fortify-ssc
A Helm chart for Fortify Software Security Center application
Upstream References
Upstream Release Notes
Learn More
Pre-Requisites
- Kubernetes Cluster deployed
- Kubernetes config installed in
~/.kube/config - Helm installed
Install Helm
https://helm.sh/docs/intro/install/
Deployment
- Clone down the repository
- cd into directory
helm install fortify-ssc chart/Values
| Key | Type | Default | Description |
|---|---|---|---|
| openshift | bool | false |
|
| image.repositoryPrefix | string | "registry1.dso.mil/ironbank/microfocus/fortify/" |
|
| image.pullPolicy | string | "Always" |
|
| image.webapp | string | "ssc" |
|
| image.tag | string | "24.2.0.0186" |
|
| securityContext.enabled | bool | true |
|
| securityContext.capabilities.drop[0] | string | "ALL" |
|
| securityContext.fsGroup | int | 1111 |
|
| securityContext.fsGroupChangePolicy | string | "OnRootMismatch" |
|
| securityContext.runAsUser | int | 1111 |
|
| securityContext.runAsGroup | int | 1111 |
|
| securityContext.runAsNonRoot | bool | true |
|
| containerSecurityContext.capabilities.drop[0] | string | "ALL" |
|
| containerSecurityContext.fsGroup | int | 1111 |
|
| containerSecurityContext.fsGroupChangePolicy | string | "OnRootMismatch" |
|
| containerSecurityContext.runAsUser | int | 1111 |
|
| containerSecurityContext.runAsGroup | int | 1111 |
|
| containerSecurityContext.runAsNonRoot | bool | true |
|
| imagePullSecrets[0].name | string | "private-registry" |
|
| nameOverride | string | "fortify-ssc" |
|
| fullnameOverride | string | "fortify-ssc" |
|
| service.type | string | "ClusterIP" |
|
| service.httpPort | int | 80 |
|
| service.httpsPort | int | 443 |
|
| service.clusterIP | string | "" |
|
| service.loadBalancerIP | string | "" |
|
| service.annotations | object | {} |
|
| urlHost | string | "fortify.dev.bigbang.mil" |
|
| urlPort | int | 0 |
|
| sscPathPrefix | string | "/" |
|
| httpClientCertificateVerification | string | "none" |
|
| secretRef.name | string | "" |
|
| secretRef.keys.sscLicenseEntry | string | "fortify.license" |
|
| secretRef.keys.sscAutoconfigEntry | string | "ssc.autoconfig" |
|
| secretRef.keys.sscSecretKeyEntry | string | "" |
|
| secretRef.keys.httpCertificateKeystoreFileEntry | string | "ssc-service.jks" |
|
| secretRef.keys.httpCertificateKeystorePasswordEntry | string | "ssc-service.jks.password" |
|
| secretRef.keys.httpCertificateKeyPasswordEntry | string | "ssc-service.jks.key.password" |
|
| secretRef.keys.httpTruststoreFileEntry | string | "" |
|
| secretRef.keys.httpTruststorePasswordEntry | string | "" |
|
| secretRef.keys.jvmTruststoreFileEntry | string | "" |
|
| secretRef.keys.jvmTruststorePasswordEntry | string | "" |
|
| ssc.config.http.min_threads | int | 1 |
|
| ssc.config.http.max_threads | int | 4 |
|
| ssc.config.https.min_threads | int | 4 |
|
| ssc.config.https.max_threads | int | 150 |
|
| ssc.config.log4j.enableDebugConfig | bool | false |
|
| ssc.config.log4j.customXMLConfigString | string | "" |
|
| persistentVolumeClaim.size | string | "4Gi" |
|
| persistentVolumeClaim.storageClassName | string | "" |
|
| persistentVolumeClaim.selector | object | {} |
|
| environment | list | [] |
|
| jvmMaxRAMPercentage | int | 86 |
|
| jvmExtraOptions | string | "-Dcom.redhat.fips=false" |
|
| resources.limits.cpu | int | 4 |
|
| resources.limits.memory | string | "16Gi" |
|
| resources.requests.cpu | int | 1 |
|
| resources.requests.memory | string | "1Gi" |
|
| user.uid | int | 1111 |
|
| user.gid | int | 1111 |
|
| nodeSelector."kubernetes.io/os" | string | "linux" |
|
| nodeSelector."kubernetes.io/arch" | string | "amd64" |
|
| tolerations | list | [] |
|
| affinity | object | {} |
|
| mysql.enabled | bool | true |
|
| mysql.fullnameOverride | string | "" |
|
