RHACS Cloud Service
RHACS Cloud Service Red Hat Advanced Cluster Security for Kubernetes 4.6 About the RHACS Cloud Service Red Hat OpenShift Documentation Team
/sys/kernel/btf/vmlinux /boot/vmlinux-<kernel-version> /lib/modules/<kernel-version>/vmlinux-<kernel-version> /lib/modules/<kernel-version>/build/vmlinux /usr/lib/modules/<kernel-version>/kernel/vmlinux /usr/lib/debug/boot/vmlinux-<kernel-version> /usr/lib/debug/boot/vmlinux-<kernel-version>.debug /usr/lib/debug/lib/modules/<kernel-version>/vmlinux export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2 helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> 3 --set imagePullSecrets.username=<your redhat.com username> \ 4 --set imagePullSecrets.password=<your redhat.com password> 5 helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> 3 --set scanner.disable=false 4 customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2" helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3 helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1 helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh oc get pod -n stackrox -w kubectl get pod -n stackrox -w proxy collector customize: envVars: - name: HTTP_PROXY value: http://egress-proxy.stackrox.svc:xxxx 1 - name: HTTPS_PROXY value: http://egress-proxy.stackrox.svc:xxxx 2 - name: NO_PROXY value: .stackrox.svc 3 export ROX_API_TOKEN=<api_token> export ROX_CENTRAL_ADDRESS=<address>:<port_number> roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2 kubectl create namespace stackrox 1 kubectl create -f <init_bundle>.yaml \ 2 -n <stackrox> 3 helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ helm search repo -l rhacs/ customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2" helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3 helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1 helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh kubectl get pod -n stackrox -w oc -n rhacs-operator delete subscription rhacs-operator kubectl -n rhacs-operator delete subscription rhacs-operator oc -n rhacs-operator delete csv -l operators.coreos.com/rhacs-operator.rhacs-operator kubectl -n rhacs-operator delete csv -l operators.coreos.com/rhacs-operator.rhacs-operator oc -n rhacs-operator describe securedclusters.platform.stackrox.io 1 Conditions: Last Transition Time: 2023-04-19T10:49:57Z Status: False Type: Deployed Last Transition Time: 2023-04-19T10:49:57Z Status: True Type: Initialized Last Transition Time: 2023-04-19T10:59:10Z Message: Deployment.apps "central" is invalid: spec.template.spec.containers[0].resources.requests: Invalid value: "50": must be less than or equal to cpu limit Reason: ReconcileError Status: True Type: Irreconcilable Last Transition Time: 2023-04-19T10:49:57Z Message: No proxy configuration is desired Reason: NoProxyConfig Status: False Type: ProxyConfigFailed Last Transition Time: 2023-04-19T10:49:57Z Message: Deployment.apps "central" is invalid: spec.template.spec.containers[0].resources.requests: Invalid value: "50": must be less than or equal to cpu limit Reason: InstallError Status: True Type: ReleaseFailed -n rhacs-operator logs deploy/rhacs-operator-controller-manager manager 1 helm repo update helm search repo -l rhacs/ helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --version <current-rhacs-version> \ 1 -f values-private.yaml ROXPATH=USD(which roxctl) && rm -f USDROXPATH 1 arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe roxctl version oc -n stackrox set image deploy/sensor sensor=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 1 oc -n stackrox set image ds/collector compliance=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 1 oc -n stackrox set image ds/collector collector=registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8:4.6.3 1 oc -n stackrox set image ds/collector collector=registry.redhat.io/advanced-cluster-security/rhacs-collector-slim-rhel8:{rhacs-version} oc -n stackrox set image deploy/admission-control