Operating

Procedure

1. Navigate to the RHACS portal and open the compliance dashboard by selecting Compliance from the navigation menu.
2. On the compliance dashboard, look for the Passing standards by cluster widget.
3. In this widget, click on a standard to view information about all the controls associated with that standard.

Procedure

1. Navigate to the RHACS portal and open the compliance dashboard by selecting Compliance from the navigation menu.
2. On the compliance dashboard, look for the Passing standards by cluster widget.
3. In this widget, click on a standard to view information about all the controls associated with that standard.
4. From the Controls table, click on a control. A side panel opens on the right.
5. In the side panel, click on the name of the control to view its details.

Procedure

1. In the RHACS portal, select Risk from the navigation menu.
2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
3. In the Deployment details panel, select the Process Discovery tab.
4. The process baselines are visible under the Spec Container Baselines section.

Procedure

1. In the RHACS portal, select Risk from the navigation menu.
2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
3. In the Deployment details panel, select the Process Discovery tab.
4. Under the Running Processes section, click the Add icon for the process you want to add to the process baseline.

Procedure

1. In the RHACS portal, select Risk from the navigation menu.
2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
3. In the Deployment details panel, select the Process Discovery tab.
4. Under the Spec Container baselines section, click the Remove icon for the process you want to remove from the process baseline.

Procedure

1. In the RHACS portal, select Risk from the navigation menu.
2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
3. In the Deployment details panel, select the Process Discovery tab.

4. Under the Spec Container baselines section:

   • Click the Lock icon to trigger violations for processes that are not in the baseline.
   • Click the Unlock icon to stop triggering violations for processes that are not in the baseline.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Policies.

2. Disable enforcement on the default policies:

   • In the policies view, scroll down and select the power icon next to the Kubernetes Actions: Exec into Pod policy to disable that policy.
   • In the policies view, scroll down and select the power icon next to the Kubernetes Actions: Port Forward to Pod policy to disable that policy.
3. Disable enforcement on any other custom policies that you have created by using criteria from the default Kubernetes Actions: Port Forward to Pod and Kubernetes Actions: Exec into Pod policies.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Clusters.
2. Select an existing cluster from the list.
3. Turn off the Enable Admission Controller Webhook to listen on exec and port-forward events toggle in the Static Configuration section.
4. Select Next to continue with Sensor setup.
5. Click Download YAML File and Keys.

6. From a system that has access to the monitored cluster, unzip and run the sensor script:

   $ unzip -d sensor sensor-<cluster_name>.zip

   $ ./sensor/sensor.sh

   Note

   If you get a warning that you do not have the required permissions to deploy the sensor, follow the on-screen instructions, or contact your cluster administrator for assistance.

   After the sensor is deployed, it contacts Central and provides cluster information.

7. Return to the RHACS portal and check if the deployment is successful. If it is successful, a green checkmark appears under section #2. If you do not see a green checkmark, use the following command to check for problems:

   • On OpenShift Container Platform:

     $ oc get pod -n stackrox -w

   • On Kubernetes:

     $ kubectl get pod -n stackrox -w

8. Select Finish.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Policies.
2. Click Create policy.

3. Enter the following details about your policy in the Policy details section:

   • Enter a Name for the policy.

   • Optional: Attach notifiers to the policy by selecting from the available Notifiers under the Attach notifiers section.

     Note

     You must integrate Red Hat Advanced Cluster Security for Kubernetes with your notification provider, for example, webhooks, Jira, PagerDuty, Splunk, or others before you can forward alerts.

   • Select a Severity level for this policy, either Critical, High, Medium, or Low.
   • Select policy Categories you want to apply to this policy.
   • Enter details about the policy in the Description box.
   • Enter an explanation about why the policy exists in the Rationale box.
   • Enter steps to resolve violations of this policy in the Guidance box.

   • Optional: Under the MITRE ATT&CK section, select the tactics and the techniques you want to specify for the policy.

     1. Click Add tactic, and then select a tactic from the dropdown list.
     2. Click the Add technique to add techniques for the selected tactic. You can specify multiple techniques for a tactic.
4. Click Next.

5. In the Policy behavior section, select the Lifecycle stages and Event sources (Runtime lifecycle only) for the policy.

