Installing
Installing Red Hat Advanced Cluster Security for Kubernetes 4.6 Installing Red Hat Advanced Cluster Security for Kubernetes Red Hat OpenShift Documentation Team
/sys/kernel/btf/vmlinux /boot/vmlinux-<kernel-version> /lib/modules/<kernel-version>/vmlinux-<kernel-version> /lib/modules/<kernel-version>/build/vmlinux /usr/lib/modules/<kernel-version>/kernel/vmlinux /usr/lib/debug/boot/vmlinux-<kernel-version> /usr/lib/debug/boot/vmlinux-<kernel-version>.debug /usr/lib/debug/lib/modules/<kernel-version>/vmlinux spec: central: declarativeConfiguration: configMaps: - name: "<declarative-configs>" 1 secrets: - name: "<sensitive-declarative-configs>" 2 CREATE USER stackrox WITH PASSWORD <password>; CREATE DATABASE stackrox; \connect stackrox CREATE SCHEMA stackrox; REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE USAGE ON SCHEMA public FROM PUBLIC; REVOKE ALL ON DATABASE stackrox FROM PUBLIC; CREATE ROLE readwrite; GRANT CONNECT ON DATABASE stackrox TO readwrite; GRANT USAGE ON SCHEMA stackrox TO readwrite; GRANT USAGE, CREATE ON SCHEMA stackrox TO readwrite; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA stackrox TO readwrite; ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO readwrite; GRANT USAGE ON ALL SEQUENCES IN SCHEMA stackrox TO readwrite; ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT USAGE ON SEQUENCES TO readwrite; GRANT readwrite TO stackrox; oc create secret generic external-db-password \ 1 --from-file=password=<password.txt> 2 spec: central: declarativeConfiguration: configMaps: - name: <declarative-configs> 1 secrets: - name: <sensitive-declarative-configs> 2 spec: tls: additionalCAs: - name: db-ca content: | <certificate> oc -n stackrox get secret central-htpasswd -o go-template='{{index .data "password" | base64decode}}' oc -n stackrox get route central -o jsonpath="{.status.ingress[0].host}" helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.route.enabled=true helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.loadBalancer.enabled=true helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> 2 env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain htpasswd: | admin:<bcrypt-hash> central: declarativeConfiguration: mounts: configMaps: - declarative-configs secrets: - sensitive-declarative-configs helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> 1 helm upgrade -n stackrox stackrox-central-services rhacs/central-services --reuse-values \ 1 -f <path_to_init_bundle_file -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version roxctl central generate interactive Path to the backup bundle from which to restore keys and certificates (optional): PEM cert bundle file (optional): 1 Disable the administrator password (only use this if you have already configured an IdP for your instance) (default: "false"): Create PodSecurityPolicy resources (for pre-v1.25 Kubernetes) (default: "false"): 2 Administrator password (default: autogenerated): Orchestrator (k8s, openshift): Default container images settings (rhacs, opensource); it controls repositories from where to download the images, image names and tags format (default: "rhacs"): The directory to output the deployment bundle to (default: "central-bundle"): Whether to enable telemetry (default: "true"): The central-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.6.0"): List of secrets to add as declarative configuration mounts in central (default: "[]"): 3 The method of exposing Central (lb, np, none) (default: "none"): 4 The main image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.0"): Whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"): List of config maps to add as declarative configuration mounts in central (default: "[]"): 5 The deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"): Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional): The scanner-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.6.0"): The scanner image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.6.0"): The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.6.0"): The scanner-v4 image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.6.0"): External volume type (hostpath, pvc): hostpath Path on the host (default: "/var/lib/stackrox-central"): Node selector key (e.g. kubernetes.io/hostname): Node selector value: sudo chcon -Rt svirt_sandbox_file_t <full_volume_path> ./central-bundle/central/scripts/setup.sh oc create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml oc create -R -f central-bundle/central oc get pod -n stackrox -w cat central-bundle/password overlays: - apiVersion: v1 1 kind: ConfigMap 2 name: my-configmap 3 patches: - path: .data 4 value: | 5 key1: data2 key2: data2 apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ServiceAccount name: central patches: - path: metadata.annotations.eks\.amazonaws\.com/role-arn value: "\"arn:aws:iam:1234:role\"" apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[name:central].env[-1] value: | name: MY_ENV_VAR value: value apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy name: allow-ext-to-central patches: - path: spec.ingress[-1] value: | ports: - port: 999 protocol: TCP apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ConfigMap name: central-endpoints patches: - path: data value: | endpoints.yaml: | disableDefault: false apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[-1] value: | name: nginx image: nginx ports: - containerPort: 8000 name: http protocol: TCP export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2 helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> 3 --set scanner.disable=false 4 customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2" helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3 helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1 helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh oc get pod -n stackrox -w kubectl