This is a cache of https://docs.openshift.com/acs/3.66/configuration/enable-offline-mode.html. It is a snapshot of the page at 2024-11-25T17:19:25.091+0000.
Enabling offline mode | Configuring | Red Hat Advanced Cluster Security for Kubernetes 3.66
    OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Enabling offline mode

You can use Red Hat Advanced Cluster Security for Kubernetes for clusters that are not connected to the internet by enabling the offline mode. In offline mode, Red Hat Advanced Cluster Security for Kubernetes components do not connect to addresses or hosts on the internet.

Red Hat Advanced Cluster Security for Kubernetes does not determine if the user-supplied hostnames, IP addresses, or other resources are on the internet. For example, if you try to integrate with a Docker registry hosted on the internet, Red Hat Advanced Cluster Security for Kubernetes will not block this request.

To deploy and operate Red Hat Advanced Cluster Security for Kubernetes in offline mode:

  1. Download Red Hat Advanced Cluster Security for Kubernetes images in a tarball (.tgz) format. These files are easy to transfer across network air gaps or other boundaries.

  2. Enable offline mode during installation.

  3. (Optional) Routinely update Scanner’s vulnerability list by uploading a new definitions file.

  4. (Optional) When required, add support for runtime collection on more kernel versions by uploading new kernel support packages.

You can only enable offline mode during the installation, and not during an upgrade.

Downloading images for offline use

You can download Red Hat Advanced Cluster Security for Kubernetes images by using an offline bundle, or you can download the images directly.

Downloading images using an offline bundle

You can download Red Hat Advanced Cluster Security for Kubernetes images by using an offline bundle.

Procedure

  1. Download the following image bundles:

  2. Copy the image bundles to the network where you want to deploy Red Hat Advanced Cluster Security for Kubernetes.

  3. Extract the images and upload them to your registry.

    1. Decompress the archives:

      $ tar xzvf image-bundle.tgz
      $ tar xzvf image-bundle-collector.tgz

    2. Read the README.txt files:

      $ cat image-bundle/README.txt
      $ cat image-collector-bundle/README.txt

    3. Run the import.sh script for each bundle.

      $ ./image-bundle/import.sh
      $ ./image-collector-bundle/import.sh

      • If you want to push the image to a registry, provide the registry prefix when answering the prompts.

      • If you do not provide a registry prefix, the images are only uploaded to the local Docker host. You must then manually run the docker tag and docker push commands to push the images to your registry.

Downloading images directly

If you do not want to use an image bundle, you can manually pull, retag, and push Red Hat Advanced Cluster Security for Kubernetes images to your registry. The images included in the current version of the image bundles are:

  • registry.redhat.io/rh-acs/main:3.66.1

  • registry.redhat.io/rh-acs/scanner:2.20.0

  • registry.redhat.io/rh-acs/scanner-db:2.20.0

  • registry.redhat.io/rh-acs/collector:3.4.1-latest

Retagging images

You can download and retag images using the Docker command-line interface.

When you retag an image, you must maintain the name of the image and the tag. For example, use:

$ docker tag registry.redhat.io/rh-acs/main:3.66.1 <your_registry>/main:3.66.1

and do not retag like the following example:

$ docker tag registry.redhat.io/rh-acs/main:3.66.1 <your_registry>/other-name:latest
Procedure

  1. Log in to the registry:

    $ docker login stackrox.io (1)
    1 The Collector image is distributed from a separate registry. To retag the Collector image, use the collector.stackrox.io registry instead of stackrox.io.

  2. Pull the image:

    $ docker pull <image>

  3. Retag the image:

    $ docker tag <image> <new_image>

  4. Push the updated image to your registry:

    $ docker push <new_image>

Enabling offline mode during installation

You can enable offline mode during the installation of Red Hat Advanced Cluster Security for Kubernetes.

Enabling offline mode by using Helm configuration

You can enable offline mode during the installation when you are installing Red Hat Advanced Cluster Security for Kubernetes by using a Helm chart.

Procedure

  1. When installing the central-services Helm chart, set the value of the env.offlineMode environmental variable to true in the values-public.yaml configuration file.

  2. When installing the secured-cluster-services Helm chart, set the value of the config.offlineMode parameter to true in the values-public.yaml configuration file.

Additional resources

Enabling offline mode by using the roxctl cli

You can enable offline mode when you are installing Red Hat Advanced Cluster Security for Kubernetes by using the roxctl cli.

Procedure

  1. If you are using a registry other than the default internet-connected registry (stackrox.io), provide the locations where you have pushed the Red Hat Advanced Cluster Security for Kubernetes images when answering the image to use prompts:

    Enter main image to use (default: "registry.redhat.io/rh-acs/main:3.66.1"): <your_registry>/stackrox/main:3.66.1
    Enter Scanner DB image to use (default: "registry.redhat.io/rh-acs/scanner-db:2.20.0"): <your_registry>/stackrox/scanner-db:2.20.0
    Enter Scanner image to use (default: "registry.redhat.io/rh-acs/scanner:2.20.0"): <your_registry>/stackrox/scanner:2.20.0

  2. To enable the offline mode, enter true when answering the Enter whether to run StackRox in offline mode prompt:

    Enter whether to run StackRox in offline mode, which avoids reaching out to the internet (default: "false"): true

  3. Later, when you add Sensor to a remote cluster in the Platform Configuration → Clusters view in the RHACS portal, you must specify your the Collector image name in the Collector Image Repository field.

