Operating
Operating Red Hat Advanced Cluster Security for Kubernetes 4.6 Operating Red Hat Advanced Cluster Security for Kubernetes Red Hat OpenShift Documentation Team
apiVersion: compliance.openshift.io/v1alpha1 kind: ScanSettingBinding metadata: name: cis-compliance profiles: - name: ocp4-cis-node kind: Profile apiGroup: compliance.openshift.io/v1alpha1 - name: ocp4-cis kind: Profile apiGroup: compliance.openshift.io/v1alpha1 settingsRef: name: default kind: ScanSetting apiGroup: compliance.openshift.io/v1alpha1 oc create -f sscan.yaml -n openshift-compliance scansettingbinding.compliance.openshift.io/cis-compliance created oc get ValidatingWebhookConfiguration 1 NAME CREATED AT stackrox 2019-09-24T06:07:34Z unzip -d sensor sensor-<cluster_name>.zip ./sensor/sensor.sh oc get pod -n stackrox -w kubectl get pod -n stackrox -w oc delete ValidatingWebhookConfiguration/stackrox kubectl delete ValidatingWebhookConfiguration/stackrox oc delete ValidatingWebhookConfiguration/stackrox kubectl delete ValidatingWebhookConfiguration/stackrox oc -n stackrox scale deploy/admission-control --replicas=<number_of_replicas> 1 kubectl create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml kind: SecurityPolicy apiVersion: config.stackrox.io/v1alpha1 metadata: name: short-name spec: policyName: A longer form name kubectl -n stackrox delete deployment config-controller 1 oc create -f "<generated_file>.yml" 1 oc delete -f "<generated_file>.yml" 1 oc get ns -o jsonpath='{.items[*].metadata.name}' | xargs -n 1 oc delete networkpolicies -l 'network-policy-generator.stackrox.io/generated=true' -n 1 oc -n stackrox set env deploy/central \ 1 ROX_NETWORK_BASELINE_OBSERVATION_PERIOD=<value> 2 oc -n stackrox set env deploy/central \ 1 ROX_BASELINE_GENERATION_DURATION=<value> 2 (http(s)?://)?<svc>(.<ns>(.svc.cluster.local)?)?(:<portNum>)? 1 roxctl netpol generate -h roxctl netpol generate <folder_path> [flags] 1 roxctl netpol connectivity map <folder_path> [flags] 1 dot -Tsvg connlist_output.dot > connlist_output_graph.svg roxctl netpol connectivity diff --dir1= <folder_path_1> --dir2= <folder_path_2> [flags] 1 apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: creationTimestamp: null name: backend-netpol spec: ingress: - from: - podSelector: matchLabels: app: frontend ports: - port: 9090 protocol: TCP podSelector: matchLabels: app: backendservice policyTypes: - Ingress - Egress status: {} diff netpol-diff-example-minimal/netpols.yaml netpol-analysis-example-minimal/netpols.yaml 12c12 < - ports: --- > ports: roxctl netpol connectivity diff --dir1=roxctl/netpol/connectivity/diff/testdata/netpol-analysis-example-minimal/ --dir2=roxctl/netpol/connectivity/diff/testdata/netpol-diff-example-minimal Connectivity diff: diff-type: changed, source: default/frontend[Deployment], destination: default/backend[Deployment], dir1: TCP 9090, dir2: TCP 9090,UDP 53 diff-type: added, source: 0.0.0.0-255.255.255.255, destination: default/backend[Deployment], dir1: No Connections, dir2: TCP 9090 spec: customize: envVars: - name: ROX_EXTERNAL_IPS 1 value: 'true' customize: # Extra environment variables for all containers in all objects. envVars: ROX_EXTERNAL_IPS: "true" 1 apiVersion: v1 kind: ConfigMap metadata: name: collector-config namespace: stackrox data: runtime_config.yaml: | 1 networking: externalIps: enable: true oc -n stackrox set env deploy/central ROX_SCANNER_VULN_UPDATE_INTERVAL=<value> 1 oc -n stackrox set env deploy/scanner \ 1 ROX_LANGUAGE_VULNS=false 2 {"result": {"deployment": {...}, "images": [...]}} {"result": {"deployment": {...}, "images": [...]}} curl -H "Authorization: Bearer USDROX_API_TOKEN" USDROX_ENDPOINT/v1/export/vuln-mgmt/workloads curl -H "Authorization: Bearer USDROX_API_TOKEN" USDROX_ENDPOINT/v1/export/vuln-mgmt/workloads?timeout=60 curl -H "Authorization: Bearer USDROX_API_TOKEN" USDROX_ENDPOINT/v1/export/vuln-mgmt/workloads?query=Deployment%3Aapp%2BNamespace%3Adefault oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":"disabled"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"name":"compliance","env":[{"name":"ROX_METRICS_PORT","value":":9091"},{"name":"ROX_NODE_SCANNING_ENDPOINT","value":"127.0.0.1:8444"},{"name":"ROX_NODE_SCANNING_INTERVAL","value":"4h"},{"name":"ROX_NODE_SCANNING_INTERVAL_DEVIATION","value":"24m"},{"name":"ROX_NODE_SCANNING_MAX_INITIAL_WAIT","value":"5m"},{"name":"ROX_RHCOS_NODE_SCANNING","value":"true"},{"name":"ROX_CALL_NODE_INVENTORY_ENABLED","value":"true"}]}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"volumes":[{"name":"tmp-volume","emptyDir":{}},{"name":"cache-volume","emptyDir":{"sizeLimit":"200Mi"}}]}}}}' oc -n stackrox patch daemonset/collector -p '{"spec":{"template":{"spec":{"containers":[{"command":["/scanner","--nodeinventory","--config=",""],"env":[{"name":"ROX_NODE_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"spec.nodeName"}}},{"name":"ROX_CLAIR_V4_SCANNING","value":"true"},{"name":"ROX_COMPLIANCE_OPERATOR_INTEGRATION","value":"true"},{"name":"ROX_CSV_EXPORT","value":"false"},{"name":"ROX_DECLARATIVE_CONFIGURATION","value":"false"},{"name":"ROX_INTEGRATIONS_AS_CONFIG","value":"false"},{"name":"ROX_NETPOL_FIELDS","value":"true"},{"name":"ROX_NETWORK_DETECTION_BASELINE_SIMULATION","value":"true"},{"name":"ROX_NETWORK_GRAPH_PATTERNFLY","value":"true"},{"name":"ROX_NODE_SCANNING_CACHE_TIME","value":"3h36m"},{"name":"ROX_NODE_SCANNING_INITIAL_BACKOFF","value":"30s"},{"name":"ROX_NODE_SCANNING_MAX_BACKOFF","value":"5m"},{"name":"ROX_PROCESSES_LISTENING_ON_PORT","value":"false"},{"name":"ROX_QUAY_ROBOT_ACCOUNTS","value":"true"},{"name":"ROX_ROXCTL_NETPOL_GENERATE","value":"true"},{"name":"ROX_SOURCED_AUTOGENERATED_INTEGRATIONS","value":"false"},{"name":"ROX_SYSLOG_EXTRA_FIELDS","value":"true"},{"name":"ROX_SYSTEM_HEALTH_PF","value":"false"},{"name":"ROX_VULN_MGMT_WORKLOAD_CVES","value":"false"}],"image":"registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8:4.6.3","imagePullPolicy":"IfNotPresent","name":"node-inventory","ports":[{"containerPort":8444,"name":"grpc","protocol":"TCP"}],"volumeMounts":[{"mountPath":"/host","name":"host-root-ro","readOnly":true},{"mountPath":"/tmp/","name":"tmp-volume"},{"mountPath":"/cache","name":"cache-volume"}]}]}}}}' kubectl -n stackrox get deployment scanner-v4-indexer scanner-v4-matcher scanner-v4-db 1 kubectl -n stackrox set env deployment/central ROX_NODE_INDEX_ENABLED=true ROX_SCANNER_V4=true 1 kubectl -n stackrox set env deployment/sensor ROX_NODE_INDEX_ENABLED=true ROX_SCANNER_V4=true 1 kubectl -n stackrox set env daemonset/collector ROX_NODE_INDEX_ENABLED=true ROX_SCANNER_V4=true 1 Scanned index report and found <number> components for node <node_name>. kubectl -n stackrox get deployment scanner scanner-db 1 kubectl -n stackrox set env deployment/central ROX_NODE_INDEX_ENABLED=false 1 kubectl -n stackrox set env daemonset/collector ROX_CALL_NODE_INVENTORY_ENABLED=true 1 Scanned node inventory <node_name> (id: <node_id>) with <number> components. ^kube-.*|^openshift-.*|^stackroxUSD|^rhacs-operatorUSD|^open-cluster-managementUSD|^multicluster-engineUSD|^aapUSD|^hiveUSD|^nvidia-gpu-operatorUSD Failed to create collections for scope _scope-name_: Unsupported operator NOT_IN in scope's label selectors. Only operator 'IN' is supported. The scope is attached to the following report configurations: [list of report configs]; Please manually create an equivalent collection and edit the listed report configurations to use this collection. Note that reports will not function correctly until a collection is attached. roxctl -e <hostname>:<port_number> central userpki create -c <ca_certificate_file> -r <default_role_name> <provider_name> oc -n stackrox set env deploy/central ROX_ENABLE_OPENSHIFT_AUTH=true CENTRAL_ADDITIONAL_ROUTES=' spec: central: exposure: loadBalancer: enabled: false port: 443 nodePort: enabled: false route: enabled: true persistence: persistentVolumeClaim: claimName: stackrox-db customize: annotations: serviceaccounts.openshift.io/oauth-redirecturi.main: sso/providers/openshift/callback 1 serviceaccounts.openshift.io/oauth-redirectreference.main: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"central\"}}" 2 serviceaccounts.openshift.io/oauth-redirecturi.second: sso/providers/openshift/callback 3 serviceaccounts.openshift.io/oauth-redirectreference.second: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"second-central\"}}" 4 ' oc patch centrals.platform.stackrox.io -n <namespace> \ 1 <custom-resource> \ 2 --patch "USDCENTRAL_ADDITIONAL_ROUTES" --type=merge customize: central: annotations: serviceaccounts.openshift.io/oauth-redirecturi.main: sso/providers/openshift/callback 1 serviceaccounts.openshift.io/oauth-redirectreference.main: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"central\"}}" 2 serviceaccounts.openshift.io/oauth-redirecturi.second: sso/providers/openshift/callback 3 serviceaccounts.openshift.io/oauth-redirectreference.second: "{\"kind\":\"OAuthRedirectReference\",\"apiVersion\":\"v1\",\"reference\":{\"kind\":\"Route\",\"name\":\"second-central\"}}" 4 helm upgrade -n stackrox stackrox-central-services rhacs/central-services -f <path_to_values_public.yaml> 1 { "idToken": "<id_token>" } { "accessToken": "<access_token>" }