diff --git a/installing/installing_ocp/install-central-config-options-ocp.adoc b/installing/installing_ocp/install-central-config-options-ocp.adoc index eff71f176f0..b3ed5b82a14 100644 --- a/installing/installing_ocp/install-central-config-options-ocp.adoc +++ b/installing/installing_ocp/install-central-config-options-ocp.adoc @@ -16,10 +16,35 @@ include::modules/central-configuration-options-operator.adoc[leveloffset=+1] * xref:../../operating/manage-vulnerabilities/vulnerability-reporting.adoc#configure-vulnerability-report-row-limit_vulnerability-reporting[Configuring the vulnerability report row limit] +//Customizing the installation using the Operator with overlays include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1] +//Overlays +include::modules/overlays-overview.adoc[leveloffset=+2] + +//Adding an overlay +include::modules/adding-an-overlay.adoc[leveloffset=+3] + +//Overlay examples +include::modules/overlay-examples-overview.adoc[leveloffset=+2] + +//Specifying an EKS pod role ARN for the Central ServiceAccount +include::modules/adding-eks-role-arn-annotation.adoc[leveloffset=+3] + +//Injecting an environment variable into the Central deployment +include::modules/adding-an-environment-variable-to-a-deployment.adoc[leveloffset=+3] + +//Extending network policy with an ingress rule +include::modules/adding-an-ingress-to-a-network-policy.adoc[leveloffset=+3] + +//Modifying ConfigMap data +include::modules/changing-configmap-data.adoc[leveloffset=+3] + +//Adding a container to the Central deployment +include::modules/adding-a-container-to-a-deployment.adoc[leveloffset=+3] + [role="_additional-resources"] .Additional resources * link:https://www.postgresql.org/docs/15/libpq-connect.html#LIBPQ-CONNSTRING[Connection Strings - PostgreSQL Docs] * link:https://www.postgresql.org/docs/15/config-setting.html#CONFIG-SETTING-CONFIGURATION-FILE[Parameter Interaction via the Configuration File - PostgreSQL Docs] -* link:https://www.postgresql.org/docs/15/auth-pg-hba-conf.html[The pg_hba.conf File - PostgreSQL Docs] \ No newline at end of file +* link:https://www.postgresql.org/docs/15/auth-pg-hba-conf.html[The pg_hba.conf File - PostgreSQL Docs] diff --git a/installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc b/installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc index 2bf60540de7..a78a290ec78 100644 --- a/installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +++ b/installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc @@ -9,6 +9,53 @@ toc::[] [role="_abstract"] When installing Secured Cluster services by using the Operator, you can configure optional settings. +//Secured Cluster services configuration options include::modules/secured-cluster-configuration-options-operator.adoc[leveloffset=+1] -include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1] \ No newline at end of file +//Required configuration settings +include::modules/required-configuration-settings.adoc[leveloffset=+2] + +//Admission controller settings +include::modules/admission-controller-settings.adoc[leveloffset=+2] + +//Scanner configuration settings for the Operator +include::modules/scanner-configuration-settings-operator.adoc[leveloffset=+2] + +//Image configuration +include::modules/image-configuration-settings.adoc[leveloffset=+2] + +//Per node settings +include::modules/per-node-settings.adoc[leveloffset=+2] + +//Sensor configuration +include::modules/sensor-configuration-settings.adoc[leveloffset=+2] + +//General and miscellaneous settings +include::modules/general-and-miscellaneous-settings-secured-cluster.adoc[leveloffset=+2] + +//Customizing the installation using the Operator with overlays +include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1] + +//Overlays +include::modules/overlays-overview.adoc[leveloffset=+2] + +//Adding an overlay +include::modules/adding-an-overlay.adoc[leveloffset=+3] + +//Overlay examples +include::modules/overlay-examples-overview.adoc[leveloffset=+2] + +//Specifying an EKS pod role ARN for the Central ServiceAccount +include::modules/adding-eks-role-arn-annotation.adoc[leveloffset=+3] + +//Injecting an environment variable into the Central deployment +include::modules/adding-an-environment-variable-to-a-deployment.adoc[leveloffset=+3] + +//Extending network policy with an ingress rule +include::modules/adding-an-ingress-to-a-network-policy.adoc[leveloffset=+3] + +//Modifying ConfigMap data +include::modules/changing-configmap-data.adoc[leveloffset=+3] + +//Adding a container to the Central deployment +include::modules/adding-a-container-to-a-deployment.adoc[leveloffset=+3] diff --git a/modules/adding-a-container-to-a-deployment.adoc b/modules/adding-a-container-to-a-deployment.adoc new file mode 100644 index 00000000000..947bca72aab --- /dev/null +++ b/modules/adding-a-container-to-a-deployment.adoc @@ -0,0 +1,34 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="adding-a-container-to-a-deployment_{context}"] += Adding a container to the `Central` deployment + +[role="_abstract"] +Add a new container to the `central` deployment as shown in the following example: + +[source,yaml] +---- +apiVersion: platform.stackrox.io +kind: Central +metadata: + name: central +spec: + # ... + overlays: + - apiVersion: apps/v1 + kind: Deployment + name: central + patches: + - path: spec.template.spec.containers[-1] + value: | + name: nginx + image: nginx + ports: + - containerPort: 8000 + name: http + protocol: TCP +---- diff --git a/modules/adding-an-environment-variable-to-a-deployment.adoc b/modules/adding-an-environment-variable-to-a-deployment.adoc new file mode 100644 index 00000000000..829364ebe5d --- /dev/null +++ b/modules/adding-an-environment-variable-to-a-deployment.adoc @@ -0,0 +1,30 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="adding-an-environment-variable-to-a-deployment_{context}"] += Injecting an environment variable into the Central deployment + +[role="_abstract"] +Inject an environment variable into the `central` deployment as shown in the following example: + +[source,yaml] +---- +apiVersion: platform.stackrox.io +kind: Central +metadata: + name: central +spec: + # ... + overlays: + - apiVersion: apps/v1 + kind: Deployment + name: central + patches: + - path: spec.template.spec.containers[name:central].env[-1] + value: | + name: MY_ENV_VAR + value: value +---- diff --git a/modules/adding-an-ingress-to-a-network-policy.adoc b/modules/adding-an-ingress-to-a-network-policy.adoc new file mode 100644 index 00000000000..dbd582109b7 --- /dev/null +++ b/modules/adding-an-ingress-to-a-network-policy.adoc @@ -0,0 +1,31 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="adding-an-ingress-to-a-network-policy_{context}"] += Extending network policy with an ingress rule + +[role="_abstract"] +Add an ingress rule to the `allow-ext-to-central` network policy for port 999 traffic as shown in the following example: + +[source,yaml] +---- +apiVersion: platform.stackrox.io +kind: Central +metadata: + name: central +spec: + # ... + overlays: + - apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + name: allow-ext-to-central + patches: + - path: spec.ingress[-1] + value: | + ports: + - port: 999 + protocol: TCP +---- diff --git a/modules/adding-an-overlay.adoc