutions:
_APP_NAME: hello
_PIPELINE_NAME: deploy-demo-pipeline
steps:
# Go test
- id: test
name: us-west1-docker.pkg.dev/s3cme1/docker/golang@sha256:cfc9d1b07b1ef4f7a4571f0b60a99646a92ef76adb7d9943f4cb7b606c6554e2
env:
- GO111MODULE=on
entrypoint: /bin/bash
dir: app
args:
- -c
- |
go test -short -count=1 -race -covermode=atomic -coverprofile=cover.out ./...
# Build image
- id: build
name: gcr.io/cloud-builders/docker@sha256:1fe0557459fea8552d5ce57bb77aaf238139bd69131d670e152e68358f6cb13c
entrypoint: /bin/bash
waitFor:
- test
dir: app
args:
- -c
- |
docker build --build-arg VERSION=${TAG_NAME} \
-t "${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO_NAME}/${_APP_NAME}:${COMMIT_SHA}" \
-t "${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO_NAME}/${_APP_NAME}:${TAG_NAME}" \
.
# Publish image, get digest, and save it to file.
# Digest because tags aren't (really) cryptographically verifiable.
- id: publish
name: gcr.io/cloud-builders/docker@sha256:1fe0557459fea8552d5ce57bb77aaf238139bd69131d670e152e68358f6cb13c
entrypoint: /bin/bash
waitFor:
- build
dir: app
args:
- -c
- |-
docker push "${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO_NAME}/${_APP_NAME}:${TAG_NAME}"
docker image inspect "${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO_NAME}/${_APP_NAME}:${TAG_NAME}" \
--format '{{index .RepoDigests 0}}' > image-digest.txt
cat image-digest.txt
# Generate Software Bill of Materials (SBOM).
# Generate SBOM file for all image layers in JSON format (SPDX schema),
# and creates attestation for that container image with the SBOM as predicate
# Future: Automatically SBOM generation in CA.
- id: sbom
name: us-docker.pkg.dev/s3cme1/builders/sbominator@sha256:d5336ddf0897758f641be4e5fa5c8de299289d4adca6388e9f820833c83706cb
entrypoint: /bin/bash
waitFor:
- publish
dir: app
env:
- PROJECT=$PROJECT_ID
- KEY=$_KMS_KEY_NAME
- COMMIT=$COMMIT_SHA
- VERSION=$TAG_NAME
- ATTESTOR=$_BIN_AUTHZ_ID
args:
- -c
- |-
builder $(cat image-digest.txt)
# Test against my vulnerability policy.
# For stability of the demo uses a pre-built image.
# See the grafeas/kritis for instruction on how to build your own signer.
# https://github.com/grafeas/kritis/blob/master/docs/signer.md
# Check-based policies
# Future: Call to check-based policy API in BinAuthz (consistent controls)
- id: scan
name: us-docker.pkg.dev/s3cme1/builders/kritis-signer@sha256:b6d76a209a79a7409e552f81e3a362fc92688f91ab1b67cedf014ee5a03cd97a
entrypoint: /bin/bash
waitFor:
- publish
args:
- -c
- |-
/kritis/signer \
-mode=check-and-sign -v=10 -alsologtostderr \
-image=$(/bin/cat app/image-digest.txt) \
-policy=policy/vulnz-signing-policy.yaml \
-note_name=${_NOTE_NAME} \
-kms_key_name=${_KMS_KEY_NAME} \
-kms_digest_alg=${_KMS_DIGEST_ALG}
# Attest image with BinAuthz (attestation to X)
# Future: Could be unnecessary, given SBOM/Provenance/Vulnerability-based policy checks
- id: attest
name: gcr.io/google.com/cloudsdktool/cloud-sdk@sha256:abe63daaa5a79e06c0e423b893237786dd221a4518a22c4b7cb5c2acc2836497
entrypoint: /bin/bash
waitFor:
- sbom
- scan
args:
- -c
- |-
gcloud beta container binauthz attestations sign-and-create \
--attestor projects/${PROJECT_ID}/attestors/built-by-cloud-build \
--artifact-url $(cat app/image-digest.txt) \
--keyversion ${_KMS_KEY_NAME}
# Create release in Google Cloud Deploy
- id: release
name: gcr.io/google.com/cloudsdktool/cloud-sdk@sha256:abe63daaa5a79e06c0e423b893237786dd221a4518a22c4b7cb5c2acc2836497
entrypoint: /bin/bash
waitFor:
- attest
dir: app
args:
- -c
- |
gcloud deploy releases create rel-${SHORT_SHA} \
--delivery-pipeline ${_PIPELINE_NAME} \
--region ${LOCATION} \
--annotations "commitId=${REVISION_ID},tag=${TAG_NAME}" \
--images "${_APP_NAME}=$(cat image-digest.txt)"
images:
- ${LOCATION}-docker.pkg.dev/$PROJECT_ID/$REPO_NAME/$_APP_NAME:$TAG_NAME
options:
# Verify generation of attestations and provenance metadata for this build.
# Otherwise, GCB generates provenance for global builds only.
requestedVerifyOption: VERIFIED
sourceProvenanceHash: ["SHA256"]
pool:
name: 'projects/$PROJECT_ID/locations/$LOCATION/workerPools/$_POOL_NAME'
tags:
- demo