升级

先决条件

• 如果从私有镜像 registry 部署镜像，请先将新镜像推送到私有 registry 中，然后替换本节中的命令中的镜像 registry。

流程

• 运行以下命令来升级 Central：

  $ oc -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}' 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  $ oc -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}' 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  $ oc -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.69.2 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  重要

  • 如果您要从 Red Hat Advanced Cluster Security for Kubernetes 3.65.0 升级，必须运行以下命令来创建 stackrox-central-diagnostics 角色：

    $ oc -n stackrox patch role stackrox-central-diagnostics -p '{"rules":[{"apiGroups":["*"],"resources":["deployments","daemonsets","replicasets","configmaps","services"],"verbs":["get","list"]}]}' 1

    1

    如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  • 如果您还没有使用 Helm 或 Operator 安装 Red Hat Advanced Cluster Security for Kubernetes，并希望使用 OpenShift OAuth 服务器启用身份验证，您必须运行以下命令：

    $ oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true

    $ oc -n stackrox patch serviceaccount/central -p '
    {
    "metadata": {
    "annotations": {
    "serviceaccounts.openshift.io/oauth-redirecturi.main": "sso/providers/openshift/callback",
    "serviceaccounts.openshift.io/oauth-redirectreference.main": "{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"central"}}"
    }
    }
    }'

验证

• 检查新 pod 是否已部署：

  $ oc get deploy -n stackrox -o wide 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  $ oc get pod -n stackrox --watch 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

先决条件

• 如果从私有镜像 registry 部署镜像，请先将新镜像推送到私有 registry 中，然后替换本节中的命令中的镜像 registry。
• 如果您在安装 Red Hat Advanced Cluster Security for Kubernetes 时使用了基于 Red Hat UBI 的镜像，请使用以下基于 UBI 的镜像名称替换本节中的命令的镜像名称：

• 如果您已创建了自定义扫描程序配置，则必须在更新扫描程序配置文件前应用这些更改：

  $ roxctl -e "$ROX_CENTRAL_ADDRESS" scanner generate

  $ oc apply -f scanner-bundle/scanner/02-scanner-03-tls-secret.yaml 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  $ oc apply -f scanner-bundle/scanner/02-scanner-04-scanner-config.yaml 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

验证

• 检查新 pod 是否已成功部署：

  $ oc get pod -n stackrox --watch 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

流程

• 检查 Central 日志：

  $ oc logs -n stackrox deploy/central -c central 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  如果升级成功，您会看到类似如下的输出：

  No database restore directory found (this is not an error).
  Migrator: 2019/10/25 17:58:54: starting DB compaction
  Migrator: 2019/10/25 17:58:54: Free fraction of 0.0391 (40960/1048576) is < 0.7500. Will not compact
  badger 2019/10/25 17:58:54 INFO: All 1 tables opened in 2ms
  badger 2019/10/25 17:58:55 INFO: Replaying file id: 0 at offset: 846357
  badger 2019/10/25 17:58:55 INFO: Replay took: 50.324µs
  badger 2019/10/25 17:58:55 DEBUG: Value log discard stats empty
  Migrator: 2019/10/25 17:58:55: DB is up to date. Nothing to do here.
  badger 2019/10/25 17:58:55 INFO: Got compaction priority: {level:0 score:1.73 dropPrefix:[]}
  version: 2019/10/25 17:58:55.189866 ensure.go:49: Info: Version found in the DB was current. We’re good to go!

流程

• 更新就绪度探测路径：

  $ oc -n stackrox patch deploy/sensor -p '{"spec":{"template":{"spec":{"containers":[{"name":"sensor","readinessProbe":{"httpGet":{"path":"/ready"}}}]}}}}' 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

流程

• Red Hat Advanced Cluster Security for Kubernetes 3.64.0 对 SCC 进行了重新命名。如果您要从以下 Red Hat Advanced Cluster Security for Kubernetes 3.64.0 版本升级，则必须删除并重新应用 SCC，否则跳过这一步：

