Skip to content

Commit 03ceca9

Browse files
MakdaamMakdaam
committed
instructions on how to deploy aqua security and twistlock/prisma cloud
1 parent 4ee9ff8 commit 03ceca9

File tree

2 files changed

+191
-33
lines changed

2 files changed

+191
-33
lines changed

‎articles/openshift/howto-run-privileged-containers.md

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
title: Run privileged containers in an Azure Red Hat OpenShift cluster | Microsoft Docs
3+
description: Run privileged containers to monitor security and compliance.
4+
author: makdaam
5+
ms.author: b-lejaku
6+
ms.service: container-service
7+
ms.topic: conceptual
8+
ms.date: 12/05/2019
9+
keywords: aro, openshift, aquasec, twistlock, red hat
10+
#Customer intent: As a customer, I want to monitor security compliance of my ARO clusters.
11+
---
12+
13+
# Run privileged containers in an Azure Red Hat OpenShift cluster
14+
15+
You can't run arbitrary privileged containers on Azure Red Hat OpenShift clusters.
16+
Two security monitoring and compliance solutions are whitelisted to run on ARO clusters.
17+
This document describes the differences from the generic OpenShift deployment documentation of the security product vendors.
18+
19+
20+
Read through these instructions before following the vendor's instructions.
21+
Section titles in product-specific steps below refer directly to section titles in the vendors' documentation.
22+
23+
## Before you begin
24+
25+
The documentation of most security products assumes you have cluster-admin privileges.
26+
Customer admins don't have all privileges in Azure Red Hat OpenShift. Permissions to modify cluster-wide resources are limited.
27+
28+
Make sure you're logged in to the cluster as a customer admin, by running
29+
`oc get scc`. All users in the customer admin group have permissions to view the SCCs on the cluster.
30+
31+
## Product-specific steps for Aqua security
32+
The base instructions we're going to modify can be found at (https://docs.aquasec.com/docs/deploy-openshift).
33+
34+
The first step is to annotate the SCCs you're editing. These annotations will prevent the Sync Pod from reverting your changes.
35+
36+
```
37+
oc annotate scc hostaccess openshift.io/reconcile-protect=true
38+
oc annotate scc privileged openshift.io/reconcile-protect=true
39+
```
40+
41+
### Step 1: Prepare prerequisites
42+
Remember to log in to the cluster as a user with ARO Customer Admin privileges instead of cluster-admin.
43+
44+
Create the project and the service account.
45+
```
46+
oc new-project aqua-security
47+
oc create serviceaccount aqua-account -n aqua-security
48+
```
49+
50+
Instead of assigning the cluster-reader role, assign the customer-admin-cluster role to the aqua-account.
51+
```
52+
oc adm policy add-cluster-role-to-user customer-admin-cluster system:serviceaccount:aqua-security:aqua-account
53+
```
54+
55+
Follow the remaining instructions in Step 1.
56+
57+
### Step 2: Deploy the Aqua Server, Database, and Gateway
58+
The only modification here is to replace the Route definition when editing the Aqua Console YAML file with the definition below
59+
```
60+
apiVersion: route.openshift.io/v1
61+
kind: Route
62+
metadata:
63+
labels:
64+
app: aqua-web
65+
name: aqua-web
66+
namespace: aqua-security
67+
spec:
68+
port:
69+
targetPort: aqua-web
70+
tls:
71+
insecureEdgeTerminationPolicy: Redirect
72+
termination: edge
73+
to:
74+
kind: Service
75+
name: aqua-web
76+
weight: 100
77+
wildcardPolicy: None
78+
```
79+
80+
Follow the remaining instructions.
81+
82+
### Step 3: Login to the Aqua Server
83+
This section isn't modified in any way.
84+
85+
You can use this command to get the Aqua Console address.
86+
```
87+
oc get route aqua-web -n aqua-security
88+
```
89+
90+
### Step 4: Deploy Aqua Enforcers
91+
Set the following fields when deploying enforcers:
92+
93+
| Field | Value |
94+
| -------------- | ------------- |
95+
| Orchestrator | OpenShift |
96+
| ServiceAccount | aqua-account |
97+
| Project | aqua-security |
98+
99+
## Product-specific steps for Prisma Cloud / Twistlock
100+
101+
The base instructions we're going to modify can be found at fhttps://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_openshift.html
102+
103+
Start by creating a new OpenShift project
104+
```
105+
oc new-project twistlock
106+
```
107+
108+
You can follow the documentation until the "Install Console" section, use the Prisma Cloud container registry instead of creating an internal one.
109+
110+
### Install Console
111+
112+
During `oc create -f twistlock_console.yaml` in Step 2, you'll get an Error when creating the namespace.
113+
You can safely ignore it, the namespace has been created with the `oc new-project` command.
114+
115+
### Create an external route to Console
116+
117+
You can either follow the documentation, or if you prefer to use the oc command
118+
copy the following Route definition to a file called twistlock_route.yaml
119+
```
120+
apiVersion: route.openshift.io/v1
121+
kind: Route
122+
metadata:
123+
labels:
124+
name: console
125+
name: twistlock-console
126+
namespace: twistlock
127+
spec:
128+
port:
129+
targetPort: mgmt-http
130+
tls:
131+
insecureEdgeTerminationPolicy: Redirect
132+
termination: edge
133+
to:
134+
kind: Service
135+
name: twistlock-console
136+
weight: 100
137+
wildcardPolicy: None
138+
```
139+
then run:
140+
```
141+
oc create -f twistlock_route.yaml
142+
```
143+
144+
You can get the URL assigned to Twistlock console with this command:
145+
`oc get route twistlock-console -n twistlock`
146+
147+
### Configure console
148+
149+
Follow the Twistlock documentation.
150+
151+
### Install Defender
152+
153+
During `oc create -f defender.yaml` in Step 2, you'll get Errors when creating the Cluster Role and Cluster Role Binding.
154+
You can ignore them.
155+
156+
Defenders will be deployed only on compute nodes. You don't have to limit them with a node selector.

