Integration¶

# .gitea/workflows/build-push.yaml
name: Build and Push
on:
  push:
    tags:
      - 'v*'

env:
  REGISTRY: harbor.example.com
  PROJECT: app-backend
  IMAGE: api

jobs:
  build-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.HARBOR_ROBOT_USER }}
          password: ${{ secrets.HARBOR_ROBOT_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-,format=short

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE }}:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE }}:buildcache,mode=max

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE }}:${{ steps.meta.outputs.version }}
          output-file: sbom.spdx.json

      - name: Sign image with Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          # Signer chaque tag
          for tag in $(echo "${{ steps.meta.outputs.tags }}" | tr ',' '\n'); do
            cosign sign --key env://COSIGN_KEY "${tag}"
          done

          # Attacher le SBOM
          cosign attach sbom \
            --sbom sbom.spdx.json \
            "${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE }}:${{ steps.meta.outputs.version }}"

# serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-backend
  namespace: app-backend
imagePullSecrets:
  - name: harbor-pull

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: app-backend
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      serviceAccountName: app-backend
      containers:
        - name: api
          # Utiliser le digest pour l'immutabilite
          image: harbor.example.com/app-backend/api@sha256:abc123...
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 1000m
              memory: 1Gi

# constraint-template.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredimagsigning
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredImageSigning
      validation:
        openAPIV3Schema:
          type: object
          properties:
            registries:
              type: array
              items:
                type: string
            cosignKey:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredimagsigning

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          registry := input.parameters.registries[_]
          startswith(container.image, registry)
          not image_signed(container.image)
          msg := sprintf("Image %v is not signed with Cosign", [container.image])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.initContainers[_]
          registry := input.parameters.registries[_]
          startswith(container.image, registry)
          not image_signed(container.image)
          msg := sprintf("Init container image %v is not signed with Cosign", [container.image])
        }

        image_signed(image) {
          # Verification via external data provider ou webhook
          external_data.cosign_verified[image]
        }

# constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredImageSigning
metadata:
  name: require-cosign-signature
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet", "DaemonSet"]
    namespaces:
      - app-backend
      - app-frontend
  parameters:
    registries:
      - "harbor.example.com"