### Install Black Duck Helm Chart Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Install the Black Duck Helm chart using the specified values files. Avoid using the `--wait` flag during installation. ```bash $ BD_NAME="bd" && BD_SIZE="sizes-gen05/120sph" && BD_INSTALL_DIR="/blackduck/" $ helm install ${BD_NAME} ${BD_INSTALL_DIR} --namespace ${BD_NAME} -f ${BD_INSTALL_DIR}/values.yaml -f ${BD_INSTALL_DIR}/${BD_SIZE}.yaml ``` -------------------------------- ### Install PostgreSQL Client (YUM) Source: https://github.com/blackducksoftware/hub/wiki/_Initializing-an-External-Database Use this command on YUM-based systems to install the PostgreSQL client, which is necessary for interacting with the external database. ```bash yum install -y postgresql_ ``` -------------------------------- ### Example Service Output Source: https://github.com/blackducksoftware/hub/wiki/_Exposing-Black-Duck-Services This is an example of the HTML output you might receive when successfully curling an exposed Black Duck service. ```html ``` -------------------------------- ### Storage Provider Configuration Example Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md This YAML structure defines a storage provider. Configure parameters like name, enablement, type, and persistence settings. Use 'preference' to set the default provider when multiple are configured. ```yaml storage: providers: - name: enabled: index: type: preference: existingPersistentVolumeClaimName: pvc: size: storageClass: existingPersistentVolumeName: mountPath: ``` -------------------------------- ### Get Minikube/Minishift IP Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI Use these commands to get the IP address valid on your local machine when running minikube or minishift. ```bash minikube ip ``` ```bash minishift ip ``` -------------------------------- ### Get OpenShift Routes Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI Use this command on OpenShift to find the HOST/PORT for the Black Duck Web UI. ```bash oc get routes -n ``` -------------------------------- ### Get Black Duck Services Source: https://github.com/blackducksoftware/hub/wiki/_Exposing-Black-Duck-Services Use this command to list all services running in the blackduck namespace. This helps in identifying the service URLs. ```bash kubectl get services -o wide -n blackduck ``` -------------------------------- ### Add Black Duck Helm Repository Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Adds the Black Duck Helm repository to your local Helm configuration. This is a prerequisite for installing the chart. ```bash $ helm repo add blackduck https://repo.blackduck.com/artifactory/cloudnative ``` -------------------------------- ### Kubernetes Ingress Resource Configuration Source: https://github.com/blackducksoftware/hub/wiki/_Configuring-an-Ingress-Controller Configure proxy body size, buffer size, and secure backends for TLS traffic. This example demonstrates annotations for Nginx Ingress Controller. ```yaml kind: Ingress metadata: namespace: myhub annotations: nginx.ingress.kubernetes.io/proxy-body-size: 1024m    nginx.ingress.kubernetes.io/proxy-buffer-size: 8k     nginx.ingress.kubernetes.io/secure-backends: "true" # enable TLS spec: rules: - http: paths: - backends: serviceName: ingress-j2oij20j09j servicePort: 8443 ``` -------------------------------- ### Custom Image Registry Format Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters When using a custom registry, format image tags as '//:'. This example shows changing the default Docker Hub image to a Red Hat registry. ```text blackducksoftware/blackduck-cfssl:1.0.0 ``` ```text registry.connect.redhat.com/blackducksoftware/blackduck-cfssl:1.0.0 ``` -------------------------------- ### Configure Kubelet with Custom Resolv.conf Source: https://github.com/blackducksoftware/hub/wiki/Tainting-Nodes-to-Fix-Infrastructure-Issues Modify kubelet startup flags to inject a custom resolv.conf file. This allows for fine-grained control over DNS resolution within pods, such as removing wildcard DNS entries that can cause