Chapter 8. Setting up RHACS Cloud Service with Kubernetes secured clusters 8.1. Creating an RHACS Cloud Service instance for Kubernetes clusters Access Red Hat Advanced Cluster Security Cloud Service (RHACS Cloud Service) by selecting an instance in the Red Hat Hybrid Cloud Console. An ACS instance contains the RHACS Cloud Service management interface and services that Red Hat configures and manages for you. The management interface connects to your secured clusters, which contain the services that scan and collect information about vulnerabilities. One instance can connect to and monitor many clusters. 8.1.1. Creating an instance in the console In the Red Hat Hybrid Cloud Console, create an ACS instance to connect to your secured clusters. Procedure To create an ACS instance : Log in to the Red Hat Hybrid Cloud Console. From the navigation menu, select Advanced Cluster Security ACS Instances . Select Create ACS instance and enter information into the displayed fields or select the appropriate option from the drop-down list: Name : Enter the name of your ACS instance . An ACS instance contains the RHACS Central component, also referred to as "Central", which includes the RHACS Cloud Service management interface and services that are configured and managed by Red Hat. You manage your secured clusters that communicate with Central. You can connect many secured clusters to one instance. Cloud provider : The cloud provider where Central is located. Select AWS . Cloud region : The region for your cloud provider where Central is located. Select one of the following regions: US-East, N. Virginia Europe, Ireland Availability zones : Use the default value ( Multi ). Click Create instance . 8.1.2. steps On each Kubernetes cluster you want to secure, install secured cluster resources by using Helm charts or the roxctl CLI. 8.2. Generating an init bundle or cluster registration secret for Kubernetes secured clusters Before you set up a secured cluster, you must create an init bundle or cluster registration secret (CRS). The secured cluster then uses this bundle or CRS to authenticate with the Central instance, also called Central. You can create an init bundle by using either the RHACS portal or the roxctl CLI. You then apply the init bundle by using it to create resources. Important Cluster registration secrets is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . You can use either an init bundle or a cluster registration secret (CRS) during installation of a secured cluster. However, RHACS does not yet provide a way to create a CRS by using the portal. Therefore, you must create the CRS by using the roxctl CLI. Before you set up a secured cluster, you must create an init bundle or CRS. The secured cluster then uses this bundle or CRS to authenticate with Central. You can create an init bundle by using either the RHACS portal or the roxctl CLI. If you are using a CRS, you must use the roxctl CLI to create it. You can then apply the init bundle or the CRS by using the OpenShift Container Platform kubectl CLI. If you install RHACS by using Helm, you provide the init bundle or CRS when you run the helm install command. 8.2.1. Generating an init bundle 8.2.1.1. Generating an init bundle by using the RHACS portal You can create an init bundle containing secrets by using the RHACS portal, also called the ACS Console. Note You must have the Admin user role to create an init bundle. Procedure Log in to the RHACS portal. If you do not have secured clusters, the Platform Configuration Clusters page appears. Click Create init bundle . Enter a name for the cluster init bundle. Select your platform. Select the installation method you will use for your secured clusters: Operator or Helm chart . Click Download to generate and download the init bundle, which is created in the form of a YAML file. You can use one init bundle and its corresponding YAML file for all secured clusters if you are using the same installation method. Important Store this bundle securely because it contains secrets. Apply the init bundle by using it to create resources on the secured cluster. Install secured cluster services on each cluster. 8.2.1.2. Generating an init bundle by using the roxctl CLI You can create an init bundle with secrets by using the roxctl CLI. Note You must have the Admin user role to create init bundles. Prerequisites You have configured the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables: Set the ROX_API_TOKEN by running the following command: USD export ROX_API_TOKEN=<api_token> Set the ROX_CENTRAL_ADDRESS environment variable by running the following command: USD export ROX_CENTRAL_ADDRESS=<address>:<port_number> Important In RHACS Cloud Service, when using roxctl commands that require the Central address, use the Central instance address as displayed in the Instance Details section of the Red Hat Hybrid Cloud Console. For example, use acs-ABCD12345.acs.rhcloud.com instead of acs-data-ABCD12345.acs.rhcloud.com . Procedure To generate a cluster init bundle containing secrets for Helm installations, run the following command: USD roxctl -e "USDROX_CENTRAL_ADDRESS" \ central init-bundles generate <cluster_init_bundle_name> --output \ cluster_init_bundle.yaml To generate a cluster init bundle containing secrets for Operator installations, run the following command: USD roxctl -e "USDROX_CENTRAL_ADDRESS" \ central init-bundles generate <cluster_init_bundle_name> --output-secrets \ cluster_init_bundle.yaml Important Ensure that you store this bundle securely because it contains secrets. You can use the same bundle to set up multiple secured clusters. 