Chapter 3. Managing secured clusters

• You have configured the ROX_ENDPOINT environment variable using the following command:

  $ export ROX_ENDPOINT=<host:port> 

  1

  Copy to Clipboard Toggle word wrap

  1

  The host and port information that you want to store in the ROX_ENDPOINT environment variable.

Procedure

• Generate the required sensor configuration for your Kubernetes cluster and associate it with your Central instance by running the following command:

  $ roxctl sensor generate k8s --name <cluster_name> --central "$ROX_ENDPOINT"

  Copy to Clipboard Toggle word wrap

Procedure

• Generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance by running the following command:

  $ roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "$ROX_ENDPOINT" 

  1

  Copy to Clipboard Toggle word wrap

  1

  For the --openshift-version option, specify the major OpenShift Container Platform version number for your cluster. For example, specify 3 for OpenShift Container Platform version 3.x and specify 4 for OpenShift Container Platform version 4.x.

  Read the --help output to see other options that you might need to use depending on your system architecture.

  Verify that the endpoint you provide for --central can be reached from the cluster where you are deploying Red Hat Advanced Cluster Security for Kubernetes services.

  Important

  If you are using a non-gRPC capable load balancer, such as HAProxy, AWS Application Load Balancer (ALB), or AWS Elastic Load Balancing (ELB), follow these guidelines:

  • Use the WebSocket Secure (wss) protocol. To use wss, prefix the address with wss://, and

  • Add the port number after the address, for example:

    $ roxctl sensor generate k8s --central wss://stackrox-central.example.com:443

    Copy to Clipboard Toggle word wrap

Procedure

• Run the sensor installation script to install Sensor:

  $ ./sensor-<cluster_name>/sensor.sh

  Copy to Clipboard Toggle word wrap

  If you get a warning that you do not have the required permissions to install Sensor, follow the on-screen instructions, or contact your cluster administrator for help.

Procedure

• Run the following command to download Sensor bundles for existing clusters by specifying a cluster name or ID:

  $ roxctl sensor get-bundle <cluster_name_or_id>

  Copy to Clipboard Toggle word wrap

Procedure

• Before deleting the cluster, ensure you have the correct cluster name that you want to remove from Central:

  $ roxctl cluster delete --name=<cluster_name>

  Copy to Clipboard Toggle word wrap
  Important

  Deleting the cluster integration does not remove the RHACS services running in the cluster, depending on the installation method. You can remove the services by running the delete-sensor.sh script from the Sensor installation bundle.