Deploy an app to GKE and view security insights

Prepare your environment

1. Set your project ID as an environment variable:

     export 
     
    PROJECT_ID 
    = 
    $( 
   gcloud  
   config  
   get  
   project ) 
    
   

2. Set the default Google Cloud region for Cloud Deploy:

    gcloud  
   config  
    set 
     
   deploy/region  
   us-central1 
   

3. Clone the GitHub repository that contains the sample code for this task:

    git  
   clone  
   https://github.com/googlecloudplatform/software-delivery-shield-demo-java.git cd 
     
   ~/software-delivery-shield-demo-java/backend 
   

4. Create an IAM service account for your GKE

   clusters to use:

    gcloud  
   iam  
   service-accounts  
   create  
   sds-runtime  
    \ 
     
   --display-name = 
    "Security insights with GKE service account" 
    
   

5. Grant permissions to the IAM service account:

    gcloud  
   projects  
   add-iam-policy-binding  
    $PROJECT_ID 
     
    \ 
     
   --member = 
   serviceAccount:sds-runtime@ ${ 
    PROJECT_ID 
    } 
   .iam.gserviceaccount.com  
    \ 
     
   --role = 
    "roles/container.nodeServiceAccount" 
   gcloud  
   projects  
   add-iam-policy-binding  
    $PROJECT_ID 
     
    \ 
     
   --member = 
   serviceAccount:sds-runtime@ ${ 
    PROJECT_ID 
    } 
   .iam.gserviceaccount.com  
    \ 
     
   --role = 
    "roles/clouddeploy.jobRunner" 
   gcloud  
   projects  
   add-iam-policy-binding  
    $PROJECT_ID 
     
    \ 
     
   --member = 
   serviceAccount:sds-runtime@ ${ 
    PROJECT_ID 
    } 
   .iam.gserviceaccount.com  
    \ 
     
   --role = 
    "roles/container.developer" 
   gcloud  
   projects  
   add-iam-policy-binding  
    $PROJECT_ID 
     
    \ 
     
   --member = 
   serviceAccount:sds-runtime@ ${ 
    PROJECT_ID 
    } 
   .iam.gserviceaccount.com  
    \ 
     
   --role = 
    "roles/artifactregistry.reader" 
    
   

6. Grant the default Compute Engine service account access to GKE clusters. Cloud Deploy uses this access to deploy apps to the clusters in your delivery pipeline.

     PROJECT_NUMBER 
    = 
    " 
    $( 
   gcloud  
   projects  
   describe  
    ${ 
    PROJECT_ID 
    } 
     
   --format = 
    'get(projectNumber)' 
    ) 
    " 
   gcloud  
   projects  
   add-iam-policy-binding  
    ${ 
    PROJECT_NUMBER 
    } 
     
    \ 
     
   --member = 
   serviceAccount: ${ 
    PROJECT_NUMBER 
    } 
   -compute@developer.gserviceaccount.com  
    \ 
     
   --role = 
   roles/container.developer 
   

Create the Artifact Registry repository for your image

1. Create the repository:

    gcloud  
   artifacts  
   repositories  
   create  
   containers  
    \ 
     
   --repository-format = 
   docker  
    \ 
     
   --location = 
   us-central1  
    \ 
     
   --description = 
    "Security insights with GKE repository" 
    
   

2. Verify that the repository exists:

    gcloud  
   artifacts  
   repositories  
   list  
    \ 
     
   --location = 
   us-central1  
    \ 
     
   --filter = 
    "REPOSITORY:containers" 
    
   

   The output displays the containers repository you created.