   • Choose Lifecycle Stages to which your policy is applicable, from Build, Deploy, or Runtime. You can select more than one stage.

     • Build-time policies apply to image fields such as CVEs and Dockerfile instructions.
     • Deploy-time policies can include all build-time policy criteria but they can also include data from your cluster configurations, such as running in privileged mode or mounting the Docker socket.
     • Runtime policies can include all build-time and deploy-time policy criteria but they can also include data about process executions during runtime.

6. For Response method, either select:

   1. Inform to include the violation in the violations list.

   2. Or select Inform and enforce to enforce actions.

      • Choose the enforcement behavior for the policy. It is only available for the stages you select when configuring Lifecycle Stages. Select ON (enable) to enforce policy and report a violation, and OFF (disable) to only report a violation. The enforcement behavior is different for each lifecycle stage.

        • Build - Red Hat Advanced Cluster Security for Kubernetes fails your continuous integration (CI) builds when images match the conditions of the policy.
        • Deploy - Red Hat Advanced Cluster Security for Kubernetes blocks creation of deployments that match the conditions of the policy. In clusters with admission controller enforcement, the Kubernetes or OpenShift Container Platform API server blocks all noncompliant deployments. In other clusters, Red Hat Advanced Cluster Security for Kubernetes edits noncompliant deployments to prevent pods from being scheduled.

        • Runtime - Red Hat Advanced Cluster Security for Kubernetes kills all pods that match the conditions of the policy or blocks the action taken on the pods.

          Warning

          Policy enforcement can impact running applications or development processes. Before you enable enforcement options, inform all stakeholders and plan about how to respond to automated enforcement actions.

7. Click Next.
8. In the Policy Criteria section, configure the attributes that you you want to trigger the policy for.
9. Click Next.

10. In the Policy scope section, configure the following:

    • Click Add inclusion scope to use Restrict to Scope to enable this policy only for a specific cluster, a namespace, or a label. You can add multiple scopes and also use regular expressions in RE2 Syntax for namespaces and labels.
    • Click Add exclusion scope to use Exclude by Scope to exclude deployments, clusters, namespaces, and labels you specify, it means that the policy will not apply to the entities that you select. You can add multiple scopes and also use regular expressions in RE2 Syntax for namespaces and labels. However, you cannot use regular expressions for selecting deployments.

    • For Excluded Images (Build Lifecycle only), select all images that you do not want to trigger a violation for.

      Note

      The Excluded Images setting only applies when you check images in a continuous integration system with the Build lifecycle stage. It does not have any effect if you use this policy to check running deployments in the Deploy lifecycle stage or runtime activities in the Runtime lifecycle stage.

11. Click Next.
12. In the Review policy section, preview the policy violations.
13. Click Save.

Procedure

1. Navigate to the RHACS portal and select Risk from the navigation menu.
2. Apply local page filtering criteria that you want to create a policy.
3. Select New Policy and fill in the required fields to create a new policy.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Policies.
2. From the Policies page, select the policy you want to edit.
3. Select Actions → Export policy to JSON.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Policies.
2. Click Import policy.
3. In the Import policy JSON dialog, click Upload and select the JSON file you want to upload.
4. Click Begin import.

Procedure

1. In the Network Graph view, select Configure CIDR Blocks.

2. Turn the Display auto-discovered CIDR blocks in Network Graph toggle off to hide auto-discovered CIDR blocks.

   Note

   When you hide the auto-discovered CIDR blocks, the auto-discovered CIDR blocks are hidden for all clusters, not only for the selected cluster on the top bar in the Network Graph view.

3. Add custom CIDR addresses by adding CIDR Block Name and CIDR Address. To add more than one, select the Add icon.
4. Click Update Configuration to save the changes.

Procedure

1. To create policies using the saved YAML file, use the following command:

   $ oc create -f "<generated_file>.yaml" 1

   1

   If you use Kubernetes, enter kubectl instead of oc.

2. If the generated policies cause problems, you can remove them by running the following command:

   $ oc delete -f "StackRox Generated.yaml" 1

   1

   If you use Kubernetes, enter kubectl instead of oc.

Procedure

1. In the RHACS portal, select Network Graph from the left-hand navigation menu.
2. Select a cluster name from the menu on the top bar if the correct one is not already selected.
3. Select one or more namespaces.
4. Select Network Policy Simulator.
5. Select View active YAMLS.
6. Select the Revert most recently applied YAML icon.