8.2.2. Generating a CRS 8.2.2.1. Generating a CRS by using the roxctl CLI You can create a cluster registration secret by using the roxctl CLI. Note You must have the Admin user role to create a CRS. Prerequisites You have configured the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables: Set the ROX_API_TOKEN by running the following command: USD export ROX_API_TOKEN=<api_token> Set the ROX_CENTRAL_ADDRESS environment variable by running the following command: USD export ROX_CENTRAL_ADDRESS=<address>:<port_number> Important In RHACS Cloud Service, when using roxctl commands that require the Central address, use the Central instance address as displayed in the Instance Details section of the Red Hat Hybrid Cloud Console. For example, use acs-ABCD12345.acs.rhcloud.com instead of acs-data-ABCD12345.acs.rhcloud.com . Procedure To generate a CRS, run the following command: USD roxctl -e "USDROX_CENTRAL_ADDRESS" \ central crs generate <crs_name> \ 1 --output <file_name> 2 1 Enter an identifier or name for the CRS. 2 Enter a file name or use - for standard output. Important Ensure that you store this file securely because it contains secrets. You can use the same file to set up multiple secured clusters. You cannot retrieve a previously-generated CRS. Depending on the output that you select, the command might return some INFO messages about the CRS and the YAML file. Sample output INFO: Successfully generated new CRS INFO: INFO: Name: test-crs INFO: Created at: 2025-02-26T19:07:21Z INFO: Expires at: 2026-02-26T19:07:00Z INFO: Created By: sample-token INFO: ID: 9214a63f-7e0e-485a-baae-0757b0860ac9 # This is a StackRox Cluster Registration Secret (CRS). # It is used for setting up StackRox secured clusters. # NOTE: This file contains secret data that allows connecting new secured clusters to central, # and needs to be handled and stored accordingly. apiVersion: v1 data: crs: EXAMPLEZXlKMlpYSnphVzl1SWpveExDSkRRWE1pT2xzaUxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwREXAMPLE= kind: Secret metadata: annotations: crs.platform.stackrox.io/created-at: "2025-02-26T19:07:21.800414339Z" crs.platform.stackrox.io/expires-at: "2026-02-26T19:07:00Z" crs.platform.stackrox.io/id: 9214a63f-7e0e-485a-baae-0757b0860ac9 crs.platform.stackrox.io/name: test-crs creationTimestamp: null name: cluster-registration-secret INFO: Then CRS needs to be stored securely, since it contains secrets. INFO: It is not possible to retrieve previously generated CRSs. 8.2.3. steps Creating resources by using the init bundle 8.3. Applying an init bundle for Kubernetes secured clusters Apply the init bundle by using it to create resources. 8.3.1. Applying the init bundle on the secured cluster Before you configure a secured cluster, you must apply the init bundle by using it to create the required resources on the secured cluster. Applying the init bundle allows the services on the secured cluster to communicate with RHACS Cloud Service. Note If you are installing by using Helm charts, do not perform this step. Complete the installation by using Helm; See "Installing RHACS on secured clusters by using Helm charts" in the additional resources section. Prerequisites You must have generated an init bundle containing secrets. You must have created the stackrox project, or namespace, on the cluster where secured cluster services will be installed. Using stackrox for the project is not required, but ensures that vulnerabilities for RHACS processes are not reported when scanning your clusters. Procedure To create resources, perform only one of the following steps: Create resources using the OpenShift Container Platform web console: In the OpenShift Container Platform web console, make sure that you are in the stackrox namespace. In the top menu, click + to open the Import YAML page. You can drag the init bundle file or copy and paste its contents into the editor, and then click Create . When the command is complete, the display shows that the collector-tls , sensor-tls , and admission-control-tls resources were created. Create resources using the Red Hat OpenShift CLI: Using the Red Hat OpenShift CLI, run the following command to create the resources: USD oc create -f <init_bundle.yaml> \ 1 -n <stackrox> 2 1 Specify the file name of the init bundle containing the secrets. 2 Specify the name of the project where Central services are installed. Using the kubectl CLI, run the following commands to create the resources: USD kubectl create namespace stackrox 1 USD kubectl create -f <init_bundle.yaml> \ 2 -n <stackrox> 3 1 Create the project where secured cluster resources will be installed. This example uses stackrox . 2 Specify the file name of the init bundle containing the secrets. 3 Specify the project name that you created. This example uses stackrox . Verification Restart Sensor to pick up the new certificates. For more information about how to restart Sensor, see "Restarting the Sensor container" in the "Additional resources" section. 8.3.2. steps Install RHACS secured cluster services in all clusters that you want to monitor. 