...
spec:
central:
declarativeConfiguration:
configMaps:
- name: "<declarative-configs>" (1)
secrets:
- name: "<sensitive-declarative-configs>" (2)
...
Central is the resource that contains the RHACS application management interface and services. It handles data persistence, API interactions, and RHACS portal access. You can use the same Central instance to secure multiple OpenShift Container Platform or Kubernetes clusters.
You can install Central on your OpenShift Container Platform or Kubernetes cluster by using one of the following methods:
Install using the Operator
Install using Helm charts
Install using the roxctl
CLI (do not use this method unless you have a specific installation need that requires using it)
Using the OperatorHub provided with OpenShift Container Platform is the easiest way to install Red Hat Advanced Cluster Security for Kubernetes.
You have access to an OpenShift Container Platform cluster using an account with Operator installation permissions.
You must be using OpenShift Container Platform 4.11 or later. For information about supported platforms and architecture, see the Red Hat Advanced Cluster Security for Kubernetes Support Matrix. For life cycle support information for RHACS, see the Red Hat Advanced Cluster Security for Kubernetes Support Policy.
In the web console, go to the Operators → OperatorHub page.
If Red Hat Advanced Cluster Security for Kubernetes is not displayed, enter Advanced Cluster Security into the Filter by keyword box to find the Red Hat Advanced Cluster Security for Kubernetes Operator.
Select the Red Hat Advanced Cluster Security for Kubernetes Operator to view the details page.
Read the information about the Operator, and then click Install.
On the Install Operator page:
Keep the default value for Installation mode as All namespaces on the cluster.
Choose a specific namespace in which to install the Operator for the Installed namespace field. Install the Red Hat Advanced Cluster Security for Kubernetes Operator in the rhacs-operator namespace.
Select automatic or manual updates for Update approval.
If you choose automatic updates, when a new version of the Operator is available, Operator Lifecycle Manager (OLM) automatically upgrades the running instance of your Operator.
If you choose manual updates, when a newer version of the Operator is available, OLM creates an update request. As a cluster administrator, you must manually approve the update request to update the Operator to the latest version.
If you choose manual updates, you must update the RHACS Operator in all secured clusters when you update the RHACS Operator in the cluster where Central is installed. The secured clusters and the cluster where Central is installed must have the same version to ensure optimal functionality. |
Click Install.
After the installation completes, go to Operators → Installed Operators to verify that the Red Hat Advanced Cluster Security for Kubernetes Operator is listed with the status of Succeeded.
You installed the Operator into the rhacs-operator project. Using that Operator, install, configure, and deploy the Central
custom resource into the stackrox
project.
The main component of Red Hat Advanced Cluster Security for Kubernetes is called Central. You can install Central on OpenShift Container Platform by using the Central
custom resource. You deploy Central only once, and you can monitor multiple separate clusters by using the same Central installation.
|
You must be using OpenShift Container Platform 4.11 or later. For information about supported platforms and architecture, see the Red Hat Advanced Cluster Security for Kubernetes Support Matrix. For life cycle support information for RHACS, see the Red Hat Advanced Cluster Security for Kubernetes Support Policy.
On the OpenShift Container Platform web console, go to the Operators → Installed Operators page.
Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
If you have installed the Operator in the recommended namespace, OpenShift Container Platform lists the project as rhacs-operator
. Select Project: rhacs-operator → Create project.
|
Enter the new project name (for example, stackrox
), and click Create. Red Hat recommends that you use stackrox
as the project name.
Under the Provided APIs section, select Central. Click Create Central.
Optional: If you are using declarative configuration, next to Configure via:, click YAML view and add the information for the declarative configuration, such as shown in the following example:
...
spec:
central:
declarativeConfiguration:
configMaps:
- name: "<declarative-configs>" (1)
secrets:
- name: "<sensitive-declarative-configs>" (2)
...
1 | Replace <declarative-configs> with the name of the config maps that you are using. |
2 | Replace <sensitive-declarative-configs> with the name of the secrets that you are using. |
Enter a name for your Central
custom resource and add any labels you want to apply. Otherwise, accept the default values for the available options.
You can configure available options for Central:
Central component settings:
Setting | Description |
---|---|
Administrator password |
Secret that contains the administrator password. Use this field if you do not want RHACS to generate a password for you. |
Exposure |
Settings for exposing Central by using a route, load balancer, or node port. See the |
User-facing TLS certificate secret |
Use this field if you want to terminate TLS in Central and serve a custom server certificate. |
Monitoring |
Configures the monitoring endpoint for Central. See the |
Persistence |
These fields configure how Central should store its persistent data. Use a persistent volume claim (PVC) for best results, especially if you are using Scanner V4. See the |
Central DB Settings |
Settings for Central DB, including data persistence. See the |
Resources |
Use these fields after consulting the documentation if you need to override the default settings for memory and CPU resources. For more information, see the "Default resource requirements for RHACS" and "Recommended resource requirements for RHACS" sections in the "Installation" chapter. |
Tolerations |
Use this parameter to configure Central to run only on specific nodes. See the |
Scanner Component Settings: Settings for the default scanner, also called the StackRox Scanner. See the "Scanner" table in the "Public configuration file" section in "Installing Central services for RHACS on Red Hat OpenShift".