Procedure

1. On the Network Graph view, select one or more namespaces.
2. Select a deployment.

3. The Network Flows details panel show both anomalous and baseline flows. From this panel, you can:

   • mark network flows from the baseline as anomalous by selecting Mark as Anomalous, or
   • add network flows to baseline from the anomalous flows by selecting Add to Baseline.

Procedure

1. On the Network Graph view, select a deployment.
2. In the network flow details panel, select Baseline Settings.

3. Turn on the Alert on baseline violations toggle.

   • Once you turn on the Alert on baseline violations toggle anomalous network flows trigger violations.
   • You can turn off the Alert on baseline violations toggle to stop receiving violations for anomalous network flows.

Procedure

1. Navigate to the RHACS portal and click Configuration Management from the left-hand navigation menu.
2. Select RBAC Visibility and Configuration → Users and Groups from the header in the Configuration Management view. The Users and Groups view displays a list of Kubernetes users and groups, their assigned roles, and whether the cluster-admin role is enabled for each of them.
3. Select a user or group to view more details about the associated cluster and namespace permissions.

Procedure

1. Navigate to the RHACS portal and click Configuration Management from the left-hand navigation menu.
2. Select RBAC Visibility and Configuration → Service Accounts from the header in the Configuration Management view. The Service Accounts view displays a list of Kubernetes service accounts across your clusters, their assigned roles, whether the cluster-admin role is enabled, and which deployments use them.
3. Select a row or an underlined link to view more details, including which cluster and namespace permissions are granted to the selected service account.

Procedure

1. Navigate to the RHACS portal and click Configuration Management from the left-hand navigation menu.
2. Select RBAC Visibility and Configuration → Roles from the header in the Configuration Management view. The Roles view displays a list of Kubernetes roles across your clusters, the permissions they grant, and where they are used.
3. Select a row or an underlined link to view more details about the role.
4. To find roles not granted to any users, groups, or service accounts, select the Users & Groups column header. Then select the Service Account column header while holding the Shift key. The list shows the roles that are not granted to any users, groups, or service accounts.

Procedure

1. On the RHACS portal, navigate to Vulnerability Management → Dashboard.
2. On the Dashboard view header, select Images.
3. From the list of images, select the image you already assessed.
4. Find the row which lists the CVE you would like to take action on.
5. Click on the right for the CVE you identified and click Defer CVE.
6. Select the date and time till you want to defer the CVE.
7. Select if you want to defer the CVE for the selected image tag or all tags for this image.
8. Enter the reason for the deferral.
9. Click Request approval. Select the blue information icon on the right of the CVE and copy the approval link to share with your organization’s deferral approver.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. Select CVEs on the Vulnerability Management view header.
3. In the CVEs view, select the Env Impact column header to arrange the CVEs in descending order (highest first) based on the environment impact.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. From the Vulnerability Management view header, select Application & Infrastructure → Components.
3. In the Components view, select the CVEs column header to arrange the components in descending order (highest first) based on the CVEs count.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. Select an image from the Top Riskiest Images widget.
3. In the Image details view, select the Dockerfile tab under the Image Findings section.
4. In the Dockerfile tab under the Image Findings section, select the expand icon to see a summary of image components.
5. Select the expand icon for specific components to get more details about the CVEs affecting the selected component.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. From the Vulnerability Management view header, select Filter CVEs → Fixable.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. From the Vulnerability Management view header, select Images.
3. View the base operating system (OS) and OS version for all images under the Image OS column.
4. Select an image to view its details. The base operating system is also available under the Image Summary → Details and Metadata section.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.

2. Select the Top Risky widget header to choose between riskiest images, deployments, clusters, and namespaces.

   The small circles on the chart represent the chosen object (image, deployment, cluster, namespace). Hover over the circles to see an overview of the object they represent. And select a circle to view detailed information about the selected object, its related entities, and the connections between them.

   For example, if you are viewing Top Risky Deployments by CVE Count and CVSS score, each circle on the chart represents a deployment.