8.3.3. Additional resources Restarting the Sensor container 8.4. Installing secured cluster services from RHACS Cloud Service on Kubernetes clusters You can install RHACS Cloud Service on your secured clusters by using one of the following methods: By using Helm charts By using the roxctl CLI (do not use this method unless you have a specific installation need that requires using it) 8.4.1. Installing RHACS Cloud Service on secured clusters by using Helm charts You can install RHACS on secured clusters by using Helm charts with no customization, by using Helm charts with the default values, or by using Helm charts with customizations of configuration parameters. First, ensure that you add the Helm chart repository. 8.4.1.1. Adding the Helm chart repository Procedure Add the RHACS charts repository. USD helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/ The Helm repository for Red Hat Advanced Cluster Security for Kubernetes includes Helm charts for installing different components, including: Secured Cluster Services Helm chart ( secured-cluster-services ) for installing the per-cluster and per-node components (Sensor, Admission Controller, Collector, and Scanner-slim). Note Deploy the per-cluster components into each cluster that you want to monitor and deploy the per-node components in all nodes that you want to monitor. Verification Run the following command to verify the added chart repository: USD helm search repo -l rhacs/ 8.4.1.2. Installing RHACS Cloud Service on secured clusters by using Helm charts without customizations 8.4.1.2.1. Installing the secured-cluster-services Helm chart without customization Use the following instructions to install the secured-cluster-services Helm chart to deploy the per-cluster and per-node components (Sensor, Admission controller, Collector, and Scanner-slim). Prerequisites You must have generated an RHACS init bundle or CRS for your cluster. You must have access to the Red Hat Container Registry and a pull secret for authentication. For information about downloading images from registry.redhat.io , see Red Hat Container Registry Authentication . You must have the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the ACS instance you created. Procedure Run one of the following commands on your Kubernetes-based clusters: If you are using an init bundle, run the following command: USD helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ 3 --set imagePullSecrets.username=<your redhat.com username> \ 4 --set imagePullSecrets.password=<your redhat.com password> 5 1 Use the -f option to specify the path for the init bundle. 2 Use the -f option to specify the path for the pull secret for Red Hat Container Registry authentication. 3 Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. 4 Include the user name for your pull secret for Red Hat Container Registry authentication. 5 Include the password for your pull secret for Red Hat Container Registry authentication. Procedure Run one of the following commands on an OpenShift Container Platform cluster: If you are using an init bundle, run the following command: USD helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ 3 --set scanner.disable=false 4 1 Use the -f option to specify the path for the init bundle. 2 Use the -f option to specify the path for the pull secret for Red Hat Container Registry authentication. 3 Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. 4 Set the value of the scanner.disable parameter to false , which means that Scanner-slim will be enabled during the installation. In Kubernetes, the secured cluster services now include Scanner-slim. If you are using a CRS, run the following command: USD helm install -n stackrox --create-namespace \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ --set-file crs.file=<crs_file_name.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> \ --set centralEndpoint=<endpoint_of_central_service> \ 3 --set scanner.disable=false 4 1 Use the name of the file in which the generated CRS has been stored. 2 Use the -f option to specify the path for the pull secret for Red Hat Container Registry authentication. 3 Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. 4 Set the value of the scanner.disable parameter to false , which means that Scanner-slim will be enabled during the installation. In Kubernetes, the secured cluster services now include Scanner-slim. 8.4.1.3. Configuring the secured-cluster-services Helm chart with customizations This section describes Helm chart configuration parameters that you can use with the helm install and helm upgrade commands. You can specify these parameters by using the --set option or by creating YAML configuration files. Create the following files for configuring the Helm chart for installing Red Hat Advanced Cluster Security for Kubernetes: Public configuration file values-public.yaml : Use this file to save all non-sensitive configuration options. Private configuration file values-private.yaml : Use this file to save all sensitive configuration options. Ensure that you store this file securely. Important While using the secured-cluster-services Helm chart, do not modify the values.yaml file that is part of the chart. 