5.3. 安装 Central

流程

1. 运行交互式 install 命令：

   $ roxctl central generate interactive

2. 按 Enter 接受提示的默认值或根据需要输入自定义值。

   Enter path to the backup bundle from which to restore keys and certificates (optional):
   Enter PEM cert bundle file (optional): 

   1

   
   Enter administrator password (default: autogenerated):
   Enter orchestrator (k8s, openshift): openshift
   Enter the directory to output the deployment bundle to (default: "central-bundle"):
   Enter the OpenShift major version (3 or 4) to deploy on (default: "0"): 4
   Enter Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional):
   Enter the method of exposing Central (route, lb, np, none) (default: "none"): route 

   2

   
   Enter main image to use (default: "stackrox.io/main:3.0.61.1"):
   Enter whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"):
   Enter whether to enable telemetry (default: "true"):
   Enter the deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"):
   Enter Scanner DB image to use (default: "stackrox.io/scanner-db:2.15.2"):
   Enter Scanner image to use (default: "stackrox.io/scanner:2.15.2"):
   Enter Central volume type (hostpath, pvc): pvc 

   3

   
   Enter external volume name (default: "stackrox-db"):
   Enter external volume size in Gi (default: "100"):
   Enter storage class name (optional if you have a default StorageClass configured):

   1

   如果要添加自定义 TLS 证书，请提供 PEM 编码证书的文件路径。当您指定自定义证书时，交互式安装程序还会提示您为您要使用的自定义证书提供 PEM 私钥。

   2

   要使用 RHACS 门户，您必须使用路由（负载均衡器或节点端口）公开中。

   3

   如果您计划在带有 hostPath 卷的 OpenShift Container Platform 上安装 Red Hat Advanced Cluster Security for Kubernetes，您必须修改 SELinux 策略。

   警告

   在 OpenShift Container Platform 中，对于 hostPath 卷，您必须修改 SELinux 策略以允许访问主机和容器共享的目录。这是因为 SELinux 默认阻止目录共享。要修改 SELinux 策略，请运行以下命令：

   $ sudo chcon -Rt svirt_sandbox_file_t <full_volume_path>

   但是，红帽不推荐修改 SELinux 策略，在 OpenShift Container Platform 上安装时使用 PVC。