Fortinet black logo

Online Help

CI/CD Integration Protection

Copy Link
Copy Doc ID 73ddbf8a-9129-11ec-9fd1-fa163e15d75b:43484

CI/CD Integration Protection

Container Protection integrates Jenkins to offer image protection using CVE (Common Vulnerability and Exposure) index. Each image generated by Jenkins is reviewed and scanned for vulnerability against the CVE index. And only the images with vulnerability below the pre-configured threshold will be uploaded to the Kubernetes registry.

Prerequisite

CI/CD integration requires Jenkins to be setup with Container Protection. Follow the instructions in the following to setup Jenkins with Container Protection:

  1. Add Policy to CI/CD Integration
  2. Jenkins Configuration

CI/CD Integration Page

After you have configured Jenkins with Container Protection, each image generated by Jenkins project will be reviewed and scanned for vulnerability using CVE index. The scanned result can be viewed in FortiView > CI/CD Integration.

Notice the image build names on CI\CD Integration page matches the image names generated on Jenkins under the same project.

When you click on image build names in CI\CD Integration page, it will show you the block status, vulnerability, and risk score.

Risk Score Risk score is determined using the vulnerabilities detected from the build images.
Vulnerability Vulnerability is sourced from CVE (Common Vulnerability and Exposure) index and is used to discover vulnerability of the build image.
Block Status A "Block" status means that image was blocked by Container Protection to be uploaded to the Kubernetes registry due to the vulnerabilities detected. A "Pass" status means the image generated by Jenkins is under the vulnerability threshold and has been uploaded to the Kubernetes registry.

The Vulnerability distribution line chart has 4 severity levels, the following table explains the representation of the severity level by color:

Color

Vulnerability Severity Level

Critical severity level vulnerability
High severity level vulnerability
Medium severity level vulnerability
Low severity level vulnerability

For example,the generated image "redis" above has 9 vulnerability in critical servility level, 34 in high severity level, 95 in medium severity level and 20 in low severity level. It received an overall risk score of 16. The reason the image is blocked and prevented to be deployed is because the policy configuration of the project. When you looked at the policy details of "forticontainer_demo_policy_1", the image will be blocked if there is more than 1 medium severity level vulnerability. You can adjust the policy configuration following the guide in Add Policy to CI/CD Integration.

Vulnerability View

When clicking on the image detail button from CI/CD Integration Project page, then Image Details page will show all the CVE vulnerability.

All the vulnerabilities discovered from the project will be displayed in Image Detail page.

Click on More CVE Info to show the particular vulnerability details:

For full description on the vulnerability, click on More Info, and you will be re-directed to the details provided by National Vulnerability Database (NVD). For more details on National Vulenrability Database, please visist https://nvd.nist.gov/vuln.

Layers View

Click on the Layers tab on the same Image Detail page, then Layers View will be shown.

Layers View contains the image core layers that were reviewed and scanned for vulnerability, click on each layer for detail.

CI/CD Integration Protection

Container Protection integrates Jenkins to offer image protection using CVE (Common Vulnerability and Exposure) index. Each image generated by Jenkins is reviewed and scanned for vulnerability against the CVE index. And only the images with vulnerability below the pre-configured threshold will be uploaded to the Kubernetes registry.

Prerequisite

CI/CD integration requires Jenkins to be setup with Container Protection. Follow the instructions in the following to setup Jenkins with Container Protection:

  1. Add Policy to CI/CD Integration
  2. Jenkins Configuration

CI/CD Integration Page

After you have configured Jenkins with Container Protection, each image generated by Jenkins project will be reviewed and scanned for vulnerability using CVE index. The scanned result can be viewed in FortiView > CI/CD Integration.

Notice the image build names on CI\CD Integration page matches the image names generated on Jenkins under the same project.

When you click on image build names in CI\CD Integration page, it will show you the block status, vulnerability, and risk score.

Risk Score Risk score is determined using the vulnerabilities detected from the build images.
Vulnerability Vulnerability is sourced from CVE (Common Vulnerability and Exposure) index and is used to discover vulnerability of the build image.
Block Status A "Block" status means that image was blocked by Container Protection to be uploaded to the Kubernetes registry due to the vulnerabilities detected. A "Pass" status means the image generated by Jenkins is under the vulnerability threshold and has been uploaded to the Kubernetes registry.

The Vulnerability distribution line chart has 4 severity levels, the following table explains the representation of the severity level by color:

Color

Vulnerability Severity Level

Critical severity level vulnerability
High severity level vulnerability
Medium severity level vulnerability
Low severity level vulnerability

For example,the generated image "redis" above has 9 vulnerability in critical servility level, 34 in high severity level, 95 in medium severity level and 20 in low severity level. It received an overall risk score of 16. The reason the image is blocked and prevented to be deployed is because the policy configuration of the project. When you looked at the policy details of "forticontainer_demo_policy_1", the image will be blocked if there is more than 1 medium severity level vulnerability. You can adjust the policy configuration following the guide in Add Policy to CI/CD Integration.

Vulnerability View

When clicking on the image detail button from CI/CD Integration Project page, then Image Details page will show all the CVE vulnerability.

All the vulnerabilities discovered from the project will be displayed in Image Detail page.

Click on More CVE Info to show the particular vulnerability details:

For full description on the vulnerability, click on More Info, and you will be re-directed to the details provided by National Vulnerability Database (NVD). For more details on National Vulenrability Database, please visist https://nvd.nist.gov/vuln.

Layers View

Click on the Layers tab on the same Image Detail page, then Layers View will be shown.

Layers View contains the image core layers that were reviewed and scanned for vulnerability, click on each layer for detail.