Chapter 2. Select your installation platform

Procedure

1. Log in to the Red Hat Hybrid Cloud Console with your Red Hat credentials.
2. From the home page, click the Services drop-down menu, and click Red Hat Ansible Automation Platform.
3. From the navigational menu, expand Automation Hub, and click Collections.
4. In the search field type rhtpa and press enter.
5. Click the trusted_profile_analyzer link on the Red Hat Trusted Profile Analyzer tile.

6. Click the Documentation tab, and follow the steps there to complete the installation of RHTPA on Red Hat Enterprise Linux.

   Note

   For a detailed overview of all the configuration parameters, click the tpa_single_node link under the Roles section.

Procedure

1. On your workstation, open a terminal, and log in to OpenShift by using the command-line interface:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL from the OpenShift web console to use on the command line. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, and click Display Token to view the command.

2. Create a new project for the RHTPA deployment:

   Syntax

   oc new-project PROJECT_NAME

   Example

   $ oc new-project trusted-profile-analyzer

3. Open a new file for editing:

   Example

   $ vi values-rhtpa-aws.yaml

4. Copy and paste the RHTPA values file template into the new values-rhtpa-aws.yaml file.

5. Update the values-rhtpa-aws.yaml file with your relevant AWS information.

   1. Replace REGIONAL_ENDPOINT with your Amazon S3 storage, and Amazon SQS endpoint URLs.
   2. Replace COGNITO_DOMAIN_URL with your Amazon Cognito URL. You can find this information in the AWS Cognito Console, under the App Integration tab.
   3. Replace REGION, USER_POOL_ID, and FRONTEND_CLIENT_ID and WALKER_CLIENT_ID with your relevant Amazon Cognito information. You can find this information in the AWS Cognito Console, in the User pool overview section, and in the App clients and analytics section under the App Integration tab.
   4. Replace UNIQUE_ID with your unique bucket names for bombastic-, vexination-, and v11y-.
   5. Save the file, and quit the editor.

6. Create the S3 storage secret resource by using your AWS credentials:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: storage-credentials
     namespace: PROJECT_NAME
   type: Opaque
   data:
     aws_access_key_id: AWS_ACCESS_KEY
     aws_secret_access_key: AWS_SECRET_KEY

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: storage-credentials
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     aws_access_key_id: RHTPASTORAGE1EXAMPLE
     aws_secret_access_key: xBalrKUtnFEMI/K7RDENG/aPxRfzCYEXAMPLEKEY
   EOF

7. Create the SQS event bus secret resource by using your AWS credentials:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: event-bus-credentials
     namespace: PROJECT_NAME
   type: Opaque
   data:
     aws_access_key_id: AWS_ACCESS_KEY
     aws_secret_access_key: AWS_SECRET_KEY

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: event-bus-credentials
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     aws_access_key_id: RHTPAEVENTBS1EXAMPLE
     aws_secret_access_key: mBaliKUtnFEMI/K6RDENG/aPxRfzCYEXAMPLEKEY
   EOF

8. Create a OpenID Connect (OIDC) walker client secret resource:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-walker
     namespace: PROJECT_NAME
   type: Opaque
   data:
     client-secret: SECRET

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-walker
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     client-secret: 5460cc91-4e20-4edd-881c-b15b169f8a79
   EOF

9. Create two PostgreSQL database secret resources by using your Amazon RDS credentials.

   1. A PostgreSQL standard user secret resource:

      Syntax

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      Example

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: rds.us-east-1.amazonaws.com
        db.name: rhtpadb
        db.user: jdoe
        db.password: example1234
        db.port: 5432
      EOF

   2. A PostgreSQL administrator secret resource:

      Syntax

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      Example

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: rds.us-east-1.amazonaws.com
        db.name: rhtpadb
        db.user: admin
        db.password: example1234
        db.port: 5432
      EOF

   3. From the AWS Management Console, configure the Amazon Virtual Private Cloud (VPC) security group to allow port 5432.

10. Set up your shell environment:

    Syntax

    export NAMESPACE=PROJECT_NAME
    export APP_DOMAIN_URL=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')

    Example

    $ export NAMESPACE=trusted-profile-analyzer
    $ export APP_DOMAIN_URL=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')

11. Add the OpenShift Helm chart repository:

    Example

    $ helm repo add openshift-helm-charts https://charts.openshift.io/

12. Get the latest chart information from the Helm chart repositories:

    Example

    $ helm repo update

13. Run the Helm chart:

    Syntax

    helm install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values PATH_TO_VALUES_FILE --set-string appDomain=$APP_DOMAIN_URL

    Example

    $ helm install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values values-rhtpa-aws.yaml --set-string appDomain=$APP_DOMAIN_URL

    Note

    You can run this Helm chart many times to apply the currently configured state from the values file.

