Chapter 3. Manually upgrading using the roxctl CLI

Procedure

1. Patch the local role:

   $ oc -n stackrox patch role edit -p '{"rules":[{"apiGroups":["*"],"resources":["*"],"verbs":["create","get", "list", "watch", "update", "patch", "delete","deletecollection"]}]}'

   Copy to Clipboard Toggle word wrap

2. Cleanup existing roles and role bindings:

   $ oc -n stackrox delete RoleBinding admission-control-use-scc || true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox delete RoleBinding sensor-use-scc || true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox delete Role use-anyuid-scc || true

   Copy to Clipboard Toggle word wrap

3. Set sensor and admission-control to restricted[-v2] security context constraints by removing the hard-coded security context:

   $ oc -n stackrox patch deploy sensor -p '{"spec":{"template":{"spec":{"securityContext":null}}}}' 

   1

   Copy to Clipboard Toggle word wrap

   1

   Red Hat Advanced Cluster Security for Kubernetes recreates the pods automatically, however, sensor can take some time to restart.

   $ oc -n stackrox patch deploy admission-control -p '{"spec":{"template":{"spec":{"securityContext":null}}}}'

   Copy to Clipboard Toggle word wrap

4. Run the following commands to upgrade Central:

   $ oc -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.74.9 

   1

   Copy to Clipboard Toggle word wrap

   1

   If you deploy images from a private image registry, push the new image into your private registry, and replace the image registry address here.

   Important

   If you have not installed Red Hat Advanced Cluster Security for Kubernetes by using Helm or Operator, and you want to enable authentication using the OpenShift OAuth server, you must run the following additional commands:

   $ oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox patch serviceaccount/central -p '
   {
   "metadata": {
   "annotations": {
   "serviceaccounts.openshift.io/oauth-redirecturi.main": "sso/providers/openshift/callback",
   "serviceaccounts.openshift.io/oauth-redirectreference.main": "{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"central"}}"
   }
   }
   }'

   Copy to Clipboard Toggle word wrap

Procedure

1. Patch the local role:

   $ kubectl -n stackrox patch role edit -p '{"rules":[{"apiGroups":["*"],"resources":["*"],"verbs":["create","get", "list", "watch", "update", "patch", "delete","deletecollection"]}]}'

   Copy to Clipboard Toggle word wrap

2. Run the following commands to upgrade Central:

   $ kubectl -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ kubectl -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ kubectl -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.74.9 

   1

   Copy to Clipboard Toggle word wrap

   1

   If you deploy images from a private image registry, push the new image into your private registry, and replace the image registry address here.

Procedure

1. Download the latest version of the roxctl CLI:

   $ curl -O https://mirror.openshift.com/pub/rhacs/assets/3.74.9/bin/Linux/roxctl

   Copy to Clipboard Toggle word wrap

2. Make the roxctl binary executable:

   $ chmod +x roxctl

   Copy to Clipboard Toggle word wrap

3. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

Procedure

1. Download the latest version of the roxctl CLI:

   $ curl -O https://mirror.openshift.com/pub/rhacs/assets/3.74.9/bin/Darwin/roxctl

   Copy to Clipboard Toggle word wrap

2. Remove all extended attributes from the binary:

   $ xattr -c roxctl

   Copy to Clipboard Toggle word wrap

3. Make the roxctl binary executable:

   $ chmod +x roxctl

   Copy to Clipboard Toggle word wrap

4. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

Procedure

1. Apply the patch:

   • If you use OpenShift Container Platform, enter the following command:

     $ oc -n stackrox patch deployment.apps/scanner-db --patch '{"spec":{"template":{"spec":{"initContainers":[{"name":"init-db","env":[{"name":"POSTGRES_PASSWORD_FILE","value":"/run/secrets/stackrox.io/secrets/password"}],"command":["/usr/local/bin/docker-entrypoint.sh","postgres","-c","config_file=/etc/postgresql.conf"],"volumeMounts":[{"name":"db-data","mountPath":"/var/lib/postgresql/data"},{"name":"scanner-db-tls-volume","mountPath":"/run/secrets/stackrox.io/certs","readOnly":true},{"name":"scanner-db-password","mountPath":"/run/secrets/stackrox.io/secrets","readOnly":true}],"securityContext":{"runAsGroup":70,"runAsNonRoot":true,"runAsUser":70}}]}}}}'

     Copy to Clipboard Toggle word wrap

   • If you use Kubernetes, enter the following command:

     $ kubectl -n stackrox patch deployment.apps/scanner-db --patch '{"spec":{"template":{"spec":{"initContainers":[{"name":"init-db","env":[{"name":"POSTGRES_PASSWORD_FILE","value":"/run/secrets/stackrox.io/secrets/password"}],"command":["/usr/local/bin/docker-entrypoint.sh","postgres","-c","config_file=/etc/postgresql.conf"],"volumeMounts":[{"name":"db-data","mountPath":"/var/lib/postgresql/data"},{"name":"scanner-db-tls-volume","mountPath":"/run/secrets/stackrox.io/certs","readOnly":true},{"name":"scanner-db-password","mountPath":"/run/secrets/stackrox.io/secrets","readOnly":true}],"securityContext":{"runAsGroup":70,"runAsNonRoot":true,"runAsUser":70}}]}}}}'

     Copy to Clipboard Toggle word wrap

2. Remove the path:

   • If you use OpenShift Container Platform, enter the following command:

     $ oc -n stackrox patch deployment.apps/scanner-db --type json --patch '[{"op":"remove","path":"/spec/template/spec/containers/0/volumeMounts/2"}]'

     Copy to Clipboard Toggle word wrap

   • If you use Kubernetes, enter the following command:

     $ kubectl -n stackrox patch deployment.apps/scanner-db --type json --patch '[{"op":"remove","path":"/spec/template/spec/containers/0/volumeMounts/2"}]'

     Copy to Clipboard Toggle word wrap