構成ファイルを準備する

• *.crt または *.cer ファイル内の公開鍵
• *.key ファイル内の秘密鍵

1. インストールプロパティー・ファイル (singular-singular.clusterKit.properties) で、証明書を base64-value に指定します。
   • SSO 認証の場合:

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

   • LDAP 認証の場合:

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

2. SSO を構成する場合は、Okta または Keycloak テナントへ AppScan 360° が接続できるように外部ドメインを指定します。例:

   CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS='xxxxx.demo.com,XXXXX.abc.com'

1. プロパティーファイル (singular-singular.clusterKit.yaml) をカスタマー CA 証明書設定で更新します。

   #
   # Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
   #
   
   global:
     customer:
       certificate:
         ca:
           # CUSTOMIZE_ME:
           # Indication whether to use customer given CA certificates, or not
           enabled: true
           secret:
               data:
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing LDAPs based service(s)
                   caCrtForLDAPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing SMTPs based service(s) 
                   caCrtForSMTPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing OIDCs based service(s)
                   caCrtForOIDCsAsBase64: ' '

2. プロパティーファイルで証明書を指定します。
   • enabled を true に設定する。
   • SSO の場合は、caCrtForOIDCsAsBase64 で証明書を指定します。
   • LDAP の場合は、caCrtForLDAPsAsBase64 で証明書を指定します。

1. 自己署名証明書を証明書フォルダー (必要に応じて SSO または LDAP) に配置します。
2. カスタムシングル VM インストール手順の手順 8f で、外部ドメインを指定して AppScan 360° が SSO または LDAP プロバイダーに接続できるようにします。

#
## Docker Registry info
#

CK_DOCKER_REGISTRY_ADDRESS='pi-dpr-lin.appscan.com'
CK_DOCKER_REGISTRY_USERNAME='user'
CK_DOCKER_REGISTRY_PASSWORD='password'

#
## Network info
#

CK_CNI_NETWORK_DOMAIN_SUFFIX='appscan.com'

#
## Storage info
#

CK_CSI_STORAGE_CLASS_NAME='longhorn'
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_VOLUME_NAME=''
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY='100Gi'

#
## Ingress info
#

CK_INGRESS_CONTROLLER_CAPABILITIES_IS_HTTPS_BACKEND_PROTOCOL_SUPPORTED='false'
CK_INGRESS_INTERNAL_CLASS='nginx'
CK_INGRESS_INTERNAL_HOST_DOMAIN='appscan.com'
CK_INGRESS_INTERNAL_HOST_SUBDOMAIN='expo.ascp'

#
## Customer certificate info 
#

CK_CUSTOMER_INGRESS_CERTIFICATE_ENABLED='false'
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_CA_CRT_AS_BASE64='   '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_CRT_AS_BASE64='  '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_KEY_AS_BASE64='  '

#
## Configuration/Disclosed info
#

CK_CONFIGURATION_DISCLOSED_SITE_URL='https://expo.ascp.appscan.com'
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_HOST=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_PORT=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_USERNAME=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_IDP_MODE='AutoOnboard'
CK_CONFIGURATION_DISCLOSED_LDAP_DOMAIN='appscan.com'
CK_CONFIGURATION_DISCLOSED_LDAP_USERNAME='labmgr'
CK_CONFIGURATION_DISCLOSED_LDAP_AUTHORIZED_GROUPS=''
CK_CONFIGURATION_DISCLOSED_LDAP_SSL='false'
CK_CONFIGURATION_DISCLOSED_LDAP_TARGET_OU='CN=Users,DC=appscan,DC=com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_HOST='wfilsus.israel.ottawa.watchfire.com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_PORT='25'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_USERNAME='admin@abcd'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_ENABLE_SSL='false'

#
## Configuration/Confidential info
#

CK_CONFIGURATION_CONFIDENTIAL_DEFAULT_CONNECTION='Data Source=mssql-service.expo.ascp.appscan.com;Initial Catalog=AppScanCloudDB;User ID=ABC;Password=1234;MultipleActiveResultSets=True;TrustServerCertificate=True'
CK_CONFIGURATION_CONFIDENTIAL_LDAP_PASSWORD='12345678Abcdefg'
CK_CONFIGURATION_CONFIDENTIAL_MAIL_SMTP_PASSWORD='ABC!@#123'
CK_CONFIGURATION_CONFIDENTIAL_UPSTREAM_PROXY_PASSWORD=''


