WO2020042086A1 - 一种实现DevOps的方法及系统 - Google Patents

一种实现DevOps的方法及系统 Download PDF

Info

Publication number
WO2020042086A1
WO2020042086A1 PCT/CN2018/103278 CN2018103278W WO2020042086A1 WO 2020042086 A1 WO2020042086 A1 WO 2020042086A1 CN 2018103278 W CN2018103278 W CN 2018103278W WO 2020042086 A1 WO2020042086 A1 WO 2020042086A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
image
application
module
information
Prior art date
Application number
PCT/CN2018/103278
Other languages
English (en)
French (fr)
Inventor
阳运生
Original Assignee
深圳市互盟科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市互盟科技股份有限公司 filed Critical 深圳市互盟科技股份有限公司
Priority to PCT/CN2018/103278 priority Critical patent/WO2020042086A1/zh
Publication of WO2020042086A1 publication Critical patent/WO2020042086A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management

Definitions

  • the present invention relates to the field of software development, and more specifically, to a method and system for implementing DevOps.
  • DevOps the combination of Development and Operations is a culture, movement, or practice that values the communication and cooperation between "software developers (Dev)” and "IT operations and maintenance technicians (Ops)”] is for efficient management Software life cycle, improve iteration speed and production efficiency.
  • the CI / CD pipeline standardizes and automates the three core development, testing, and deployment phases of the software life cycle to achieve continuous integration and continuous deployment.
  • An object of the present invention is to provide a method for implementing DevOps in view of the defects existing in the prior art.
  • a method for implementing DevOps includes:
  • performing a security scan on the base image to obtain a compliant image includes:
  • Vulnerability detection by analyzing and scanning the base image and its application, to obtain vulnerability information
  • Behavioral compliance analysis by analyzing behavioral compliance of running applications to obtain information on non-compliant behaviors
  • Run-time security check to obtain security alarm information by analyzing the security status of the current application.
  • the basic image can be discovered before it is delivered to the image warehouse, and the existing image can be re-encoded and an image can be constructed in time.
  • the analyzing and scanning the base image and its application to obtain vulnerability information includes:
  • the security scan database is synchronized with the vulnerability information database in real time.
  • the security scanning database is synchronized with the vulnerability information database in real time to ensure the latestness of the vulnerability and avoid the problem of being attacked due to the lag of vulnerability information of the security scanning database.
  • the analyzing the behavioral compliance of the running application and obtaining the non-compliance behavior information includes:
  • the obtained current application behavior information is compared with the database behavior compliance information in the security scan, and the non-compliant behavior information is obtained according to the comparison result.
  • the security scan database actually defines a behavior specification.
  • the non-compliant behavior information is obtained by analyzing the behavior of the current application, and the non-compliant behavior of the application can be eliminated in time.
  • the obtaining the security alarm information by analyzing the security status of the current application includes:
  • the security information obtained by analyzing the security status of the current application is compared with the security policies in the security scanning database, and the security alarm information is obtained according to the comparison result.
  • the security scanning database has customized security policies.
  • a system for implementing DevOps includes:
  • a coding module for continuously triggering coding according to the changing requirements of the business
  • Image construction module which is used to perform image construction according to the encoding result to obtain a basic image
  • a security scanning module configured to perform security scanning on the base image to obtain a compliant image
  • An image test module configured to perform a system test on the compliant image, obtain an application image, and deliver the application image to an image warehouse;
  • the application deployment module performs application deployment according to the application image, and continuously monitors and feedbacks business requirements.
  • the security scanning module includes:
  • a vulnerability detection sub-module is used for vulnerability detection, and the vulnerability detection sub-module is used to analyze and scan the base image and its application to obtain vulnerability information;
  • the runtime security check sub-module is used for runtime security check, and the runtime security check sub-module is used to analyze the current security status of the application to obtain security alarm information.
  • the vulnerability detection sub-module, the behavior compliance sub-module, and the runtime security check sub-module are used to scan the base image, thereby improving the security and stability of the base image.
  • the security scanning module further includes a security scanning data sub-module, the security scanning data sub-module is configured to store security scanning data, provide data support for the security scanning module, and construct a security scanning database.
  • the security scanning data sub-module is configured to store security scanning data, provide data support for the security scanning module, and construct a security scanning database.
  • security scanning In security scanning, a large amount of data is used for comparison, and the security scanning data sub-module provides data resources for data comparison. Build a security scan database that can be used for security scan data management.
  • the security scan data sub-module includes:
  • a vulnerability data unit configured to provide data support for the vulnerability detection submodule
  • a behavior compliance data unit configured to provide data support for the behavior compliance submodule
  • the runtime safety inspection data unit is configured to provide data support for the runtime safety inspection sub-module.
  • the security scanning data sub-module is divided into three data units, which can increase the specificity of data and speed up the speed of data search and comparison.
  • the beneficial effect brought by the present invention is that by performing a security scan on the base image before the image is delivered, the security risks existing in the base image can be scanned, and the security of the application can be obtained in advance, avoiding unknown when the application is released to the production environment Risks and major losses increase the efficiency of DevOps.
  • FIG. 1 is a schematic flowchart of a method according to an embodiment of the present invention
  • FIG. 2 is a security scanning frame diagram according to an embodiment of the present invention
  • FIG. 3 is a system block diagram of an embodiment of the present invention.
  • the present invention provides a method and system for implementing DevOps.
  • DevOps is a method of continuous integration, continuous delivery, deployment and release, continuous monitoring, and continuous feedback.
  • continuous integration Continuous changes in requirements trigger continuous coding and construction processes; continuous delivery, business applications that have completed testing are delivered to the appropriate nodes in a suitable manner; deployment and release, the delivered business applications are deployed to the production environment in accordance with rules, and released after completion of testing .
  • Continuous monitoring monitoring the operating status of business applications and system platforms from time to time, forming monitoring reports.
  • Continuous feedback is based on the use of monitoring and business applications, continuous data analysis, and continuous suggestions for improvement. Continuous improvement, based on feedback, start a new improvement planning process.
  • the environment includes: continuous integration for software development / continuous deployment (CI / CD) stream development terminal and service host, test terminal for software testing, and service terminal for operation and maintenance.
  • continuous integration Jenkins can be used as the engine. Jenkins is a scalable continuous integration engine.
  • BAMBOO Glassian bamboo
  • Build Server non-open source software
  • Configure version iteration control and choose version control tools such as Github (gitHub is a hosting platform for open source and private software projects), GitLab (GitLab is an open source project for warehouse management systems, using Git as a code management tool, and Web services built on this basis), SVN (SVN is the abbreviation of Subversion, is an open source version control system), CVS (CVS is a C / S system, is a commonly used code version control software) and other tools Perform version iteration control.
  • Configure the application container engine which can be configured as a Docker (Docker is an open source application container engine) container engine.
  • the method includes:
  • Developers write corresponding computer code based on the business needs.
  • Business requirements are constantly changing. Developers can choose the old code that can implement the business requirements based on the content of the business requirements, or they can write new code based on the content of the business requirements.
  • the content of the business requirement is A, and the code that implements A has been written by the developer before, and can be directly referenced. If the content of the business requirement is B, it is a new business requirement, and the developer is before If you haven't written it, you need to write it.
  • step S1 also includes: S10, start, the developer writes the code; S11, the developer submits the code through the development terminal and submits the code to the code warehouse, S12, triggers the configuration of Jenkins (Jenkins is a powerful application, Allow continuous integration and continuous delivery projects, no matter what platform is used)
  • the engine platform automatically compiles the code, S13, call the code analysis tool to unit test the code, check whether the code is successfully tested, and get the quality of the code.
  • the automatic compilation may be triggered automatically when the code is submitted, or it may be triggered manually. After the code is submitted, the automatic compilation is not triggered automatically, and the manual compilation may be used. When unit testing the code, you can implement it with Sonar (Sonar is an open platform for code quality management).
