Configuring Red Hat Advanced Cluster Security for Kubernetes 4.5 Configuring Red Hat Advanced Cluster Security for Kubernetes Red Hat OpenShift Documentation Team

Commands:
-----BEGIN CERTIFICATE----- MIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G l4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo= -----END CERTIFICATE-----
-n <namespace> create secret tls central-default-tls-cert --cert <tls-cert.pem> --key <tls-key.pem>
central: # Configure a default TLS certificate (public cert + private key) for central defaultTLS: cert: | -----BEGIN CERTIFICATE----- EXAMPLE!MIIMIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G -----END CERTIFICATE----- key: | -----BEGIN EC PRIVATE KEY----- EXAMPLE!MHcl4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo= -----END EC PRIVATE KEY-----
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f values-private.yaml
roxctl central generate --default-tls-cert "cert.pem" --default-tls-key "key.pem"
Enter PEM cert bundle file (optional): <cert.pem> Enter PEM private key file (optional): <key.pem> Enter administrator password (default: autogenerated): Enter orchestrator (k8s, openshift): openshift
-n <namespace> create secret tls central-default-tls-cert --cert <tls-cert.pem> --key <tls-key.pem>
central: # Configure a default TLS certificate (public cert + private key) for central defaultTLS: cert: | -----BEGIN CERTIFICATE----- EXAMPLE!MIIMIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G -----END CERTIFICATE----- key: | -----BEGIN EC PRIVATE KEY----- EXAMPLE!MHcl4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo= -----END EC PRIVATE KEY-----
helm upgrade -n stackrox --create-namespace stackrox-central-services rhacs/central-services --reuse-values \ 1 -f values-private.yaml
oc -n stackrox create secret tls central-default-tls-cert --cert <server_cert.pem> --key <server_key.pem> --dry-run -o yaml | oc apply -f -
oc delete secret central-default-tls-cert
oc -n stackrox create secret tls central-default-tls-cert --cert <server_cert.pem> --key <server_key.pem> --dry-run -o yaml | oc apply -f -
oc -n stackrox exec deploy/central -c central -- kill 1
oc -n stackrox delete pod -lapp=central
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
unzip -d sensor sensor-<cluster_name>.zip
./sensor/ca-setup-sensor.sh -d sensor/additional-cas/ 1
./sensor/ca-setup-sensor.sh -d sensor/additional-cas/ -u
unzip -d sensor sensor-<cluster_name>.zip
./sensor/ca-setup-sensor.sh -d sensor/additional-cas/ 1
./sensor/ca-setup-sensor.sh -d sensor/additional-cas/ -u
oc -n stackrox deploy/sensor -c sensor -- kill 1
kubectl -n stackrox deploy/sensor -c sensor -- kill 1
oc -n stackrox delete pod -lapp=sensor
kubectl -n stackrox delete pod -lapp=sensor
chmod +x ca-setup.sh
./ca-setup.sh -f <certificate>
./ca-setup.sh -d <directory_name>
oc -n stackrox exec deploy/central -c central -- kill 1
oc -n stackrox delete pod -lapp=central
oc delete pod -n stackrox -l app=scanner
kubectl delete pod -n stackrox -l app=scanner
./ca-setup-sensor.sh -d ./additional-cas/
oc apply -f <secret_file.yaml>
oc -n stackrox exec deploy/central -c central -- kill 1
oc -n stackrox delete pod -lapp=central
oc apply -f <secret_file.yaml>
oc delete pod -n stackrox -l app=scanner; oc -n stackrox delete pod -l app=scanner-db
kubectl delete pod -n stackrox -l app=scanner; kubectl -n stackrox delete pod -l app=scanner-db
roxctl -e <endpoint> -p <admin_password> central init-bundles generate --output-secrets <bundle_name> init-bundle.yaml
oc -n stackrox apply -f <init-bundle.yaml>
docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.5.6 <your_registry>/rhacs-main-rhel8:4.5.6
docker tag registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.5.6 <your_registry>/other-name:latest
docker login registry.redhat.io
docker pull <image>
docker tag <image> <new_image>
docker push <new_image>
Enter main image to use (if unset, the default will be used): <your_registry>/rhacs-main-rhel8:4.5.6
Enter Scanner DB image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-db-rhel8:4.5.6
Enter Scanner image to use (if unset, the default will be used): <your_registry>/rhacs-scanner-rhel8:4.5.6
