准备配置文件

• *.crt 或 *.cer 文件中的公钥
• *.key 文件中的专用密钥

1. 在安装属性文件 (singular-singular.clusterKit.properties) 中，将证书指定为 base64-value。
   • 对于 SSO 认证：

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

   • 对于 LDAP 认证：

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

2. 如果您要配置 SSO，请指定外部域以允许 AppScan 360° 连接到 Okta 或 Keycloak 租户。例如：

   CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS='xxxxx.demo.com,XXXXX.abc.com'

1. 使用客户 CA 证书设置更新属性文件 (singular-singular.clusterKit.yaml)。

   #
   # Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
   #
   
   global:
     customer:
       certificate:
         ca:
           # CUSTOMIZE_ME:
           # Indication whether to use customer given CA certificates, or not
           enabled: true
           secret:
               data:
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing LDAPs based service(s)
                   caCrtForLDAPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing SMTPs based service(s) 
                   caCrtForSMTPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing OIDCs based service(s)
                   caCrtForOIDCsAsBase64: ' '

2. 在属性文件中指定证书。
   • 将 enabled 设置为 true。
   • 对于 SSO，请在 caCrtForOIDCsAsBase64 处指定证书。
   • 对于 LDAP，请在 caCrtForLDAPsAsBase64 处指定证书

1. 将自签名证书放在证书文件夹中（SSO 或 LDAP，视情况而定）。
2. 在定制单个 VM 安装过程的步骤 8f 中，指定外部域以允许 AppScan 360° 连接到您的 SSO 或 LDAP 提供程序。

#
## Docker Registry info
#

CK_DOCKER_REGISTRY_ADDRESS='pi-dpr-lin.appscan.com'
CK_DOCKER_REGISTRY_USERNAME='user'
CK_DOCKER_REGISTRY_PASSWORD='password'

#
## Network info
#

CK_CNI_NETWORK_DOMAIN_SUFFIX='appscan.com'

#
## Storage info
#

CK_CSI_STORAGE_CLASS_NAME='longhorn'
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_VOLUME_NAME=''
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY='100Gi'

#
## Ingress info
#

CK_INGRESS_CONTROLLER_CAPABILITIES_IS_HTTPS_BACKEND_PROTOCOL_SUPPORTED='false'
CK_INGRESS_INTERNAL_CLASS='nginx'
CK_INGRESS_INTERNAL_HOST_DOMAIN='appscan.com'
CK_INGRESS_INTERNAL_HOST_SUBDOMAIN='expo.ascp'

#
## Customer certificate info 
#

CK_CUSTOMER_INGRESS_CERTIFICATE_ENABLED='false'
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_CA_CRT_AS_BASE64='   '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_CRT_AS_BASE64='  '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_KEY_AS_BASE64='  '

#
## Configuration/Disclosed info
#

CK_CONFIGURATION_DISCLOSED_SITE_URL='https://expo.ascp.appscan.com'
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_HOST=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_PORT=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_USERNAME=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_IDP_MODE='AutoOnboard'
CK_CONFIGURATION_DISCLOSED_LDAP_DOMAIN='appscan.com'
CK_CONFIGURATION_DISCLOSED_LDAP_USERNAME='labmgr'
CK_CONFIGURATION_DISCLOSED_LDAP_AUTHORIZED_GROUPS=''
CK_CONFIGURATION_DISCLOSED_LDAP_SSL='false'
CK_CONFIGURATION_DISCLOSED_LDAP_TARGET_OU='CN=Users,DC=appscan,DC=com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_HOST='wfilsus.israel.ottawa.watchfire.com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_PORT='25'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_USERNAME='admin@abcd'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_ENABLE_SSL='false'

#
## Configuration/Confidential info
#

CK_CONFIGURATION_CONFIDENTIAL_DEFAULT_CONNECTION='Data Source=mssql-service.expo.ascp.appscan.com;Initial Catalog=AppScanCloudDB;User ID=ABC;Password=1234;MultipleActiveResultSets=True;TrustServerCertificate=True'
CK_CONFIGURATION_CONFIDENTIAL_LDAP_PASSWORD='12345678Abcdefg'
CK_CONFIGURATION_CONFIDENTIAL_MAIL_SMTP_PASSWORD='ABC!@#123'
CK_CONFIGURATION_CONFIDENTIAL_UPSTREAM_PROXY_PASSWORD=''


#
## OIDC Configuration and Certificates
#

CK_CONFIGURATION_DISCLOSED_OIDC_CLIENT_ID=''
CK_CONFIGURATION_DISCLOSED_OIDC_AUTHORITY=''
CK_CONFIGURATION_CONFIDENTIAL_OIDC_CLIENT_SECRET=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_SMTPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATES_ENABLED=''