  • the automatic trigger can be preset trigger conditions, such as timing, code submission events, or through webhook (Webhooks is a behavior that a user changes a web application through a custom callback function) as a preset trigger condition.
  • the unit test is automatically performed, and the unit test environment is preset according to environmental requirements, test logic, and the like.
  • the image build is automatically started.
  • the image build is based on the dockerfile file definition. You can upload the dockerfile file to the code warehouse beforehand. When starting the build image, you can call the dockerfile file with a general script, or you can define the Upload the dockerfile.
  • Security scanning can be divided into three levels: vulnerability detection, compliance checking, and runtime security. They correspond to vulnerability libraries, behavior compliance, and self-defined policies.
  • security scanning architecture security scanning can Detection, compliance check, and runtime security are performed in three aspects; among them, vulnerability detection will be connected to the public network CVE information library, and the base image of the running container and the installed application software package will be analyzed for vulnerability analysis.
  • Containers check, such as exposed ports, SSH service, root user, running parameters and permissions, etc.
  • Runtime security is mainly checked against some custom policies, such as restricting certain ports, protocol types, etc.
  • security scans each Modules are called through RESTful (REpresentational State Transfer) API (REST-style API), event notification, etc.
  • step S1 is executed, that is, the developer corrects the hidden danger or rewrites the related code.
  • step S1 is executed, that is, the developer corrects the hidden danger or rewrites the related code.
  • step S1 submit it to the code warehouse to trigger the platform that configures the Jenkins engine to automatically compile the code, build a new base image, and perform vulnerability detection again based on the new base image.
  • a compliant image is obtained.
  • the platform configured with the Jenkins engine will automatically start a system test to test the compliant image.
  • the system test can call or interface with a third-party test framework to achieve automatic testing and the test is completed. The test results will be reported later.
  • the failure reason is determined according to the reported test result, and a report is formed and sent back to the development terminal.
  • the developer modifies or rewrites the code according to the report, and executes step S1.
  • the compliance image is obtained after the system test is passed, and the platform configured with the Jenkins engine uploads the secure and tested application image to the mirror repository, so that the production environment can be pulled directly from the mirror repository Reliable images for production deployment.
  • Step S5 includes: S51. Pull an application image from the image repository and run it as a container application. S52. Trigger application deployment.
  • the process is defined, the production environment resources, application configuration, application parameters, etc. are defined. After the application deployment is triggered, the entire application deployment process is automatically completed.
  • the entire CI / CD (Continuous Integration / Continuous Deployment) or DevOps is a continuous, automated process or method. With this process or method, the entire application can Complete continuous upgrades and iterations.
  • a security scanning process is added to the current DevOps process to perform a security scan of the base image, so that the application image can determine whether there is a risk in advance in the process, and it is not necessary to wait for the application to go online or be attacked and then restart Application release.
  • This system or method not only improves the lack of current DevOps processes, but also improves the efficiency, sustainability, and automation of DevOps.
  • the performing a security scan on the base image to obtain a compliant image includes:
  • Vulnerability detection by analyzing and scanning the base image and its application, to obtain vulnerability information
  • step S1 that is, the developer corrects the vulnerability or rewrites the relevant code, and then submits it to the code warehouse to trigger the configuration of the Jenkins engine.
  • the platform automatically compiles the code, according to the new base image, and conducts vulnerability detection again.
  • Behavioral compliance analysis by analyzing behavioral compliance of running applications to obtain information on non-compliant behaviors
  • Behavioral compliance is defined in the security scan database according to the CIS specification. By analyzing the behavior of the current application and comparing it with the behavioral compliance of the database in the security scan, the corresponding non-conformance is obtained Information.
  • step S1 is performed, that is, the developer corrects or rewrites the related behavior that results in the corresponding violation of the code of conduct. Submitting it to the code warehouse triggers the platform that configures the Jenkins engine to automatically compile the code, according to the new base image, and conduct behavior compliance analysis again.
  • Run-time security check to obtain security alarm information by analyzing the security status of the current application.
  • the customized policies are analyzed, and the customized policies are also stored in the security scan database.
  • the security status of the current application is compared with the database customized policies in the security scan to obtain corresponding application security alarm information.
  • step S1 is executed, that is, the developer corrects or rewrites the corresponding custom strategy, and then submits it to the code warehouse to trigger.
  • Configure the platform of the Jenkins engine to automatically compile the code, according to the new base image, and perform runtime security checks again.
  • the basic image can be discovered before it is delivered to the image warehouse, and then the existing image can be re-encoded and imaged in time.
  • the obtaining the vulnerability information by analyzing and scanning the base image and its application includes:
  • the security scan database is synchronized with the vulnerability information database in real time.
  • the security scanning database is synchronized with the vulnerability information database in real time to ensure the latestness of the vulnerability and avoid the problem of being attacked due to the lag of vulnerability information of the security scanning database.
  • the security scanning database can synchronize CVE vulnerability information database information on the public network in real time, and the security scanning database can also be connected with other vulnerability information databases, which is not limited herein.
  • the obtaining the non-compliant behavior information by analyzing the behavior compliance of the running application includes:
  • the obtained current application behavior information is compared with the database behavior compliance information in the security scan, and the non-compliant behavior information is obtained according to the comparison result.
  • the security scan database actually defines a behavior specification.
  • the non-compliant behavior information is obtained by analyzing the behavior of the current application, and the non-compliant behavior of the application can be eliminated in time.
  • the security scan database may define compliance information of the application in operation according to the CIS specification in the security scan database, run the base image as a container application, and use each piece of compliance information in the security scan database. Perform a one-to-one comparison scan of the behavior of the container application, or logically or aggregate each compliance information in the security scan database, and then scan the container application when it runs out of order.
  • the compliance behavior indicates that there is non-compliance information in the base image, that is, non-compliance caused by the code level, the code needs to be re-evaluated and written, and then step S1 is performed.
  • the acquiring the security alarm information by analyzing the security status of the current application includes:
  • the security information obtained by analyzing the security status of the current application is compared with the security policies in the security scan database, and the security alert information is obtained based on the comparison result.
  • the security scan database has a custom security policy.
  • the security policy is a custom policy, such as a firewall policy.
  • the security policy is written in the code, the foundation is run as a container application, and the database is scanned by the security.
  • Each of the custom policies in the scanning scans the security status of the container application one by one, or logically or aggregates each custom policy in the security scan database, and then the container application runtime A security scan is performed for comparison. If a lack of a custom policy is detected, it indicates that the basic image lacks a security policy, that is, a deficiency caused by the code level, and the code needs to be re-evaluated and written, and then step S1 is performed.
  • a system for implementing DevOps includes:
  • the coding module 11 is configured to continuously trigger coding according to the changing requirements of the business.
  • the coding module 11 is provided in the development terminal 1.
  • the development terminal 1 may be a computer terminal configured with Jenkins.
  • the coding module 11 may Relevant applications supporting Jenkins. The specific applications are known to those skilled in the art and will not be described here.
  • developers can write corresponding computer code according to the business requirements.
  • Business requirements are constantly changing. Developers can choose the old code that can implement the business requirements based on the content of the business requirements, or they can write new code based on the content of the business requirements.
  • the content of the business requirement is A, and the code that implements A has been written by the developer before, and can be directly referenced. If the content of the business requirement is B, it is a new business requirement, and the developer is before If you haven't written it, you need to write it.
