Chapter 1. High-level RHACS installation overview Red Hat Advanced Cluster Security for Kubernetes (RHACS) provides security services for your self-managed Red Hat OpenShift Kubernetes systems or platforms such as OpenShift Container Platform, Amazon Elastic Kubernetes Service (Amazon EKS), Google Kubernetes Engine (Google GKE), and Microsoft Azure Kubernetes Service (Microsoft AKS). For information about supported platforms and architecture, see the Red Hat Advanced Cluster Security for Kubernetes Support Matrix . For life cycle support information for RHACS, see the Red Hat Advanced Cluster Security for Kubernetes Support Policy . 1.1. General installation guidelines To ensure the best installation experience, follow these guidelines: Understand the installation platforms and methods described in this module. Understand Red Hat Advanced Cluster Security for Kubernetes architecture . Check the default resource requirements . 1.2. Installation methods for different platforms You can perform different types of installations on different platforms. Note Not all installation methods are supported for all platforms. See the Red Hat Advanced Cluster Security for Kubernetes Support Matrix for more information. Table 1.1. Platforms and recommended installation methods Platform type Platform Recommended installation methods Installation steps Managed service platform Red Hat OpenShift Dedicated (OSD) Operator (recommended), Helm charts, or roxctl CLI [1] Installing Central services for RHACS on Red Hat OpenShift Installing Secured Cluster services for RHACS on Red Hat OpenShift Azure Red Hat OpenShift (ARO) Red Hat OpenShift Service on AWS (ROSA) Red Hat OpenShift on IBM Cloud Amazon Elastic Kubernetes Service (Amazon EKS) Helm charts (recommended), or roxctl CLI [1] Installing Central services for RHACS on other platforms Installing Secured Cluster services for RHACS on other platforms Google Kubernetes Engine (Google GKE) Microsoft Azure Kubernetes Service (Microsoft AKS) Self-managed platform Red Hat OpenShift Container Platform (OCP) Operator (recommended), Helm charts, or roxctl CLI [1] Installing Central services for RHACS on Red Hat OpenShift Installing Secured Cluster services for RHACS on Red Hat OpenShift Red Hat OpenShift Kubernetes Engine (OKE) Do not use the roxctl installation method unless you have specific requirements for following this installation method. 1.3. Installation methods for different architectures Red Hat Advanced Cluster Security for Kubernetes (RHACS) supports the following architectures. For information on supported platforms and architecture, see the Red Hat Advanced Cluster Security for Kubernetes Support Matrix . Additionally, the following table gives information about installation methods available for each architecture. Table 1.2. Architectures and supported installation methods for each architecture Supported architectures Supported installation methods AMD64 Operator (preferred), Helm charts, or roxctl CLI (not recommended) ppc64le (IBM Power) Operator s390x (IBM Z and IBM(R) LinuxONE) AArch64 ( ARM64 ) Operator (preferred), Helm charts, or roxctl CLI 1.4. Installation steps for RHACS on OpenShift Container Platform 1.4.1. Installing RHACS on Red Hat OpenShift by using the RHACS Operator On the Red Hat OpenShift cluster, install the RHACS Operator into the rhacs-operator project, or namespace. On the Red Hat OpenShift cluster that will contain Central, called the central cluster, use the RHACS Operator to install Central services into the stackrox project. One central cluster can secure multiple clusters. Log in to the RHACS web console from the central cluster, and then create an init bundle or cluster registration secret (CRS) and download it. The init bundle is then installed on the cluster that you want to secure, called the secured cluster. For the secured cluster: Install the RHACS Operator into the rhacs-operator namespace. On the secured cluster, apply the init bundle or CRS that you created in RHACS by performing one of these steps: Use the OpenShift Container Platform web console to import the YAML file of the init bundle or CRS that you created. Make sure you are in the stackrox namespace. Use the OpenShift CLI to perform one of the following actions: If you created an init bundle, in the terminal window, run the oc create -f <init_bundle.yaml> -n <stackrox> command, specifying the path to the downloaded YAML file of the init bundle. If you created a CRS, in the terminal window, run the oc create -f <file_name.yaml> -n <stackrox> command, specifying the path to the downloaded CRS. On the secured cluster, use the RHACS Operator to install Secured Cluster services into the stackrox namespace. When creating these services, be sure to enter the address of Central in the Central Endpoint field so that the secured cluster can communicate with Central. 