#
## SCA Configuration
#
SCA_CSI_STORAGE_CLASS_NAME=''
SCA_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY=''
SCA_CSI_STORAGE_ACCESS_MODE=''
SCA_CSI_STORAGE_VOLUME_NAME=''
SCA_CONNECTIONSTRINGSSCAENGINEDATABASE=''
SCA_CONNECTIONSTRINGSSCAAGGREGATIONDB=''

#
## SCA Auto Updater Configuration
#
SCA_AUTOUPDATER_REGISTRY_ADDRESS=''
SCA_AUTOUPDATER_REGISTRY_PATH=''
SCA_AUTOUPDATER_HELM_PATH=''
SCA_AUTOUPDATER_REGISTRY_USERNAME=''
SCA_AUTOUPDATER_REGISTRY_PASSWORD=''

#
## Registry Contexts Customization
# 
CK_DOCKER_REGISTRY_CONTEXT=''
CK_HELM_REPOSITORY_CONTEXT=''
CK_DOCKER_REGISTRY_CONTEXT_4_ADDONS=''
CK_HELM_REPOSITORY_CONTEXT_4_ADDONS=''

#
## Namespace Customization
#
CK_K8S_ASCP_NAMESPACE=''
CK_K8S_ASRA_NAMESPACE=''
NAMESPACE=''

# Default values for ascp-dart-prime.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

#
# Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
#
global:
  customer:
    certificate:
       ca:
         # CUSTOMIZE_ME:
         # Indication whether to use customer given CA certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing LDAPs based service(s)
             caCrtForLDAPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing SMTPs based service(s)
             caCrtForSMTPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing OIDCs based service(s)
             caCrtForOIDCsAsBase64: ''
       ingress:
         # CUSTOMIZE_ME:
         # Indication whether to use a customer given certificate as the applicable external (out-of-cluster) micro services ingresses certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied certificate authority (CA) signing certificate of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             caCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied public key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied private key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsKeyAsBase64: ''
  storage:
    pvc:
      linux:
        enabled: true
        # The customer's K8S storage driver access mode
        #   NOTE: Set on 'ReadWriteMany' and should not be changed
        accessMode: ReadWriteMany
        # CUSTOMIZE_ME:
        # The customer's K8S storage driver class name
        #   NOTE: The CSI driver must support 'ReadWriteMany' access mode
#       storageClassName: freenas-nfs-csi
        storageClassName: longhorn
        # CUSTOMIZE_ME:
        # The customer's K8S predefined PV (Persistent Volume), to be used with the auto-generated PVC (Persistent Volume Claim) for the shared file system
        #   NOTES:
        #   1. This field is optional, if left empty, the designated PV will be generated automatically by the PVC
        #   2. This ability is generally used in case migrating from the Windows VM based version of AppScan 360°, and there is a need to keep the existing (shared) data
        #   3. Note: In case the PV is NOT intended to be associated with any storage class, do the following:
        #     3.1 The storage class name parameter (CK_CSI_STORAGE_CLASS_NAME) should be set to a pseudo one (e.g., 'manual')
        #     3.2 The PV should be set in the same way (regarding its storage-class parameter) as the PVC
        volumeName: null
        # CUSTOMIZE_ME:
        # The customer's K8S shared storage designated size, to be calculated before installation, following the calculation logic outlined in the formal documentation
        requestedCapacity: 50Gi
      accessMode: ReadWriteMany     # SCA
      requestedCapacity: 10Gi       # SCA
      storageClassName: manual      # SCA
      volumeName: ‘’            # SCA
  ca:
    seed:
      enabled: true
      issuer:
        name: appscan-seed-ca-clusterissuer
        kind: ClusterIssuer
    root:
      secret:
        data:
          # Auto generated root CA certificate
          tlsCrtAsBase64: null
          # Auto generated root CA private key
          tlsKeyAsBase64: null
      certificate:
        name: appscan-root-ca-cert
        duration: 26280h0m0s # 3 years
        renewBefore: 8760h0m0s # 1 year
  ingress:
    controller:
      capabilities:
        # CUSTOMIZE_ME:
        # Indicates whether the Ingress Controller is based on NGINX, or the SSL onload (HTTPS backend protocol) is supported by the ingress controller (not via an annotation, but by the controller itself!), or not
        isHttpsBackendProtocolSupported: true
    internal:
      # CUSTOMIZE_ME:
      # The ingress class name to be used when deploying ingresses into the customer's K8S cluster
      class: nginx
      host:
        # CUSTOMIZE_ME:
        # The (main) domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        #   NOTE: If left empty, it will be taken from the 'global.network.domainSuffix' field
        domain: appscan.com
        # CUSTOMIZE_ME:
        # The sub domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        subDomain: as360
  network:
    # CUSTOMIZE_ME:
    # The customer's designated (main) domain name
    domainSuffix: appscan.com
  configuration:
    disclosed:
      # CUSTOMIZE_ME:
      # AS360 frontend URL (of the UI)
      #   NOTE: The URL must NOT have a trailing '/' at the end of the URL (A valid example: 'https://mydomain.server.com', an invalid example: 'https://mydomain.server.com/')