b/modules/adding-an-overlay.adoc new file mode 100644 index 00000000000..32564f9196d --- /dev/null +++ b/modules/adding-an-overlay.adoc @@ -0,0 +1,15 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: CONCEPT +[id="adding-an-overlay_{context}"] += Adding an overlay + +[role="_abstract"] +For customizations, you can add overlays to `Central` or `SecuredCluster` custom resources. Use the OpenShift CLI (`oc`) +or the {ocp} web console for modifications. + +If overlays do not take effect as expected, check the {product-title-short} Operator logs for any syntax errors or +issues logged. diff --git a/modules/adding-eks-role-arn-annotation.adoc b/modules/adding-eks-role-arn-annotation.adoc new file mode 100644 index 00000000000..2c757c9c35e --- /dev/null +++ b/modules/adding-eks-role-arn-annotation.adoc @@ -0,0 +1,29 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="adding-eks-role-arn-annotation_{context}"] += Specifying an EKS pod role ARN for the Central ServiceAccount + +[role="_abstract"] +Add an Amazon Elastic Kubernetes Service (EKS) pod role Amazon Resource Name (ARN) annotation to the `central` +ServiceAccount as shown in the following example: + +[source,yaml] +---- +apiVersion: platform.stackrox.io +kind: Central +metadata: + name: central +spec: + # ... + overlays: + - apiVersion: v1 + kind: ServiceAccount + name: central + patches: + - path: metadata.annotations.eks\.amazonaws\.com/role-arn + value: "\"arn:aws:iam:1234:role\"" +---- diff --git a/modules/admission-controller-settings.adoc b/modules/admission-controller-settings.adoc new file mode 100644 index 00000000000..830423542d4 --- /dev/null +++ b/modules/admission-controller-settings.adoc @@ -0,0 +1,59 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="admission-controller-settings_{context}"] += Admission controller settings + +[role="_abstract"] +Configure the admission controller component of the `SecuredCluster` custom resource to enforce security policies on workload create and update operations. + +[cols="1,3"] +|=== +| Parameter | Description + +|`admissionControl.enforcement` +| This parameter determines if you configured the admission controller to enforce policies that have enforcement enabled. For a new secured cluster deployed with {product-title-short} 4.9, the default value is `Enabled`. For secured clusters updating from {product-title-short} versions before 4.9, previous values for the admission controller configuration parameters determine the value of this parameter. Before the update, if either of the `admissionControl.listenOnCreates` or `admissionControl.listenOnUpdates` parameters was set to `true`, the value of this parameter defaults to `Enabled` after upgrade. If both of these parameters were set to `false`, the default value becomes `Disabled` on update. + +| `admissionControl.listenOnCreates` +| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect. + +| `admissionControl.listenOnEvents` +| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect. + +| `admissionControl.listenOnUpdates` +| This parameter is deprecated and {product-title-short} ignores its value. + +| `admissionControl.nodeSelector` +| If you want this component to only run on specific nodes, you can configure a node selector using this parameter. + +| `admissionControl.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Admission Control. This parameter is mainly used for infrastructure nodes. + +| `admissionControl.hostAliases` +| Use this parameter to inject hosts and IP addresses into the pod's hosts file. + +| `admissionControl.resources.limits` +| Use this parameter to override the default resource limits for the admission controller. + +| `admissionControl.resources.requests` +| Use this parameter to override the default resource requests for the admission controller. + +| `admissionControl.bypass` +a| Use one of the following values to configure whether {product-title-short} allows bypassing the admission controller enforcement: + + * `BreakGlassAnnotation` to enable bypassing the admission controller by using the `admission.stackrox.io/break-glass` annotation. + * `Disabled` to disable the ability to bypass admission controller enforcement for the secured cluster. + +The default value is `BreakGlassAnnotation`. + +| `admissionControl.contactImageScanners` +| This field is deprecated. Setting it has no effect. + +|`admissionControl.failurePolicy` +| Determines whether the API server request is allowed (fail open) or blocked (fail closed) if an error or timeout happens in the {product-title-short} validating webhook's evaluation. Valid values are `Ignore` and `Fail`. The default value is `Ignore` to fail open. + +| `admissionControl.timeoutSeconds` +| The ability to configure this parameter is deprecated. {product-title-short} uses a preset value for the timeout period and you cannot change it. This parameter is ignored. +|=== diff --git a/modules/changing-configmap-data.adoc b/modules/changing-configmap-data.adoc new file mode 100644 index 00000000000..7d7842039d2 --- /dev/null +++ b/modules/changing-configmap-data.adoc @@ -0,0 +1,38 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="changing-configmap-data_{context}"] += Modifying ConfigMap data + +[role="_abstract"] +Modify the `central-endpoints` ConfigMap data as shown in the following example: + +[source,yaml] +---- +apiVersion: platform.stackrox.io +kind: Central +metadata: + name: central +spec: + # ... + overlays: + - apiVersion: v1 + kind: ConfigMap + name: central-endpoints + patches: + - path: data.endpoints\.yaml + verbatim: | + disableDefault: false + # another line +---- +This example shows how to override only a single item (file) under `data`. + +Follow this example by taking these steps: + +* Use the `verbatim` key, rather than `value`. +This helps pass through characters such as newlines or quotes so that they are unaffected. +* You must escape the dot in the filename in the `path` key as shown, or + you can write the path as `data["endpoints.yaml"]`. diff --git a/modules/customize-installation-operator-overlays.adoc b/modules/customize-installation-operator-overlays.adoc index e5ec4d77f72..182139d5079 100644 --- a/modules/customize-installation-operator-overlays.adoc +++ b/modules/customize-installation-operator-overlays.adoc @@ -1,3 +1,8 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + :_mod-docs-content-type: CONCEPT [id="customize-installation-operator-overlays_{context}"] @@ -5,196 +10,3 @@ [role="_abstract"] Learn how to tailor the installation of {product-title-short} using the Operator method with overlays. - -[id="overlays_{context}"] -== Overlays - -When `Central` or `SecuredCluster` custom resources don't expose certain low-level configuration options as parameters, -you can use the `.spec.overlays` field for adjustments. Use this field to amend the Kubernetes resources -generated by these custom resources. - -The `.spec.overlays` field comprises a sequence of patches, applied in their listed order. These patches are processed -by the Operator on the Kubernetes resources before deployment to the cluster. - -[WARNING] -==== -The `.spec.overlays` field in both `Central` and `SecuredCluster` allows users to modify -low-level Kubernetes resources in