Enter whether to run StackRox in offline mode, which avoids reaching out to the internet (default: "false"): true
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl scanner upload-db -e "USDROX_CENTRAL_ADDRESS" --scanner-db-file=<compressed_scanner_definitions.zip>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl scanner upload-db -p <your_administrator_password> -e "USDROX_CENTRAL_ADDRESS" --scanner-db-file=<compressed_scanner_definitions.zip>
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl collector support-packages upload <package_file> -e "USDROX_CENTRAL_ADDRESS"
roxctl central generate interactive --plaintext-endpoints=<endpoints_spec> 1
CENTRAL_PLAINTEXT_PATCH=' spec: template: spec: containers: - name: central env: - name: ROX_PLAINTEXT_ENDPOINTS value: <endpoints_spec> 1 '
oc -n stackrox patch deploy/central -p "USDCENTRAL_PLAINTEXT_PATCH"
oc -n stackrox get secret proxy-config -o go-template='{{index .data "config.yaml" | base64decode}}{{"\n"}}' > /tmp/proxy-config.yaml
oc -n stackrox create secret generic proxy-config --from-file=config.yaml=/tmp/proxy-config.yaml -o yaml --dry-run | oc label -f - --local -o yaml app.kubernetes.io/name=stackrox | oc apply -f -
apiVersion: v1 kind: Secret metadata: namespace: stackrox name: proxy-config type: Opaque stringData: config.yaml: |- 1 # # NOTE: Both central and scanner should be restarted if this secret is changed. # # While it is possible that some components will pick up the new proxy configuration # # without a restart, it cannot be guaranteed that this will apply to every possible # # integration etc. # url: http://proxy.name:port 2 # username: username 3 # password: password 4 # # If the following value is set to true, the proxy wil NOT be excluded for the default hosts: # # - *.stackrox, *.stackrox.svc # # - localhost, localhost.localdomain, 127.0.0.0/8, ::1 # # - *.local # omitDefaultExcludes: false # excludes: # hostnames (may include * components) for which you do not 5 # # want to use a proxy, like in-cluster repositories. # - some.domain # # The following configuration sections allow specifying a different proxy to be used for HTTP(S) connections. # # If they are omitted, the above configuration is used for HTTP(S) connections as well as TCP connections. # # If only the `http` section is given, it will be used for HTTPS connections as well. # # Note: in most cases, a single, global proxy configuration is sufficient. # http: # url: http://http-proxy.name:port 6 # username: username 7 # password: password 8 # https: # url: http://https-proxy.name:port 9 # username: username 10 # password: password 11
export ROX_PASSWORD= <rox_password> && export ROX_CENTRAL_ADDRESS= <address>:<port_number> 1
roxctl -e "USDROX_CENTRAL_ADDRESS" -p "USDROX_PASSWORD" central debug download-diagnostics
export ROX_API_TOKEN= <api_token>
roxctl -e "USDROX_CENTRAL_ADDRESS" central debug download-diagnostics
Sample endpoints.yaml configuration for Central. # # CAREFUL: If the following line is uncommented, do not expose the default endpoint on port 8443 by default. # This will break normal operation. disableDefault: true # if true, do not serve on :8443 1 endpoints: 2 # Serve plaintext HTTP only on port 8080 - listen: ":8080" 3 # Backend protocols, possible values are 'http' and 'grpc'. If unset or empty, assume both. protocols: 4 - http tls: 5 # Disable TLS. If this is not specified, assume TLS is enabled. disable: true 6 # Serve HTTP and gRPC for sensors only on port 8444 - listen: ":8444" 7 tls: 8 # Which TLS certificates to serve, possible values are 'service' (For service certificates that Red&#160;Hat Advanced Cluster Security for Kubernetes generates) # and 'default' (user-configured default TLS certificate). If unset or empty, assume both. serverCerts: 9 - default - service # Client authentication settings. clientAuth: 10 # Enforce TLS client authentication. If unset, do not enforce, only request certificates # opportunistically. required: true 11 # Which TLS client CAs to serve, possible values are 'service' (CA for service # certificates that Red&#160;Hat Advanced Cluster Security for Kubernetes generates) and 'user' (CAs for PKI auth providers). If unset or empty, assume both. certAuthorities: 12 # if not set, assume ["user", "service"] - service
