【版权声明】
本文首发于Huiling’s blog,欢迎转载,转载须保留作者Huiling的署名和原文链接。如您有合作/授权的需要,请留言:362759348@qq.com
author: Huiling
转载请注明原文来源:https://blog.csdn.net/oasisss/article/details/116661124
Kubernetes安全解决方案–StackRox 安装篇
前提:
以下操作是在root用户下面完成的
安装的环境是openshift4.x
oc命令登陆Openshift
安装helm所需组件
$ mkdir ~/bin
$ wget https://mirror.openshift.com/pub/openshift-v4/clients/helm/latest/helm-linux-amd64 -O ~/bin/helm
$ chmod 0755 ~/bin/helm
用Helm安装stackrox Central
helm repo add rhacs https://mirror.openshift.com/pub/rhacs/charts/
helm search repo -l rhacs/
helm repo update
安装并暴露一个路由
helm install -n stackrox --create-namespace stackrox-central-services rhacs/central-services --set imagePullSecrets.allowNone=true --set central.exposure.route.enabled=true
oc get route central -n stackrox
登陆stackrox图形化界面(上面命令会输出用户名是Admin和密码)
在集成->StackRox API Token里面创建一个Token,给Token取一个名字,用户名选择为Admin,将Token复制下来,这一步很简单,不再截图。
建立环境变量
下面的TOKEN改成自己刚才创建的
[root@bastion ~]# export ROX_API_TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6Imp3dGswIiwidHlwIjoiSldUIn0.eyJhdWQiOlsiaHR0cHM6Ly9zdGFja3JveC5pby9qd3Qtc291cmNlcyNhcGktdG9rZW5zIl0sImV4cCI6MTY1MjI1MjQwMywiaWF0IjoxNjIwNzE2NDAzLCJpc3MiOiJodHRwczovL3N0YWNrcm94LmlvL2p3dCIsImp0aSI6IjNiMmM2YTFkLWQ5YTMtNGM5Mi1hZmQ3LTVmNDA3NjFlZjVjZCIsIm5hbWUiOiJvcGVuc2hpZnQgc2Vuc29yIiwicm9sZXMiOlsiQWRtaW4iXX0.SqioXJ0q9Yb7HTuJcQnKjfP1RTm7fiQVeQt9YFhE-qTivGHso_UDEvx6pzg553dG3x4IQhxXC8xZGY27gf5oo5nKBnKHa5EPakJ-LY-bW95Ddj17GxX9ZuV6Yipy___OVTp-BUeZb6QqNDIgnLx6teeLd9XvtZ8YFCGxXSpOc4-DthR7sqWt9doSfX-2UngmXKw0a48oT0uVaBxYbUZfj3muyldXWzR51dKuP6FzH9tMeNMvEWAT5gW9abjyjUKIoBM44C0G8X0MoI3mZ9ccW9goUnkJmd-YWU9fzexcSri0YxBzdeDQKjmG73J5fxkkyqDVNsekIHOKcjqR_yw9zZzM8_hqdB13H-ST0PKZcjiIb5hM6HKcXoSNCd-Hqn2VUpF7gZnJrHLYELW3a_23id9IvjCHA_eUMNRdYqVEUnHSq3Nu0kLKwkP-3i_MCLdVJy_jrZsWDI2hXrwt8Z6NzaHhVY3Gj4AaEN-_YQIMfoPSL5tIl8XIhyYFt2rL_HuQajs4h2nykG5k3jOYT6SW01m2yRknLgHNkUpz5V5wplcSIP2ZV9dnWogy1vimwkcuab9XIBXNqjw9WvnonFHVbhgtTkb0ENhcqbdqeA8DtMymLovpY9nqJZdDbk9UGzxdJAYLRlT4BWQl20wRDSDYd5aCZQ9BkBRgnvRd8tU9FRU
[root@bastion ~]# export ROX_CENTRAL_ADDRESS=central-stackrox.apps.cluster-skph5.skph5.example.opentlc.com:443
下载roxctl命令
curl -O https://mirror.openshift.com/pub/rhacs/assets/3.0.59.1/bin/Linux/roxctl
chmod 777 roxctl
生成bundle文件
./roxctl -e "$ROX_CENTRAL_ADDRESS" central init-bundles generate init-bundle --output cluster-init-bundle.yaml
在openshift集群里安装sensor,并且纳管到Stackrox central
helm install -n stackrox --create-namespace stackrox-secured-cluster-services rhacs/secured-cluster-services \
-f cluster-init-bundle.yaml \
--set centralEndpoint=central-stackrox.apps.cluster-skph5.skph5.example.opentlc.com:443 \
--set clusterName=ocp1 \
--set imagePullSecrets.allowNone=true
完成后,可以在控制台上看到纳管的集群:
【版权声明】
本文首发于Huiling’s blog,欢迎转载,转载须保留作者Huiling的署名和原文链接。如您有合作/授权的需要,请留言:362759348@qq.com
author: Huiling
转载请注明原文来源:https://blog.csdn.net/oasisss/article/details/116661124