8.4. Installing secured cluster services from RHACS Cloud Service on Kubernetes clusters
You can install RHACS Cloud Service on your secured clusters by using one of the following methods:
- By using Helm charts
-
By using the
roxctlCLI (do not use this method unless you have a specific installation need that requires using it)
8.4.1. Installing RHACS Cloud Service on secured clusters by using Helm charts
You can install RHACS on secured clusters by using Helm charts with no customization, by using Helm charts with the default values, or by using Helm charts with customizations of configuration parameters.
First, ensure that you add the Helm chart repository.
8.4.1.1. Adding the Helm chart repository
Procedure
Add the RHACS charts repository.
$ helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/The Helm repository for Red Hat Advanced Cluster Security for Kubernetes includes Helm charts for installing different components, including:
Secured Cluster Services Helm chart (
secured-cluster-services) for installing the per-cluster and per-node components (Sensor, Admission Controller, Collector, and Scanner-slim).참고Deploy the per-cluster components into each cluster that you want to monitor and deploy the per-node components in all nodes that you want to monitor.
Verification
Run the following command to verify the added chart repository:
$ helm search repo -l rhacs/
8.4.1.2.1. Installing the secured-cluster-services Helm chart without customization
Use the following instructions to install the secured-cluster-services Helm chart to deploy the per-cluster and per-node components (Sensor, Admission controller, Collector, and Scanner-slim).
Prerequisites
- You must have generated an RHACS init bundle or CRS for your cluster.
-
You must have access to the Red Hat Container Registry and a pull secret for authentication. For information about downloading images from
registry.redhat.io, see Red Hat Container Registry Authentication. -
You must have the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the ACS instance you created.
Procedure
Run one of the following commands on your Kubernetes-based clusters:
If you are using an init bundle, run the following command:
$ helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <path_to_cluster_init_bundle.yaml> \ -f <path_to_pull_secret.yaml> \ --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ --set imagePullSecrets.username=<your redhat.com username> \ --set imagePullSecrets.password=<your redhat.com password>where:
<path_to_cluster_init_bundle.yaml>- Specifies the path for the init bundle.
<path_to_pull_secret.yaml>- Specifies the path for the pull secret for Red Hat Container Registry authentication.
<endpoint_of_central_service>-
Specifies the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, and then clicking the RHACS instance you created. <your redhat.com username>- Specifies the user name for your pull secret for Red Hat Container Registry authentication.
<your redhat.com password>- Specifies the password for your pull secret for Red Hat Container Registry authentication.
Procedure
Run one of the following commands on an OpenShift Container Platform cluster:
If you are using an init bundle, run the following command:
$ helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <path_to_cluster_init_bundle.yaml> \ -f <path_to_pull_secret.yaml> \ --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ --set scanner.disable=falsewhere:
<path_to_cluster_init_bundle.yaml>- Specifies the path for the init bundle.
<path_to_pull_secret.yaml>- Specifies the path for the pull secret for Red Hat Container Registry authentication.
<endpoint_of_central_service>-
Specifies the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. --set-
Sets the value of the
scanner.disableparameter tofalse, which means that Scanner-slim will be enabled during the installation. In Kubernetes, the secured cluster services now include Scanner-slim.
If you are using a CRS, run the following command:
$ helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ --set-file crs.file=<crs_file_name.yaml> \ -f <path_to_pull_secret.yaml> \ --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ --set scanner.disable=falsewhere:
<crs_file_name.yaml>- Specifies the name of the file in which the generated CRS has been stored.
<path_to_pull_secret.yaml>- Specifies the path for the pull secret for Red Hat Container Registry authentication.
<endpoint_of_central_service>-
Specifies the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. --set-
Sets the value of the
scanner.disableparameter tofalse, which means that Scanner-slim will be enabled during the installation. In Kubernetes, the secured cluster services now include Scanner-slim.
8.4.1.3. Configuring the secured-cluster-services Helm chart with customizations
This section describes Helm chart configuration parameters that you can use with the helm install and helm upgrade commands. You can specify these parameters by using the --set option or by creating YAML configuration files.
Create the following files for configuring the Helm chart for installing Red Hat Advanced Cluster Security for Kubernetes:
-
Public configuration file
values-public.yaml: Use this file to save all non-sensitive configuration options. -
Private configuration file
values-private.yaml: Use this file to save all sensitive configuration options. Ensure that you store this file securely.
While using the secured-cluster-services Helm chart, do not modify the values.yaml file that is part of the chart.
