Chapter 2. Manually upgrading using the roxctl CLI

Prerequisites

• If you deploy images from a private image registry, first push the new image into your private registry, and then replace your image registry for the commands in this section.

Procedure

• Run the following commands to upgrade Central:

  $ oc -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}' 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  $ oc -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}' 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  $ oc -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.70.2 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  Important

  • If you are upgrading from Red Hat Advanced Cluster Security for Kubernetes 3.65.0, you must run the following additional command to create the stackrox-central-diagnostics role:

    $ oc -n stackrox patch role stackrox-central-diagnostics -p '{"rules":[{"apiGroups":["*"],"resources":["deployments","daemonsets","replicasets","configmaps","services"],"verbs":["get","list"]}]}' 1

    1

    If you use Kubernetes, enter kubectl instead of oc.

  • If you have not installed Red Hat Advanced Cluster Security for Kubernetes by using Helm or Operator, and you want to enable authentication using the OpenShift OAuth server, you must run the following additional command:

    $ oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true

    $ oc -n stackrox patch serviceaccount/central -p '
    {
    "metadata": {
    "annotations": {
    "serviceaccounts.openshift.io/oauth-redirecturi.main": "sso/providers/openshift/callback",
    "serviceaccounts.openshift.io/oauth-redirectreference.main": "{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"central"}}"
    }
    }
    }'

Verification

• Check that the new pods have deployed:

  $ oc get deploy -n stackrox -o wide 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  $ oc get pod -n stackrox --watch 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

Prerequisites

• If you deploy images from a private image registry, first push the new image into your private registry, and then replace your image registry for the commands in this section.
• If you used Red Hat UBI-based images when you installed Red Hat Advanced Cluster Security for Kubernetes, replace the image names for the commands in this section with the following UBI-based image names:

• If you have created custom scanner configurations, you must apply those changes before updating the scanner configuration file:

  $ roxctl -e "$ROX_CENTRAL_ADDRESS" scanner generate

  $ oc apply -f scanner-bundle/scanner/02-scanner-03-tls-secret.yaml 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  $ oc apply -f scanner-bundle/scanner/02-scanner-04-scanner-config.yaml 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

Verification

• Check that the new pods have deployed successfully:

  $ oc get pod -n stackrox --watch 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

Procedure

• Check the Central logs:

  $ oc logs -n stackrox deploy/central -c central 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  If the upgrade is successful, you will see output similar to the following:

  No database restore directory found (this is not an error).
  Migrator: 2019/10/25 17:58:54: starting DB compaction
  Migrator: 2019/10/25 17:58:54: Free fraction of 0.0391 (40960/1048576) is < 0.7500. Will not compact
  badger 2019/10/25 17:58:54 INFO: All 1 tables opened in 2ms
  badger 2019/10/25 17:58:55 INFO: Replaying file id: 0 at offset: 846357
  badger 2019/10/25 17:58:55 INFO: Replay took: 50.324µs
  badger 2019/10/25 17:58:55 DEBUG: Value log discard stats empty
  Migrator: 2019/10/25 17:58:55: DB is up to date. Nothing to do here.
  badger 2019/10/25 17:58:55 INFO: Got compaction priority: {level:0 score:1.73 dropPrefix:[]}
  version: 2019/10/25 17:58:55.189866 ensure.go:49: Info: Version found in the DB was current. We’re good to go!

Procedure

• Update the readiness probe path:

  $ oc -n stackrox patch deploy/sensor -p '{"spec":{"template":{"spec":{"containers":[{"name":"sensor","readinessProbe":{"httpGet":{"path":"/ready"}}}]}}}}' 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

Procedure

• Red Hat Advanced Cluster Security for Kubernetes 3.64.0 renames the SCCs. If you are upgrading from a version below Red Hat Advanced Cluster Security for Kubernetes 3.64.0, you must delete and reapply the SCCs, otherwise, skip this step:

  1. Run the following commands to update Central:

     $ oc apply -f - <<EOF
     kind: SecurityContextConstraints
     apiVersion: security.openshift.io/v1
     metadata:
       name: stackrox-central
       labels:
         app.kubernetes.io/name: stackrox
       annotations:
         kubernetes.io/description: stackrox-central is the security constraint for the central server
         email: support@stackrox.com
         owner: stackrox
     allowHostDirVolumePlugin: false
     allowedCapabilities: []
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     defaultAddCapabilities: []
     fsGroup:
       type: MustRunAs
       ranges:
         - max: 4000
           min: 4000
     priority: 0
     readOnlyRootFilesystem: true
     requiredDropCapabilities: []
     runAsUser:
       type: MustRunAs
       uid: 4000
     seLinuxContext:
       type: MustRunAs
     seccompProfiles:
       - '*'
     users:
       - system:serviceaccount:stackrox:central
     volumes:
       - '*'
     EOF

     $ oc delete scc central

  2. Run the following commands to update Scanner:

     $ oc apply -f - <<EOF
     kind: SecurityContextConstraints
     apiVersion: security.openshift.io/v1
     metadata:
       name: stackrox-scanner
       labels:
         app.kubernetes.io/name: stackrox
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-scanner is the security constraint for the Scanner container
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     users:
       - system:serviceaccount:stackrox:scanner
     volumes:
       - '*'
     allowHostDirVolumePlugin: false
     allowedCapabilities: []
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     defaultAddCapabilities: []
     fsGroup:
       type: RunAsAny
     readOnlyRootFilesystem: false
     requiredDropCapabilities: []
     EOF

     $ oc delete scc scanner

  3. Run the following commands on each OpenShift Secured Cluster:

     $ oc apply -f - <<EOF
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-admission-control
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-admission-control is the security constraint for the admission controller
     users:
       - system:serviceaccount:stackrox:admission-control
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     fsGroup:
       type: RunAsAny
     groups: []
     readOnlyRootFilesystem: true
     allowHostDirVolumePlugin: false
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - secret
     ---
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-collector
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: This SCC is based on privileged, hostaccess, and hostmount-anyuid
     users:
       - system:serviceaccount:stackrox:collector
     allowHostDirVolumePlugin: true
     allowPrivilegedContainer: true
     fsGroup:
       type: RunAsAny
     groups: []
     priority: 0
     readOnlyRootFilesystem: true
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: true
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - hostPath
       - secret
     ---
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-sensor
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-sensor is the security constraint for the sensor
     users:
       - system:serviceaccount:stackrox:sensor
       - system:serviceaccount:stackrox:sensor-upgrader
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     fsGroup:
       type: RunAsAny
     groups: []
     readOnlyRootFilesystem: true
     allowHostDirVolumePlugin: false
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: true
     allowPrivilegedContainer: false
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - secret
     EOF

     $ oc delete scc admission-control collector sensor

Procedure

• Check that the new pods have deployed:

  $ oc get deploy,ds -n stackrox -o wide 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

  $ oc get pod -n stackrox --watch 1

  1

  If you use Kubernetes, enter kubectl instead of oc.

Prerequisites

• You must be using Red Hat Advanced Cluster Security for Kubernetes 3.0.57.0 or higher.
• Before you can perform a rollback, you must have free disk space available on your persistent storage. Red Hat Advanced Cluster Security for Kubernetes uses disk space to keep a copy of databases during the upgrade. If the disk space is not enough to store a copy and the upgrade fails, you will not be able to roll back to an earlier version.

Procedure

• Run the following command to roll back to a previous version when an upgrade fails (before the Central service starts):

  $ oc -n stackrox rollout undo deploy/central 1

  1

  If you use Kubernetes, enter kubectl instead of oc.