#
## OIDC Configuration and Certificates
#

CK_CONFIGURATION_DISCLOSED_OIDC_CLIENT_ID=''
CK_CONFIGURATION_DISCLOSED_OIDC_AUTHORITY=''
CK_CONFIGURATION_CONFIDENTIAL_OIDC_CLIENT_SECRET=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_SMTPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATES_ENABLED=''

#
## SCA Configuration
#
SCA_CSI_STORAGE_CLASS_NAME=''
SCA_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY=''
SCA_CSI_STORAGE_ACCESS_MODE=''
SCA_CSI_STORAGE_VOLUME_NAME=''
SCA_CONNECTIONSTRINGSSCAENGINEDATABASE=''
SCA_CONNECTIONSTRINGSSCAAGGREGATIONDB=''

#
## SCA Auto Updater Configuration
#
SCA_AUTOUPDATER_REGISTRY_ADDRESS=''
SCA_AUTOUPDATER_REGISTRY_PATH=''
SCA_AUTOUPDATER_HELM_PATH=''
SCA_AUTOUPDATER_REGISTRY_USERNAME=''
SCA_AUTOUPDATER_REGISTRY_PASSWORD=''

#
## Registry Contexts Customization
# 
CK_DOCKER_REGISTRY_CONTEXT=''
CK_HELM_REPOSITORY_CONTEXT=''
CK_DOCKER_REGISTRY_CONTEXT_4_ADDONS=''
CK_HELM_REPOSITORY_CONTEXT_4_ADDONS=''