8.4.1.3.1. Configuration parameters Parameter Description clusterName Name of your cluster. centralEndpoint Address of the Central endpoint. If you are using a non-gRPC capable load balancer, use the WebSocket protocol by prefixing the endpoint address with wss:// . When configuring multiple clusters, use the hostname for the address. For example, central.example.com . sensor.endpoint Address of the Sensor endpoint including port number. sensor.imagePullPolicy Image pull policy for the Sensor container. sensor.serviceTLS.cert The internal service-to-service TLS certificate that Sensor uses. sensor.serviceTLS.key The internal service-to-service TLS certificate key that Sensor uses. sensor.resources.requests.memory The memory request for the Sensor container. Use this parameter to override the default value. sensor.resources.requests.cpu The CPU request for the Sensor container. Use this parameter to override the default value. sensor.resources.limits.memory The memory limit for the Sensor container. Use this parameter to override the default value. sensor.resources.limits.cpu The CPU limit for the Sensor container. Use this parameter to override the default value. sensor.nodeSelector Specify a node selector label as label-key: label-value to force Sensor to only schedule on nodes with the specified label. sensor.tolerations If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Sensor. This parameter is mainly used for infrastructure nodes. image.main.name The name of the main image. image.collector.name The name of the Collector image. image.main.registry The address of the registry you are using for the main image. image.collector.registry The address of the registry you are using for the Collector image. image.scanner.registry The address of the registry you are using for the Scanner image. image.scannerDb.registry The address of the registry you are using for the Scanner DB image. image.scannerV4.registry The address of the registry you are using for the Scanner V4 image. image.scannerV4DB.registry The address of the registry you are using for the Scanner V4 DB image. image.main.pullPolicy Image pull policy for main images. image.collector.pullPolicy Image pull policy for the Collector images. image.main.tag Tag of main image to use. image.collector.tag Tag of collector image to use. collector.collectionMethod Either CORE_BPF or NO_COLLECTION . collector.imagePullPolicy Image pull policy for the Collector container. collector.complianceImagePullPolicy Image pull policy for the Compliance container. collector.disableTaintTolerations If you specify false , tolerations are applied to Collector, and the collector pods can schedule onto all nodes with taints. If you specify it as true , no tolerations are applied, and the collector pods are not scheduled onto nodes with taints. collector.resources.requests.memory The memory request for the Collector container. Use this parameter to override the default value. collector.resources.requests.cpu The CPU request for the Collector container. Use this parameter to override the default value. collector.resources.limits.memory The memory limit for the Collector container. Use this parameter to override the default value. collector.resources.limits.cpu The CPU limit for the Collector container. Use this parameter to override the default value. collector.complianceResources.requests.memory The memory request for the Compliance container. Use this parameter to override the default value. collector.complianceResources.requests.cpu The CPU request for the Compliance container. Use this parameter to override the default value. collector.complianceResources.limits.memory The memory limit for the Compliance container. Use this parameter to override the default value. collector.complianceResources.limits.cpu The CPU limit for the Compliance container. Use this parameter to override the default value. collector.serviceTLS.cert The internal service-to-service TLS certificate that Collector uses. collector.serviceTLS.key The internal service-to-service TLS certificate key that Collector uses. admissionControl.listenOnCreates This setting controls whether Kubernetes is configured to contact Red Hat Advanced Cluster Security for Kubernetes with AdmissionReview requests for workload creation events. admissionControl.listenOnUpdates When you set this parameter as false , Red Hat Advanced Cluster Security for Kubernetes creates the ValidatingWebhookConfiguration in a way that causes the Kubernetes API server not to send object update events. Since the volume of object updates is usually higher than the object creates, leaving this as false limits the load on the admission control service and decreases the chances of a malfunctioning admission control service. admissionControl.listenOnEvents This setting controls whether the cluster is configured to contact Red Hat Advanced Cluster Security for Kubernetes with AdmissionReview requests for Kubernetes exec and portforward events. RHACS does not support this feature on OpenShift Container Platform 3.11. admissionControl.dynamic.enforceOnCreates This setting controls whether Red Hat Advanced Cluster Security for Kubernetes evaluates policies; if it is disabled, all AdmissionReview requests are automatically accepted. admissionControl.dynamic.enforceOnUpdates This setting controls the behavior of the admission control service. You must specify listenOnUpdates as true for this to work. admissionControl.dynamic.scanInline If you set this option to true , the admission control service requests an image scan before making an admission decision. Since image scans take several seconds, enable this option only if you can ensure that all images used in your