How to upgrade the Fortify Package chart📜

BigBang makes modifications to the upstream helm chart. The full list of changes is at the end of this document.

Notes:

This is the Fortify Software Security Center (SSC). You can find additional info on the official Fortify SSC documentation.
List of Fortify SSC Releases
In the context of this document and repo Fortify and Fortify SSC are often used interchangeably.

Find the current and latest release notes from the documentation. Be aware of changes that are included in the upgrade. Take note of any manual upgrade steps that customers might need to perform, if any.
Do diff of upstream chart between old and new release tags to become aware of any significant chart changes. A graphical diff tool such as Meld is useful. You can see where the current helm chart came from by inspecting /chart/kptfile or for an easier way to see the changes skip forward to the KPT instructions.
Create a development branch and merge request from the Gitlab issue.
Merge/Sync the new helm chart with the existing Fortify package code. A graphical diff tool like Meld is useful. Reference the “Modifications made to upstream chart” section below. Be careful not to overwrite Big Bang Package changes that need to be kept. Note that some files will have combinations of changes that you will overwrite and changes that you keep. Stay alert. The hardest file to update is the /chart/values.yaml because the changes are many and complicated.
1. An easy way to do this is with KPT
```
kpt pkg update chart --strategy force-delete-replace
```
2. Then to reduce the number of changes you have to work through run the following:
```
git checkout chart/templates/bigbang/
git checkout chart/tests/
git checkout chart/templates/tests/
git checkout chart/charts/
git checkout chart/Chart.lock
git checkout chart/requirements.yaml
git checkout chart/templates/script-configmap.yaml
git checkout chart/templates/secrets.yaml
git checkout chart/templates/tomcat-configmap.yaml
```
In /chart/requirements.yaml update the gluon library to the latest version.
Run a helm dependency command to update the chart/charts/*.tgz archives and create a new requirements.lock file. You will commit the tar archives along with the requirements.lock that was generated.
```
helm dependency update ./chart
```
In /chart/values.yaml update image.tag to the new version. Renovate might have arleady done this for you.
Update /CHANGELOG.md with an entry for “upgrade Fortify to app version X.X.X chart version X.X.X-bb.X”. Or, whatever description is appropriate.
Update the /README.md following the gluon library script

Update /chart/Chart.yaml to the appropriate versions. The annotation version should match the appVersion.

version: X.X.X-bb.X
appVersion: X.X.X.X
annotations:
  bigbang.dev/applicationVersions: |
    - Fortify: 23.1.2.0005

Update /chart/Chart.yaml annotations."helm.sh/images" section to fix references to updated packages (if needed)
Use a development environment to deploy and test Fortify. See more detailed testing instructions below. Also test an upgrade by deploying the old version first and then deploying the new version.
When the Package pipeline runs expect the cypress tests to fail due to UI changes.
Update the /README.md again if you have made any additional changes during the upgrade/testing process.

Testing a new Fortify version📜

Create a k8s dev environment. One option is to use the Big Bang k3d-dev.sh with no arguments which will give you the default configuration. The following steps assume you are using the script.
Follow the instructions at the end of the script to connect to the k8s cluster and install flux.

Deploy Fortify with these dev values overrides. Core apps are disabled for quick deployment.

addons:
  fortify:
    enabled: true
    sourceType: "git"
    git:
      repo: "https://repo1.dso.mil/big-bang/product/packages/fortify.git"
      path: "chart"
      tag: null
      branch: "replace-me-with-your-branch-name"
values:
  trust_store_password: dsoppassword
  key_store_password: dsoppassword
  key_store_cert_password : dsoppassword
  fortify_autoconfig: |
    # Need a license to use autoconfig
  fortify_license: |
    <License>

Access Fortify UI from a browser (whatever you put in your hosts file) and login with admin admin
You should get asked for a license which we don’t have.

Modifications made to upstream chart📜

This is a high-level list of modifications that Big Bang has made to the upstream helm chart. You can use this as as cross-check to make sure that no modifications were lost during the upgrade process.

chart/charts/*.tgz📜

run helm dependency update ./chart and commit the downloaded archives
commit the tar archives that were downloaded from the helm dependency update command. And also commit the requirements.lock that was generated.

