Overview
Learn how to install and configure a CVE Shield agent in a Kubernetes cluster using a Helm chart with Contrast Security's Flex Agent. The Flex Agent lets CVE Shield scan your Java applications. This one time setup should take less than 15 minutes to complete.
Before you begin
You need an active CVE Shield account. Sign in to the Northstar web interface before you start. Don't have a CVE Shield account? Register here: Contrast Security
You need permission to run sudo commands with admin access to your Kubernetes cluster.
You need Helm installed on your computer. You'll use Helm to install the agent operator.
You need a Java application already running in your cluster.
Note: CVE Shield only supports Java applications currently. Check that your application uses Java before you continue. Support for other languages is coming in a future CVE Shield release.
Steps
1. Select an installation method
In Northstar, go to Administration > Agent management, and select + Add Agent in the top right corner of the page.
In the Agent Wizard, select Flex Agent via Kubernetes.
(Insert screenshot: Select an installation method – Flex Agent via Kubernetes)
2. Install Helm
You'll install the agent using a Helm chart. If you have not installed Helm yet, install it now before you continue.
3. Download your configured Helm Chart
You can skip this step if the Contrast Agent Operator is already installed in your cluster.
Northstar fills in your Agent key for you. The Wizard will show it as default.
Below the Agent key field, Northstar shows a values file for the Helm Chart. This file already has your real token filled in. Select Download YAML to save this file locally. You'll use this downloaded file in the next step.
(Insert screenshot: Download and set up the values file)
Note: If you need a Helm Chart with all possible Helm settings, you can generate a YAML file in Northstar. The full YAML file doesn't come with your tokenValue inserted. If you decide to work with the full YAML file, ensure you copy your tokenValue and the Download YAML values in the code block.
4. Install the Helm chart
You can skip this step if the Contrast Agent Operator is already installed in your cluster.
Run the commands in the wizard to install the Helm chart.
5. Label your namespace
Run the command in the wizard to tell Kubernetes which namespace should use the agent. Replace <your_namespace_name> with your own namespace.
6. Find your deployment name
Run the command in the wizard to see a list of your deployments.
In the list that returns, find the deployment you want to scan and make a note of its name. You'll need the deployment name for the next step.
7. Label your deployment
Run the wizard command, replacing <your_deployment_name> with the deployment name from the last step.
(Insert screenshot: Install and deploy Helm chart / Label namespaces / Label deployments)
8. Generate some traffic
Use your application as you normally would. Click a few links or send a few requests. This gives the agent something to detect.
9. Check in Northstar
Select View agent activity. You're taken to Explorer > CVEs. If your application appears, the agent is working.
(Insert screenshot: Interact with your application and check in the Northstar web interface)
Expected Outcome
Your application appears in Northstar on the Agent management screen soon after you start using it. When your application appears, CVE Shield starts finding vulnerabilities in that application.
Related Resources
How to Install an Agent Directly (if you don't run applications in a cluster)
Troubleshooting your first scan (if an agent doesn't report data)
Escalation Path
Free Entry: Post your question in the Gather Community Forum. Include any error messages you saw.
Related to
Comments
0 comments
Please sign in to leave a comment.