Kubernetes中部署Dependency-Track 并对接 EAuth OIDC 认证

深圳市智易付科技有限责任公司2026-04-08 14:54

Dependency-Track 简介

Dependency-Track 是 OWASP 的持续 SBOM 分析平台，它不是一次性扫描工具，而是"软件供应链风险持续治理平台"，核心能力是：

  1. 接收 CycloneDX SBOM（来自构建流程或供应商）。
  2. 持续分析组件漏洞、许可证和策略风险。
  3. 通过通知与集成，把风险结果推送到研发与安全流程。

OIDC认证能力支持

Dependency-Track支持使用第三方OIDC认证，同时能够通过令牌中的groups信息实现Dependency-Track中不同项目的权限控制，这样能够简化Dependency-Track对用户的管理

Dependency-Track部署

本文通过kube-keeper来部署，首先通过kube-keeper创建两个命名空间，一个为dtrack用于部署dependency-track，另一个为postgres用于部署数据库postgres

  1. eauth中应用创建dependency-track应用，其中的回调地址为dtrack.efucloud.com//static/oid...
  2. 如果使用集群外的数据库则不需要创建命名空间postgres和部署postgres服务
yaml 复制代码 
---
# Source: dependency-track/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dtrack-dependency-track
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
  annotations: {}
automountServiceAccountToken: false
---
# Source: custom/database-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: dtrack-database-secret
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/component: api-server
type: Opaque
stringData:
  ALPINE_DATABASE_USERNAME: postgres
  ALPINE_DATABASE_PASSWORD: EfuCloud@pwd
---
# Source: dependency-track/templates/api-server/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: dtrack-dependency-track-api-server
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
    app.kubernetes.io/version: 4.14.0
spec:
  type: "ClusterIP"
  ports:
    - name: web
      port: 8080
      targetPort: web
  selector:
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
---
# Source: dependency-track/templates/frontend/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: dtrack-dependency-track-frontend
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track

    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
    app.kubernetes.io/version: 4.14.0
spec:
  type: "ClusterIP"
  ports:
    - name: web
      port: 8080
      targetPort: web
  selector:
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
---
# Source: dependency-track/templates/api-server/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dtrack-dependency-track-api-server
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track

