Deploying ScanCentral SAST Controller in Kubernetes

This document describes how to configure and use the scancentral-sast 24.4 Helm chart for ScanCentral SAST Controller container orchestration in Kubernetes. You can find the ScanCentral SAST Helm chart at https://hub.docker.com/r/fortifydocker/helm-scancentral-sast.

Table of contents

• Kubernetes versions
• Tool prerequisites
• Installation
• Upgrading

Kubernetes versions

These charts were tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool prerequisites

• kubectl v1.28.7
• helm v3.12.2
• yq v4.35.1

OpenText recommends that you use the same tool versions to avoid unpredictable results.

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems might require different syntax for certain commands and other Kubernetes Cluster providers might require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation prerequisites

• A working Kubernetes cluster
• A Fortify Software Security Center 24.4 server with user accounts with access to Fortify ScanCentral SAST
• A Fortify license file

Installation steps

1. Creating an image pull secret
2. Installing ScanCentral SAST components
3. Verifying the ScanCentral SAST API is available
4. Integrating ScanCentral SAST with Fortify Software Security Center
5. Special Considerations for testing environments

Creating an image pull secret

By default, the Fortify ScanCentral SAST components Helm chart references its images directly from DockerHub. For Kubernetes to properly install your images using the default configuration, you must create an image pull secret and store it in your installation namespace in Kubernetes. If you are replicating these images to a local repository, you can skip this task and update the relevant image values in the Helm chart to reference your local repository. To create an image pull secret:

• Use the kubectl create secret command as shown in the following code sample:

  kubectl create secret docker-registry docker.io \
   --docker-server=registry-1.docker.io \
   --docker-username='<docker username>' \ 
   --docker-password='<docker password>' \
   --docker-email='<docker user email>'

Installing ScanCentral SAST components

The following command installs the SAST Controller and sensor (on linux by default) using the recommended defaults. In some cases, you might need to customize these values using the '--set' parameter or by creating a 'values.yaml' and passing it to the command line with '-f' flag. For more information about the values you can override, see the Helm Chart Values table.

1. Use the following Helm commands to perform the installation:

   helm install sast <release-name> oci://registry-1.docker.io/fortifydocker/helm-scancentral-sast --version 24.4.0-2 \
     --set-file=secrets.fortifyLicense=fortify.license \
     --set controller.sscUrl="https://<SSC service FQDN>/ssc"

2. Verify that your SAST pods (sast-scancentral-sast-controller-0 & sast-scancentral-sast-worker-linux-0) are running successfully. It might take a few minutes before your pod gets to a proper 1/1 Running configuration. You can run the command above multiple times or use the flag -w to watch for any changes.

   kubectl get pods

Verifying the ScanCentral SAST API is available

1. Open a new terminal shell.

2. To access your ScanCentral SAST endpoint, set up port forwarding through kubectl.

   For example, to forward the ScanCentral SAST service on localhost port 8082:

   kubectl port-forward svc/sast-scancentral-sast-controller 8082:80

3. Verify that you can access ScanCentral SAST API endpoint with your browser.

   https://localhost:8082/scancentral-ctrl/
   
   

Integrating ScanCentral SAST with Fortify Software Security Center

1. Configure your ScanCentral SAST Service URL in Fortify Software Security Center by performing following the steps:

2. Access the Fortify Software Security Center webpage by opening up a new terminal shell and setting up port forward on the Software Security Center service through kubectl.

   For example, to forward the Software Security Center service on localhost port 8081:

   kubectl port-forward svc/ssc-service 8081:443

3. Access the Software Security Center web application from your browser.

   https://localhost:8081
   

4. After you login to Software Security Center, select the Administration view.

5. Expand Configuration, and then select ScanCentral SAST.

6. Specify the ScanCentral SAST Controller URL, and the SSC and ScanCentral Controller shared secret. Follow the below steps to get the secret.

     kubectl get secret --namespace sc-sast sast-scancentral-sast -o jsonpath="{.data.scancentral-ssc-scancentral-ctrl-secret}" | base64 -d

7. Restart the Software Security Center pod to effect the change by running the following command:

    kubectl rollout restart statefulset ssc-webapp

8. Login back to Software Security Center. You should see ScanCentral view on the header and you can access the SAST page from that view.

9. See the Software Security Center and ScanCentral SAST documentation to submit a scan requests.

Special Considerations for testing environments:

By default, the helm chart defines the container resource/requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources.

To disable these settings, paste the below values into a file called "resource_override.yaml" and add it to the install commandline with the -f flag. (e.g. -f resource_override.yaml")

WARNING: Using the following settings in production is not supported and will lead to unstable behaviors.

# Set all Kubernetes resources except for the datastores to best-effort mode (no resource requirements)
# DO NOT null out the resource configuration for the 'datastore' containers, this will result in unexpected evictions due to how that service allocates memory.
resources:
requests:
   cpu: null
   memory: null
limits:
   cpu: null
   memory: null
wise:
resources: null

Upgrading

• Preparing for the upgrade
• Performing the upgrade

Preparing for the upgrade

This release of the ScanCentral SAST helm chart has many changes that are not compatible with the previous chart. However, because all the states for Scancentral SAST is installed in the database, no data is lost.

Performing the upgrade

1. Remove the previous ScanCentral SAST helm deployment. If you do not remember the release name, use the following example command to find it.

   helm -n <scancentral namespace> list

2. After you identify the previous ScanCentral SAST installation, uninstall that Helm chart.

   helm -n <scancentral namespace> uninstall <release name>

3. Now perform the steps listed in Installation.

Values

The following values are exposed by the Helm chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

Required

Other Values