Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Published by Scroll Versions from space FUNCTDEV and version SVC2025.1

...

Code Block
languageyml
titlesoavirt-service.yaml
kind: Service
apiVersion: v1
metadata:
  name: soavirt-service
  namespace: parasoft-sv-namespace
spec:
  selector:
    tagapp: soavirt
  type: NodePort
  ports:
    - name: http
      protocol: TCP
      port: 9080
      targetPort: 9080
      nodePort: 30080
    - name: https
      protocol: TCP
      port: 9443
      targetPort: 9443
      nodePort: 30083

Use the yaml file to create service that can be used to access SOAVirt server in Kubernetes:

...

Code Block
languageyml
titlesoavirt-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: soavirt-config
  namespace: parasoft-sv-namespace
data:
  config.properties: |
	# Configuration properties for soavirt server

	# === END USER LICENSE AGREEMENT ===
	# Set to true to accept the end user license agreement
	# Please review the EULA.txt file included in the distribution zip for soavirt.war
	parasoft.eula.accepted=false


	# === WORKING DIRECTORY ===
	# Specifies workspace location
	#working.dir=C:/Users/../workspace


	# === LOGGING CONFIGURATION ===
	# Specifies configuration file for logging
	logging.config.file=/WEB-INF/default.logging.xml
	# Replace with the following line to enable debug information
	#logging.config.file=/WEB-INF/debug.logging.xml


	# === CTP SERVER ===
	# Specifies CTP server endpoint
	#env.manager.server=http\://[CTP Server Host]\:8080

	# Specifies the server name that will be displayed in CTP
	#env.manager.server.name=[Server Name]

	# Specifies username for CTP authentication
	#env.manager.username=[CTP Server Username]

	# Specifies password for CTP authentication
	#env.manager.password=[CTP Server Password]

	# Enables notifications to CTP for deployments
	#env.manager.notify=true


	# === SERVLET CONTAINER ===
	# Specifies the hostname to use for remote access to this server
	# Useful when a name or address must be strictly used for CTP connectivity
	# If empty, the address will be auto-detected
	#server.hostname=[Server Hostname]

	# Specifies port for http
	# Port should match your servlet container
	server.port.http=9080

	# Specifies port for https
	# Port should match your servlet container
	#serverserver.port.https=84439443


	# === PRODUCT LICENSING ===
	# Enables virtualize functionality
	virtualize.license.enabled=true

	# Enables soatest functionality
	soatest.license.enabled=true


	# === NODE-LOCK LICENSE ===
	# Specifies password for virtualize local license
	#virtualize.license.local.password=[Virtualize License Password]

	# Specifies password for soatest local license
	#soatest.license.local.password=[Soatest License Password]


	# === NETWORK LICENSE ===
	# Enables network licensing for virtualize
	virtualize.license.use_network=true

	# Specifies the type of network license for virtualize ['performance_server_edition', 'runtime_server_edition', 'custom_edition']
	virtualize.license.network.edition=custom_edition

	# Specifies features for virtualize 'custom_edition' license
	virtualize.license.custom_edition_features=Service Enabled, Performance, Extension Pack, Validate, Message Packs, Developer Sandbox 1000 Hits/Day, 10000 Hits/Day, 25000 Hits/Day, 50000 Hits/Day, 100000 Hits/Day, 500000 Hits/Day, 1 Million Hits/Day, Unlimited Hits/Day, 30 HPS, 100 HPS

	# Enables network licensing for soatest
	soatest.license.use_network=true

	# Specifies the type of network license for soatest ['server_edition', 'custom_edition']
	soatest.license.network.edition=custom_edition

	# Specifies features for soatest 'custom_edition' license
	soatest.license.custom_edition_features=RuleWizard, Command Line, SOA, Web, Server API Enabled, Message Packs, Advanced Test Generation Desktop, Advanced Test Generation 5 Users, Advanced Test Generation 25 Users, Advanced Test Generation 100 Users, Requirements Traceability, API Security Testing


	# === LICENSE SERVER ===
	# Enables using a specific license server
	# If true, the license network properties below will be used to retrieve a license
	# If false, the DTP server properties will be used to retrieve a license
	license.network.use.specified.server=true

	# Specifies license server URL, e.g., https://host[:port][/context-path]
	license.network.url=https\://[License Server Host]\:8443