split-brain issues. ```bash KUBELET_ARGS="--pod-manifest-path=/etc/kubernetes/manifests --cadvisor-port=0 --pod-infra-container-image=gcr.io/google_containers/pause-amd64:3.0 --node-status-update-frequency=10s --docker-disable-shared-pid=True --client-ca-file=/etc/kubernetes/ssl/ca.pem --tls-cert-file=/etc/kubernetes/ssl/node-k8s-master-1.pem --tls-private-key-file=/etc/kubernetes/ssl/node-k8s-master-1-key.pem --anonymous-auth=false --read-only-port=10255 --cgroup-driver=cgroupfs --cgroups-per-qos=True --fail-swap-on=True --enforce-node-allocatable="" --cluster-dns=10.233.0.3 --cluster-domain=kubernetes.tdlab --resolv-conf=/etc/resolv.conf ``` -------------------------------- ### Run PostgreSQL Initialization Script Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Execute the modified PostgreSQL initialization script using 'psql' to create users, databases, and other necessary structures. Ensure you replace and with your actual PostgreSQL connection details. ```bash psql -U blackduck -h -p -f external_postgres_init.pgsql postgres ``` -------------------------------- ### Deploy Black Duck with Resource Allocation Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Deploy the Black Duck stack using a base compose file and a specific resource allocation file. This command may require root privileges or sudo. The `--with-registry-auth` flag might be necessary if using a private image repository. ```bash docker stack deploy -c docker-compose.yml -c sizes-gen05/120sph.yaml hub ``` -------------------------------- ### Deploy Black Duck with Binary Analysis Enabled Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Deploy the Black Duck stack with binary analysis capabilities enabled. This command may require root privileges or sudo. The `--with-registry-auth` flag might be necessary if using a private image repository. ```bash docker stack deploy --compose-file docker-compose.yml -c docker-compose.bdba.yml hub ``` -------------------------------- ### Enabling a Proxy (JSON) Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters Configure environment variables for proxy settings in a JSON file to enable Black Duck to connect to external services. ```json "environs": [ "HUB_PROXY_SCHEME:https", "HUB_PROXY_HOST:proxy.my.company", "HUB_PROXY_PORT:8080" ], ``` -------------------------------- ### Get Pod IP Address (Internal) Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI If the cluster is not externally exposed, use this command to get the IP address accessible within the cluster network. The IP will be in the 'Node' value of the describe pod output. ```bash kubectl describe pod <> -n <> ``` -------------------------------- ### Deploy Docker Stack for Database Migration Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Use this command to deploy a subset of Black Duck Docker containers specifically for the database migration process. Ensure the operation completes before proceeding. ```bash docker stack deploy -c docker-compose.dbmigrate.yml hub ``` -------------------------------- ### Get External Node IP Addresses Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI Obtain the external IP addresses of cluster nodes when not running minikube/minishift on Kubernetes. ```bash kubectl get nodes -o jsonpath=‘{ $.items[*].status.addresses[?(@.type==“ExternalIP”)].address }’ ``` -------------------------------- ### Get Kubernetes NodePort Service Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI Extract the node port number for the Black Duck web server service on Kubernetes. ```bash kubectl get -o jsonpath=“{.spec.ports[0].nodePort}” services webserver-np -n ``` -------------------------------- ### Delete Black Duck Manifest Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Delete the Black Duck deployment if it was initially installed using `kubectl apply` from a dry-run manifest. ```bash kubectl delete -f ${BD_NAME}.yaml ``` -------------------------------- ### Configure External PostgreSQL for Black Duck (Docker Swarm) Source: https://context7.com/blackducksoftware/hub/llms.txt Initializes an external