Breadcrumbs

Add a New Scan Node

Scan nodes are asynchronous, stateless worker nodes subscribing to Kafka topics to get scan requests, execute the scan, and publish data back to Kafka. Scan nodes only run HAProxy and Scheduler services.

If you want to decouple or distribute scan operations on separate nodes, you can provision one or more scan nodes and run the following installation steps on each scan node. Scan nodes use env.backend-1 file for configuration.

Prerequisites

Prior to installing a new scan node, users will need the following:

Directory Path References

Directory Path Variables

There are two referenced directory locations in these instructions:

  1. installer_dir: the location where the unzipped install files reside, including all installation scripts and supporting files.

  2. agilesec_install_dir: the location where AgileSec will be installed to.

Export these as bash variables to easily copy and paste guide instructions:

export installer_dir=</path/to/installer>
export agilesec_install_dir=</path/to/installation>

Step 1: From backend-1 Copy Certificates and Configuration to Scan Node

From backend-1:

Java
scp $installer_dir/certificates/kf-agilesec.internal-certs.tgz \
  $SN-1_IP:$installer_dir/certificates

[Optional] Using your own certificates

If you are using your own certificates, perform the following steps:

  • Copy your CA cert chain to <installation_directory>/certificates/ca

  • Copy server and client certificates to <installation_directory>/certificates/<analytics_internal_domain> .

  • Certificate filenames must match those listed under Certificate Requirements.

Step 2: Install Scan Node

From Scan Node:

Java
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz

cp env.backend-1 ../.env

cd ../
sudo ./scripts/tune.sh -u ec2-user -r scan
./install_analytics.sh install -u ec2-user -p $agilesec_install_dir -r scan

Note: Both tune.sh and install_analytics.sh require the special flag -r scan for scan node installations.

Once you have one or more scan nodes, you have the option to permanently disable the Scheduler service on backend-1 and backend-2.

cd $agilesec_install_dir
./scripts/manage.sh stop scheduler