8.4.1.3.1. Configuration parameters
| Parameter | Description |
|---|---|
|
| Name of your cluster. |
|
|
Address of the Central endpoint. If you are using a non-gRPC capable load balancer, use the WebSocket protocol by prefixing the endpoint address with |
|
| Address of the Sensor endpoint including port number. |
|
| Image pull policy for the Sensor container. |
|
| The internal service-to-service TLS certificate that Sensor uses. |
|
| The internal service-to-service TLS certificate key that Sensor uses. |
|
| The memory request for the Sensor container. Use this parameter to override the default value. |
|
| The CPU request for the Sensor container. Use this parameter to override the default value. |
|
| The memory limit for the Sensor container. Use this parameter to override the default value. |
|
| The CPU limit for the Sensor container. Use this parameter to override the default value. |
|
|
Specify a node selector label as |
|
| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Sensor. This parameter is mainly used for infrastructure nodes. |
|
|
The name of the |
|
| The name of the Collector image. |
|
| The address of the registry you are using for the main image. |
|
| The address of the registry you are using for the Collector image. |
|
| The address of the registry you are using for the Scanner image. |
|
| The address of the registry you are using for the Scanner DB image. |
|
| The address of the registry you are using for the Scanner V4 image. |
|
| The address of the registry you are using for the Scanner V4 DB image. |
|
|
Image pull policy for |
|
| Image pull policy for the Collector images. |
|
|
Tag of |
|
|
Tag of |
|
|
Either |
|
| Image pull policy for the Collector container. |
|
| Image pull policy for the Compliance container. |
|
|
If you specify |
|
| The memory request for the Collector container. Use this parameter to override the default value. |
|
| The CPU request for the Collector container. Use this parameter to override the default value. |
|
| The memory limit for the Collector container. Use this parameter to override the default value. |
|
| The CPU limit for the Collector container. Use this parameter to override the default value. |
|
| The memory request for the Compliance container. Use this parameter to override the default value. |
|
| The CPU request for the Compliance container. Use this parameter to override the default value. |
|
| The memory limit for the Compliance container. Use this parameter to override the default value. |
|
| The CPU limit for the Compliance container. Use this parameter to override the default value. |
|
| The internal service-to-service TLS certificate that Collector uses. |
|
| The internal service-to-service TLS certificate key that Collector uses. |
|
|
This setting controls whether Kubernetes is configured to contact Red Hat Advanced Cluster Security for Kubernetes with |
|
|
When you set this parameter as |
|
|
This setting controls whether the cluster is configured to contact Red Hat Advanced Cluster Security for Kubernetes with |
|
| This setting controls whether Red Hat Advanced Cluster Security for Kubernetes evaluates policies; if it is disabled, all AdmissionReview requests are automatically accepted. |
|
|
This setting controls the behavior of the admission control service. You must specify |
|
|
If you set this option to |
|
|
Set it to |
|
|
Use this parameter to specify the maximum number of seconds RHACS must wait for an admission review before marking it as fail open. If the admission webhook does not receive information that it is requesting before the end of the timeout period, it fails, but in fail open status, it still allows the operation to succeed. For example, the admission controller would allow a deployment to be created even if a scan had timed out and RHACS could not determine if the deployment violated a policy. Beginning in release 4.5, Red Hat reduced the default timeout setting for the RHACS admission controller webhooks from 20 seconds to 10 seconds, resulting in an effective timeout of 12 seconds within the |
|
| The memory request for the Admission Control container. Use this parameter to override the default value. |
|
| The CPU request for the Admission Control container. Use this parameter to override the default value. |
|
| The memory limit for the Admission Control container. Use this parameter to override the default value. |
|
| The CPU limit for the Admission Control container. Use this parameter to override the default value. |
|
|
Specify a node selector label as |
|
| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Admission Control. This parameter is mainly used for infrastructure nodes. |
|
|
If the admission controller webhook needs a specific |
|
| The internal service-to-service TLS certificate that Admission Control uses. |
|
| The internal service-to-service TLS certificate key that Admission Control uses. |
|
|
Use this parameter to override the default |
|
|
If you specify |
|
|
Specify |
|
|
Specify |
|
|
Deprecated. Specify |
|
| Resource specification for Sensor. |
|
| Resource specification for Admission controller. |
|
| Resource specification for Collector. |
|
| Resource specification for Collector’s Compliance container. |
|
|
If you set this option to |
|
|
If you set this option to |
|
|
If you set this option to |
|
| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. |
|
| Resource specification for Collector’s Compliance container. |
|
| Setting this parameter allows you to modify the scanner log level. Use this option only for troubleshooting purposes. |
|
|
If you set this option to |
|
| The minimum number of replicas for autoscaling. Defaults to 2. |
|
| The maximum number of replicas for autoscaling. Defaults to 5. |
|
|
Specify a node selector label as |
|
| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. |
|
|
Specify a node selector label as |
|
| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. |
|
| The memory request for the Scanner container. Use this parameter to override the default value. |
|
| The CPU request for the Scanner container. Use this parameter to override the default value. |
|
| The memory limit for the Scanner container. Use this parameter to override the default value. |
|
| The CPU limit for the Scanner container. Use this parameter to override the default value. |
|
| The memory request for the Scanner DB container. Use this parameter to override the default value. |
|
| The CPU request for the Scanner DB container. Use this parameter to override the default value. |
|
| The memory limit for the Scanner DB container. Use this parameter to override the default value. |
|
| The CPU limit for the Scanner DB container. Use this parameter to override the default value. |
|
|
If you set this option to |
|
|
To provide security at the network level, RHACS creates default 주의 Disabling creation of default network policies can break communication between RHACS components. If you disable creation of default policies, you must create your own network policies to allow this communication. |
8.4.1.3.1.1. Environment variables
You can specify environment variables for Sensor and Admission controller in the following format:
customize:
envVars:
ENV_VAR1: "value1"
ENV_VAR2: "value2"
The customize setting allows you to specify custom Kubernetes metadata (labels and annotations) for all objects created by this Helm chart and additional pod labels, pod annotations, and container environment variables for workloads.
