Chapter 3. Managing secured clusters To secure a Kubernetes or an OpenShift Container Platform cluster, you must deploy Red Hat Advanced Cluster Security for Kubernetes (RHACS) services into the cluster. You can generate deployment files in the RHACS portal by navigating to the Platform Configuration Clusters view, or you can use the roxctl CLI. 3.1. Prerequisites You have configured the ROX_ENDPOINT environment variable using the following command: USD export ROX_ENDPOINT= <host:port> 1 1 The host and port information that you want to store in the ROX_ENDPOINT environment variable. 3.2. Generating Sensor deployment files Generating files for Kubernetes systems Procedure Generate the required sensor configuration for your Kubernetes cluster and associate it with your Central instance by running the following command: USD roxctl sensor generate k8s --name <cluster_name> --central "USDROX_ENDPOINT" Generating files for OpenShift Container Platform systems Procedure Generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance by running the following command: USD roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 1 For the --openshift-version option, specify the major OpenShift Container Platform version number for your cluster. For example, specify 3 for OpenShift Container Platform version 3.x and specify 4 for OpenShift Container Platform version 4.x . Read the --help output to see other options that you might need to use depending on your system architecture. Verify that the endpoint you provide for --central can be reached from the cluster where you are deploying Red Hat Advanced Cluster Security for Kubernetes services. Important If you are using a non-gRPC capable load balancer, such as HAProxy, AWS Application Load Balancer (ALB), or AWS Elastic Load Balancing (ELB), follow these guidelines: Use the WebSocket Secure ( wss ) protocol. To use wss , prefix the address with wss:// , and Add the port number after the address, for example: USD roxctl sensor generate k8s --central wss://stackrox-central.example.com:443 3.3. Installing Sensor by using the sensor.sh script When you generate the Sensor deployment files, roxctl creates a directory called sensor-<cluster_name> in your working directory. The script to install Sensor is located in this directory. Procedure Run the sensor installation script to install Sensor: USD ./sensor- <cluster_name> /sensor.sh If you get a warning that you do not have the required permissions to install Sensor, follow the on-screen instructions, or contact your cluster administrator for help. 3.4. Downloading Sensor bundles for existing clusters Procedure Run the following command to download Sensor bundles for existing clusters by specifying a cluster name or ID : USD roxctl sensor get-bundle <cluster_name_or_id> 3.5. Deleting cluster integration Procedure Before deleting the cluster, ensure you have the correct cluster name that you want to remove from Central: USD roxctl cluster delete --name= <cluster_name> Important Deleting the cluster integration does not remove the RHACS services running in the cluster, depending on the installation method. You can remove the services by running the delete-sensor.sh script from the Sensor installation bundle.

Commands:
export ROX_ENDPOINT= <host:port> 1
roxctl sensor generate k8s --name <cluster_name> --central "USDROX_ENDPOINT"
roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1
roxctl sensor generate k8s --central wss://stackrox-central.example.com:443
./sensor- <cluster_name> /sensor.sh
roxctl sensor get-bundle <cluster_name_or_id>
roxctl cluster delete --name= <cluster_name>