Security Center:Jenkins pipeline integration

Jenkins version requirements

Make sure you are using Jenkins 1.625.3 or later.

Download the CI/CD plug-in

1. Log on to the Security Center console. In the top navigation bar, select the region of the asset you want to manage. You can select Chinese Mainland or Outside Chinese Mainland.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > CI/CD Integration Settings.

3. Click Integration Configuration.

4. In the Integration Configuration panel, click Download Plug-in in the upper-right corner.

The plug-in file (sas-jenkins-plugin) downloads to your computer in HPI format.

Install the CI/CD plug-in on Jenkins

This example uses the Jenkins 2.479.1 interface.

1. Log on to Jenkins.

2. In the left-side navigation pane, click Manage Jenkins.

3. On the Manage Jenkins page, click Plugins.

4. On the Plugins page, click the Advanced settings tab.

5. In the Deploy Plugin section, click Choose File and select the sas-jenkins-plugin HPI file downloaded earlier.

6. Click Deploy.

7. Restart Jenkins.

   Important

   The sas-jenkins-plugin plug-in takes effect only after Jenkins restarts. You can select the Restart Jenkins when installation is complete and no jobs are running checkbox to allow Jenkins to restart automatically when idle.

Configure image scanning

1. Log on to Jenkins.

2. Find the Pipeline project whose images you want to scan and click the project name.

3. In the left-side navigation pane, click Configure.

4. In the Pipeline section, configure the Security Center CI/CD plug-in integration with your Jenkins Pipeline.

   The following Jenkinsfile syntax examples are provided for scripted and declarative pipelines. Choose one based on your needs.

   • Scripted Pipeline

     node {
         sas(accessKeyId: '$AK', accessKeySecret: '$SK', token: '$TOKEN', imageId: '$IMAGE', domain: '$DOMAIN', registryUrl: '$REGISTRY_URL', registryUsername: '$REGISTRY_USERNAME', registryPwd: '$REGISTRY_PWD')
     }

   • Declarative Pipeline

     pipeline {
         agent any
     
         environment {
             ACCESS_KEY_ID = '$AK'
             ACCESS_KEY_SECRET = '$SK'
             IMAGE_ID = '$IMAGE'
             TOKEN = '$TOKEN'
             DOMAIN = '$DOMAIN'
             REGISTRY_URL = null
             REGISTRY_USERNAME = null
             REGISTRY_PWD = null
         }
     
         stages {
             stage('Build') {
                 steps {
                     sas(accessKeyId: env.ACCESS_KEY_ID, accessKeySecret: env.ACCESS_KEY_SECRET, imageId: env.IMAGE_ID, token: env.TOKEN, domain: env.DOMAIN, registryUrl: env.REGISTRY_URL, registryUsername: env.REGISTRY_USERNAME, registryPwd: env.REGISTRY_PWD)
                 }
             }
         }
     }

5. Click Save.

After the integration is configured, Security Center runs an image security scan task each time you build the project, scanning your project images for security risks. The build console output displays Step.1 Image security scan started (loading the scanner image) followed by Step.2 Security scan in progress (analyzing the target image), indicating that the image security scan task is running.

What's next

View image scanning results on the Container tab of the Assets page in the Security Center console. For more information, see View image scan results.