Chapter 5. Enabling offline mode
Chapter 5. Enabling offline mode You can use Red Hat Advanced Cluster Security for Kubernetes for clusters that are not connected to the internet by enabling the offline mode. In offline mode, Red Hat Advanced Cluster Security for Kubernetes components do not connect to addresses or hosts on the internet. Note Red Hat Advanced Cluster Security for Kubernetes does not determine if the user-supplied hostnames, IP addresses, or other resources are on the internet. For example, if you try to integrate with a Docker registry hosted on the internet, Red Hat Advanced Cluster Security for Kubernetes will not block this request. To deploy and operate Red Hat Advanced Cluster Security for Kubernetes in offline mode: Download RHACS images and install them in your clusters. If you are using OpenShift Container Platform, you can use Operator Lifecycle Manager (OLM) and OperatorHub to download images to a workstation that is connected to the internet. The workstation then pushes images to a mirror registry that is also connected to your secured cluster. For other platforms, you can use a program such as Skopeo or Docker to pull the images from the remote registry and push them to your own private registry, as described in Downloading images for offline use . Enable offline mode during installation. Update Scanner's vulnerability list by uploading a new definitions file at least once per day. Important You can only enable offline mode during the installation, and not during an upgrade. 5.1. Downloading images for offline use 5.1.1. Image versions You can manually pull, retag, and push Red Hat Advanced Cluster Security for Kubernetes images to your registry. The current version includes the following images: Table 5.1. Red Hat Advanced Cluster Security for Kubernetes images Image Description Current version Main Includes Central, Sensor, Admission controller, and Compliance components. Also includes roxctl for use in continuous integration (CI) systems. registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 Central DB PostgreSQL instance that provides the database storage for Central. registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.6.3 Scanner Scans images and nodes. registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.6.3 registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8:4.6.3 Scanner DB Stores image scan results and vulnerability definitions. registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.6.3 Scanner V4 Scans images. registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.6.3 Scanner V4 DB Stores image scan results and vulnerability definitions for Scanner V4. registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.6.3 Collector Collects runtime activity in Kubernetes or OpenShift Container Platform clusters. registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8:4.6.3 registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8:4.6.3 5.1.1.1. Retagging images You can download and retag images using the Docker command-line interface. Important When you retag an image, you must maintain the name of the image and the tag. For example, use: USD docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 <your_registry>/rhacs-main-rhel8:4.6.3 and do not retag like the following example: USD docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 <your_registry>/other-name:latest Procedure Log in to the registry: USD docker login registry.redhat.io Pull the image: USD docker pull <image> Retag the image: USD docker tag <image> <new_image> Push the updated image to your registry: USD docker push <new_image> 5.2. Enabling offline mode during installation You can enable offline mode during the installation of Red Hat Advanced Cluster Security for Kubernetes. 5.2.1. Enabling offline mode by using Helm configuration You can enable offline mode during the installation when you are installing Red Hat Advanced Cluster Security for Kubernetes by using a Helm chart. Procedure When installing the central-services Helm chart, set the value of the env.offlineMode environmental variable to true in the values-public.yaml configuration file. When installing the secured-cluster-services Helm chart, set the value of the config.offlineMode parameter to true in the values-public.yaml configuration file. 5.2.2. Enabling offline mode by using the roxctl CLI You can enable offline mode when you are installing Red Hat Advanced Cluster Security for Kubernetes by using the roxctl CLI. Procedure If you are using a registry other than the default internet-connected registry ( registry.redhat.io ), provide the locations where you have pushed the Red Hat Advanced Cluster Security for Kubernetes images when answering the image to use prompts: Enter main image to use (if unset, the default will be used): <your_registry>/rhacs-main-rhel8:4.6.3 Note The default image depends on your answer for the prompt Enter default container images settings: . If you entered rhacs , the default option, the default image will be registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 . Enter Scanner DB image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-db-rhel8:4.6.3 Enter Scanner image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-rhel8:4.6.3 To enable the offline mode, enter true when answering the Enter whether to run StackRox in offline mode prompt: Enter whether to run StackRox in offline mode, which avoids reaching out to the internet (default: "false"): true Later, when you add Sensor to a remote cluster in the Platform Configuration Clusters view in the RHACS portal, you must specify your the Collector image name in the Collector Image Repository field. 5.3. Updating Scanner definitions in offline mode Scanner maintains a database of vulnerabilities. When Red Hat Advanced Cluster Security for Kubernetes (RHACS) runs in normal mode, Central retrieves the latest vulnerability data from the internet, and Scanner retrieves vulnerability data from Central. However, if you are using RHACS in offline mode, you must manually update the vulnerability data. To manually update the vulnerability data, you must upload a definitions file to Central, and Scanner then retrieves the vulnerability data from Central. In both online and offline mode, Scanner checks for new data from Central every 5 minutes by default. In online mode, Central also checks for new data from the internet approximately every 5-20 minutes. The offline data source is updated approximately every 3 hours. After the data has been uploaded to Central, Scanner downloads the data and updates its local vulnerability database. To update the definitions in offline mode, perform the following steps: Download the definitions. Upload the definitions to Central. 