   • When you hover over a deployment, you see an overview of the deployment, which includes deployment name, name of the cluster and namespace, severity, risk priority, CVSS, and CVE count (including fixable).
   • When you select a deployment, the Deployment view opens for the selected deployment. The Deployment view shows in-depth details of the deployment and includes information about policy violations, common vulnerabilities, CVEs, and riskiest images for that deployment.
3. Select View All on the widget header to view all objects of the chosen type. For example, if you chose Top Risky Deployments by CVE Count and CVSS score, you can select View All to view detailed information about all deployments in your infrastructure.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.

2. Select the Top Riskiest Images widget header to choose between the riskiest images and components. If you are viewing Top Riskiest Images:

   • When you hover over an image in the list, you see an overview of the image, which includes image name, scan time, and the number of CVEs along with severity (critical, high, medium, and low).
   • When you select an image, the Image view opens for the selected image. The Image view shows in-depth details of the image and includes information about CVEs by CVSS score, top riskiest components, fixable CVEs, and Dockerfile for the image.
3. Select View All on the widget header to view all objects of the chosen type. For example, if you chose Top Riskiest Components, you can select View All to view detailed information about all components in your infrastructure.

Procedure

1. Navigate to the RHACS portal and click Vulnerability Management from the navigation menu.
2. Select an image from the Top Riskiest Images widget.
3. In the Image details view, select the Dockerfile tab under the Image Findings section.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Integrations.
2. Under Image Integrations, select StackRox Scanner.
3. From the list of scanners, select StackRox Scanner to view its details.
4. Remove the Node Scanner option from Types.
5. Select Save.

Procedure

1. Select Images on the Vulnerability Management view header to view a list of all the images.
2. On the Images view header, select Watch Images.
3. In the Manage Inactive Images dialog, enter the inactive image’s name (and not the image id) for which you want to enable scanning.
4. Select Add Image. Red Hat Advanced Cluster Security for Kubernetes then scans the image and shows the error or success message.
5. Select Return to Image list to view the Images view.

Procedure

1. Click CVEs from the Vulnerability Management view header.
2. Select the checkboxes (leftmost column) for one or more CVEs and then click Add selected CVEs to Policy (add icon). Or, move the mouse over a CVE in the list, and select the Add icon on the right side.

3. For Policy Name:

   • To add the CVE to an existing policy, select an existing policy from the drop-down list box.
   • To create a new policy, enter the name for the new policy, and select Create <policy_name>.
4. Select a value for Severity, either Critical, High, Medium, or Low.
5. Choose the Lifecycle Stage to which your policy is applicable, from Build, or Deploy. You can also select both life-cycle stages.
6. Enter details about the policy in the Description box.
7. Turn off the Enable Policy toggle if you want to create the policy but enable it later. The Enable Policy toggle is on by default.
8. Verify the listed CVEs which are included in this policy.
9. Click Save Policy.

Procedure

1. Click on one of the clusters from the list to view details about the cluster. The Cluster view includes:

   • Cluster Details section, which shows cluster details and metadata, top risky objects (deployments, namespaces, and images), recently detected vulnerabilities, riskiest images, and deployments with the most severe policy violations.
   • Cluster Findings section, which includes a list of failing policies and list of fixable CVEs.
   • Related Entities section, which shows the number of namespaces, deployments, policies, images, components, and CVEs the cluster contains. You can select these entities to view more details.
2. Click View All on the widget header to view the list of all clusters.

Procedure

1. Select Nodes on the Vulnerability Management view header to view a list of all the CVEs affecting your nodes.

2. Select a node from the list to view details of all CVEs affecting that node.

   1. When you select a node, the Node details panel opens for the selected node. The Node view shows in-depth details of the node and includes information about CVEs by CVSS score and fixable CVEs for that node.
   2. Select View All on the CVEs by CVSS score widget header to view a list of all the CVEs in the selected node. You can also filter the list of CVEs.
   3. To export the fixable CVEs as a CSV file, select Export as CSV under the Node Findings section.

Procedure

1. On the Okta portal, select Applications from the menu bar.
2. Click Add Application and then select Create New App.
3. In the Create a New Application Integration dialog box, leave Web as the platform and select SAML 2.0 as the protocol that you want to sign in users.
4. Click Create.
5. On the General Settings page, enter a name for the app in the App name field.
6. Click Next.