	# Enables http authentication for the license server
	license.network.auth.enabled=false

	# Specifies username for license server authentication
	#license.network.user=[License Server Username]

	# Specifies password for license server authentication
	#license.network.password=[License Server Password]

	# === DTP SERVER ===
	# Specifies DTP server URL, e.g., https://host[:port][/context-path]
	#dtp.url=https\://[DTP Server Host]\:8443

	# Specifies username for DTP authentication
	#dtp.user=[DTP Server Username]

	# Specifies password for DTP authentication
	#dtp.password=[DTP Server Password]

	# Specifies the name of the DTP project that you want to link to
	#dtp.project=[DTP Project]

	# === MISC ===
	# Specifies scripting timeout in minutes
	#scripting.timeout.minutes=10

	# Enables logging telemetry data
	#usage.reporting.enabled=true

	# === OIDC ===
	# Enables or disables user authentication via OpenID Connect
	#oidc.enabled=false

	# Specifies the URI of the OpenID Connect server
	#oidc.issuer.uri=

	# Specifies the ID provided by your OpenID Connect server
	#oidc.client.id=

	# Specifies the method that will be used to authenticate the user on the OpenID Connect server
	#oidc.cli.mode=devicecode

	# Specifies the path to the token file containing user authentication information
	#oidc.devicecode.token.file=

	# === REPORTS ===
	# Specifies a tag that represents a unique identifier for each run
	# e.g., ${config_name}-${project_module}-${scontrol_branch}-${exec_env}
	#session.tag=${config_name}

	# Specifies a build identifier used to label results
	#build.id=${dtp_project}-yyyy-MM-dd

	# Specifies data that should be included in the report
	#report.developer_errors=true
	#report.developer_reports=true
	#report.authors_details=true
	#report.testcases_details=false
	#report.test_suites_only=true
	#report.failed_tests_only=false
	#report.output_details=false
	#report.env_details=false
	#report.organize_security_findings_by=CWE
	#report.associations=false
	#report.assoc.url.pr=
	#report.assoc.url.fr=
	#report.assoc.url.task=
	#report.assoc.url.req=
	#report.assoc.url.test=

	# Specifies report format configuration ['html', 'pdf', 'xml', 'custom']
	report.format=html
	#report.custom.extension=
	#report.custom.xsl.file=

	# Specifies installation directory for Jtest or dotTEST that generates coverage report
	#jtest.install.dir=
	#dottest.install.dir=

...

After creating the configuration map, you need to create the service account and required permissions.can choose to set up a secret for the server. This step is optional.

Code Block
languageyml
titleparasoftsoavirt-permissionssecret.yaml
apiVersion: v1
kind: ServiceAccountSecret
metadata:
  name: parasoftsoavirt-accountsecret
  namespace: parasoft-sv-namespace
automountServiceAccountTokentype: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: parasoft-read
  namespace: parasoft-sv-namespace
rules:
- apiGroups:
  - ""
  resources:
  - "namespaces"
  - "pods"
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: parasoft-read-bind
  namespace: parasoft-sv-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: parasoft-read
subjects:
- kind: ServiceAccount
  name: parasoft-account
  namespace: parasoft-sv-namespace

Use the yaml file to create the service account and required permissions:

Code Block
languagetext
kubectl create -f parasoft-permissions.yaml

You should see something similar to the output below in your console:

Code Block
languagetext
serviceaccount/parasoft-account created
role.rbac.authorization.k8s.io/parasoft-read created
rolebinding.rbac.authorization.k8s.io/parasoft-read-bind created

The following creates the SOAVirt server. If a custom Persistent Volume Claim name was used in previous steps, make sure to update the 'claimName' field to match the custom name.

Note: kind: Deployment is not supported. Use either kind: Pod or kind: StatefulSet.

Opaque
# It is recommended to encrypt password values using the -encodepass CLI option or the encodepass.sh script.
# After encryption, both username and password values must be base64 encoded.
# Example: echo -n "[string]" | base64
# For additional security, see https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/.
data:
  # Specifies username for CTP authentication
  #env.manager.username: [CTP Server Username]

  # Specifies password for CTP authentication
  #env.manager.password: [CTP Server Password]

  # Specifies username for license server authentication
  #license.network.user: [License Server Username]

  # Specifies password for license server authentication
  #license.network.password: [License Server Password]

  # Specifies username for DTP authentication
  #dtp.user: [DTP Server Username]

  # Specifies password for DTP authentication
  #dtp.password: [DTP Server Password]

Use the yaml file to create the secret for the SOAVirt server:

Code Block
languagetext
kubectl create -f soavirt-secret.yaml
Info
titleEncrypting Your Password

To encrypt a password, run the following command to create a pod that has the parasoft/soavirt-server image without starting the server.

