Skip to content

NEXT_STEPS.md

Latest commit

 

History

History
229 lines (165 loc) · 6.19 KB

NEXT_STEPS.md

File metadata and controls

229 lines (165 loc) · 6.19 KB
Raw

🎯 DevSecOps Jenkins - Next Steps

✅ Current Status: SUCCESS!

Your Jenkins DevSecOps environment is fully operational with all security tools installed and ready.

🌐 Access Your Jenkins

URL: http://localhost:8081

🚀 Step 1: Access Jenkins (2 minutes)

  1. Open your browser and navigate to: http://localhost:8081

  2. You should see the Jenkins dashboard (no login required initially)

  3. If prompted for setup, click "Skip and continue as admin"

🔧 Step 2: Install Required Plugins (5 minutes)

  1. Go to: Manage Jenkins → Plugins → Available plugins

  2. Search and install these plugins:

    • ✅ HTML Publisher Plugin
    • ✅ Warnings Next Generation Plugin
    • ✅ Pipeline Stage View Plugin
    • ✅ Blue Ocean (optional, for modern UI)

  3. Click "Install without restart"

🔐 Step 3: Set Up Security (3 minutes)

  1. Go to: Manage Jenkins → Security

  2. Configure Global Security:

    • Security Realm: Jenkins' own user database
    • Authorization: Logged-in users can do anything
    • ✅ Allow users to sign up

  3. Create Admin User:

    • Click "Sign up" in top right
    • Username: admin
    • Password: admin123
    • Full name: DevSecOps Admin
    • Email: admin@devsecops.local

🔑 Step 4: Add Credentials (5 minutes)

GitHub Credentials

  1. Go to: Manage Jenkins → Credentials → System → Global credentials
  2. Add Credentials:
    • Kind: Username with password
    • Username: eknathdj (your GitHub username)
    • Password: Your GitHub Personal Access Token
    • ID: github-creds
    • Description: GitHub Personal Access Token

DockerHub Credentials

  1. Add Credentials (same location):
    • Kind: Username with password
    • Username: Your DockerHub username
    • Password: Your DockerHub password
    • ID: dockerhub-creds
    • Description: DockerHub Registry Credentials

🔄 Step 5: Create DevSecOps Pipeline (5 minutes)

  1. Click "New Item"

  2. Configure:

    • Name: devsecops-sample-app
    • Type: Pipeline
    • Click "OK"

  3. Pipeline Configuration:

    • Description: DevSecOps CI/CD Pipeline with Security Scanning
    • ✅ GitHub project: https://github.com/eknathdj/devops-sample-app
    • Build Triggers: ✅ GitHub hook trigger for GITScm polling
    • Pipeline Definition: Pipeline script from SCM
    • SCM: Git
    • Repository URL: https://github.com/eknathdj/devops-sample-app
    • Credentials: Select github-creds
    • Branch: */main
    • Script Path: Jenkinsfile.devsecops

  4. Click "Save"

🧪 Step 6: Test Your First DevSecOps Build (10 minutes)

  1. Go to your pipeline: devsecops-sample-app

  2. Click "Build Now"

  3. Monitor the build:

    • Click on build number (e.g., #1)
    • Click "Console Output"
    • Watch the security scans execute

Expected Pipeline Stages:

🔧 Setup & Checkout (1-2 min)
🔍 Pre-Build Security Scans (5-8 min)
  ├── 🔐 Secret Detection
  ├── 📋 SAST Analysis  
  └── 🛡️ Infrastructure Security
🔨 Build & Test (2-3 min)
🔍 Container Security Scans (8-12 min)
  ├── 🛡️ Trivy Vulnerability Scan
  └── 🔍 Trivy Configuration Scan
📊 Security Report Generation (1-2 min)
🚀 Deploy (2-3 min) [main branch only]

📊 Step 7: Review Security Reports

After the build completes:

  1. Check Build Artifacts:

    • Download security-scan-results.tar.gz
    • View individual JSON reports

  2. Security Dashboard:

    • Look for "DevSecOps Security Report" link
    • Review security metrics and findings

  3. Console Output:

    ✅ Secret Detection: No secrets detected
✅ SAST Analysis: 0 critical, 2 high issues
✅ Container Security: 0 critical, 3 high vulnerabilities
✅ All security gates passed!

🌐 Step 8: Set Up GitHub Webhook (Optional)

For automatic builds on code changes:

  1. Go to GitHub: https://github.com/eknathdj/devops-sample-app
  2. Settings → Webhooks → Add webhook
  3. Payload URL: http://YOUR_IP:8081/github-webhook/
  4. Content type: application/json
  5. Events: Just the push event

🎯 Success Criteria

After completing these steps, you should have:

  • ✅ Jenkins accessible at http://localhost:8081
  • ✅ All security tools working (8 tools installed)
  • ✅ DevSecOps pipeline created and functional
  • ✅ Security scans running automatically
  • ✅ Security reports generated with each build
  • ✅ Security gates enforced with configurable thresholds

🔧 Troubleshooting

Jenkins Not Accessible

# Check if container is running
docker ps | findstr jenkins-devsecops

# Check logs
docker logs jenkins-devsecops

# Restart if needed
docker-compose -f docker-compose-simple.yml restart

Security Tools Not Working

# Test tools in container
docker exec jenkins-devsecops bash -c "
gitleaks version &&
trivy version &&
semgrep --version &&
checkov --version
"

Pipeline Fails

  • Check Console Output for specific errors
  • Verify credentials are set up correctly
  • Check security tool logs in build output
  • Adjust security thresholds if needed

🎉 Congratulations!

You now have a production-ready DevSecOps pipeline with:

  • 8 Security Tools integrated and working
  • Automated Security Scanning on every build
  • Security Gate Enforcement with configurable thresholds
  • Comprehensive Security Reporting and dashboards
  • CI/CD Integration with GitHub and DockerHub

🚀 What You've Achieved

This is an enterprise-grade DevSecOps implementation that includes:

  1. Shift-Left Security - Catching issues early in development
  2. Multi-Layer Security Scanning - Secrets, SAST, containers, IaC
  3. Automated Policy Enforcement - Security gates with thresholds
  4. Comprehensive Reporting - JSON reports and HTML dashboards
  5. CI/CD Integration - Seamless integration with existing workflows

🎯 Ready to start your first secure build? Go to http://localhost:8081 and begin!