1.4.2. Installing RHACS on Red Hat OpenShift by using Helm charts Add the RHACS Helm charts repository. Install the central-services Helm chart on the Red Hat OpenShift cluster that will contain Central, called the central cluster. Log in to the RHACS web console on the Central cluster and create an init bundle or CRS. For each cluster that you want to secure, log in to the secured cluster and use the helm install command to install the secured-cluster-services Helm chart, specifying the path to the init bundle or CRS that you created. 1.4.3. Installing RHACS on Red Hat OpenShift by using the roxctl CLI This installation method is also called the manifest installation method . Install the roxctl CLI. On the Red Hat OpenShift cluster that will contain Central, perform these steps: In the terminal window, run the interactive install command by using the roxctl CLI. Run the setup shell script. In the terminal window, create the Central resources by using the oc create command. Perform one of the following actions: In the RHACS web console, create and download the sensor YAML file and keys. On the secured cluster, use the roxctl sensor generate openshift command. On the secured cluster, run the sensor installation script. 1.5. Installation steps for RHACS on Kubernetes 1.5.1. Installing RHACS on Kubernetes platforms by using Helm charts Add the RHACS Helm charts repository. Install the central-services Helm chart on the cluster that will contain Central, called the Central cluster. Log in to the RHACS web console from the Central cluster and create an init bundle or cluster registration secret (CRS) that you need to apply to the cluster that you want to secure, called the secured cluster. The init bundle or the CRS contains the cryptographic artifacts that RHACS uses to establish trusted connections between Central and secured clusters. Important Cluster registration secret is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . For each secured cluster, install the secured-cluster-services Helm chart by running one of the following commands: For an init bundle, run the following command: USD helm install -n stackrox \ --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <name_of_cluster_init_bundle.yaml> \ -f <path_to_values_public.yaml> \ 1 -f <path_to_values_private.yaml> \ 2 --set imagePullSecrets.username=<username> \ 3 --set imagePullSecrets.password=<password> 4 1 Use the -f option to specify the paths for your public YAML configuration file. 2 Use the -f option to specify the paths for your private YAML configuration file. 3 Include the user name for your pull secret for Red Hat Container Registry authentication. 4 Include the password for your pull secret for Red Hat Container Registry authentication. For a CRS, run the following command: USD helm install -n stackrox \ --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services \ --set-file crs.file=<crs_file_name.yaml> \ 1 -f <path_to_values_public.yaml> \ 2 -f <path_to_values_private.yaml> \ 3 --set imagePullSecrets.username=<username> \ 4 --set imagePullSecrets.password=<password> 5 1 Use the name of the file in which the generated CRS has been stored. 2 Use the -f option to specify the paths for your public YAML configuration file. 3 Use the -f option to specify the paths for your private YAML configuration file. 4 Include the user name for your pull secret for Red Hat Container Registry authentication. 5 Include the password for your pull secret for Red Hat Container Registry authentication. 1.5.2. Installing RHACS on Kubernetes platforms by using the roxctl CLI This installation method is also called the manifest installation method . Install the roxctl CLI. On the Kubernetes cluster that will contain Central, perform these steps: In the terminal window, run the interactive install command by using the roxctl CLI. Run the setup shell script. In the terminal window, create the Central resources by using the kubectl create command. Perform one of the following actions: In the RHACS web console, create and download the sensor YAML file and keys. On the cluster that you want to secure, called the secured cluster, use the roxctl sensor generate openshift command. On the secured cluster, run the sensor installation script.

Commands:
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> \ 1 -f <path_to_values_private.yaml> \ 2 --set imagePullSecrets.username=<username> \ 3 --set imagePullSecrets.password=<password> 4
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services --set-file crs.file=<crs_file_name.yaml> \ 1 -f <path_to_values_public.yaml> \ 2 -f <path_to_values_private.yaml> \ 3 --set imagePullSecrets.username=<username> \ 4 --set imagePullSecrets.password=<password> 5