Deploying ScanCentral DAST in Kubernetes

This document describes how to configure and use the scancentral-dast-core 24.4 Helm charts for complete ScanCentral DAST core container orchestration in Kubernetes. You can find the ScanCentral DAST Helm charts at https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-core

Table of Contents

• Kubernetes Versions
• Tool Prerequisites
• Installation
• Upgrade

Kubernetes Versions

These charts have been tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool Prerequisites

These instructions were written and tested using the following tool versions. It is recommended that the same tool versions be used in order to avoid unpredictable results.

• kubectl v1.28.7
• helm v3.12.2
• yq v4.35.1

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems may require different syntax for certain commands and other Kubernetes Cluster providers may require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation Prerequisites

• A working Kubernetes Cluster
• A supported Database for ScanCentral DAST
• A Fortify License and Infrastructure Manager (LIM) server with Fortify ScanCentral DAST Server License (server-type ) and Fortify WebInspect Concurrent License
• A Fortify Software Security Center 24.4.0 (SSC) server with user accounts for users who will access Fortify ScanCentral DAST

Installation Steps

1. Creating a LIM secret in Kubernetes
2. Storing database credentials in Kubernetes
3. Generating a service account token
4. Configuring Fortify Software Security Center credentials
5. Prepare service SSL certificates
6. Creating an image pull secret
7. Installing the Fortify ScanCentral DAST core components
8. Special considerations for testing environments

Creating a LIM secret in Kubernetes

The LIM secret is required for retrieving a license seat for the scanner. To create a LIM secret:

1. Ensure that the LIM is running within the cluster, the LIM is activated, and a Fortify WebInspect license is added to a license pool in the LIM.

2. Use the kubectl create secret command, as shown in the following code sample, with the license pool information you defined in the LIM to create a secret in the namespace where you intend to install Fortify ScanCentral DAST:

   kubectl create secret generic lim-pool \
    --type='basic-auth' \
    --from-literal=username=<lim license pool name> \
    --from-literal=password=<lim license pool password>

3. Ensure that you have the name of the administrative secret used for LIM. You must provide this to the Helm chart. Note: By default, the LIM names this secret lim-admin-credentials.

Storing database credentials in Kubernetes

Database credentials are required to access the Fortify ScanCentral DAST database. To store the database credentials in Kubernetes:

1. Create or obtain the credentials for a DBO-level account as described in Database settings within the Fortify ScanCentral DAST documentation.

2. Use the kubectl create secret command, as shown in the following code sample, with the credentials from the previous step to create a secret for the DBO-level account in the namespace where you intend to install Fortify ScanCentral DAST:

   kubectl  create secret generic scdast-db-owner \
    --type='basic-auth' \
    --from-literal=username=<DBO username> \
    --from-literal=password=<DBO password>

3. Create or obtain the credentials to a standard account as described in Database settings within the Fortify ScanCentral DAST documentation.

4. Use the kubectl create secret command, as shown in the following code sample, with the credentials from the previous step to create a secret for the standard account in the namespace where you intend to install Fortify ScanCentral DAST:

   kubectl create secret generic scdast-db-standard \
    --type='basic-auth' \
    --from-literal=username=<DBO username> \
    --from-literal=password=<DBO password>

Generating a service account token

You must generate a service account token (or shared secret) as described in Miscellaneous DAST settings within the Fortify ScanCentral DAST documentation.

• Use the kubectl create secret command, as shown in the following code sample, to generate a service account token and install it as a secret into Kubernetes:

  kubectl  create secret generic scdast-service-token \
   --type='opaque' \
   --from-literal=service-token=$(openssl rand -base64 32)

Configuring Fortify Software Security Center credentials

You must configure Fortify Software Security Center credentials for the connection between Fortify ScanCentral DAST and Fortify Software Security Center. To configure Fortify Software Security Center credentials:

1. Create or obtain the service account credentials for Fortify Software Security Center as described in SSC settings within the Fortify ScanCentral DAST documentation.

2. Use the kubectl create secret command, as shown in the following code sample, with the credentials from the previous step to create a secret in the namespace where you intend to install Fortify ScanCentral DAST:

   kubectl  create secret generic scdast-ssc-serviceaccount \
    --type='basic-auth' \
    --from-literal=username=<SSC username> \
    --from-literal=password=<SSC password>

Prepare service SSL certificates

Optionally, you can generate SSL certificates for the DAST API service and DAST Utility Service to ensure that components communicate with one another using SSL. These certificates do not affect ingress resources. Certificates must be in PFX format. You can use the kubectl create secret command to generate these certificates using your internal trusted PKI services with your PKI-generated PFX files and passwords. For more information, see DAST API SSL settings and Utility Service SSL settings within the Fortify ScanCentral DAST documentation.