cluster are scanned before deployment (for example, by a CI integration during image build). This option corresponds to the Contact image scanners option in the RHACS portal. admissionControl.dynamic.disableBypass Set it to true to disable bypassing the Admission controller. admissionControl.dynamic.timeout Use this parameter to specify the maximum number of seconds RHACS must wait for an admission review before marking it as fail open. If the admission webhook does not receive information that it is requesting before the end of the timeout period, it fails, but in fail open status, it still allows the operation to succeed. For example, the admission controller would allow a deployment to be created even if a scan had timed out and RHACS could not determine if the deployment violated a policy. Beginning in release 4.5, Red Hat reduced the default timeout setting for the RHACS admission controller webhooks from 20 seconds to 10 seconds, resulting in an effective timeout of 12 seconds within the ValidatingWebhookConfiguration . admissionControl.resources.requests.memory The memory request for the Admission Control container. Use this parameter to override the default value. admissionControl.resources.requests.cpu The CPU request for the Admission Control container. Use this parameter to override the default value. admissionControl.resources.limits.memory The memory limit for the Admission Control container. Use this parameter to override the default value. admissionControl.resources.limits.cpu The CPU limit for the Admission Control container. Use this parameter to override the default value. admissionControl.nodeSelector Specify a node selector label as label-key: label-value to force Admission Control to only schedule on nodes with the specified label. admissionControl.tolerations If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Admission Control. This parameter is mainly used for infrastructure nodes. admissionControl.namespaceSelector If the admission controller webhook needs a specific namespaceSelector , you can specify the corresponding selector here. Use this parameter to override the default, which avoids a few system namespaces. admissionControl.serviceTLS.cert The internal service-to-service TLS certificate that Admission Control uses. admissionControl.serviceTLS.key The internal service-to-service TLS certificate key that Admission Control uses. registryOverride Use this parameter to override the default docker.io registry. Specify the name of your registry if you are using some other registry. collector.disableTaintTolerations If you specify false , tolerations are applied to Collector, and the Collector pods can schedule onto all nodes with taints. If you specify it as true , no tolerations are applied, and the Collector pods are not scheduled onto nodes with taints. createUpgraderServiceAccount Specify true to create the sensor-upgrader account. By default, Red Hat Advanced Cluster Security for Kubernetes creates a service account called sensor-upgrader in each secured cluster. This account is highly privileged but is only used during upgrades. If you do not create this account, you must complete future upgrades manually if the Sensor does not have enough permissions. createSecrets Specify false to skip the orchestrator secret creation for the Sensor, Collector, and Admission controller. collector.slimMode Deprecated. Specify true if you want to use a slim Collector image for deploying Collector. sensor.resources Resource specification for Sensor. admissionControl.resources Resource specification for Admission controller. collector.resources Resource specification for Collector. collector.complianceResources Resource specification for Collector's Compliance container. exposeMonitoring If you set this option to true , Red Hat Advanced Cluster Security for Kubernetes exposes Prometheus metrics endpoints on port number 9090 for the Sensor, Collector, and the Admission controller. auditLogs.disableCollection If you set this option to true , Red Hat Advanced Cluster Security for Kubernetes disables the audit log detection features used to detect access and modifications to configuration maps and secrets. scanner.disable If you set this option to false , Red Hat Advanced Cluster Security for Kubernetes deploys a Scanner-slim and Scanner DB in the secured cluster to allow scanning images on the integrated OpenShift image registry. Enabling Scanner-slim is supported on OpenShift Container Platform and Kubernetes secured clusters. Defaults to true . scanner.dbTolerations If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. scanner.replicas Resource specification for Collector's Compliance container. scanner.logLevel Setting this parameter allows you to modify the scanner log level. Use this option only for troubleshooting purposes. scanner.autoscaling.disable If you set this option to true , Red Hat Advanced Cluster Security for Kubernetes disables autoscaling on the Scanner deployment. scanner.autoscaling.minReplicas The minimum number of replicas for autoscaling. Defaults to 2. scanner.autoscaling.maxReplicas The maximum number of replicas for autoscaling. Defaults to 5. scanner.nodeSelector Specify a node selector label as label-key: label-value to force Scanner to only schedule on nodes with the specified label. scanner.tolerations If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. scanner.dbNodeSelector