lab03.md

3 - Running the Basic and Advanced DevSecOps Pipelines

In this lab you will use environments and secrets.

Duration: 10-15 minutes

References:

• Using environments for deployment
• Encrypted secrets
• Accessing your secrets
• OWASP: Pygoat Project
• Pygoat app on GitHub

3.1 Create new environments, variables, and secrets - basic pipeline

1. In order to run the basic pipeline, you must first enable workflows.
2. Create an environment called dev
3. Then add 2 environment secrets called TOKEN_FOR_DOS and DEFECTDOJO_COMMONPASSWORD
4. TOKEN_FOR_DOS should be a GitHub Personal Access Token (classic) with Read Only permissions:
5. If needed, you can always edit personal access token permissions
6. The other secret DEFECTDOJO_COMMONPASSWORD can be found here:
7. Once both secrets are entered
8. Go ahead and run the basic pipeline!
9. When all is done:
10. Modify the GitHub PAT to see the errors detected by DevOps Shield Scanner. Additionally, see the compliance get better as you add more GitHub actions that improve your DevSecOps.

3.2 Create new environments, variables, and secrets - advanced pipeline

1. Try running the advanced pipeline and you will quickly see it fail
2. You can immediately remedy this by running

.\Create-GitHubEnvironments.ps1 -ghOwner emmanuel-knafo `
    -ghRepo devsecops-workshop `
    -dockerName crs001fwmpo7kn3hnty `
    -dockerPassword "Dgv*************************************************" `
    -defectDojoProductId 6 `
    -defectDojoToken "607*************************************" `
    -githubReadOnlyPersonalAccessTokenClassic "ghp_pPK*********************************" `
    -kubeConfigFileName "C:\Users\emmanuel.DEVOPSABCS\Downloads\wrkshp-001-student-001-config-aks-wrkshp-001-s-001"

3. You can grab all the parameter values from the OneDrive file you received:
4. Or you can enter each environment secret and variable manually till you get something like:
5. Then run the advanced pipeline again
6. It should end like this:
7. You can view the deployed app here: http://gh-pygoat.cad4devops.com or find the ip in the deployment such as http://20.175.206.146 :
8. The Live Demo of the Pygoat app is a great way to learn more about DevSecOps. Please bear in mind that this app is intentionally insecure!