Deploying DAST Scanner in Kubernetes

This document describes how to configure and use the scancentral-dast-scanner 24.4 Helm charts for complete ScanCentral DAST scanner container orchestration in Kubernetes. You can find the ScanCentral DAST Scanner Helm charts at https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-scanner

Table of Contents

• Kubernetes Versions
• Tool Prerequisites
• Installation

Kubernetes Versions

These charts have been tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool Prerequisites

These instructions were written and tested using the following tool versions. It is recommended that the same tool versions be used in order to avoid unpredictable results.

• kubectl v1.28.7
• helm v3.12.2
• yq v4.35.1

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems may require different syntax for certain commands and other Kubernetes Cluster providers may require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation Prerequisites

• A working Kubernetes Cluster
• Installed ScanCentral DAST Core Services
• DockerHub image pull secret

Installation Steps

1. Ensure ScanCentral DAST Core Services are installed
2. Retrieve core configuration properties
3. Ensure image pull secret
4. Installing ScanCentral DAST scanner
5. Special Considerations for testing environments

Ensure ScanCentral DAST Core Services are installed

Ensure that the ScanCentral DAST core components have been installed and are at the same Helm chart revision as the ScanCentral DAST scanner chart.

Retrieve core configuration properties

Obtain the following information to populate core services values in the ScanCentral DAST scanner helm chart:

• DAST API service URL

• DAST API service account token secret name, previously created during the ScanCentral DAST core components Helm deployment

You can obtain this information by running the following command:

helm  get notes  <name_of_scancentral-dast-core_helm_release>

Ensure image pull secret

If you are using Docker images directly from DockerHub, ensure that you have the name of your image pull secret ready to add to the Helm configuration. It should be the same configuration created to install the ScanCentral DAST core components Helm chart.

Installing ScanCentral DAST scanner

The following command installs the Fortify ScanCentral DAST scanner using the recommended defaults for all services. In some cases, you might need to customize these values using the Helm --set parameter or by creating a values.yaml override file and passing it to the command line with the Helm -f flag. For more information about Helm overrides, refer to the Helm documentation.

For more information about the values that can be overridden, see the Fortify ScanCentral DAST scanner Helm chart values.

Tip: To find other available versions, go to https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-scanner/tags.

Note: These example values presume the default naming referenced in both the helm-scancentral-dast-scanner and the helm-scancentral-dast-core charts. If these values are different, then you must update the following command line accordingly.

helm install <Installation release name> -i oci://registry-1.docker.io/fortifydocker/helm-scancentral-dast-scanner --version <chart_version> --timeout 60m \
 --set dastApiServiceURL=<SC_DAST_API_service_URL> \
 --set serviceTokenSecretName=scdast-service-token

Special Considerations for testing environments

By default, the Helm chart defines the container resources and requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources. To disable these settings, paste the following values into a file named 'resource_override.yaml' and add it to the install command line with the -f flag, for example $ helm install -f resource_override.yaml

Caution: Using the following settings in production is not supported and will lead to unstable behavior.

# Set all Kubernetes resources except for the datastores to best-effort mode (no resource requirements)
# DO NOT null out the resource configuration for the 'datastore' containers, this will result in unexpected evictions due to how that service allocates memory.
resources:
  requests:
    cpu: null
    memory: null
  limits:
    cpu: null
    memory: null
wise:
  resources: nul

Values

The following values are exposed by the Helm Chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

[]

{}

false

{}

{
  "enabled": false,
  "resources": {}
}

false

{}

""

[]

null

"IfNotPresent"

"mcr.microsoft.com/mssql/server"

"2022-latest"

"1500Mi"

"1"

"1500Gi"

"4Gi"

"1"

"1500Mi"

"4Gi"

false

false

null

8080

null

"IfNotPresent"

"fortifydocker/dast-scanner"

"24.4.ubi.9"

[]

null

null

{}

{}

{}

1

"7"

"30Gi"

"32Gi"

"7"

"30Gi"

"16Gi"

false

"15Gi"

""

"0"

"Fixed"

"service-token"

""

[]

{}

[]

null

"IfNotPresent"

"fortifydocker/wise"

"24.4.ubi.9"

"8"

"64Gi"

"8"

"16Gi"