Chapter 5. Installing by using the roxctl CLI

Procedure

1. Download the latest version of the roxctl CLI:

   $ curl -O https://mirror.openshift.com/pub/rhacs/assets/3.70.2/bin/Darwin/roxctl

2. Remove all extended attributes from the binary:

   $ xattr -c roxctl

3. Make the roxctl binary executable:

   $ chmod +x roxctl

4. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   $ echo $PATH

Procedure

1. Run the interactive install command:

   $ roxctl central generate interactive

2. Press Enter to accept the default value for a prompt or enter custom values as required.

   Enter path to the backup bundle from which to restore keys and certificates (optional):
   Enter PEM cert bundle file (optional): 1
   Enter administrator password (default: autogenerated):
   Enter orchestrator (k8s, openshift): openshift
   Enter the directory to output the deployment bundle to (default: "central-bundle"):
   Enter the OpenShift major version (3 or 4) to deploy on (default: "0"): 4
   Enter Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional):
   Enter the method of exposing Central (route, lb, np, none) (default: "none"): route 2
   Enter main image to use (default: "stackrox.io/main:3.0.61.1"):
   Enter whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"):
   Enter whether to enable telemetry (default: "true"):
   Enter the deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"):
   Enter Scanner DB image to use (default: "stackrox.io/scanner-db:2.15.2"):
   Enter Scanner image to use (default: "stackrox.io/scanner:2.15.2"):
   Enter Central volume type (hostpath, pvc): pvc 3
   Enter external volume name (default: "stackrox-db"):
   Enter external volume size in Gi (default: "100"):
   Enter storage class name (optional if you have a default StorageClass configured):

   1

   If you want to add a custom TLS certificate, provide the file path for the PEM-encoded certificate. When you specify a custom certificate the interactive installer also prompts you to provide a PEM private key for the custom certificate you are using.

   2

   To use the RHACS portal, you must expose Central by using a route, a load balancer or a node port.

   3

   If you plan to install Red Hat Advanced Cluster Security for Kubernetes on OpenShift Container Platform with a hostPath volume, you must modify the SELinux policy.

   Warning

   On OpenShift Container Platform, for using a hostPath volume, you must modify the SELinux policy to allow access to the directory, which the host and the container share. It is because SELinux blocks directory sharing by default. To modify the SELinux policy, run the following command:

   $ sudo chcon -Rt svirt_sandbox_file_t <full_volume_path>

   However, Red Hat does not recommend modifying the SELinux policy, instead use PVC when installing on OpenShift Container Platform.

Procedure

1. Run the setup.sh script to configure image registry access:

   $ ./central-bundle/central/scripts/setup.sh

2. Create the necessary resources:

   $ oc create -R -f central-bundle/central

3. Check the deployment progress:

   $ oc get pod -n stackrox -w

4. After Central is running, find the RHACS portal IP address and open it in your browser. Depending on the exposure method you selected when answering the prompts, use one of the following methods to get the IP address.

   Exposure method	Command	Address	Example
   Route	oc -n stackrox get route central	The address under the HOST/PORT column in the output	https://central-stackrox.example.route
   Node Port	oc get node -owide && oc -n stackrox get svc central-loadbalancer	IP or hostname of any node, on the port shown for the service	https://198.51.100.0:31489
   Load Balancer	oc -n stackrox get svc central-loadbalancer	EXTERNAL-IP or hostname shown for the service, on port 443	https://192.0.2.0
   None	central-bundle/central/scripts/port-forward.sh 8443	https://localhost:8443	https://localhost:8443