PostgreSQL database and deploys Black Duck using Docker Swarm with external database support. Ensure you substitute placeholder values and create Docker secrets for passwords. ```bash # 1. Substitute placeholder values in the init script export POSTGRESQL_USER=blackduck export HUB_POSTGRES_USER=blackduck_user export BLACKDUCK_USER_PASSWORD=SecurePass123 sed \ -e "s|POSTGRESQL_USER|${POSTGRESQL_USER}|g" \ -e "s|HUB_POSTGRES_USER|${HUB_POSTGRES_USER}|g" \ -e "s|BLACKDUCK_USER_PASSWORD|${BLACKDUCK_USER_PASSWORD}|g" \ docker-swarm/external-postgres-init.pgsql > /tmp/pg-init.pgsql # 2. Run the init script against the external PostgreSQL instance psql -U blackduck -h pg.my-company.com -p 5432 \ -f /tmp/pg-init.pgsql postgres # 3. Configure connection details in hub-postgres.env # HUB_POSTGRES_HOST=pg.my-company.com # HUB_POSTGRES_PORT=5432 # 4. Create Docker secrets for the passwords docker secret create hub_HUB_POSTGRES_USER_PASSWORD_FILE ./pg_user_pass.txt docker secret create hub_HUB_POSTGRES_ADMIN_PASSWORD_FILE ./pg_admin_pass.txt # 5. Deploy using the external-db compose file docker stack deploy \ -c docker-swarm/docker-compose.externaldb.yml \ -c docker-swarm/sizes-gen05/120sph.yaml \ hub ``` -------------------------------- ### Display Help for blackduck-images.sh Source: https://github.com/blackducksoftware/hub/wiki/_Pushing-Black-Duck-Images-to-a-Secure-Registry Run the --help option on the blackduck-images.sh script to see which Black Duck container versions will be pulled and pushed. ```bash ./blackduck-images.sh --help ``` -------------------------------- ### Get OpenShift Routes Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Use this command to retrieve the OpenShift routes for the Black Duck application when using the OpenShift service type. ```bash $ oc get routes ${BD_NAME}-blackduck -n ${BD_NAME} ``` -------------------------------- ### Modify PostgreSQL Initialization Script Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Use 'sed' to replace placeholders in the 'external-postgres-init.pgsql' script with the previously defined environment variables. The output is redirected back to the same file. ```bash sed 's|POSTGRESQL_USER|'$POSTGRESQL_USER'|g; s|HUB_POSTGRES_USER|'$HUB_POSTGRES_USER'|g; s|BLACKDUCK_USER_PASSWORD|'$BLACKDUCK_USER_PASSWORD'|g' external-postgres-init.pgsql > external-postgres-init.pgsql ``` -------------------------------- ### Set Password for blackduck_user Source: https://github.com/blackducksoftware/hub/wiki/_Initializing-an-External-Database After initializing the database, use pgAdmin to set the password for the `blackduck_user` within the `blackduck` database. This is a crucial step for authentication. ```sql From the pdAdmin tool open the blackduck database, expand Login/Group Roles, right click on the blackduck_user and select 'Properties' >> Select the 'Definition' tab and enter a PASSWORD for blackduck_user ``` -------------------------------- ### Disabling IPv6 (JSON) Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters Set environment variables to disable IPv6 and specify the server address in a JSON file. This is required for installations in IPv6-disabled clusters. ```json "environs": [ "IPV4_ONLY:1", "BLACKDUCK_HUB_SERVER_ADDRESS:0.0.0.0" ], ``` -------------------------------- ### Get Kubernetes Load Balancer Service Source: https://github.com/blackducksoftware/hub/wiki/_Viewing-the-Black-Duck-Web-UI Retrieve the external IP address for the Black Duck web server when using a load balancer on Kubernetes. ```bash kubectl get service webserver-lb -n ``` -------------------------------- ### Apply Kubernetes Ingress Source: https://context7.com/blackducksoftware/hub/llms.txt Apply the Ingress configuration to the Black Duck namespace. ```bash kubectl apply -f ingress.yaml -n blackduck ``` -------------------------------- ### Get LoadBalancer IP Address Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Use this command to retrieve the external IP address of the Black Duck web server when using a LoadBalancer service type. ```bash $ kubectl get