準備配置檔

• *.crt 或 *.cer 檔案中的公開金鑰
• *.key 檔案中的私密金鑰

1. 在安裝內容檔案 (singular-singular.clusterKit.properties) 中，將憑證指定為 base64-value。
   • 如果是 SSO 鑑別：

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

   • 如果是 LDAP 鑑別：

     CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=<base64-value>
     CK_CUSTOMER_CA_CERTIFICATES_ENABLED='true'

2. 如果您配置的是 SSO，請指定外部網域，以允許 AppScan 360° 連線至您的 Okta 或 Keycloak 租戶。例如：

   CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS='xxxxx.demo.com,XXXXX.abc.com'

1. 使用客戶 CA 憑證設定更新內容檔案 (singular-singular.clusterKit.yaml)。

   #
   # Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
   #
   
   global:
     customer:
       certificate:
         ca:
           # CUSTOMIZE_ME:
           # Indication whether to use customer given CA certificates, or not
           enabled: true
           secret:
               data:
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing LDAPs based service(s)
                   caCrtForLDAPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing SMTPs based service(s) 
                   caCrtForSMTPsAsBase64: ' '
                   # CUSTOMIZE_ME:
                   # The customer's supplied CA certificate used for signing OIDCs based service(s)
                   caCrtForOIDCsAsBase64: ' '

2. 在內容檔案中指定憑證。
   • 將 enabled 設定為 true。
   • 如果是 SSO，請在 caCrtForOIDCsAsBase64 指定憑證。
   • 如果是 LDAP，請在 caCrtForLDAPsAsBase64 指定憑證

1. 將自簽憑證放在憑證資料夾中（視情況選取 SSO 或 LDAP）。
2. 在自訂單一 VM 安裝程序的步驟 8f 中，指定外部網域，以允許 AppScan 360° 連線至您的 SSO 或 LDAP 提供者。

#
## Docker Registry info
#

CK_DOCKER_REGISTRY_ADDRESS='pi-dpr-lin.appscan.com'
CK_DOCKER_REGISTRY_USERNAME='user'
CK_DOCKER_REGISTRY_PASSWORD='password'

#
## Network info
#

CK_CNI_NETWORK_DOMAIN_SUFFIX='appscan.com'

#
## Storage info
#

CK_CSI_STORAGE_CLASS_NAME='longhorn'
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_VOLUME_NAME=''
CK_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY='100Gi'

#
## Ingress info
#

CK_INGRESS_CONTROLLER_CAPABILITIES_IS_HTTPS_BACKEND_PROTOCOL_SUPPORTED='false'
CK_INGRESS_INTERNAL_CLASS='nginx'
CK_INGRESS_INTERNAL_HOST_DOMAIN='appscan.com'
CK_INGRESS_INTERNAL_HOST_SUBDOMAIN='expo.ascp'

#
## Customer certificate info 
#

CK_CUSTOMER_INGRESS_CERTIFICATE_ENABLED='false'
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_CA_CRT_AS_BASE64='   '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_CRT_AS_BASE64='  '
CK_CUSTOMER_INGRESS_CERTIFICATE_SECRET_DATA_TLS_KEY_AS_BASE64='  '

#
## Configuration/Disclosed info
#

CK_CONFIGURATION_DISCLOSED_SITE_URL='https://expo.ascp.appscan.com'
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_HOST=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_PORT=''
CK_CONFIGURATION_DISCLOSED_UPSTREAM_PROXY_USERNAME=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_IDP_MODE='AutoOnboard'
CK_CONFIGURATION_DISCLOSED_LDAP_DOMAIN='appscan.com'
CK_CONFIGURATION_DISCLOSED_LDAP_USERNAME='labmgr'
CK_CONFIGURATION_DISCLOSED_LDAP_AUTHORIZED_GROUPS=''
CK_CONFIGURATION_DISCLOSED_LDAP_SSL='false'
CK_CONFIGURATION_DISCLOSED_LDAP_TARGET_OU='CN=Users,DC=appscan,DC=com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_HOST='wfilsus.israel.ottawa.watchfire.com'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_PORT='25'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_USERNAME='admin@abcd'
CK_CONFIGURATION_DISCLOSED_MAIL_SMTP_ENABLE_SSL='false'