14. Once the installation finishes, you can log in to the RHTPA console by using a user’s credentials from the Cognito user pool. You can find the RHTPA console URL by running the following command:

    Example

    $ oc -n $NAMESPACE get route --selector app.kubernetes.io/name=spog-ui -o jsonpath='https://{.items[0].status.ingress[0].host}{"\n"}'

15. A scheduled Cron job runs each day to gather the latest Common Vulnerabilities and Exposures (CVE) data for RHTPA. Instead of waiting, you can manually start this Cron job by running the following command:

    Example

    $ oc -n $NAMESPACE create job --from=cronjob/v11y-walker v11y-walker-now

    Once the Cron job finishes, delete this Cron job:

    Example

    $ oc -n $NAMESPACE delete job v11y-walker-now

Procedure

1. On your workstation, open a terminal, and log in to OpenShift by using the command-line interface:

   Syntax

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   Example

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   Note

   You can find your login token and URL from the OpenShift web console to use on the command line. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, and click Display Token to view the command.

2. Create a new project for the RHTPA deployment:

   Syntax

   oc new-project PROJECT_NAME

   Example

   $ oc new-project trusted-profile-analyzer

3. Open a new file for editing:

   Example

   $ vi values-rhtpa.yaml

4. Copy and paste the RHTPA values file template into the new values-rhtpa.yaml file.

5. Update the values-rhtpa.yaml file with your information.

   1. Replace S3_ENDPOINT_URL with your relevant S3 storage information.
   2. Replace AMQ_ENDPOINT_URL, and USER_NAME with your relevant AMQ Streams information.
   3. Replace OIDC_ISSUER_URL, FRONTEND_CLIENT_ID and WALKER_CLIENT_ID with your relevant OIDC information.
   4. Save the file, and quit the editor.

6. Create the S3 storage secret resource with your credentials:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: s3-credentials
     namespace: PROJECT_NAME
   type: Opaque
   data:
     user: USER_NAME
     password: PASSWORD

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: s3-credentials
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     user: root
     password: example123
   EOF

7. Create the AMQ Streams secret resource with your credentials:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: kafka-credentials
     namespace: PROJECT_NAME
   type: Opaque
   data:
     client_password: PASSWORD

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: kafka-credentials
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     client_password: example123
   EOF

8. Create a OIDC walker client secret resource:

   Syntax

   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-walker
     namespace: PROJECT_NAME
   type: Opaque
   data:
     client-secret: SECRET

   Example

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-walker
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     client-secret: 5460cc91-4e20-4edd-881c-b15b169f8a79
   EOF

9. Create the two PostgreSQL database secret resources with your database credentials.

   1. A PostgreSQL standard user secret resource:

      Syntax

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      Example

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: postgresql.example.com
        db.name: rhtpadb
        db.user: jdoe
        db.password: example1234
        db.port: 5432
      EOF

   2. A PostgreSQL administrator secret resource:

      Syntax

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      Example

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: postgresql.example.com
        db.name: rhtpadb
        db.user: admin
        db.password: example1234
        db.port: 5432
      EOF

10. Set up your shell environment:

    Syntax

    export NAMESPACE=PROJECT_NAME
    export APP_DOMAIN_URL=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')

    Example

    $ export NAMESPACE=trusted-profile-analyzer
    $ export APP_DOMAIN_URL=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')

11. Add the OpenShift Helm chart repository:

    Example

    $ helm repo add openshift-helm-charts https://charts.openshift.io/

12. Get the latest chart information from the Helm chart repositories:

    Example

    $ helm repo update

13. Run the Helm chart:

    Syntax

    helm install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values PATH_TO_VALUES_FILE --set-string appDomain=$APP_DOMAIN_URL

    Example

    $ helm install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values values-rhtpa.yaml --set-string appDomain=$APP_DOMAIN_URL

    Note

    You can run this Helm chart many times to apply the currently configured state from the values file.

14. Once the installation finishes, you can log in to the RHTPA console by using a user’s credentials from your OIDC provider. You can find the RHTPA console URL by running the following command:

    Example

    $ oc -n $NAMESPACE get route --selector app.kubernetes.io/name=spog-ui -o jsonpath='https://{.items[0].status.ingress[0].host}{"\n"}'

15. A scheduled Cron job runs each day to gather the latest Common Vulnerabilities and Exposures (CVE) data for RHTPA. Instead of waiting, you can manually start this Cron job by running the following command:

    Example

    $ oc -n $NAMESPACE create job --from=cronjob/v11y-walker v11y-walker-now

    Once the Cron job finishes, delete this Cron job:

    Example

    $ oc -n $NAMESPACE delete job v11y-walker-now