‎articles/openshift/toc.yml

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,27 @@
22
href: index.yml
33
- name: Overview
44
items:
5-
- name: About Azure Red Hat OpenShift
6-
href: intro-openshift.md
5+
- name: About Azure Red Hat OpenShift
6+
href: intro-openshift.md
77
- name: Tutorials
88
items:
9-
- name: Create and manage an Azure Red Hat OpenShift cluster
10-
items:
11-
- name: 1 - Create an Azure Red Hat OpenShift cluster
12-
href: tutorial-create-cluster.md
13-
- name: 2 - Scale an Azure Red Hat OpenShift cluster
14-
href: tutorial-scale-cluster.md
15-
- name: 3 - Delete an Azure Red Hat OpenShift cluster
16-
href: tutorial-delete-cluster.md
9+
- name: Create and manage an Azure Red Hat OpenShift cluster
10+
items:
11+
- name: 1 - Create an Azure Red Hat OpenShift cluster
12+
href: tutorial-create-cluster.md
13+
- name: 2 - Scale an Azure Red Hat OpenShift cluster
14+
href: tutorial-scale-cluster.md
15+
- name: 3 - Delete an Azure Red Hat OpenShift cluster
16+
href: tutorial-delete-cluster.md
1717

1818
- name: Cluster administration
1919
items:
20-
- name: Azure Red Hat OpenShift cluster administration
21-
items:
22-
- name: 1 - Azure Red Hat OpenShift cluster administrator role
23-
href: cluster-administration-cluster-admin-role.md
24-
- name: 2 - Managing security context constraints
25-
href: cluster-administration-security-context-constraints.md
20+
- name: Azure Red Hat OpenShift cluster administration
21+
items:
22+
- name: 1 - Azure Red Hat OpenShift cluster administrator role
23+
href: cluster-administration-cluster-admin-role.md
24+
- name: 2 - Managing security context constraints
25+
href: cluster-administration-security-context-constraints.md
2626

2727
- name: How-to guides
2828
expanded: true
@@ -40,7 +40,7 @@
4040
- name: Manage projects in an Azure Red Hat OpenShift cluster
4141
href: howto-manage-projects.md
4242
- name: Monitoring and logging
43-
items:
43+
items:
4444
- name: Azure Monitor for containers (preview)
4545
items:
4646
- name: Configure Azure Monitor for containers
@@ -49,24 +49,26 @@
4949
- name: Disable Azure Monitor for containers
5050
href: ../azure-monitor/insights/container-insights-optout-openshift.md
5151
maintainContext: true
52+
- name: Run privileged containers in an Azure Red Hat OpenShift cluster
53+
href: howto-run-privileged-containers.md
5254
- name: Reference
5355
items:
54-
- name: Azure Red Hat OpenShift CLI
55-
href: /cli/azure/openshift
56-
- name: Azure Red Hat OpenShift REST APIs
57-
href: /rest/api/openshift
56+
- name: Azure Red Hat OpenShift CLI
57+
href: /cli/azure/openshift
58+
- name: Azure Red Hat OpenShift REST APIs
59+
href: /rest/api/openshift
5860

5961
- name: Resources
6062
items:
61-
- name: Common questions
62-
href: openshift-faq.md
63-
- name: Troubleshooting
64-
href: troubleshoot.md
65-
- name: Supported resources
66-
href: supported-resources.md
67-
- name: Regional availability
68-
href: https://azure.microsoft.com/regions/services/
69-
- name: Red Hat OpenShift documentation
70-
href: https://docs.openshift.com/aro/welcome/index.html
71-
- name: Azure Roadmap
72-
href: https://azure.microsoft.com/roadmap/
63+
- name: Common questions
64+
href: openshift-faq.md
65+
- name: Troubleshooting
66+
href: troubleshoot.md
67+
- name: Supported resources
68+
href: supported-resources.md
69+
- name: Regional availability
70+
href: https://azure.microsoft.com/regions/services/
71+
- name: Red Hat OpenShift documentation
72+
href: https://docs.openshift.com/aro/welcome/index.html
73+
- name: Azure Roadmap
74+
href: https://azure.microsoft.com/roadmap/

0 commit comments

Comments
 (0)