5.3.1. Downloading Scanner definitions If you are running Red Hat Advanced Cluster Security for Kubernetes in offline mode, you can download the vulnerability definitions database that Scanner uses and then upload it to Central. Prerequisites To download Scanner definitions, you need a system with internet access. Procedure To download the definitions, perform one of the following actions: Recommended: Beginning with RHACS version 4.4, use the roxctl scanner download-db --scanner-db-file scanner-vuln-updates.zip command to download the definitions. Go to https://install.stackrox.io/scanner/scanner-vuln-updates.zip to download the definitions. Additional resources roxctl scanner download-db 5.3.2. Uploading definitions to Central To upload Scanner definitions to Central, you can either use an API token or your administrator password. Red Hat recommends using an authentication token in a production environment because each token is assigned specific access control permissions. 5.3.2.1. Uploading definitions to Central by using an API token You can upload the vulnerability definitions database that Scanner uses to Central by using an API token. Prerequisites You must have an API token with the administrator role. You must have installed the roxctl command-line interface (CLI). Procedure Set the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables: USD export ROX_API_TOKEN=<api_token> USD export ROX_CENTRAL_ADDRESS=<address>:<port_number> Run the following command to upload the definitions file: USD roxctl scanner upload-db \ -e "USDROX_CENTRAL_ADDRESS" \ --scanner-db-file=<compressed_scanner_definitions.zip> 5.3.2.1.1. Additional resources Authenticating by using the roxctl CLI 5.3.2.2. Uploading definitions to Central by using the administrator password You can upload the vulnerability definitions database that Scanner uses to Central by using your Red Hat Advanced Cluster Security for Kubernetes administrator password. Prerequisites You must have the administrator password. You must have installed the roxctl command-line interface (CLI). Procedure Set the ROX_CENTRAL_ADDRESS environment variable: USD export ROX_CENTRAL_ADDRESS=<address>:<port_number> Run the following command to upload the definitions file: USD roxctl scanner upload-db \ -p <your_administrator_password> \ -e "USDROX_CENTRAL_ADDRESS" \ --scanner-db-file=<compressed_scanner_definitions.zip> 5.4. Updating kernel support packages in offline mode Note Support packages are deprecated and have no effect on secured clusters running version 4.5 or later. Support package uploads only affect secured clusters on version 4.4 and earlier. Collector monitors the runtime activity for each node in your secured clusters. To monitor the activities, Collector requires probes in the form of eBPF programs. With the CORE_BPF collection method, the probe is not specific to any kernel version, and can still be used after the underlying kernel has been updated. This collection method does not require you to provide or update a support package. Instead, when you use the collection method EBPF , the probes are specific to the Linux kernel version installed on the host. The Collector image contains a set of built-in probes for the kernels supported at release time. However, later kernels will require newer probes. When Red Hat Advanced Cluster Security for Kubernetes runs in normal mode (connected to the internet), Collector automatically downloads a new probe if the required probe is not built in. In offline mode, you can manually download packages containing probes for all recent and supported Linux kernel versions and upload them to Central. Collectors then download these probes from Central. Collector checks for the new probes in the following order. It checks: The existing Collector image. The kernel support package (if you have uploaded one to Central). A Red Hat-operated server available on the internet. Collector uses Central's network connection to check and download the probes. If Collector does not get new probes after checking, it reports a CrashLoopBackoff event. If your network configuration restricts outbound traffic, you can manually download packages containing probes for all recent and supported Linux kernel versions and upload them to Central. Collectors then download these probes from Central, thus avoiding any outbound internet access. 5.4.1. Downloading kernel support packages Note Support packages are deprecated and have no effect on secured clusters running version 4.5 or later. Support package uploads only affect secured clusters on version 4.4 and earlier. If you are running Red Hat Advanced Cluster Security for Kubernetes in offline mode, you can download packages containing probes for all recent and supported Linux kernel versions and then upload them to Central. Procedure View and download available support packages from https://install.stackrox.io/collector/support-packages/index.html . The kernel support packages list categorizes support packages based on Red Hat Advanced Cluster Security for Kubernetes version. 5.4.2. Uploading kernel support packages to Central You can upload the kernel support packages containing probes for all recent and supported Linux kernel versions to Central. Prerequisites You must have an API token with the administrator role. You must have installed the roxctl command-line interface (CLI). Procedure Set the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables: USD export ROX_API_TOKEN=<api_token> USD export ROX_CENTRAL_ADDRESS=<address>:<port_number> Run the following command to upload the kernel support packages: USD roxctl collector support-packages upload <package_file> \ -e "USDROX_CENTRAL_ADDRESS" Note When you upload a new support package that includes content uploaded to Central previously, only new files are uploaded. When you upload a new support package that includes files with the same name but different contents than those present on the Central, roxctl shows a warning message and does not overwrite files. You can use the --overwrite option with the upload command to overwrite the files. When you upload a support package that contains a required probe, Central does not make any outbound requests (to the internet) for downloading this probe. Central uses the probe from the support package.
docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 <your_registry>/rhacs-main-rhel8:4.6.3 docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 <your_registry>/other-name:latest docker login registry.redhat.io docker pull <image> docker tag <image> <new_image> docker push <new_image> Enter main image to use (if unset, the default will be used): <your_registry>/rhacs-main-rhel8:4.6.3 Enter Scanner DB image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-db-rhel8:4.6.3 Enter Scanner image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-rhel8:4.6.3 Enter whether to run StackRox in offline mode, which avoids reaching out to the internet (default: "false"): true export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl scanner upload-db -e "USDROX_CENTRAL_ADDRESS" --scanner-db-file=<compressed_scanner_definitions.zip> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl scanner upload-db -p <your_administrator_password> -e "USDROX_CENTRAL_ADDRESS" --scanner-db-file=<compressed_scanner_definitions.zip> export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl collector support-packages upload <package_file> -e "USDROX_CENTRAL_ADDRESS"