Find and Fix Vulnerabilities in Your Pipeline With Snyk and Harness

When DevOps emerged more than 10 years ago, the main focus was to bridge the gaps between Dev and Ops teams. This was achieved by introducing automation to the processes of designing, building, testing, and deploying applications. 

As development teams continue to deliver faster and more frequently, security teams find it difficult to keep up. Often, they become the bottleneck in the delivery pipeline. For this reason, bringing security early into the DevOps process and embracing a DevSecOps culture has become increasingly important.

Integrating Snyk’s developer-focused security platform into Harness’ unified delivery pipeline workflow ensures security and compliance testing is part of every release. This allows you to prevent applications with vulnerable dependencies and code from making their way into production. With modern tooling like Snyk and Harness, you can find, fix, and remediate through a CI/CD pipeline and mitigate the risk to the business without affecting your ability to release software quickly.

Getting Started With Snyk

Snyk is a developer security platform that makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. It integrates directly into development tools, workflows, and automation pipelines.

Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.

Getting started with Snyk is as simple as heading over to snyk.io and signing up for a free account. 

Getting Started With Harness

Harness is the industry’s first Software Delivery Platform that uses AI to simplify your DevOps processes - CI, CD, Feature Flags, Cloud Cost Management, and much more.

Harness enables you to build complex deployments in minutes with reusable templates, saving both time and stress. With Harness, you can build pipelines in minutes.

Getting started with Harness is as simple as heading over to harness.io and setting up a free trial account. 

Prevent Vulnerabilities From Passing Through the Build and Deployment Process

The best way to demonstrate the combined power of Snyk and Harness is via a walkthrough, which you are welcome to set up and run for yourself. In this example, we use Snyk to demonstrate how to prevent vulnerabilities from passing through the build and deployment process by adding automated Snyk tests into a Harness workflow.

We use the following GitHub repository: https://github.com/mansong1/springbootemployee-api

If you wish to follow along, you will need the following:

1. Snyk Account
2. Harness Account

This tutorial makes the most sense after you’ve completed the following:

• CI Pipeline Quickstart
• Delegates Overview
• CI Stage Settings
• Learn Harness' Key Concepts

If you’ve completed/reviewed the above, you’ve learned how to set up a Harness CI workflow. 

Seven Steps to Running Snyk Tests in Harness

Step 1: Create Snyk API Token Secret

You need a Snyk API token to perform Snyk CLI tests. For enterprise customers, you can set up service accounts and create a token through Snyk App. For non-enterprise Snyk accounts, including our free Snyk tier, you can use the main user token.

Next, create a secret in Harness to store your Snyk API token by following these steps.

Step 2: Create a new Pipeline

1. Firstly, create a new project in Harness by clicking on +Project

2. Once you’ve created your project, go to the Continuous Integration Module to create a new pipeline.

Step 3: Add the Codebase

If this is the first CI Stage in the Pipeline, enable Clone Codebase in the CI Stage settings. If you have an existing Pipeline with a CI Stage, click Codebase. See Edit Codebase Configuration.

Step 4: Define the Build Farm Infrastructure

In the CI Stage Infrastructure, define the build farm for the Codebase.

See Kubernetes Cluster Build Infrastructure Setup.

Step 5: Configure a Run Snyk Test

In the CI Execution, click Add Step and then click Run.

The Run Step executes one or more commands on a container image.

Snyk offers multiple container images that wrap the Snyk CLI and come with relevant tooling for different languages. In this example, we are using the Maven version since that's what is used in this sample application.

For Step Settings on configuring a Run Step, see Run Step Settings and add your Snyk API token. 

You can now reference this environment variable in the Command section of the Run Step configuration.

Step 6: Run the Pipeline

Now you can run your Pipeline.

1. Click Save and Publish.
2. Click Run. The Pipeline Inputs settings appear.
3. In CI Codebase, click Git Branch.
4. In the Git Branch, enter the name of the branch where the Codebase is, such as master.

5. Click Run Pipeline.

Step 7: View Pipeline Execution

When the workflow runs, the Snyk Test Step fails because the project includes vulnerable dependencies. We can also click on the console view toggle to see the full report.

Note: To have better control over your tests, you can pass the severity-threshold flag to the Snyk test command with one of the supported options (low|medium|high|critical). With this flag, only vulnerabilities of provided level or higher will be reported

The entire Pipeline is available as YAML, also.