  • the encoding module 11 further includes: a submission submodule 111, where the submission submodule 111 is used by a developer to submit code through the development terminal 1, and submit the code to a code warehouse; an automatic compilation submodule 112, which automatically compiles Sub-module 112 is used to trigger the automatic compilation of code when the platform configured with Jenkins engine is triggered; unit test sub-module 113, which can call a code analysis tool to unit test the code and check whether the code is successfully tested to obtain The quality of the code.
  • the triggering of the automatic compilation sub-module 112 may cause compilation to be automatically triggered when the code is submitted.
  • automatic compilation is not triggered automatically, manual compilation may be used to trigger the automatic compilation.
  • the automatic compiling sub-module 112 may preset trigger conditions, such as timing, code submission events, or webhook as preset trigger conditions.
  • the unit test sub-module 113 automatically performs unit tests after the code is successfully compiled, and the unit test environment is preset in accordance with environmental requirements, test logic, and the like.
  • An image construction module 12 configured to perform image construction according to the encoding result to obtain a basic image
  • the image construction is automatically started.
  • the image construction is defined according to the dockerfile file, and the dockerfile file can be uploaded to the code warehouse in advance to start building the image. You can call the dockerfile file with a general script, or you can upload the dockerfile file during the process definition.
  • the image building module 12 may be a Docker container engine.
  • a security scanning module 13 configured to perform a security scan on the base image to obtain a compliant image
  • the security scanning module 13 may be based on RESTful API (REpresentational State Transfer), and set up three levels of vulnerability detection, behavior compliance detection, and runtime security, corresponding to the vulnerability library based on event notification. , Behavior rules, custom strategies.
  • RESTful API REpresentational State Transfer
  • the security scanning module 13 is a security scanning architecture. It is carried out from three aspects: vulnerability detection, compliance check, and runtime security. Among them, vulnerability detection will connect to the CVE information library on the public network, and perform vulnerability analysis scanning on the base image of the running container and installed application software packages.
  • the running container is checked, such as exposed ports, SSH service, root user, running parameters and permissions, etc.
  • Runtime security is mainly checked against some custom policies, such as restricting certain ports, protocol types, etc .; In addition, security
  • the scanning of each module is through RESTful API calls, event notifications, etc.
  • step S1 is executed, that is, the developer deals with the hidden danger. Correct or rewrite the relevant code to eliminate hidden dangers, and then submit to the code warehouse to trigger the automatic compilation of the platform configured with the Jenkins engine to build a new base image. According to the new base image, go through the security scanning module 13 again. Security scan.
  • An image test module 21 configured to perform a system test on the compliant image, obtain an application image, and deliver the application image to an image warehouse 311;
  • the platform configured with the Jenkins engine will automatically start the image test module 21 to perform a system test on the compliant image.
  • the image test module 21 may be a third-party test framework, and Automatic test is implemented, and test results will be reported after the test is completed.
  • the compliance image is analyzed according to the reported test results, and a report is generated and sent back to the development terminal 1.
  • the developer modifies or rewrites the code according to the report, and enters the coding again. Module 11.
  • the compliant image will obtain an application image after the system test passes.
  • the platform configured with the Jenkins engine will upload the secure and tested application image to the image repository 311, so that the production environment can be directly from the image repository 311. Pull a reliable image for deployment in a production environment.
  • the mirror test module 21 may be provided in the test terminal 2, a Docker container is configured in the test terminal 2, and an application for a third-party test framework is also configured in the test terminal 2.
  • the security scanning module 13 is disposed in the development terminal 1, and an application for a security scanning framework is configured in the development terminal 1.
  • the security scanning module 13 may be disposed in the test terminal 2.
  • the application deployment module 31 performs application deployment according to the application image, and continuously monitors and feeds back service requirements.
  • the application deployment module 31 includes: an image warehouse 311, which pulls an application image from the image warehouse 311 and runs as a container application; a trigger deployment submodule 312, which is used to trigger the application deployment module 31 to place an application on the market and complete the release .
  • the service host 3 will define the production environment resources, application configuration, application parameters, etc. After the application deployment module 31 is triggered, it will automatically complete the entire application deployment process and deploy the application to the service. terminal.
  • the entire CI / CD (Continuous Integration / Continuous Deployment) or DevOps is a continuous, automated process or method. With this process or method, the entire application can Complete continuous upgrades and iterations.
  • a security scanning module 13 is added to the current DevOps process to perform a security scan on the base image, so that the application image can determine whether there is a risk in advance in the process, and it is not necessary to wait until the application is online or after being attacked, and then restart it. Publish the application.
  • This system or method not only improves the lack of current DevOps processes, but also improves the efficiency, sustainability, and automation of DevOps.
  • the security scanning module 13 includes:
  • the vulnerability detection sub-module 131 is used for vulnerability detection, and the vulnerability detection sub-module 131 analyzes and scans the basic image and its application to obtain vulnerability information;
  • the vulnerability detection submodule 131 is used to analyze the basic image of the scanning application and its application software package. Mirroring it is a hierarchical storage method. After analysis, it is compared with the database vulnerability information in the security scan (the database will be synchronized in real time) CVE vulnerability information database information on the public network) to obtain corresponding vulnerability information.
  • the vulnerability detection sub-module 131 may be a vulnerability scanning engine.
  • the platform of the Jenkins engine automatically compiles the code, performs a new vulnerability detection in the vulnerability detection sub-module 131 according to the new base image.
  • the behavior compliance of the running application is analyzed through the behavior compliance sub-module 132.
  • the behavior compliance is defined in the security scan database according to the CIS specification, and the behavior of the current application is compared with the database behavior compliance in the security scan. This leads to corresponding information that does not comply with the code of conduct.
  • the runtime security check sub-module 133 is used for runtime security check.
  • the runtime security check sub-module 133 analyzes the security status of the current application to obtain security alarm information.
  • the runtime security check sub-module 133 analyzes custom policies, and the custom policies are also stored in the security scan database. The security status of the current application is compared with the database custom policies in the security scan to obtain the corresponding application security. Alarm information.
  • the corresponding application security alarm information is obtained, it is sent back to the development terminal 1 and enters the coding module 11 again, that is, the developer corrects or rewrites the corresponding custom strategy, and then submits it to
  • the code warehouse triggers an automatic compilation of the code by the platform configured with the Jenkins engine, according to the new base image, and performs runtime security checks again as described.
  • Scanning the base image through the vulnerability detection sub-module 131, the behavior compliance sub-module 132, and the runtime security check sub-module 133 improves the security and stability of the base image.
  • the security scanning module 13 further includes a security scanning data submodule 134.
  • the security scanning data submodule 134 is configured to store security scanning data, provide data support for the security scanning module 13, and Build a security scan database.
  • the vulnerability information database data is written into the security scan data submodule 134 in real time synchronously, and relevant behavioral compliance information is written into the security scan data submodule 134.
  • the scan data sub-module may be a data memory, and of course, it may also be a de-memory.
  • the security scan data sub-module 134 provides data resources for data comparison. Build a security scan database that can be used for security scan data management.
  • the security scan data sub-module 134 includes:
  • the vulnerability data unit 1341 is configured to provide data support for the vulnerability detection submodule 131;
  • a behavior compliance data unit 1342 configured to provide data support for the behavior compliance submodule 132;
  • the runtime security inspection data unit 1343 is configured to provide data support for the runtime security inspection submodule 133.
  • Dividing the security scan data submodule 134 into three data units can increase the specificity of data and speed up the speed of data search and comparison.
  • a server includes a processor and a memory.
  • the memory stores at least one instruction, at least one program, a code set, or an instruction set.
  • the at least one instruction, the at least one program, The code set or the instruction set is loaded and executed by the processor to implement the method for implementing DevOps according to any one of the foregoing.
  • a computer-readable storage medium stores at least one instruction, at least one program, code set, or instruction set, the at least one instruction, the at least one program, or the code set. Or the instruction set is loaded and executed by the processor to implement the method for implementing DevOps according to any one of the foregoing.