#
## Configuration/Confidential info
#

CK_CONFIGURATION_CONFIDENTIAL_DEFAULT_CONNECTION='Data Source=mssql-service.expo.ascp.appscan.com;Initial Catalog=AppScanCloudDB;User ID=ABC;Password=1234;MultipleActiveResultSets=True;TrustServerCertificate=True'
CK_CONFIGURATION_CONFIDENTIAL_LDAP_PASSWORD='12345678Abcdefg'
CK_CONFIGURATION_CONFIDENTIAL_MAIL_SMTP_PASSWORD='ABC!@#123'
CK_CONFIGURATION_CONFIDENTIAL_UPSTREAM_PROXY_PASSWORD=''


#
## OIDC Configuration and Certificates
#

CK_CONFIGURATION_DISCLOSED_OIDC_CLIENT_ID=''
CK_CONFIGURATION_DISCLOSED_OIDC_AUTHORITY=''
CK_CONFIGURATION_CONFIDENTIAL_OIDC_CLIENT_SECRET=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_OIDCS_AS_BASE64=''
CK_CONFIGURATION_DISCLOSED_EXTERNAL_DOMAINS=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_SMTPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATE_SECRET_DATA_FOR_LDAPS_AS_BASE64=''
CK_CUSTOMER_CA_CERTIFICATES_ENABLED=''

#
## SCA Configuration
#
SCA_CSI_STORAGE_CLASS_NAME=''
SCA_CSI_STORAGE_SHARED_FILE_SYSTEM_REQUESTED_CAPACITY=''
SCA_CSI_STORAGE_ACCESS_MODE=''
SCA_CSI_STORAGE_VOLUME_NAME=''
SCA_CONNECTIONSTRINGSSCAENGINEDATABASE=''
SCA_CONNECTIONSTRINGSSCAAGGREGATIONDB=''

#
## SCA Auto Updater Configuration
#
SCA_AUTOUPDATER_REGISTRY_ADDRESS=''
SCA_AUTOUPDATER_REGISTRY_PATH=''
SCA_AUTOUPDATER_HELM_PATH=''
SCA_AUTOUPDATER_REGISTRY_USERNAME=''
SCA_AUTOUPDATER_REGISTRY_PASSWORD=''

#
## Registry Contexts Customization
# 
CK_DOCKER_REGISTRY_CONTEXT=''
CK_HELM_REPOSITORY_CONTEXT=''
CK_DOCKER_REGISTRY_CONTEXT_4_ADDONS=''
CK_HELM_REPOSITORY_CONTEXT_4_ADDONS=''