      siteUrl: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service domain
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. This is a key setting, IFF set, it will override the UI related settings (alongside with all the other LDAP related settings below)
      ldapDomain: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service user name (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapUsername: ''
      # CUSTOMIZE_ME:
      # The customer's list of LDAP groups (comma-separated) that are authorized to access the AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'GroupsAccess' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapAuthorizedGroups: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's LDAP server/service, or not
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Valid values are 'True' or 'False'
      ldapSsl: ''
      # CUSTOMIZE_ME:
      # The customer's designated location of the users in the its AD (Active Directory) for LDAP queries, it is used to authenticate AD users during login to AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      ldapTargetOU: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service host name
      mailSmtpHost: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service port
      mailSmtpPort: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service user name (for establishing connection)
      mailSmtpUserName: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's SMTP mail server/service, or not
      #   NOTE: Valid values are 'True' or 'False'
      mailSmtpEnableSsl: ''
      # CUSTOMIZE_ME:
      # Define your method for onboarding new users:
      #   AutoOnboard: Any user with access to the server can log in to AppScan 360°.
      #   GroupsAccess: Any user in an authorized group (defined below) can log in to AppScan 360°.
      #   ManualOnboard: Users must be invited using the Add Users button on the Access management > Users page.
      externalIDPMode: 'AutoOnboard'
      # CUSTOMIZE_ME:
      # The customer's comma delimited external domains to allow access to, particularly crucial for establishing communication with OpenID Connect (OIDC) servers
      externalDomains: ''
      # CUSTOMIZE_ME:
      # Optional set of parameters, to be used IFF the customer has a dedicated upstream proxy (used to enable Internet access from within the customer's network),
      # holding the customer's upstream proxy settings (for establishing connection), if applicable.
      #   NOTE: Currently there is NO support using a script to configure the upstream proxy settings
      # The customer's upstream proxy host (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyHost: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy port (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyPort: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy username (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyUsername: ''
      # CUSTOMIZE_ME:
      # The customer's designated K8S ASRA namespace to be used for AS360 installation
      #   NOTE: This field is optional, If left empty, a factory default will be used
      k8sAsraNamespace: 'hcl-appscan-asra'
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client ID (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientId: ''
      # CUSTOMIZE_ME:
      # The customer's OIDC authority base URL to use when making OpenIdConnect (OIDC) calls
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcAuthority: ''
    confidential:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      defaultConnection: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service password (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapPassword: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service password (for establishing connection)
      mailSmtpPassword: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy password (for establishing connection), an optional parameter, to be used IFF the customer has a dedicated upstream proxy
      upstreamProxyPassword: ''
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client secret (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientSecret: ''
      #
      # Below entries are not required for ASOP/AS360
      #
      opsConsoleDPKey: ''
      licenseApiKey: ''
      githubClientSecret: ''
common:
  ingress:
    enabled: false
  service:
    enabled: false
  helmHooks:
    rbacBaseName: helm-hooks-rbac

ascp-user-portal-ui:
  enabled: true

ascp-domain-challenger:
  enabled: true

ascp-egress-gatekeeper:
  enabled: true

ascp-mr-tasks-manager:
  enabled: true

ascp-mr-user-api:
  enabled: true

ascp-mr-scanners-api:
  enabled: true

ascp-mr-presence-api:
  enabled: true

ascp-mr-iast-api:
  enabled: true

scaenginefetchcve:
  common:
    # CUSTOMIZE_ME:
    # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
    # If the connection string contains a comma, escape it with a backslash (\,)
    scaservicesecrets:
      ConnectionStrings__ScaAggregationDB: ''

scaenginescanmonitorapi:
  common:
    scaservicesecrets:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      # If the connection string contains a comma, escape it with a backslash (\,).
      ConnectionStrings__ScaEngineDatabase: ''