3.3. 升级中央集群

流程

1. 修补本地角色：

   $ oc -n stackrox patch role edit -p '{"rules":[{"apiGroups":["*"],"resources":["*"],"verbs":["create","get", "list", "watch", "update", "patch", "delete","deletecollection"]}]}'

   Copy to Clipboard Toggle word wrap

2. 清理现有的角色和角色绑定：

   $ oc -n stackrox delete RoleBinding admission-control-use-scc || true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox delete RoleBinding sensor-use-scc || true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox delete Role use-anyuid-scc || true

   Copy to Clipboard Toggle word wrap

3. 通过删除硬编码的安全上下文，将 sensor 和 admission-control 设置为 restricted[-v2] 安全性上下文约束：

   $ oc -n stackrox patch deploy sensor -p '{"spec":{"template":{"spec":{"securityContext":null}}}}' 

   1

   Copy to Clipboard Toggle word wrap

   1

   Red Hat Advanced Cluster Security for Kubernetes 会自动重新创建 pod，但 sensor 可能需要一些时间才能重启。

   $ oc -n stackrox patch deploy admission-control -p '{"spec":{"template":{"spec":{"securityContext":null}}}}'

   Copy to Clipboard Toggle word wrap

4. 运行以下命令来升级 Central：

   $ oc -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.73.5 

   1

   Copy to Clipboard Toggle word wrap

   1

   如果从私有镜像 registry 部署镜像，请将新镜像推送到私有 registry 中，并在此处替换镜像 registry 地址。

   重要

   如果您还没有使用 Helm 或 Operator 安装 Red Hat Advanced Cluster Security for Kubernetes，并希望使用 OpenShift OAuth 服务器启用身份验证，您必须运行以下命令：

   $ oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true

   Copy to Clipboard Toggle word wrap

   $ oc -n stackrox patch serviceaccount/central -p '
   {
   "metadata": {
   "annotations": {
   "serviceaccounts.openshift.io/oauth-redirecturi.main": "sso/providers/openshift/callback",
   "serviceaccounts.openshift.io/oauth-redirectreference.main": "{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"central"}}"
   }
   }
   }'

   Copy to Clipboard Toggle word wrap

流程

1. 修补本地角色：

   $ kubectl -n stackrox patch role edit -p '{"rules":[{"apiGroups":["*"],"resources":["*"],"verbs":["create","get", "list", "watch", "update", "patch", "delete","deletecollection"]}]}'

   Copy to Clipboard Toggle word wrap

2. 运行以下命令来升级 Central：

   $ kubectl -n stackrox patch deploy/central -p '{"spec":{"template":{"spec":{"containers":[{"name":"central","env":[{"name":"ROX_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}}]}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ kubectl -n stackrox patch deployment/scanner -p '{"spec":{"template":{"spec":{"containers":[{"name":"scanner","securityContext":{"runAsUser":65534}}]}}}}'

   Copy to Clipboard Toggle word wrap

   $ kubectl -n stackrox set image deploy/central central=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:3.73.5 

   1

   Copy to Clipboard Toggle word wrap

   1

   如果从私有镜像 registry 部署镜像，请将新镜像推送到私有 registry 中，并在此处替换镜像 registry 地址。

流程

1. 下载 roxctl CLI 的最新版本：

   $ curl -O https://mirror.openshift.com/pub/rhacs/assets/3.73.5/bin/Linux/roxctl

   Copy to Clipboard Toggle word wrap

2. 使 roxctl 二进制文件可执行：

   $ chmod +x roxctl

   Copy to Clipboard Toggle word wrap

3. 将 roxctl 二进制文件放到 PATH 中的目录中：

   要查看您的 PATH，请执行以下命令：

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

流程

1. 下载 roxctl CLI 的最新版本：

   $ curl -O https://mirror.openshift.com/pub/rhacs/assets/3.73.5/bin/Darwin/roxctl

   Copy to Clipboard Toggle word wrap

2. 从二进制文件中删除所有扩展属性：

   $ xattr -c roxctl

   Copy to Clipboard Toggle word wrap

3. 使 roxctl 二进制文件可执行：

   $ chmod +x roxctl

   Copy to Clipboard Toggle word wrap

4. 将 roxctl 二进制文件放到 PATH 中的目录中：

   要查看您的 PATH，请执行以下命令：

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

流程

1. 应用补丁：

   • 如果使用 OpenShift Container Platform，请输入以下命令：

     $ oc -n stackrox patch deployment.apps/scanner-db --patch '{"spec":{"template":{"spec":{"initContainers":[{"name":"init-db","env":[{"name":"POSTGRES_PASSWORD_FILE","value":"/run/secrets/stackrox.io/secrets/password"}],"command":["/usr/local/bin/docker-entrypoint.sh","postgres","-c","config_file=/etc/postgresql.conf"],"volumeMounts":[{"name":"db-data","mountPath":"/var/lib/postgresql/data"},{"name":"scanner-db-tls-volume","mountPath":"/run/secrets/stackrox.io/certs","readOnly":true},{"name":"scanner-db-password","mountPath":"/run/secrets/stackrox.io/secrets","readOnly":true}],"securityContext":{"runAsGroup":70,"runAsNonRoot":true,"runAsUser":70}}]}}}}'

     Copy to Clipboard Toggle word wrap

   • 如果使用 Kubernetes，请输入以下命令：

     $ kubectl -n stackrox patch deployment.apps/scanner-db --patch '{"spec":{"template":{"spec":{"initContainers":[{"name":"init-db","env":[{"name":"POSTGRES_PASSWORD_FILE","value":"/run/secrets/stackrox.io/secrets/password"}],"command":["/usr/local/bin/docker-entrypoint.sh","postgres","-c","config_file=/etc/postgresql.conf"],"volumeMounts":[{"name":"db-data","mountPath":"/var/lib/postgresql/data"},{"name":"scanner-db-tls-volume","mountPath":"/run/secrets/stackrox.io/certs","readOnly":true},{"name":"scanner-db-password","mountPath":"/run/secrets/stackrox.io/secrets","readOnly":true}],"securityContext":{"runAsGroup":70,"runAsNonRoot":true,"runAsUser":70}}]}}}}'

     Copy to Clipboard Toggle word wrap

2. 删除路径：

   • 如果使用 OpenShift Container Platform，请输入以下命令：

     $ oc -n stackrox patch deployment.apps/scanner-db --type json --patch '[{"op":"remove","path":"/spec/template/spec/containers/0/volumeMounts/2"}]'

     Copy to Clipboard Toggle word wrap

   • 如果使用 Kubernetes，请输入以下命令：

     $ kubectl -n stackrox patch deployment.apps/scanner-db --type json --patch '[{"op":"remove","path":"/spec/template/spec/containers/0/volumeMounts/2"}]'

     Copy to Clipboard Toggle word wrap