arbitrary ways. Use this feature only when the desired customization -is not available through the `SecuredCluster` or `Central` custom resources. - -Support for the `.spec.overlays` feature is limited primarily because it grants the ability to -make intricate and highly specific modifications to Kubernetes resources, which can vary significantly -from one implementation to another. This level of customization introduces a complexity that goes beyond -standard usage scenarios, making it challenging to provide broad support. Each modification can -be unique, potentially interacting with the Kubernetes system in unpredictable ways across -different versions and configurations of the product. This variability means that troubleshooting and -guaranteeing the stability of these customizations require a level of expertise and understanding specific -to each individual's setup. Consequently, while this feature empowers tailoring Kubernetes resources -to meet precise needs, greater responsibility must also assumed to ensure the compatibility and stability -of configurations, especially during upgrades or changes to the underlying product. - -==== - -The following example shows the structure of an overlay: -[source,yaml] ----- -overlays: -- apiVersion: v1 # - kind: ExampleKind # - name: my-resource # - patches: - - path: .some.field # - value: | # - key1: data2 - key2: data2 ----- - -where: - --- -`overlays.apiVersion`:: Specifies the targeted Kubernetes resource ApiVersion, for example, `apps/v1`, `v1`, `networking.k8s.io/v1`. -`overlays.kind`:: Specifies the resource type, for example,`Deployment`, `ConfigMap`, `NetworkPolicy`. -`overlays.name`:: Specifies the name of the resource, for example, `my-resource`. -`overlays.patches.path`:: Specifies the JSON path expression to the field, for example, `spec.template.spec.containers[name:central].env[-1]`. -`overlays.patches.value`:: Specifies the YAML string for the new field value. If you do not want to use YAML parsing, you can use the `verbatim` key as shown in the following ConfigMap example. --- -[id="adding-an-overlay_{context}"] -=== Adding an overlay - -For customizations, you can add overlays to `Central` or `SecuredCluster` custom resources. Use the OpenShift CLI (`oc`) -or the OpenShift Container Platform web console for modifications. - -If overlays do not take effect as expected, check the {product-title-short} Operator logs for any syntax errors or -issues logged. - -[id="examples_{context}"] -== Overlay examples - -[id="adding-eks-role-arn-annotation_{context}"] -=== Specifying an EKS pod role ARN for the Central ServiceAccount - -Add an Amazon Elastic Kubernetes Service (EKS) pod role Amazon Resource Name (ARN) annotation to the `central` -ServiceAccount as shown in the following example: - -[source,yaml] ----- -apiVersion: platform.stackrox.io -kind: Central -metadata: - name: central -spec: - # ... - overlays: - - apiVersion: v1 - kind: ServiceAccount - name: central - patches: - - path: metadata.annotations.eks\.amazonaws\.com/role-arn - value: "\"arn:aws:iam:1234:role\"" ----- -[id="adding-an-environment-variable-to-a-deployment_{context}"] -=== Injecting an environment variable into the Central deployment - -Inject an environment variable into the `central` deployment as shown in the following example: - -[source,yaml] ----- -apiVersion: platform.stackrox.io -kind: Central -metadata: - name: central -spec: - # ... - overlays: - - apiVersion: apps/v1 - kind: Deployment - name: central - patches: - - path: spec.template.spec.containers[name:central].env[-1] - value: | - name: MY_ENV_VAR - value: value ----- -[id="adding-an-ingress-to-a-network-policy_{context}"] -=== Extending network policy with an ingress rule - -Add an ingress rule to the `allow-ext-to-central` network policy for port 999 traffic as shown in the following example: - -[source,yaml] ----- -apiVersion: platform.stackrox.io -kind: Central -metadata: - name: central -spec: - # ... - overlays: - - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - name: allow-ext-to-central - patches: - - path: spec.ingress[-1] - value: | - ports: - - port: 999 - protocol: TCP ----- -[id="changing-configmap-data_{context}"] -=== Modifying ConfigMap data - -Modify the `central-endpoints` ConfigMap data as shown in the following example: - -[source,yaml] ----- -apiVersion: platform.stackrox.io -kind: Central -metadata: - name: central -spec: - # ... - overlays: - - apiVersion: v1 - kind: ConfigMap - name: central-endpoints - patches: - - path: data.endpoints\.yaml - verbatim: | - disableDefault: false - # another line ----- -This example shows how to override only a single item (file) under `data`. - -Follow this example by taking these steps: - -* Use the `verbatim` key, rather than `value`. -This helps pass through characters such as newlines or quotes so that they are unaffected. -* You must escape the dot in the filename in the `path` key as shown, or - you can write the path as `data["endpoints.yaml"]`. - -[id="adding-a-container-to-a-deployment_{context}"] -=== Adding a container to the `Central` deployment - -Add a new container to the `central` deployment as shown in the following example:. - -[source,yaml] ----- -apiVersion: platform.stackrox.io -kind: Central -metadata: - name: central -spec: - # ... - overlays: - - apiVersion: apps/v1 - kind: Deployment - name: central - patches: - - path: spec.template.spec.containers[-1] - value: | - name: nginx - image: nginx - ports: - - containerPort: 8000 - name: http - protocol: TCP ----- \ No newline at end of file diff --git a/modules/general-and-miscellaneous-settings-secured-cluster.adoc b/modules/general-and-miscellaneous-settings-secured-cluster.adoc new file mode 100644 index 00000000000..01f753f232b --- /dev/null +++ b/modules/general-and-miscellaneous-settings-secured-cluster.adoc @@ -0,0 +1,94 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="general-and-miscellaneous-settings-secured-cluster_{context}"] += General and miscellaneous settings + +[role="_abstract"] +Configure general and miscellaneous settings for the `SecuredCluster` custom resource, including custom annotations, environment variables, network policies, and TLS settings. + +[cols="1,6"] +|=== +| Parameter | Description + +| `customize.annotations` +| Allows specifying custom annotations for the Central deployment. + +| `customize.envVars` +| Advanced settings to configure environment variables. + +| `customize.deploymentDefaults.pinToNodes` +a| Automates the placement of all deployment-based components onto specific node types. +Set to `InfraRole` to target OpenShift infrastructure nodes. +You cannot use this parameter simultaneously with `nodeSelector` or `tolerations`. +The default value is `None`. + +[NOTE] +==== +If you configure a specific node selector or tolerations settings for individual components, such as `central.nodeSelector` or `admissionControl.nodeSelector`, those settings override the global values defined in `customize.deploymentDefaults.pinToNodes`. + +Setting `pinToNodes` to `InfraRole` is a simple alternative to manually configuring node selectors and tolerations when you want to pin deployments to infrastructure nodes. + +It is the exact equivalent of