Abstract

本发明公布了提供一种实现DevOps的方法及系统，所述方法包括：根据业务需求的不断变动持续触发编码；根据编码结果进行镜像构建，得到基础镜像；对所述基础镜像进行安全扫描，得到合规镜像；对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。本发明通过在交付镜像之前，对基础镜像进行安全扫描，扫描出基础镜像存在的安全隐患，可以提前获取到应用的安全性，避免应用发布到生产环境时，造成未知的风险及重大损失，提高了DevOps的高效性。

Description

一种实现DevOps的方法及系统 技术领域
本发明涉及软件开发领域，更具体的说，是涉及一种实现DevOps的方法及系统。
背景技术
随着技术的飞速发展，人们对软件服务的要求越来越高。软件必须快速地迭代，才能满足市场不断变化的需求。软件功能的上线速度，一定程度上决定了市场的机会和份额。然而，这种快速的迭代和发布，势必会让开发和运维间不可调和的冲突变得更加严峻。那DevOps[Development和Operations的组合，是一种重视“软件开发人员(Dev)”和“IT运维技术人员(Ops)”之间沟通合作的文化、运动或惯例]的引入就是为了高效地管理软件生命周期，提高迭代速度和生产效率。CI/CD流水线将软件生命周期中最核心的三个环节开发、测试和部署规范化、自动化管理起来，实现持续集成和持续部署，它是DevOps在流程管理方面非常重要的组成部分。目前CI/CD实现大多还在代码的触发、编译、单元测试、系统测试，最后到应用的持续发布，这种实现方法在一定程度上提高了软件迭代的速度，但是应用上线后就会发现很多问题，比如应用的基础镜像有大量漏洞、应用本身不合规等，轻则导致整个CI/CD重新来过，重则被人家攻击利用，造成巨大损失。
发明内容
本发明的目的是针对上述现有技术存在的缺陷，提供一种实现DevOps的方法。
本发明的目的是通过以下技术方案来实现的：
第一方面，提供一种实现DevOps的方法，所述方法包括：
根据业务需求的不断变动持续触发编码；
根据编码结果进行镜像构建，得到基础镜像；
对所述基础镜像进行安全扫描，得到合规镜像；
对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；
根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
优选的，所述对所述基础镜像进行安全扫描，得到合规镜像包括：
漏洞探测，通过分析扫描基础镜像及其应用，获取漏洞信息；
行为合规分析，通过分析运行应用的行为合规性，获取不合规行为信息；
运行时安全检查，通过分析当前应用的安全状态，获取安全告警信息。
通过漏洞探测、行为合规分析以及运行时安全检查，可以使所述基础镜像在交付到所述镜像仓库前就发现存在的安全问题，进而及时进行重新编码、构建镜像。
优选的，所述通过分析扫描基础镜像及其应用，获取漏洞信息包括：
扫描基础镜像及其应用，与安全扫描数据库中漏洞信息进行对比，根据对比结果得到漏洞信息，所述安全扫描数据库实时同步于漏洞信息库。
所述安全扫描数据库与所述漏洞信息库实时同步，确保了漏洞的最新性，避免了因为安全扫描数据库的漏洞信息滞后而导致被攻击的问题。
优选的，所述通过分析运行应用的行为合规性，获取不合规行为信息包括：
通过分析当前应用的行为，将得到的当前应用行为信息与安全扫描中数据库行为合规信息进行对比，根据对比结果得到不合规行为信息，所述安全扫描数据库实定义有行为规范。
通过分析当前应用的行为获取到所述不合规行为信息，可以及时对应用的不合规行为进行消除。
优选的，所述通过分析当前应用的安全状态，获取安全告警信息包括：
将通过分析当前应用的安全状态得到的安全信息与安全扫描数据库中的安全策略进行对比，根据对比结果得到安全告警信息，所述安全扫描数据库中自定义有安全策略。
通过分析当前应用的安全状态得到的安全告警信息，可以得出应用在运行时存在的安全问题，进而做出合理的规避。
第二方面，提供一种实现DevOps的系统，所述系统包括：
编码模块，用于根据业务需求的不断变动持续触发编码；
镜像构建模块，用于根据编码结果进行镜像构建，得到基础镜像；
安全扫描模块，用于对所述基础镜像进行安全扫描，得到合规镜像；
镜像测试模块，用于对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；
应用部署模块，根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
优选的，所述安全扫描模块包括：
漏洞探测子模块，用于漏洞探测，通过所述漏洞探测子模块分析扫描基础镜像及其应用，获取漏洞信息；
行为合规子模块，用于行为合规分析，通过所述行为合规子模块分析运行应用的行为合规性，获取不合规行为信息；
运行时安全检查子模块，用于运行时安全检查，通过所述运行时安全检查子模块分析当前应用的安全状态，获取安全告警信息。
通过所述漏洞探测子模块、所述行为合规子模块以及所述运行时安全检查子模块对所述基础镜像进行扫描，提升了所述基础镜像的安全性与稳定性。
优选的，所述安全扫描模块还包括安全扫描数据子模块，所述安全扫描数据子模块用于存储安全扫描数据，为所述安全扫描模块提供数据支持，并构建安全扫描数据库。
在安全扫描中，需要用到大量的数据进行对比，所述安全扫描数据子模块为数据对比提供了数据资源。构建安全扫描数据库，可以将用于安全扫描数据进行管理。
优选的，所述安全扫描数据子模块包括：
漏洞数据单元，用于为所述漏洞探测子模块提供数据支持；
行为合规数据单元，用于为所述行为合规子模块提供数据支持；
运行时安全检查数据单元，用于为所述运行时安全检查子模块提供数据支持。
将所述安全扫描数据子模块分别三个数据单元，可以使增加数据的专用性，进行加快数据查找比对的速度。
本发明带来的有益效果：通过在交付镜像之前，对基础镜像进行安全扫描，扫描出基础镜像存在的安全隐患，可以提前获取到应用的安全性，避免应用发布到生产环境时，造成未知的风险及重大损失，提高了DevOps的高效性。
附图说明
图1为本发明实施例的方法流程示意图；
图2为本发明实施例的安全扫描框架图；
图3为本发明实施例的系统模块图。
其中，1、开发终端；11、编码模块；111、提交子模块；112、自动编译子模块；113、单元测试子模块；12、镜像构建模块；13、安全扫描模块；131、漏洞探测子模块；132、行为合规子模块；133、运行时安全检查子模块；134、安全扫描数据子模块；1341、漏洞数据单元；1342、行为合规数据单元；1343、运行时安全检查数据单元；2、测试终端；21、镜像测试模块；3、服务主机；31、应用部署模块；311、镜像仓库；312、触发部署子模块。
具体实施方式
下面描述本发明的优选实施方式，本领域普通技术人员将能够根据下文所述用本领域的相关技术加以实现，并能更加明白本发明的创新之处和带来的益处。
本发明提供了一种实现DevOps的方法及系统。
