8.3. Applying an init bundle for Kubernetes secured clusters

Prerequisites

• You must have generated an init bundle containing secrets.
• You must have created the stackrox project, or namespace, on the cluster where secured cluster services will be installed. Using stackrox for the project is not required, but ensures that vulnerabilities for RHACS processes are not reported when scanning your clusters.

• Create resources using the OpenShift Container Platform web console: In the OpenShift Container Platform web console, make sure that you are in the stackrox namespace. In the top menu, click + to open the Import YAML page. You can drag the init bundle file or copy and paste its contents into the editor, and then click Create. When the command is complete, the display shows that the collector-tls, sensor-tls, and admission-control-tls resources were created.

• Create resources using the Red Hat OpenShift CLI: Using the Red Hat OpenShift CLI, run the following command to create the resources:

  $ oc create -f <init_bundle.yaml> \
    -n <stackrox>

  where:

  <init_bundle.yaml>

  Specifies the file name of the init bundle containing the secrets.

  <stackrox>

  Specifies the name of the project where Central services are installed.

• Using the kubectl CLI, run the following commands to create the resources:

  $ kubectl create namespace stackrox

  This command creates the project where secured cluster resources will be installed. This example uses stackrox.

  $ kubectl create -f <init_bundle.yaml> \
    -n <stackrox>

  where:

  <init_bundle.yaml>

  Specifies the file name of the init bundle containing the secrets.

  <stackrox>

  Specifies the project name that you created. This example uses stackrox.

Verification

• Restart Sensor to pick up the new certificates.

  For more information about how to restart Sensor, see "Restarting the Sensor container" in the "Additional resources" section.

• Install RHACS secured cluster services in all clusters that you want to monitor.