#
## Namespace Customization
#
CK_K8S_ASCP_NAMESPACE=''
CK_K8S_ASRA_NAMESPACE=''
NAMESPACE=''

# Default values for ascp-dart-prime.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

#
# Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
#
global:
  customer:
    certificate:
       ca:
         # CUSTOMIZE_ME:
         # Indication whether to use customer given CA certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing LDAPs based service(s)
             caCrtForLDAPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing SMTPs based service(s)
             caCrtForSMTPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing OIDCs based service(s)
             caCrtForOIDCsAsBase64: ''
       ingress:
         # CUSTOMIZE_ME:
         # Indication whether to use a customer given certificate as the applicable external (out-of-cluster) micro services ingresses certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied certificate authority (CA) signing certificate of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             caCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied public key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied private key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsKeyAsBase64: ''
  storage:
    pvc:
      linux:
        enabled: true
        # The customer's K8S storage driver access mode
        #   NOTE: Set on 'ReadWriteMany' and should not be changed
        accessMode: ReadWriteMany
        # CUSTOMIZE_ME:
        # The customer's K8S storage driver class name
        #   NOTE: The CSI driver must support 'ReadWriteMany' access mode
#       storageClassName: freenas-nfs-csi
        storageClassName: longhorn
        # CUSTOMIZE_ME:
        # The customer's K8S predefined PV (Persistent Volume), to be used with the auto-generated PVC (Persistent Volume Claim) for the shared file system
        #   NOTES:
        #   1. This field is optional, if left empty, the designated PV will be generated automatically by the PVC
        #   2. This ability is generally used in case migrating from the Windows VM based version of AppScan 360°, and there is a need to keep the existing (shared) data
        #   3. Note: In case the PV is NOT intended to be associated with any storage class, do the following:
        #     3.1 The storage class name parameter (CK_CSI_STORAGE_CLASS_NAME) should be set to a pseudo one (e.g., 'manual')
        #     3.2 The PV should be set in the same way (regarding its storage-class parameter) as the PVC
        volumeName: null
        # CUSTOMIZE_ME:
        # The customer's K8S shared storage designated size, to be calculated before installation, following the calculation logic outlined in the formal documentation
        requestedCapacity: 50Gi
      accessMode: ReadWriteMany     # SCA
      requestedCapacity: 10Gi       # SCA
      storageClassName: manual      # SCA
      volumeName: ‘’            # SCA
  ca:
    seed:
      enabled: true
      issuer:
        name: appscan-seed-ca-clusterissuer
        kind: ClusterIssuer
    root:
      secret:
        data:
          # Auto generated root CA certificate
          tlsCrtAsBase64: null
          # Auto generated root CA private key
          tlsKeyAsBase64: null
      certificate:
        name: appscan-root-ca-cert
        duration: 26280h0m0s # 3 years
        renewBefore: 8760h0m0s # 1 year
  ingress:
    controller:
      capabilities:
        # CUSTOMIZE_ME:
        # Indicates whether the Ingress Controller is based on NGINX, or the SSL onload (HTTPS backend protocol) is supported by the ingress controller (not via an annotation, but by the controller itself!), or not
        isHttpsBackendProtocolSupported: true
    internal:
      # CUSTOMIZE_ME:
      # The ingress class name to be used when deploying ingresses into the customer's K8S cluster
      class: nginx
      host:
        # CUSTOMIZE_ME:
        # The (main) domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        #   NOTE: If left empty, it will be taken from the 'global.network.domainSuffix' field
        domain: appscan.com
        # CUSTOMIZE_ME:
        # The sub domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        subDomain: as360
  network:
    # CUSTOMIZE_ME:
    # The customer's designated (main) domain name
    domainSuffix: appscan.com
  configuration:
    disclosed:
      # CUSTOMIZE_ME:
      # AS360 frontend URL (of the UI)
      #   NOTE: The URL must NOT have a trailing '/' at the end of the URL (A valid example: 'https://mydomain.server.com', an invalid example: 'https://mydomain.server.com/')
      siteUrl: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service domain
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. This is a key setting, IFF set, it will override the UI related settings (alongside with all the other LDAP related settings below)
      ldapDomain: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service user name (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapUsername: ''
      # CUSTOMIZE_ME:
      # The customer's list of LDAP groups (comma-separated) that are authorized to access the AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'GroupsAccess' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapAuthorizedGroups: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's LDAP server/service, or not
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Valid values are 'True' or 'False'
      ldapSsl: ''
      # CUSTOMIZE_ME:
      # The customer's designated location of the users in the its AD (Active Directory) for LDAP queries, it is used to authenticate AD users during login to AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      ldapTargetOU: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service host name
      mailSmtpHost: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service port
      mailSmtpPort: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service user name (for establishing connection)
      mailSmtpUserName: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's SMTP mail server/service, or not
      #   NOTE: Valid values are 'True' or 'False'
      mailSmtpEnableSsl: ''
      # CUSTOMIZE_ME:
      # Define your method for onboarding new users:
      #   AutoOnboard: Any user with access to the server can log in to AppScan 360°.
      #   GroupsAccess: Any user in an authorized group (defined below) can log in to AppScan 360°.
      #   ManualOnboard: Users must be invited using the Add Users button on the Access management > Users page.
      externalIDPMode: 'AutoOnboard'
      # CUSTOMIZE_ME:
      # The customer's comma delimited external domains to allow access to, particularly crucial for establishing communication with OpenID Connect (OIDC) servers
      externalDomains: ''
      # CUSTOMIZE_ME:
      # Optional set of parameters, to be used IFF the customer has a dedicated upstream proxy (used to enable Internet access from within the customer's network),
      # holding the customer's upstream proxy settings (for establishing connection), if applicable.
      #   NOTE: Currently there is NO support using a script to configure the upstream proxy settings
      # The customer's upstream proxy host (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyHost: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy port (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyPort: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy username (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyUsername: ''
      # CUSTOMIZE_ME:
      # The customer's designated K8S ASRA namespace to be used for AS360 installation
      #   NOTE: This field is optional, If left empty, a factory default will be used
      k8sAsraNamespace: 'hcl-appscan-asra'
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client ID (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientId: ''
      # CUSTOMIZE_ME:
      # The customer's OIDC authority base URL to use when making OpenIdConnect (OIDC) calls
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcAuthority: ''
    confidential:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      defaultConnection: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service password (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapPassword: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service password (for establishing connection)
      mailSmtpPassword: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy password (for establishing connection), an optional parameter, to be used IFF the customer has a dedicated upstream proxy
      upstreamProxyPassword: ''
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client secret (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientSecret: ''
      #
      # Below entries are not required for ASOP/AS360
      #
      opsConsoleDPKey: ''
      licenseApiKey: ''
      githubClientSecret: ''
common:
  ingress:
    enabled: false
  service:
    enabled: false
  helmHooks:
    rbacBaseName: helm-hooks-rbac

ascp-user-portal-ui:
  enabled: true

ascp-domain-challenger:
  enabled: true

ascp-egress-gatekeeper:
  enabled: true

ascp-mr-tasks-manager:
  enabled: true

ascp-mr-user-api:
  enabled: true

ascp-mr-scanners-api:
  enabled: true

ascp-mr-presence-api:
  enabled: true

ascp-mr-iast-api:
  enabled: true

scaenginefetchcve:
  common:
    # CUSTOMIZE_ME:
    # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
    # If the connection string contains a comma, escape it with a backslash (\,)
    scaservicesecrets:
      ConnectionStrings__ScaAggregationDB: ''

scaenginescanmonitorapi:
  common:
    scaservicesecrets:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      # If the connection string contains a comma, escape it with a backslash (\,).
      ConnectionStrings__ScaEngineDatabase: ''