| mysql.global.imageRegistry | string | "registry1.dso.mil/ironbank" |
|
| mysql.global.imagePullSecrets[0] | string | "private-registry" |
|
| mysql.image.repository | string | "bitnami/mysql8" |
|
| mysql.image.tag | string | "8.0.36-debian-11-r1" |
|
| mysql.auth.rootPassword | string | "password" |
|
| mysql.auth.database | string | "ssc_db" |
|
| mysql.primary.configuration | string | "[mysqld]\ndefault_authentication_plugin=mysql_native_password\nskip-name-resolve\nexplicit_defaults_for_timestamp\nbasedir=/opt/bitnami/mysql\nplugin_dir=/opt/bitnami/mysql/lib/plugin\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\ndatadir=/bitnami/mysql/data\ntmpdir=/opt/bitnami/mysql/tmp\nbind-address=0.0.0.0\npid-file=/opt/bitnami/mysql/tmp/mysqld.pid\nlog-error=/opt/bitnami/mysql/logs/mysqld.log\ncharacter-set-server=latin1\ncollation-server=latin1_general_cs\nslow_query_log=0\nslow_query_log_file=/opt/bitnami/mysql/logs/mysqld.log\nlong_query_time=10.0\ndefault_storage_engine=INNODB\ninnodb_buffer_pool_size=512M\ninnodb_lock_wait_timeout=300\ninnodb_log_file_size=512M\nmax_allowed_packet=1G\nsql-mode=\"TRADITIONAL\"\n\n[mysqldump]\nmax_allowed_packet=1G\n\n[client]\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\ndefault-character-set=UTF8\nplugin_dir=/opt/bitnami/mysql/lib/plugin\n\n[manager]\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\npid-file=/opt/bitnami/mysql/tmp/mysqld.pid" |
|
| mysql.primary.resources.limits.cpu | int | 8 |
|
| mysql.primary.resources.limits.memory | string | "64Gi" |
|
| mysql.primary.resources.requests.cpu | int | 4 |
|
| mysql.primary.resources.requests.memory | string | "16Gi" |
|
| mysql.primary.podSecurityContext.enabled | bool | true |
|
| mysql.primary.podSecurityContext.fsGroup | int | 1001 |
|
| mysql.primary.containerSecurityContext.enabled | bool | true |
|
| mysql.primary.containerSecurityContext.capabilities.drop[0] | string | "ALL" |
|
| mysql.primary.containerSecurityContext.runAsUser | int | 1001 |
|
| mysql.primary.containerSecurityContext.runAsGroup | int | 1001 |
|
| mysql.primary.containerSecurityContext.runAsNonRoot | bool | true |
|
| mysql.secondary.resources.limits.cpu | int | 8 |
|
| mysql.secondary.resources.limits.memory | string | "64Gi" |
|
| mysql.secondary.resources.requests.cpu | int | 4 |
|
| mysql.secondary.resources.requests.memory | string | "16Gi" |
|
| mysql.secondary.podSecurityContext.enabled | bool | true |
|
| mysql.secondary.podSecurityContext.fsGroup | int | 1001 |
|
| mysql.secondary.containerSecurityContext.enabled | bool | true |
|
| mysql.secondary.containerSecurityContext.capabilities.drop[0] | string | "ALL" |
|
| mysql.secondary.containerSecurityContext.runAsUser | int | 1001 |
|
| mysql.secondary.containerSecurityContext.runAsGroup | int | 1001 |
|
| mysql.secondary.containerSecurityContext.runAsNonRoot | bool | true |
|
| mysql.metrics.resources.limits.cpu | int | 2 |
|
| mysql.metrics.resources.limits.memory | string | "1Gi" |
|
| mysql.metrics.resources.requests.cpu | string | "100m" |
|
| mysql.metrics.resources.requests.memory | string | "256Mi" |
|
| mysql.metrics.podSecurityContext.enabled | bool | true |
|
| mysql.metrics.podSecurityContext.fsGroup | int | 1001 |
|
| mysql.metrics.containerSecurityContext.enabled | bool | true |
|
| mysql.metrics.containerSecurityContext.capabilities.drop[0] | string | "ALL" |
|
| mysql.metrics.containerSecurityContext.runAsUser | int | 1001 |
|
| mysql.metrics.containerSecurityContext.runAsGroup | int | 1001 |
|
| mysql.metrics.containerSecurityContext.runAsNonRoot | bool | true |
|
| domain | string | "dev.bigbang.mil" |
|
| istio.enabled | bool | false |
|
| istio.hardened.enabled | bool | false |
|
| istio.hardened.outboundTrafficPolicyMode | string | "REGISTRY_ONLY" |
|
| istio.hardened.customServiceEntries | list | [] |
