This is a Helm Chart to deploy the Snyk Universal Broker.

• Helm 3.8.0 or newer
• (Optionally) the helm-sigstore Helm plugin, or cosign

Universal Broker requires outbound communication via TLS to the following domains (or your regional equivalent):

• https://api.snyk.io
• https://app.snyk.io
• https://broker.snyk.io

If a proxy, firewall, or other network appliance sits between Broker and the public internet, ensure:

• the above domains are whitelisted, and
• the proxy, firewall or other network appliance supports the websockets protocol

Pull the Helm Chart, and provide any configuration necessary:

helm pull oci://registry-1.docker.io/snyk/snyk-universal-broker

The Helm Chart for Snyk Universal Broker is signed with cosign. Optionally validate the Helm Chart with the following methods.

Replace x.y.z with the value of the tag:

cosign verify snyk/snyk-universal-broker:x.y.z \
  --certificate-identity-regexp="https://github.com/snyk/snyk-universal-broker-helm/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

Replace @sha256:... with the digest of the tag:

cosign verify snyk/snyk-universal-broker@sha256:... \
  --certificate-identity-regexp="https://github.com/snyk/snyk-universal-broker-helm/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

If required, specify your Snyk Region by entering the url fragment between app and snyk.io into region. For example, to set the Universal Broker to connect to SNYK-EU-01:

region: "eu"

Any Credential References (refer to the example provided on docs.snyk.io) must be provided to the Universal Broker. This can be achieved directly through Helm, or via an external Kubernetes Secret.

For the following example, assume three credential references are created of the following deployment_credential types:

• github
• gitlab
• azure-repos

An example data object is shown for the github type.

{
  ...
  "data":{
    "id": "uuidv4",
    "type": "deployment_credential",
    "attributes": {
      "comment": "",
      "deployment_id": "uuidv4",
      "environment_variable_name": "MY_GITHUB_TOKEN",
      "type": "github"
    }
  }
}

The number of credential references will depend on the type of the deployment_credential; github holds just one (the GitHub PAT), whilst azure-repos holds three (the Azure Repos Org, Username and Password)

Provide the environment variable used when creating the credential reference, and the actual value of your credential.

For example, providing the Universal Broker with a GitHub, GitLab and Azure Repos credential:

credentialReferences:
  MY_GITHUB_TOKEN: <your-github-token>
  MY_GITLAB_TOKEN: <your-gitlab-token>
  AZURE_REPOS_PRODSEC_ORG: prodsec
  AZURE_REPOS_PRODSEC_USERNAME: <your-azure-repos-username>
  AZURE_REPOS_PRODSEC_PASSWORD: <your-azure-repos-password>

The Universal Broker Helm Chart creates this secret for you.

First create or otherwise ensure the secret exists:

kind: Secret
apiVersion: v1
metadata:
  name: my-universal-broker-secrets
data:
  MY_GITHUB_TOKEN: <your-github-token>
  ...

Then set values within .Values.credentialReferencesSecret that match your external Secret:

credentialReferencesSecret:
  name: my-universal-broker-secrets

By default, Universal Broker provides a ClusterIP Service. This can be adjusted to a LoadBalancer, NodePort as best fits the deployment environment.

Universal Broker provides an Ingress template, compatible with any Kubernetes Ingress controller.

It may be extended with additional hosts, paths, annotations as required.

Universal Broker will run with High Availability Mode enabled by default. Optionally increase the number of replicas from 2 up to 4 to suit fault tolerance.

High Availability Mode may be disabled by setting highAvailabilityMode.enabled: false.

Review documentation on docs.snyk.io for a list of checks executed by the Universal Broker at startup.

If any of these checks are failing, it may indicate a misconfiguration.

The Universal Broker log level is set to "INFO" by default. All responses, regardless of HTTP status code, are logged by the Universal Broker.

Additional logging is available:

• For verbose request logging (including headers), set logVerbose: true. This provides additional information without enabling DEBUG logs.
• For debug-level logging, set logLevel: "debug".

Note: Some logs may capture sensitive information like credentials. If using increased logging to provide Universal Broker logs to Snyk, check for credentials and redact before transmission.

• 401 or 403 error codes indicate credentials are not valid for the integration.
• References to SSL or leaf certificate indicate a self-signed certificate is not trusted by Broker. Refer to steps in Certificate Trust.

To use Universal Broker behind a proxy, set:

• .Values.httpsProxy to the Proxy URL - this may contain username/password authentication if required
• .Values.noProxy to any URLs that should not transit the Proxy - this may include internal registries, SCMs, or other systems Broker may interact with.

Other authentication methods are not supported.

Certificate Authority material may be provided directly to Universal Broker in the Helm Chart, or referenced to an external secret.