Specify a node selector label as label-key: label-value to force Scanner DB to only schedule on nodes with the specified label. scanner.dbTolerations If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. scanner.resources.requests.memory The memory request for the Scanner container. Use this parameter to override the default value. scanner.resources.requests.cpu The CPU request for the Scanner container. Use this parameter to override the default value. scanner.resources.limits.memory The memory limit for the Scanner container. Use this parameter to override the default value. scanner.resources.limits.cpu The CPU limit for the Scanner container. Use this parameter to override the default value. scanner.dbResources.requests.memory The memory request for the Scanner DB container. Use this parameter to override the default value. scanner.dbResources.requests.cpu The CPU request for the Scanner DB container. Use this parameter to override the default value. scanner.dbResources.limits.memory The memory limit for the Scanner DB container. Use this parameter to override the default value. scanner.dbResources.limits.cpu The CPU limit for the Scanner DB container. Use this parameter to override the default value. monitoring.openshift.enabled If you set this option to false , Red Hat Advanced Cluster Security for Kubernetes will not set up Red Hat OpenShift monitoring. Defaults to true on Red Hat OpenShift 4. network.enableNetworkPolicies To provide security at the network level, RHACS creates default NetworkPolicy resources in the namespace where secured cluster resources are installed. These network policies allow ingress to specific components on specific ports. If you do not want RHACS to create these policies, set this parameter to False . This is a Boolean value. The default value is True , which means the default policies are automatically created. Warning Disabling creation of default network policies can break communication between RHACS components. If you disable creation of default policies, you must create your own network policies to allow this communication. 8.4.1.3.1.1. Environment variables You can specify environment variables for Sensor and Admission controller in the following format: customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2" The customize setting allows you to specify custom Kubernetes metadata (labels and annotations) for all objects created by this Helm chart and additional pod labels, pod annotations, and container environment variables for workloads. The configuration is hierarchical, in the sense that metadata defined at a more generic scope (for example, for all objects) can be overridden by metadata defined at a narrower scope (for example, only for the Sensor deployment). 8.4.1.3.2. Installing the secured-cluster-services Helm chart with customizations After you configure the values-public.yaml and values-private.yaml files, install the secured-cluster-services Helm chart to deploy the following per-cluster and per-node components: Sensor Admission controller Collector Scanner: optional for secured clusters when the StackRox Scanner is installed Scanner DB: optional for secured clusters when the StackRox Scanner is installed Scanner V4 Indexer and Scanner V4 DB: optional for secured clusters when Scanner V4 is installed Prerequisites You must have generated an RHACS init bundle for your cluster. You must have access to the Red Hat Container Registry and a pull secret for authentication. For information about downloading images from registry.redhat.io , see Red Hat Container Registry Authentication . You must have the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. Procedure Run the following command: USD helm install -n stackrox \ --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services \ -f <name_of_cluster_init_bundle.yaml> \ -f <path_to_values_public.yaml> \ 1 -f <path_to_values_private.yaml> \ 2 --set imagePullSecrets.username=<username> \ 3 --set imagePullSecrets.password=<password> 4 1 Use the -f option to specify the paths for your public YAML configuration file. 2 Use the -f option to specify the paths for your private YAML configuration file. 3 Include the user name for your pull secret for Red Hat Container Registry authentication. 4 Include the password for your pull secret for Red Hat Container Registry authentication. Note To deploy secured-cluster-services Helm chart by using a continuous integration (CI) system, pass the init bundle YAML file as an environment variable to the helm install command: USD helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1 1 If you are using base64 encoded variables, use the helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET" | base64 --decode) command instead. 