|
| istio.hardened.customAuthorizationPolicies | list | [] |
|
| istio.hardened.monitoring.enabled | bool | true |
|
| istio.hardened.monitoring.namespaces[0] | string | "monitoring" |
|
| istio.hardened.monitoring.principals[0] | string | "cluster.local/ns/monitoring/sa/monitoring-monitoring-kube-prometheus" |
|
| istio.mtls.mode | string | "STRICT" |
STRICT = Allow only mutual TLS traffic, PERMISSIVE = Allow both plain text and mutual TLS traffic |
| istio.fortify.gateways[0] | string | "istio-system/public" |
|
| istio.fortify.hosts[0] | string | "fortify.{{ .Values.domain }}" |
|
| istio.injection | string | "disabled" |
|
| initContainer.keystoreImage | string | "registry1.dso.mil/ironbank/google/golang/golang-1.20" |
|
| initContainer.keystoreTag | string | "1.20.14" |
|
| initContainer.resources.limits.cpu | string | "500m" |
|
| initContainer.resources.limits.memory | string | "128Mi" |
|
| initContainer.resources.requests.cpu | string | "250m" |
|
| initContainer.resources.requests.memory | string | "64Mi" |
|
| initContainer.containerSecurityContext.enabled | bool | true |
|
| initContainer.containerSecurityContext.capabilities.drop[0] | string | "ALL" |
|
| initContainer.containerSecurityContext.fsGroup | int | 1111 |
|
| initContainer.containerSecurityContext.fsGroupChangePolicy | string | "OnRootMismatch" |
|
| initContainer.containerSecurityContext.runAsUser | int | 1111 |
|
| initContainer.containerSecurityContext.runAsGroup | int | 1111 |
|
| initContainer.containerSecurityContext.runAsNonRoot | bool | true |
|
| networkPolicies.enabled | bool | false |
|
| networkPolicies.ingressLabels.app | string | "istio-ingressgateway" |
|
| networkPolicies.ingressLabels.istio | string | "ingressgateway" |
|
| networkPolicies.additionalPolicies | list | [] |
|
| cache.enabled | bool | false |
|
| cache.expireHours | int | 24 |
|
| databaseSecret.use_secret | bool | false |
|
| databaseSecret.name | string | "db-credentials-mysql" |
|
| databaseSecret.useRoot | bool | false |
|
| fortify_java_keystore.use | bool | false |
|
| fortify_java_keystore.keystore | string | "ZHVtbXkK" |
|
| default_cert_alias | string | "tomcat" |
|
| fortifySecret.use_secret | bool | false |
|
| fortifySecret.name | string | "fortify-secret" |
|
| bbtests.enabled | bool | false |
|
| bbtests.cypress.artifacts | bool | true |
|
| bbtests.cypress.envs.cypress_url | string | "http://fortify-ssc-service:80" |
|
| bbtests.cypress.envs.cypress_user | string | "admin" |
|
| bbtests.cypress.envs.cypress_password | string | "admin" |
|
| bbtests.cypress.resources.requests.cpu | string | "2" |
|
| bbtests.cypress.resources.requests.memory | string | "4Gi" |
|
| bbtests.cypress.resources.limits.cpu | string | "2" |
|
| bbtests.cypress.resources.limits.memory | string | "4Gi" |
|
| bbtests.scripts.image | string | "registry1.dso.mil/bigbang-ci/gitlab-tester:0.0.4" |
|
| bbtests.scripts.envs | object | {} |
|
| trust_store_password | string | "dsoppassword" |
|
| key_store_password | string | "dsoppassword" |
|
| key_store_cert_password | string | "dsoppassword" |
|
| fortify_autoconfig | string | "appProperties:\n host.validation: false\n\ndatasourceProperties:\n db.username: root\n db.password: password\n\n jdbc.url: 'jdbc:mysql://fortify-mysql:3306/ssc_db?sessionVariables=collation_connection=latin1_general_cs&rewriteBatchedStatements=true'\n\ndbMigrationProperties:\n\n migration.enabled: true\n migration.username: root\n migration.password: password\n" |
|
| fortify_license | string | "<License>\n" |
Contributing
Please see the contributing guide if you are interested in contributing.
This file is programatically generated using helm-docs and some BigBang-specific templates. The gluon repository has instructions for regenerating package READMEs.