Kubernetes中部署Dependency-Track 并对接 EAuth OIDC 认证

深圳市智易付科技有限责任公司2026-04-08 14:54

Dependency-Track 简介

Dependency-Track 是 OWASP 的持续 SBOM 分析平台，它不是一次性扫描工具，而是"软件供应链风险持续治理平台"，核心能力是：

  1. 接收 CycloneDX SBOM（来自构建流程或供应商）。
  2. 持续分析组件漏洞、许可证和策略风险。
  3. 通过通知与集成，把风险结果推送到研发与安全流程。

OIDC认证能力支持

Dependency-Track支持使用第三方OIDC认证，同时能够通过令牌中的groups信息实现Dependency-Track中不同项目的权限控制，这样能够简化Dependency-Track对用户的管理

Dependency-Track部署

本文通过kube-keeper来部署，首先通过kube-keeper创建两个命名空间，一个为dtrack用于部署dependency-track，另一个为postgres用于部署数据库postgres

  1. eauth中应用创建dependency-track应用，其中的回调地址为dtrack.efucloud.com//static/oid...
  2. 如果使用集群外的数据库则不需要创建命名空间postgres和部署postgres服务
yaml 复制代码 
---
# Source: dependency-track/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dtrack-dependency-track
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
  annotations: {}
automountServiceAccountToken: false
---
# Source: custom/database-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: dtrack-database-secret
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/component: api-server
type: Opaque
stringData:
  ALPINE_DATABASE_USERNAME: postgres
  ALPINE_DATABASE_PASSWORD: EfuCloud@pwd
---
# Source: dependency-track/templates/api-server/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: dtrack-dependency-track-api-server
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
    app.kubernetes.io/version: 4.14.0
spec:
  type: "ClusterIP"
  ports:
    - name: web
      port: 8080
      targetPort: web
  selector:
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
---
# Source: dependency-track/templates/frontend/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: dtrack-dependency-track-frontend
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track

    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
    app.kubernetes.io/version: 4.14.0
spec:
  type: "ClusterIP"
  ports:
    - name: web
      port: 8080
      targetPort: web
  selector:
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
---
# Source: dependency-track/templates/api-server/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dtrack-dependency-track-api-server
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track