services ${BD_NAME}-blackduck-webserver-exposed -n ${BD_NAME} ``` -------------------------------- ### Get Kubernetes Secrets Source: https://github.com/blackducksoftware/hub/wiki/_Common-Configuration-Tasks-v1 Use this command to list all secrets within a specific Black Duck namespace. Note that this command displays secret names but not their values. ```bash kubectl get secrets -n ``` -------------------------------- ### Deploy Binary Analysis with External PostgreSQL Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Deploy the Black Duck stack with binary analysis enabled, utilizing an external PostgreSQL instance. This command assumes the external PostgreSQL instance is already configured. ```bash docker stack deploy --compose-file docker-compose.externaldb.yml -c docker-compose.bdba.yml hub ``` -------------------------------- ### Get Storage Class Names with kubectl Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters Use this command to list available storage class names in your Kubernetes cluster. This is useful for configuring the 'pvcStorageClass' parameter. ```bash kubectl get storageclass ``` -------------------------------- ### Enable Source Code Upload with Helm Source: https://context7.com/blackducksoftware/hub/llms.txt Use this Helm command to upgrade a Black Duck deployment, enabling source code uploads and setting data retention policies. Ensure the correct namespace is specified. ```bash helm upgrade bd blackduck/blackduck \ --namespace blackduck \ --set enableSourceCodeUpload=true \ --set dataRetentionInDays=180 \ --set maxTotalSourceSizeinMB=4000 ``` -------------------------------- ### Configure Black Duck Databases and Users in Postgres Source: https://github.com/blackducksoftware/hub/wiki/_Installing-Black-Duck-in-Clusters-not-Running-the-Operator Execute these SQL commands within your Postgres database to set up the necessary databases, users, schemas, and permissions for Black Duck. ```sql CREATE DATABASE bds_hub owner blackduck ; CREATE DATABASE bds_hub_report owner blackduck; CREATE DATABASE bdio owner blackduck; CREATE USER blackduck_user; CREATE USER blackduck_reporter; \c bds_hub CREATE EXTENSION pgcrypto; CREATE SCHEMA st AUTHORIZATION blackduck; GRANT USAGE ON SCHEMA st TO blackduck_user ; GRANT SELECT, INSERT, UPDATE, TRUNCATE, DELETE, REFERENCES ON ALL TABLES IN SCHEMA st TO blackduck_user; GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA st to blackduck_user; ALTER DEFAULT PRIVILEGES IN SCHEMA st GRANT SELECT, INSERT, UPDATE, TRUNCATE, DELETE, REFERENCES ON TABLES TO blackduck_user; ALTER DEFAULT PRIVILEGES IN SCHEMA st GRANT ALL PRIVILEGES ON SEQUENCES TO blackduck_user; \c bds_hub_report GRANT SELECT ON ALL TABLES IN SCHEMA public TO blackduck_reporter; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO blackduck_reporter; GRANT SELECT, INSERT, UPDATE, TRUNCATE, DELETE, REFERENCES ON ALL TABLES IN SCHEMA public TO blackduck_user; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, TRUNCATE, DELETE, REFERENCES ON TABLES TO blackduck_user; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO blackduck_user; \c bdio GRANT ALL PRIVILEGES ON DATABASE bdio TO blackduck_user; ``` -------------------------------- ### Set up Certificate Authentication via Custom CA Source: https://context7.com/blackducksoftware/hub/llms.txt Create a Docker secret for your custom CA certificate and mount it as AUTH_CUSTOM_CA to enable JWT token acquisition using client certificates signed by that CA. ```bash # Create the Docker secret docker secret create hub_AUTH_CUSTOM_CA ./my-ca.crt ``` -------------------------------- ### Get PostgreSQL Service Information Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Reporting-Database Retrieve details about the internal and external IP addresses of the PostgreSQL service. This information is crucial for connecting to the database, especially if your client is outside the Kubernetes cluster. ```bash kubectl get service postgres -o wide ``` -------------------------------- ### Migrate Database to PostgreSQL (Docker Swarm) Source: