Skip to content

Commit 688008c

Browse files
kcarmichael08kcarmichael08
committed
Add info about configuring scanner v4
1 parent 8a601ba commit 688008c

13 files changed

+319
-6
lines changed

‎installing/installing_ocp/install-central-ocp.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ You can install {product-title-short} on your cluster without any customizations
5959

6060
include::modules/adding-helm-repository.adoc[leveloffset=+3]
6161
include::modules/acs-quick-install-using-helm.adoc[leveloffset=+3]
62+
include::modules/automatically-generated-ca.adoc[leveloffset=+3]
6263

6364
[id="install-using-helm-customizations-ocp"]
6465
=== Install Central using Helm charts with customizations

‎modules/automatically-generated-ca.adoc

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_ocp/install-central-ocp.adoc
4+
// * installing/installing_other/install-central-other.adoc
5+
:_mod-docs-content-type: CONCEPT
6+
[id="automatically-generated-ca_{context}"]
7+
= Retrieving the automatically generated certificate authority
8+
9+
When installing {product-title-short}, a certificate authority (CA) is automatically generated and stored in a Kubernetes secret on the cluster. If you later change your installation by using Helm, you might need to supply this CA. For example, enabling Scanner V4 requires that you provide this CA.
10+
11+
The automatically generated CA is stored in a secret that is usually named similar to `stackrox-generated-_suffix_`, where _suffix_ is a randomly generated string.
12+
13+
To retrieve the CA and export it to a `generated-values.yaml` file when needed for the `helm upgrade` command, for example, run the following command:
14+
15+
[source,terminal]
16+
----
17+
$ kubectl -n <namespace> get secret stackrox-generated-<suffix> \
18+
-o go-template='{{ index .data "generated-values.yaml" }}' | \
19+
base64 --decode >generated-values.yaml
20+
----
21+
22+
[IMPORTANT]
23+
====
24+
This file might contain sensitive data, so store it in a safe place.
25+
====
26+
27+
If you are using the `helm upgrade` command after changing a configuration, you might need to supply this CA. For example, to update your system and enable Scanner V4, you run the following command:
28+
29+
[source,terminal]
30+
----
31+
$ helm upgrade -n stackrox stackrox-central-services rhacs/central-services --reuse-values \
32+
-f <path_to_generated-values.yaml> \
33+
--set scannerV4.disable=false
34+
----

‎modules/central-configuration-options-operator.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ Ensure that this value does not exceed the maximum number of connections support
141141
|===
142142

143143
[id="scanner-settings_{context}"]
144-
== StackRox Scanner settings
144+
== StackRox Scanner settings for the Operator
145145

146146
[cols="1,3"]
147147
|===
@@ -198,7 +198,7 @@ Ensure that this value does not exceed the maximum number of connections support
198198
|===
199199

200200
[id="scannerv4-settings_{context}"]
201-
== Scanner V4 settings
201+
== Scanner V4 settings for the Operator
202202

203203
[cols="1,3"]
204204
|===

‎modules/enabling-scanner-v4-after-helm-installation-central.adoc

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-after-helm-installation-central_{context}"]
6+
= Enabling RHACS Scanner V4 for Central after Helm installation
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default, but you can enable Scanner V4 after installation.
10+
11+
.Procedure
12+
13+
. On the cluster where Central is installed, run the following command, using the instructions in "Changing configuration options after deploying the central-services Helm chart" if you need more information:
14+
+
15+
[source,terminal]
16+
----
17+
$ helm upgrade -n stackrox \
18+
stackrox-central-services rhacs/central-services \
19+
--reuse-values \
20+
-f <path_to_values_public.yaml> \
21+
-f <path_to_generated-values.yaml> \// <1>
22+
--set scannerV4.disable=false
23+
----
24+
<1> When updating the system and installing a new component, you must provide the internal CA. See "Retrieving the automatically generated certificate authority".
25+

‎modules/enabling-scanner-v4-after-helm-installation-secured-cluster.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-after-helm-installation-secured-cluster_{context}"]
6+
= Enabling RHACS Scanner V4 on the secured cluster after Helm installation
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default, but you can enable Scanner V4 after installation.
10+
11+
.Prerequisites
12+
13+
* You set up Central and the secured cluster by using an init bundle or CRS so that they can communicate with each other.
14+
15+
.Procedure
16+
17+
. On the secured cluster, run the following command, using the instructions in "Configuring the secured-cluster-services Helm chart with customizations" if you need more information:
18+
+
19+
[source,terminal]
20+
----
21+
$ helm upgrade -n stackrox \
22+
stackrox-central-services rhacs/secured-cluster-services \
23+
--reuse-values \
24+
-f <path_to_values_public.yaml> \
25+
-f <path_to_generated-values.yaml> \// <1>
26+
--set scannerV4.disable=false
27+
----
28+
<1> When updating the system and installing a new component, you must provide the internal CA. See "Retrieving the automatically generated certificate authority".