Scanner V4 Component Settings: Settings for the optional Scanner V4 scanner, available in version 4.4 and later. It is not currently enabled by default. You can enable both the StackRox Scanner and Scanner V4 for concurrent use. See the "Scanner V4" table in the "Public configuration file" section in "Installing Central services for RHACS on Red Hat OpenShift".
Scanner V4 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope. |
When Scanner V4 is enabled, you can configure the following options:
Setting | Description |
---|---|
Indexer |
The process that indexes images and creates a report of findings. You can configure replicas and autoscaling, resources, and tolerations. Before changing the default resource values, see the "Scanner V4" sections in the "Default resource requirements for RHACS" and "Recommended resource requirements for RHACS" sections in the "Installation" chapter. |
Matcher |
The process that performs vulnerability matching of the report from the indexer against vulnerability data stored in Scanner V4 DB. You can configure replicas and autoscaling, resources, and tolerations. Before changing the default resource values, see the "Scanner V4" sections in the "Default resource requirements for RHACS" and "Recommended resource requirements for RHACS" sections in the "Installation" chapter. |
DB |
The database that stores information for Scanner V4, including vulnerability data and index reports. You can configure persistence, resources, and tolerations. If you are using Scanner V4, a persistent volume claim (PVC) is required on Central clusters. A PVC is strongly recommended on secured clusters for best results. Before changing the default resource values, see the "Scanner V4" sections in the "Default resource requirements for RHACS" and "Recommended resource requirements for RHACS" sections in the "Installation" chapter. |
Egress: Settings for outgoing network traffic, including whether RHACS should run in online (connected) or offline (disconnected) mode.
TLS: Use this field to add additional trusted root certificate authorities (CAs).
Advanced configuration: You can use these fields to perform the following actions:
Specify additional image pull secrets
Add custom environment variables to set for managed pods' containers
Enable Red Hat OpenShift monitoring
Click Create.
If you are using the cluster-wide proxy, Red Hat Advanced Cluster Security for Kubernetes uses that proxy configuration to connect to the external services. |
Verify Central installation.
Optional: Configure Central options.
Generate an init bundle containing the cluster secrets that allows communication between the Central
and SecuredCluster
resources. You need to download this bundle, use it to generate resources on the clusters you want to secure, and securely store it.
Install secured cluster services on each cluster you want to monitor.
This step is optional. You can use your existing PostgreSQL infrastructure to provision a database for RHACS. Use the instructions in this section for configuring a PostgreSQL database environment, creating a user, database, schema, role, and granting required permissions.
Create a new user:
CREATE USER stackrox WITH PASSWORD <password>;
Create a database:
CREATE DATABASE stackrox;
Connect to the database:
\connect stackrox
Create user schema:
CREATE SCHEMA stackrox;
(Optional) Revoke rights on public:
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE USAGE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON DATABASE stackrox FROM PUBLIC;
Create a role:
CREATE ROLE readwrite;
Grant connection permission to the role:
GRANT CONNECT ON DATABASE stackrox TO readwrite;
Add required permissions to the readwrite
role:
GRANT USAGE ON SCHEMA stackrox TO readwrite;
GRANT USAGE, CREATE ON SCHEMA stackrox TO readwrite;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA stackrox TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO readwrite;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA stackrox TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA stackrox GRANT USAGE ON SEQUENCES TO readwrite;
Assign the readwrite
role to the stackrox
user:
GRANT readwrite TO stackrox;
The main component of Red Hat Advanced Cluster Security for Kubernetes is called Central. You can install Central on OpenShift Container Platform by using the Central
custom resource. You deploy Central only once, and you can monitor multiple separate clusters by using the same Central installation.
When you install Red Hat Advanced Cluster Security for Kubernetes for the first time, you must first install the |
For more information about RHACS databases, see the Database Scope of Coverage.
You must be using OpenShift Container Platform 4.11 or later. For more information about supported OpenShift Container Platform versions, see the Red Hat Advanced Cluster Security for Kubernetes Support Matrix.
You must have a database in your database instance that supports PostgreSQL 13 and a user with the following permissions:
Connection rights to the database.
Usage
and Create
on the schema.
Select
, Insert
, Update
, and Delete
on all tables in the schema.
Usage
on all sequences in the schema.
On the OpenShift Container Platform web console, go to the Operators → Installed Operators page.
Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
If you have installed the Operator in the recommended namespace, OpenShift Container Platform lists the project as rhacs-operator
. Select Project: rhacs-operator → Create project.
|
Enter the new project name (for example, stackrox
), and click Create. Red Hat recommends that you use stackrox
as the project name.
Create a password secret in the deployed namespace by using the OpenShift Container Platform web console or the terminal.
On the OpenShift Container Platform web console, go to the Workloads → Secrets page. Create a Key/Value secret with the key password
and the value as the path of a plain text file containing the password for the superuser of the provisioned database.