本发明的目的是通过以下技术方案来实现的：第一方面，提供一种实现DevOps的方法，DevOps是一种持续集成，持续交付，部署发布，持续监控，持续反馈的方法，其中，持续集成，需求的不断变动触发持续的编码、构建流程；持续交付，完成测试的业务应用以合适的方式交付到适当的节点；部署发布，将交付的业务应用按照规则部署到生产环境，完成测试后发布。持续监控，时时监控业务应用以及系统平台的运行情况，形成监控报告。持续反馈，是基于监控和业务应用的使用情况，持续的数据分析，持续地提出完善意见。持续改进，基于反馈的意见，启动新的改进计划流程。
为更清楚地描述本发明的创造意图，首先提出一种用于所述方法的实施环境，所述环境包括：用于软件开发的持续集成(Continuous integration)/持续部署(continuous deployment)(CI/CD)流的开发终端和服务主机，用于软件测试的测试终端，用于运维的服务终端，在持续集成中，可选用Jenkins做为引擎，Jenkins是一个可扩展的持续集成引擎，当然，也可以选用BAMBOO(Atlassian Bamboo是一款持续集成构建服务器软件(Build Server))(非开源软件)来持续集成。配置版本迭代控制，选用版本控制工具，如Github(gitHub是一个面向开源及私有软件项目的托管平台)、GitLab(GitLab是一个用于仓库管理系统的开源项目,使用Git作为代码管理工具,并在此基础上搭建起来的web服务)、SVN(SVN是Subversion的简称,是一个开放源代码的版本控制系统)、CVS (CVS是一个C/S系统,是一个常用的代码版本控制软件)等工具进行版本迭代控制。配置应用容器引擎，可以配置为Docker(Docker是一个开源的应用容器引擎)容器引擎。配置安全扫描架构，并配置相应的安全扫描数据库。配置代码仓库，开发人员向代码仓库中提交代码。
如图1所示，所述方法包括：
S1、根据业务需求的不断变动持续触发编码；
开发人员根据所述业务需求，编写相应的计算机代码。业务需求不断变动，开发人员可以根据业务需求的内容，选择可以实现该业务需求的旧有代码，也可以根据业务需求的的内容编写新的代码。比如，业务需求的内容为A，而实现A的代码，开发人员在之前已经编写过，就可直接进行引用，而如果业务需要的内容为B，是一项新的业务需求，开发人员在之前并没有编写过，就需要开发人员进行编写。
进一步的，步骤S1中还包括：S10、开始，开发人员编写代码；S11、开发人员通过开发终端提交代码，将代码提交到代码仓库，S12、触发配置Jenkins(Jenkins是一个功能强大的应用程序,允许持续集成和持续交付项目,无论用的是什么平台)引擎的平台对代码的自动编译，S13、调用代码分析工具对代码进行单元测试，检查代码是否测试成功，从而得到代码的质量。所述自动编译可以是在代码提交时自动触发，也可以手动触发，在代码提交后，没有自动触发自动编译，可以使用手动触发自动编译。在对代码进行单元测试时，可以采用Sonar(Sonar是一个用于代码质量管理的开放平台)工具进行实现。
更进一步的，所述自动触发可以预设触发条件，比如通过定时、代码提交事件、或者是通过webhook(Webhooks就是用户通过自定义回调函数的方式来改变Web应用的一种行为)作为预设触发条件。所述单元测试在代码编译成功后，自动进行单元测试，单元测试环境根据环境要求、测试逻辑等事先进行预设。
S2、根据编码结果进行镜像构建，得到基础镜像；
进一步的，单元测试成功后，会自动启动镜像构建，镜像的构建是根据dockerfile文件定义，事先可以把dockerfile文件上传到代码仓库，启动构建镜像的时候可以通用脚本调用dockerfile文件，或可在流程定义的时候上传dockerfile文件。
S3、对所述基础镜像进行安全扫描，得到合规镜像；
进一步的，镜像构建完成后，得到基础镜像，基于所述基础镜像会Docker 启动容器，并对所述基础镜像进行安全扫描。请同时参考图2，安全扫描可以分为漏洞探测、合规检查、运行时安全这三个层级，分别对应漏洞库、行为合规、自己定义策略；根据安全扫描架构，安全扫描可以分别从漏洞探测、合规检查、运行时安全这三个方面进行；其中漏洞探测会对接公网的CVE信息库，对运行容器的基础镜像及安装的应用软件包进行漏洞分析扫描；合规检查对运行的容器进行检查，比如暴露的端口、SSH服务、root用户、运行的参数及权限等，运行时安全主要是针对自定义的一些策略进行检查，比如限制某些端口、协议类型等；另外安全扫描各模块之间都是通过RESTful(REpresentational State Transfer)API(REST风格的API)调用，事件通知等。
更进一步的，在进行安全扫描后，如果所述基础镜像没有通过安全扫描，则将出现的隐患信息发回开发终端上，执行步骤S1，即开发人员对所述隐患进行修正或重写相关代码以消除隐患，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，构建新的基础镜像，根据新的基础镜像，并再次进行漏洞探测。
S4、对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；
所述基础镜像安全扫描通过后，得到合规镜像，配置Jenkins引擎的平台会自动启动系统测试对所述合规镜像进行测试，系统测试可以调用或对接第三方测试框架，实现自动测试，测试完成后会上报测试结果。
进一步的，所述合规镜像在系统测试未通过后，根据上报的测试结果析出未通过原因，并形成报告，发回开发终端，开发人员根据报告对代码进行修改或重写，执行步骤S1。
进行一步，所述合规镜像在系统测试通过后，得到应用镜像，所述配置Jenkins引擎的平台会将安全及通过测试的应用镜像上传到镜像仓库中，这样生产环境可以直接从镜像仓库拉取可靠的镜像进行生产环境部署。
S5、根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
步骤S5包括：S51、从所述镜像仓库中拉取应用镜像，运行为容器应用；S52、触发应用部署。
进一步的，在流程定义的时候，会定义好生产环境资源、应用配置、应用参数等，应用部署触发后，会自动完成整个应用的部署过程。
到这为止，完成了应用的第一次发布，整个CI/CD(持续集成/持续部署)或DevOps它是一个持续、自动的过程或方法，正是有了这种过程或方法，整个应用才能完成持续的升级与迭代。
整体来说，在当前DevOps流程中加入了安全扫描过程，对基础镜像进行安全扫描，使应用镜像在该过程提前就判断了是否存在风险，不需要等到应用上线，或是被攻击后，重新进行应用的发布。该系统或是方法不仅仅完善了当前DevOps流程的缺失，更是提高了DevOps的高效性，以及可持续性和自动化。
在本发明方法实施例中，所述对所述基础镜像进行安全扫描，得到合规镜像包括：
漏洞探测，通过分析扫描基础镜像及其应用，获取漏洞信息；
分析扫描应用的基础镜像及其应用的软件包，镜像它是一种分层存储的方式，通过分析后再与安全扫描中数据库漏洞信息进行对比(数据库会实时同步公网上CVE漏洞信息库信息)，从而得出相应的漏洞信息。
进一步的，在获取到所述基础镜像的漏洞信息后，发回开发终端上，执行步骤S1，即开发人员对所述漏洞进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并再次进行漏洞探测。