‎modules/enabling-scanner-v4-after-operator-installation-central.adoc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-after-operator-installation-central_{context}"]
6+
= Enabling RHACS Scanner V4 for Central after Operator installation
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default. If you did not enable it during installation, you can enable it after installation.
10+
11+
.Procedure
12+
13+
. In the cluster where Central is installed, in the console, click *Operators* -> *Installed Operators* and select the {product-title-short} Operator.
14+
. Click *Central* in the menu bar.
15+
. Click the name of the cluster where Central was installed. The default value is *stackrox-central-services*.
16+
. Click the *YAML* tab.
17+
. Edit the YAML file as shown in the following example:
18+
+
19+
[source,yaml]
20+
----
21+
scannerV4:
22+
scannerComponent: Enabled
23+
----

‎modules/enabling-scanner-v4-after-operator-installation-secured-cluster.adoc

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-after-operator-installation-secured-cluster_{context}"]
6+
= Enabling RHACS Scanner V4 on the secured cluster after Operator installation
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default. If you did not enable it during installation, you can enable it after installation.
10+
11+
.Prerequisite
12+
13+
* You set up Central and the secured cluster by using an init bundle or CRS so that they can communicate with each other.
14+
15+
.Procedure
16+
17+
. In the secured cluster, click *Operators* -> *Installed Operators* and select the {product-title-short} Operator.
18+
. Click *Secured Cluster* in the menu bar.
19+
. Click the default cluster name, *stackrox-secured-cluster-services*, or the name that you entered during installation.
20+
. Click the *YAML* tab.
21+
. Edit the YAML file as shown in the following example:
22+
+
23+
[source,yaml]
24+
----
25+
scannerV4:
26+
scannerComponent: AutoSense
27+
----

‎modules/enabling-scanner-v4-helm-central.adoc

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-helm-central_{context}"]
6+
= Enabling RHACS Scanner V4 for Central when installing with Helm
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default, but you can enable it during installation. Use this procedure to understand the steps you must follow when enabling Scanner V4. However, you might need to refer to the detailed installation documentation in "Additional resources", depending on the configuration of your other components.
10+
11+
.Procedure
12+
13+
. On the cluster where Central is installed, run the following command, using the instructions in "Install Central using Helm charts with customizations" if you need more information:
14+
+
15+
[source,terminal]
16+
----
17+
$ helm install -n stackrox --create-namespace \
18+
stackrox-central-services rhacs/central-services \
19+
--set scannerV4.disable=false \
20+
-f <path_to_values_public.yaml> -f <path_to_values_private.yaml>
21+
----
22+
+
23+
.Example output
24+
[source,terminal]
25+
----
26+
Central Services Configuration Summary:
27+
28+
Stackrox Version: 4.7.1
29+
Kubernetes Version: v1.31.6
30+
Kubernetes Namespace: stackrox
31+
Helm Release Name: stackrox-central-services
32+
OpenShift Cluster: 4
33+
Scanner V4: enabled
34+
Scanner V4 DB Volume: PVC (scanner-v4-db)
35+
----
36+
+
37+
. Configure your init bundle or cluster registration secret (CRS) so that Central and the secured cluster can communicate. For more information, see "Generating and applying an init bundle or cluster registration secret for RHACS on Red Hat OpenShift" or "Generating and applying an init bundle or cluster registration secret for RHACS on other platforms".

‎modules/enabling-scanner-v4-helm-secured-cluster.adoc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-helm-secured-cluster_{context}"]
6+
= Enabling RHACS Scanner V4 on the secured cluster when installing with Helm
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default, but you can enable it during installation. Use this procedure to understand the steps you must follow when enabling Scanner V4. However, you might need to refer to the detailed installation documentation in "Additional resources", depending on the configuration of your other components.
10+
11+
.Prerequisite
12+
13+
* You set up Central and the secured cluster by using an init bundle or CRS so that they can communicate with each other.
14+
15+
.Procedure
16+
17+
. On the secured cluster, run the following command, using the instructions in "Configuring the secured-cluster-services Helm chart with customizations" if you need more information:
18+
+
19+
[source,terminal]
20+
----
21+
$ helm install -n stackrox --create-namespace \
22+
stackrox-secured-cluster-services rhacs/secured-cluster-services \
23+
--set-file crs.file=<crs_file_name.yaml> \
24+
-f <path_to_pull_secret.yaml> \
25+
-f <path_to_values_public.yaml> -f <path_to_values_private.yaml> \
26+
--set clusterName=<name_of_the_secured_cluster> \
27+
--set centralEndpoint=<endpoint_of_central_service> \
28+
--set scanner.disable=false \
29+
--set scannerV4.disable=false
30+
----

‎modules/enabling-scanner-v4-operator-central.adoc

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * operating/examine-images-for-vulnerabilities.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="enabling-scanner-v4-operator-central_{context}"]
6+
= Enabling RHACS Scanner V4 for Central when installing with the Operator
7+
8+
[role="_abstract"]
9+
Scanner V4 is not enabled by default, but you can enable it during installation. Use this procedure to understand the steps you must follow when enabling Scanner V4. However, you might need to refer to the detailed installation documentation in "Additional resources", depending on the configuration of your other components.
10+
11+
.Procedure
12+
13+
. On the cluster where Central is installed, follow the installation procedures as described in "Installing Central using the Operator method". Choose one of these methods to enable Scanner V4:
14+
* As described in that procedure, when configuring the available options for Central, go to the *Scanner V4 Component Settings* section and in the *Scanner V4 Component* menu, select *Enabled*.
15+
* In the Central custom resource (CR) YAML, configure the following parameter:
16+
+
17+
[source,yaml]
18+
----
19+
scannerV4:
20+
scannerComponent: Enabled
21+
----
22+
. Configure your init bundle or cluster registration secret (CRS) to allow communication between Central and the secured cluster. For more information, see "Generating and applying an init bundle or cluster registration secret for RHACS on Red Hat OpenShift".

0 commit comments

Comments
 (0)