Code Block
kubectl run soavirt-encodepass -n parasoft-sv-namespace --image parasoft/soavirt-server --command -- tail -f /dev/null

Once the pod is created, run the following command to execute the encodepass.sh script inside the pod. Make sure to substitute the desired password.

Code Block
kubectl exec -n parasoft-sv-namespace --stdin --tty soavirt-encodepass -- /usr/local/parasoft/soavirt/webapps/ROOT/scripts/encodepass.sh <YOUR_PASSWORD>

After the password is encrypted, delete the pod.

Code Block
kubectl delete pod soavirt-encodepass -n parasoft-sv-namespace 

Once you have set up the configuration map and the secret for the server, you need to create the service account and required permissions.

Code Block
languageyml
titleparasoft-permissions.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: parasoft-account
  namespace: parasoft-sv-namespace
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: parasoft-read
  namespace: parasoft-sv-namespace
rules:
- apiGroups:
  - ""
  resources:
  - "namespaces"
  - "pods"
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: parasoft-read-bind
  namespace: parasoft-sv-namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: parasoft-read
subjects:
- kind: ServiceAccount
  name: parasoft-account
  namespace: parasoft-sv-namespace

Use the yaml file to create the service account and required permissions:

Code Block
languagetext
kubectl create -f parasoft-permissions.yaml

You should see something similar to the output below in your console:

Code Block
languagetext
serviceaccount/parasoft-account created
role.rbac.authorization.k8s.io/parasoft-read created
rolebinding.rbac.authorization.k8s.io/parasoft-read-bind created

The following creates the SOAVirt server. If a custom Persistent Volume Claim name was used in previous steps, make sure to update the 'claimName' field to match the custom name.

Note: kind: Deployment is not supported. Use either kind: Pod or kind: StatefulSet.

Code Block
languageyml
titlesoavirt-pod.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: soavirt
  namespace: parasoft-sv-namespace
  labels:
    app: soavirt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: soavirt
  serviceName: soavirt
  template:
    metadata:
      labels:
Code Block
languageyml
titlesoavirt.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: soavirt
  namespace: parasoft-sv-namespace
  labels:
    tag: soavirt
spec:
  replicas: 1
  selector:
    matchLabels:
      tag: soavirt
  serviceName: soavirt
  template:
    metadata:
      labels:
        tag: soavirt
    spec:
      securityContext:
        runAsNonRoot: true
      serviceAccountName: parasoft-account
      automountServiceAccountToken: true
      volumes:
      - name: soavirt-pv
        persistentVolumeClaim:
          claimName: soavirt-pvc
      - name: soavirt-config
        configMap:
          name: soavirt-config
      containers:
      - name: soavirt
        image: parasoft/soavirt-server
        imagePullPolicy: IfNotPresent
# When running on Kubernetes nodes with more than 32 CPU cores the product will print the following in the logs: This machine exceeds the licensed number of CPU cores
# To reduce the number of cores available, uncomment the following resource specification (if you are using OpenShift, see the note below) or contact Parasoft to enable running on higher core counts.
#        resources:
#          limits:
#            cpu: "4" 
        securityContext:
          allowPrivilegeEscalation: false
        app:  capabilities:soavirt
    spec:
        dropsecurityContext:
 ["ALL"]
       runAsNonRoot: true
  seccompProfile:
    serviceAccountName: parasoft-account
      automountServiceAccountToken: true
      typevolumes: RuntimeDefault
      -  volumeMounts:name: soavirt-pv
        - name: soavirt-pvpersistentVolumeClaim:
          mountPathclaimName: /usr/local/parasoft/soavirt/webapps/ROOT/workspacesoavirt-pvc
        - name: soavirt-config
          mountPath: /usr/local/parasoft/soavirt/webapps/config.propertiesconfigMap:
          subPathname: soavirt-config.properties
        portscontainers:
        - name: httpsoavirt
          containerPortimage: 9080parasoft/soavirt-server
        startupProbeimagePullPolicy: IfNotPresent
# When running on Kubernetes nodes with more than 32 httpGet:
CPU cores the product will print the following in the logs: This path: /soavirt/api/v6/healthcheck
            port: 9080
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 30
machine exceeds the licensed number of CPU cores
# To reduce the number of cores available, uncomment the following resource specification (if you are using OpenShift, see the note below) or contact Parasoft to enable running on higher core counts.
#        resources:
#          failureThresholdlimits: 3
#        livenessProbe:
    cpu: "4" 
        httpGetsecurityContext:
            pathallowPrivilegeEscalation: /soavirt/api/v6/healthcheckfalse
            portcapabilities:
 9080
          initialDelaySeconds: 30 drop: ["ALL"]
          periodSecondsseccompProfile:
 30
           timeoutSecondstype: 30 RuntimeDefault
        envvolumeMounts:
        - name: CATALINA_OPTSsoavirt-pv
          value: "-Dparasoft.auto.deploy.new=falsemountPath: /usr/local/parasoft/soavirt/webapps/ROOT/workspace
        -           -Dparasoft.cloudvm=truename: soavirt-config
          mountPath: /usr/local/parasoft/soavirt/webapps/config.properties
          -Dparasoft.cloudvm.config=Kubernetes"subPath: config.properties
        - name: PARASOFT_POD_NAMEports:
        - name: valueFrom:http
          containerPort:  fieldRef:9080
              fieldPath- name: metadata.namehttps
         - namecontainerPort: PARASOFT_POD_NAMESPACE9443
          valueFromstartupProbe:
          httpGet:
          fieldRef:
  path: /soavirt/api/v6/healthcheck
            port:   fieldPath: metadata.namespace
9080
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 30
          failureThreshold: 3
        livenessProbe:
          httpGet:
            path: /soavirt/api/v6/healthcheck
            port: 9080
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 30 
        envFrom:
        - secretRef:
            name: soavirt-secret
            optional: true 
        env:
        - name: CATALINA_OPTS
          value: "-Dparasoft.auto.deploy.new=false
                   -Dparasoft.cloudvm=true
                   -Dparasoft.cloudvm.config=Kubernetes"
        - name: PARASOFT_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: PARASOFT_POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
Info
titleOpenShift Users