https://context7.com/blackducksoftware/hub/llms.txt Deploy a migration-only stack to upgrade the database, monitor progress via logs, and then tear down the migration stack before deploying the full Black Duck application. ```bash # Run migration-only stack (brings up a subset of containers) docker stack deploy \ -c docker-swarm/docker-compose.dbmigrate.yml \ hub # Monitor migration progress docker service logs hub_postgres-upgrader -f # When all migration containers show "healthy", tear them down docker stack rm hub # Then proceed with the normal deployment docker stack deploy \ -c docker-swarm/docker-compose.yml \ -c docker-swarm/sizes-gen05/120sph.yaml \ hub ``` -------------------------------- ### Scale Docker Swarm Services Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Use 'docker service scale' to adjust the number of running instances for a service. This example scales the 'hub_jobrunner' service to two instances, increasing processing capacity. ```bash docker service scale hub_jobrunner=2 ``` ```bash docker service scale hub_jobrunner=1 ``` -------------------------------- ### Configure External PostgreSQL Database Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Provides parameters for connecting to an external PostgreSQL instance for Black Duck's database. Ensure the external database meets the required specifications. ```yaml postgres.host: "" postgres.adminUsername: "" postgres.adminPassword: "" postgres.userUsername: "" postgres.userPassword: "" ``` -------------------------------- ### Enable Source Upload Feature Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Set the 'ENABLE_SOURCE_UPLOADS' environment variable to 'true' in the 'blackduck-config.env' file to enable the source side-by-side view feature. ```env ENABLE_SOURCE_UPLOADS=true ``` -------------------------------- ### Port Forward to Black Duck Webserver Pod Source: https://github.com/blackducksoftware/hub/wiki/_Exposing-Black-Duck-Services Forwards traffic to a specific Black Duck webserver pod. First, retrieve the pod name using `kubectl get pods`, then use this command to establish the forward. ```bash kubectl get pods -n ``` ```bash kubectl -n port-forward 443:8443 ``` -------------------------------- ### Deploy Black Duck with Registry Authentication Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Include this flag when deploying the Docker stack if your images are hosted in a private repository and Docker stack fails to pull them. ```bash --with-registry-auth ``` -------------------------------- ### Enable Binary Analysis Environment Variable Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters Set the 'USE_BINARY_UPLOADS' environment variable to '1' in the 'spec' stanza of your JSON file to enable Black Duck Binary Analysis. ```json "environs": [ "USE_BINARY_UPLOADS:1" ], ``` -------------------------------- ### Get Black Duck Node Port Service Source: https://github.com/blackducksoftware/hub/wiki/_Common-Configuration-Tasks-v1 Retrieve the Node Port assigned to the Black Duck webserver service. This is necessary when configuring the public web server port, especially when accessing the UI via a Node Port. ```bash kubectl get service webserver-np -n ``` -------------------------------- ### Create Black Duck Namespace Source: https://github.com/blackducksoftware/hub/blob/master/kubernetes/blackduck/README.md Creates a Kubernetes namespace for the Black Duck deployment. Replace 'bd' with your desired namespace name. ```bash $ BD_NAME="bd" $ kubectl create ns ${BD_NAME} ``` -------------------------------- ### Changing Web Server Ports and Hosts (JSON) Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters Configure environment variables for Black Duck web server host and port in a JSON file. Ensure these are within the 'spec' stanza. ```json "environs": [ "PUBLIC_HUB_WEBSERVER_HOST:localhost", "PUBLIC_HUB_WEBSERVER_PORT:443", "HUB_WEBSERVER_PORT:8443" ], ``` -------------------------------- ### Perform Database Backup (Docker Swarm) Source: https://context7.com/blackducksoftware/hub/llms.txt Use the hub_create_data_dump.sh