Pre-deploy Image Scanning

Image Scanning is a great candidate to be used in Pre-deploy workflows. Scanning during pre-deploy allows a separate approval to be created specifically for reviewing the scan results.

Configuring the setup only takes a few minutes, firstly

1. Create a new workflow of type Pre-deploy

2. Add the scan operation

I am using the Anchore AnalyzeImage operation which will scan a remote docker image and upload the results to an existing Anchore Engine. Feel free to use any scan utility you wish. In order for the Pre-deploy workflow to generate a task you need to set two variables in the workflow. Click the variable button and set your values. These can be set dynamically in the workflow via the assign operation as well.

<?xml version="1.0" encoding="UTF-8"?>
<ns0:WorkFlow xmlns:ns1="http://flexagon.com/flexdeploy/workflow/common" xmlns:ns0="http://flexagon.com/flexdeploy/workflow">
   <ns1:Name>ScanImage</ns1:Name>
   <ns1:Description></ns1:Description>
   <ns0:Variables>
      <ns0:Variable>
         <ns1:Name>FD_REVIEW_REQUIRED</ns1:Name>
         <ns1:Type>Boolean</ns1:Type>
         <ns0:returnAsOutput>true</ns0:returnAsOutput>
         <ns1:isConstant>false</ns1:isConstant>
         <ns1:InitialValue>true</ns1:InitialValue>
      </ns0:Variable>
      <ns0:Variable>
         <ns1:Name>FD_REVIEW_GROUP</ns1:Name>
         <ns1:Type>String</ns1:Type>
         <ns0:returnAsOutput>true</ns0:returnAsOutput>
         <ns1:isConstant>false</ns1:isConstant>
         <ns1:InitialValue>"FD Administrators"</ns1:InitialValue>
      </ns0:Variable>
   </ns0:Variables>
   <ns0:Steps>
      <ns0:Step>
         <ns1:Name>analyzeImage</ns1:Name>
         <ns1:StepId>1</ns1:StepId>
         <ns0:InvokePlugin>
            <ns0:PluginName>FlexagonAnchorePlugin</ns0:PluginName>
            <ns0:PluginOperation>analyzeImage</ns0:PluginOperation>
            <ns0:consumesArtifacts>false</ns0:consumesArtifacts>
            <ns0:producesArtifacts>false</ns0:producesArtifacts>
            <ns0:EndpointSelection>
               <ns0:EndpointSelectionChoice>All</ns0:EndpointSelectionChoice>
            </ns0:EndpointSelection>
            <ns0:EndpointExecutionChoice>Any</ns0:EndpointExecutionChoice>
            <ns0:PluginInputs>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_USER</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>String</ns1:Type>
                  <ns0:Text>admin</ns0:Text>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_PASSWORD</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>true</ns0:Encrypted>
                  <ns1:Type>String</ns1:Type>
                  <ns0:Text>changeme</ns0:Text>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_URL</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>String</ns1:Type>
                  <ns0:Text>http://yourhost:8228/v1</ns0:Text>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_IMAGE_NAME</ns0:Name>
                  <ns0:ValueType>Expression</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>String</ns1:Type>
                  <ns0:Value>
                     <ns0:Expression>"docker.io/"+FD_PROJECT_DOCKER_IMAGE_NAME</ns0:Expression>
                  </ns0:Value>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_WAIT_FOR_RESULTS</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>Boolean</ns1:Type>
                  <ns0:Text>true</ns0:Text>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_SCAN_FAIL_CONDITION</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>String</ns1:Type>
               </ns0:PluginInput>
               <ns0:PluginInput>
                  <ns0:Name>FDANCR_INP_FORCE_ANALYZE</ns0:Name>
                  <ns0:ValueType>Text</ns0:ValueType>
                  <ns0:Encrypted>false</ns0:Encrypted>
                  <ns1:Type>Boolean</ns1:Type>
                  <ns0:Text>false</ns0:Text>
               </ns0:PluginInput>
            </ns0:PluginInputs>
            <ns0:UserInputs/>
            <ns0:PluginOutputs>
               <ns0:OutputValue>
                  <ns0:NameInCallee>FDANCR_OUT_FINAL_ACTION</ns0:NameInCallee>
               </ns0:OutputValue>
               <ns0:OutputValue>
                  <ns0:NameInCallee>FDANCR_OUT_STATUS</ns0:NameInCallee>
               </ns0:OutputValue>
               <ns0:OutputValue>
                  <ns0:NameInCallee>FDANCR_OUT_STOP_COUNT</ns0:NameInCallee>
               </ns0:OutputValue>
               <ns0:OutputValue>
                  <ns0:NameInCallee>FDANCR_OUT_WARN_COUNT</ns0:NameInCallee>
               </ns0:OutputValue>
               <ns0:OutputValue>
                  <ns0:NameInCallee>FDANCR_OUT_ALL_COUNT_LIST</ns0:NameInCallee>
                  <ns0:NameInCaller></ns0:NameInCaller>
               </ns0:OutputValue>
            </ns0:PluginOutputs>
            <ns0:UserOutputs/>
         </ns0:InvokePlugin>
      </ns0:Step>
   </ns0:Steps>
</ns0:WorkFlow>

3. Add the Pre-deploy workflow to your Project

Now we just need to set the pre-deploy workflow on the project.

Now, whenever we deploy, either manually or through a release, we can optionally execute the pre-deploy.