GitLab Protect Stage, 20 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Migration from Vulnerability-Check rules to Scan Result Policies with automated script

Description

Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/362744
Snippet with the script: https://gitlab.com/gitlab-org/gitlab/-/snippets/2328089

A

Hello: everyone, my name is matthew perzetsky, I'm staff packet engineer in the container security team, and today I would like to talk about automated creation of scan result policies for multiple projects. Recently we have deprecated and removed vulnerability, check rules to scatter result policies.

A

Instead, we wanted to help you with the migration, especially if you have multiple projects or you want to script it instead of using the ui okay, let's get started so here we have the issue where we are describing the process and the format of the file, and so on I'll leave the link to this issue.

A

In the description below the video today, I would like to focus on automated script to help us with the migration.

A

There is a whole section of of the issue where we are describing how to run it and how to provide the migration for your projects before you start, you need to create your personal access token to do so. You need to go to your account preferences access tokens and create a token for api scope.

A

Okay, let's do the migration here. I've created already a group where I have bunch of projects and in the first scenario I have multiple projects. I would like to create a security policy project for one of them, assign the security policy project to my other project and apply and create prepared policy.

A

Here I have the yaml file where I can describe everything. So I have a create security policy, project paths um and I'll start to comment that and I'll I'll start to the demo. Okay, we would like to create security policy project path. Let's select one of the projects, let it be this one project test, one: I'm gonna just copy the full path for it.

A

A

I'll paste it here and then I'm gonna assign the policy project that will be created for that project. To my author, two projects.

A

Okay, here is the um the policy itself. The post itself is the same as you would have. If you go to the policy editor, so you can go to policies and you can create a new policy. Select this kind of result policy and you can configure it using the ui or you can have the ammo mode where you can actually uh modify it as a yaml file. So you can copy that once you, you managed to create all the rules.

A

You would like to have copy the yaml file paste it here under the yaml object and then you'll be able to apply it to your project. Okay, so I'm going to create security policy project for this project and assign this additionally to these two projects- and this is the policy I would like to use.

A

Okay, I'm going to save the file, I'm going to run the script.

A

Okay, so um we've created security policy project for for the first test. uh Here's the idea of this. Then we started creating nmr with updating policy. There is the link, I can click the link.

A

And here's my policy, I can click, create merge request and I can merge it.

A

And then I can get back to policies and this policy will be available here, okay and also for my other projects. If I'll just change this and I'll select project test2, it will be available here as well. Okay.

A

So let's take a look at my our second scenario and the second scenario: I already have a secret policy project that I would like to use and would like to assign this product to my other project. Okay, so I'm gonna just change it to see.

A

Right, I'm gonna comment that.

A

This one- and I would like to use this guy.

A

Okay and let's go to my group.

A

This is the person I would like to use. I'm gonna copy the path.

A

Okay, here is the path: oh, there we go and then I would like to assign this project.

A

And here we have three two projects that I would like to use: okay,.

A

A

The first one, the second one.

A

Let's say I don't want to apply the seattle, I just want to do the assignment, so what I can do. I can just comment that.

A

I can save it, I can, I can run again the script and what it will do. It will simply assign the security policy project to these three projects without creating the yaml file. Okay, here we are, but I can also uncomment that I can save it. I can run the script again and what it will do. It will create a security uh policy in this project and then it will assign the security policy project to uh do these three projects. I can again click here. You can open the link.

A

Can create the merch request, so you can see this merge quest is created to security policy project. I can simply merge it.

A

That's it, this is what we have and I can again go to my other project. Let's, let's pick the second one I'll go to policies, um security policies.

A

And it's available here: okay, one last step and one last scenario that we can. We can verify here. In this scenario I have already assigned the security policy project for multiple, multiple projects, but now I would like to unassign them, so I I can do.

A

So, instead of assigning, I can unassign and what it will do. It will remove the connection between the security policy project and the projects that are described here. I can also.

A

Disable the ammo file, okay, and I can run the script.

A

Okay, so the product was unassigned and now I can take a look at my policies and I should not see any policy in this project.

A

Yes, okay, so if you have more questions, please leave them in in the issue. I will leave the link to this issue in this video below and please let us know if we can help you. Thank you.