Chapter 1. Upgrading by using the Operator

Procedure

1. In the OpenShift Container Platform web console, go to the RHACS Operator page.
2. In the top navigation menu, select Secured Cluster.
3. Click the instance name, for example, stackrox-secured-cluster-services.

4. Use one of the following methods to change the setting:

   • In the Form view, under Per Node Settings Collector Settings Collection, select CORE_BPF.
   • Click YAML to open the YAML editor and locate the spec.perNode.collector.collection attribute. If the value is KernelModule or EBPF, then change it to CORE_BPF.
5. Click Save.

Procedure

1. In the Administrator perspective of the OpenShift Container Platform web console, go to Operators Installed Operators.
2. Click the RHACS Operator.
3. Click the Subscription tab.
4. Click the name of the update channel under Update Channel.
5. Select stable, then click Save.

6. For subscriptions with an Automatic approval strategy, the update begins automatically. Go back to the Operators Installed Operators page to monitor the progress of the update. When complete, the status changes to Succeeded and Up to date.

   For subscriptions with a Manual approval strategy, you can manually approve the update from the Subscription tab.

Procedure

1. Delete the Operator Lifecycle Manager (OLM) subscription and cluster service version (CSV):

   Important

   If you use Kubernetes, enter kubectl instead of oc.

   1. To delete the OLM subscription, run the following command:

      $ oc -n rhacs-operator delete subscription rhacs-operator

      Copy to Clipboard Toggle word wrap

      Example output

      subscription.operators.coreos.com "rhacs-operator" deleted

      Copy to Clipboard Toggle word wrap

   2. To delete the CSV, run the following command:

      $ oc -n rhacs-operator delete csv -l operators.coreos.com/rhacs-operator.rhacs-operator

      Copy to Clipboard Toggle word wrap

      Example output

      clusterserviceversion.operators.coreos.com "rhacs-operator.v4.8.4" deleted

      Copy to Clipboard Toggle word wrap

2. Install the previous version of the RHACS Operator:

   1. In the OpenShift web console, click OperatorHub.
   2. Search for Advanced Cluster Security for Kubernetes.

   3. Select and install the previous version of the Operator.

      Note

      Installing the previous Operator version rolls back RHACS to the same version as the Operator.

Procedure

1. In the OpenShift web console, click Operators Installed Operators.
2. From the list of projects, select rhacs-operator.

3. Locate the Advanced Cluster Security for Kubernetes Operator:

   1. Click the overflow menu Uninstall Operator.

      The uninstall Operator dialog is displayed.

   2. Ensure that the Delete all operand instances for this operator checkbox is clear to avoid uninstallation of Red Hat Advanced Cluster Security for Kubernetes (RHACS).
   3. Click Uninstall.

4. Install the previous version of RHACS Operator:

   1. In the OpenShift web console, click OperatorHub.
   2. Search for Advanced Cluster Security for Kubernetes.

   3. Select and install the previous version of the Operator.

      Note

      Installing the previous Operator version rolls back RHACS to the same version as the Operator.

1. Check the status of the central-db pod:

   $ oc -n <namespace> get pod -l app=central-db 

   1

   Copy to Clipboard Toggle word wrap

   1

   If you use Kubernetes, enter kubectl instead of oc.

2. If the status of the pod is Pending, use the describe command to get more details:

   $ oc -n <namespace> describe po/<central-db-pod-name> 

   1

   Copy to Clipboard Toggle word wrap

   1

   If you use Kubernetes, enter kubectl instead of oc.

3. You might see the FailedScheduling warning message:

   Type     Reason            Age   From               Message
   ----     ------            ----  ----               -------
   Warning  FailedScheduling  54s   default-scheduler  0/7 nodes are available: 1 Insufficient memory, 3 node(s) had untolerated taint {node-role.kubernetes.io/master: }, 4 Insufficient cpu. preemption: 0/7 nodes are available: 3 Preemption is not helpful for scheduling, 4 No preemption victims found for incoming pod.

   Copy to Clipboard Toggle word wrap

4. This warning message suggests that the scheduled node had insufficient memory to accommodate the pod’s resource requirements. If you have a small environment, consider increasing resources on the nodes or adding a larger node that can support the database.

   Otherwise, consider decreasing the resource requirements for the central-db pod in the custom resource under central db resources. However, running central with fewer resources than the recommended minimum might lead to degraded performance for RHACS.