Or, run the following command in your terminal:
$ oc create secret generic external-db-password \(1)
--from-file=password=<password.txt> (2)
1 | If you use Kubernetes, enter kubectl instead of oc . |
2 | Replace password.txt with the path of the file which has the plain text password. |
Return to the Red Hat Advanced Cluster Security for Kubernetes operator page in the OpenShift Container Platform web console. Under the Provided APIs section, select Central. Click Create Central.
Optional: If you are using declarative configuration, next to Configure via:, click YAML view.
Add the information for the declarative configuration, such as shown in the following example:
...
spec:
central:
declarativeConfiguration:
configMaps:
- name: <declarative-configs> (1)
secrets:
- name: <sensitive-declarative-configs> (2)
...
1 | Replace <declarative-configs> with the name of the config maps that you are using. |
2 | Replace <sensitive-declarative-configs> with the name of the secrets that you are using. |
Enter a name for your Central
custom resource and add any labels you want to apply.
Go to Central Component Settings → Central DB Settings.
For Administrator Password specify the referenced secret as external-db-password
(or the secret name of the password created previously).
For Connection String specify the connection string in keyword=value
format, for example, host=<host> port=5432 database=stackrox user=stackrox sslmode=verify-ca
For Persistence → PersistentVolumeClaim → Claim Name, remove central-db
.
If necessary, you can specify a Certificate Authority so that there is trust between the database certificate and Central. To add this, go to the YAML view and add a TLS block under the top-level spec, as shown in the following example:
spec:
tls:
additionalCAs:
- name: db-ca
content: |
<certificate>
Click Create.
If you are using the cluster-wide proxy, Red Hat Advanced Cluster Security for Kubernetes uses that proxy configuration to connect to the external services. |
Verify Central installation.
Optional: Configure Central options.
Generate an init bundle containing the cluster secrets that allows communication between the Central
and SecuredCluster
resources. You need to download this bundle, use it to generate resources on the clusters you want to secure, and securely store it.
Install secured cluster services on each cluster you want to monitor.
After Central finishes installing, log in to the RHACS portal to verify the successful installation of Central.
On the OpenShift Container Platform web console, go to the Operators → Installed Operators page.
Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
Select the Central tab.
From the Centrals list, select stackrox-central-services
to view its details.
To get the password for the admin
user, you can either:
Click the link under Admin Password Secret Reference.
Use the Red Hat OpenShift CLI to enter the command listed under Admin Credentials Info:
$ oc -n stackrox get secret central-htpasswd -o go-template='{{index .data "password" | base64decode}}'
Find the link to the RHACS portal by using the Red Hat OpenShift CLI command:
$ oc -n stackrox get route central -o jsonpath="{.status.ingress[0].host}"
Alternatively, you can use the Red Hat Advanced Cluster Security for Kubernetes web console to find the link to the RHACS portal by performing the following commands:
Go to Networking → Routes.
Find the central Route and click on the RHACS portal link under the Location column.
Log in to the RHACS portal using the username admin and the password that you retrieved in a previous step. Until RHACS is completely configured (for example, you have the Central
resource and at least one SecuredCluster
resource installed and configured), no data is available in the dashboard. The SecuredCluster
resource can be installed and configured on the same cluster as the Central
resource. Clusters with the SecuredCluster
resource are similar to managed clusters in Red Hat Advanced Cluster Management (RHACM).
Optional: Configure central settings.
Generate an init bundle containing the cluster secrets that allows communication between the Central
and SecuredCluster
resources. You need to download this bundle, use it to generate resources on the clusters you want to secure, and securely store it.
Install secured cluster services on each cluster you want to monitor.
You can install Central using Helm charts without any customization, using the default values, or by using Helm charts with additional customizations of configuration parameters.
You can install RHACS on your cluster without any customizations. You must add the Helm chart repository and install the central-services
Helm chart to install the centralized components of Central and Scanner.
Add the RHACS charts repository.
$ helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
The Helm repository for Red Hat Advanced Cluster Security for Kubernetes includes Helm charts for installing different components, including:
Central services Helm chart (central-services
) for installing the centralized components (Central and Scanner).
You deploy centralized components only once and you can monitor multiple separate clusters by using the same installation. |
Secured Cluster Services Helm chart (secured-cluster-services
) for installing the per-cluster and per-node components (Sensor, Admission Controller, Collector, and Scanner-slim).
Deploy the per-cluster components into each cluster that you want to monitor and deploy the per-node components in all nodes that you want to monitor. |
Run the following command to verify the added chart repository:
$ helm search repo -l rhacs/
Use the following instructions to install the central-services
Helm chart to deploy the centralized components (Central and Scanner).
You must have access to the Red Hat Container Registry. For information about downloading images from registry.redhat.io
, see Red Hat Container Registry Authentication.