The configuration is hierarchical, in the sense that metadata defined at a more generic scope (for example, for all objects) can be overridden by metadata defined at a narrower scope (for example, only for the Sensor deployment).
8.4.1.3.2. Installing the secured-cluster-services Helm chart with customizations
After you configure the values-public.yaml and values-private.yaml files, install the secured-cluster-services Helm chart to deploy the following per-cluster and per-node components:
- Sensor
- Admission controller
- Collector
- Scanner: optional for secured clusters when the StackRox Scanner is installed
- Scanner DB: optional for secured clusters when the StackRox Scanner is installed
- Scanner V4 Indexer and Scanner V4 DB: optional for secured clusters when Scanner V4 is installed
Prerequisites
- You must have generated an RHACS init bundle for your cluster.
-
You must have access to the Red Hat Container Registry and a pull secret for authentication. For information about downloading images from
registry.redhat.io, see Red Hat Container Registry Authentication. -
You must have the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created.
Procedure
Run the following command:
$ helm install -n stackrox \ --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <name_of_cluster_init_bundle.yaml> \ -f <path_to_values_public.yaml> \ -f <path_to_values_private.yaml> \ --set imagePullSecrets.username=<username> \ --set imagePullSecrets.password=<password>where:
<path_to_values_public.yaml>- Specifies the path to your public YAML configuration file.
<path_to_values_private.yaml>- Specifies the path to your private YAML configuration file.
<username>- Specifies the user name for your pull secret for Red Hat Container Registry authentication.
<password>- Specifies the password for your pull secret for Red Hat Container Registry authentication.
참고To deploy
secured-cluster-servicesHelm chart by using a continuous integration (CI) system, pass the init bundle YAML file as an environment variable to thehelm installcommand:$ helm install ... -f <(echo "$INIT_BUNDLE_YAML_SECRET")If you are using base64 encoded variables, use the
helm install … -f <(echo "$INIT_BUNDLE_YAML_SECRET" | base64 --decode)command instead.
You can make changes to any configuration options after you have deployed the secured-cluster-services Helm chart.
When using the helm upgrade command to make changes, the following guidelines and requirements apply:
-
You can also specify configuration values using the
--setor--set-fileparameters. However, these options are not saved, and you must manually specify all the options again whenever you make changes. Some changes, such as enabling a new component like Scanner V4, require new certificates to be issued for the component. Therefore, you must provide a CA when making these changes.
-
If the CA was generated by the Helm chart during the initial installation, you must retrieve these automatically generated values from the cluster and provide them to the
helm upgradecommand. The post-installation notes of thecentral-servicesHelm chart include a command for retrieving the automatically generated values. -
If the CA was generated outside of the Helm chart and provided during the installation of the
central-serviceschart, then you must perform that action again when using thehelm upgradecommand, for example, by using the--reuse-valuesflag with thehelm upgradecommand.
-
If the CA was generated by the Helm chart during the initial installation, you must retrieve these automatically generated values from the cluster and provide them to the
Procedure
-
Update the
values-public.yamlandvalues-private.yamlconfiguration files with new values. Run the
helm upgradecommand and specify the configuration files using the-foption:$ helm upgrade -n stackrox \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ --reuse-values \ -f <path_to_values_public.yaml> \ -f <path_to_values_private.yaml>where:
--reuse-values-
Specifies that the modified values are not included in the
values_public.yamlandvalues_private.yamlfiles.