get pod -n stackrox -w overlays: - apiVersion: v1 1 kind: ConfigMap 2 name: my-configmap 3 patches: - path: .data 4 value: | 5 key1: data2 key2: data2 apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ServiceAccount name: central patches: - path: metadata.annotations.eks\.amazonaws\.com/role-arn value: "\"arn:aws:iam:1234:role\"" apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[name:central].env[-1] value: | name: MY_ENV_VAR value: value apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy name: allow-ext-to-central patches: - path: spec.ingress[-1] value: | ports: - port: 999 protocol: TCP apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ConfigMap name: central-endpoints patches: - path: data value: | endpoints.yaml: | disableDefault: false apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[-1] value: | name: nginx image: nginx ports: - containerPort: 8000 name: http protocol: TCP oc get route central -n stackrox oc get service central-loadbalancer -n stackrox oc port-forward svc/central 18443:443 -n stackrox oc new-project test oc run shell --labels=app=shellshock,team=test-team --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2014-6271 -n test oc run samba --labels=app=rce --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2017-7494 -n test helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.route.enabled=true helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.loadBalancer.enabled=true helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> 2 env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain htpasswd: | admin:<bcrypt-hash> central: declarativeConfiguration: mounts: configMaps: - declarative-configs secrets: - sensitive-declarative-configs helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> 1 helm upgrade -n stackrox stackrox-central-services rhacs/central-services --reuse-values \ 1 -f <path_to_init_bundle_file -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version roxctl central generate interactive Path to the backup bundle from which to restore keys and certificates (optional): PEM cert bundle file (optional): 1 Disable the administrator password (only use this if you have already configured an IdP for your instance) (default: "false"): Create PodSecurityPolicy resources (for pre-v1.25 Kubernetes) (default: "false"): 2 Administrator password (default: autogenerated): Orchestrator (k8s, openshift): Default container images settings (rhacs, opensource); it controls repositories from where to download the images, image names and tags format (default: "rhacs"): The directory to output the deployment bundle to (default: "central-bundle"): Whether to enable telemetry (default: "true"): The central-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.6.0"): List of secrets to add as declarative configuration mounts in central (default: "[]"): 3 The method of exposing Central (lb, np, none) (default: "none"): 4 The main image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.0"): Whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"): List of config maps to add as declarative configuration mounts in central (default: "[]"): 5 The deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"): Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional): The scanner-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.6.0"): The scanner image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.6.0"): The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.6.0"): The scanner-v4 image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.6.0"): External volume type (hostpath, pvc): hostpath Path on the host (default: "/var/lib/stackrox-central"): Node selector key (e.g. kubernetes.io/hostname): Node selector value: sudo chcon -Rt svirt_sandbox_file_t <full_volume_path> ./central-bundle/central/scripts/setup.sh oc create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml kubectl create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml oc create -R -f central-bundle/central kubectl create -R -f central-bundle/central oc get pod -n stackrox -w kubectl get pod -n stackrox -w cat central-bundle/password export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2 kubectl create namespace stackrox 1 kubectl create -f <init_bundle>.yaml \ 2 -n <stackrox> 3 helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2" helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3 helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1 helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh kubectl get pod -n stackrox -w kubectl get service central-loadbalancer -n stackrox kubectl port-forward svc/central 18443:443 -n stackrox kubectl create namespace test kubectl run shell --labels=app=shellshock,team=test-team --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2014-6271 -n test kubectl run samba --labels=app=rce --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2017-7494 -n test oc delete namespace stackrox kubectl delete namespace stackrox oc get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs oc delete --wait oc delete scc -l "app.kubernetes.io/name=stackrox" oc delete ValidatingWebhookConfiguration stackrox kubectl get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs kubectl delete --wait kubectl delete ValidatingWebhookConfiguration stackrox for namespace in USD(oc get ns | tail -n +2 | awk '{print USD1}'); do oc label namespace USDnamespace namespace.metadata.stackrox.io/id-; oc label namespace USDnamespace namespace.metadata.stackrox.io/name-; oc annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done for namespace in USD(kubectl get ns | tail -n +2 | awk '{print USD1}'); do kubectl label namespace USDnamespace namespace.metadata.stackrox.io/id-; kubectl label namespace USDnamespace namespace.metadata.stackrox.io/name-; kubectl annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done