To prepare the DAST API service certificate:

1. Generate a random password using openssl.

   API_SERVER_CERT_PWD="$(openssl rand -base64 32)"

2. Create a certificate using openssl.

   openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout /tmp/api-server-key.pem -out /tmp/api-server-cert.pem -subj "/C=CA/ST=Ontario/L=Waterloo/O=YourCompany/OU=IT"

3. Create a PKCS12 certificate.

   openssl pkcs12 -export -out /tmp/api-server-cert.pfx -inkey /tmp/api-server-key.pem -in /tmp/api-server-cert.pem  -passout "pass:${API_SERVER_CERT_PWD}"

4. Create a Kubernetes secret for the api-server-certificate.

   kubectl create secret generic api-server-certificate --type=Opaque --from-file=tls.pfx=/tmp/api-server-cert.pfx

5. Create a Kubernetes secret for the api-server-certificate-password.

   kubectl create secret generic api-server-certificate-password --type=Opaque --from-literal=password=$API_SERVER_CERT_PWD

6. Remove the temporary files.

   rm /tmp/api-server-key.pem /tmp/api-server-cert.pem /tmp/api-server-cert.pfx

7. Unset the environment variables.

   unset API_SERVER_CERT_PWD

To prepare the DAST Utility Service certificate:

1. Generate a random password using openssl.

   UTILITYSERVICE_SERVER_CERT_PWD="$(openssl rand -base64 32)"

2. Create a certificate using openssl.

   openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout /tmp/utilityservice-server-key.pem -out /tmp/utilityservice-server-cert.pem -subj "/C=CA/ST=Ontario/L=Waterloo/O=YourCompany/OU=IT"

3. Create a PKCS12 certificate.

   openssl pkcs12 -export -out /tmp/utilityservice-server-cert.pfx -inkey /tmp/utilityservice-server-key.pem -in /tmp/utilityservice-server-cert.pem  -passout "pass:${UTILITYSERVICE_SERVER_CERT_PWD}"

4. Create a Kubernetes secret for the utilityservice-server-certificate.

   kubectl create secret generic utilityservice-server-certificate --type=Opaque --from-file=tls.pfx=/tmp/utilityservice-server-cert.pfx 

5. Create a Kubernetes secret for the utilityservice-server-certificate-password.

   kubectl create secret generic utilityservice-server-certificate-password --type=Opaque --from-literal=password=$UTILITYSERVICE_SERVER_CERT_PWD

6. Remove the temporary files.

   rm /tmp/utilityservice-server-key.pem /tmp/utilityservice-server-cert.pem /tmp/utilityservice-server-cert.pfx

7. Unset the environment variables.

   unset UTILITYSERVICE_SERVER_CERT_PWD

Creating an image pull secret

By default, the Fortify ScanCentral DAST core helm chart references its images directly from DockerHub. For Kubernetes to properly install your images using the default configuration, you must create an image pull secret and store it in your installation namespace in Kubernetes. If you are replicating these images to a local repository, you can skip this task and update the relevant image values in the Helm chart to reference your local repository. To create an image pull secret:

• Use the kubectl create secret command as shown in the following code sample:

  kubectl create secret docker-registry docker.io \
   --docker-server=registry-1.docker.io \
   --docker-username='<docker username>' \ 
   --docker-password='<docker password>' \
   --docker-email='<docker user email>'

Installing the Fortify ScanCentral DAST core components

The following command installs the Fortify ScanCentral DAST core components using the recommended defaults for all services. In some cases, you might need to customize these values using the Helm --set parameter or by creating a values.yaml override file and passing it to the command line with the Helm -f flag. For more information about the values you can override, see the core components Helm chart values.

Tip: To find the available SC DAST 24.4 helm chart version, go to https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-core/tags.

Note: These example values assume a database type of 'MS-SQL', with secrets named the same as the previous examples. If these values are different, then you must update the following command line accordingly.

helm upgrade -i scdast-core oci://registry-1.docker.io/fortifydocker/helm-scancentral-dast-core --version <chart version> --timeout 60m \
 --set imagePullSecrets[0].name=docker-registry \
 --set appsettings.lIMSettings.limUrl="<https url to LIM service>" \ # Update with your LIM Host/Port
 --set appsettings.sSCSettings.sSCRootUrl="<ssc root URL>" \ # Update with your SSC host path
 --set appsettings.databaseSettings.server="<Name of the database server>" \ # Update with the name of the Database
 --set database.dboLevelAccountCredentialsSecret=scdast-db-owner \
 --set database.standardAccountCredentialsSecret=scdast-db-standard \
 --set sscServiceAccountSecretName=scdast-ssc-serviceaccount \
 --set serviceTokenSecretName=scdast-service-token \
 --set limServiceAccountSecretName=lim-admin-credentials \
 --set limDefaultPoolSecretName=lim-pool \
 --set api.certificate.certificateSecretName=api-server-certificate \
 --set api.certificate.certificatePasswordSecretName=api-server-certificate-password \
 --set utilityService.certificate.certificateSecretName=api-server-certificate \
 --set utilityService.certificate.certificatePasswordSecretName=utilityservice-server-certificate-password

In the previous code sample, the is in the format https://<lim-server-url>:<port>. The is in the format https://<ssc-server-url>:<port>/ssc.