Run the following command to install Central services and expose Central using a route:
$ helm install -n stackrox \
--create-namespace stackrox-central-services rhacs/central-services \
--set imagePullSecrets.username=<username> \(1)
--set imagePullSecrets.password=<password> \(2)
--set central.exposure.route.enabled=true
1 | Include the user name for your pull secret for Red Hat Container Registry authentication. |
2 | Include the password for your pull secret for Red Hat Container Registry authentication. |
Or, run the following command to install Central services and expose Central using a load balancer:
$ helm install -n stackrox \
--create-namespace stackrox-central-services rhacs/central-services \
--set imagePullSecrets.username=<username> \(1)
--set imagePullSecrets.password=<password> \(2)
--set central.exposure.loadBalancer.enabled=true
1 | Include the user name for your pull secret for Red Hat Container Registry authentication. |
2 | Include the password for your pull secret for Red Hat Container Registry authentication. |
Or, run the following command to install Central services and expose Central using port forward:
$ helm install -n stackrox \
--create-namespace stackrox-central-services rhacs/central-services \
--set imagePullSecrets.username=<username> \(1)
--set imagePullSecrets.password=<password> (2)
1 | Include the user name for your pull secret for Red Hat Container Registry authentication. |
2 | Include the password for your pull secret for Red Hat Container Registry authentication. |
|
The output of the installation command includes:
An automatically generated administrator password.
Instructions on storing all the configuration values.
Any warnings that Helm generates.
You can install RHACS on your Red Hat OpenShift cluster with customizations by using Helm chart configuration parameters with the helm install
and helm upgrade
commands. You can specify these parameters by using the --set
option or by creating YAML configuration files.
Create the following files for configuring the Helm chart for installing Red Hat Advanced Cluster Security for Kubernetes:
Public configuration file values-public.yaml
: Use this file to save all non-sensitive configuration options.
Private configuration file values-private.yaml
: Use this file to save all sensitive configuration options. Ensure that you store this file securely.
Configuration file declarative-config-values.yaml
: Create this file if you are using declarative configuration to add the declarative configuration mounts to Central.
This section lists the configurable parameters of the values-private.yaml
file.
There are no default values for these parameters.
The credentials that are required for pulling images from the registry depend on the following factors:
If you are using a custom registry, you must specify these parameters:
imagePullSecrets.username
imagePullSecrets.password
image.registry
If you do not use a username and password to log in to the custom registry, you must specify one of the following parameters:
imagePullSecrets.allowNone
imagePullSecrets.useExisting
imagePullSecrets.useFromDefaultServiceAccount
Parameter | Description |
---|---|
|
The username of the account that is used to log in to the registry. |
|
The password of the account that is used to log in to the registry. |
|
Use |
|
A comma-separated list of secrets as values.
For example, |
|
Use |
If you are installing Red Hat Advanced Cluster Security for Kubernetes in a cluster that requires a proxy to connect to external services, you must specify your proxy configuration by using the proxyConfig
parameter.
For example:
env:
proxyConfig: |
url: http://proxy.name:port
username: username
password: password
excludes:
- some.domain
Parameter | Description |
---|---|
|
Your proxy configuration. |
Configurable parameters for Central.
For a new installation, you can skip the following parameters:
central.jwtSigner.key
central.serviceTLS.cert
central.serviceTLS.key
central.adminPassword.value
central.adminPassword.htpasswd
central.db.serviceTLS.cert
central.db.serviceTLS.key
central.db.password.value
When you do not specify values for these parameters the Helm chart autogenerates values for them.
If you want to modify these values you can use the helm upgrade
command and specify the values using the --set
option.
For setting the administrator password, you can only use either |
Parameter | Description |
---|---|
|
A private key which RHACS should use for signing JSON web tokens (JWTs) for authentication. |
|
An internal certificate that the Central service should use for deploying Central. |
|
The private key of the internal certificate that the Central service should use. |
|
The user-facing certificate that Central should use. RHACS uses this certificate for RHACS portal.
|
|
The private key of the user-facing certificate that Central should use.
|
|
Connection password for Central database. |
|
Administrator password for logging into RHACS. |
|
Administrator password for logging into RHACS. This password is stored in hashed format using bcrypt. |
|
An internal certificate that the Central DB service should use for deploying Central DB. |
|
The private key of the internal certificate that the Central DB service should use. |
|
The password used to connect to the Central DB. |
If you are using
|
Configurable parameters for the StackRox Scanner and Scanner V4 (Technology Preview).