行为合规分析，通过分析运行应用的行为合规性，获取不合规行为信息；
分析运行应用的行为合规性，行为合规是根据CIS规范定义在安全扫描数据库中，通过分析当前应用的行为再与安全扫描中数据库行为合规进行对比，从而得出相应的不符合行为规范的信息。
进一步的，在得出相应的不符合行为规范的信息后，发回开发终端上，执行步骤S1，即开发人员对所述得出相应的不符合行为规范的行为进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并再次进行行为合规分析。
运行时安全检查，通过分析当前应用的安全状态，获取安全告警信息。
进一步的，分析自定义策略，自定义策略也会存放到安全扫描数据库中，通过分析当前应用的安全状态再与安全扫描中数据库自定义策略对比，从而得出相应应用安全告警信息。
进一步的，在得出相应应用安全告警信息后，发回开发终端上，执行步骤S1，即开发人员对所述得出相应的自定义策略进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并再次进行运行时安全检查。
通过漏洞探测、行为合规分析以及运行时安全检查，可以使所述基础镜像在交付到所述镜像仓库前就发现存在的安全问题，进而及时进行重新编码、构 建镜像。
在本发明方法实施例中，所述通过分析扫描基础镜像及其应用，获取漏洞信息包括：
扫描基础镜像及其应用，与安全扫描数据库中漏洞信息进行对比，根据对比结果得到漏洞信息，所述安全扫描数据库实时同步于漏洞信息库。
所述安全扫描数据库与所述漏洞信息库实时同步，确保了漏洞的最新性，避免了因为安全扫描数据库的漏洞信息滞后而导致被攻击的问题。
进一步的，所述安全扫描数据库可以实时同步公网上CVE漏洞信息库信息，所述安全扫描数据库也可以与其他的漏洞信息库进行接驳，在此并不进行限定。以所述安全扫描数据库中的每条漏洞信息对所述基础镜像进行逐一对比扫描，或是将所述安全扫描数据库中的每条漏洞信息进行逻辑或聚合，进而对所述基础镜像进行扫描，扫描到基础镜像中存在与所述安全扫描数据库中漏洞信息相同的，则进行记录，直到扫描完成，将漏洞记录发回开发终端，由开发人员对代码进行修改，并重新执行步骤S1。
在本发明方法实施例中，所述通过分析运行应用的行为合规性，获取不合规行为信息包括：
通过分析当前应用的行为，将得到的当前应用行为信息与安全扫描中数据库行为合规信息进行对比，根据对比结果得到不合规行为信息，所述安全扫描数据库实定义有行为规范。
通过分析当前应用的行为获取到所述不合规行为信息，可以及时对应用的不合规行为进行消除。
进一步的，所述安全扫描数据库可以根据CIS规范在安全扫描数据库中定义应用在运行中的合规信息，将所述基础镜像运行为容器应用，以所述安全扫描数据库中的每条合规信息对所述容器应用运行时的行为进行逐一对比扫描，或是将所述安全扫描数据库中的每条合规信息进行逻辑或聚合，进而对所述容器应用运行时进行扫描，如果扫描出不合规行为，则说明所述基础镜像存在不合规的信息，也就是代码层面导致的不合规，需要进行代码的重新评估与编写，再执行步骤S1。
在本发明方法实施例中，所述通过分析当前应用的安全状态，获取安全告警信息包括：
将通过分析当前应用的安全状态得到的安全信息与安全扫描数据库中的安全策略进行对比，根据对比结果得到安全告警信息，所述安全扫描数据库中自 定义有安全策略。
通过分析当前应用的安全状态得到的安全告警信息，可以得出应用在运行时存在的安全问题，进而做出合理的规避。
进一步的，所述安全策略为自定义策略，比如防火墙策略，所述安全策略在开发人员编写代码时，就写入了代码中，将所述基础进行运行为容器应用，以所述安全扫描数据库中的每条自定义策略对所述容器应用运行时的安全状态进行逐一对比扫描，或是将所述安全扫描数据库中的每条自定义策略进行逻辑或聚合，进而对所述容器应用运行时的安全状态进行对比扫描，如果扫描出缺少自定义策略，则说明所述基础镜像缺少安全策略，也就是代码层面导致的不足，需要进行代码的重新评估与编写，再执行步骤S1。
如图3所示，第二方面，提供一种实现DevOps的系统，所述系统包括：
编码模块11，用于根据业务需求的不断变动持续触发编码；所述编码模块11设置在所述开发终端1内，所述开发终端1可以是配置有Jenkins的计算机终端，所述编码模块11可以支持Jenkins的相关应用，具体应用为本领域的技术人员所知，在此不另行说明。
通过所述编码模块11，开发人员可以根据所述业务需求，编写相应的计算机代码。业务需求不断变动，开发人员可以根据业务需求的内容，选择可以实现该业务需求的旧有代码，也可以根据业务需求的的内容编写新的代码。比如，业务需求的内容为A，而实现A的代码，开发人员在之前已经编写过，就可直接进行引用，而如果业务需要的内容为B，是一项新的业务需求，开发人员在之前并没有编写过，就需要开发人员进行编写。
进一步的，所述编码模块11还包括：提交子模块111，所述提交子模块111用于开发人员通过开发终端1提交代码，将代码提交到代码仓库；自动编译子模块112，所述自动编译子模块112用于触发配置Jenkins引擎的平台时对代码的自动编译；单元测试子模块113，所述单元测试子模块113可以调用代码分析工具对代码进行单元测试，检查代码是否测试成功，从而得到代码的质量。所述自动编译子模块112的触发可以使在代码提交时自动触发编译，当然，在代码提交后，如果没有自动触发自动编译，可以使用手动触发自动编译。在对代码进行单元测试时，可以采用Sonar工具进行实现。
更进一步的，所述自动编译子模块112中可以预设触发条件，比如通过定时、代码提交事件、或者是通过webhook作为预设触发条件。所述单元测试子模块113在代码编译成功后，自动进行单元测试，单元测试环境根据环境要求、 测试逻辑等事先进行预设。
镜像构建模块12，用于根据编码结果进行镜像构建，得到基础镜像；
进一步的，代码在经过所述单元测试模块测试成功后，会自动启动镜像构建，在镜像构建模块12中，镜像的构建是根据dockerfile文件定义，事先可以把dockerfile文件上传到代码仓库，启动构建镜像的时候可以通用脚本调用dockerfile文件，或可在流程定义的时候上传dockerfile文件。所述镜像构建模块12可以是Docker容器引擎。
安全扫描模块13，用于对所述基础镜像进行安全扫描，得到合规镜像；
再参考图2，所述安全扫描模块13可以基于RESTful API(REpresentational State Transfer:表现层状态转移)，设置漏洞检测、行为合规检测及运行时安全三个层级，分别对应基于事件通知的漏洞库、行为会规、自定义策略。
进一步的，通过所述镜像构建模块12将镜像构建完成后，得到基础镜像，基于所述基础镜像会启动Docker容器，并通过所述安全扫描模块13对所述基础镜像进行安全扫描。安全扫描可以分为漏洞探测、行为合规分析、运行时安全检查这三个层级，分别对应漏洞库、行为合规、自己定义策略；所述安全扫描模块13为安全扫描架构，安全扫描可以分别从漏洞探测、合规检查、运行时安全这三个方面进行；其中漏洞探测会对接公网的CVE信息库，对运行容器的基础镜像及安装的应用软件包进行漏洞分析扫描；合规检查对运行的容器进行检查，比如暴露的端口、SSH服务、root用户、运行的参数及权限等，运行时安全主要是针对自定义的一些策略进行检查，比如限制某些端口、协议类型等；另外安全扫描各模块之间都是通过RESTful API调用，事件通知等。
