Deploying Lineaje SCA360

Deploy Lineaje SCA360 through the Lineaje Portal by initiating the deployment and configuring essential settings.

To deploy SCA360 through the Lineaje Portal:

1. Log in to the Lineaje Portal.

2. In the left-hand navigation, select Integrations.

   
3. Under SCA360, click Deploy to Public Cloud, and select Deploy in AWS.

   
4. In the window that appears, from the drop-down menu, choose the AWS Region and click Deploy. You are directed to the latest CloudFormation Stacks page in AWS.

   
5. On the Stacks page, enter the following information:

   • Stack name: The stack identifier. The Stack name is automatically populated.

   • Lineaje Unified Scanner Hub Code: This code is automatically populated.

   • Instance Type: Select c5-xlarge from the drop-down menu. Instance type determines the CPU and Memory allocation for the Lineaje Virtual Machine (VM).

   • VPC ID: Choose your preferred VPC to define the network boundary of your AWS resources. VPC ID must be created prior to deployment. To learn more, see Prerequisites.

   • Subnet ID: Choose a subnet where your resources will be launched within the VPC. Subnet ID must be created prior to deployment. To learn more, see Prerequisites.

   • CIDR IP Range: Enter 0.0.0.0/0. Accesses the VM or EC2 instance to allow access of all IP addresses. To allow a specific IP address access, set CIDR to x.x.x.x/32.

   • Key Pair: Select the Key Pair. Key Pair must be created prior to deployment. To learn more, see Prerequisites.

   • Volume Size of VM: Enter 500 GB. The root volume size for the Lineaje Unified Scanner VM.

   • Discover the ECR Images: Select No from the drop-down menu. To have Lineaje SCA360 scan all images in the current AWS Account and Region, select Yes.

   
6. Under Capabilities, check I acknowledge that that AWS CloudFormation might create IAM resources.

7. Click Create stack. Wait for the stack to complete.

   
8. Under the Resources tab, click on the Physical ID’s link for the stack you just created and click Instant ID.

9. Click Connect.

10. Under the Session Manager tab, click Connect.

You can deploy Lineaje SCA360 in your AWS environment by subscribing to the Lineaje service and creating a stack and then configuring the instance in the Lineaje Portal.

Step 1: Deploying Lineaje SCA360 Through AWS Marketplace

1. Log in to the AWS Marketplace and search for Lineaje SCA360 in the AWS Marketplace products.

   
2. Click on View purchase options and click Subscribe.

   
3. Click Set up your account and enter the details.

   
4. Click Next.

5. Click Deploy to set up SCA360 in your preferred AWS region.

6. On the Stacks page, a pre-filled CloudFormation template is displayed. Enter the following information:

   • VPC ID: Choose your preferred VPC to define the network boundary of your AWS resources. VPC ID must be created prior to deployment. To learn more, see Prerequisites.

   • Subnet ID: Choose a subnet where your resources will be launched within the VPC. Subnet ID must be created prior to deployment. To learn more, see Prerequisites.

   • CIDR IP Range: Enter 0.0.0.0/0. Accesses the VM or EC2 instance to allow access of all IP addresses. To allow a specific IP address access, set CIDR to x.x.x.x/32.

   • Key Pair: Select the Key Pair. Key Pair must be created prior to deployment. To learn more, see Prerequisites.

   
7. Under Capabilities, check I acknowledge that that AWS CloudFormation might create IAM resources.

8. Click Create stack.

Step 2: Configuring Lineaje SCA360 in the Lineaje Portal

1. Log in to the Lineaje Portal.

2. In the left-hand navigation, select Integrations.

3. Click Scan Remotely to create an SBOM by connecting to your relevant SCM or Container Registry. Click Upload and Scan > Upload Manifest File if you want to generate SBOM by uploading a Manifest File.

   
4. To create an SBOM using your GitHub repository:

   1. In Scan Remotely, select GitHub.

   2. In the Details section, enter a name for your integration and enter a GitHub link.

   3. Click Next.

   
5. In the Repositories section, select the tag or branch you want to scan from your GitHub repository and click Save Configuration.