Scanner V4 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope. |
For a new installation, you can skip the following parameters and the Helm chart autogenerates values for them. Otherwise, if you are upgrading to a new version, specify the values for the following parameters:
scanner.dbPassword.value
scanner.serviceTLS.cert
scanner.serviceTLS.key
scanner.dbServiceTLS.cert
scanner.dbServiceTLS.key
scannerV4.db.password.value
scannerV4.indexer.serviceTLS.cert
scannerV4.indexer.serviceTLS.key
scannerV4.matcher.serviceTLS.cert
scannerV4.matcher.serviceTLS.key
scannerV4.db.serviceTLS.cert
scannerV4.db.serviceTLS.key
Parameter | Description |
---|---|
|
The password to use for authentication with Scanner database. Do not modify this parameter because RHACS automatically creates and uses its value internally. |
|
An internal certificate that the StackRox Scanner service should use for deploying the StackRox Scanner. |
|
The private key of the internal certificate that the Scanner service should use. |
|
An internal certificate that the Scanner-db service should use for deploying Scanner database. |
|
The private key of the internal certificate that the Scanner-db service should use. |
|
The password to use for authentication with the Scanner V4 database. Do not modify this parameter because RHACS automatically creates and uses its value internally. |
|
An internal certificate that the Scanner V4 DB service should use for deploying the Scanner V4 database. |
|
The private key of the internal certificate that the Scanner V4 DB service should use. |
|
An internal certificate that the Scanner V4 service should use for deploying the Scanner V4 Indexer. |
|
The private key of the internal certificate that the Scanner V4 Indexer should use. |
|
An internal certificate that the Scanner V4 service should use for deploying the the Scanner V4 Matcher. |
|
The private key of the internal certificate that the Scanner V4 Matcher should use. |
This section lists the configurable parameters of the values-public.yaml
file.
Image pull secrets are the credentials required for pulling images from your registry.
Parameter | Description |
---|---|
|
Use |
|
A comma-separated list of secrets as values.
For example, |
|
Use |
Image declares the configuration to set up the main registry, which the Helm chart uses to resolve images for the central.image
, scanner.image
, scanner.dbImage
, scannerV4.image
, and scannerV4.db.image
parameters.
Parameter | Description |
---|---|
|
Address of your image registry.
Either use a hostname, such as |
Red Hat Advanced Cluster Security for Kubernetes automatically detects your cluster environment and sets values for env.openshift
, env.istio
, and env.platform
.
Only set these values to override the automatic cluster environment detection.
Parameter | Description |
---|---|
|
Use |
|
Use |
|
The platform on which you are installing RHACS.
Set its value to |
|
Use |
The RHACS automatically references the system root certificates to trust. When Central, the StackRox Scanner, or Scanner V4 must reach out to services that use certificates issued by an authority in your organization or a globally trusted partner organization, you can add trust for these services by specifying the root certificate authority to trust by using the following parameter:
Parameter | Description |
---|---|
|
Specify the PEM encoded certificate of the root certificate authority to trust. |
Configurable parameters for Central.
You must specify a persistent storage option as either hostPath
or persistentVolumeClaim
.
For exposing Central deployment for external access.
You must specify one parameter, either central.exposure.loadBalancer
, central.exposure.nodePort
, or central.exposure.route
.
When you do not specify any value for these parameters, you must manually expose Central or access it by using port-forwarding.
The following table includes settings for an external PostgreSQL database.
Parameter | Description |
---|---|
|
Mounts config maps used for declarative configurations. |
|
Mounts secrets used for declarative configurations. |
|
The endpoint configuration options for Central. |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Central. This parameter is mainly used for infrastructure nodes. |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Central. This parameter is mainly used for infrastructure nodes. |
|
Specify |
|
A custom registry that overrides the global |
|
The custom image name that overrides the default Central image name ( |
|
The custom image tag that overrides the default tag for Central image.
If you specify your own image tag during a new installation, you must manually increment this tag when you to upgrade to a new version by running the |
|
Full reference including registry address, image name, and image tag for the Central image.
Setting a value for this parameter overrides the |
|
The memory request for Central. |
|
The CPU request for Central. |
|
The memory limit for Central. |
|
The CPU limit for Central. |
|
The path on the node where RHACS should create a database volume. Red Hat does not recommend using this option. |
|
The name of the persistent volume claim (PVC) you are using. |
|
Use |
|
The size (in GiB) of the persistent volume managed by the specified claim. |
|
Use |
|
The port number on which to expose Central. The default port number is 443. |
|
Use |
|
The port number on which to expose Central. When you skip this parameter, OpenShift Container Platform automatically assigns a port number. Red Hat recommends that you do not specify a port number if you are exposing RHACS by using a node port. |
|
Use |
|
Use |
|
The connection string for Central to use to connect to the database. This is only used when
|
|
The minimum number of connections to the database to be established. |
|
The maximum number of connections to the database to be established. |
|
The number of milliseconds a single query or transaction can be active against the database. |
|
The postgresql.conf to be used for Central DB as described in the PostgreSQL documentation in "Additional resources". |
|
The pg_hba.conf to be used for Central DB as described in the PostgreSQL documentation in "Additional resources". |
|
Specify a node selector label as |
|
A custom registry that overrides the global |
|
The custom image name that overrides the default Central DB image name ( |
|
The custom image tag that overrides the default tag for Central DB image.
If you specify your own image tag during a new installation, you must manually increment this tag when you to upgrade to a new version by running the |
|
Full reference including registry address, image name, and image tag for the Central DB image.
