Deploying ScanCentral SAST Components in Kubernetes

This document describes how to configure and use the scancentral-sast 24.4 Helm chart for ScanCentral SAST components in Kubernetes. You can find the ScanCentral SAST Helm chart at https://hub.docker.com/r/fortifydocker/helm-scancentral-sast.

Table of contents

• Kubernetes versions
• Tool prerequisites
• Installation
• Upgrading

Kubernetes versions

These charts were tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool prerequisites

• kubectl v1.28.7
• helm v3.12.2

OpenText recommends that you use the same tool versions to avoid unpredictable results.

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems might require different syntax for certain commands and other Kubernetes Cluster providers might require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation prerequisites

• A working Kubernetes cluster
• A Fortify Software Security Center 24.4 server with user accounts with access to Fortify ScanCentral SAST
• A Fortify license file

Installation steps

1. Creating an image pull secret
2. Installing ScanCentral SAST components
3. Verifying the ScanCentral SAST API is available
4. Integrating ScanCentral SAST with Fortify Software Security Center
5. Special Considerations for testing environments

Creating an image pull secret

By default, the Fortify ScanCentral SAST components Helm chart references its images directly from DockerHub. For Kubernetes to properly install your images using the default configuration, you must create an image pull secret and store it in your installation namespace in Kubernetes. If you are replicating these images to a local repository, you can skip this task and update the relevant image values in the Helm chart to reference your local repository. To create an image pull secret:

• Use the kubectl create secret command as shown in the following code sample:

  kubectl create secret docker-registry docker.io \
   --docker-server=registry-1.docker.io \
   --docker-username='<docker username>' \ 
   --docker-password='<docker password>' \
   --docker-email='<docker user email>'

Installing ScanCentral SAST components

The following command installs the SAST Controller and sensor (on linux by default) using the recommended defaults. In some cases, you might need to customize these values using the '--set' parameter or by creating a 'values.yaml' and passing it to the command line with '-f' flag. For more information about the values you can override, see the Helm Chart Values table.

Tip: To find the available Fortify ScanCentral SAST 24.4 Helm chart versions, go to https://hub.docker.com/r/fortifydocker/helm-scancentral-sast/tags.

1. Use the following Helm commands to perform the installation:

   helm install <release-name> oci://registry-1.docker.io/fortifydocker/helm-scancentral-sast --version <sc-sast-helm-chart-version> \
     --set-file=secrets.fortifyLicense=<fortify.license> \
     --set controller.sscUrl="https://<ssc-svc-name>.<namespace>.svc.cluster.local/ssc"

2. Verify that your ScanCentral SAST pods are running successfully. It might take a few minutes before your pod gets to a proper 1/1 Running configuration. You can run the following command multiple times or use the flag -w to watch for any changes.

   kubectl get pods

Verifying the ScanCentral SAST API is available

1. Open a new terminal shell.

2. To access your ScanCentral SAST endpoint, set up port forwarding through kubectl.

   For example, to forward the ScanCentral SAST service on localhost port 8082:

   kubectl port-forward svc/<sc-sast-service-name> 8082:80

   You can determine the by using the following command to list the Kubernetes services:

   kubectl get services

3. Verify that you can access ScanCentral SAST API endpoint with your browser.

   http://localhost:8082/scancentral-ctrl/
   
   

Integrating ScanCentral SAST with Fortify Software Security Center

Configure your ScanCentral SAST Service URL in Fortify Software Security Center by performing following the steps:

1. Access the Fortify Software Security Center webpage by opening up a new terminal shell and setting up port forward on the Software Security Center service through kubectl. For example, to forward the Software Security Center service on localhost port 8081:

   kubectl port-forward svc/<ssc-service-name> 8081:443

   You can determine the by using the following command to list the Kubernetes services:

   kubectl get services

2. Access the Software Security Center web application from your browser.

   https://localhost:8081
   

3. After you login to Software Security Center, select the Administration view.

4. Expand Configuration, and then select ScanCentral SAST.

5. Specify the ScanCentral SAST Controller URL, and the SSC and ScanCentral Controller shared secret. Follow the below steps to get the secret.

     kubectl get secret <scancentral-sast-secret-name> -o jsonpath="{.data.scancentral-ssc-scancentral-ctrl-secret}" | base64 -d

   You can determine the 'scancentral-sast-secret-name' by using the following command to list the Kubernetes secrets:

   kubectl get secrets

6. Restart the Software Security Center pod (managed by statefulset) to effect the change by running the following command:

    kubectl rollout restart statefulset <ssc-statefulset-name>

   You can determine the 'ssc-statefulset-name' by using the following command to list the Kubernetes statefulsets:

   kubectl get statefulsets

7. Restarting the Software Security Center statefulset causes its service port forwarding to be interrupted. See step 1 to configure port forwarding again.

8. Login back to Software Security Center. You should see ScanCentral view on the header and you can access the SAST page from that view.

9. See the Software Security Center and ScanCentral SAST documentation to submit a scan requests.

Special Considerations for testing environments:

By default, the helm chart defines the container resource/requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources.

To disable these settings, paste the below values into a file called "resource_override.yaml" and add it to the install commandline with the -f flag. (e.g. -f resource_override.yaml")

WARNING: Using the following settings in production is not supported and will lead to unstable behaviors.

controller:
  resources:
    requests:
      cpu: null
      memory: null
    limits:
      cpu: null
      memory: null
workers:
  linux:
    resources:
      requests:
        cpu: null
        memory: null
      limits:
        cpu: null
        memory: null

Upgrading

• Preparing for the upgrade
• Performing the upgrade

Preparing for the upgrade

The current release of the ScanCentral SAST helm chart includes changes that might not be compatible with the previous chart version. However, Fortify Software Security Center is designed to persist its state in an external database, therefore the data will remain in the database regardless of the ScanCentral-SAST lifecycle.

Performing the upgrade

1. Remove the previous ScanCentral SAST helm deployment. If you do not remember the release name, use the following example command to find it.

   helm list

2. After you identify the previous ScanCentral SAST release, uninstall the Helm chart.

   helm uninstall <release-name>

3. Now perform the steps listed in Installation.

Values

The following values are exposed by the Helm chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

Required

Other Values