Create the GKE clusters

Create two GKE clusters, a staging cluster named dev-cluster and a production cluster named prod-cluster . In Autopilot, workload vulnerability scanning is automatically enabled for new clusters running version 1.27 and later. If you use a Standard cluster, specify the --workload-vulnerability-scanning=standard flag.

 gcloud  
container  
clusters  
create-auto  
dev-cluster  
 \ 
  
--region = 
us-central1  
 \ 
  
--release-channel = 
rapid  
 \ 
  
--service-account = 
sds-runtime@ ${ 
 PROJECT_ID 
 } 
.iam.gserviceaccount.com
gcloud  
container  
clusters  
create-auto  
prod-cluster  
 \ 
  
--region = 
us-central1  
 \ 
  
--release-channel = 
rapid  
 \ 
  
--service-account = 
sds-runtime@ ${ 
 PROJECT_ID 
 } 
.iam.gserviceaccount.com 

Cluster creation can take up to five minutes to complete. You can also enable workload vulnerability scanning by updating existing GKE clusters.

Build the image

Build and submit the image using Cloud Build:

 gcloud  
builds  
submit  
--region  
us-central1  
--config  
cloudbuild.yaml 

When the build completes, the output is similar to the following:

 DONE
-----------------------------------------------------------------------------
ID: 3e23094f-7f57-4449-bc68-51c37hn34d03
CREATE_TIME: 2022-09-19T15:41:07+00:00
DURATION: 54S
SOURCE: gs://my-project_cloudbuild/source/1663602066.777581-6ebe4b2d6fd741ffa18936d7f.tgz
IMAGES: us-central1-docker.pkg.dev/ PROJECT_ID 
/containers/java-guestbook-backend:quickstart
STATUS: SUCCESS 

Deploy the image to GKE using Cloud Deploy

1. Update the Cloud Deploy configuration file with your project ID:

    sed  
   -i  
    "s/PROJECT_ID/ 
    ${ 
    PROJECT_ID 
    } 
    /g" 
     
   clouddeploy.yaml 
   

2. Register the pipeline and targets:

    gcloud deploy apply --file=clouddeploy.yaml 
   

3. To verify that your pipeline exists, go to the Delivery pipelinespage in the Google Cloud console:

   Go to Delivery pipelines

   The list of pipelines displays your new pipeline, guestbook-app-delivery .

4. Click the name of the pipeline to monitor progress. The Delivery pipeline detailspage opens.

5. Create a new release in Cloud Deploy:

    gcloud  
   deploy  
   releases  
   create  
   guestbook-release-001  
    \ 
     
   --delivery-pipeline = 
   guestbook-app-delivery  
    \ 
     
   --images = 
   java-guestbook-backend = 
   us-central1-docker.pkg.dev/ ${ 
    PROJECT_ID 
    } 
   /containers/java-guestbook-backend:quickstart 
   

   The new release appears in the Releasessection on the Delivery pipeline detailspage.

6. On the Delivery pipeline detailspage, monitor the Pipeline visualizationview until the Promotebutton displays for dev-cluster . You might need to refresh the page.

7. Click Promotein the dev-cluster visualization.

8. On the Promote releasepane, click Promoteto confirm the promotion to your production cluster.

9. To verify that your release was successful, check the Releasessection. The Last rollout statuscolumn displays Successfully deployed to prod-cluster .

View vulnerabilities

In this section, view OS vulnerability insights using the security posture dashboard. The dashboard displays information about vulnerabilities in your running workloads after you deploy them to your clusters.

1. Go to the GKE security posturepage in the Google Cloud console.

   Go to GKE security posture

2. To view scan results, refresh the page. The initial scan might take up to 15 minutes to complete.

3. On the GKE security posturepage, review the Workload OS vulnerabilitysection. This section lists the top CVEs affecting your deployed workload.

4. For details, click See all vulnerability concerns. The Concernstab opens and applies a filter for the Vulnerabilityconcern type. The table shows an overview of each vulnerability and its impact.

5. For details about a specific vulnerability, click the name of the concern in the table. The Vulnerabilitypane opens. On this pane, you can do the following:

   • Read a detailed description of the CVE, including affected versions, packages, and the CVSS score.
   • View recommended actions to mitigate the concern, such as documentation and patch version information.
   • View the specific workloads that are affected by the vulnerability in the Affected workloadstab.