Jenkins Configuration

Follow each sections below to configure Jenkins to establish connection with Container Protection.

1. FortiCWP Plugin Installation
2. FortiCWP Plugin Configuration
3. Pipeline Configuration
4. Freestyle Project Configuration
5. Vulnerability Scan Result

FortiCWP Plugin Installation

1. Log into your Jenkins account.
2. Click on Manage Jenkins at the left navigation menu.
3. In Manage Jenkins page, scroll down and click Manage Plugins.



4. Search for "forticwp" plugin, follow the instruction and install the plugin.

Note: If the plugin cannot be found, update the plugin list by clicking Check now at the bottom of the page.

FortiCWP Plugin Configuration

1. From Jenkins navigation menu, click Manage Jenkins.
2. In System Configuration, click Configure System.



3. Scroll down to FortiCWP CICD Plugin Configuration.

Click FortiCWP Login Region drop down menu, and select FortiCWP GLOBAL or FortiCWP EU Web Host accordingly and, click Verify Settings to check the connection to the Kubernetes agent Host Address. (Kuberenetes controller agent uses the port "30575" to connect to Jenkins.)



Note: The access token can be found in Configure > Kubernetes Cluster page on Container Protection. Click on the Actions button of the Kubernetes cluster and select View CI/CD Integration Configurations. Copy the Access Token from the CI/CD Integration Configurations.





4. Click the check box, "Enter this box and enter a host address instead of using FortiCWP default host address" if you have a host address. (Optional)

This option can be used when Kubernetes cluster and Jenkins are not in the same network and we need a way to divert traffic through a load balancer(FortiCWP Kubernetes Agent Host). In that scenario, we need to input the Kubernetes Agent Host address instead of the FortiCWP default host address (https://www.forticwp.com or https://eu.forticwp.com).

An example of FortiCWP Kubernetes Agent Host address (Load Balancer DNS in this case):



5. After clicking Verify Settings, if the connection is successful, then a success message will appear with the URL: http://KUBERNETES_CLUSTER_IP _ADDRESS:30575.

Note: There should not be any restriction on the port "30575" which includes firewall settings, security group settings, etc. for the connection to be successful.

For Example: "Successfully connected to https://172.31.42.188:30575"

The success message indicates the Jenkins has successfully connected to the Kubernetes cluster.

6. Click Save to save the configurations.

Note: After the Jenkins is configured, the Kubernetes cluster and Jenkins should be in same private network. Also, the port 30575 should be exposed for connection.

Pipeline Configuration

When building a new pipeline, please include the following code in Pipeline script to scan images to be evaluated for vulnerabilities by container protection:

fortiCWPScanner imageName: <image name>, block: <true>

Parameter Description:

imageName: image name should be in String, separated by comma if there are more than one image.

block: set to true to return a fail status if any vulnerability is found. The default value is set to true.

For Example:

1. Scan the "redis:latest" image:

fortiCWPScanner imageName: "redis:latest"

2. Scan both the "redis:latest" and "alpine:latest" image, do not block the build if vulnerability is found.

fortiCWPScanner imageName: "redis:latest, alpine:latest", block: false

Freestyle Project Configuration

In the case of freestyle project configuration, please add the step to scan container image in Build to scan for vulnerability.

1. In freestyle project configuration page, scroll down to Build, enter execute shell commands to be executed initially.

Example of Execute shell command:



2. Click Add build step drop down button, and select Scan container images to perform the image scan.

Specify the image name, for example, "redis:latest".



Check the "Fail the build if result is not compliant" checkbox to block the image from deployment if the image is not compliant.

3. In the last Execute shell command field, enter the shell command that will be executed only when the image scan is successful and in compliant.

If the image is not in compliant, the last set of commands will not be executed, and the build fails.

Example of the last Execute shell:



4. Click Save to save the configuration.

Vulnerability Scan Result

After a pipeline built, the result of vulnerability scan can be viewed from the build summary.

From the build navigation menu, click on Vulnerabilities to view the Image Vulnerability Summary.

When clicking on the Policy Detail link, you will be re-directed to Policy Detail page of the CI/CD Integration in Container Protection.