Prerequisites

Before you use the PQC assessment tool, complete the following prerequisites:
  • Configure a service account to send reports to AppViewX.
  • Configure how scan reports are sent to AppViewX based on your deployment type:
    • SaaS or managed Kubernetes deployments
      Send reports by using one of the following methods:
      • Use a cloud connector when the scanning environment is in a restricted or private network.
      • Send reports directly to the AppViewX Cloud endpoint over HTTPS (port 443) when outbound connectivity is available.
    • On-premises deployments

      Send reports directly to the AppViewX application by using its configured IP address and port.

Configure Service Account

  1. Login to AppViewX with your valid credentials.
  2. Go to Menu > Platform > Identity > Service Account.
    The Service Account page is displayed, with the complete inventory of all existing service accounts.
  3. From the menu bar, click Add Account.
    The Service Account > Add page is displayed.
  4. In the Account Information section, enter/select the following service account details:
    Feature Description
    *Name Name of service account.
    Authenticate Externally Enable the toggle to authenticate external service account using the client ID.
    Client Id This field is mandatory only when the Authenticate Externally toggle is enabled.

    Enter the external Client ID for authentication.

    When Authenticate Externally is disabled, the Client ID field will be auto-generated after registration.
    Client Secret This field is enabled only when Authenticate Externally toggle is disabled.

    The Client Secret is auto-generated after registration and is masked.

    To view and copy the Client Secret, click the Show/Hide icon.
    Description Brief description of the service account
    *: Mandatory fields
  5. In the Client Secret Settings section, enter/select the following details:
    Note: This section is displayed only if the Authenticate Externally toggle is disabled.
    Feature Description
    *Client Secret Validity (in days) Specifies the number of days for which the generated client secret remains valid
    Enable Secret Expiry Notification When enabled, the system sends notifications to designated users or admins before a client secret expires. Alerts will be sent at intervals of 90, 60, 30, 7, and 1 day(s) before expiry and 1 day after expiry.
    *: Mandatory fields
  6. In the Contact Information section, enter the Email Address for creating the service account.
  7. Click Save.
    The client ID and client secret are generated and displayed on the same page. These details have to be provided while running the code scan and the configuration scan agent.
  8. Assign admin user groups for the created service account, or assign a user group with roles having Quantum Trust Hub ACF permissions.
    For instructions, see Enabling ACF Permissions for the Quantum Trust Hub.

Configure Cloud Connector (Optional)

This section applies only if you use a cloud connector to communicate with AppViewX from a restricted or private network.

Prerequisites

Before you begin, make sure the following requirements are met:
  • At least one cloud connector is available in your tenant.
  • The cloud connector is installed and running.
  • Ensure the cloud connector is running version 2025.0.0.0
    • If your cloud connector is running a different version, upgrade it to version 2025.0.0.0
  • Make sure the Gateway pod is enabled in the cloud connector. If it isn't enabled, see Enable the Gateway pod with the HTTPS profile in the cloud connector.
  • During agent installation, provide the cloud connector hostname if you want to communicate through the cloud connector.

Gateway Configuration

The cloud connector uses an HTTPS gateway to receive scan reports from agents. The default gateway port is 30020.

Before you proceed, make sure the following conditions are met:

  • The gateway is enabled.
  • The gateway HTTPS profile is active.
Note: If you use a load balancer, the port must match the listener port configured on the load balancer.

Verify Gateway with HTTPS Profile

If the cloud connector is already installed, verify that the gateway is enabled.
  1. Navigate to the Cloud Connector (CC) installation directory where the install.sh script is located.
  2. Run the following command and verify that the output is similar to the one shown in the screenshot: 
    ./deps/tools/k3s kubectl get svc -A | grep avx-mid-server-gateway-https

Enable Gateway (If not Enabled)

  1. Navigate to the installation directory where the install.sh script is located in the cloud connector.
  2. Set the following properties in the deps/properties/appviewx.properties file: 
    AUTO_ENROLL_ENABLED=true
ENABLE_HTTPS_PROFILE=true
  3. Navigate back to install.sh script location in same CC installation folder and execute the following commands: 
    deps/tools/k3s kubectl scale deploy avx-mid-server-platform --replicas=0 -n cc
  4. Wait until the platform pod is completely scaled down.
  5. Restart the starter pod using below command to bring up both Gateway and Platform pods: 
    ./avxctl restart starter
    Expected CC downtime: 2–5 minutes.
  6. Verify the gateway is enabled following the instructions given here.