Installing Red Hat Advanced Cluster Security for Kubernetes 4.6 Installing Red Hat Advanced Cluster Security for Kubernetes Red Hat OpenShift Documentation Team

Commands:
/sys/kernel/btf/vmlinux /boot/vmlinux-<kernel-version> /lib/modules/<kernel-version>/vmlinux-<kernel-version> /lib/modules/<kernel-version>/build/vmlinux /usr/lib/modules/<kernel-version>/kernel/vmlinux /usr/lib/debug/boot/vmlinux-<kernel-version> /usr/lib/debug/boot/vmlinux-<kernel-version>.debug /usr/lib/debug/lib/modules/<kernel-version>/vmlinux
spec: central: declarativeConfiguration: configMaps: - name: "<declarative-configs>" 1 secrets: - name: "<sensitive-declarative-configs>" 2
CREATE USER stackrox WITH PASSWORD <password>;
CREATE DATABASE stackrox;
\connect stackrox
CREATE SCHEMA stackrox;
REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE USAGE ON SCHEMA public FROM PUBLIC; REVOKE ALL ON DATABASE stackrox FROM PUBLIC;
CREATE ROLE readwrite;
GRANT CONNECT ON DATABASE stackrox TO readwrite;
GRANT USAGE ON SCHEMA stackrox TO readwrite; GRANT USAGE, CREATE ON SCHEMA stackrox TO readwrite; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA stackrox TO readwrite; ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO readwrite; GRANT USAGE ON ALL SEQUENCES IN SCHEMA stackrox TO readwrite; ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT USAGE ON SEQUENCES TO readwrite;
GRANT readwrite TO stackrox;
oc create secret generic external-db-password \ 1 --from-file=password=<password.txt> 2
spec: central: declarativeConfiguration: configMaps: - name: <declarative-configs> 1 secrets: - name: <sensitive-declarative-configs> 2
spec: tls: additionalCAs: - name: db-ca content: | <certificate>
oc -n stackrox get secret central-htpasswd -o go-template='{{index .data "password" | base64decode}}'
oc -n stackrox get route central -o jsonpath="{.status.ingress[0].host}"
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.route.enabled=true
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.loadBalancer.enabled=true
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> 2
env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain
env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain
htpasswd: | admin:<bcrypt-hash>
central: declarativeConfiguration: mounts: configMaps: - declarative-configs secrets: - sensitive-declarative-configs
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> 1
helm upgrade -n stackrox stackrox-central-services rhacs/central-services --reuse-values \ 1 -f <path_to_init_bundle_file -f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}"
chmod +x roxctl
echo USDPATH
roxctl version
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}"
xattr -c roxctl
chmod +x roxctl
echo USDPATH
roxctl version
curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe
roxctl version
roxctl central generate interactive
Path to the backup bundle from which to restore keys and certificates (optional): PEM cert bundle file (optional): 1 Disable the administrator password (only use this if you have already configured an IdP for your instance) (default: "false"): Create PodSecurityPolicy resources (for pre-v1.25 Kubernetes) (default: "false"): 2 Administrator password (default: autogenerated): Orchestrator (k8s, openshift): Default container images settings (rhacs, opensource); it controls repositories from where to download the images, image names and tags format (default: "rhacs"): The directory to output the deployment bundle to (default: "central-bundle"): Whether to enable telemetry (default: "true"): The central-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.6.0"): List of secrets to add as declarative configuration mounts in central (default: "[]"): 3 The method of exposing Central (lb, np, none) (default: "none"): 4 The main image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.0"): Whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"): List of config maps to add as declarative configuration mounts in central (default: "[]"): 5 The deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"): Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional): The scanner-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.6.0"): The scanner image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.6.0"): The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.6.0"): The scanner-v4 image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.6.0"): External volume type (hostpath, pvc): hostpath Path on the host (default: "/var/lib/stackrox-central"): Node selector key (e.g. kubernetes.io/hostname): Node selector value:
sudo chcon -Rt svirt_sandbox_file_t <full_volume_path>
./central-bundle/central/scripts/setup.sh
oc create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml
oc create -R -f central-bundle/central
oc get pod -n stackrox -w
cat central-bundle/password
