Enabling Snyk Testing in the Tanzu Java Buildpack
· 7 min read
The Tanzu Java Buildpack ships with various 3rd-party integrations, and one of them enables testing with Snyk.
Introduction
The Tanzu Java Buildpack is a commercial Cloud Native Buildpack supported by VMware.
It bundles buildpacks that enable various 3rd-party integrations. Information is still scarce, but some of these appear to be supported. This post looks into enabling this one:
tanzu-buildpacks/snyk
Reading material
Information is scarce, but I used the following as references:
https://docs.pivotal.io/tanzu-buildpacks/release-notes/tanzu-snyk-release-notes.html
https://docs.pivotal.io/build-service/1-1/managing-images.html#service-bindings
It seems that kpack's ServiceBindings mechanism lets you invoke additional buildpacks.
Environment
Tanzu Build Service 1.1.1
Trying it
Let's try it quickly.
Create the Image resource
Create a YAML file like the one below. Change the value of tag to match your environment.
apiVersion: kpack.io/v1alpha1
kind: Image
metadata:
name: spring-petclinic-snyk
spec:
builder:
kind: ClusterBuilder
name: default
source:
git:
revision: main
url: https://github.com/spring-projects/spring-petclinic
tag: <REPO>/<LIBRARY>/<IMAGE>
bindings:
- name: snyk
metadataRef:
name: snyk
secretRef:
name: snyk-secret
---
apiVersion: v1
kind: Secret
metadata:
name: snyk-secret
type: Opaque
stringData:
org-name: YYYYY
api-token: XXXXXXXXXXXXXXXXXX
api-url: https://snyk.io/api
---
apiVersion: v1
kind: ConfigMap
metadata:
name: snyk
data:
kind: snyk
provider: snyk
Update these values with your snyk account information:
stringData:
org-name: YYYYY
api-token: XXXXXXXXXXXXXXXXXX
api-url: https://snyk.io/api
The key points of this YAML are the Bindings definition and the kind: snyk in the ConfigMap. This makes the snyk buildpack get invoked additionally at build time.
Apply
Apply the YAML above:
kubectl apply -f <yaml-file> -n <namespace>
That's it. Now let's check the behavior.
Checking the behavior
After a while, a failed Job shows up like this:
kubectl get po -n petclinic-build
NAME READY STATUS RESTARTS AGE
spring-petclinic-snyk-build-1-mcbn6-build-pod 0/1 Init:Error 0 21m
Since it's an error you might think this is pointless — but let's check the logs. Looking at the Detect phase first, the Snyk buildpack has indeed been added:
# kubectl logs spring-petclinic-snyk-build-1-mcbn6-build-pod -n petclinic-build -c detect
8 of 33 buildpacks participating
paketo-buildpacks/ca-certificates 2.0.0
tanzu-buildpacks/snyk 3.0.0 <<<< here!!
paketo-buildpacks/bellsoft-liberica 7.0.0
paketo-buildpacks/maven 4.0.0
paketo-buildpacks/executable-jar 4.0.0
paketo-buildpacks/apache-tomcat 4.2.0
paketo-buildpacks/dist-zip 3.0.0
paketo-buildpacks/spring-boot 4.0.0
Looking further at the Build phase, the cause of the error turns out to be the Snyk test result:
# kubectl logs spring-petclinic-snyk-build-1-mcbn6-build-pod -n petclinic-build -c build
Paketo CA Certificates Buildpack 2.0.0
https://github.com/paketo-buildpacks/ca-certificates
Launch Helper: Reusing cached layer
Tanzu Snyk Buildpack 3.0.0
https://github.com/pivotal-cf/tanzu-snyk
Build Configuration:
$BP_SNYK_BREAK_BUILD true whether to fail build when issues are found
$BP_SNYK_SEVERITY_THRESHOLD low the lowest severity of issues to display and use to determine build breakage
Testing...
Tanzu Snyk Buildpack 3.0.0
unable to test
could not download https://snyk.io/api/v1/test/maven?org=machih: 403
ERROR: failed to build: exit status 1
So we at least confirmed that the expected buildpack is invoked correctly.
As for this error, my research suggests it happens because Snyk free accounts have no API access. So a paid Snyk account appears to be required. Giving up at this point for now.
Summary
3rd-party integrations can easily be invoked from the Tanzu Java Buildpack. However, as the result shows, no actual testing happened, so I'll post the method once I learn more details. For now, this is an "it runs" level introduction.