8.4.2. Installing RHACS on secured clusters by using the roxctl CLI
To install RHACS on secured clusters by using the CLI, perform the following steps:
-
Install the
roxctlCLI. - Install Sensor.
8.4.2.1. Installing the roxctl CLI
You must first download the binary. You can install roxctl on Linux, Windows, or macOS.
8.4.2.1.1. Installing the roxctl CLI on Linux
You can install the roxctl CLI binary on Linux by using the following procedure.
roxctl CLI for Linux is available for amd64, arm64, ppc64le, and s390x architectures.
Procedure
Determine the
roxctlarchitecture for the target operating system:$ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"Download the
roxctlCLI:$ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.8/bin/Linux/roxctl${arch}"Make the
roxctlbinary executable:$ chmod +x roxctlPlace the
roxctlbinary in a directory that is on yourPATH:To check your
PATH, execute the following command:$ echo $PATH
Verification
Verify the
roxctlversion you have installed:$ roxctl version
8.4.2.1.2. Installing the roxctl CLI on macOS
You can install the roxctl CLI binary on macOS by using the following procedure.
roxctl CLI for macOS is available for amd64 and arm64 architectures.
Procedure
Determine the
roxctlarchitecture for the target operating system:$ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"Download the
roxctlCLI:$ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.8/bin/Darwin/roxctl${arch}"Remove all extended attributes from the binary:
$ xattr -c roxctlMake the
roxctlbinary executable:$ chmod +x roxctlPlace the
roxctlbinary in a directory that is on yourPATH:To check your
PATH, execute the following command:$ echo $PATH
Verification
Verify the
roxctlversion you have installed:$ roxctl version
8.4.2.1.3. Installing the roxctl CLI on Windows
You can install the roxctl CLI binary on Windows by using the following procedure.
roxctl CLI for Windows is available for the amd64 architecture.
Procedure
Download the
roxctlCLI:$ curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.7.8/bin/Windows/roxctl.exe
Verification
Verify the
roxctlversion you have installed:$ roxctl version
8.4.2.2. Installing Sensor
To monitor a cluster, you must deploy Sensor. You must deploy Sensor into each cluster that you want to monitor. This installation method is also called the manifest installation method.
To perform an installation by using the manifest installation method, follow only one of the following procedures:
- Use the RHACS web portal to download the cluster bundle, and then extract and run the sensor script.
-
Use the
roxctlCLI to generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance.
Prerequisites
- You must have already installed Central services, or you can access Central services by selecting your ACS instance on Red Hat Advanced Cluster Security Cloud Service (RHACS Cloud Service).
8.4.2.2.1. Manifest installation method by using the web portal
Procedure
-
On your secured cluster, in the RHACS portal, go to Platform Configuration
Clusters. -
Select Secure a cluster
Legacy installation method. - Specify a name for the cluster.
Provide appropriate values for the fields based on where you are deploying the Sensor.
-
Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created.
-
Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security
- Click Next to continue with the Sensor setup.
Click Download YAML File and Keys to download the cluster bundle (zip archive).
중요The cluster bundle zip archive includes unique configurations and keys for each cluster. Do not reuse the same files in another cluster.
From a system that has access to the monitored cluster, extract and run the
sensorscript from the cluster bundle:$ unzip -d sensor sensor-<cluster_name>.zip
$ ./sensor/sensor.shIf you get a warning that you do not have the required permissions to deploy Sensor, follow the on-screen instructions, or contact your cluster administrator for help.
After Sensor is deployed, it contacts Central and provides cluster information.
8.4.2.2.2. Manifest installation by using the roxctl CLI
Procedure
Generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance by running the following command:
$ roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "$ROX_ENDPOINT"where:
<ocp_version>-
Specifies the major OpenShift Container Platform version number for your cluster. For example, specify
3for OpenShift Container Platform version3.xand specify4for OpenShift Container Platform version4.x.
From a system that has access to the monitored cluster, extract and run the
sensorscript from the cluster bundle:$ unzip -d sensor sensor-<cluster_name>.zip
$ ./sensor/sensor.shIf you get a warning that you do not have the required permissions to deploy Sensor, follow the on-screen instructions, or contact your cluster administrator for help.
After Sensor is deployed, it contacts Central and provides cluster information.
Verification
Return to the RHACS portal and check if the deployment is successful. If successful, when viewing your list of clusters in Platform Configuration
Clusters, the cluster status displays a green checkmark and a Healthy status. If you do not see a green checkmark, use the following command to check for problems: On Kubernetes, enter the following command:
$ kubectl get pod -n stackrox -w
- Click Finish to close the window.
After installation, Sensor starts reporting security information to RHACS and the RHACS portal dashboard begins showing deployments, images, and policy violations from the cluster on which you have installed the Sensor.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}