Setting a value for this parameter overrides the |
|
The memory request for Central DB. |
|
The CPU request for Central DB. |
|
The memory limit for Central DB. |
|
The CPU limit for Central DB. |
|
The path on the node where RHACS should create a database volume. Red Hat does not recommend using this option. |
|
The name of the persistent volume claim (PVC) you are using. |
|
Use |
|
The size (in GiB) of the persistent volume managed by the specified claim. |
The following table lists the configurable parameters for the StackRox Scanner. This is the scanner used for node and platform scanning. If Scanner V4 is not enabled, the StackRox scanner also performs image scanning. Beginning with version 4.4, Scanner V4 can be enabled to provide image scanning. See the next table for Scanner V4 parameters.
Parameter | Description |
---|---|
|
Use |
|
Specify |
|
The number of replicas to create for the StackRox Scanner deployment.
When you use it with the |
|
Configure the log level for the StackRox Scanner.
Red Hat recommends that you not change the default log level value ( |
|
Specify a node selector label as |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the StackRox Scanner. This parameter is mainly used for infrastructure nodes. |
|
Use |
|
The minimum number of replicas for autoscaling. |
|
The maximum number of replicas for autoscaling. |
|
The memory request for the StackRox Scanner. |
|
The CPU request for the StackRox Scanner. |
|
The memory limit for the StackRox Scanner. |
|
The CPU limit for the StackRox Scanner. |
|
The memory request for the StackRox Scanner database deployment. |
|
The CPU request for the StackRox Scanner database deployment. |
|
The memory limit for the StackRox Scanner database deployment. |
|
The CPU limit for the StackRox Scanner database deployment. |
|
A custom registry for the StackRox Scanner image. |
|
The custom image name that overrides the default StackRox Scanner image name ( |
|
A custom registry for the StackRox Scanner DB image. |
|
The custom image name that overrides the default StackRox Scanner DB image name ( |
|
Specify a node selector label as |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the StackRox Scanner DB. This parameter is mainly used for infrastructure nodes. |
The following table lists the configurable parameters for Scanner V4.
Scanner V4 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope. |
Parameter | Description |
---|---|
|
The name of the PVC to manage persistent data for Scanner V4.
If no PVC with the given name exists, it is created. The default value is |
|
Use |
|
Specify |
|
The number of replicas to create for the Scanner V4 Indexer deployment.
When you use it with the |
|
Configure the log level for the Scanner V4 Indexer.
Red Hat recommends that you not change the default log level value ( |
|
Specify a node selector label as |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the Scanner V4 Indexer. This parameter is mainly used for infrastructure nodes. |
|
Use |
|
The minimum number of replicas for autoscaling. |
|
The maximum number of replicas for autoscaling. |
|
The memory request for the Scanner V4 Indexer. |
|
The CPU request for the Scanner V4 Indexer. |
|
The memory limit for the Scanner V4 Indexer. |
|
The CPU limit for the Scanner V4 Indexer. |
|
The number of replicas to create for the Scanner V4 Matcher deployment.
When you use it with the |
|
Red Hat recommends that you not change the default log level value ( |
|
Specify a node selector label as |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the Scanner V4 Matcher. This parameter is mainly used for infrastructure nodes. |
|
Use |
|
The minimum number of replicas for autoscaling. |
|
The maximum number of replicas for autoscaling. |
|
The memory request for the Scanner V4 Matcher. |
|
The CPU request for the Scanner V4 Matcher. |
|
The memory request for the Scanner V4 database deployment. |
|
The CPU request for the Scanner V4 database deployment. |
|
The memory limit for the Scanner V4 database deployment. |
|
The CPU limit for the Scanner V4 database deployment. |
|
Specify a node selector label as |
|
If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the Scanner V4 DB. This parameter is mainly used for infrastructure nodes. |
|
A custom registry for the Scanner V4 DB image. |
|
The custom image name that overrides the default Scanner V4 DB image name ( |
|
A custom registry for the Scanner V4 image. |
|
The custom image name that overrides the default Scanner V4 image name ( |
Use these parameters to specify additional attributes for all objects that RHACS creates.
Parameter | Description |
---|---|
|
A custom label to attach to all objects. |
|
A custom annotation to attach to all objects. |
|
A custom label to attach to all deployments. |
|
A custom annotation to attach to all deployments. |
|
A custom environment variable for all containers in all objects. |
|
A custom label to attach to all objects that Central creates. |
|
A custom annotation to attach to all objects that Central creates. |
|
A custom label to attach to all Central deployments. |
|
A custom annotation to attach to all Central deployments. |
|
A custom environment variable for all Central containers. |
|
A custom label to attach to all objects that Scanner creates. |
|
A custom annotation to attach to all objects that Scanner creates. |
|
A custom label to attach to all Scanner deployments. |
|
A custom annotation to attach to all Scanner deployments. |
|
A custom environment variable for all Scanner containers. |
|
A custom label to attach to all objects that Scanner DB creates. |
|
A custom annotation to attach to all objects that Scanner DB creates. |
|
A custom label to attach to all Scanner DB deployments. |
|
A custom annotation to attach to all Scanner DB deployments. |
|
A custom environment variable for all Scanner DB containers. |
|
A custom label to attach to all objects that Scanner V4 Indexer creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 Indexer creates and into the pods belonging to them. |
|
A custom label to attach to all objects that Scanner V4 Indexer creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 Indexer creates and into the pods belonging to them. |
|
A custom environment variable for all Scanner V4 Indexer containers and the pods belonging to them. |
|
A custom label to attach to all objects that Scanner V4 Matcher creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 Matcher creates and into the pods belonging to them. |
|
A custom label to attach to all objects that Scanner V4 Matcher creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 Matcher creates and into the pods belonging to them. |
|
A custom environment variable for all Scanner V4 Matcher containers and the pods belonging to them. |
|
A custom label to attach to all objects that Scanner V4 DB creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 DB creates and into the pods belonging to them. |
|
A custom label to attach to all objects that Scanner V4 DB creates and into the pods belonging to them. |
|
A custom annotation to attach to all objects that Scanner V4 DB creates and into the pods belonging to them. |
|
A custom environment variable for all Scanner V4 DB containers and the pods belonging to them. |
You can also use:
the customize.other.service/*.labels
and the customize.other.service/*.annotations
parameters, to specify labels and annotations for all objects.
