Azure DevOps Integration

App Registration

Before starting the integration, ensure you are logged in to the Azure website.

Click on Cloud Shell (opens in a new tab) in navbar and type az login in the terminal. If you are new to Azure, you might see a popup prompting you to select an environment. Choose Bash.

You will then be prompted to select a subscription. Choose Mount storage account if you wish to store data; otherwise, proceed with No storage account required.

After entering the az login command, you will be able to see the below and follow the steps as shown.

Cloud Shell is automatically authenticated under the initial account signed-in with. Run 'az login' only if you need to use a different account
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code E******S to authenticate.

Follow the provided link: https://microsoft.com/devicelogin (opens in a new tab) and enter the code displayed in Cloud Shell to complete the login process.

After completing the validation, you will get the details that are specific to tenant.

Download flyingduck-azure-integration script on azure terminal using the following command.

wget https://awosasins-artifacts.s3.amazonaws.com/flyingduck-azure-integration/setup.sh

Run the script using the command

sh setup.sh --enable devops

• FlyingDuck app will be downloaded in to your azure.
• You will be asked for app registration permission either yes or no.
• If you pass yes, enter the name example-name for the app registration so that app will be created with that name.

Custom role FlyingDuckAzureDeveopsRole will be created, this role will be assigned to the app registration with the application id. You wil get some details like :

• Application Name: [app name]
• Application ID (Client ID): [some Id]
• Tenant ID: [some Id]
• Client Secret: [some Id]
• Subscription id: [some Id]

App Permissions

Login to your Azure DevOps and go to organisation settings.

After opening the organisation settings click on Users.

In the Users tab click on Add User.

In the Add new users section, enter the name example-name that you provided during App registration in the Azure terminal. Select all the options as shown in the image below, under Add to projects select the projects you want to integrate and then click on Add.

If a project was created after the user was set up, you can still assign it to that user. Simply click on the three dots, choose Manage Access.

A list of all available projects in the organization will be displayed in the Projects section, select the necessary projects.

Click on Save.

Events Configuration

To capture continuous events from azure devops, need to perform two steps.

Click on Cloud Shell (opens in a new tab) to open azure terminal.

Function App

In the terminal run the below commands.

wget https://awosasins-artifacts.s3.amazonaws.com/flyingduck-azure-integration/fd-azure-function-app.sh

chmod +x fd-azure-function-app.sh

sh fd-azure-function-app.sh

After running this command, you will be prompted to provide certain details, as shown in the below.

If no input is provided for the above details, default values will be used and pass the FlyingDuck API Key.

The message "Azure Function App created successfully!" will be displayed after completing the function app step.

Service Hooks

wget https://awosasins-artifacts.s3.amazonaws.com/flyingduck-azure-integration/fd-azure-service-hooks.sh

chmod +x fd-azure-service-hooks.sh

sh fd-azure-service-hooks.sh

Install App

After completing all the required steps, go to the FlyingDuck portal and go to integrations page.

On the Integrations page, click on Azure DevOps to start integration.

After completing the App Registration and App Permissions, select the checkbox that you have completed required steps and click the Continue button.

Enter the specified details: Client ID, Tenant ID, Client secret, and Organization Name (the name of your Azure DevOps organization), then click the Continue button.

Active Branches

Under active branches, specify the branch name as shown in the image.

By clicking on the Save & Continue button, the branch name that you gave will be saved.

API Key

If you've created API Key previously you can click on Skip or else you can create a new API Key.

Provide a name to your API Key that your about to create and click on Generate API key

A new API Key will be generated that will be shown once, so store it with you confidentially.

Clicking on Next step will take you to code scan section.

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -v $(Build.SourcesDirectory):/src  ${{ variables.imageName }} 
    displayName: 'Run Duckdefender Container'

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -v $(Build.SourcesDirectory):/src  \
      --entrypoint /bin/sh ${{ variables.imageName }} -c "duckdefender code --all"
    displayName: 'Run Duckdefender Container'

pool:
  vmImage: 'ubuntu-latest'

pool:
  name: configuredPoolName

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      - feature/*
      - bug/*

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -e LOG_LEVEL="debug" \
      -v $(Build.SourcesDirectory):/src  ${{ variables.imageName }}
    displayName: 'Run Duckdefender Container'

On-premise Runner

Automated Scan

After selecting the scanning option, enable the checkbox to automatically scan the code upon each commit. This functionality is available only when a runner is configured and active.