8.4.1.4. Changing configuration options after deploying the secured-cluster-services Helm chart You can make changes to any configuration options after you have deployed the secured-cluster-services Helm chart. When using the helm upgrade command to make changes, the following guidelines and requirements apply: You can also specify configuration values using the --set or --set-file parameters. However, these options are not saved, and you must manually specify all the options again whenever you make changes. Some changes, such as enabling a new component like Scanner V4, require new certificates to be issued for the component. Therefore, you must provide a CA when making these changes. If the CA was generated by the Helm chart during the initial installation, you must retrieve these automatically generated values from the cluster and provide them to the helm upgrade command. The post-installation notes of the central-services Helm chart include a command for retrieving the automatically generated values. If the CA was generated outside of the Helm chart and provided during the installation of the central-services chart, then you must perform that action again when using the helm upgrade command, for example, by using the --reuse-values flag with the helm upgrade command. Procedure Update the values-public.yaml and values-private.yaml configuration files with new values. Run the helm upgrade command and specify the configuration files using the -f option: USD helm upgrade -n stackrox \ stackrox-secured-cluster-services rhacs/secured-cluster-services \ --reuse-values \ 1 -f <path_to_values_public.yaml> \ -f <path_to_values_private.yaml> 1 If you have modified values that are not included in the values_public.yaml and values_private.yaml files, include the --reuse-values parameter. 8.4.2. Installing RHACS on secured clusters by using the roxctl CLI To install RHACS on secured clusters by using the CLI, perform the following steps: Install the roxctl CLI. Install Sensor. 8.4.2.1. Installing the roxctl CLI You must first download the binary. You can install roxctl on Linux, Windows, or macOS. 8.4.2.1.1. Installing the roxctl CLI on Linux You can install the roxctl CLI binary on Linux by using the following procedure. Note roxctl CLI for Linux is available for amd64 , arm64 , ppc64le , and s390x architectures. Procedure Determine the roxctl architecture for the target operating system: USD arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" Download the roxctl CLI: USD curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Linux/roxctlUSD{arch}" Make the roxctl binary executable: USD chmod +x roxctl Place the roxctl binary in a directory that is on your PATH : To check your PATH , execute the following command: USD echo USDPATH Verification Verify the roxctl version you have installed: USD roxctl version 8.4.2.1.2. Installing the roxctl CLI on macOS You can install the roxctl CLI binary on macOS by using the following procedure. Note roxctl CLI for macOS is available for amd64 and arm64 architectures. Procedure Determine the roxctl architecture for the target operating system: USD arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}" Download the roxctl CLI: USD curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Darwin/roxctlUSD{arch}" Remove all extended attributes from the binary: USD xattr -c roxctl Make the roxctl binary executable: USD chmod +x roxctl Place the roxctl binary in a directory that is on your PATH : To check your PATH , execute the following command: USD echo USDPATH Verification Verify the roxctl version you have installed: USD roxctl version 8.4.2.1.3. Installing the roxctl CLI on Windows You can install the roxctl CLI binary on Windows by using the following procedure. Note roxctl CLI for Windows is available for the amd64 architecture. Procedure Download the roxctl CLI: USD curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Windows/roxctl.exe Verification Verify the roxctl version you have installed: USD roxctl version 8.4.2.2. Installing Sensor To monitor a cluster, you must deploy Sensor. You must deploy Sensor into each cluster that you want to monitor. This installation method is also called the manifest installation method. To perform an installation by using the manifest installation method, follow only one of the following procedures: Use the RHACS web portal to download the cluster bundle, and then extract and run the sensor script. Use the roxctl CLI to generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance. Prerequisites You must have already installed Central services, or you can access Central services by selecting your ACS instance on Red Hat Advanced Cluster Security Cloud Service (RHACS Cloud Service). 8.4.2.2.1. Manifest installation method by using the web portal Procedure On your secured cluster, in the RHACS portal, go to Platform Configuration Clusters . Select Secure a cluster Legacy installation method . Specify a name for the cluster. Provide appropriate values for the fields based on where you are deploying the Sensor. Enter the Central API Endpoint address. You can view this information by choosing Advanced Cluster Security ACS Instances from the Red Hat Hybrid Cloud Console navigation menu, then clicking the RHACS instance you created. Click to continue with the Sensor setup. Click Download YAML File and Keys to download the cluster bundle (zip archive). Important The cluster bundle zip archive includes unique configurations and keys for each cluster. Do not reuse the same files in another cluster. From a system that has access to the monitored cluster, extract and run the sensor script from the cluster bundle: USD unzip -d sensor sensor-<cluster_name>.zip USD ./sensor/sensor.sh If you get a warning that you do not have the required permissions to deploy Sensor, follow the on-screen instructions, or contact your cluster administrator for help. After Sensor is deployed, it contacts Central and provides cluster information. 