    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-api-server
    app.kubernetes.io/component: api-server
    app.kubernetes.io/version: 4.14.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: dtrack
      app.kubernetes.io/name: dependency-track-api-server
      app.kubernetes.io/component: api-server
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: dtrack
        app.kubernetes.io/name: dependency-track-api-server
        app.kubernetes.io/component: api-server
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: /metrics
    spec:
      enableServiceLinks: true
      initContainers:
      serviceAccountName: dtrack-dependency-track
      securityContext:
        fsGroup: 1000
      containers:
        - name: dependency-track-api-server
          image: registry.cn-shenzhen.aliyuncs.com/efucloud-public/dependencytrack-apiserver:4.14.0
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          resources:
            limits:
              memory: 5Gi
            requests:
              cpu: "1"
              memory: 1Gi
          env:
            - name: ALPINE_METRICS_ENABLED
              value: "true"
            - name: ALPINE_DATABASE_MODE
              value: "external"
            - name: ALPINE_DATABASE_URL
              value: "jdbc:postgresql://postgres.postgres.svc.cluster.local:5432/dependencytrack"
            - name: ALPINE_DATABASE_DRIVER
              value: "org.postgresql.Driver"
            - name: ALPINE_DATABASE_USERNAME
              valueFrom:
                secretKeyRef:
                  name: dtrack-database-secret
                  key: ALPINE_DATABASE_USERNAME
            - name: ALPINE_DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: dtrack-database-secret
                  key: ALPINE_DATABASE_PASSWORD
            # OIDC configuration placeholders (fill values as needed)
            - name: ALPINE_OIDC_ENABLED
              value: "true"
            - name: ALPINE_OIDC_CLIENT_ID
              value: "rot7giyv32yy5kkfpmemvlu56"
            - name: ALPINE_OIDC_ISSUER
              value: "https://eauth-demo.efucloud.com"
            - name: ALPINE_OIDC_USERNAME_CLAIM
              value: "username"
            - name: ALPINE_OIDC_USER_PROVISIONING
              value: "true"
            - name: ALPINE_OIDC_TEAM_SYNCHRONIZATION
              value: "false"
            - name: ALPINE_OIDC_TEAMS_CLAIM
              value: "groups"
            - name: ALPINE_OIDC_TEAMS_DEFAULT
              value: "Administrators"
          ports:
            - name: web
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: data
              mountPath: /data
            - name: tmp
              mountPath: /tmp
          startupProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/started
            failureThreshold: 30
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/live
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /health/ready
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: data
          emptyDir: {}
        - name: tmp
          emptyDir: {}
---
# Source: dependency-track/templates/frontend/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dtrack-dependency-track-frontend
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
    app.kubernetes.io/name: dependency-track-frontend
    app.kubernetes.io/component: frontend
    app.kubernetes.io/version: 4.14.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: dtrack
      app.kubernetes.io/name: dependency-track-frontend
      app.kubernetes.io/component: frontend
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: dtrack
        app.kubernetes.io/name: dependency-track-frontend
        app.kubernetes.io/component: frontend
    spec:
      enableServiceLinks: true
      initContainers:
      serviceAccountName: dtrack-dependency-track
      securityContext:
        fsGroup: 1000
      containers:
        - name: dependency-track-frontend
          image: registry.cn-shenzhen.aliyuncs.com/efucloud-public/dependencytrack-frontend:4.14.0
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 150m
              memory: 64Mi
          env:
            - name: API_BASE_URL
              value: ""
            # OIDC configuration placeholders (fill values as needed)
            - name: OIDC_ISSUER
              value: "https://eauth-demo.efucloud.com"
            - name: OIDC_CLIENT_ID
              value: "rot7giyv32yy5kkfpmemvlu56"
            - name: OIDC_SCOPE
              value: "openid profile email"
            - name: OIDC_FLOW
              value: ""
            - name: OIDC_LOGIN_BUTTON_TEXT
              value: ""
          ports:
            - name: web
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          livenessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              scheme: HTTP
              port: web
              path: /
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 15
            successThreshold: 1
            timeoutSeconds: 5
      volumes:
        - name: tmp
          emptyDir: {}
---
# Source: custom/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dtrack-dependency-track
  namespace: dtrack
  labels:
    app.kubernetes.io/part-of: dependency-track
    app.kubernetes.io/instance: dtrack
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - dtrack.efucloud.com
      secretName: dtrack-tls
  rules:
    - host: dtrack.efucloud.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: dtrack-dependency-track-api-server
                port:
                  number: 8080
          - path: /
            pathType: Prefix
            backend:
              service:
                name: dtrack-dependency-track-frontend
                port:
                  number: 8080

Dependency-Track访问

  1. 浏览器打开dtrack.efucloud.com/ ，点击更多的选择，先使用admin/admin登录，若直接使用OIDC登录则会出现下图的情形。

配置完成后，使用oidc登录后的页面如下

相关推荐
LONGZETECH1 小时前
一线职教实测：风光 580 汽车故障诊断仿真系统，破解实车实训四大核心痛点
人工智能·学习·安全·架构·汽车
Mikko71 小时前
jackson-databind 升到 2.21.6 就安全了吗?jackson-core 是另一个坐标,它那条 high 全局库至今没收
java·后端·安全·json
赛博守夜人1 小时前
反舞弊系列之十四：商业地产与零售招商中的“转租差价与免租期寻租”
安全
xiaoqiMikko2 小时前
你升的是 jackson-databind,中招的是 jackson-core:一个超长 JSON key 就能吃掉 200MB 堆
java·安全
程序员若风3 小时前
CSRF攻击原理介绍和利用-腾讯云开发者社区
前端·网络·安全·web安全·网络安全·csrf攻击·腾讯云开发者社区
Jialu.4 小时前
第7篇：舆情预警系统：三类规则引擎 + 飞书/钉钉 Webhook 通知
python·安全
红姐跨境书12 小时前
从零打造高性能 API 网关： Go 语言中的双缓冲 Dynamic Config 最佳实践
安全
迪康Defender17 小时前
终端安全实战：如何高效解决企业U盘泄密与管控难题
运维·网络·安全·web安全·终端安全管理
网安小学生（兼顾数据库版）18 小时前
固件+软件供应链：ONEKEY+Mend如何实现全链路安全覆盖
网络·安全·web安全
珠海西格电力19 小时前
零碳园区管理系统“智慧大脑”功能对园区运营成本的影响有哪些？
大数据·人工智能·安全·系统架构·能源
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02历年考研数学一、数学二、数学三真题试卷及答案PDF03蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接04GitHub 镜像站点05微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新062026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？07人工智能（AI）发展史：详细里程碑08ZCode 周末送额度活动开启：3 亿 Token 免费领取09Telegram APK 下载安装完整指南 — 2026年最新102026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享