7. On the SAML Settings page, set values for the following fields:

   1. Single sign on URL

      • Specify it as https://<RHACS_portal_hostname>/sso/providers/saml/acs.
      • Leave the Use this for Recipient URL and Destination URL option checked.
      • If your RHACS portal is accessible at different URLs, you can add them here by checking the Allow this app to request other SSO URLs option and add the alternative URLs using the specified format.

   2. Audience URI (SP Entity ID)

      • Set the value to RHACS or another value of your choice.
      • Remember the value you choose; you will need this value when you configure Red Hat Advanced Cluster Security for Kubernetes.

   3. Attribute Statements

      • You must add at least one attribute statement.

      • Red Hat recommends using the email attribute:

        • Name: email
        • Format: Unspecified
        • Value: user.email
8. Verify that you have configured at least one Attribute Statement before continuing.
9. Click Next.
10. On the Feedback page, select an option that applies to you.
11. Select an appropriate App type.
12. Click Finish.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Access Control.
2. Open the Add an Auth Provider menu and select SAML 2.0.

3. Fill out the details for:

   • Integration Name: A name to identify this authentication provider, for example, Okta or Google. The integration name is shown on the login page to help users select the right sign-in option.
   • ServiceProvider Issuer: The value you are using as the Audience URI or SP Entity ID in Okta, or a similar value in other providers.
   • IdP Metadata URL: Use the URL of Identity Provider metadata available from your identity provider console. If you do not want to use the IdP Metadata URL, you can instead copy the required static fields from the View Setup Instructions link in the Okta console, or a similar location for other providers.

4. Choose a Minimum access role for users accessing Red Hat Advanced Cluster Security for Kubernetes by using the selected identity provider.

   Tip

   Set the Minimum access role to Admin while you complete setup. Later, you can return to the Access Control page to set up more tailored access rules based on user metadata from your identity provider.

5. Click Save.

Verification

1. On the RHACS portal, navigate to Platform Configuration → Access Control.
2. Select the Auth Provider Rules tab.
3. Under the Auth Providers section, select the authentication provider that you want to verify the configuration for.
4. Select Test Login from the Auth Provider section header. The Test Login page opens in a new browser tab.

5. Sign in with your credentials.

   • On success, Red Hat Advanced Cluster Security for Kubernetes shows the User ID and User Attributes the identity provider sent for the credentials you have used to log in.
   • On failure, Red Hat Advanced Cluster Security for Kubernetes shows a message describing why the identity provider’s response could not be processed.

6. Close the Test Login browser tab.

   Note

   Even if the response indicates successful authentication, you might need to create additional access rules based on the user metadata from your identity provider.

Procedure

1. Create a new Google Cloud Platform (GCP) project, see the Google documentation topic creating and managing projects.
2. After you have created the project, open the Credentials page in the Google API Console.
3. Verify the project name listed in the upper left corner near the logo to make sure that you are using the correct project.
4. To create new credentials, go to Create Credentials → OAuth client ID.
5. Choose Web application as the Application type.
6. In the Name box, enter a name for the application, for example, RHACS.

7. In the Authorized redirect URIs box, enter https://<stackrox_hostname>:<port_number>/sso/providers/oidc/callback.

   • replace <stackrox_hostname> with the hostname on which you expose your Central instance.
   • replace <port_number> with the port number on which you expose Central. If you are using the standard HTTPS port 443, you can omit the port number.
8. Click Create. This creates an application and credentials and redirects you back to the credentials page.
9. An information box opens, showing details about the newly created application. Close the information box.
10. Copy and save the Client ID that ends with .apps.googleusercontent.com. You can check this client ID by using the Google API Console.

11. Select OAuth consent screen from the navigation menu on the left.

    Note

    The OAuth consent screen configuration is valid for the entire GCP project, and not only to the application you created in the previous steps. If you already have an OAuth consent screen configured in this project and want to apply different settings for Red Hat Advanced Cluster Security for Kubernetes login, create a new GCP project.

12. On the OAuth consent screen page:

    1. Choose the Application type as Internal. If you select Public, anyone with a Google account can sign in.
    2. Enter a descriptive Application name. This name is shown to users on the consent screen when they sign in. For example, use RHACS or <organization_name> SSO for Red Hat Advanced Cluster Security for Kubernetes.
    3. Verify that the Scopes for Google APIs only lists email, profile, and openid scopes. Only these scopes are required for single sign-on. If you grant additional scopes it increases the risk of exposing sensitive data.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Access Control.
2. Open the Add an Auth Provider menu and select OpenID Connect.