applying the following configuration: + +[source,yaml] +---- +# ... +nodeSelector: + node-role.kubernetes.io/infra: "" +tolerations: +- key: node-role.kubernetes.io/infra + value: reserved + effect: NoSchedule +- key: node-role.kubernetes.io/infra + value: reserved +# ... +---- +==== + +| `customize.deploymentDefaults.nodeSelector` +a| Applies a default `nodeSelector` to all deployment-based components. +You cannot use this parameter simultaneously with `pinToNodes`. + +[NOTE] +==== +* If you configure specific `nodeSelector` settings for individual components, such as `admissionControl.nodeSelector`, `scanner.analyzer.nodeSelector`, `scanner.db.nodeSelector`, `scannerV4.db.nodeSelector`, `scannerV4.indexer.nodeSelector`, or `sensor.nodeSelector`, those settings override the global values defined in `customize.deploymentDefaults.nodeSelector`. +* You can use this setting to define global node selectors and tolerations that are automatically inherited by all resources to reduce repetitive configuration and simplify scheduling. +==== + +| `customize.deploymentDefaults.tolerations` +a| Applies default tolerations to all deployment-based components. +You cannot use this parameter simultaneously with `pinToNodes`. + +[NOTE] +==== +* If you configure specific `tolerations` settings for individual components, such as `admissionControl.tolerations`, `scanner.analyzer.tolerations`, `scanner.analyzer.tolerations`, `scanner.db.tolerations`, `scannerV4.db.tolerations`, `scannerV4.indexer.tolerations`, or `sensor.tolerations`, those settings override the global values defined in `customize.deploymentDefaults.tolerations`. +* You can use this setting to define global node selectors and tolerations that are automatically inherited by all resources to reduce repetitive configuration and simplify scheduling. +==== + +| `egress.connectivityPolicy` +| Configures whether {product-title} should run in online or offline mode. +In offline mode, automatic updates of vulnerability definitions and kernel modules are disabled. + +| `misc.createSCCs` +| Set this to `true` to create SCCs for Central. +It might cause issues in some environments. + +|`network.policies` +a| To provide security at the network level, {product-title-short} creates default `NetworkPolicy` resources in the namespace where secured cluster resources are installed. These network policies allow ingress to specific components on specific ports. If you do not want {product-title-short} to create these policies, set this parameter to `Disabled`. The default value is `Enabled`. + +[WARNING] +==== +Disabling creation of default network policies can break communication between {product-title-short} components. If you disable creation of default policies, you must create your own network policies to allow this communication. +==== + +| `overlays` +| See "Customizing the installation using the Operator with overlays". + +| `tls.additionalCAs` +| Additional trusted CA certificates for the secured cluster. +These certificates are used when integrating with services using a private certificate authority. + +|=== diff --git a/modules/image-configuration-settings.adoc b/modules/image-configuration-settings.adoc new file mode 100644 index 00000000000..cc9f1bc0796 --- /dev/null +++ b/modules/image-configuration-settings.adoc @@ -0,0 +1,19 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="image-configuration-settings_{context}"] += Image configuration + +[role="_abstract"] +Use image configuration settings when you are using a custom registry. + +[cols="1,3"] +|=== +| Parameter | Description + +| `imagePullSecrets.name` +| Additional image pull secrets to be taken into account for pulling images. + +|=== diff --git a/modules/overlay-examples-overview.adoc b/modules/overlay-examples-overview.adoc new file mode 100644 index 00000000000..260b43cd94f --- /dev/null +++ b/modules/overlay-examples-overview.adoc @@ -0,0 +1,11 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: CONCEPT +[id="examples_{context}"] += Overlay examples + +[role="_abstract"] +The following examples demonstrate common overlay configurations for `Central` and `SecuredCluster` custom resources. diff --git a/modules/overlays-overview.adoc b/modules/overlays-overview.adoc new file mode 100644 index 00000000000..c8f9e7642d8 --- /dev/null +++ b/modules/overlays-overview.adoc @@ -0,0 +1,46 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc +// * installing/installing_ocp/install-central-config-options-ocp.adoc + +:_mod-docs-content-type: CONCEPT +[id="overlays_{context}"] += Overlays + +[role="_abstract"] +When `Central` or `SecuredCluster` custom resources do not expose certain low-level configuration options as parameters, you can use the `.spec.overlays` field for adjustments. + +The `.spec.overlays` field comprises a sequence of patches, applied in their listed order. These patches are processed +by the Operator on the Kubernetes resources before deployment to the cluster. + +[WARNING] +==== +You can use the `.spec.overlays` field in both `Central` and `SecuredCluster` to modify low-level Kubernetes resources in arbitrary ways. Use this feature only when the required customization is not available through the `SecuredCluster` or `Central` custom resources. + +Support for the `.spec.overlays` feature is limited primarily because it grants the ability to make intricate and highly specific modifications to Kubernetes resources, which can vary significantly from one implementation to another. This level of customization introduces a complexity that goes beyond standard usage scenarios, making it challenging to provide broad support. Each modification can be unique, potentially interacting with the Kubernetes system in unpredictable ways across different versions and configurations of the product. This variability means that troubleshooting and guaranteeing the stability of these customizations require a level of expertise and understanding specific to each individual's setup. Consequently, while this feature empowers tailoring Kubernetes resources to meet precise needs, greater responsibility must also assumed to ensure the compatibility and stability of configurations, especially during upgrades or changes to the underlying product. + +==== + +The following example shows the structure of an overlay: +[source,yaml] +---- +overlays: +- apiVersion: v1 # + kind: ExampleKind # + name: my-resource # + patches: + - path: .some.field # + value: | # + key1: data2 + key2: data2 +---- + +where: + +-- +`overlays.apiVersion`:: Specifies the targeted Kubernetes resource ApiVersion, for example, `apps/v1`, `v1`, `networking.k8s.io/v1`. +`overlays.kind`:: Specifies the resource type, for example,`Deployment`, `ConfigMap`, `NetworkPolicy`. +`overlays.name`:: Specifies the name of the resource, for example, `my-resource`. +`overlays.patches.path`:: Specifies the JSON path expression to the field, for example, `spec.template.spec.containers[name:central].env[-1]`. +`overlays.patches.value`:: Specifies the YAML string for the new field value. If you do not want to use YAML parsing, you can use the `verbatim` key as shown in the following ConfigMap example. +-- diff --git a/modules/per-node-settings.adoc b/modules/per-node-settings.adoc