第8章 Configuring automatic upgrades for manifest-installed secured clusters
If you installed Red Hat Advanced Cluster Security for Kubernetes by using the manifest installation method, also known as the `roxctl` CLI method or the legacy installation method, you can automate the upgrade process for each secured cluster. You can also view the upgrade status from the RHACS portal.
Automatic upgrades are only available for RHACS systems that were installed by using the manifest installation method. If you installed RHACS by using the Operator, upgrades are controlled by using Operator Lifecycle Manager (OLM). If you installed RHACS by using Helm charts, you must use Helm to upgrade.
Automatic upgrades make it easier to stay up-to-date by automating the manual task of upgrading each secured cluster. If you have automatic upgrades enabled, and the secured cluster is configured for receiving automated upgrades, the upgrader upgrades the entire secured cluster to the same version as Central.
The new Clusters view displays information about all your secured clusters, the Sensor version for every cluster, and upgrade status messages. You can also use this view to selectively upgrade your secured clusters or change their configuration.
- The automatic upgrade feature is enabled by default.
- If you are using a private image registry, you must first push the Sensor and Collector images to your private registry.
- The Sensor must run with the default RBAC permissions.
- Automatic upgrades do not preserve any patches that you have made to any RHACS services running in your cluster. However, it preserves all labels and annotations that you have added to any RHACS object.
-
By default, Red Hat Advanced Cluster Security for Kubernetes creates a service account called
sensor-upgraderin each secured cluster. This account is highly privileged but is only used during upgrades. If you remove this account, Sensor does not have enough permissions, and you must complete future upgrades manually.
8.1. Enabling automatic upgrades for manifest-installed secured clusters
You can enable automatic upgrades for all secured clusters that were installed by using the manifest installation method, also known as the roxctl CLI method. This feature automatically upgrades Sensor, Admission Controller, Collector, and Compliance in all secured clusters to the same version as Central.
Procedure
-
In the RHACS portal, go to Platform Configuration
Clusters. Turn on the Automatically upgrade secured clusters toggle.
注記For new installations, the Automatically upgrade secured clusters toggle is enabled by default.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}