3. Fill out the details for:

   • Integration Name: A name to identify your authentication provider. For example, Auth0 or Google Workspace". The integration name is shown on the login page to help users select the right sign-in option.
   • Callback Mode: Select HTTP POST (default). An alternative mode called Fragment, designed around the limitations of Single Page Applications (SPAs), is also available. Red Hat only supports the Fragment mode for legacy integrations, and does not recommended using it for new integrations.

   • Issuer: The root URL of your identity provider, for example https://accounts.google.com for Google Workspace. See your identity provider documentation for more information.

     Note

     If you are using Red Hat Advanced Cluster Security for Kubernetes version 3.0.49 and newer, for Issuer you can:

     • Prefix your root URL with https+insecure:// to skip TLS validation. This configuration is insecure and Red Hat does not recommended it. Only use it for testing purposes.
     • Specify query strings, for example, ?key1=value1&key2=value2 along with the root URL. Red Hat Advanced Cluster Security for Kubernetes appends the value of Issuer as is to the authorization endpoint. You can use it to customize your provider’s login screen. For example, you can optimize the Google Workspace login screen to a specific hosted domain by using the hd parameter, or pre-select an authentication method in PingFederate by using the pfidpadapterid parameter.
   • Client ID: The OIDC Client ID for your configured project.

4. Choose a Minimum access role for users accessing Red Hat Advanced Cluster Security for Kubernetes by using the selected identity provider.

   Tip

   Set the Minimum access role to Admin while you complete setup. Later, you can return to the Access Control page to set up more tailored access rules based on user metadata from your identity provider.

5. Click Save.

Verification

1. On the RHACS portal, navigate to Platform Configuration → Access Control.
2. Select the Auth Provider Rules tab.
3. Under the Auth Providers section, select the authentication provider that you want to verify the configuration for.
4. Select Test Login from the Auth Provider section header. The Test Login page opens in a new browser tab.

5. Sign in with your credentials.

   • On success, Red Hat Advanced Cluster Security for Kubernetes shows the User ID and User Attributes the identity provider sent for the credentials you have used to log in.
   • On failure, Red Hat Advanced Cluster Security for Kubernetes shows a message describing why the identity provider’s response could not be processed.
6. Close the Test Login browser tab.

Procedure

1. On the RHACS portal, navigate to Platform Configuration → Access Control.
2. Open the Add an Auth Provider menu and select OpenShift Auth.
3. Enter a name for the authentication provider in the Name field.

4. Choose a Minimum access role for users accessing RHACS by using the selected identity provider.

   Tip

   For security, Red Hat recommends setting the Minimum access role to None while you complete setup. Later, you can return to the Access Control page to set up more tailored access rules based on user metadata from your identity provider.

5. Optional: To add access rules for users and groups accessing RHACS, click Add new rule in the Rules section, then enter the rule information and click Save. You will need attributes for the user or group so that you can configure access.

   Tip

   Group mappings are more robust because groups are usually associated with teams or permissions sets and require modification less often than users.

   To get user information in OpenShift Container Platform, you can use one of the following methods:

   • Click User Management → Users → <username> → YAML.
   • Access the k8s/cluster/user.openshift.io~v1~User/<username>/yaml file and note the values for name, uid (userid in RHACS), and groups.
   • Use the OpenShift Container Platform API as described in the OpenShift Container Platform API reference.

   The following configuration example describes how to configure rules for an Admin role with the following attributes:

   • name: administrator
   • groups: ["system:authenticated", "system:authenticated:oauth", "myAdministratorsGroup"]
   • uid: 12345-00aa-1234-123b-123fcdef1234

   You can add a rule for this administrator role using one of the following steps:

   • To configure a rule for a name, select name from the Key drop-down list, enter administrator in the Value field, then select Administrator under Role.
   • To configure a rule for a group, select groups from the Key drop-down list, enter myAdministratorsGroup in the Value field, then select Admin under Role.
   • To configure a rule for a user name, select userid from the Key drop-down list, enter 12345-00aa-1234-123b-123fcdef1234 in the Value field, then select Admin under Role.