SupportConsoleDevelopersStart a trialContact

Chapter 3. Managing secured clusters

To secure a Kubernetes or an OpenShift Container Platform cluster, you must deploy Red Hat Advanced Cluster Security for Kubernetes (RHACS) services into the cluster. You can generate deployment files in the RHACS portal by navigating to the Platform Configuration Clusters view, or you can use the roxctl CLI.

3.1. Prerequisites
Copy link

You must configure environment variables before using the roxctl CLI.

Procedure

  • To configure the ROX_ENDPOINT environment variable, run the following command: 

    $ export ROX_ENDPOINT=<host:port>

    where:

    <host:port>
    Specifies the host and port information that you want to store in the ROX_ENDPOINT environment variable.

3.2. Generating Sensor deployment files
Copy link

You can generate Sensor deployment files for both Kubernetes and OpenShift Container Platform systems by using the roxctl CLI. The deployment files contain the necessary configuration to deploy and associate Sensor with your Central instance.

You can generate the required Sensor configuration for your Kubernetes cluster and associate it with your Central instance by using the roxctl CLI.

Procedure

  • To generate the required sensor configuration for your Kubernetes cluster and associate it with your Central instance, run the following command: 

    $ roxctl sensor generate k8s --name <cluster_name> --central "$ROX_ENDPOINT"

You can generate the required Sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance by using the roxctl CLI.

Procedure

  • To generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance, run the following command: 

    $ roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "$ROX_ENDPOINT"

    where:

    <ocp_version>
    Specifies the major OpenShift Container Platform version number for your cluster. For example, specify 3 for OpenShift Container Platform version 3.x and specify 4 for OpenShift Container Platform version 4.x.

    Read the --help output to see other options that you might need to use depending on your system architecture.

    Verify that the cluster where you are deploying Red Hat Advanced Cluster Security for Kubernetes services can reach the endpoint you give for --central.

    Important

    If you are using a non-gRPC capable load balancer, such as HAProxy, AWS Application Load Balancer (ALB), or AWS Elastic Load Balancing (ELB), follow these guidelines:

    • Use the WebSocket Secure (wss) protocol. To use wss, prefix the address with wss://.

    • Add the port number after the address, for example: 

      $ roxctl sensor generate k8s --central wss:

When you generate the Sensor deployment files, roxctl creates a directory called sensor-<cluster_name> in your working directory. This directory contains the script to install Sensor.

Procedure

  • To install Sensor, run the following command: 

    $ ./sensor-<cluster_name>/sensor.sh

    If you get a warning that you do not have the required permissions to install Sensor, follow the on-screen instructions, or contact your cluster administrator for help.

You can download Sensor bundles for clusters that are already integrated with Central by using the roxctl CLI.

Procedure

  • To download Sensor bundles for existing clusters, specify a cluster name or ID and run the following command: 

    $ roxctl sensor get-bundle <cluster_name_or_id>

3.5. Deleting cluster integration
Copy link

You can remove a cluster integration from Central by using the roxctl CLI. This removes the cluster from Central’s management but does not uninstall the services running in the cluster.

Procedure

  • To delete the cluster integration, ensure you have the correct cluster name and run the following command: 

    $ roxctl cluster delete --name=<cluster_name>
    Important

    Deleting the cluster integration does not remove the RHACS services running in the cluster, depending on the installation method. You can remove the services by running the delete-sensor.sh script from the Sensor installation bundle.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top