Chapter 1. Adding custom certificates

• You must already have PEM-encoded private key and certificate files.

• The certificate file should begin and end with human-readable blocks. For example:

  -----BEGIN CERTIFICATE-----
  MIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G
  ...
  l4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo=
  -----END CERTIFICATE-----

• The certificate file can contain either a single (leaf) certificate, or a certificate chain.

  Warning
  • If the certificate is not directly signed by a trusted root, you must give the full certificate chain, including any intermediate certificates.
  • All certificates in the chain must be in order so that the leaf certificate is the first and the root certificate is the last in the chain.
• If you are using a custom certificate that is not globally trusted, you must also configure the Sensor to trust your custom certificate.

Procedure

• If you are installing Red Hat Advanced Cluster Security for Kubernetes using the Operator:

  1. Create a central-default-tls-cert secret that has the appropriate TLS certificates in the namespace where you install the Central service by entering the following command:

     $ oc -n <namespace> create secret tls central-default-tls-cert --cert <tls-cert.pem> --key <tls-key.pem>

• If you are installing Red Hat Advanced Cluster Security for Kubernetes using Helm:

  1. Add your custom certificate and its key in the values-private.yaml file:

     central:
       # Configure a default TLS certificate (public cert + private key) for central
       defaultTLS:
         cert: |
           -----BEGIN CERTIFICATE-----
           EXAMPLE!MIIMIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G
           ...
           -----END CERTIFICATE-----
         key: |
           -----BEGIN EC PRIVATE KEY-----
           EXAMPLE!MHcl4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo=
           ...
           -----END EC PRIVATE KEY-----

  2. Give the configuration file during the installation:

     $ helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services -f values-private.yaml

• If you are installing Red Hat Advanced Cluster Security for Kubernetes using the roxctl CLI, give the certificate and key files when you run the installation program:

  • For the noninteractive installation program, use the --default-tls-cert and --default-tls-key options:

    $ roxctl central generate --default-tls-cert "cert.pem" --default-tls-key "key.pem"

  • For the interactive installation program, give the certificate and key files when you enter answers for the prompts:

    ...
    Enter PEM cert bundle file (optional): <cert.pem>
    Enter PEM private key file (optional): <key.pem>
    Enter administrator password (default: autogenerated):
    Enter orchestrator (k8s, openshift): openshift
    ...

Procedure

• If you have installed Red Hat Advanced Cluster Security for Kubernetes using the Operator:

  1. Create a central-default-tls-cert secret that has the appropriate TLS certificates in the namespace where you installed the Central service by entering the following command:

     $ oc -n <namespace> create secret tls central-default-tls-cert --cert <tls-cert.pem> --key <tls-key.pem>

• If you have installed Red Hat Advanced Cluster Security for Kubernetes using Helm:

  1. Add your custom certificate and its key in the values-private.yaml file:

     central:
       # Configure a default TLS certificate (public cert + private key) for central
       defaultTLS:
         cert: |
           -----BEGIN CERTIFICATE-----
           EXAMPLE!MIIMIICLDCCAdKgAwIBAgIBADAKBggqhkjOPQQDAjB9MQswCQYDVQQGEwJCRTEPMA0G
           ...
           -----END CERTIFICATE-----
         key: |
           -----BEGIN EC PRIVATE KEY-----
           EXAMPLE!MHcl4wOuDwKQa+upc8GftXE2C//4mKANBC6It01gUaTIpo=
           ...
           -----END EC PRIVATE KEY-----

  2. Use the helm upgrade command and give the updated configuration file:

     $ helm upgrade -n stackrox --create-namespace stackrox-central-services \
      rhacs/central-services --reuse-values \
      -f values-private.yaml

     where:

     --reuse-values

     Specifies that the upgrade will reuse existing values. You must use this parameter because the values-private.yaml file does not contain all of the required configuration values.

• If you have installed Red Hat Advanced Cluster Security for Kubernetes using the roxctl CLI:

  • Create and apply a TLS secret from the PEM-encoded key and certificate files:

    $ oc -n stackrox create secret tls central-default-tls-cert \
      --cert <server_cert.pem> \
      --key <server_key.pem> \
      --dry-run -o yaml | oc apply -f -

    After you run this command, Central automatically applies the new key and certificate without restarting the pod. It might take up to a minute to propagate the changes.

Procedure

• To delete the Central pod, run the following command:

  $ oc -n stackrox delete pod -lapp=central

Prerequisites

• You have downloaded the Sensor bundle.

Procedure

• If you are using the sensor.sh script:

  1. Extract the Sensor bundle:

     $ unzip -d sensor sensor-<cluster_name>.zip

  2. Run the sensor.sh script:

     $ ./sensor/sensor.sh

     The certificates are automatically applied when you run the sensor (./sensor/sensor.sh) script. You can also place additional custom certificates in the sensor/additional-cas/ directory before you run the sensor.sh script.

• If you are not using the sensor.sh script:

  1. Extract the Sensor bundle:

     $ unzip -d sensor sensor-<cluster_name>.zip

  2. Run the following command to create the secret:

     $ ./sensor/ca-setup-sensor.sh -d sensor/additional-cas/

     where:

     -d

     Specifies a directory containing custom certificates.

     Important

     If you get the "secret already exists" error message, re-run the script with the -u option:

     $ ./sensor/ca-setup-sensor.sh -d sensor/additional-cas/ -u

  3. Continue Sensor deployment by using the YAML files.

Prerequisites

• You have downloaded the Sensor bundle.

Procedure

• Run the following command to stop the Sensor container:

  Note

  You must wait for at least 1 minute, until OpenShift Container Platform or Kubernetes propagates your changes and restarts the Sensor container.

  • On OpenShift Container Platform:

    $ oc -n stackrox deploy/sensor -c sensor -- kill 1

  • On Kubernetes:

    $ kubectl -n stackrox deploy/sensor -c sensor -- kill 1

• Or, run the following command to delete the Sensor pod:

  • On OpenShift Container Platform:

    $ oc -n stackrox delete pod -lapp=sensor

  • On Kubernetes:

    $ kubectl -n stackrox delete pod -lapp=sensor