If you are using OpenShift and your host is

Info
titleOpenShift Users

If you are using OpenShift and your host is using more than 32 cores, you will need to look at your OpenShift version's documentation about Quotas and Limit Ranges for CPU as there are significant differences between versions. This link is to the documentation for version 4.16, but you should consult the documentation for your exact version: https://docs.openshift.com/container-platform/4.16/nodes/clusters/nodes-cluster-limit-ranges.html

...

Code Block
languagetext
kubectl create -f soavirt-pod.yaml

Anchor
UsingALocalLicense
UsingALocalLicense
Using a Local License: To use a node-lock license, you will need to retrieve the machine ID from the deployed server in order to procure your license from Parasoft.

  1. Open a shell to the running container:

    Code Block
    kubectl exec --stdin --tty soavirt-0 -n parasoft-sv-namespace -- /bin/bash
  2. Make a curl call to the SOAVirt REST API to retrieve the machine ID:

    Code Block
    curl http://localhost:9080/soavirt/api/v6/status?fields=machineId 
  3. Note the machine ID in the response and provide it to your Parasoft representative, who will send you a license password.
  4. Once you've received your license password, apply it in the soavirt-config.yaml.apply it in the soavirt-config.yaml.
  5. Apply the updated soavirt-config.yaml to the running container:

    Code Block
    kubectl apply -f soavirt-config.yaml
  6. The license will be applied when the pod is restarted automatically. Alternatively, you can delete and recreate the pod for the changes to take effect.

    Code Block
    kubectl delete -f soavirt-pod.yaml
    kubectl create

    Apply the updated soavirt-config.yaml to the running container:

    Code Block
    kubectl apply -f soavirt-configpod.yaml

    The license will be applied when the pod is restarted automatically. Alternatively, you can delete and recreate the pod for the changes to take effect.

    Code Blockkubectl delete -f soavirt.yaml kubectl create -f soavirt.yaml

Volume Mount Security Policies (Optional)

If your security policy requires applications to only write to mounted volumes, then in addition to the workspace (which is already set in the example pod) you will need to mount the following locations:

No Format
nopaneltrue
/usr/local/parasoft/soavirt/logs
/usr/local/parasoft/soavirt/temp
/usr/local/parasoft/soavirt/webapps/ROOT/WEB-INF/configs/builtin
/usr/local/parasoft/soavirt/webapps/ROOT/felix-cache
/usr/local/parasoft/soavirt/webapps/ROOT/apifiles
/usr/local/parasoft/soavirt/work/Catalina/localhost/ROOT
/usr/local/tomcat/logs/ 

Deploying SOAVirt Server in Kubernetes with a Helm Chart

...