    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
    app.kubernetes.io/version: 4.14.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: dtrack
      app.kubernetes.io/name: dependency-track-api-server
      app.kubernetes.io/component: api-server
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: dtrack
        app.kubernetes.io/name: dependency-track-api-server
        app.kubernetes.io/component: api-server
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: /metrics
    spec:
      enableServiceLinks: true
      initContainers:
      serviceAccountName: dtrack-dependency-track
      securityContext:
        fsGroup: 1000
      containers:
        - name: dependency-track-api-server
          image: registry.cn-shenzhen.aliyuncs.com/efucloud-public/dependencytrack-apiserver:4.14.0
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          resources:
            limits:
              memory: 5Gi
            requests:
              cpu: "1"
              memory: 1Gi
          env:
            - name: ALPINE_METRICS_ENABLED
              value: "true"
            - name: ALPINE_DATABASE_MODE
              value: "external"
            - name: ALPINE_DATABASE_URL
              value: "jdbc:postgresql://postgres.postgres.svc.cluster.local:5432/dependencytrack"
            - name: ALPINE_DATABASE_DRIVER
              value: "org.postgresql.Driver"
            - name: ALPINE_DATABASE_USERNAME
              valueFrom:
                secretKeyRef:
                  name: dtrack-database-secret
                  key: ALPINE_DATABASE_USERNAME
            - name: ALPINE_DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: dtrack-database-secret
                  key: ALPINE_DATABASE_PASSWORD
            # OIDC configuration placeholders (fill values as needed)
            - name: ALPINE_OIDC_ENABLED
              value: "true"
            - name: ALPINE_OIDC_CLIENT_ID
              value: "rot7giyv32yy5kkfpmemvlu56"
            - name: ALPINE_OIDC_ISSUER
              value: "https://eauth-demo.efucloud.com"
            - name: ALPINE_OIDC_USERNAME_CLAIM
              value: "username"
            - name: ALPINE_OIDC_USER_PROVISIONING
              value: "true"
            - name: ALPINE_OIDC_TEAM_SYNCHRONIZATION
              value: "false"
            - name: ALPINE_OIDC_TEAMS_CLAIM
              value: "groups"
            - name: ALPINE_OIDC_TEAMS_DEFAULT
              value: "Administrators"
          ports:
            - name: web
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /data
            - name: tmp
              mountPath: /tmp
          startupProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/started
            failureThreshold: 30
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/live
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/ready
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: data
          emptyDir: {}
        - name: tmp
          emptyDir: {}
---
# Source: dependency-track/templates/frontend/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dtrack-dependency-track-frontend
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
    app.kubernetes.io/version: 4.14.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: dtrack
      app.kubernetes.io/name: dependency-track-frontend
      app.kubernetes.io/component: frontend
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: dtrack
        app.kubernetes.io/name: dependency-track-frontend
        app.kubernetes.io/component: frontend
    spec:
      enableServiceLinks: true
      initContainers:
      serviceAccountName: dtrack-dependency-track
      securityContext:
        fsGroup: 1000
      containers:
        - name: dependency-track-frontend
          image: registry.cn-shenzhen.aliyuncs.com/efucloud-public/dependencytrack-frontend:4.14.0
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 150m
              memory: 64Mi
          env:
            - name: API_BASE_URL
              value: ""
            # OIDC configuration placeholders (fill values as needed)
            - name: OIDC_ISSUER
              value: "https://eauth-demo.efucloud.com"
            - name: OIDC_CLIENT_ID
              value: "rot7giyv32yy5kkfpmemvlu56"
            - name: OIDC_SCOPE
              value: "openid profile email"
            - name: OIDC_FLOW
              value: ""
            - name: OIDC_LOGIN_BUTTON_TEXT
              value: ""
          ports:
            - name: web
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          livenessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: tmp
          emptyDir: {}
---
# Source: custom/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dtrack-dependency-track
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - dtrack.efucloud.com
      secretName: dtrack-tls
  rules:
    - host: dtrack.efucloud.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: dtrack-dependency-track-api-server
                port:
                  number: 8080
          - path: /
            pathType: Prefix
            backend:
              service:
                name: dtrack-dependency-track-frontend
                port:
                  number: 8080

Dependency-Track访问

  1. 浏览器打开dtrack.efucloud.com/ ，点击更多的选择，先使用admin/admin登录，若直接使用OIDC登录则会出现下图的情形。

配置完成后，使用oidc登录后的页面如下

相关推荐
赵侃侃爱分享2 小时前
AI怎么定义网络安全
人工智能·安全·web安全
步步为营DotNet2 小时前
深度探索.NET Aspire在云原生应用性能与安全加固的创新实践
安全·云原生·.net
上海云盾-小余3 小时前
服务器被入侵后如何快速止损？从排查到加固的应急处置全流程
网络·网络协议·tcp/ip·安全·web安全
电磁脑机4 小时前
人脑电磁路由拓扑与外耦合脑机接口基础理论
分布式·神经网络·安全·交互
APguantou4 小时前
NCRE-三级数据库技术-第9章-安全管理
数据库·安全·sqlserver
FreeBuf_5 小时前
14000余台F5 BIG-IP暴露，高危RCE漏洞正遭活跃利用
tcp/ip·安全·web安全
Xudde.5 小时前
班级作业笔记报告0x08
笔记·学习·安全·web安全
龙亘川6 小时前
城管住建领域丨市政设施监测功能详解（3）——管廊监测系统：严防泄漏保障用气安全
安全·管廊监测系统
上海云盾-小余6 小时前
网站防爬防刷防薅羊毛：接口安全与业务风控实战方案
安全
热门推荐
01GitHub 镜像站点02OpenClaw 请求超时 llm request timed out 怎么解决？3 种方案实测，附完整排查流程03AI 编程效率翻倍：Superpowers Skills 上手清单 + 完整指南04Qwen3.5-Omni与Qwen3.6模型全面解析（含测评/案例/使用教程）05VMware Workstation Pro 17 虚拟机完整安装教程（2026最新）06Claude Code 未登录 使用第三方模型07Oh My Codex 快速使用指南08UV安装并设置国内源09【技术干货】Gemma 4 上手深度指南：本地多模态大模型的新基线10Claude Code + GLM4.7 避坑指南：解决 Unable to connect to Anthropic services