Halo semuanya! Nama saya Timur Gilmullin, saya bekerja di departemen teknologi dan proses pengembangan di Positive Technologies. Secara informal, kami disebut departemen DevOps, dan orang-orang kami terlibat dalam otomatisasi berbagai proses dan membantu pemrogram dan penguji bekerja dengan saluran produk.
, PT Application Inspector . - CI/CD-, CI-. PT Application Inspector — .
:
DevSecOps- , PT Application Inspector CI- ;
Security Gates, - GitLab;
, .
DevSecOps Positive Technologies
DevSecOps CI/CD- . , PT Application Inspector .
CI/CD- . (Developing), git-, GitLab CI (Unit-Testing + Building). (Deploying) (Functional Testing). Artifactory (Promoting), GUS FLUS- (Publishing GUS/FLUS). (Installing/Updating). (Collecting telemetry), (Monitoring) (User's feedback). .
Security- , , , . . , . , PT Application Inspector, — , . CI/CD- , MaxPatrol.SIEM - PT Application Firewall.
, DevSecOps, , , . - « » — . , , .
PT Application Inspector Positive Technologies
, . , , DevOps-, . . DevSecOps Positive Technologies.
DevSecOps-, CI- PT Application Inspector , , . , , ; -, DevSecOps- PT Application Inspector .
:
SAST/DAST/IAST- CI- , ( shift-left).
— . .
PT Application Inspector « », «» — CI- — , .
DevSecOps . PT Application Inspector DevSecOps, CI/CD-. Positive Technologies , , .
PT Application Inspector CI-
:
DevOps.BuildAgent —
Docker.Linux.AISA.Latest/TAG — - AISA,
AI.Agent —
AI.Server — PT Application Inspector
DevOps.GitLab —
DevOps.GitLab-CI — CI-
DevOps.Artifactory —
Docker.Registry — -
Docker.Linux.AISA — AISA ( - )
AI.Shell Agent — AISA, -, API PT Application Inspector
BuildAgent.Console —
WorkingDirectory — , ,
, . PT Application Inspector . GitLab CI. GitLab , AISA .
AISA — Application Inspector Shell Agent. API PT Application Inspector. AISA -, «» .
- AISA CI-, CI- DevOps-. docker registry Artifactory. - AISA.
CI-. :
:
● PT Application Inspector;
● .
:
● CI- AISA ( -).
:
● ;
● AISA.
CI-:
● GitLab CI;
● TeamCity;
● ( CLI AISA).
PT Application Inspector , - CI- .
PT Application Inspector
— , . , , () . , , . AISA. , , .
:
GitLab.
.
build-on-server, . — CI-. build-on-server , , CI- CI-.
AISA. .
.
, .
. , .
.
AISA- , .
Security Gates. Code Quality Status — 0, , 1, .
Code Quality Status 0, , . 1 , — .
Artifactory. .
Security Gates GitLab CI - GitLab. , .
:
, . , AISA GitLab CI.
, — PT Application Inspector , , . GitLab CI, downstream pipelines, . , , .
, , - GitLab, , , - , Security Gates ( Code Quality Gates SonarQube).
git. , -, - .
Security Gates:
, , Security Gates - GitLab.
Security Gates — , CI-, : - .
«» Artifactory — -BANNED , , Security Gates.
yaml-, :
threats mapping — GitLab ( ) PT Application Inspector ( ). , . , , GitLab Potential, Low, Medium Info.
security gates — . , - . , . , .
Security Gates . , . .
SonarQube GitLab — codequality. , -, , . , «» , legacy-, . , .
, , , -. , CI- AISA GitLab CI.
Security Gates:
, Security Gates, Code Quality Status 0 (Passed). - , GitLab ( ) . , , HTML- GitLab CI TeamCity, .
, Security Gates, — Code Quality Status 1 (Failed) - Draft .
, , , Security Gates , .
-: .
TeamCity -«», AISA-. HTML- TeamCity, (Tab reports), .
, TeamCity - GitLab.
, Security Gates — Code Quality Status — .
Security Gates:
, PT Application Inspector . , . , . GitLab CI.
CI- , . - , . .
— . , Security Gates -, .
, .gitlab-ci.yml .
Security Gates: Information mode
GitLab CI, (AI Information Mode).
, :
- (Unit tests);
(Build);
(Upload to registry).
GitLab CI gitlab-ci.yml include. :
(Start AI Scan);
AISA (AI-Scanning);
— (Send info);
— AISA (AI Scan Report);
Security Gates, — Code Quality Status (0, Passed / 1, Failed) — ;
(Send emails).
, -.
Security Gates: Lock mode
(AI Lock Mode) — . , (include) , , .
, : (running). , Security Gates - GitLab . , .
Security Gates: Strictest mode
, , (AI Strictest Mode) — . , , , (Approve build). , , Security Gates, , -. - (Draft).
, .
git Security Gates
git-flow :
master — ;
develop — -;
feature — ;
release — , .
- , . , - .
:
feature- (Information mode). - feature- develop . PT Application Inspector.
develop- (Strictest mode), Security Gates. . , - , .
release- (Lock mode) - master, develop.
master- (Information mode), , , , .
: Security Gates -
2021 . DevSecOps-. , Security Gates , , - Application Inspector .
Open Source dohq-ai-best-practices
GitLab CI TeamCity, PT Application Inspector Open Source dohq-ai-best-practices MIT-. :
-
-
Dockerfile AISA- Windows Linux.
-
DevOps
CI :
« : Continuous Integration» (2016)
« : Positive Technologies DevOps» (2017)
« -» (2018)
« : » (2019)
« : DevOps» (2020)
«DevSecOps: PT Application Inspector » (2020)
« DevOps Positive Technologies» (2021)
: — Positive Technologies. PT Application Inspector DevOps-, Open Source.
: — CI- . PT Application Inspector CI- Open Source.
DevSecOps . : , , , PT Application Inspector, , DevOps Positive Technologies PT Application Inspector , :)