Xray HA OpenShift Installation

Add the charts.jfrog.io to your Helm client.

helm repo add jfrog https://charts.jfrog.io

Update the repository.

helm repo update

Next, create a unique master key. JFrog Xray requires a unique master key to be used by all micro-services in the same cluster. By default the chart has one set in values.yaml (xray.masterKey).

Generate a unique key and pass it to the template during installation/upgrade.

# Create a key
export MASTER_KEY=$(openssl rand -hex 32)
echo ${MASTER_KEY}

You can pass this master key to the Helm installation through the Helm command or through the values.yaml file.

The following example shows the values.yaml file with the master key.

xray:
  masterKey: <master key value>

Alternatively, you can create a secret containing the master key manually and pass it to the template during installation/upgrade.

 # Create a secret containing the key. The key in the secret must be named master-key
oc create secret generic masterkey-secret --from-literal=master-key=${MASTER_KEY}

You can pass this master key secret to the Helm installation through the Helm command (by passing masterkey-secret)or through the values.yaml file.

The following example shows the values.yaml file with the master key secret.

xray:
  masterKeySecretName: masterkey-secret

Installation requires a join key.

You can pass the join key along with the Helm install/upgrade command or pass it in a values.yaml file.

The following sample shows how to provide join key in the values.yaml file.

xray:
  joinKey: <join key value>

Alternatively, you can manually create a secret containing the join key and then pass it to the template during install/upgrade. The key must be named join-key.

oc create secret generic joinkey-secret --from-literal=join-key=<YOUR_PREVIOUSLY_RETRIEVED_JOIN_KEY>

The following example shows the values.yaml file with the join key secret.

xray:
  joinKeySecretName: joinkey-secret

You need to enter the JFrog URL.

You can either pass the JFrog URL along with the Helm install/upgrade command or pass it along with the values.yaml file.

The following example shows the values.yaml file with the JFrog URL.

xray:
  jfrogUrl: <JFrog URL>

For an HA Xray installation, set the replicaCount value as >1 (the recommended is 3).

You can either pass the value along with the Helm install/upgrade command or pass it along with the values.yaml file.

The following example shows the values.yaml file with the replicaCount values.

replicaCount: 3

When you deploy Xray helm chart on an OpenShift cluster, you need to disable the podSecurityContext and containerSecurityContext. Default OpenShift functionality automatically assigns and arbitrary UID block associated with the project.

Set the following values in the values.yaml so that you can pass it along with the installation.

containerSecurityContext:
  enabled: false
podSecurityContext:
  enabled: false

rbac:
  create: true
serviceAccount:
  create: true

rabbitmq:
  rbac:
    create: true
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false

To make PostgreSQL work on OpenShift, disable the securityContext in the pod and container level in the values.yaml file, and set the following values.

  postgresql:
    postgresqlPassword: password
    securityContext:
      enabled: false
    containerSecurityContext:
      enabled: false
    serviceAccount:
      enabled: true

Create a values.yaml file with all the required configuration if you want to proceed with an installation that holds all the configurations in a values.yaml file.

You can also use separate configuration files for each configuration and pass them as separate yaml files.

The following sample shows an example values.yaml file with join key and JFrog URL.

replicaCount: 3
xray:
  jfrogUrl: http://artifactory.rt:8082
  joinKey: joinkey-secret
  masterKey: masterkey-secret

containerSecurityContext:
  enabled: false
podSecurityContext:
  enabled: false

rbac:
  create: true
serviceAccount:
  create: true

rabbitmq:
  rbac:
    create: true
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  replicaCount: 1
postgresql:
  postgresqlPassword: password
  securityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  serviceAccount:
    enabled: true

The following sample shows an example values.yaml file with join key as a secret and JFrog URL.

replicaCount: 3
xray:
  jfrogUrl: http://artifactory.rt:8082
  joinKeySecretName: joinkey-secret
  masterKeySecretName: masterkey-secret

containerSecurityContext:
  enabled: false
podSecurityContext:
  enabled: false

rbac:
  create: true
serviceAccount:
  create: true

rabbitmq:
  rbac:
    create: true
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  replicaCount: 1
postgresql:
  postgresqlPassword: password
  securityContext:
    enabled: false
  containerSecurityContext:
    enabled: false
  serviceAccount:
    enabled: true

Run the Helm install command to proceed with the installation.

The following command shows how you can pass the required values through a values.yaml file.

helm upgrade --install xray --namespace xray -f values.yaml

To access the logs, find the name of the pod using the following command.

oc --namespace <your namespace> get pods

To get the container logs, run the following command.

oc --namespace <your namespace> logs -f <name of the pod>

Customize the product configuration.

Access Xray from your browser at: http://<jfrogUrl>/ui/ and go to Xray Security & Compliance tab in the Administration module in the UI

Check the status of your deployed helm releases.

helm status xray