or, provide a specific service name, for example, customize.other.service/central-loadbalancer.labels
and customize.other.service/central-loadbalancer.annotations
as parameters and set their value.
The parameters specified in this section are for information only. Red Hat does not support RHACS instances with modified namespace and release names. |
Parameter | Description |
---|---|
|
Use |
|
Use |
To use declarative configuration, you must create a YAML file (in this example, named "declarative-config-values.yaml") that adds the declarative configuration mounts to Central. This file is used in a Helm installation.
Create the YAML file (in this example, named declarative-config-values.yaml
) using the following example as a guideline:
central:
declarativeConfiguration:
mounts:
configMaps:
- declarative-configs
secrets:
- sensitive-declarative-configs
Install the Central services Helm chart as documented in the "Installing the central-services Helm chart", referencing the declarative-config-values.yaml
file.
After you configure the values-public.yaml
and values-private.yaml
files, install the central-services
Helm chart to deploy the centralized components (Central and Scanner).
Run the following command:
$ helm install -n stackrox --create-namespace \
stackrox-central-services rhacs/central-services \
-f <path_to_values_public.yaml> -f <path_to_values_private.yaml> (1)
1 | Use the -f option to specify the paths for your YAML configuration files. |
Optional: If using declarative configuration, add |
You can make changes to any configuration options after you have deployed the central-services
Helm chart.
When using the helm upgrade
command to make changes, the following guidelines and requirements apply:
You can also specify configuration values using the --set
or --set-file
parameters.
However, these options are not saved, and you must manually specify all the options again whenever you make changes.
Some changes, such as enabling a new component like Scanner V4, require new certificates to be issued for the component. Therefore, you must provide a CA when making these changes.
Scanner V4 is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope. |
If the CA was generated by the Helm chart during the initial installation, you must retrieve these automatically generated values from the cluster and provide them to the helm upgrade
command. The post-installation notes of the central-services
Helm chart include a command for retrieving the automatically generated values.
If the CA was generated outside of the Helm chart and provided during the installation of the central-services
chart, then you must perform that action again when using the helm upgrade
command, for example, by using the --reuse-values
flag with the helm upgrade
command.
Update the values-public.yaml
and values-private.yaml
configuration files with new values.
Run the helm upgrade
command and specify the configuration files using the -f
option:
$ helm upgrade -n stackrox \
stackrox-central-services rhacs/central-services \
--reuse-values \(1)
-f <path_to_init_bundle_file \
-f <path_to_values_public.yaml> \
-f <path_to_values_private.yaml>
1 | If you have modified values that are not included in the values_public.yaml and values_private.yaml files, include the --reuse-values parameter. |
For production environments, Red Hat recommends using the Operator or Helm charts to install RHACS. Do not use the |
To install Red Hat Advanced Cluster Security for Kubernetes you must install the roxctl
CLI by downloading the binary.
You can install roxctl
on Linux, Windows, or macOS.
You can install the roxctl
CLI binary on Linux by using the following procedure.
|
Determine the roxctl
architecture for the target operating system:
$ arch="$(uname -m | sed "s/x86_64//")"; arch="${arch:+-$arch}"
Download the roxctl
CLI:
$ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.4.7/bin/Linux/roxctl${arch}"
Make the roxctl
binary executable:
$ chmod +x roxctl
Place the roxctl
binary in a directory that is on your PATH
:
To check your PATH
, execute the following command:
$ echo $PATH
Verify the roxctl
version you have installed:
$ roxctl version
You can install the roxctl
CLI binary on macOS by using the following procedure.
|
Download the roxctl
CLI:
$ curl -L -f -o roxctl "https://mirror.openshift.com/pub/rhacs/assets/4.4.7/bin/Darwin/roxctl${arch}"
Remove all extended attributes from the binary:
$ xattr -c roxctl
Make the roxctl
binary executable:
$ chmod +x roxctl
Place the roxctl
binary in a directory that is on your PATH
:
To check your PATH
, execute the following command:
$ echo $PATH
Verify the roxctl
version you have installed:
$ roxctl version
You can install the roxctl
CLI binary on Windows by using the following procedure.
|
Download the roxctl
CLI:
$ curl -f -O https://mirror.openshift.com/pub/rhacs/assets/4.4.7/bin/Windows/roxctl.exe
Verify the roxctl
version you have installed:
$ roxctl version
Use the interactive installer to generate the required secrets, deployment configurations, and deployment scripts for your environment.
