Project: secureCodeBox (Provisioning / Security & Compliance)
File: installation.md

title: "Installation" sidebar_label: Installation sidebar_position: 1 path: "docs/getting-started/installation" The secureCodeBox is running on . To install it you need , a package manager for Kubernetes. For your first steps Kubernetes from , or is sufficient. We also provide a based all-in-one installation (see ). First of all you need to install the secureCodeBox Operator which is responsible for starting all security scans. ```bash helm repo add secureCodeBox https://charts.securecodebox.io kubectl create namespace securecodebox-system helm --namespace securecodebox-system upgrade --install securecodebox-operator secureCodeBox/operator ``` If you didn't see any errors you now have the secureCodeBox Operator up and running! You're now ready to install your . The secureCodeBox supports the 4 latest Kubernetes releases (`v1.29`, `v1.28`, `v1.27` & `v1.26`). Older version might also work but are not officially supported or tested. The default secureCodeBox Operator includes a instance, which acts as a local S3 filestorage API used by the secureCodeBox to store the results files of its scans. You can switch it out with a S3 compatible API provided by most cloud providers. You can access the MinIO instance included in the default installation like the following: Port Forward MinIO UI: `kubectl port-forward -n securecodebox-system service/securecodebox-operator-minio 9000:9001` AccessKey (Username): `kubectl get secret securecodebox-operator-minio -n securecodebox-system -o=jsonpath='{.data.root-user}' | base64 --decode; echo` SecretKey (Password): `kubectl get secret securecodebox-operator-minio -n securecodebox-system -o=jsonpath='{.data.root-password}' | base64 --decode; echo` :::note If you are using Windows, do not include the `| base64 --decode; echo` part in the Command Prompt. Instead, after running the command, manually decode the resulting base64 output using PowerShell. ::: Then open your browser on and login in with the credentials returned by the command listed above. If you find yourself running these snippets regularly, you might want to check out this To change out the default MinIO instance with a S3 Bucket from a cloud provider you can update the helm values to connect the operator with you S3 bucket. ```yaml minio: enabled: false s3: enabled: true endpoint: "s3.eu-west-1.amazonaws.com" bucket: "your-own-securecodebox-bucket-name" keySecret: securecodebox-s3-credentials ``` :::info Instead of using access keys it is possible to use IAM roles for more fine grained access management. To achieve that set in your helm values `s3.authType` to `aws-irsa`, and `s3.awsStsEndpoint` to your desired region (`https://sts.REGION.amazonaws.com`). ::: ```yaml minio: enabled: false s3: enabled: true bucket: your-own-securecodebox-bucket-name endpoint: storage.googleapis.com keySecret: gcs-bucket-credentials ``` The following list will give you a short overview of all supported security scanner charts and how to install them. You will find a more detailed documentation for each scanner in our Scanners documentation section. :::note If you are installing the secureCodeBox the first time we recommend to read the documentation first. ::: You can optionally deploy SCB scanner charts for each security scanner you want to

They should not be installed into the securecodebox-system namespace like the operator, but into the individual namespaces where you want to run the scans. ```bash helm upgrade --install amass secureCodeBox/amass helm upgrade --install gitleaks secureCodeBox/gitleaks helm upgrade --install kube-hunter secureCodeBox/kube-hunter helm upgrade --install nikto secureCodeBox/nikto helm upgrade --install nmap secureCodeBox/nmap helm upgrade --install ssh-scan secureCodeBox/ssh-scan helm upgrade --install sslyze secureCodeBox/sslyze helm upgrade --install trivy secureCodeBox/trivy helm upgrade --install wpscan secureCodeBox/wpscan helm upgrade --install zap secureCodeBox/zap ``` If you want to test some of the security scanners within your namespace you can use some demo targets. :::danger As these demo targets are intentionally vulnerable you shouldn't expose them to the internet - keep them internal. Otherwise you could be targeted by someone else really fast ::: ```bash helm upgrade --install dummy-ssh secureCodeBox/dummy-ssh helm upgrade --install bodgeit secureCodeBox/bodgeit helm upgrade --install juice-shop secureCodeBox/juice-shop helm upgrade --install old-wordpress secureCodeBox/old-wordpress helm upgrade --install swagger-petstore secureCodeBox/swagger-petstore ``` :::note These charts will be installed in the `default` namespace, but you can choose the namespace of your choice by adding `--namespace YOURNAMESPACE` to each helm command. ::: We provide a setup with everything installed (Kubernetes cluster, operator, scanners, hooks, demo applications, etc.). You only need and our main repository to play around with secureCodeBox: ```bash git clone https://github.com/secureCodeBox/secureCodeBox.git cd secureCodeBox vagrant up ``` After this setup has finished just ssh into the vagrant box: ```bash vagrant ssh ``` Now you can . If your secureCodeBox Operator install is failing, and you see that the operator pod seems to be working okay, but the MinIO pods started alongside it does not start up properly, your cluster probably isn't configured to have a working default . Suggested solutions: Use a Cloud Storage provider instead of MinIO. This has to provide a API compatible to AWS S3. Providers that we have tried and worked great include: AWS S3 Google Cloud Storage DigitalOcean Spaces Configure MinIO to use a HostPath Volume. This is more work to set up and manage, but also works for local / on-prem installation. The secureCodeBox Operator Helm Chart contains Custom Resource Definitions and ClusterRoles which is usually reserved to administrators of production cluster (and rightfully so ). If you are just testing out the secureCodeBox consider using a local Kubernetes Cluster with tools like , or . There are multiple ways to install Kubernetes and Helm to run secureCodeBox on Windows. One easy method is to install then enable Kubernetes in the Settings. While installing a current version of Docker Desktop you will be prompted to install Linux Subsystem for Windows (WSL2). Now you can continue the installation on either Windows or the Linux Subsystem. For Windows: Install for Windows like instructed on the website. Usually installing from Binaries will be easy. For Linux Subsystem: Install the Linux Distribution of your choice from the Microsoft Store (Ubuntu 18.04 works fine). Now install for the chosen Distribution (e.g. using Apt for Ubuntu).