9.3. Manually upgrading secured clusters in RHACS Cloud Service by using the roxctl CLI

Procedure

1. Determine the roxctl architecture for the target operating system:

   $ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"

2. Download the roxctl CLI:

   $ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.8/bin/Linux/roxctl${arch}"

3. Make the roxctl binary executable:

   $ chmod +x roxctl

4. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   $ echo $PATH

Procedure

1. Determine the roxctl architecture for the target operating system:

   $ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"

2. Download the roxctl CLI:

   $ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.8/bin/Darwin/roxctl${arch}"

3. Remove all extended attributes from the binary:

   $ xattr -c roxctl

4. Make the roxctl binary executable:

   $ chmod +x roxctl

5. Place the roxctl binary in a directory that is on your PATH:

   To check your PATH, execute the following command:

   $ echo $PATH

Procedure

1. Update the Sensor image:

   $ oc -n stackrox set image deploy/sensor sensor=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.8

2. Update the Compliance image:

   $ oc -n stackrox set image ds/collector compliance=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.8

3. Update the Collector image:

   $ oc -n stackrox set image ds/collector collector=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8:4.7.8

4. Update the admission control image:

   $ oc -n stackrox set image deploy/admission-control admission-control=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.7.8

   중요

   If you have installed RHACS on Red Hat OpenShift by using the roxctl CLI, you need to migrate the security context constraints (SCCs).

   For more information, see "Migrating SCCs during the manual upgrade" in the "Additional resources" section.

Procedure

1. List all of the RHACS services that are deployed on all secured clusters:

   $ oc -n stackrox describe pods | grep 'openshift.io/scc\|^Name:'

   Example output

   Name:      admission-control-6f4dcc6b4c-2phwd
              openshift.io/scc: stackrox-admission-control
   #...
   Name:      central-575487bfcb-sjdx8
              openshift.io/scc: stackrox-central
   Name:      central-db-7c7885bb-6bgbd
              openshift.io/scc: stackrox-central-db
   Name:      collector-56nkr
              openshift.io/scc: stackrox-collector
   #...
   Name:      scanner-68fc55b599-f2wm6
              openshift.io/scc: stackrox-scanner
   Name:      scanner-68fc55b599-fztlh
   #...
   Name:      sensor-84545f86b7-xgdwf
              openshift.io/scc: stackrox-sensor
   #...

   In this example, you can see that each pod has its own custom SCC, which is specified through the openshift.io/scc field.

2. Add the required roles and role bindings to use the Red Hat OpenShift SCCs instead of the RHACS custom SCCs.

3. To add the required roles and role bindings to use the Red Hat OpenShift SCCs for all secured clusters, complete the following steps:

   1. Create a file named upgrade-scs.yaml that defines the role and role binding resources by using the following content:

      예 9.1. Example YAML file

      apiVersion: rbac.authorization.k8s.io/v1
      kind: Role  #
      metadata:
        annotations:
           email: support@stackrox.com
           owner: stackrox
        labels:
           app.kubernetes.io/component: collector
           app.kubernetes.io/instance: stackrox-secured-cluster-services
           app.kubernetes.io/name: stackrox
           app.kubernetes.io/part-of: stackrox-secured-cluster-services
           app.kubernetes.io/version: 4.4.0
           auto-upgrade.stackrox.io/component: sensor
        name: use-privileged-scc  #
        namespace: stackrox #
      rules:  #
      - apiGroups:
        - security.openshift.io
        resourceNames:
        - privileged
        resources:
        - securitycontextconstraints
        verbs:
        - use
      - - -
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding #
      metadata:
        annotations:
           email: support@stackrox.com
           owner: stackrox
        labels:
           app.kubernetes.io/component: collector
           app.kubernetes.io/instance: stackrox-secured-cluster-services
           app.kubernetes.io/name: stackrox
           app.kubernetes.io/part-of: stackrox-secured-cluster-services
           app.kubernetes.io/version: 4.4.0
           auto-upgrade.stackrox.io/component: sensor
        name: collector-use-scc #
        namespace: stackrox
      roleRef: #
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: use-privileged-scc
      subjects: #
      - kind: ServiceAccount
        name: collector
        namespace: stackrox
      - - -

      where:

      kind: Role

      Specifies the type of Kubernetes resource, in this example, Role.

      metadata.name: <rolename>

      Specifies the name of the role resource.

      metadata.namespace

      Specifies the namespace in which the role is created.

      Rules

      Specifies the permissions granted by the role resource.

      kind: RoleBinding

      Specifies the type of Kubernetes resource, in this example, RoleBinding.

      metadata.name: <rolebindingname>

      Specifies the name of the role binding resource.

      metadata.roleRef

      Specifies the role to bind in the same namespace.

      metadata.subjects

      Specifies the subjects that are bound to the role.

   2. Create the role and role binding resources specified in the upgrade-scs.yaml file by running the following command:

      $ oc -n stackrox create -f ./update-scs.yaml

      중요

      You must run this command on each secured cluster to create the role and role bindings specified in the upgrade-scs.yaml file.

4. Delete the SCCs that are specific to RHACS:

   1. To delete the SCCs that are specific to all secured clusters, run the following command:

      $ oc delete scc/stackrox-admission-control scc/stackrox-collector scc/stackrox-sensor

      중요

      You must run this command on each secured cluster to delete the SCCs that are specific to each secured cluster.