overlays: - apiVersion: v1 1 kind: ConfigMap 2 name: my-configmap 3 patches: - path: .data 4 value: | 5 key1: data2 key2: data2
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ServiceAccount name: central patches: - path: metadata.annotations.eks\.amazonaws\.com/role-arn value: "\"arn:aws:iam:1234:role\""
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[name:central].env[-1] value: | name: MY_ENV_VAR value: value
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy name: allow-ext-to-central patches: - path: spec.ingress[-1] value: | ports: - port: 999 protocol: TCP
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ConfigMap name: central-endpoints patches: - path: data value: | endpoints.yaml: | disableDefault: false
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[-1] value: | name: nginx image: nginx ports: - containerPort: 8000 name: http protocol: TCP
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml
oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <path_to_cluster_init_bundle.yaml> \ 1 -f <path_to_pull_secret.yaml> \ 2 --set clusterName=<name_of_the_secured_cluster> --set centralEndpoint=<endpoint_of_central_service> 3 --set scanner.disable=false 4
customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2"
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3
helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1
helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}"
chmod +x roxctl
echo USDPATH
roxctl version
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}"
xattr -c roxctl
chmod +x roxctl
echo USDPATH
roxctl version
curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe
roxctl version
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
oc get pod -n stackrox -w
kubectl get pod -n stackrox -w
overlays: - apiVersion: v1 1 kind: ConfigMap 2 name: my-configmap 3 patches: - path: .data 4 value: | 5 key1: data2 key2: data2
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ServiceAccount name: central patches: - path: metadata.annotations.eks\.amazonaws\.com/role-arn value: "\"arn:aws:iam:1234:role\""
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[name:central].env[-1] value: | name: MY_ENV_VAR value: value
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: networking.k8s.io/v1 kind: NetworkPolicy name: allow-ext-to-central patches: - path: spec.ingress[-1] value: | ports: - port: 999 protocol: TCP
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: v1 kind: ConfigMap name: central-endpoints patches: - path: data value: | endpoints.yaml: | disableDefault: false
apiVersion: platform.stackrox.io kind: Central metadata: name: central spec: # overlays: - apiVersion: apps/v1 kind: Deployment name: central patches: - path: spec.template.spec.containers[-1] value: | name: nginx image: nginx ports: - containerPort: 8000 name: http protocol: TCP
oc get route central -n stackrox
oc get service central-loadbalancer -n stackrox
oc port-forward svc/central 18443:443 -n stackrox
oc new-project test
oc run shell --labels=app=shellshock,team=test-team --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2014-6271 -n test oc run samba --labels=app=rce --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2017-7494 -n test
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.route.enabled=true
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> \ 2 --set central.exposure.loadBalancer.enabled=true
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.username=<username> \ 1 --set imagePullSecrets.password=<password> 2
env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain
env: proxyConfig: | url: http://proxy.name:port username: username password: password excludes: - some.domain
htpasswd: | admin:<bcrypt-hash>
central: declarativeConfiguration: mounts: configMaps: - declarative-configs secrets: - sensitive-declarative-configs
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> 1
helm upgrade -n stackrox stackrox-central-services rhacs/central-services --reuse-values \ 1 -f <path_to_init_bundle_file -f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}"
chmod +x roxctl
echo USDPATH
roxctl version
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}"
xattr -c roxctl
chmod +x roxctl
echo USDPATH
roxctl version
curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe
roxctl version
roxctl central generate interactive