new file mode 100644 index 00000000000..5f5b98b2d8f --- /dev/null +++ b/modules/per-node-settings.adoc @@ -0,0 +1,47 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="per-node-settings_{context}"] += Per node settings + +[role="_abstract"] +Per node settings define the configuration settings for components that run on each node in a cluster to secure the cluster. +These components are Collector and Compliance. + +[cols="1,3a"] +|=== +| Parameter | Description + +| `perNode.collector.collection` +| The method for system-level data collection. +The default value is `CORE_BPF`. +Red{nbsp}Hat recommends using `CORE_BPF` for data collection. +If you select `NoCollection`, Collector does not report any information about the network activity and the process executions. +Available options are `NoCollection` and `CORE_BPF`. The `EBPF` option is available only for version 4.4 and earlier. + +| `perNode.collector.imageFlavor` +| The image type to use for Collector. You can specify it as `Regular` or `Slim`. +This value is deprecated. `Regular` and `Slim` images are identical. + +| `perNode.collector.resources.limits` +| Use this parameter to override the default resource limits for Collector. + +| `perNode.collector.resources.requests` +| Use this parameter to override the default resource requests for Collector. + +| `perNode.compliance.resources.requests` +| Use this parameter to override the default resource requests for Compliance. + +| `perNode.compliance.resources.limits` +| Use this parameter to override the default resource limits for Compliance. + +| `perNode.sfa.agent` +| Use this parameter to enable file activity monitoring for the secured cluster. Set to `Enabled`. + +| `perNode.taintToleration` +| To ensure comprehensive monitoring of your cluster activity, {product-title} runs services on every node in the cluster, including tainted nodes by default. +If you do not want this behavior, specify `AvoidTaints` for this parameter. The default value is `TolerateTaints`. + +|=== diff --git a/modules/required-configuration-settings.adoc b/modules/required-configuration-settings.adoc new file mode 100644 index 00000000000..b101aa7d71f --- /dev/null +++ b/modules/required-configuration-settings.adoc @@ -0,0 +1,26 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="required-configuration-settings_{context}"] += Required configuration settings + +[role="_abstract"] +The following required parameters must be configured when creating a `SecuredCluster` custom resource. + +[cols="1,3"] +|=== +| Parameter | Description + +| `centralEndpoint` +| The endpoint of Central instance to connect to, including the port number. +If using a non-gRPC capable load balancer, use the WebSocket protocol by prefixing the endpoint address with `wss://`. +If you do not specify a value for this parameter, Sensor attempts to connect to a Central instance running in the same namespace. + +| `clusterName` +| The unique name of this cluster, which shows up in the {product-title-short} portal. +After you set the name by using this parameter, you cannot change it again. +To change the name, you must delete and re-create the object. + +|=== diff --git a/modules/scanner-configuration-settings-operator.adoc b/modules/scanner-configuration-settings-operator.adoc new file mode 100644 index 00000000000..686b44cdfb4 --- /dev/null +++ b/modules/scanner-configuration-settings-operator.adoc @@ -0,0 +1,133 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="scanner-configuration-settings_{context}"] += Scanner configuration settings for the Operator + +[role="_abstract"] +Use Scanner configuration settings to modify the local cluster scanner for the integrated {product-registry}. + +[cols="1,3"] +|=== +| Parameter | Description + +| `scanner.analyzer.nodeSelector` +| Specify a node selector label as `label-key: label-value` to force Scanner to only schedule on nodes with the specified label. + +| `scanner.analyzer.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. + +| `scanner.analyzer.hostAliases` +| Use this parameter to inject hosts and IP addresses into the pod's hosts file. + +| `scanner.analyzer.resources.requests.memory` +| The memory request for the Scanner container. Use this parameter to override the default value. + +| `scanner.analyzer.resources.requests.cpu` +| The CPU request for the Scanner container. Use this parameter to override the default value. + +| `scanner.analyzer.resources.limits.memory` +| The memory limit for the Scanner container. Use this parameter to override the default value. + +| `scanner.analyzer.resources.limits.cpu` +| The CPU limit for the Scanner container. Use this parameter to override the default value. + +| `scanner.analyzer.scaling.autoscaling` +| If you set this option to `Disabled`, {product-title} disables autoscaling on the Scanner deployment. The default value is `Enabled`. + +| `scanner.analyzer.scaling.minReplicas` +| The minimum number of replicas for autoscaling. The default value is `2`. + +| `scanner.analyzer.scaling.maxReplicas` +| The maximum number of replicas for autoscaling. The default value is `5`. + +| `scanner.analyzer.scaling.replicas` +| The default number of replicas. The default value is `3`. + +| `scanner.analyzer.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. + +| `scanner.db.nodeSelector` +| Specify a node selector label as `label-key: label-value` to force Scanner DB to only schedule on nodes with the specified label. + +| `scanner.db.hostAliases` +| Use this parameter to inject hosts and IP addresses into the pod's hosts file. + +| `scanner.db.resources.requests.memory` +| The memory request for the Scanner DB container. Use this parameter to override the default value. + +| `scanner.db.resources.requests.cpu` +| The CPU request for the Scanner DB container. Use this parameter to override the default value. + +| `scanner.db.resources.limits.memory` +| The memory limit for the Scanner DB container. Use this parameter to override the default value. + +| `scanner.db.resources.limits.cpu` +| The CPU limit for the Scanner DB container. Use this parameter to override the default value. + +| `scanner.db.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. + +| `scanner.scannerComponent` +| If you set this option to `Disabled`, {product-title} does not deploy the Scanner deployment. Do not disable the Scanner on {ocp} clusters. The default value is `AutoSense`. + +| `scannerV4.db.nodeSelector` +| If you want this component to only run on specific nodes, you can use this parameter to configure a node selector. + +| `scannerV4.db.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner V4 DB. This parameter is mainly used for infrastructure nodes. + +| `scannerV4.db.resources.limits` +| Use this parameter to override the default resource limits for Scanner V4 DB. + +| `scannerV4.db.resources.requests` +| Use this parameter to override the default resource requests for Scanner V4 DB. + +| `scannerV4.db.persistence.persistentVolumeClaim.claimName` +| The name of the PVC to manage persistent data for Scanner V4. You can use a PVC, which is the recommended default if a default storage class exists on the cluster. If no default storage class exists and it is not specifically set in the `persistentVolumeClaim.storageClassName` parameter, ephemeral storage is used. + +| `scannerV4.db.persistence.persistentVolumeClaim.size` +| The size of the PVC to manage persistent data for Scanner V4. + +| `scannerV4.db.persistence.persistentVolumeClaim.storageClassName` +| The name of the storage class to use for the PVC. If your cluster is not configured with a default storage class, and no value is provided for this parameter, ephemeral storage is used. + +| `scannerV4.indexer.nodeSelector` +| If you want this component to only run on specific nodes, you can use this parameter to configure a node selector. + +| `scannerV4.indexer.