Deploying Fortify Software Security Center in Kubernetes

This document describes how to configure and use the helm-ssc 24.4 Helm chart for complete Software Security Center container orchestration in Kubernetes. You can find the Software Security Center Helm chart at https://hub.docker.com/r/fortifydocker/helm-ssc.

Table of contents

• Kubernetes Versions
• Tool Prerequisites
• Installation
• Upgrade

Kubernetes versions

These charts have been tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool prerequisites

• kubectl v1.28.7
• helm v3.12.2
• yq v4.35.1

OpenText recommends that you use the same tool versions to avoid unpredictable results.

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems might require different syntax for some commands and other Kubernetes Cluster providers might require additional/different configurations. Your Kubernetes administrator might require the use of specific namespaces and/or other configuration adjustments.

Installation prerequisites

• A working Kubernetes cluster
• A Kubernetes Storage Class to use for Software Security Center persistence.
• A supported database for Software Security Center.

Installation steps

1. Preparing the Fortify license file
2. Prepare the HTTP Certificate Password
3. Preparing an httpKeystore file
4. Preparing an autoconfig file for Software Security Center
5. Preparing a Kubernetes secret for Software Security Center
6. Creating an image pull secret
7. Installing the Software Security Center release
8. Setting up port forwarding
9. Verify Software Security Center is available
10. Testing the admin login
11. Special considerations for testing environments

Preparing the Fortify license file

• Obtain the Fortify license and store it in the /tmp folder as fortify-license.txt so that it can be accessed as /tmp/fortify-license.txt.

Preparing an HTTP certificate password

• Run the following command to create an HTTP certificate password:

  HTTP_CERT_PWD="$(openssl rand -base64 32)"

Preparing the HTTP keystore file

• Run the following command to create the HTTP keystore File

  keytool -genkeypair -keyalg RSA -keysize 2048 -keystore /tmp/httpKeystore.jks -alias ssc-server -storepass $HTTP_CERT_PWD -keypass $HTTP_CERT_PWD -dname "CN=CA, OU=IT, O=OpenText, L=Waterloo, ST=Ontario, C=CN"

Preparing the Software Security Center autoconfig file

1. Create a file /tmp/ssc.autoconfig.tpl and copy the following content to it.

   appProperties:
     host.validation: false
     authentication.max.concurrent.logins: -1
     token.management.user.sessionless.tokens.max: 500
     token.management.user.session.tokens.max: 500     
   
   datasourceProperties:
     db.username: '<DB-USERNAME>'
     db.password: '<DB-PASSWORD>'
   
     jdbc.url: 'jdbc:sqlserver://<DB-HOST>;database=<DB-NAME>;sendStringParametersAsUnicode=false;trustServerCertificate=true'
   
   dbMigrationProperties:
     migration.enabled: true
     migration.username: '<DB-USERNAME>'
     migration.password: '<DB-PASSWORD>'

• This is an example autoconfig file for a MS SQL Server database. You might have to modify this based on your database. Update the values of <DB-USERNAME>,<DB-PASSWORD>, <DB-HOST> and <DB-NAME> for your environment.

Preparing the Software Security Center Kubernetes secret

1. Use the kubectl create secret command, as shown in the following example code, to create the ssc-secret secret in Kubernetes.

   kubectl create secret generic ssc-secret \
    --from-file=/tmp/httpKeystore.jks \
    --from-file=/tmp/fortify-license.txt \
    --from-file=/tmp/ssc.autoconfig.tpl \
    --from-literal=httpCertificateKeyPassword=$HTTP_CERT_PWD \
    --from-literal=httpCertificateKeystorePassword=$HTTP_CERT_PWD

2. Run the following command to delete the temporary files.

   rm /tmp/httpKeystore.jks /tmp/ssc.autoconfig.tpl /tmp/fortify-license.txt

3. Run the following command to unset the HTTP certificate password from the terminal.

   unset HTTP_CERT_PWD

Creating an image pull secret

By default, the Software Security Center Helm chart references its images directly from DockerHub. For Kubernetes to properly install your images using the default configuration, you must create an image pull secret and store it in your installation namespace in Kubernetes. If you are replicating these images to a local repository, you can skip this task and update the relevant image values in the Helm chart to reference your local repository. To create an image pull secret:

• Use the kubectl create secret command as shown in the following example code:

  kubectl create secret docker-registry docker.io \
   --docker-server=registry-1.docker.io \
   --docker-username='<docker username>' \
   --docker-password='<docker password>' \
   --docker-email='<docker user email>'

Installing the Software Security Center release

The following command installs the Software Security Center using the recommended defaults. In some cases, you might need to customize these values using the Helm --set parameter or by creating a values.yaml override file and passing it to the command line with the Helm -f flag. For more information about the values you can override, see the Helm Chart Values table.

Tip: To find the available Software Security Center 24.4 Helm chart version, go to https://hub.docker.com/r/fortifydocker/helm-ssc/tags.

• Use the following command to install Software Security Center.

  helm install <release-name> oci://registry-1.docker.io/fortifydocker/helm-ssc --version <ssc-helm-chart-version> \
   --set imagePullSecrets[0].name=docker-registry \
   --set secretRef.name=ssc-secret \
   --set secretRef.keys.sscLicenseEntry=fortify-license.txt \
   --set secretRef.keys.sscAutoconfigEntry=ssc.autoconfig.tpl \
   --set secretRef.keys.httpCertificateKeystoreFileEntry=httpKeystore.jks \
   --set secretRef.keys.httpCertificateKeyPasswordEntry=httpCertificateKeyPassword \
   --set secretRef.keys.httpCertificateKeystorePasswordEntry=httpCertificateKeystorePassword \
   --set urlHost=<preferred-ssc-url-hostname> \
   --set persistentVolumeClaim.storageClassName=<available-kubernetes-storage-class-name>

Setting up port forwarding through kubectl

1. Verify that your Software Security Center pod (ssc-webapp-0) is running successfully. It might take a few minutes before your pod gets to a proper 1/1 Running configuration. You can run the command above multiple times or use the flag -w to watch for any changes.

   kubectl get pods

2. Open a new terminal shell.

3. Set up port forwarding through kubectl to access your Software Security Center endpoint.

   For example, to forward the localhost port 8081:

   kubectl port-forward svc/ssc-service 8081:443

Verifying that Software Security Center is available

1. Follow the steps at Setting up port forwarding through kubectl.

2. You should now be able to access the Software Security Center web endpoint from your browser.

   https://localhost:8081
   

Testing the admin login

1. Follow the steps at Setting up port forwarding through kubectl.

2. Access the login endpoint from your browser:

   https://localhost:8081
   

3. Log in with your default admin credentials

Special considerations for testing environments

By default, the Helm chart defines the container resource/requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources. You can override the resource requests by passing additional value --set resources=null in the helm install command above.

WARNING: Using the above option in production is not supported and will lead to unstable behavior.

Upgrading

This section explains how to upgrade Software Security Center Helm charts from previous releases to version 24.4.

Upgrade prerequisites

• A running Software Security Center environment
• Helm access to a Software Security Center environment

Upgrading from version 23.2.x

Upgrade steps

1. Preparing a values file
2. Upgrading the Software Security Center release
3. Verifying Software Security Center after an upgrade

Preparing a values file

Starting from Software Security Center Helm version 24.4, a few values in the Helm charts have been modified and few values are added. Compare the values used in deploying Helm chart version 23.2 with the current release values and create a values.yaml by merging the values.

Upgrading the Software Security Center release

Use the 'helm upgrade' command as shown in the below example to upgrade the Software Security Center release.

helm upgrade <Existing Installed SSC Release Name> oci://registry-1.docker.io/fortifydocker/helm-ssc --version <ssc-helm-chart-version>  -f values.yaml --reuse-values

Verifying Software Security Center after the upgrade

After the Software Security Center upgrade, verify if Software Security Center is available and test the admin login.

Values

The following values are exposed by the Helm Chart. Unless specified as Required, only override values as required for your specific environment.

Required

Other Values