script to back up the Black Duck PostgreSQL database and optionally storage service uploads. Supports standard, live, parallel, and no-storage backup modes. ```bash mkdir -p /backup/blackduck # Standard backup (requires system to be in dbMigrate mode) ./docker-swarm/bin/hub_create_data_dump.sh /backup/blackduck # Backup a live system (performance impact — use with caution) ./docker-swarm/bin/hub_create_data_dump.sh --live-system /backup/blackduck # Parallel dump using 4 CPU threads (faster, requires ~10% extra /tmp space in the container) ./docker-swarm/bin/hub_create_data_dump.sh --max-cpu 4 /backup/blackduck # Skip the storage service backup ./docker-swarm/bin/hub_create_data_dump.sh --no-storage /backup/blackduck # Expected output files: # /backup/blackduck/globals.sql — PostgreSQL global roles/settings # /backup/blackduck/bds_hub.dump — Main Black Duck database dump # /backup/blackduck/uploads.tgz — Storage service file uploads (if present) ``` -------------------------------- ### Initialize External PostgreSQL Instance Source: https://github.com/blackducksoftware/hub/wiki/_Initializing-an-External-Database Execute the `external-postgres-init.pgsql` script against your Aurora RDS instance using `psql`. Ensure you replace placeholders with your actual connection details. ```bash psql -U blackduck -h hub47-aurora-jfs.XXXXXXXX.us-east-2.rds.amazonaws.com -p 5432 -f ./external-postgres-init.pgsql blackduck_hub_470 ``` -------------------------------- ### Configure Proxy Settings for Black Duck Source: https://context7.com/blackducksoftware/hub/llms.txt Configures proxy settings in `blackduck-config.env` for services requiring external internet access. For authenticated proxies, create a Docker secret for the password and add it to affected services in `docker-compose.local-overrides.yml`. ```bash # docker-swarm/blackduck-config.env (relevant excerpt) HUB_PROXY_SCHEME=https HUB_PROXY_HOST=proxy.my-company.com HUB_PROXY_PORT=8080 HUB_PROXY_USER=proxyuser HUB_PROXY_NON_PROXY_HOSTS=localhost,127.0.0.1 # For an authenticated proxy, supply the password as a Docker secret: docker secret create hub_HUB_PROXY_PASSWORD_FILE ./proxy_password.txt # In docker-compose.local-overrides.yml, add to affected services: # services: # authentication: # secrets: [HUB_PROXY_PASSWORD_FILE] # webapp: # secrets: [HUB_PROXY_PASSWORD_FILE] # ... ``` -------------------------------- ### Create Service Account for BDBA Source: https://github.com/blackducksoftware/hub/wiki/_Creating-an-Image-Pull-Secret Create an additional service account, typically with the same name as the namespace, if Black Duck Binary Analysis (BDBA) will be used. This is necessary for BDBA's elevated privilege requirements. ```bash kubectl create sa <> -n <> ``` -------------------------------- ### List All Running Black Duck Pods Source: https://github.com/blackducksoftware/hub/wiki/Debugging-a-Black-Duck-Deployment Use this command to list all pods in the Black Duck deployment and verify their status. Ensure all pods are in a 'Running' state. ```bash ubuntu@ip-10-0-22-242:~$ kubectl get pods NAME READY STATUS RESTARTS AGE cfssl-258485687-m3szc 1/1 Running 0 3h jobrunner-1397244634-xgcn2 1/1 Running 2 26m nginx-webapp-2564656559-6fbq8 2/2 Running 0 26m postgres-1794201949-tt4gj 1/1 Running 0 3h registration-2718034894-7brjv 1/1 Running 0 26m solr-1180309881-sscsl 1/1 Running 0 26m zookeeper-3368690434-rnz3m 1/1 Running 0 26m ... ``` -------------------------------- ### Expose Black Duck Service via Cloud Load Balancer Source: https://github.com/blackducksoftware/hub/wiki/_Exposing-Black-Duck-Services Creates a Network Load Balancer to expose a service, providing a single IP address for external traffic forwarding. Suitable for large cloud environments. ```bash kubectl expose --namespace=default deployment webserver --type=LoadBalancer --port=443 --target-port=8443 --name=nginx-gateway ``` -------------------------------- ### Deploy Black Duck with Read-Only File System Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Use this command to deploy Black