更进一步的，在所述安全扫描模块13进行安全扫描后，如果所述基础镜像没有通过安全扫描，则将出现的隐患信息发回开发终端1上，执行步骤S1，即开发人员对所述隐患进行修正或重写相关代码以消除隐患，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，构建新的基础镜像，根据新的基础镜像，并通过所述安全扫描模块13再次进行安全扫描。
镜像测试模块21，用于对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库311；
所述基础镜像安全扫描通过后，得到合规镜像，配置Jenkins引擎的平台会自动启动镜像测试模块21对所述合规镜像进行系统测试，所述镜像测试模块21可以是第三方测试框架，并实现自动测试，测试完成后会上报测试结果。
进一步的，所述合规镜像在系统测试未通过后，根据上报的测试结果析出 未通过原因，并形成报告，发回开发终端1，开发人员根据报告对代码进行修改或重写，再次进入编码模块11。
进行一步，所述合规镜像在系统测试通过后，得到应用镜像，所述配置Jenkins引擎的平台会将安全及通过测试的应用镜像上传到镜像仓库311中，这样生产环境可以直接从镜像仓库311拉取可靠的镜像进行生产环境部署。
所述镜像测试模块21可以设置在所述测试终端2内，所述测试终端2内配置有Docker容器容器，所述测试终端2内还配置有用于第三方测试框架的应用。所述安全扫描模块13设置在所述开发终端1内，所述开发终端1内配置有用于安全扫描构架的应用。
做为一种可能的实施例，所述安全扫描模块13可以设置在所述测试终端2内。
应用部署模块31，根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
所述应用部署模块31包括：镜像仓库311，从所述镜像仓库311中拉取应用镜像，运行为容器应用；触发部署子模块312，用于触发应用部署模块31将应用布置到市场，完成发布。
进一步的，在流程定义的时候，所述服务主机3会定义好生产环境资源、应用配置、应用参数等，应用部署模块31被触发后，会自动完成整个应用的部署过程，将应用部署到服务终端。
到这为止，完成了应用的第一次发布，整个CI/CD(持续集成/持续部署)或DevOps它是一个持续、自动的过程或方法，正是有了这种过程或方法，整个应用才能完成持续的升级与迭代。
整体来说，在当前DevOps流程中加入了安全扫描模块13，对基础镜像进行安全扫描，使应用镜像在该过程提前就判断了是否存在风险，不需要等到应用上线，或是被攻击后，重新进行应用的发布。该系统或是方法不仅仅完善了当前DevOps流程的缺失，更是提高了DevOps的高效性，以及可持续性和自动化。
在本发明系统实施例中，所述安全扫描模块13包括：
漏洞探测子模块131，用于漏洞探测，通过所述漏洞探测子模块131分析扫描基础镜像及其应用，获取漏洞信息；
通过所述漏洞探测子模块131分析扫描应用的基础镜像及其应用的软件包，镜像它是一种分层存储的方式，通过分析后再与安全扫描中数据库漏洞信 息进行对比(数据库会实时同步公网上CVE漏洞信息库信息)，从而得出相应的漏洞信息。所述漏洞探测子模块131可以是漏洞扫描引擎。
进一步的，在获取到所述基础镜像的漏洞信息后，发回开发终端1上，再次进入编码模块11，即开发人员对所述漏洞进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并在所述漏洞探测子模块131中再次进行漏洞探测。
行为合规子模块132，用于行为合规分析，通过所述行为合规子模块132分析运行应用的行为合规性，获取不合规行为信息；
通过所述行为合规子模块132分析运行应用的行为合规性，行为合规是根据CIS规范定义在安全扫描数据库中，通过分析当前应用的行为再与安全扫描中数据库行为合规进行对比，从而得出相应的不符合行为规范的信息。
进一步的，在得出相应的不符合行为规范的信息后，发回开发终端1上，再次进入编码模块11，即开发人员对所述得出相应的不符合行为规范的行为进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并再次进行行为合规分析。
运行时安全检查子模块133，用于运行时安全检查，通过所述运行时安全检查子模块133分析当前应用的安全状态，获取安全告警信息。
所述运行时安全检查子模块133分析自定义策略，自定义策略也会存放到安全扫描数据库中，通过分析当前应用的安全状态再与安全扫描中数据库自定义策略对比，从而得出相应应用安全告警信息。
进一步的，在得出相应应用安全告警信息后，发回开发终端1上，再次进入编码模块11，即开发人员对所述得出相应的自定义策略进行修正或重写相关代码，再提交到代码仓库触发配置Jenkins引擎的平台对代码的自动编译，根据新的基础镜像，并再次在所述进行运行时安全检查。
通过所述漏洞探测子模块131、所述行为合规子模块132以及所述运行时安全检查子模块133对所述基础镜像进行扫描，提升了所述基础镜像的安全性与稳定性。
在本发明系统实施例中，所述安全扫描模块13还包括安全扫描数据子模块134，所述安全扫描数据子模块134用于存储安全扫描数据，为所述安全扫描模块13提供数据支持，并构建安全扫描数据库。
进一步的，在所述安全扫描数据子模块134中实时同步写入所述漏洞信息库数据，在所述安全扫描数据子模块134中写入相关的行为合规信息，在所述 安全策略，也就是自定义策略。所述案值扫描数据子模块可以是一个数据存储器，当然，也可以是一个去存储器。
在安全扫描中，需要用到大量的数据进行对比，所述安全扫描数据子模块134为数据对比提供了数据资源。构建安全扫描数据库，可以将用于安全扫描数据进行管理。
在本发明系统实施例中，所述安全扫描数据子模块134包括：
漏洞数据单元1341，用于为所述漏洞探测子模块131提供数据支持；
行为合规数据单元1342，用于为所述行为合规子模块132提供数据支持；
运行时安全检查数据单元1343，用于为所述运行时安全检查子模块133提供数据支持。
将所述安全扫描数据子模块134分为三个数据单元，可以使增加数据的专用性，进行加快数据查找比对的速度。
第三方面，提出一种服务器，所述服务器包括处理器与存储器，所述存储器中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或所述指令集由所述处理器加载并执行以实现如前述任一项所述的实现DevOps的方法。
第四方面，提出一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或所述指令集由所述处理器加载并执行以实现如前述任一项所述的实现DevOps的方法。
以上内容是结合具体的优选实施方式对本发明所作的进一步详细说明，不能认定本发明的具体实施方式只局限于这些说明。对于本发明所属技术领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本发明的保护范围。

