Chapter 9. Upgrading RHACS Cloud Service

Procedure

1. In the OpenShift Container Platform web console, go to the RHACS Operator page.
2. In the top navigation menu, select Secured Cluster.
3. Click the instance name, for example, stackrox-secured-cluster-services.

4. Use one of the following methods to change the setting:

   • In the Form view, under Per Node Settings Collector Settings Collection, select CORE_BPF.
   • Click YAML to open the YAML editor and locate the spec.perNode.collector.collection attribute. If the value is KernelModule or EBPF, then change it to CORE_BPF.
5. Click Save.

Procedure

1. Delete the OLM subscription by running the following command:

   • For OpenShift Container Platform, run the following command:

     Copy to Clipboard Toggle word wrap

     $ oc -n rhacs-operator delete subscription rhacs-operator

   • For Kubernetes, run the following command:

     Copy to Clipboard Toggle word wrap

     $ kubectl -n rhacs-operator delete subscription rhacs-operator

2. Delete the cluster service version (CSV) by running the following command:

   • For OpenShift Container Platform, run the following command:

     Copy to Clipboard Toggle word wrap

     $ oc -n rhacs-operator delete csv -l operators.coreos.com/rhacs-operator.rhacs-operator

   • For Kubernetes, run the following command:

     Copy to Clipboard Toggle word wrap

     $ kubectl -n rhacs-operator delete csv -l operators.coreos.com/rhacs-operator.rhacs-operator

3. Install the latest version of the Operator on the rolled back channel.

Procedure

1. Go to the Operators Installed Operators page.
2. Click the RHACS Operator.
3. On the Operator Details page, select Uninstall Operator from the Actions list. Following this action, the Operator stops running and no longer receives updates.
4. Install the latest version of the Operator on the rolled back channel.

Procedure

1. Determine the roxctl architecture for the target operating system:

   Copy to Clipboard Toggle word wrap

   $ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"

2. Download the roxctl CLI:

   Copy to Clipboard Toggle word wrap

   $ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.3/bin/Linux/roxctl${arch}"

3. Make the roxctl binary executable:

   Copy to Clipboard Toggle word wrap

   $ chmod +x roxctl

4. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   Copy to Clipboard Toggle word wrap

   $ echo $PATH

Procedure

1. Determine the roxctl architecture for the target operating system:

   Copy to Clipboard Toggle word wrap

   $ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"

2. Download the roxctl CLI:

   Copy to Clipboard Toggle word wrap

   $ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.3/bin/Darwin/roxctl${arch}"

3. Remove all extended attributes from the binary:

   Copy to Clipboard Toggle word wrap

   $ xattr -c roxctl

4. Make the roxctl binary executable:

   Copy to Clipboard Toggle word wrap

   $ chmod +x roxctl

5. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   Copy to Clipboard Toggle word wrap

   $ echo $PATH

Procedure

1. Update the Sensor image:

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image deploy/sensor sensor=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.3 

   1

   1

   If you use Kubernetes, enter kubectl instead of oc.

2. Update the Compliance image:

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image ds/collector compliance=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.3 

   1

   1

   If you use Kubernetes, enter kubectl instead of oc.

3. Update the Collector image:

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image ds/collector collector=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8:4.7.3 

   1

   1

   If you use Kubernetes, enter kubectl instead of oc.

4. Update the admission control image:

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image deploy/admission-control admission-control=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.3

Procedure

1. List all of the RHACS services that are deployed on all secured clusters:

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox describe pods | grep 'openshift.io/scc\|^Name:'

   Example output

   Copy to Clipboard Toggle word wrap

   Name:      admission-control-6f4dcc6b4c-2phwd
              openshift.io/scc: stackrox-admission-control
   #...
   Name:      central-575487bfcb-sjdx8
              openshift.io/scc: stackrox-central
   Name:      central-db-7c7885bb-6bgbd
              openshift.io/scc: stackrox-central-db
   Name:      collector-56nkr
              openshift.io/scc: stackrox-collector
   #...
   Name:      scanner-68fc55b599-f2wm6
              openshift.io/scc: stackrox-scanner
   Name:      scanner-68fc55b599-fztlh
   #...
   Name:      sensor-84545f86b7-xgdwf
              openshift.io/scc: stackrox-sensor
   #...

   In this example, you can see that each pod has its own custom SCC, which is specified through the openshift.io/scc field.

2. Add the required roles and role bindings to use the Red Hat OpenShift SCCs instead of the RHACS custom SCCs.

3. To add the required roles and role bindings to use the Red Hat OpenShift SCCs for all secured clusters, complete the following steps:

   1. Create a file named upgrade-scs.yaml that defines the role and role binding resources by using the following content:

      Example 9.1. Example YAML file

      Copy to Clipboard Toggle word wrap

      apiVersion: rbac.authorization.k8s.io/v1
      kind: Role  

      1

      
      metadata:
        annotations:
           email: support@stackrox.com
           owner: stackrox
        labels:
           app.kubernetes.io/component: collector
           app.kubernetes.io/instance: stackrox-secured-cluster-services
           app.kubernetes.io/name: stackrox
           app.kubernetes.io/part-of: stackrox-secured-cluster-services
           app.kubernetes.io/version: 4.4.0
           auto-upgrade.stackrox.io/component: sensor
        name: use-privileged-scc  

      2

      
        namespace: stackrox 

      3

      
      rules:  

      4

      
      - apiGroups:
        - security.openshift.io
        resourceNames:
        - privileged
        resources:
        - securitycontextconstraints
        verbs:
        - use
      - - -
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding 

      5

      
      metadata:
        annotations:
           email: support@stackrox.com
           owner: stackrox
        labels:
           app.kubernetes.io/component: collector
           app.kubernetes.io/instance: stackrox-secured-cluster-services
           app.kubernetes.io/name: stackrox
           app.kubernetes.io/part-of: stackrox-secured-cluster-services
           app.kubernetes.io/version: 4.4.0
           auto-upgrade.stackrox.io/component: sensor
        name: collector-use-scc 

      6

      
        namespace: stackrox
      roleRef: 

      7

      
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: use-privileged-scc
      subjects: 

      8

      
      - kind: ServiceAccount
        name: collector
        namespace: stackrox
      - - -

      1

      The type of Kubernetes resource, in this example, Role.

      2

      The name of the role resource.

      3

      The namespace in which the role is created.

      4

      Describes the permissions granted by the role resource.

      5

      The type of Kubernetes resource, in this example, RoleBinding.

      6

      The name of the role binding resource.

      7

      Specifies the role to bind in the same namespace.

      8

      Specifies the subjects that are bound to the role.

   2. Create the role and role binding resources specified in the upgrade-scs.yaml file by running the following command:

      Copy to Clipboard Toggle word wrap

      $ oc -n stackrox create -f ./update-scs.yaml

      Important

      You must run this command on each secured cluster to create the role and role bindings specified in the upgrade-scs.yaml file.

4. Delete the SCCs that are specific to RHACS:

   1. To delete the SCCs that are specific to all secured clusters, run the following command:

      Copy to Clipboard Toggle word wrap

      $ oc delete scc/stackrox-admission-control scc/stackrox-collector scc/stackrox-sensor

      Important

      You must run this command on each secured cluster to delete the SCCs that are specific to each secured cluster.