Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SNYK

View Snyk scanned vulnerabilities and license compliance of your components.

Plugin details

Created by

Snyk Tech Services

Category

Security

Source

GitHub

Type

Open-source plugin

Configuration

Application configuration YAML

No action required

This plugin requires a backend proxy configuration to make calls to Snyk with authentication. The following configuration is set by default and you do not need to change anything:

proxy:
  endpoints:
    '/snyk':
      target: https://api.snyk.io/
      pathRewrite:
        api/proxy/snyk/?: /
      headers:
        User-Agent: tech-services/backstage-plugin/1.x
        Authorization: token ${SNYK_TOKEN}

Secrets

  • Obtain your Snyk token (a service account with Viewer permission at your group level is preferred)

  • Create secret in Harness to store API token, click on “New Secret Text” and enter values as shown below.

Delegate proxy

  • If Snyk is behind a firewall, snyk.mycompany.io will not be accessible from outside, so a delegate proxy has to be selected. Ensure you have Harness Delegate installed for the same.

Layout

No action required

This plugin exports a UI card that you can show on the Overview tab of a service or any other layout page as well as a tab. The following configuration is set by default in Layout under Configure for Service and you do not need to change anything:

Annotations

To configure the plugin for a service in the software catalog, set one of the following annotations in its catalog-info.yaml definition file.

  1. Add one of the following annotations to your entities:

  • snyk.io/org-id: The ID of the Snyk organization where your project is located. You can find the ID in the Organization Settings in the Snyk dashboard.

  • snyk.io/org-ids: Specify one or more Snyk organization IDs, comma-separated. This will try to find any targets or projects in any of the organizations. snyk.io/org-id is ignored when this annotation is set.

  1. Then add one or more of the following annotations to your entities:

  • snyk.io/target-id: Specify a single target by name or ID. Using the target ID will avoid an API call and be faster. Use this API endpoint to get the Target IDs.

  • snyk.io/targets: Specify one or more targets by name or ID. Using the target ID will avoid an API call and be faster. Use this API endpoint to get the Target IDs.

  • snyk.io/project-ids: The project ID (see slug in URL or ID in project settings). If there are multiple projects (e.g., multiple package.json or pom files), add them comma-separated.

  • snyk.io/exclude-project-ids: Exclude specific projects you might not want.

More Examples can be found here

Support

The plugin is owned by Snyk Tech Services and managed in the Backstage repository as an open-source project. Create a GitHub issue to report bugs or suggest new features for the plugin.

PreviousRootly
NextSonarQube

Last updated

Was this helpful?