If providing directly to Helm, set .Values.caCert to the full trust chain necessary (this may be multiple certificates) for your Certificate Authority in PEM format as a string.

caCert: |-
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----

The Universal Broker Helm Chart creates this secret for you.

First create or otherwise ensure the secret exists:

kind: Secret
apiVersion: v1
metadata:
  name: ca-certificate
data:
  ca.pem: -----BEGIN CERTIFICATE-----.....

Then set values within .Values.caCertSecret that match your external Secret:

caCertSecret:
  name: ca-certificate
  caCertKey: ca.pem

Set .Values.disableAllCertificateTrust to true. Broker will no longer validate any certificates, including those issued by public Certificate Authorities.

The Universal Broker Helm Chart will pull directly from DockerHub by default. Using the pull command for your private container registry as reference, set image.registry to the domain of your registry, and image.repository to the internal repository the Broker image will be available from.

For example, this might be:

image:
  registry: containers.company
  repository: docker/broker

Set .Values.image.pullSecrets if the custom image registry requires authentication. The Universal Broker Helm Chart will reference a pre-existing secret; it will not create one. Multiple secrets may be specified.

image:
  registry: containers.company
  repository: docker/broker
  imagePullSecrets:
    - name: containers-company-secret

Snyk Broker commit signing is in Early Access. If you would like to use this feature, contact your Snyk representative or team.

This feature requires a GitHub Account that has a GPG key configured for commit signing.

Provide the GPG key (exported as an ASCII armored version), the passphrase, and associated email/user:

commitSigning:
  name: "Account Name"
  email: "[email protected]"
  passphrase: "passphrase"
  gpgPrivateKey: -----BEGIN PGP PRIVATE KEY BLOCK-----\n....\n-----END PGP PRIVATE KEY BLOCK-----

The Universal Broker Helm Chart creates this secret for you.

First create or otherwise ensure the secret exists:

kind: Secret
apiVersion: v1
metadata:
  name: gpg-signing-key
data:
  GPG_PRIVATE_KEY: "-----BEGIN PRIVATE KEY BLOCK-----..."
  GPG_PASSPRHASE: "passphrase"
  GIT_COMMITTER_EMAIL: "[email protected]"
  GIT_COMMITTER_NAME: "User Name"

The keys must match the example above.

Then set values within .Values.commitSigningSecret to reference this external Secret:

commitSigning:
  enabled: true
commitSigningSecret:
  name: gpg-signing-key

Commit signing is enabled if the following entry appears in Universal Broker logs at startup:

loading commit signing rules (enabled=true, rulesCount=5)

Optionally provide a certificate and key to run Broker behind TLS. This may be useful if an Ingress is not used.

localWebServer:
  https: true
  certificate: "-----BEGIN CERTIFICATE-----\nYOUR CERTIFICATE HERE\n-----END CERTIFICATE-----"
  key: "-----BEGIN PRIVATE KEY-----\nYOUR KEY HERE\n-----END PRIVATE KEY-----"

The Universal Broker Helm Chart creates this secret for you.

First create or otherwise ensure the secret exists:

kind: Secret
apiVersion: v1
metadata:
  name: broker-tls
type: kubernetes.io/tls
data:
  tls.crt: "-----BEGIN PRIVATE CERTIFICATE-----\nYOUR CERTIFICATE HERE\n-----END CERTIFICATE-----"
  tls.key: "-----BEGIN PRIVATE KEY-----\nYOUR KEY HERE\n-----END PRIVATE KEY-----"

Note: This is of type kubernetes.io/tls. If using another format, the keys must match the example above.

THen set values within localWebServerSecret to reference this external Secret:

localWebServerSecret:
  name: broker-tls

Universal Broker will communicate with any downstream systems via HTTPS by default.

In some situations http only traffic is required. This mode is not recommended as credentials/data will be transmitted to downstream systems unencrypted.

Snyk will not be held responsible for any credential leaks that may occur as a result of the use of insecure downstream mode.

Enable by setting insecureDownstream: true.

Use the Additional Objects values to add ConfigMaps, Secrets, Sidecars, initContainers, Volumes and VolumeMounts to the Universal Broker.

Use extraEnvVars to add arbitrary environment variables directly in Helm:

extraEnvVars:
  - MY_ENV_VAR: myvalue

Note: Check for duplicate environment variables.

Refer to documentation via docs.snyk.io to obtain deploymentId, clientId, clientSecret values.

Credential References should contain one or more key/value pairs where each key matches the environment_variable_name of a deployment_credential, and the value provides the secret. For example:

helm install ... --set credentialReferences.MY_GITHUB_TOKEN=<gh-pat>