Integrating
Integrating Red Hat Advanced Cluster Security for Kubernetes 4.7 Integrating Red Hat Advanced Cluster Security for Kubernetes Red Hat OpenShift Documentation Team
eksctl utils associate-iam-oidc-provider --cluster <cluster name> --approve kubectl -n stackrox annotate sa central eks.amazonaws.com/role-arn=arn:aws:iam::67890:role/<role-name> kubectl -n stackrox delete pod -l app=central { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::<ecr-registry>:role/<assumerole-readonly>" 1 } ] } { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::<ecr-registry>:role/<role-name>" 1 ] }, "Action": "sts:AssumeRole" } ] } { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::<ecr-registry>:role/<assumerole-readonly>" 1 } ] } { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::<ecr-registry>:user/<role-name>" ] }, "Action": "sts:AssumeRole" } ] } export ROX_API_TOKEN=<api_token> roxctl central debug dump --token-file <token_file> arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Linux/roxctlUSD{arch}" chmod +x roxctl echo USDPATH roxctl version arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Darwin/roxctlUSD{arch}" xattr -c roxctl chmod +x roxctl echo USDPATH roxctl version curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Windows/roxctl.exe roxctl version docker login registry.redhat.io docker pull registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8:4.7.0 docker run -e ROX_API_TOKEN=USDROX_API_TOKEN -it registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8:4.7.0 -e USDROX_CENTRAL_ADDRESS <command> docker run -it registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8:4.7.0 version version: 2 jobs: check-policy-compliance: docker: - image: 'circleci/node:latest' auth: username: USDDOCKERHUB_USER password: USDDOCKERHUB_PASSWORD steps: - checkout - run: name: Install roxctl command: | curl -H "Authorization: Bearer USDROX_API_TOKEN" https://USDSTACKROX_CENTRAL_HOST:443/api/cli/download/roxctl-linux -o roxctl && chmod +x ./roxctl - run: name: Scan images for policy deviations and vulnerabilities command: | ./roxctl image check --endpoint "USDSTACKROX_CENTRAL_HOST:443" --image "<your_registry/repo/image_name>" 1 - run: name: Scan deployment files for policy deviations command: | ./roxctl image check --endpoint "USDSTACKROX_CENTRAL_HOST:443" --image "<your_deployment_file>" 2 # Important note: This step assumes the YAML file you'd like to test is located in the project. workflows: version: 2 build_and_test: jobs: - check-policy-compliance example.com/slack-webhook: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX { "alert": { "id": "<id>", "time": "<timestamp>", "policy": { "name": "<name>", }, }, "<custom_field_1>": "<custom_value_1>" } annotations: jira/project-key: <jira_project_key> { "customfield_10004": 3, "customfield_20005": "Alerts", } annotations: jira/project-key: <jira_project_key> roxctl -e "USDROX_CENTRAL_ADDRESS" central debug log --level Debug --modules notifiers/jira roxctl -e "USDROX_CENTRAL_ADDRESS" central debug dump roxctl -e "USDROX_CENTRAL_ADDRESS" central debug log --level Info annotations: email: <email_address> annotations: email: <email_address> eksctl utils associate-iam-oidc-provider --cluster <cluster_name> --approve { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:ListImages" ], "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>" } ] } { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::<ecr-registry>:role/<role_name>" 1 ] }, "Action": "sts:AssumeRole" } ] } oc -n stackrox annotate sa central eks.amazonaws.com/role-arn=arn:aws:iam::67890:role/<role_name> 1 oc -n stackrox delete pod -l "app in (central,sensor)" 1 { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:ListImages" ], "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>" } ] } { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "<oidc_provider_arn>" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "<oidc_provider_name>:aud": "openshift" } } } ] } AWS_ROLE_ARN=<role_arn> AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/openshift/serviceaccount/token oc annotate serviceaccount \ 1 central \ 2 --namespace stackrox iam.gke.io/gcp-service-account=<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com gcloud iam workload-identity-pools create rhacs-pool --location="global" --display-name="RHACS workload pool" gcloud iam workload-identity-pools providers create-oidc rhacs-provider --location="global" --workload-identity-pool="rhacs-pool" --display-name="RHACS provider" --attribute-mapping="google.subject=assertion.sub" --issuer-uri="https://<oidc_configuration_url>" --allowed-audiences=openshift gcloud iam service-accounts add-iam-policy-binding <GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member="principal://iam.googleapis.com/projects/<GSA_PROJECT_NUMBER>/locations/global/workloadIdentityPools/rhacs-provider/subject/system:serviceaccount:stackrox:central" 1 { "type": "external_account", "audience": "//iam.googleapis.com/projects/<GSA_PROJECT_ID>/locations/global/workloadIdentityPools/rhacs-pool/providers/rhacs-provider", "subject_token_type": "urn:ietf:params:oauth:token-type:jwt", "token_url": "https://sts.googleapis.com/v1/token", "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com:generateAccessToken", "credential_source": { "file": "/var/run/secrets/openshift/serviceaccount/token", "format": { "type": "text" } } } apiVersion: v1 kind: Secret metadata: name: gcp-cloud-credentials namespace: stackrox data: credentials: <base64_encoded_json> oc annotate serviceaccount \ 1 central \ 2 --namespace stackrox azure.workload.identity/client-id=<CLIENT_ID> 3 serviceaccount/central annotated az identity federated-credential create --name "USD{FEDERATED_CREDENTIAL_NAME}" --identity-name "USD{MANAGED_IDENTITY_NAME}" \ 1 --resource-group "USD{RESOURCE_GROUP}" --issuer "USD{OIDC_ISSUER_URL}" \ 2 --subject system:serviceaccount:stackrox:central \ 3 --audience openshift { "TimeGenerated": "2024-09-03T10:56:58.5010069Z", 1 "msg": { 2 "id": "1abe30d1-fa3a-xxxx-xxxx-781f0a12228a", 3 "policy" : {} } }