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the Scanner V4 Indexer. This parameter is mainly used for infrastructure nodes. + +| `scannerV4.indexer.resources.limits` +| Use this parameter to override the default resource limits for the Scanner V4 Indexer. + +| `scannerV4.indexer.resources.requests` +| Use this parameter to override the default resource requests for the Scanner V4 Indexer. + +| `scannerV4.indexer.scaling.autoScaling` +| When enabled, the number of Scanner V4 Indexer replicas is managed dynamically based on the load, within the limits specified. + +| `scannerV4.indexer.scaling.maxReplicas` +| Specifies the maximum replicas to be used in the Scanner V4 Indexer autoscaling configuration. + +| `scannerV4.indexer.scaling.minReplicas` +| Specifies the minimum replicas to be used in the Scanner V4 Indexer autoscaling configuration. + +| `scannerV4.indexer.scaling.replicas` +| When autoscaling is disabled for the Scanner V4 Indexer, the number of replicas is always configured to match this value. + +| `scannerV4.monitoring.exposeEndpoint` +| Configures a monitoring endpoint for Scanner V4. The monitoring endpoint allows other services to collect metrics from Scanner V4, provided in a Prometheus-compatible format. Use `Enabled` to expose the monitoring endpoint. When you enable monitoring, {product-title-short} creates a new service, `monitoring`, with port 9090, and a network policy allowing inbound connections to the port. By default, this is not enabled. + +a| `scannerV4.scannerComponent` +| Enables Scanner V4. Valid values are: + +* `Default`: Scanner V4 is not enabled and not deployed. + +* `AutoSense`: If Central exists in the same namespace, Scanner V4 is not deployed and the existing Scanner V4 that was installed with Central is used. If there is no Central in this namespace, Scanner V4 is deployed. + +* `Disabled`: Do not deploy Scanner V4. + +|=== diff --git a/modules/secured-cluster-configuration-options-operator.adoc b/modules/secured-cluster-configuration-options-operator.adoc index 81b01efa490..6f301cf9550 100644 --- a/modules/secured-cluster-configuration-options-operator.adoc +++ b/modules/secured-cluster-configuration-options-operator.adoc @@ -1,375 +1,10 @@ // Module included in the following assemblies: // // * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + :_mod-docs-content-type: CONCEPT [id="secured-cluster-configuration-options-operator_{context}"] = Secured Cluster services configuration options +[role="_abstract"] When you create a Central instance, the Operator lists the following configuration options for the `Central` custom resource. - -[id="required-configuration-settings_{context}"] -== Required configuration settings - -[cols="1,3"] -|=== -| Parameter | Description - -| `centralEndpoint` -| The endpoint of Central instance to connect to, including the port number. -If using a non-gRPC capable load balancer, use the WebSocket protocol by prefixing the endpoint address with `wss://`. -If you do not specify a value for this parameter, Sensor attempts to connect to a Central instance running in the same namespace. - -| `clusterName` -| The unique name of this cluster, which shows up in the {product-title-short} portal. -After you set the name by using this parameter, you cannot change it again. -To change the name, you must delete and re-create the object. - -|=== - -[id="admission-controller-settings_{context}"] -== Admission controller settings - -[cols="1,3"] -|=== -| Parameter | Description - -|`admissionControl.enforcement` -| This parameter determines if you configured the admission controller to enforce policies that have enforcement enabled. For a new secured cluster deployed with {product-title-short} 4.9, the default value is `Enabled`. For secured clusters updating from {product-title-short} versions before 4.9, previous values for the admission controller configuration parameters determine the value of this parameter. Before the update, if either of the `admissionControl.listenOnCreates` or `admissionControl.listenOnUpdates` parameters was set to `true`, the value of this parameter defaults to `Enabled` after upgrade. If both of these parameters were set to `false`, the default value becomes `Disabled` on update. - -| `admissionControl.listenOnCreates` -| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect. - -| `admissionControl.listenOnEvents` -| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect. - -| `admissionControl.listenOnUpdates` -| This parameter is deprecated and {product-title-short} ignores its value. - -| `admissionControl.nodeSelector` -| If you want this component to only run on specific nodes, you can configure a node selector using this parameter. - -| `admissionControl.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Admission Control. This parameter is mainly used for infrastructure nodes. - -| `admissionControl.hostAliases` -| Use this parameter to inject hosts and IP addresses into the pod's hosts file. - -| `admissionControl.resources.limits` -| Use this parameter to override the default resource limits for the admission controller. - -| `admissionControl.resources.requests` -| Use this parameter to override the default resource requests for the admission controller. - -| `admissionControl.bypass` -a| Use one of the following values to configure whether {product-title-short} allows bypassing the admission controller enforcement: - - * `BreakGlassAnnotation` to enable bypassing the admission controller by using the `admission.stackrox.io/break-glass` annotation. - * `Disabled` to disable the ability to bypass admission controller enforcement for the secured cluster. - -The default value is `BreakGlassAnnotation`. - -| `admissionControl.contactImageScanners` -| This field is deprecated. Setting it has no effect. - -|`admissionControl.failurePolicy` -| Determines whether the API server request is allowed (fail open) or blocked (fail closed) if an error or timeout happens in the {product-title-short} validating webhook's evaluation. Valid values are `Ignore` and `Fail`. The default value is `Ignore` to fail open. - -| `admissionControl.timeoutSeconds` -| The ability to configure this parameter is deprecated. {product-title-short} uses a preset value for the timeout period and you cannot change it. This parameter is ignored. -|=== - -[id="scanner-configuration-settings_{context}"] -== Scanner configuration settings for the Operator - -Use Scanner configuration settings to modify the local cluster scanner for the integrated {product-registry}. - -[cols="1,3"] -|=== -| Parameter | Description - -| `scanner.analyzer.nodeSelector` -| Specify a node selector label as `label-key: label-value` to force Scanner to only schedule on nodes with the specified label. - -| `scanner.analyzer.