Skip to content

Fortify Software Security Center

This chart deploys Fortify Software Security Center (SSC) as a Big Bang package. It uses the upstream helm-ssc chart as the upstream subchart and adds Big Bang-owned database, keystore, Istio, network-policy, OpenShift, and package-test integration.

Configuration boundary

The top-level chart values configure the Big Bang additions. The upstream parent is passed to the bundled helm-ssc 26.2.0-1 values; use that versioned upstream reference for SSC settings rather than copying nested upstream values into an umbrella override. The package sets selected upstream overrides for the Iron Bank SSC image, service naming, image pull secrets, and Istio startup behavior.

Big Bang deploys Fortify as the fortify release in the fortify namespace. Enable and configure it through packages.fortify; the legacy addons.fortify path remains supported for compatibility. The umbrella-selected package reference, release ordering, and global value mapping are owned by the Big Bang umbrella chart.

Database and storage

The chart enables its bundled MySQL dependency by default. Plan persistent storage and CPU and memory capacity for both SSC and MySQL before enabling the package; the package values contain the current resource requests and limits.

To use an external MySQL server, disable the bundled dependency and ensure the SSC autoconfiguration points to the same database host and port. Configure the umbrella packages.fortify.externalDatabase.host and .port so Big Bang can create the outbound mesh route when Istio is enabled. Also set explicit CIDRs in bb-common.networkPolicies.egress.definitions.external-mysql.to. The package does not add broad egress access for an external database.

Ingress, mesh, and network security

These umbrella values illustrate the external-MySQL networking inputs. They supplement, but do not replace, your protected SSC autoconfiguration:

packageConfiguration:
  version: v1
packages:
  fortify:
    enabled: true
    externalDatabase:
      host: mysql.example.com
      port: 3306
    values:
      mysql:
        enabled: false
      bb-common:
        networkPolicies:
          enabled: true
          egress:
            definitions:
              external-mysql:
                to:
                  - ipBlock:
                      cidr: 203.0.113.10/32
                ports:
                  - port: 3306
                    protocol: TCP

Replace the documentation host/IP with the actual database DNS name and reviewed destination CIDRs. Match the port in both inputs. Big Bang generates the outbound mesh route when Istio is enabled and selects the external-database egress rule when bundled MySQL is disabled and the CIDR list is nonempty. Direct chart users must configure the route and the source rule themselves. The CIDR list replaces existing entries; preserve every required database address. Registration is not NetworkPolicy permission or TLS/authentication configuration. Supply the full fortify_autoconfig string through your protected workflow with the matching JDBC URL, database credentials, migration settings, and certificate validation; replacing that string is not a partial merge. Disabling bundled MySQL does not migrate its data. Back up and validate the database migration before an upgrade.

Big Bang provides an inbound route for fortify.<domain> through the selected Istio gateway. The package uses the bb-common subchart to render routes, Istio resources, and network policies; configure the istio, routes, and networkPolicies values under the bb-common key according to the deployment’s traffic requirements.

When hardened Istio settings or network policies are enabled, validate access paths for the SSC web application, its database, and any required external services. Do not weaken unrelated admission or network policies to accommodate Fortify. For an external database, retain the explicit egress restriction described above.

Keystore and sensitive configuration

By default, a pre-install/pre-upgrade keystore Job creates or verifies the Secret consumed by SSC for the keystore, autoconfiguration, and license data. The Job requires namespace-scoped Secret permissions while it runs. Keep its hook configuration and the upstream Secret references aligned when changing keystore behavior.

Provide licenses, database credentials, keystore passwords, and SSO material through your approved secret-management process. Do not place them in committed values files or documentation examples. If custom certificates are required, disable the generated keystore only after arranging compatible Secret data and upstream Secret references.

SSO

SSC SAML configuration is an upstream capability. Configure it through the upstream parent and the Fortify SSC documentation. Ensure the identity provider redirect and logout endpoints match the public Fortify URL exposed by Big Bang, and store identity-provider certificates and other sensitive values in Secrets.

Operations

Review the upstream SSC release notes before package upgrades. Upgrades may require application- or database-specific actions outside this chart. The package’s development and maintenance guide describes the chart boundary, upgrade alignment, and integration-test expectations. Branch-testing guidance is available in Test package against Big Bang.

A full SSC deployment and upgrade requires environment-specific validation, including database migration, keystore hooks, ingress, and any configured SSO flow. Do not treat chart rendering as evidence that license activation or application-level migration has succeeded.