#
## Namespace Customization
#
CK_K8S_ASCP_NAMESPACE=''
CK_K8S_ASRA_NAMESPACE=''
NAMESPACE=''

# Default values for ascp-dart-prime.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

#
# Settings that need to be customized by the customer are marked with 'CUSTOMIZE_ME' comments
#
global:
  customer:
    certificate:
       ca:
         # CUSTOMIZE_ME:
         # Indication whether to use customer given CA certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing LDAPs based service(s)
             caCrtForLDAPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing SMTPs based service(s)
             caCrtForSMTPsAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied CA certificate used for signing OIDCs based service(s)
             caCrtForOIDCsAsBase64: ''
       ingress:
         # CUSTOMIZE_ME:
         # Indication whether to use a customer given certificate as the applicable external (out-of-cluster) micro services ingresses certificates, or not
         enabled: false
         secret:
           data:
             # CUSTOMIZE_ME:
             # The customer's supplied certificate authority (CA) signing certificate of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             caCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied public key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsCrtAsBase64: ''
             # CUSTOMIZE_ME:
             # The customer's supplied private key of the certificate used as the applicable external (out-of-cluster) micro services ingresses certificates
             tlsKeyAsBase64: ''
  storage:
    pvc:
      linux:
        enabled: true
        # The customer's K8S storage driver access mode
        #   NOTE: Set on 'ReadWriteMany' and should not be changed
        accessMode: ReadWriteMany
        # CUSTOMIZE_ME:
        # The customer's K8S storage driver class name
        #   NOTE: The CSI driver must support 'ReadWriteMany' access mode
#       storageClassName: freenas-nfs-csi
        storageClassName: longhorn
        # CUSTOMIZE_ME:
        # The customer's K8S predefined PV (Persistent Volume), to be used with the auto-generated PVC (Persistent Volume Claim) for the shared file system
        #   NOTES:
        #   1. This field is optional, if left empty, the designated PV will be generated automatically by the PVC
        #   2. This ability is generally used in case migrating from the Windows VM based version of AppScan 360°, and there is a need to keep the existing (shared) data
        #   3. Note: In case the PV is NOT intended to be associated with any storage class, do the following:
        #     3.1 The storage class name parameter (CK_CSI_STORAGE_CLASS_NAME) should be set to a pseudo one (e.g., 'manual')
        #     3.2 The PV should be set in the same way (regarding its storage-class parameter) as the PVC
        volumeName: null
        # CUSTOMIZE_ME:
        # The customer's K8S shared storage designated size, to be calculated before installation, following the calculation logic outlined in the formal documentation
        requestedCapacity: 50Gi
      accessMode: ReadWriteMany     # SCA
      requestedCapacity: 10Gi       # SCA
      storageClassName: manual      # SCA
      volumeName: ‘’            # SCA
  ca:
    seed:
      enabled: true
      issuer:
        name: appscan-seed-ca-clusterissuer
        kind: ClusterIssuer
    root:
      secret:
        data:
          # Auto generated root CA certificate
          tlsCrtAsBase64: null
          # Auto generated root CA private key
          tlsKeyAsBase64: null
      certificate:
        name: appscan-root-ca-cert
        duration: 26280h0m0s # 3 years
        renewBefore: 8760h0m0s # 1 year
  ingress:
    controller:
      capabilities:
        # CUSTOMIZE_ME:
        # Indicates whether the Ingress Controller is based on NGINX, or the SSL onload (HTTPS backend protocol) is supported by the ingress controller (not via an annotation, but by the controller itself!), or not
        isHttpsBackendProtocolSupported: true
    internal:
      # CUSTOMIZE_ME:
      # The ingress class name to be used when deploying ingresses into the customer's K8S cluster
      class: nginx
      host:
        # CUSTOMIZE_ME:
        # The (main) domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        #   NOTE: If left empty, it will be taken from the 'global.network.domainSuffix' field
        domain: appscan.com
        # CUSTOMIZE_ME:
        # The sub domain to be used when deploying ingresses into the customer's K8S cluster (for building the host name)
        subDomain: as360
  network:
    # CUSTOMIZE_ME:
    # The customer's designated (main) domain name
    domainSuffix: appscan.com
  configuration:
    disclosed:
      # CUSTOMIZE_ME:
      # AS360 frontend URL (of the UI)
      #   NOTE: The URL must NOT have a trailing '/' at the end of the URL (A valid example: 'https://mydomain.server.com', an invalid example: 'https://mydomain.server.com/')
      siteUrl: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service domain
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. This is a key setting, IFF set, it will override the UI related settings (alongside with all the other LDAP related settings below)
      ldapDomain: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service user name (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapUsername: ''
      # CUSTOMIZE_ME:
      # The customer's list of LDAP groups (comma-separated) that are authorized to access the AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'GroupsAccess' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapAuthorizedGroups: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's LDAP server/service, or not
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Valid values are 'True' or 'False'
      ldapSsl: ''
      # CUSTOMIZE_ME:
      # The customer's designated location of the users in the its AD (Active Directory) for LDAP queries, it is used to authenticate AD users during login to AppScan 360°
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      ldapTargetOU: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service host name
      mailSmtpHost: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service port
      mailSmtpPort: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service user name (for establishing connection)
      mailSmtpUserName: ''
      # CUSTOMIZE_ME:
      # Indicates whether to establish a secured (over SSL/TLS) connection towards the customer's SMTP mail server/service, or not
      #   NOTE: Valid values are 'True' or 'False'
      mailSmtpEnableSsl: ''
      # CUSTOMIZE_ME:
      # Define your method for onboarding new users:
      #   AutoOnboard: Any user with access to the server can log in to AppScan 360°.
      #   GroupsAccess: Any user in an authorized group (defined below) can log in to AppScan 360°.
      #   ManualOnboard: Users must be invited using the Add Users button on the Access management > Users page.
      externalIDPMode: 'AutoOnboard'
      # CUSTOMIZE_ME:
      # The customer's comma delimited external domains to allow access to, particularly crucial for establishing communication with OpenID Connect (OIDC) servers
      externalDomains: ''
      # CUSTOMIZE_ME:
      # Optional set of parameters, to be used IFF the customer has a dedicated upstream proxy (used to enable Internet access from within the customer's network),
      # holding the customer's upstream proxy settings (for establishing connection), if applicable.
      #   NOTE: Currently there is NO support using a script to configure the upstream proxy settings
      # The customer's upstream proxy host (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyHost: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy port (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyPort: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy username (an optional parameter, to be used IFF the customer has a dedicated upstream proxy)
      upstreamProxyUsername: ''
      # CUSTOMIZE_ME:
      # The customer's designated K8S ASRA namespace to be used for AS360 installation
      #   NOTE: This field is optional, If left empty, a factory default will be used
      k8sAsraNamespace: 'hcl-appscan-asra'
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client ID (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientId: ''
      # CUSTOMIZE_ME:
      # The customer's OIDC authority base URL to use when making OpenIdConnect (OIDC) calls
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcAuthority: ''
    confidential:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      defaultConnection: ''
      # CUSTOMIZE_ME:
      # The customer's LDAP server/service password (for establishing connection)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. Relevant IFF 'ManualOnboard' is selected for the 'global.configuration.externalIDPMode' parameter
      ldapPassword: ''
      # CUSTOMIZE_ME:
      # The customer's SMTP mail server/service password (for establishing connection)
      mailSmtpPassword: ''
      # CUSTOMIZE_ME:
      # The customer's upstream proxy password (for establishing connection), an optional parameter, to be used IFF the customer has a dedicated upstream proxy
      upstreamProxyPassword: ''
      # CUSTOMIZE_ME:
      # The customer's OpenIdConnect (OIDC) client secret (used to establish a connection with the OIDC server)
      # NOTES:
      #   1. This setting should be configured through the UI, it is exposed here only to allow troubleshooting misconfigured settings that were set through the UI, and caused account lockout
      #   2. Once set, it has precedence over the UI settings
      #   3. IFF set, ALL other OIDC related parameters must be set as well in order to actually override the UI related settings
      oidcClientSecret: ''
      #
      # Below entries are not required for ASOP/AS360
      #
      opsConsoleDPKey: ''
      licenseApiKey: ''
      githubClientSecret: ''
common:
  ingress:
    enabled: false
  service:
    enabled: false
  helmHooks:
    rbacBaseName: helm-hooks-rbac

ascp-user-portal-ui:
  enabled: true

ascp-domain-challenger:
  enabled: true

ascp-egress-gatekeeper:
  enabled: true

ascp-mr-tasks-manager:
  enabled: true

ascp-mr-user-api:
  enabled: true

ascp-mr-scanners-api:
  enabled: true

ascp-mr-presence-api:
  enabled: true

ascp-mr-iast-api:
  enabled: true

scaenginefetchcve:
  common:
    # CUSTOMIZE_ME:
    # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
    # If the connection string contains a comma, escape it with a backslash (\,)
    scaservicesecrets:
      ConnectionStrings__ScaAggregationDB: ''

scaenginescanmonitorapi:
  common:
    scaservicesecrets:
      # CUSTOMIZE_ME:
      # The customer's MSSQL data store (database) connection string (used to established a connection with the database)
      # If the connection string contains a comma, escape it with a backslash (\,).
      ConnectionStrings__ScaEngineDatabase: ''