Run the interactive install command:
$ roxctl central generate interactive
Installing RHACS using the |
Press Enter to accept the default value for a prompt or enter custom values as required. The following example shows the interactive installer prompts:
Enter path to the backup bundle from which to restore keys and certificates (optional):
Enter read templates from local filesystem (default: "false"):
Enter path to helm templates on your local filesystem (default: "/path"):
Enter PEM cert bundle file (optional): (1)
Enter Create PodSecurityPolicy resources (for pre-v1.25 Kubernetes) (default: "true"): (2)
Enter administrator password (default: autogenerated):
Enter orchestrator (k8s, openshift):
Enter default container images settings (development_build, stackrox.io, rhacs, opensource); it controls repositories from where to download the images, image names and tags format (default: "development_build"):
Enter the directory to output the deployment bundle to (default: "central-bundle"):
Enter the OpenShift major version (3 or 4) to deploy on (default: "0"):
Enter whether to enable telemetry (default: "false"):
Enter central-db image to use (if unset, a default will be used according to --image-defaults):
Enter Istio version when deploying into an Istio-enabled cluster (leave empty when not running Istio) (optional):
Enter the method of exposing Central (route, lb, np, none) (default: "none"): (3)
Enter main image to use (if unset, a default will be used according to --image-defaults):
Enter whether to run StackRox in offline mode, which avoids reaching out to the Internet (default: "false"):
Enter list of secrets to add as declarative configuration mounts in central (default: "[]"): (4)
Enter list of config maps to add as declarative configuration mounts in central (default: "[]"): (5)
Enter the deployment tool to use (kubectl, helm, helm-values) (default: "kubectl"):
Enter scanner-db image to use (if unset, a default will be used according to --image-defaults):
Enter scanner image to use (if unset, a default will be used according to --image-defaults):
Enter Central volume type (hostpath, pvc): (6)
Enter external volume name for Central (default: "stackrox-db"):
Enter external volume size in Gi for Central (default: "100"):
Enter storage class name for Central (optional if you have a default StorageClass configured):
Enter external volume name for Central DB (default: "central-db"):
Enter external volume size in Gi for Central DB (default: "100"):
Enter storage class name for Central DB (optional if you have a default StorageClass configured):
1 | If you want to add a custom TLS certificate, provide the file path for the PEM-encoded certificate. When you specify a custom certificate the interactive installer also prompts you to provide a PEM private key for the custom certificate you are using. |
2 | If you are running Kubernetes version 1.25 or later, set this value to false . |
3 | To use the RHACS portal, you must expose Central by using a route, a load balancer or a node port. |
4 | For more information on using declarative configurations for authentication and authorization, see "Declarative configuration for authentication and authorization resources" in "Managing RBAC in Red Hat Advanced Cluster Security for Kubernetes". |
5 | For more information on using declarative configurations for authentication and authorization, see "Declarative configuration for authentication and authorization resources" in "Managing RBAC in Red Hat Advanced Cluster Security for Kubernetes". |
6 | If you plan to install Red Hat Advanced Cluster Security for Kubernetes on OpenShift Container Platform with a hostPath volume, you must modify the SELinux policy. |
On OpenShift Container Platform, for using a hostPath volume, you must modify the SELinux policy to allow access to the directory, which the host and the container share. It is because SELinux blocks directory sharing by default. To modify the SELinux policy, run the following command:
However, Red Hat does not recommend modifying the SELinux policy, instead use PVC when installing on OpenShift Container Platform. |
On completion, the installer creates a folder named central-bundle, which contains the necessary YAML manifests and scripts to deploy Central. In addition, it shows on-screen instructions for the scripts you need to run to deploy additional trusted certificate authorities, Central and Scanner, and the authentication instructions for logging into the RHACS portal along with the autogenerated password if you did not provide one when answering the prompts.
After you run the interactive installer, you can run the setup.sh
script to install Central.
Run the setup.sh
script to configure image registry access:
$ ./central-bundle/central/scripts/setup.sh
Create the necessary resources:
$ oc create -R -f central-bundle/central
Check the deployment progress:
$ oc get pod -n stackrox -w
After Central is running, find the RHACS portal IP address and open it in your browser. Depending on the exposure method you selected when answering the prompts, use one of the following methods to get the IP address.
Exposure method | Command | Address | Example |
---|---|---|---|
Route |
|
The address under the |
|
Node Port |
|
IP or hostname of any node, on the port shown for the service |
|
Load Balancer |
|
EXTERNAL-IP or hostname shown for the service, on port 443 |
|
None |
|
|
|
If you have selected autogenerated password during the interactive install, you can run the following command to see it for logging into Central:
|