SupportConsoleDevelopersStart a trialContact

Chapter 8. Add Red Hat Advanced Cluster Security for Kubernetes sources and credentials

To run a scan on a Red Hat Advanced Cluster Security for Kubernetes (RHACS) deployment, you must add a source that identifies the RHACS instance to scan. Then you must add a credential that contains the authentication data to access that instance.

Define Red Hat Advanced Cluster Security for Kubernetes sources to identify RHACS deployments for Discovery scanning.

Prerequisites

  • You have access to the Red Hat Advanced Cluster Security for Kubernetes (RHACS) portal to generate admin application programming interface (API) token values.
  • You have either access to the RHACS portal to find the RHACS Central endpoint or access to the RHACS Configuration Management Cloud Service instance details.

Procedure

  1. Click the option to add a new credential based on your location:

    • From the Credentials view, click Add Source.
    • From the Sources view, click Add.
  2. On the Type page, select RHACS as the source type and click Next.

  3. On the Credentials page, enter the following information:

    1. In the Name field, enter a descriptive name.

    2. In the IP Address or Hostname field, enter the Red Hat Advanced Cluster Security for Kubernetes Central address for this source.

      • You can find the address by viewing the network routes for the cluster if RHACS was deployed on OpenShift.
      • If RHACS was deployed on the cloud, you can find this information in the instance details.
    3. Optional: In the Proxy URL field enter the proxy server needed to reach the RHACS host. This value is passed directly to the HTTP client and must match the format expected by your proxy setup, for example, http://proxy.example.com:3128 or https://proxy.example.com:443.
    4. In the Credentials list, select the credential that is required to access the cluster for this source. If a required credential does not exist, click the Add a credential icon to open the Add Credential view.
    5. In the Connection list, select the SSL protocol to be used for a secure connection during a scan of this source. Select Disable SSL to disable secure communication during a scan of this source.
    6. If you need to upgrade the SSL validation for the cluster to check for a verified SSL certificate from a certificate authority, select the Verify SSL Certificate check box.
  4. Click Save to save the source and then click Close to close the Add Source view.

Verification

  1. In the Sources view, verify that the new source appears in the sources list with the correct name and type.

Create RHACS credentials to authenticate Discovery scans against Red Hat Advanced Cluster Security for Kubernetes instances by using an API token.

Prerequisites

  • You have access to the Red Hat Advanced Cluster Security for Kubernetes (RHACS) portal to generate admin API token values.
  • You have either access to the RHACS portal to find the RHACS Central endpoint or access to the RHACS Configuration Management Cloud Service instance details.

Procedure

  1. Click the option to add a new credential based on your location:

    • From the Credentials view, click Add RHACS.
    • From the Add Source wizard, click the Add a credential icon for the Credentials field.

    The Add Credential wizard opens.

  2. In the Credential Name field, enter a descriptive name.
  3. Enter the API token for RHACS from your RHACS portal. If you do not already have a token, you can generate a token on the RHACS Configuration Management Cloud Service portal.
  4. Click Save to save the credential and close the Add Credential wizard.

Verification

  1. In the Credentials view, verify that the new credential appears in the credentials list with the correct name and type.

8.3. Red Hat Discovery sources and credentials
Copy link

To run a scan, you must configure data for two basic structures: sources and credentials. The type of source that you are going to inspect during the scan determines the type of data that is required for both source and credential configuration.

A source contains a single asset or a set of multiple assets that are to be inspected during the scan. You can configure any of the following types of sources:

Network source
One or more physical machines, virtual machines, or containers. These assets can be expressed as hostnames, IP addresses, IP ranges, or subnets.
vCenter source
A vCenter Server systems management solution that is managing all or part of your IT infrastructure.
Satellite source
A Satellite systems management solution that is managing all or part of your IT infrastructure.
Red Hat OpenShift source
A Red Hat OpenShift Container Platform cluster that is managing all or part of your Red Hat OpenShift Container Platform nodes and workloads.
Ansible source
An Red Hat Ansible Automation Platform management solution that is managing your Red Hat Ansible Automation Platform nodes and workloads.
Red Hat Advanced Cluster Security for Kubernetes source
A RHACS security platform solution that secures your Kubernetes environments.

When you are working with network sources, you determine how many individual assets you should group within a single source. Currently, you can add multiple assets to a source only for network sources. The following list contains some of the other factors that you should consider when you are adding sources:

  • Whether assets are part of a development, testing, or production environment, and if demands on computing power and similar concerns are a consideration for those assets.
  • Whether you want to scan a particular entity or group of entities more often because of internal business practices such as frequent changes to the installed software.

A credential contains data such as the username and password or SSH key of a user with sufficient authority to run the scan on all or part of the assets in that source. As with sources, credentials are configured as the network, vCenter, satellite, OpenShift, Red Hat Ansible Automation Platform, or RHACS type. A network source might require multiple network credentials to access all assets in a broad IP range. Conversely, a vCenter or satellite source typically uses a single credential to access a particular system management solution server. An OpenShift, Red Hat Ansible Automation Platform, or RHACS source uses a single credential to access a single cluster.

You can add new sources from the Sources view and you can add new credentials from the Credentials view. You can also add new or select previously existing credentials during source creation. It is during source creation that you associate a credential directly with a source.

Because sources and credentials must have matching types, any credential that you add during source creation shares the same type as the source. If you want to use an existing credential during source creation, the list of available credentials contains only credentials of the same type. For example, during network source creation, only network credentials are available for selection.

RHACS scans authenticate to the application programming interface (API) by using a bearer token encrypted over TLS. By default, scans run with certificate validation and secure communication through TLS protocols, which you can configure during source creation.

You might need to adjust the level of certificate validation to connect to the RHACS portal during a scan. For example, your RHACS instance might use a verified TLS certificate from a certificate authority. During source creation, you can upgrade TLS certificate validation to check for that certificate during a scan of that source.

Conversely, your RHACS instance might use self-signed certificates. During source creation, you can leave the TLS validation at the default so that scan of that source does not check for a certificate. This choice, to leave the option at the default for a self-signed certificate, could possibly avoid scan errors.

You might also need to disable TLS as the method of secure communication during the scan if the RHACS instance is not configured to use TLS communication for web applications. For example, your RHACS instance might be configured to communicate with web applications by using HTTP with port 80. If so, then during source creation you can disable TLS communication for scans of that source.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top