In Builds, click More Options (︙) and select Edit Pipeline.

Click YAML.

You can see the entire Pipeline as YAML (see below screenshot). You can edit anything in the Pipeline and run it again.

pipeline:
  stages:
      - stage:
            type: CI
            spec:
                infrastructure:
                    type: KubernetesDirect
                    spec:
                        connectorRef: org.GKE
                        namespace: harness-builds
                execution:
                    steps:
                        - step:
                              type: Run
                              spec:
                                  connectorRef: org.Dockerhub
                                  image: snyk/snyk-cli:1.745.0-maven-3.5.4
                                  command: |-
                                      snyk config set api=$SNYK_TOKEN
                                      snyk test
                                  privileged: true
                                  envVariables:
                                      SNYK_TOKEN:  <+secrets.getValue("org.SNYK_TOKEN")>
                                  resources:
                                      limits:
                                          memory: 1Gi
                                          cpu: "1.0"
                              name: Snyk Test
                              identifier: Snyk_Test
                cloneCodebase: true
            name: CI
            identifier: CI
  properties:
      ci:
          codebase:
              repoName: springbootemployee-api
              connectorRef: org.Github
              build: <+input>
  projectIdentifier: Snyk
  orgIdentifier: default
  name: Snyk Test
  identifier: Snyk_Test
  description: Test local project for vulnerabilities.

CI/CD Workflow

Besides scanning for application dependencies, vulnerabilities can creep in based on the choice of container used. In addition to that, misconfiguration of cloud resources attributes to the most prevalent cloud vulnerabilities exploited to access cloud data and services.

In this example, we will be building and deploying our application to Kubernetes then monitoring it using Snyk.

To build and push a container in Harness, simply follow these steps. Adding a Snyk container scanning step is similar to the Snyk Test Step above. 

To deploy the container to our Kubernetes cluster, see here. In our CD pipeline, we’ll be executing the Snyk test of our Kubernetes manifest before we do that. Adding a Snyk IaC test Step is done via a Shell Script Step.

The script executed in the Snyk IaC Step is as follows:

rm -rf springbootemployee-api || true

git clone https://github.com/mansong1/springbootemployee-api
cd springbootemployee-api

SNYK_TOKEN=<+secrets.getValue("org.SNYK_TOKEN")>
snyk config set api=$SNYK_TOKEN
snyk iac test manifests/<+infra.namespace>/templates/*.yaml

The complete CI/CD workflow looks like this:

As before, this pipeline can be viewed as YAML and is located in this GitHub repo.

Snyk integrates with Kubernetes, enabling you to import and test your running workloads and identify vulnerabilities in their associated images and configurations. Once imported, Snyk continues to monitor those workloads, identifying additional security issues as new images are deployed and the workload configuration changes.

A successful deployment through our Harness CD workflow shows up on Snyk App as follows:

Try it Now

When choosing a technology platform, it’s important to select one that places the needs of developers at the centre of its solutions. It should also focus on remediating issues rather than just reporting them. Platforms with a developer-first approach can integrate security across the pipeline, helping multiple different stakeholders such as devs, sec, and ops teams get a holistic view. This helps embed a mutual DevSecOps mindset and ensures more secure software in the hands of consumers.

Thank you so much for joining us for this tutorial. Don’t forget to try Snyk and Harness today!

This article was written in collaboration between Pas Apicella (Snyk) and Martin Ansong (Harness).

Martin is a Solutions Engineer in the Harness Commercial Sales organization, working to help customers accelerate the build and delivery of their software lifecycle. Prior to Harness, Martin worked in various engineering roles bringing a wealth of knowledge in cloud computing, automation tools, DevOps practices, and more. In his spare time, he enjoys sailing, sketching and juggling.

Pas Apicella is a Principal Solution Engineer APJ at Snyk, working on the Snyk Platform to help customers secure their cloud native applications and enable a DevSecOps culture while still meeting the business needs. He has contributed code to OSS projects and constantly blogs about cloud native architecture when time permits. He graduated from RMIT with a Bachelor of Computer Science and since then has worked for companies such as Snyk, Elastic, Pivotal, VMware, Oracle, and IBM in various roles.