Claims (10)

  1. 一种实现DevOps的方法，其特征在于，所述方法包括：
    根据业务需求的不断变动持续触发编码；
    根据编码结果进行镜像构建，得到基础镜像；
    对所述基础镜像进行安全扫描，得到合规镜像；
    对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；
    根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
  2. 如权利要求1所述的实现DevOps的方法，其特征在于，所述对所述基础镜像进行安全扫描，得到合规镜像包括：
    漏洞探测，通过分析扫描基础镜像及其应用，获取漏洞信息；
    行为合规分析，通过分析运行应用的行为合规性，获取不合规行为信息；
    运行时安全检查，通过分析当前应用的安全状态，获取安全告警信息。
  3. 如权利要求2所述的实现DevOps的方法，其特征在于，所述通过分析扫描基础镜像及其应用软件包，获取漏洞信息包括：
    扫描基础镜像及其应用，与安全扫描数据库中漏洞信息进行对比，根据对比结果得到漏洞信息，所述安全扫描数据库实时同步于漏洞信息库。
  4. 如权利要求2或3所述的实现DevOps的方法，其特征在于，所述通过分析运行应用的行为合规性，获取不合规行为信息包括：
    通过分析当前应用的行为，将得到的当前应用行为信息与安全扫描中数据库行为合规信息进行对比，根据对比结果得到不合规行为信息，所述安全扫描数据库实定义有行为规范。
  5. 如权利要求2或3所述的实现DevOps的方法，其特征在于，所述通过分析当前应用的安全状态，获取安全告警信息包括：
    将通过分析当前应用的安全状态得到的安全信息与安全扫描数据库中的安全策略进行对比，根据对比结果得到安全告警信息，所述安全扫描数据库中自定义有安全策略。
  6. 如权利要求4所述的实现DevOps的方法，其特征在于，所述通过分析当前应用的安全状态，获取安全告警信息包括：
    将通过分析当前应用的安全状态得到的安全信息与安全扫描数据库中的安全策略进行对比，根据对比结果得到安全告警信息，所述安全扫描数据库中自定义有安全策略。
  7. 一种实现DevOps的系统，其特征在于，所述系统包括：
    编码模块，用于根据业务需求的不断变动持续触发编码；
    镜像构建模块，用于根据编码结果进行镜像构建，得到基础镜像；
    安全扫描模块，用于对所述基础镜像进行安全扫描，得到合规镜像；
    镜像测试模块，用于对所述合规镜像进行系统测试，得到应用镜像，交付到镜像仓库；
    应用部署模块，根据所述应用镜像进行应用部署，并持续监控、反馈业务需求。
  8. 如权利要求7所述的实现DevOps的系统，其特征在于，所述安全扫描模块包括：
    漏洞探测子模块，用于漏洞探测，通过所述漏洞探测子模块分析扫描基础镜像及其应用，获取漏洞信息；
    行为合规子模块，用于行为合规分析，通过所述行为合规子模块分析运行应用的行为合规性，获取不合规行为信息；
    运行时安全检查子模块，用于运行时安全检查，通过所述运行时安全检查子模块分析当前应用的安全状态，获取安全告警信息。
  9. 如权利要求8所述的实现DevOps的系统，其特征在于，所述安全扫描模块还包括安全扫描数据子模块，所述安全扫描数据子模块用于存储安全扫描数据，为所述安全扫描模块提供数据支持，并构建安全扫描数据库。
  10. 如权利要求9所述的实现DevOps的系统，其特征在于，所述安全扫描数据子模块包括：
    漏洞数据单元，用于为所述漏洞探测子模块提供数据支持；
    行为合规数据单元，用于为所述行为合规子模块提供数据支持；
    运行时安全检查数据单元，用于为所述运行时安全检查子模块提供数据支持。
PCT/CN2018/103278 2018-08-30 2018-08-30 一种实现DevOps的方法及系统 WO2020042086A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/103278 WO2020042086A1 (zh) 2018-08-30 2018-08-30 一种实现DevOps的方法及系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/103278 WO2020042086A1 (zh) 2018-08-30 2018-08-30 一种实现DevOps的方法及系统

Publications (1)

Publication Number Publication Date
WO2020042086A1 true WO2020042086A1 (zh) 2020-03-05

Family

ID=69643371

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/103278 WO2020042086A1 (zh) 2018-08-30 2018-08-30 一种实现DevOps的方法及系统

Country Status (1)

Country Link
WO (1) WO2020042086A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106873975A (zh) * 2016-12-30 2017-06-20 武汉默联股份有限公司 基于Docker的devops持续交付与自动化系统及方法
CN106997297A (zh) * 2017-03-31 2017-08-01 广东亿迅科技有限公司 一种基于DevOps的软件开发管理平台及方法
CN107423952A (zh) * 2017-07-25 2017-12-01 苏州博纳讯动软件有限公司 一种可扩展的DevOps持续交付系统及其方法
CN107885995A (zh) * 2017-10-09 2018-04-06 阿里巴巴集团控股有限公司 小程序的安全扫描方法、装置以及电子设备
CN108173690A (zh) * 2017-12-27 2018-06-15 上海新炬网络技术有限公司 一种主动预警并自动定位业务故障的控制方法
CN108345988A (zh) * 2018-01-22 2018-07-31 广州欧赛斯信息科技有限公司 一种基于容器平台的敏捷软件协同开发管理系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106873975A (zh) * 2016-12-30 2017-06-20 武汉默联股份有限公司 基于Docker的devops持续交付与自动化系统及方法
CN106997297A (zh) * 2017-03-31 2017-08-01 广东亿迅科技有限公司 一种基于DevOps的软件开发管理平台及方法
CN107423952A (zh) * 2017-07-25 2017-12-01 苏州博纳讯动软件有限公司 一种可扩展的DevOps持续交付系统及其方法
CN107885995A (zh) * 2017-10-09 2018-04-06 阿里巴巴集团控股有限公司 小程序的安全扫描方法、装置以及电子设备
CN108173690A (zh) * 2017-12-27 2018-06-15 上海新炬网络技术有限公司 一种主动预警并自动定位业务故障的控制方法
CN108345988A (zh) * 2018-01-22 2018-07-31 广州欧赛斯信息科技有限公司 一种基于容器平台的敏捷软件协同开发管理系统

Similar Documents

Publication Publication Date Title
US10162650B2 (en) Maintaining deployment pipelines for a production computing service using live pipeline templates
US10255058B2 (en) Analyzing deployment pipelines used to update production computing services using a live pipeline template process
US11727117B2 (en) Vulnerability analyzer for application dependencies in development pipelines
Horton et al. Dockerizeme: Automatic inference of environment dependencies for python code snippets
JP4961123B2 (ja) 自動化されたテストケース実行に関して疎結合された自動化されたテストケース検証
US9485151B2 (en) Centralized system management on endpoints of a distributed data processing system
US7895565B1 (en) Integrated system and method for validating the functionality and performance of software applications
US20090307763A1 (en) Automated Test Management System and Method
US20180285247A1 (en) Systems, methods, and apparatus for automated code testing
US20100235807A1 (en) Method and system for feature automation
US20160026547A1 (en) Generating predictive diagnostics via package update manager
CN113703730A (zh) 持续集成方法、装置、计算机设备及存储介质
US9116802B2 (en) Diagnostic notification via package update manager
US9672139B2 (en) Debugging in a production environment
US20170220324A1 (en) Data communication accelerator system
JP2023507301A (ja) データフローグラフのコンポーネントのユニットテスト
US11586433B2 (en) Pipeline release validation
Sandobalin et al. End-to-end automation in cloud infrastructure provisioning
US10789563B2 (en) Building confidence of system administrator in productivity tools and incremental expansion of adoption
Dhakate et al. Distributed cloud monitoring using Docker as next generation container virtualization technology
JP2023550607A (ja) セキュアな環境におけるコードの継続的なインテグレーション及び開発
WO2020042086A1 (zh) 一种实现DevOps的方法及系统
WO2017167015A1 (zh) 服务器设备安全管理方法、装置及计算机存储介质
CN111881056A (zh) 一种自动化测试框架及测试方法
US20230325298A1 (en) System and method for cloud infrastructure test automation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18932267

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18932267

Country of ref document: EP

Kind code of ref document: A1