Duck with a read-only file system, requiring additional persisted volumes. ```bash docker stack deploy --compose-file docker-compose.yml -c docker-compose.readonly.yml hub ``` -------------------------------- ### Set Black Duck User Passwords Source: https://github.com/blackducksoftware/hub/wiki/_Installing-Black-Duck-in-Clusters-not-Running-the-Operator After setting up the databases and users, set the passwords for the 'blackduck' and 'blackduck_user' accounts. Replace 'XXXXX' with your actual password. ```sql ALTER USER blackduck SET PASSSWORD XXXXX ALTER USER blackduck_user SET PASSSWORD XXXXX ``` -------------------------------- ### Scale Docker Services Source: https://context7.com/blackducksoftware/hub/llms.txt Scale specific Docker services to a desired number of instances. Ensure services are named correctly. ```bash docker service ls --filter name=hub_jobrunner docker service ls --filter name=hub_scan ``` ```bash docker service scale hub_jobrunner=1 docker service scale hub_scan=1 ``` -------------------------------- ### Join Projects for Network Access Source: https://github.com/blackducksoftware/hub/wiki/Deploying-Black-Duck-in-Secured-Clusters Use this command in OpenShift to allow network traffic between namespaces when network policies restrict communication. Replace placeholders with your actual namespace names. ```bash oc adm pod-network join-projects --to= ``` -------------------------------- ### Configure Persistent Volume for Black Duck Postgres Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters When enabling persistent storage, define the PVC for Black Duck's Postgres instance. Ensure the 'name' is 'blackduck-postgres' and specify the required 'size'. ```json "pvc": [ { "name": "blackduck-postgres", "size": "150Gi" } ], ``` -------------------------------- ### Download Black Duck Images as Tar File Source: https://github.com/blackducksoftware/hub/wiki/_Pushing-Black-Duck-Images-to-a-Secure-Registry Use the --no-push option with the blackduck-images.sh command to download Black Duck images as a tar file instead of pushing them to a registry. The tar file will be located in the download/blackduck/blackduck-images directory. ```bash ./blackduck-images.sh --no-push ``` -------------------------------- ### Docker Login to Secure Registry Source: https://github.com/blackducksoftware/hub/wiki/_Creating-an-Image-Pull-Secret Log in to your secure container registry using your customer ID and registry address. This command prompts for a password and verifies successful login. ```bash docker login -u ``` -------------------------------- ### Enable Liveness Probes Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Installation-Parameters To enable liveness probes for Black Duck containers, set the 'livenessProbes' parameter to 'true' in your JSON configuration. ```json { "livenessProbes": "true" } ``` -------------------------------- ### Deploy Black Duck with External PostgreSQL Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Deploy the Black Duck stack using an external PostgreSQL instance instead of the provided hub-postgres docker image. This assumes the external PostgreSQL instance is already configured. ```bash docker stack deploy -c docker-compose.externaldb.yml hub ``` -------------------------------- ### Enable Application-Level Encryption Source: https://context7.com/blackducksoftware/hub/llms.txt Enable application-level encryption by generating a root seed, setting the environment variable, and deploying with the encryption overlay. For Kubernetes, use kubectl to create a secret. ```bash # 1. Generate a cryptographic root seed (store this securely; loss = data loss) openssl rand -hex 1024 > root_seed # 2. Enable encryption in blackduck-config.env # BLACKDUCK_CRYPTO_ENABLED=true # 3. Supply seeds via the encryption overlay (docker-compose.encryption.yml) docker stack deploy \ -c docker-swarm/docker-compose.yml \ -c docker-swarm/sizes-gen05/120sph.yaml \ -c docker-swarm/docker-compose.encryption.yml \ hub # For Kubernetes: kubectl create secret generic crypto-root-seed \ --namespace blackduck \ --from-file=crypto-root-seed=./root_seed rm root_seed # Do not leave the seed on disk helm upgrade bd blackduck/blackduck \ --namespace blackduck \ --set enableApplicationLevelEncryption=true ``` -------------------------------- ### Connect to Black Duck Reporting Database with psql Source: https://github.com/blackducksoftware/hub/wiki/_Black-Duck-Reporting-Database Connect to the Black Duck reporting database using the psql client. You will need the reporting user, the exposed port, the external IP of the PostgreSQL service, and the database name. ```bash psql -U blackduck_reporter -p 55436 -h $external_ip_from_above -W bds_hub_report ``` -------------------------------- ### Export Black Duck Configuration YAML Source: https://github.com/blackducksoftware/hub/wiki/_Installing-Black-Duck-in-Clusters-not-Running-the-Operator Use this command to collect all deployment, secret, and configmap resources for a specific namespace in your sandbox environment. ```bash kubectl get deployments,secrets,configmap -o yaml -n my-namespace --export=true > createme.yaml ``` -------------------------------- ### Create Docker Secrets for Custom Certificates Source: https://github.com/blackducksoftware/hub/blob/master/docker-swarm/README.md Use 'docker secret create' to create secrets for your custom web server certificate and key. Replace '' with your stack's name and ''/'' with the actual file paths. ```bash docker secret create _WEBSERVER_CUSTOM_CERT_FILE docker secret create _WEBSERVER_CUSTOM_KEY_FILE ``` -------------------------------- ### Stream Black Duck Webapp Logs Source: https://context7.com/blackducksoftware/hub/llms.txt Stream logs from the Black Duck web application pods in real-time. ```bash # Stream webapp logs (main application log) kubectl logs -n blackduck -l app=webapp -f ``` -------------------------------- ### Configure Web Server Hostname and Port (Docker Swarm) Source: https://context7.com/blackducksoftware/hub/llms.txt Sets the public hostname and port for the Black Duck web server by editing the environment file before deploying the stack. This ensures the auto-generated TLS certificate includes the correct Subject Alternative Name. ```bash # hub-webserver.env PUBLIC_HUB_WEBSERVER_HOST=blackduck.my-company.com PUBLIC_HUB_WEBSERVER_PORT=443 HUB_WEBSERVER_PORT=8443 IPV4_ONLY=0 # set to 1 if IPv6 is disabled on the host USE_ALERT=0 # set to 1 if Black Duck Alert is also deployed # After editing, redeploy the stack: docker stack deploy \ -c docker-swarm/docker-compose.yml \ -c docker-swarm/sizes-gen05/120sph.yaml \ hub # Access Black Duck at: # https://blackduck.my-company.com/ ``` -------------------------------- ### Enable Binary Analysis (BDBA) for Black Duck Source: https://context7.com/blackducksoftware/hub/llms.txt Enables Binary Analysis (BDBA) for Black Duck. For Docker Swarm, use the `docker-compose.bdba.yml` overlay. For Kubernetes, enable via Helm values. ```bash # Docker Swarm: add the BDBA compose overlay docker stack deploy \ -c docker-swarm/docker-compose.yml \ -c docker-swarm/sizes-gen05/120sph.yaml \ -c docker-swarm/docker-compose.bdba.yml \ hub # Kubernetes: enable via Helm values helm upgrade bd blackduck/blackduck \ --namespace blackduck \ --set enableBinaryScanner=true \ --set binaryscanner.replicas=1 \ --set binaryscanner.resources.limits.memory=4096Mi ``` -------------------------------- ### Configure Kubernetes Ingress Controller Source: https://context7.com/blackducksoftware/hub/llms.txt Define an Nginx Ingress resource for Black Duck to manage external access via HTTPS. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: blackduck-ingress namespace: blackduck annotations: nginx.ingress.kubernetes.io/proxy-body-size: "1024m" nginx.ingress.kubernetes.io/proxy-buffer-size: "8k" nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" spec: tls: - hosts: - blackduck.my-company.com secretName: blackduck-tls-secret rules: - host: blackduck.my-company.com http: paths: - path: / pathType: Prefix backend: service: name: bd-blackduck-webserver port: number: 443 ```