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. - -| `scanner.analyzer.hostAliases` -| Use this parameter to inject hosts and IP addresses into the pod's hosts file. - -| `scanner.analyzer.resources.requests.memory` -| The memory request for the Scanner container. Use this parameter to override the default value. - -| `scanner.analyzer.resources.requests.cpu` -| The CPU request for the Scanner container. Use this parameter to override the default value. - -| `scanner.analyzer.resources.limits.memory` -| The memory limit for the Scanner container. Use this parameter to override the default value. - -| `scanner.analyzer.resources.limits.cpu` -| The CPU limit for the Scanner container. Use this parameter to override the default value. - -| `scanner.analyzer.scaling.autoscaling` -| If you set this option to `Disabled`, {product-title} disables autoscaling on the Scanner deployment. The default value is `Enabled`. - -| `scanner.analyzer.scaling.minReplicas` -| The minimum number of replicas for autoscaling. The default value is `2`. - -| `scanner.analyzer.scaling.maxReplicas` -| The maximum number of replicas for autoscaling. The default value is `5`. - -| `scanner.analyzer.scaling.replicas` -| The default number of replicas. The default value is `3`. - -| `scanner.analyzer.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner. - -| `scanner.db.nodeSelector` -| Specify a node selector label as `label-key: label-value` to force Scanner DB to only schedule on nodes with the specified label. - -| `scanner.db.hostAliases` -| Use this parameter to inject hosts and IP addresses into the pod's hosts file. - -| `scanner.db.resources.requests.memory` -| The memory request for the Scanner DB container. Use this parameter to override the default value. - -| `scanner.db.resources.requests.cpu` -| The CPU request for the Scanner DB container. Use this parameter to override the default value. - -| `scanner.db.resources.limits.memory` -| The memory limit for the Scanner DB container. Use this parameter to override the default value. - -| `scanner.db.resources.limits.cpu` -| The CPU limit for the Scanner DB container. Use this parameter to override the default value. - -| `scanner.db.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner DB. - -| `scanner.scannerComponent` -| If you set this option to `Disabled`, {product-title} does not deploy the Scanner deployment. Do not disable the Scanner on {ocp} clusters. The default value is `AutoSense`. - -| `scannerV4.db.nodeSelector` -| If you want this component to only run on specific nodes, you can use this parameter to configure a node selector. - -| `scannerV4.db.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Scanner V4 DB. This parameter is mainly used for infrastructure nodes. - -| `scannerV4.db.resources.limits` -| Use this parameter to override the default resource limits for Scanner V4 DB. - -| `scannerV4.db.resources.requests` -| Use this parameter to override the default resource requests for Scanner V4 DB. - -| `scannerV4.db.persistence.persistentVolumeClaim.claimName` -| The name of the PVC to manage persistent data for Scanner V4. You can use a PVC, which is the recommended default if a default storage class exists on the cluster. If no default storage class exists and it is not specifically set in the `persistentVolumeClaim.storageClassName` parameter, ephemeral storage is used. - -| `scannerV4.db.persistence.persistentVolumeClaim.size` -| The size of the PVC to manage persistent data for Scanner V4. - -| `scannerV4.db.persistence.persistentVolumeClaim.storageClassName` -| The name of the storage class to use for the PVC. If your cluster is not configured with a default storage class, and no value is provided for this parameter, ephemeral storage is used. - -| `scannerV4.indexer.nodeSelector` -| If you want this component to only run on specific nodes, you can use this parameter to configure a node selector. - -| `scannerV4.indexer.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for the Scanner V4 Indexer. This parameter is mainly used for infrastructure nodes. - -| `scannerV4.indexer.resources.limits` -| Use this parameter to override the default resource limits for the Scanner V4 Indexer. - -| `scannerV4.indexer.resources.requests` -| Use this parameter to override the default resource requests for the Scanner V4 Indexer. - -| `scannerV4.indexer.scaling.autoScaling` -| When enabled, the number of Scanner V4 Indexer replicas is managed dynamically based on the load, within the limits specified. - -| `scannerV4.indexer.scaling.maxReplicas` -| Specifies the maximum replicas to be used in the Scanner V4 Indexer autoscaling configuration. - -| `scannerV4.indexer.scaling.minReplicas` -| Specifies the minimum replicas to be used in the Scanner V4 Indexer autoscaling configuration. - -| `scannerV4.indexer.scaling.replicas` -| When autoscaling is disabled for the Scanner V4 Indexer, the number of replicas is always configured to match this value. - -| `scannerV4.monitoring.exposeEndpoint` -| Configures a monitoring endpoint for Scanner V4. The monitoring endpoint allows other services to collect metrics from Scanner V4, provided in a Prometheus-compatible format. Use `Enabled` to expose the monitoring endpoint. When you enable monitoring, {product-title-short} creates a new service, `monitoring`, with port 9090, and a network policy allowing inbound connections to the port. By default, this is not enabled. - -a| `scannerV4.scannerComponent` -| Enables Scanner V4. Valid values are: - -* `Default`: Scanner V4 is not enabled and not deployed. - -* `AutoSense`: If Central exists in the same namespace, Scanner V4 is not deployed and the existing Scanner V4 that was installed with Central is used. If there is no Central in this namespace, Scanner V4 is deployed. - -* `Disabled`: Do not deploy Scanner V4. - -|=== - -[id="image-configuration-settings_{context}"] -== Image configuration - -Use image configuration settings when you are using a custom registry. - -[cols="1,3"] -|=== -| Parameter | Description - -| `imagePullSecrets.name` -| Additional image pull secrets to be taken into account for pulling images. - -|=== - -[id="per-node-settings_{context}"] -== Per node settings - -Per node settings define the configuration settings for components that run on each node in a cluster to secure the cluster. -These components are Collector and Compliance. - -[cols="1,3a"] -|=== -| Parameter | Description - -| `perNode.collector.collection` -| The method for system-level data collection. -The default value is `CORE_BPF`. -Red{nbsp}Hat recommends using `CORE_BPF` for data collection. -If you select `NoCollection`, Collector does not report any information about the network activity and the process executions. -Available options are `NoCollection` and `CORE_BPF`. The `EBPF` option is available only for version 4.4 and earlier. - -| `perNode.collector.imageFlavor` -| The image type to use for Collector. You can specify it as `Regular` or `Slim`. -This value is deprecated. `Regular` and `Slim` images are identical. - -| `perNode.collector.resources.limits` -| Use this parameter to override the default resource limits for Collector. - -| `perNode.collector.resources.requests` -| Use this parameter to override the default resource requests for Collector. - -| `perNode.compliance.resources.requests` -| Use this parameter to override the default resource requests for Compliance. - -| `perNode.compliance.resources.limits` -| Use this parameter to override the default resource limits for Compliance. - -| `perNode.sfa.agent` -| Use this parameter to enable file activity monitoring for the secured cluster. Set to `Enabled`. - -| `perNode.taintToleration` -| To ensure comprehensive monitoring of your cluster activity, {product-title} runs services on every node in the cluster, including tainted nodes by default. -If you do not want this behavior, specify `AvoidTaints` for this parameter. The default value is `TolerateTaints`. - -|=== - -[id="sensor-configuration-settings_{context}"] -== Sensor configuration - -This configuration defines the settings of the Sensor components, which runs on one node in a cluster. - -[cols="1,3"] -|=== -| Parameter | Description - -| `sensor.nodeSelector` -| If you want Sensor to only run on specific nodes, you can configure a node selector. - -| `sensor.tolerations` -| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Sensor. This parameter is mainly used for infrastructure nodes. - -| `sensor.hostAliases` -| Use this parameter to inject hosts and IP addresses into the pod's hosts file. - -| `sensor.resources.limits` -| Use this parameter to override the default resource limits for Sensor. - -| `sensor.resources.requests` -| Use this parameter to override the default resource requests for Sensor. -|=== - -[id="general-and-miscellaneous-settings-secured-cluster_{context}"] -== General and miscellaneous settings - -[cols="1,6"] -|=== -| Parameter | Description - -| `customize.annotations` -| Allows specifying custom annotations for the Central deployment. - -| `customize.envVars` -| Advanced settings to configure environment variables. - -| `customize.deploymentDefaults.pinToNodes` -a| Automates the placement of all deployment-based components onto specific node types. -Set to `InfraRole` to target OpenShift infrastructure nodes. -You cannot use this parameter simultaneously with `nodeSelector` or `tolerations`. -The default value is `None`. - -[NOTE] -==== -If you configure a specific node selector or tolerations settings for individual components, such as `central.nodeSelector` or `admissionControl.nodeSelector`, those settings override the global values defined in `customize.deploymentDefaults.pinToNodes`. - -Setting `pinToNodes` to `InfraRole` is a simple alternative to manually configuring node selectors and tolerations when you want to pin deployments to infrastructure nodes. - -It is the exact equivalent of applying the following configuration: - -[source,yaml] ----- -# ... -nodeSelector: - node-role.kubernetes.io/infra: "" -tolerations: -- key: node-role.kubernetes.io/infra - value: reserved - effect: NoSchedule -- key: node-role.kubernetes.io/infra - value: reserved -# ... ----- -==== - -| `customize.deploymentDefaults.nodeSelector` -a| Applies a default `nodeSelector` to all deployment-based components. -You cannot use this parameter simultaneously with `pinToNodes`. - -[NOTE] -==== -* If you configure specific `nodeSelector` settings for individual components, such as `admissionControl.nodeSelector`, `scanner.analyzer.nodeSelector`, `scanner.db.nodeSelector`, `scannerV4.db.nodeSelector`, `scannerV4.indexer.nodeSelector`, or `sensor.nodeSelector`, those settings override the global values defined in `customize.deploymentDefaults.nodeSelector`. -* You can use this setting to define global node selectors and tolerations that are automatically inherited by all resources to reduce repetitive configuration and simplify scheduling. -==== - -| `customize.deploymentDefaults.tolerations` -a| Applies default tolerations to all deployment-based components. -You cannot use this parameter simultaneously with `pinToNodes`. - -[NOTE] -==== -* If you configure specific `tolerations` settings for individual components, such as `admissionControl.tolerations`, `scanner.analyzer.tolerations`, `scanner.analyzer.tolerations`, `scanner.db.tolerations`, `scannerV4.db.tolerations`, `scannerV4.indexer.tolerations`, or `sensor.tolerations`, those settings override the global values defined in `customize.deploymentDefaults.tolerations`. -* You can use this setting to define global node selectors and tolerations that are automatically inherited by all resources to reduce repetitive configuration and simplify scheduling. -==== - -| `egress.connectivityPolicy` -| Configures whether {product-title} should run in online or offline mode. -In offline mode, automatic updates of vulnerability definitions and kernel modules are disabled. - -| `misc.createSCCs` -| Set this to `true` to create SCCs for Central. -It may cause issues in some environments. - -|`network.policies` -a| To provide security at the network level, {product-title-short} creates default `NetworkPolicy` resources in the namespace where secured cluster resources are installed. These network policies allow ingress to specific components on specific ports. If you do not want {product-title-short} to create these policies, set this parameter to `Disabled`. The default value is `Enabled`. - -[WARNING] -==== -Disabling creation of default network policies can break communication between {product-title-short} components. If you disable creation of default policies, you must create your own network policies to allow this communication. -==== - -| `overlays` -| See "Customizing the installation using the Operator with overlays". - -| `tls.additionalCAs` -| Additional trusted CA certificates for the secured cluster. -These certificates are used when integrating with services using a private certificate authority. - -|=== \ No newline at end of file diff --git a/modules/sensor-configuration-settings.adoc b/modules/sensor-configuration-settings.adoc new file mode 100644 index 00000000000..73eeb3d8123 --- /dev/null +++ b/modules/sensor-configuration-settings.adoc @@ -0,0 +1,30 @@ +// Module included in the following assemblies: +// +// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc + +:_mod-docs-content-type: REFERENCE +[id="sensor-configuration-settings_{context}"] += Sensor configuration + +[role="_abstract"] +This configuration defines the settings of the Sensor components, which runs on one node in a cluster. + +[cols="1,3"] +|=== +| Parameter | Description + +| `sensor.nodeSelector` +| If you want Sensor to only run on specific nodes, you can configure a node selector. + +| `sensor.tolerations` +| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Sensor. This parameter is mainly used for infrastructure nodes. + +| `sensor.hostAliases` +| Use this parameter to inject hosts and IP addresses into the pod's hosts file. + +| `sensor.resources.limits` +| Use this parameter to override the default resource limits for Sensor. + +| `sensor.resources.requests` +| Use this parameter to override the default resource requests for Sensor. +|===