chart/templates/bigbang/*📜

add istio virtual service
add networkpolicies
add istio peerauthentications

chart/templates/tests/*📜

add templates for CI helm tests

chart/templates/*.yaml📜

add script-configmap.yaml
add secrets.yaml
add tomcat-configuration.yaml
modify tomcat-configuration.yaml
Allow setting Tomcat server min/max threads within server configuration configmap
modify webapp.yaml
set spec.template.spec.containers[“webapp”].readinessProbe.initialDelaySeconds to 30
set spec.template.spec.containers[“webapp”].readinessProbe.periodSeconds to 20
set spec.template.spec.containers[“webapp”].readinessProbe.httpGet.path to /images/favicon.ico
set spec.template.spec.containers[“webapp”].readinessProbe.httpGet.port http-web
set spec.template.spec.containers[“webapp”].readinessProbe.httpGet.scheme HTTP
set spec.template.spec.containers[“webapp”].readinessProbe.httpGet.httpHeaders[“Host”].value to {{ include "ssc.fullcomponentname" (merge (dict "component" "service") . ) }}
set spec.template.spec.containers[“webapp”].volumeMounts[“secrets-volume”].name to shared

add spec.template.spec.initContainers

initContainers:
  - name: keystore-gen
    image: "{{ .Values.initContainer.keystoreImage }}:{{ .Values.initContainer.keystoreTag }}"
    imagePullPolicy: IfNotPresent
    command:
    - /bin/sh
    args:
    - /script/gen.sh
    volumeMounts:
    - name: keystore-script
      mountPath: /script
    - name: shared
      mountPath /shared
    - name: secrets-volume
      mountPath: /secrets
    resources:
      {{- toYaml .Values.initContainer.resources | nindent 12 }}

modify spec.template.spec.volumes[“secrets-volume”]

- name: secrets-volume
      secret:
        {{- if not .Values.databaseSecret.use secret }}
        secretName: {{ include "ssc.fullcomponentname" (merge (dict "component" "secret") . ) }}
        {{- else }}
        secretName: {{ required "The secretRef.name config value is required!" .Values.secretRef.name }}
        {{- end }}

remove spec.template.spec.volumes[“etc-volume”].medium
add spec.template.spec.volumes[“shared”]
```
- name: shared
  emptydir: {}
```

add spec.template.spec.volumes[“keystore-script”]

- name: keystore-script
  configMap:
    name: {{ include "ssc.fullcomponentname" (merge (dict "component" "keystore-script") . ) }}

add spec.template.spec.volumes[“tomcat-template”]

- name: tomcat-template
  configMap:
    name: {{ include "ssc.fullcomponentname" (merge (dict "component" "tomcat-template") . ) }}

chart/tests/*📜

add helm test scripts for CI pipeline

chart/.helmignore📜

add *.orig

chart/Chart.yaml📜

switch the api version to v2
update the name to fortify-ssc
change version key to Big Bang composite version
add Big Bang annotations.bigbang.dev/applicationVersions and annotations.helm.sh/images keys to support release automation

add the following

type: application
keywords:
- fortify
- ssc
- sast
home: https://www.microfocus.com/en-us/solutions/application-security
icon: https://avatars.githubusercontent.com/u/28990234?s=200&v=4
sources:
- https://github.com/fortify/helm3-charts
engine: gotpl

add the dependencies that are needed

chart/kpt.yaml📜

add this to manage kpt

chart/requirements.yaml📜

add this to manage needed charts

chart/values.yaml📜

update the image.repositoryPrefix to ironbank
comment out image.buildNumber
change image.webapp to “ssc”
add the desired image.tag
add an array element to imagePullSecrets with the name set to “private-registry”
set nameOverride to “fortify-ssc”
set fullnameOverride to “fortify-ssc”
set urlHost to “fortify.bigbang.dev”
set secretRef.keys.sscLicenseEntry to “fortify.license”
set secretRef.keys.sscAutoconfigEntry to “fortify.autoconfig”
set secretRef.keys.httpCertificateKeystoreFileEntry to “ssc-service.jks”
set secretRef.keys.httpCertificateKeystorePasswordEntry to “ssc-service.jks.password”
set secretRef.keys.httpCertificateKeyPasswordEntry to “ssc-service.jks.key.password”
set jvmExtraOptions to “-Dcom.redhat.fips=false”

set the resources like this

# Recommended resources can be found here - https://www.microfocus.com/documentation/fortify-ScanCentral-DAST/2120/Fortify_Sys_Reqs_21.2.0.pdf
# Check page 33 and 41 for recommended resources depending on the type of scan (DAST vs SSC)
resources:
  limits:
    cpu: 4
    memory: 16Gi
  requests:
    cpu: 1
    memory: 1Gi

allow overriding mix and max threads allowed by ssc server with:

ssc:
  config:
    http:
      min_threads: 1
      max_threads: 4
    https:
      min_threads: 4
      max_threads: 150