oc -n stackrox get cm/central-endpoints -o go-template='{{index .data "endpoints.yaml"}}' > <directory_path>/central_endpoints.yaml
oc -n stackrox create cm central-endpoints --from-file=endpoints.yaml=<directory-path>/central-endpoints.yaml -o yaml --dry-run | label -f - --local -o yaml app.kubernetes.io/name=stackrox | apply -f -
oc -n stackrox exec deploy/central -c central -- kill 1
oc -n stackrox delete pod -lapp=central
oc -n stackrox get networkpolicy.networking.k8s.io/allow-ext-to-central -o yaml > <directory_path>/allow-ext-to-central-custom-port.yaml
monitoring: openshift: enabled: false
monitoring.openshift.enabled: false
central.exposeMonitoring: true scanner.exposeMonitoring: true
apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: prometheus-stackrox namespace: stackrox spec: endpoints: - interval: 30s port: monitoring scheme: http selector: matchLabels: app.kubernetes.io/name: <stackrox-service> 1
oc apply -f servicemonitor.yaml 1
oc get servicemonitor --namespace stackrox 1
{ "headers": { "Accept-Encoding": [ "gzip" ], "Content-Length": [ "586" ], "Content-Type": [ "application/json" ], "User-Agent": [ "Go-http-client/1.1" ] }, "data": { "audit": { "interaction": "CREATE", "method": "UI", "request": { "endpoint": "/v1/notifiers", "method": "POST", "source": { "requestAddr": "10.131.0.7:58276", "xForwardedFor": "8.8.8.8", }, "sourceIp": "8.8.8.8", "payload": { "@type": "storage.Notifier", "enabled": true, "generic": { "auditLoggingEnabled": true, "endpoint": "http://samplewebhookserver.com:8080" }, "id": "b53232ee-b13e-47e0-b077-1e383c84aa07", "name": "Webhook", "type": "generic", "uiEndpoint": "https://localhost:8000" } }, "status": "REQUEST_SUCCEEDED", "time": "2019-05-28T16:07:05.500171300Z", "user": { "friendlyName": "John Doe", "role": { "globalAccess": "READ_WRITE_ACCESS", "name": "Admin" }, "username": "john.doe@example.com" } } } }
Warn: API Token [token name] (ID [token ID]) will expire in less than X days.
roxctl declarative-config create permission-set --name="restricted" --description="Restriction permission set that only allows access to Administration and Access resources" --resource-with-access=Administration=READ_WRITE_ACCESS --resource-with-access=Access=READ_ACCESS > permission-set.yaml
roxctl declarative-config create role --name="restricted" --description="Restricted role that only allows access to Administration and Access" --permission-set="restricted" --access-scope="Unrestricted" > role.yaml
kubectl create configmap declarative-configurations \ 1 --from-file permission-set.yaml --from-file role.yaml -o yaml --namespace=stackrox > declarative-configs.yaml
kubectl apply -f declarative-configs.yaml 1
name: A sample auth provider minimumRole: Analyst 1 uiEndpoint: central.custom-domain.com:443 2 extraUIEndpoints: 3 - central-alt.custom-domain.com:443 groups: 4 - key: email 5 value: example@example.com role: Admin 6 - key: groups value: reviewers role: Analyst requiredAttributes: 7 - key: org_id value: "12345" claimMappings: 8 - path: org_id value: my_org_id oidc: 9 issuer: sample.issuer.com 10 mode: auto 11 clientID: CLIENT_ID clientSecret: CLIENT_SECRET clientSecret: CLIENT_SECRET iap: 12 audience: audience saml: 13 spIssuer: sample.issuer.com metadataURL: sample.provider.com/metadata saml: 14 spIssuer: sample.issuer.com cert: | 15 ssoURL: saml.provider.com idpIssuer: idp.issuer.com userpki: certificateAuthorities: | 16 certificate 17 openshift: 18 enable: true
name: A sample permission set description: A sample permission set created declaratively resources: - resource: Integration 1 access: READ_ACCESS 2 - resource: Administration access: READ_WRITE_ACCESS
name: A sample access scope description: A sample access scope created declaratively rules: included: - cluster: secured-cluster-A 1 namespaces: - namespaceA - cluster: secured-cluster-B 2 clusterLabelSelectors: - requirements: - requirements: - key: kubernetes.io/metadata.name operator: IN 3 values: - production - staging - environment
name: A sample role description: A sample role created declaratively permissionSet: A sample permission set 1 accessScope: Unrestricted 2