Install a Java agent with a Kubernetes Helm Chart
Use this workflow to install and configure a Contrast CVE Shield agent in a Kubernetes cluster using a Helm Chart with Contrast Security’s Flex Agent. The Flex Agent lets CVE Shield scan your Java applications. CVE Shield only supports Java applications currently. Check that your application uses Java before you continue.
You'll need an active CVE Shield account. Learn more about signing up for CVE Shield and trying Contrast for free.
Before you begin
Make sure you have everything you need before you start.
The agent will need to be able to reach your Contrast instance. It can be a local/on-premise instance or a hosted instance. A proxy can be configured if the environment has limited network access.
Your web application is packaged in a JAR file.
It must use supported versions, frameworks, and tools
Understand the order of precedence
You will also need access to a command line interface (with a chosen directory for downloading the agent) and your organization's instance of Contrast.
Install an agent
In Northstar, go to Administration > Agent management, and select + Add Agent.
In the Agent Wizard, select Flex Agent via Kubernetes.
Select Helm charts (recommended), then install Helm, if you haven't already.
Note
If you can't install Helm, you can alternatively install the agent using a manifest instead by selecting the Manifest option. See Install Agent Operator with manifest files documentation for details.
Download the Helm Chart configured for you by selecting the Download YAML button.
You can skip this step if the Contrast Agent Operator is already installed in your cluster.
If you need a Helm chart with all possible Helm settings, you can generate a comprehensive YAML file in Northstar. The full YAML file will not come with your
tokenValueinserted. If you decide to work with the full YAML file, ensure you copy yourtokenValueand the values in the Download YAML code block displayed the wizard.Install the Helm Chart by running the commands show in the wizard.
You can skip this step if the Contrast Agent Operator is already installed in your cluster.
Label your namespace by running the command shown in the wizard to tell Kubernetes which namespace should use the agent. Replace
<your_namespace_name>with your own namespace.Find your deployment name by running the command shown in the wizard to see a list of your deployments.
In the list that returns, find the deployment you want to scan and make note of its name for the validation step.
Verify agent deployment
Open your Java application. Click a few links or send a few requests. This gives the agent something to detect.
Select View agent activity. If your application appears, the agent is working.
Your application should appear in Northstar on the Agent management screen soon after you start using it.
When your application appears, CVE Shield starts finding vulnerabilities in that application.