   
6. Under Project Name, click on your project to view the enriched SBOM.

7. Click Actions to download the SBOM.

   

Set up your Windows 11 environment to deploy Lineaje SCA360. Install the required components, configure a virtual machine, and deploy SCA360 using Gitbash.

Step 1: Installing the Required Components

Install the following on your Windows 11 system (use default settings):

• Python 3

• Git Bash

• Oracle VirtualBox

Step 2: Setting Up a Virtual Machine

1. Download the OVA file from the SharePoint link sent to your email address.

2. Open Oracle VirtualBox > File > Import Virtual Application.

3. Select the OVA file and click Finish.

4. After import, go to Settings.

   
5. In the System section, set Base Memory to 4096 MB.

   
6. In the Network section, click on Port Forwarding.

   
7. Create a new rule with the following configuration:

   • Name: SSH

   • Protocol: TCP

   • Host IP: 127.0.0.1

   • Host Port: 2222

   • Guest Port: 22

1. Click OK.

2. Click OK to save the settings. 8. Start the virtual machine. 9. Log in using the following credentials:

   • Username: lineaje

   • Password: lineaje

1. Confirm that the CLI is installed correctly by checking its version.

./veecli --version

Lineaje SCA360 can be deployed in a Kubernetes cluster by running the SCA360 CLI inside a Linux-based pod. A Python-based webhook receiver can run in the deployment to receive scan requests and invoke the SCA360 CLI.

Kubernetes Requirements for SBOM Generation

Storage Requirements

Persistent Scan Storage

The SCA360 scan output directory must be backed by a Kubernetes PersistentVolumeClaim (PVC).

Provision at least 100 GiB of persistent storage for SBOM generation.

For environments performing frequent or high-volume scans, 250 GiB or more is recommended.

Where supported by the Kubernetes environment, use a StorageClass that supports volume expansion so storage capacity can be increased without redesigning the deployment.

Persistent storage ensures scan output remains available if the SCA360 pod is restarted, replaced, or scheduled onto another Kubernetes worker node.

Temporary Storage

The /tmp directory requires at least 40 GiB of writable working space.

This storage is used during scanning and normally does not need to persist after the pod is removed. A disk-backed Kubernetes emptyDir volume can therefore be used for /tmp.

The Kubernetes worker node running the SCA360 pod must have sufficient local ephemeral storage available to support this allocation.

Home Directory

Provide at least 1 GiB of writable storage for /home.

If SCA360 configuration, authentication information, or other CLI state stored under the home directory needs to survive pod recreation, mount persistent storage for /home.

Otherwise, regular writable pod storage can be used.

Resource Allocation

The standard SCA360 Kubernetes deployment uses a single scanner pod configured with:

• 4 vCPU

• 4 GiB RAM

These resources should be requested for the scanner pod so Kubernetes schedules it only onto worker nodes with sufficient available capacity.

Horizontal Scaling

For higher scan throughput or parallel scan execution, SCA360 can be scaled horizontally by running additional scanner pods.

Each additional scanner pod should be allocated:

• 4 vCPU

• 4 GiB RAM

When scaling horizontally, ensure that the Kubernetes cluster has sufficient CPU and memory capacity for all scanner pods.

Persistent storage should also be sized for the increased scan volume. If multiple scanner pods require concurrent access to the same persistent storage, the configured storage backend and PersistentVolume access mode must support concurrent access.

Scan requests should be distributed across the available scanner pods through the Kubernetes deployment and service configuration.

Additional Requirements

The Kubernetes image or pod environment must include:

• SCA360 CLI

• Git

• Python for the webhook receiver

• Any additional language-specific package managers or tools required by the repositories being scanned

The deployment must allow outbound HTTPS traffic over TCP port 443 to the Lineaje backend and any source code repositories or package repositories required during SBOM generation.

The Python webhook receiver can be exposed through a Kubernetes Service according to the customer's network architecture.