Chapter 7. Enabling offline mode

Procedure

1. Install the Red Hat Advanced Cluster Security for Kubernetes Operator following the instructions in "Installing the Red Hat Advanced Cluster Security for Kubernetes Operator".
2. On the OpenShift Container Platform web console, go to the Ecosystem Installed Operators page.
3. Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.

4. If you have installed the Operator in the recommended namespace, OpenShift Container Platform lists the project as rhacs-operator. Select Project: rhacs-operator Create project.

   Note

   If you installed the Operator in a different namespace, OpenShift Container Platform lists the name of that namespace instead of rhacs-operator.

5. Enter the new project name (for example, stackrox), and click Create. Red Hat recommends that you use stackrox as the project name.
6. Under the Provided APIs section, select Central. Click Create Central.

7. Take one of the following actions to configure offline mode. In this mode, RHACS does not automatically download or update vulnerability definitions or other data. You must manually download these and provide them to RHACS if you have configured it to run in offline mode.

   • To configure offline mode by using the portal, select Form view in the Configure via field.

     1. Locate the Egress setting. This setting indicates if the system allows outgoing network traffic.
     2. In the Connectivity Policy field, select Offline to indicate that RHACS should run in offline (disconnected) mode.

   • To configure offline mode by editing the YAML CR, select YAML view in the Configure via field.

     1. Add egress.connectivityPolicy: Offline to the file as shown in the following example:

        apiVersion: platform.stackrox.io/v1alpha1
        kind: Central
        metadata:
          name: stackrox-central-services
          namespace: stackrox
        spec:
          egress:
            connectivityPolicy: Offline

8. Click Create.

Procedure

1. When installing the central-services Helm chart, set the value of the env.offlineMode environmental variable to true in the values-public.yaml configuration file.
2. When installing the secured-cluster-services Helm chart, set the value of the config.offlineMode parameter to true in the values-public.yaml configuration file.

Procedure

1. If you are using a registry other than the default internet-connected registry (registry.redhat.io), provide the locations where you have pushed the Red Hat Advanced Cluster Security for Kubernetes images when answering the image to use prompts:

   Enter main image to use (if unset, the default will be used): <your_registry>/rhacs-main-rhel8:4.10.0

   Note

   The default image depends on your answer for the prompt Enter default container images settings:. If you entered rhacs, the default option, the default image will be registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.10.0.

   Enter Scanner DB image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-db-rhel8:4.10.0

   Enter Scanner image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-rhel8:4.10.0

2. To enable the offline mode, enter true when answering the Enter whether to run StackRox in offline mode prompt:

   Enter whether to run StackRox in offline mode, which avoids reaching out to the internet (default: "false"): true

3. Later, when you add Sensor to a remote cluster in the Platform Configuration Clusters view in the RHACS portal, you must specify your the Collector image name in the Collector Image Repository field.

Procedure

1. Set the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables:

   $ export ROX_API_TOKEN=<api_token>

   $ export ROX_CENTRAL_ADDRESS=<address>:<port_number>

2. Run the following command to upload the kernel support packages:

   $ roxctl collector support-packages upload <package_file> \
     -e "$ROX_CENTRAL_ADDRESS"