5.2. Secured cluster services
Secured cluster services contain the following components:
- Sensor
- Admission controller
- Collector
- Scanner (optional)
- Scanner V4 (optional)
If you use a web proxy or firewall, you must ensure that secured clusters and Central can communicate on HTTPS port 443.
5.2.1. Sensor
Sensor monitors your Kubernetes and OpenShift Container Platform clusters. These services currently deploy in a single deployment, which handles interactions with the Kubernetes API and coordinates with the other Red Hat Advanced Cluster Security for Kubernetes components.
5.2.1.1. CPU and memory requirements
The following table lists the minimum CPU and memory values required to install and run sensor on secured clusters.
| Sensor | CPU | Memory |
|---|---|---|
| Request | 2 cores | 4 GiB |
| Limit | 4 cores | 8 GiB |
5.2.2. Admission controller
The Admission controller prevents users from creating workloads that violate policies you configure.
5.2.2.1. CPU and memory requirements
By default, the admission control service runs 3 replicas. The following table lists the request and limits for each replica.
| Admission controller | CPU | Memory |
|---|---|---|
| Request | 0.05 cores | 100 MiB |
| Limit | 0.5 cores | 500 MiB |
5.2.3. Collector
Collector monitors runtime activity on each node in your secured clusters as a DaemonSet. It connects to Sensor to report this information. The collector pod has three containers. The first container is collector, which monitors and reports the runtime activity on the node. The other two are compliance and node-inventory.
5.2.3.1. Collection requirements
To use the CORE_BPF collection method, the base kernel must support BTF, and the BTF file must be available to collector. In general, the kernel version must be later than 5.8 (4.18 for RHEL nodes) and the CONFIG_DEBUG_INFO_BTF configuration option must be set.
Collector looks for the BTF file in the standard locations shown in the following list:
例5.1 BTF file locations
/sys/kernel/btf/vmlinux
/boot/vmlinux-<kernel-version>
/lib/modules/<kernel-version>/vmlinux-<kernel-version>
/lib/modules/<kernel-version>/build/vmlinux
/usr/lib/modules/<kernel-version>/kernel/vmlinux
/usr/lib/debug/boot/vmlinux-<kernel-version>
/usr/lib/debug/boot/vmlinux-<kernel-version>.debug
/usr/lib/debug/lib/modules/<kernel-version>/vmlinux
If any of these files exists, it is likely that the kernel has BTF support and CORE_BPF is configurable.
5.2.3.2. CPU and memory requirements
By default, the collector pod runs 3 containers. The following tables list the request and limits for each container and the total for each collector pod.
5.2.3.2.1. Collector container
| Type | CPU | Memory |
|---|---|---|
| Request | 0.06 cores | 320 MiB |
| Limit | 0.9 cores | 1000 MiB |
5.2.3.2.2. Compliance container
| Type | CPU | Memory |
|---|---|---|
| Request | 0.01 cores | 10 MiB |
| Limit | 1 core | 2000 MiB |
5.2.3.2.3. Node-inventory container
| Type | CPU | Memory |
|---|---|---|
| Request | 0.01 cores | 10 MiB |
| Limit | 1 core | 500 MiB |
5.2.3.2.4. Total collector pod requirements
| Type | CPU | Memory |
|---|---|---|
| Request | 0.07 cores | 340 MiB |
| Limit | 2.75 cores | 3500 MiB |
5.2.4. Scanner
5.2.4.1. CPU and memory requirements
The requirements in this table are based on the default of 3 replicas.
| StackRox Scanner | CPU | Memory |
|---|---|---|
| Request | 3 cores | 4500 MiB |
| Limit | 6 cores | 12 GiB |
The StackRox Scanner requires Scanner DB (PostgreSQL 15) to store data. The following table lists the minimum memory and storage values required to install and run Scanner DB.
| Scanner DB | CPU | Memory |
|---|---|---|
| Request | 0.2 cores | 512 MiB |
| Limit | 2 cores | 4 GiB |
5.2.5. Scanner V4
Scanner V4 is optional. If Scanner V4 is installed on secured clusters, the following requirements apply.
5.2.5.1. CPU, memory, and storage requirements
5.2.5.2. Scanner V4 Indexer
The requirements in this table are based on the default of 2 replicas.
| Scanner V4 Indexer | CPU | Memory |
|---|---|---|
| Request | 2 cores | 3000 MiB |
| Limit | 4 cores | 6 GiB |
5.2.5.3. Scanner V4 DB
Scanner V4 requires Scanner V4 DB (PostgreSQL 15) to store data. The following table lists the minimum CPU, memory, and storage values required to install and run Scanner V4 DB. For Scanner V4 DB, a PVC is not required, but it is strongly recommended because it ensures optimal performance.
| Scanner V4 DB | CPU | Memory | Storage |
|---|---|---|---|
| Request | 0.2 cores | 2 GiB | 10 GiB |
| Limit | 2 cores | 4 GiB | 10 GiB |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}