Special considerations for testing environments (core components)

By default, the Helm chart defines the container resource/requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources.

To disable these settings, paste the below values into a file called "resource_override.yaml" and add it to the install commandline with the -f flag. (e.g. -f resource_override.yaml")

WARNING: Using the following settings in production is not supported and will lead to unstable behavior.

# Set all Kubernetes resources except for the datastores to best-effort mode (no resource requirements)
# DO NOT null out the resource configuration for the 'datastore' containers, this will result in unexpected evictions due to how that service allocates memory.
api:
  resources: null

globalService:
  resources: null
 
utilityService:
  resources: 
    requests:
      cpu: null
      memory: null
    limits:
      cpu: null
      memory: null

twofactorauth:
  resources: null

fortifyConnectServer:
  resources: null

upgradejob:
  resources: null
  prepJob:
    resources: null

Upgrade

Upgrade helm-scancentral-dast-core chart from previous releases to version 24.4.

• Preparing for Upgrade
• Perform the upgrade

Preparing for Upgrade

This release of the ScanCentral DAST helm chart has many changes that are not compatible with the previous chart. However, because all of the state for Scancentral DAST is installed in the database, no data will be lost.

Perform the upgrade

1. Remove the previous Fortify ScanCentral DAST helm deployment. If you do not remember the release name, you can find it using the following example command:

   helm -n <scancentral namespace> list

2. After you have identified the previous Fortify ScanCentral DAST installation, use the following command to uninstall the helm chart:

   helm -n <scancentral namespace> uninstall <release name>

3. Now perform the steps listed in Installation.

Values

The following values are exposed by the Helm Chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

Required

""

""

""

""

"http://ssc"

""

""

""

""

""

""

""

Other Values

false

[]

{}

"password"

true

"tls.pfx"

{}

null

"IfNotPresent"

"fortifydocker/scancentral-dast-api"

"24.4.ubi.9"

{}

""

false

{
  "host": "dast-api.local",
  "paths": [
    {
      "path": "/",
      "pathType": "Prefix"
    }
  ]
}

{
  "path": "/",
  "pathType": "Prefix"
}

"Prefix"

[]

 See defaultLogLevel

null

null

{}

{}

{}

1

"4"

"10Gi"

"4"

"5Gi"

34785

"ClusterIP"

[]

true

"0.0.0.0"

1444

false

{}

"DAST"

"SQLServer"

null

false

null

false

false

false

false

true

"invalidHost.replaceme.org"

2022

33467

false

null

"https://licenseservice.fortify.microfocus.com/"

"https://smartupdate.fortify.microfocus.com/"

1444

1445

{}

{
  "enabled": false,
  "resources": {}
}

false

{}

""

"access-token"

""

"Information"

[]

{}

{}

"Chart"

null

"IfNotPresent"

"fortifydocker/scancentral-dast-fortifyconnect"

"24.4.ubi.9"

null

null

{}

{}

{}

1

"4"

"4Gi"

"4"

"4Gi"

{}

null

null

"LoadBalancer"

""

"private.key"

"public.key"

"sshd-config-template"

""

[]

null

[]

{}

{}

8080

null

"IfNotPresent"

"fortifydocker/scancentral-dast-globalservice"

"24.4.ubi.9"

Information

null

null

{}

{}

{}

1

"4"

"4Gi"

"4"

"2Gi"

[]

[]

null

null

""

"service-token"

[]

{}

1443

{}

null

"IfNotPresent"

"fortifydocker/fortify-2fa"

"24.4.ubi.9"

{}

""

false

{
  "host": "dast-2fa.local",
  "paths": [
    {
      "path": "/",
      "pathType": "Prefix"
    }
  ]
}

"Prefix"

[]

"master-token"

""

null

null

{}

{}

{}

1

"16"

"64Gi"

"16"

"16Gi"

59752

"ClusterIP"

[]

[]

{}

{}

null

"IfNotPresent"

"fortifydocker/scancentral-dast-config"

"24.4.ubi.9"

null

null

{}

{}

{}

null

"IfNotPresent"

"bitnami/kubectl"

"1.28"

".5"

"1Gi"

".5"

"1Gi"

"4"

"4Gi"

"4"

"4Gi"

true

[]

[]

{}

"password"

true

"tls.pfx"

{}

[]

null

"IfNotPresent"

"mcr.microsoft.com/mssql/server"

"2022-latest"

"1500Mi"

"1"

"1500Mi"

"4Gi"

"1"

"1500Mi"

"4Gi"

8080

null

"IfNotPresent"

"fortifydocker/dast-scanner"

"24.4.ubi.9"

Information

null

null

{}

{}

{}

1

"4"

"30Gi"

"32Gi"

"4"

"30Gi"

"16Gi"

"15Gi"

48756

"ClusterIP"

[]