Deploying DAST Scanner in Kubernetes

This document describes how to configure and use the scancentral-dast-scanner 25.4 Helm charts for complete ScanCentral DAST scanner container orchestration in Kubernetes. You can find the ScanCentral DAST Scanner Helm charts at https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-scanner.

Table of contents

• Kubernetes versions
• Tool prerequisites
• Installation

Kubernetes versions

OpenText recommends running Fortify on the tested platforms described in the product system requirements documentation. However, customers running on other platforms or with untested configurations will be supported until the point OpenText determines that the root cause is the untested platform or configuration. Issues that can be reproduced on the tested platforms will be prioritized and fixed according to standard defect-handling policies.

These charts have been tested using the following Kubernetes versions:

• Kubernetes 1.32
• Kubernetes 1.33
• Kubernetes 1.34

Tool prerequisites

These instructions were written and tested using the following tool versions. It is recommended that the same tool versions be used in order to avoid unpredictable results.

• kubectl v1.33
• helm v3.18

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems may require different syntax for certain commands and other Kubernetes Cluster providers may require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation prerequisites

• A working Kubernetes Cluster
• Installed ScanCentral DAST Core Services
• DockerHub image pull secret

Installation steps

1. Ensure ScanCentral DAST Core Services are installed
2. Retrieve core configuration properties
3. Configuring mTLS client settings
4. Ensure image pull secret
5. Configure DB password secret
6. Installing ScanCentral DAST scanner
7. Special considerations for testing environments

Ensure ScanCentral DAST Core Services are installed

Ensure that the ScanCentral DAST core components have been installed and are at the same Helm chart revision as the ScanCentral DAST scanner chart.

Retrieve core configuration properties

Obtain the following information to populate core services values in the ScanCentral DAST scanner helm chart:

• DAST API service URL

• DAST API service account token secret name, previously created during the ScanCentral DAST core components Helm deployment

You can obtain this information by running the following command:

helm  get notes  <name_of_scancentral-dast-core_helm_release>

Configuring client TLS settings

1. Ensure that mTLS settings were configured for DAST API Service

2. Generate and sign with CA a client certificate that will be used by WI scanner to access DAST API service. See scancentral-dast-core installation guide for getting CA certificate.

   openssl genrsa -out /tmp/dast-scanner-api-client-key.pem 2048
   openssl req -new -key /tmp/dast-scanner-api-client-key.pem -out /tmp/dast-scanner-api-client.csr -subj "/C=CA/ST=Ontario/L=Waterloo/O=YourCompany/OU=IT/CN=dast-scanner-client"
   openssl x509 -req -in /tmp/dast-scanner-api-client.csr -CA /tmp/ca-cert.pem -CAkey /tmp/ca-key.pem -CAcreateserial -out /tmp/dast-scanner-api-client-cert.pem -days 3650 -sha256
   openssl pkcs12 -export -out /tmp/dast-scanner-api-client-cert.pfx -inkey /tmp/dast-scanner-api-client-key.pem -in /tmp/dast-scanner-api-client-cert.pem -certfile /tmp/ca-cert.pem -passout pass:123456
   kubectl create secret generic dast-scanner-api-client-certificate --type=Opaque --from-file=dast-scanner-api-client-cert.pfx=/tmp/dast-scanner-api-client-cert.pfx
   kubectl create secret generic dast-scanner-api-client-certificate-password --type=Opaque --from-literal=password=123456
   rm /tmp/dast-scanner-api-client-cert.pem /tmp/dast-scanner-api-client-cert.pfx /tmp/dast-scanner-api-client.csr /tmp/dast-scanner-api-client-key.pem

Ensure image pull secret

If you are using Docker images directly from DockerHub, ensure that you have the name of your image pull secret ready to add to the Helm configuration. It should be the same configuration created to install the ScanCentral DAST core components Helm chart.

Configure DB password secret

kubectl create secret generic dast-scanner-db-password --type=Opaque --from-literal=password="$(openssl rand -base64 32)"

Installing ScanCentral DAST scanner

The following command installs the Fortify ScanCentral DAST scanner using the recommended defaults for all services. In some cases, you might need to customize these values using the Helm --set parameter or by creating a values.yaml override file and passing it to the command line with the Helm -f flag. For more information about Helm overrides, refer to the Helm documentation.

For more information about the values that can be overridden, see the Fortify ScanCentral DAST scanner Helm chart values.

Tip: To find other available versions, go to https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-scanner/tags.

Note: These example values presume the default naming referenced in both the helm-scancentral-dast-scanner and the helm-scancentral-dast-core charts. If these values are different, then you must update the following command line accordingly.

helm install <Installation release name> oci://registry-1.docker.io/fortifydocker/helm-scancentral-dast-scanner --version <chart_version> --timeout 60m \
 --set dastApiServiceURL=<SC_DAST_API_service_URL> \
 --set serviceTokenSecretName=scdast-service-token \
 --set datastore.dbPasswordSecretName=dast-scanner-db-password \
 --set dast.tls.clientCertificate.secretName=dast-scanner-api-client-certificate \
 --set dast.tls.clientCertificate.passwordSecretName=dast-scanner-api-client-certificate-password

Special considerations for testing environments

By default, the Helm chart defines the container resources and requests based on recommended best-practice values intended to prevent performance issues and unexpected Kubernetes evictions of containers and pods. These values are often too large for a small test environment that does not require the same level of resources. To disable these settings, paste the following values into a file named 'resource_override.yaml' and add it to the install command line with the -f flag, for example $ helm install -f resource_override.yaml

Caution: Using the following settings in production is not supported and will lead to unstable behavior.

# Set all Kubernetes resources except for the datastores to best-effort mode (no resource requirements)
# DO NOT null out the resource configuration for the 'datastore' containers, this will result in unexpected evictions due to how that service allocates memory.
resources:
  requests:
    cpu: null
    memory: null
  limits:
    cpu: null
    memory: null
wise:
  resources: null

Values

The following values are exposed by the Helm Chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

[]

{}

false

{}

{
  "enabled": false,
  "resources": {}
}

false

{}

[]

8080

null

"IfNotPresent"

"fortifydocker/scancentral-dast-scannerservice"

"25.4.ubi.9"

true

""

""

""

""

false

"1"

"4Gi"

"1"

"2Gi"

{
  "keyPathSecretKey": "",
  "passwordSecretKey": "password",
  "passwordSecretName": "",
  "pathSecretKey": "dast-scanner-api-client-cert.pfx",
  "secretName": ""
}

""

"password"

""

"dast-scanner-api-client-cert.pfx"

""

"https://127.0.0.1:8089"

""

[]

"SQLExpress"

null

"IfNotPresent"

"mcr.microsoft.com/mssql/server"

"2022-latest"

15

"1500Mi"

"1"

"1500Gi"

"4Gi"

"1"

"1500Mi"

"4Gi"

false

true

false

null

null

"IfNotPresent"

"fortifydocker/dast-scanner"

"25.4.ubi.9"

[]

null

null

{}

{}

{}

1

"6"

"30Gi"

"30Gi"

"6"

"30Gi"

"15Gi"

false

"15Gi"

""

"0"

"Fixed"

"service-token"

""

[]

{}

[]

null

"IfNotPresent"

"fortifydocker/wise"

"25.4.ubi.9"

"8"

"64Gi"

"8"

"16Gi"