8.4.2.2.2. Manifest installation by using the roxctl CLI Procedure Generate the required sensor configuration for your OpenShift Container Platform cluster and associate it with your Central instance by running the following command: USD roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1 1 For the --openshift-version option, specify the major OpenShift Container Platform version number for your cluster. For example, specify 3 for OpenShift Container Platform version 3.x and specify 4 for OpenShift Container Platform version 4.x . From a system that has access to the monitored cluster, extract and run the sensor script from the cluster bundle: USD unzip -d sensor sensor-<cluster_name>.zip USD ./sensor/sensor.sh If you get a warning that you do not have the required permissions to deploy Sensor, follow the on-screen instructions, or contact your cluster administrator for help. After Sensor is deployed, it contacts Central and provides cluster information. Verification Return to the RHACS portal and check if the deployment is successful. If successful, when viewing your list of clusters in Platform Configuration Clusters , the cluster status displays a green checkmark and a Healthy status. If you do not see a green checkmark, use the following command to check for problems: On Kubernetes, enter the following command: USD kubectl get pod -n stackrox -w Click Finish to close the window. After installation, Sensor starts reporting security information to RHACS and the RHACS portal dashboard begins showing deployments, images, and policy violations from the cluster on which you have installed the Sensor. 8.5. Verifying installation of secured clusters After installing RHACS Cloud Service, you can perform some steps to verify that the installation was successful. To verify installation, access your ACS Console from the Red Hat Hybrid Cloud Console. The Dashboard displays the number of clusters that RHACS Cloud Service is monitoring, along with information about nodes, deployments, images, and violations. If no data appears in the ACS Console: Ensure that at least one secured cluster is connected to your RHACS Cloud Service instance. For more information, see instructions for installing by using Helm charts or by using the roxctl CLI . Examine your Sensor pod logs to ensure that the connection to your RHACS Cloud Service instance is successful. Examine the values in the SecuredCluster API in the Operator on your local cluster to ensure that the Central API Endpoint has been entered correctly. This value should be the same value as shown in the ACS instance details in the Red Hat Hybrid Cloud Console.

Commands:
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate <cluster_init_bundle_name> --output cluster_init_bundle.yaml
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate <cluster_init_bundle_name> --output-secrets cluster_init_bundle.yaml
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl -e "USDROX_CENTRAL_ADDRESS" central crs generate <crs_name> \ 1 --output <file_name> 2
INFO: Successfully generated new CRS INFO: INFO: Name: test-crs INFO: Created at: 2025-02-26T19:07:21Z INFO: Expires at: 2026-02-26T19:07:00Z INFO: Created By: sample-token INFO: ID: 9214a63f-7e0e-485a-baae-0757b0860ac9 This is a StackRox Cluster Registration Secret (CRS). It is used for setting up StackRox secured clusters. NOTE: This file contains secret data that allows connecting new secured clusters to central, and needs to be handled and stored accordingly. apiVersion: v1 data: crs: EXAMPLEZXlKMlpYSnphVzl1SWpveExDSkRRWE1pT2xzaUxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwREXAMPLE= kind: Secret metadata: annotations: crs.platform.stackrox.io/created-at: "2025-02-26T19:07:21.800414339Z" crs.platform.stackrox.io/expires-at: "2026-02-26T19:07:00Z" crs.platform.stackrox.io/id: 9214a63f-7e0e-485a-baae-0757b0860ac9 crs.platform.stackrox.io/name: test-crs creationTimestamp: null name: cluster-registration-secret INFO: Then CRS needs to be stored securely, since it contains secrets. INFO: It is not possible to retrieve previously generated CRSs.
oc create -f <init_bundle.yaml> \ 1 -n <stackrox> 2
kubectl create namespace stackrox 1 kubectl create -f <init_bundle.yaml> \ 2 -n <stackrox> 3
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> \ 3 --set imagePullSecrets.username=<your redhat.com username> \ 4 --set imagePullSecrets.password=<your redhat.com password> 5
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> \ 3 --set scanner.disable=false 4
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services --set-file crs.file=<crs_file_name.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> \ 3 --set scanner.disable=false 4
customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2"
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> \ 1 -f <path_to_values_private.yaml> \ 2 --set imagePullSecrets.username=<username> \ 3 --set imagePullSecrets.password=<password> 4
helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1
helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Linux/roxctlUSD{arch}"
chmod +x roxctl
echo USDPATH
roxctl version
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Darwin/roxctlUSD{arch}"
xattr -c roxctl
chmod +x roxctl
echo USDPATH
roxctl version
curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.7.0/bin/Windows/roxctl.exe
roxctl version
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
kubectl get pod -n stackrox -w