Path to the backup bundle from which to restore keys and certificates (optional): PEM cert bundle file (optional): 1 Disable the administrator password (only use this if you have already configured an IdP for your instance) (default: "false"): Create PodSecurityPolicy resources (for pre-v1.25 Kubernetes) (default: "false"): 2 Administrator password (default: autogenerated): Orchestrator (k8s, openshift): Default container images settings (rhacs, opensource); it controls repositories from where to download the images, image names and tags format (default: "rhacs"): The directory to output the deployment bundle to (default: "central-bundle"): Whether to enable telemetry (default: "true"): The central-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8:4.6.0"): List of secrets to add as declarative configuration mounts in central (default: "[]"): 3 The method of exposing Central (lb, np, none) (default: "none"): 4 The main image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8:4.6.0"): Whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"): List of config maps to add as declarative configuration mounts in central (default: "[]"): 5 The deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"): Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional): The scanner-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8:4.6.0"): The scanner image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8:4.6.0"): The scanner-v4-db image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.6.0"): The scanner-v4 image to use (if unset, a default will be used according to --image-defaults) (default: "registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8:4.6.0"): External volume type (hostpath, pvc): hostpath Path on the host (default: "/var/lib/stackrox-central"): Node selector key (e.g. kubernetes.io/hostname): Node selector value:
sudo chcon -Rt svirt_sandbox_file_t <full_volume_path>
./central-bundle/central/scripts/setup.sh
oc create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml
kubectl create -f helm/chart/crds/config.stackrox.io_securitypolicies.yaml
oc create -R -f central-bundle/central
kubectl create -R -f central-bundle/central
oc get pod -n stackrox -w
kubectl get pod -n stackrox -w
cat central-bundle/password
export ROX_API_TOKEN=<api_token>
export ROX_CENTRAL_ADDRESS=<address>:<port_number>
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output <cluster_init_bundle_name> cluster_init_bundle.yaml
roxctl -e "USDROX_CENTRAL_ADDRESS" central init-bundles generate --output-secrets <cluster_init_bundle_name> cluster_init_bundle.yaml
oc create -f <init_bundle>.yaml \ 1 -n <stackrox> 2
kubectl create namespace stackrox 1 kubectl create -f <init_bundle>.yaml \ 2 -n <stackrox> 3
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
customize: envVars: ENV_VAR1: "value1" ENV_VAR2: "value2"
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services -f <name_of_cluster_init_bundle.yaml> -f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \ 1 --set imagePullSecrets.username=<username> \ 2 --set imagePullSecrets.password=<password> 3
helm install ... -f <(echo "USDINIT_BUNDLE_YAML_SECRET") 1
helm upgrade -n stackrox stackrox-secured-cluster-services rhacs/secured-cluster-services --reuse-values \ 1 -f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Linux/roxctlUSD{arch}"
chmod +x roxctl
echo USDPATH
roxctl version
arch="USD(uname -m | sed "s/x86_64//")"; arch="USD{arch:+-USDarch}"
curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Darwin/roxctlUSD{arch}"
xattr -c roxctl
chmod +x roxctl
echo USDPATH
roxctl version
curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.6.3/bin/Windows/roxctl.exe
roxctl version
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
roxctl sensor generate openshift --openshift-version <ocp_version> --name <cluster_name> --central "USDROX_ENDPOINT" 1
unzip -d sensor sensor-<cluster_name>.zip
./sensor/sensor.sh
kubectl get pod -n stackrox -w
kubectl get service central-loadbalancer -n stackrox
kubectl port-forward svc/central 18443:443 -n stackrox
kubectl create namespace test
kubectl run shell --labels=app=shellshock,team=test-team --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2014-6271 -n test kubectl run samba --labels=app=rce --image=quay.io/stackrox-io/docs:example-vulnerables-cve-2017-7494 -n test
oc delete namespace stackrox
kubectl delete namespace stackrox
oc get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs oc delete --wait
oc delete scc -l "app.kubernetes.io/name=stackrox"
oc delete ValidatingWebhookConfiguration stackrox
kubectl get clusterrole,clusterrolebinding,role,rolebinding,psp -o name | grep stackrox | xargs kubectl delete --wait
kubectl delete ValidatingWebhookConfiguration stackrox
for namespace in USD(oc get ns | tail -n +2 | awk '{print USD1}'); do oc label namespace USDnamespace namespace.metadata.stackrox.io/id-; oc label namespace USDnamespace namespace.metadata.stackrox.io/name-; oc annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done
for namespace in USD(kubectl get ns | tail -n +2 | awk '{print USD1}'); do kubectl label namespace USDnamespace namespace.metadata.stackrox.io/id-; kubectl label namespace USDnamespace namespace.metadata.stackrox.io/name-; kubectl annotate namespace USDnamespace modified-by.stackrox.io/namespace-label-patcher-; done