add this to the bottom

# MySQL Dependency Values
mysql:
  enabled: true
  global:
    imageRegistry: "registry1.dso.mil/ironbank"
    imagePullSecrets:
      - private-registry
  image:
    repository: bitnami/mysql8
    tag: 8.0.34-debian-11-r2
  auth:
    rootPassword: "password"
    database: "ssc_db"
  primary:
    configuration: |-
      [mysqld]
      default_authentication_plugin=mysql_native_password
      skip-name-resolve
      explicit_defaults_for_timestamp
      basedir=/opt/bitnami/mysql
      plugin_dir=/opt/bitnami/mysql/lib/plugin
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      datadir=/bitnami/mysql/data
      tmpdir=/opt/bitnami/mysql/tmp
      bind-address=0.0.0.0
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
      log-error=/opt/bitnami/mysql/logs/mysqld.log
      character-set-server=latin1
      collation-server=latin1_general_cs
      slow_query_log=0
      slow_query_log_file=/opt/bitnami/mysql/logs/mysqld.log
      long_query_time=10.0
      default_storage_engine=INNODB
      innodb_buffer_pool_size=512M
      innodb_lock_wait_timeout=300
      innodb_log_file_size=512M
      max_allowed_packet=1G
      sql-mode="TRADITIONAL"

      [mysqldump]
      max_allowed_packet=1G

      [client]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      default-character-set=UTF8
      plugin_dir=/opt/bitnami/mysql/lib/plugin

      [manager]
      port=3306
      socket=/opt/bitnami/mysql/tmp/mysql.sock
      pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
    # resources for MySQL, recommended resources can be found here - https://www.microfocus.com/documentation/fortify-ScanCentral-DAST/2120/Fortify_Sys_Reqs_21.2.0.pdf
    # Page 22 for MySQL
    resources:
      limits:
        cpu: 8
        memory: 64Gi
      requests:
        cpu: 1
        memory: 500Mi
  secondary:
    # Page 22 for MySQL
    resources:
      limits:
        cpu: 8
        memory: 64Gi
      requests:
        cpu: 1
        memory: 500Mi
  metrics:
    # pulled from the chart example with some higher limits
    resources:
      limits:
        cpu: 2
        memory: 1Gi
      requests:
        cpu: 100m
        memory: 256Mi


# Big Bang Additions
domain: bigbang.dev
istio:
  enabled: false
  mtls:
    # -- STRICT = Allow only mutual TLS traffic,
    # PERMISSIVE = Allow both plain text and mutual TLS traffic
    mode: STRICT
  fortify:
    gateways:
    - "istio-system/public"
    hosts:
    - "fortify.{{ .Values.domain }}"
  injection: disabled

initContainer:
  keystoreImage: registry1.dso.mil/ironbank/google/golang/golang-1.20
  keystoreTag: 1.20.8
  resources:
    limits:
      cpu: 500m
      memory: 128Mi
    requests:
      cpu: 250m
      memory: 64Mi

networkPolicies:
  enabled: false
  egress: []
  egressDns: []
  ingress: []

# cache layer configurations
# if this feature enabled, Fortify will cache the resource
# `project/project_metadata/repository/artifact/manifest` in the redis
# which help to improve the performance of high concurrent pulling manifest.
cache:
  # default is not enabled.
  enabled: false
  # default keep cache for one day.
  expireHours: 24

databaseSecret:
  use_secret: false
  name: db-credentials-mysql
  useRoot: false # Use root credentials to create database if required

# Please read the docs to create java keystore and convert it into base64
fortify_java_keystore:
  use: false
  keystore: "ZHVtbXkK" # base64 of keystore

default_cert_alias: tomcat

fortifySecret:
  use_secret: false
  name: fortify-secret
  # Secret contains following values:
  # certificate-key-password
  # certificate-keystore-password
  # scc.autoconfig
  # fortify.license
  # Note: certificate-keystore is generated by init container

bbtests:
  enabled: false
  cypress:
    artifacts: true
    envs:
      cypress_url: "http://fortify-ssc-service:80"
      cypress_token: "change_me"
  scripts:
    image: "registry1.dso.mil/bigbang-ci/gitlab-tester:0.0.4"
    envs: {}


trust_store_password: dsoppassword
key_store_password: dsoppassword
key_store_cert_password : dsoppassword
fortify_autoconfig: |
    appProperties:
      host.validation: false

    datasourceProperties:
      db.username: root
      db.password: password

      jdbc.url: 'jdbc:mysql://fortify-mysql:3306/ssc_db?sessionVariables=collation_connection=latin1_general_cs&rewriteBatchedStatements=true'

    dbMigrationProperties:

      migration.enabled: true
      migration.username: root
      migration.password: password
fortify_license: |
  <License>

Last update: 2023-10-30 by Andrew Shoell