Updating Scanner definitions in offline mode

Scanner contains a local vulnerability definitions database. When Red Hat Advanced Cluster Security for Kubernetes runs in normal mode (connected to the internet), Scanner fetches new vulnerability definitions from the internet and updates its database.

However, when you are using Red Hat Advanced Cluster Security for Kubernetes in offline mode, you must manually update Scanner definitions by uploading them to Central.

When Red Hat Advanced Cluster Security for Kubernetes runs in offline mode, Scanner checks for new definitions from Central. If new definitions are available, Scanner downloads the new definitions from Central, marks them as default, and then uses the updated definitions for scanning images.

To update the definitions in offline mode:

  1. Download the definitions.

  2. Upload the definitions to Central.

  3. Restart Scanner.

Downloading Scanner definitions

If you are running Red Hat Advanced Cluster Security for Kubernetes in offline mode, you can download the vulnerability definitions database that Scanner uses and then upload it to Central.

Prerequisites

  • To download Scanner definitions, you need a system with internet access.

Procedure

Uploading definitions to Central

To upload Scanner definitions to Central, you can either use an API token or your administrator password. Red Hat recommends using an authentication token in a production environment because each token is assigned specific access control permissions.

Uploading definitions to Central by using an API token

You can upload the vulnerability definitions database that Scanner uses to Central by using an API token.

Prerequisites

  • You must have an API token with the administrator role.

  • You must have installed the roxctl command-line interface (cli).

Procedure

  1. Set the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables:

    $ export ROX_API_TOKEN=<api_token>
    $ export ROX_CENTRAL_ADDRESS=<address>:<port_number>

  2. Run the following command to upload the definitions file:

    $ roxctl scanner upload-db \
  -e "$ROX_CENTRAL_ADDRESS" \
  --scanner-db-file=<compressed_scanner_definitions.zip>
Additional resources

Uploading definitions to Central by using the administrator password

You can upload the vulnerability definitions database that Scanner uses to Central by using your Red Hat Advanced Cluster Security for Kubernetes administrator password.

Prerequisites

  • You must have the administrator password.

  • You must have installed the roxctl command-line interface (cli).

Procedure

  1. Set the ROX_CENTRAL_ADDRESS environment variable:

    $ export ROX_CENTRAL_ADDRESS=<address>:<port_number>

  2. Run the following command to upload the definitions file:

    $ roxctl scanner upload-db \
  -p <your_administrator_password> \
  -e "$ROX_CENTRAL_ADDRESS" \
  --scanner-db-file=<compressed_scanner_definitions.zip>

Restarting the Scanner container

You can restart the Scanner container by deleting the pod.

Procedure

  • Run the following command to delete the Scanner pod:

    • On OpenShift Container Platform:

      $ oc delete pod -n stackrox -l app=scanner

    • On Kubernetes:

      $ kubectl delete pod -n stackrox -l app=scanner

Updating kernel support packages in offline mode

Collector monitors the runtime activity for each node in your secured clusters. To monitor the activities, Collector requires probes. These probes are kernel modules or eBPF programs specific to the Linux kernel version installed on the host. The Collector image contains a set of built-in probes.

When Red Hat Advanced Cluster Security for Kubernetes runs in normal mode (connected to the internet), Collector automatically downloads a new probe if the required probe is not built in.

In offline mode, you can manually download packages containing probes for all recent and supported Linux kernel versions and upload them to Central. Collectors then download these probes from Central.

Collector checks for the new probes in the following order. It checks:

  1. The existing Collector image.

  2. The kernel support package (if you have uploaded one to Central).

  3. A Red Hat-operated server available on the internet. Collector uses Central’s network connection to check and download the probes.

If Collector does not get new probes after checking, it reports a CrashLoopBackoff event.

If your network configuration restricts outbound traffic, you can manually download packages containing probes for all recent and supported Linux kernel versions and upload them to Central. Collectors then download these probes from Central, thus avoiding any outbound internet access.

Downloading kernel support packages

If you are running Red Hat Advanced Cluster Security for Kubernetes in offline mode, you can download packages containing probes for all recent and supported Linux kernel versions and then upload them to Central.

Procedure

Uploading kernel support packages to Central

You can upload the kernel support packages containing probes for all recent and supported Linux kernel versions to Central.

Prerequisites

  • You must have an API token with the administrator role.

  • You must have installed the roxctl command-line interface (cli).

Procedure

  1. Set the ROX_API_TOKEN and the ROX_CENTRAL_ADDRESS environment variables:

    $ export ROX_API_TOKEN=<api_token>
    $ export ROX_CENTRAL_ADDRESS=<address>:<port_number>

  2. Run the following command to upload the kernel support packages:

    $ roxctl collector support-packages upload <package_file> \
  -e "$ROX_CENTRAL_ADDRESS"

  • When you upload a new support package that includes content uploaded to Central previously, only new files are uploaded.

  • When you upload a new support package that includes files with the same name but different contents than those present on the Central, roxctl shows a warning message and does not overwrite files.

    • You can use the --overwrite option with the upload command to overwrite the files.

  • When you upload a support package that contains a required probe, Central does not make any outbound requests (to the internet) for downloading this probe. Central uses the probe from the support package.