  1. 运行以下命令以更新 Central：

     $ oc apply -f - <<EOF
     kind: SecurityContextConstraints
     apiVersion: security.openshift.io/v1
     metadata:
       name: stackrox-central
       labels:
         app.kubernetes.io/name: stackrox
       annotations:
         kubernetes.io/description: stackrox-central is the security constraint for the central server
         email: support@stackrox.com
         owner: stackrox
     allowHostDirVolumePlugin: false
     allowedCapabilities: []
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     defaultAddCapabilities: []
     fsGroup:
       type: MustRunAs
       ranges:
         - max: 4000
           min: 4000
     priority: 0
     readOnlyRootFilesystem: true
     requiredDropCapabilities: []
     runAsUser:
       type: MustRunAs
       uid: 4000
     seLinuxContext:
       type: MustRunAs
     seccompProfiles:
       - '*'
     users:
       - system:serviceaccount:stackrox:central
     volumes:
       - '*'
     EOF

     $ oc delete scc central

  2. 运行以下命令以更新 Scanner：

     $ oc apply -f - <<EOF
     kind: SecurityContextConstraints
     apiVersion: security.openshift.io/v1
     metadata:
       name: stackrox-scanner
       labels:
         app.kubernetes.io/name: stackrox
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-scanner is the security constraint for the Scanner container
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     users:
       - system:serviceaccount:stackrox:scanner
     volumes:
       - '*'
     allowHostDirVolumePlugin: false
     allowedCapabilities: []
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     defaultAddCapabilities: []
     fsGroup:
       type: RunAsAny
     readOnlyRootFilesystem: false
     requiredDropCapabilities: []
     EOF

     $ oc delete scc scanner

  3. 在每个 OpenShift Secured 集群中运行以下命令：

     $ oc apply -f - <<EOF
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-admission-control
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-admission-control is the security constraint for the admission controller
     users:
       - system:serviceaccount:stackrox:admission-control
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     fsGroup:
       type: RunAsAny
     groups: []
     readOnlyRootFilesystem: true
     allowHostDirVolumePlugin: false
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: false
     allowPrivilegedContainer: false
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - secret
     ---
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-collector
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: This SCC is based on privileged, hostaccess, and hostmount-anyuid
     users:
       - system:serviceaccount:stackrox:collector
     allowHostDirVolumePlugin: true
     allowPrivilegedContainer: true
     fsGroup:
       type: RunAsAny
     groups: []
     priority: 0
     readOnlyRootFilesystem: true
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: true
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - hostPath
       - secret
     ---
     apiVersion: security.openshift.io/v1
     kind: SecurityContextConstraints
     metadata:
       name: stackrox-sensor
       labels:
         app.kubernetes.io/name: stackrox
         auto-upgrade.stackrox.io/component: "sensor"
       annotations:
         email: support@stackrox.com
         owner: stackrox
         kubernetes.io/description: stackrox-sensor is the security constraint for the sensor
     users:
       - system:serviceaccount:stackrox:sensor
       - system:serviceaccount:stackrox:sensor-upgrader
     priority: 0
     runAsUser:
       type: RunAsAny
     seLinuxContext:
       type: RunAsAny
     seccompProfiles:
       - '*'
     supplementalGroups:
       type: RunAsAny
     fsGroup:
       type: RunAsAny
     groups: []
     readOnlyRootFilesystem: true
     allowHostDirVolumePlugin: false
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: true
     allowPrivilegedContainer: false
     allowedCapabilities: []
     defaultAddCapabilities: []
     requiredDropCapabilities: []
     volumes:
       - configMap
       - downwardAPI
       - emptyDir
       - secret
     EOF

     $ oc delete scc admission-control collector sensor

流程

• 检查新 pod 是否已部署：

  $ oc get deploy,ds -n stackrox -o wide 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

  $ oc get pod -n stackrox --watch 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。

先决条件

• 您必须使用 Red Hat Advanced Cluster Security for Kubernetes 3.0.57.0 或更高版本。
• 执行回滚前，持久性存储必须具有可用磁盘空间。Red Hat Advanced Cluster Security for Kubernetes 使用磁盘空间在升级过程中保留数据库副本。如果磁盘空间不足以存储副本，升级失败，您将无法回滚到较早的版本。

流程

• 当升级失败时（ Central 服务启动前），运行以下命令回滚到以前的版本：

  $ oc -n stackrox rollout undo deploy/central 1

  1

  如果使用 Kubernetes，请输入 kubectl 而不是 oc。