admission-control=registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.3 oc -n stackrox describe pods | grep 'openshift.io/scc\|^Name:' Name: admission-control-6f4dcc6b4c-2phwd openshift.io/scc: stackrox-admission-control # Name: central-575487bfcb-sjdx8 openshift.io/scc: stackrox-central Name: central-db-7c7885bb-6bgbd openshift.io/scc: stackrox-central-db Name: collector-56nkr openshift.io/scc: stackrox-collector # Name: scanner-68fc55b599-f2wm6 openshift.io/scc: stackrox-scanner Name: scanner-68fc55b599-fztlh # Name: sensor-84545f86b7-xgdwf openshift.io/scc: stackrox-sensor # apiVersion: rbac.authorization.k8s.io/v1 kind: Role 1 metadata: annotations: email: support@stackrox.com owner: stackrox labels: app.kubernetes.io/component: collector app.kubernetes.io/instance: stackrox-secured-cluster-services app.kubernetes.io/name: stackrox app.kubernetes.io/part-of: stackrox-secured-cluster-services app.kubernetes.io/version: 4.4.0 auto-upgrade.stackrox.io/component: sensor name: use-privileged-scc 2 namespace: stackrox 3 rules: 4 - apiGroups: - security.openshift.io resourceNames: - privileged resources: - securitycontextconstraints verbs: - use - - - apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding 5 metadata: annotations: email: support@stackrox.com owner: stackrox labels: app.kubernetes.io/component: collector app.kubernetes.io/instance: stackrox-secured-cluster-services app.kubernetes.io/name: stackrox app.kubernetes.io/part-of: stackrox-secured-cluster-services app.kubernetes.io/version: 4.4.0 auto-upgrade.stackrox.io/component: sensor name: collector-use-scc 6 namespace: stackrox roleRef: 7 apiGroup: rbac.authorization.k8s.io kind: Role name: use-privileged-scc subjects: 8 - kind: ServiceAccount name: collector namespace: stackrox - - - oc -n stackrox create -f ./update-scs.yaml oc delete scc/stackrox-admission-control scc/stackrox-collector scc/stackrox-sensor oc -n stackrox describe pods | grep 'openshift.io/scc\|^Name:' oc -n stackrox edit deploy/sensor 1 oc -n stackrox edit deploy/collector 1 oc -n stackrox edit deploy/admission-control 1 oc get deploy,ds -n stackrox -o wide 1 oc get pod -n stackrox --watch 1 oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":"disabled"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":":9091"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"volumes":[{"name":"tmp-volume","emptyDir":{}},{"name":"cache-volume","emptyDir":{"sizeLimit":"200Mi"}}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"command":["/scanner","--nodeinventory","--config=",""],"env":[{"name":"ROX_NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}},{"name":"ROX_CLAIR_V4_SCANNING","value":"true"},{"name":"ROX_COMPLIANCE_OPERATOR_INTEGRATION","value":"true"},{"name":"ROX_CSV_EXPORT","value":"false"},{"name":"ROX_DECLARATIVE_CONFIGURATION","value":"false"},{"name":"ROX_INTEGRATIONS_AS_CONFIG","value":"false"},{"name":"ROX_NETPOL_FIELDS","value":"true"},{"name":"ROX_NETWORK_DETECTION_BASELINE_SIMULATION","value":"true"},{"name":"ROX_NETWORK_GRAPH_PATTERNFLY","value":"true"},{"name":"ROX_NODE_SCANNING_CACHE_TIME","value":"3h36m"},{"name":"ROX_NODE_SCANNING_INITIAL_BACKOFF","value":"30s"},{"name":"ROX_NODE_SCANNING_MAX_BACKOFF","value":"5m"},{"name":"ROX_PROCESSES_LISTENING_ON_PORT","value":"false"},{"name":"ROX_QUAY_ROBOT_ACCOUNTS","value":"true"},{"name":"ROX_ROXCTL_NETPOL_GENERATE","value":"true"},{"name":"ROX_SOURCED_AUTOGENERATED_INTEGRATIONS","value":"false"},{"name":"ROX_SYSLOG_EXTRA_FIELDS","value":"true"},{"name":"ROX_SYSTEM_HEALTH_PF","value":"false"},{"name":"ROX_VULN_MGMT_WORKLOAD_CVES","value":"false"}],"image":"registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8:4.6.3","imagePullPolicy":"IfNotPresent","name":"node-inventory","ports":[{"containerPort":8444,"name":"grpc","protocol":"TCP"}],"volumeMounts":[{"mountPath":"/host","name":"host-root-ro","readOnly":true},{"mountPath":"/tmp/","name":"tmp-volume"},{"mountPath":"/cache","name":"cache-volume"}]}]}}}}'