[RHACS] [Docs] [rhacs-docs-main] ROX-33164: Fix DITA errors in installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc

installing/installing_ocp/install-central-config-options-ocp.adoc

@@ -16,10 +16,35 @@ include::modules/central-configuration-options-operator.adoc[leveloffset=+1]
 
 * xref:../../operating/manage-vulnerabilities/vulnerability-reporting.adoc#configure-vulnerability-report-row-limit_vulnerability-reporting[Configuring the vulnerability report row limit]
 
+//Customizing the installation using the Operator with overlays
 include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1]
 
+//Overlays
+include::modules/overlays-overview.adoc[leveloffset=+2]
+
+//Adding an overlay
+include::modules/adding-an-overlay.adoc[leveloffset=+3]
+
+//Overlay examples
+include::modules/overlay-examples-overview.adoc[leveloffset=+2]
+
+//Specifying an EKS pod role ARN for the Central ServiceAccount
+include::modules/adding-eks-role-arn-annotation.adoc[leveloffset=+3]
+
+//Injecting an environment variable into the Central deployment
+include::modules/adding-an-environment-variable-to-a-deployment.adoc[leveloffset=+3]
+
+//Extending network policy with an ingress rule
+include::modules/adding-an-ingress-to-a-network-policy.adoc[leveloffset=+3]
+
+//Modifying ConfigMap data
+include::modules/changing-configmap-data.adoc[leveloffset=+3]
+
+//Adding a container to the Central deployment
+include::modules/adding-a-container-to-a-deployment.adoc[leveloffset=+3]
+
 [role="_additional-resources"]
 .Additional resources
 * link:https://www.postgresql.org/docs/15/libpq-connect.html#LIBPQ-CONNSTRING[Connection Strings - PostgreSQL Docs]
 * link:https://www.postgresql.org/docs/15/config-setting.html#CONFIG-SETTING-CONFIGURATION-FILE[Parameter Interaction via the Configuration File - PostgreSQL Docs]
-* link:https://www.postgresql.org/docs/15/auth-pg-hba-conf.html[The pg_hba.conf File - PostgreSQL Docs]
+* link:https://www.postgresql.org/docs/15/auth-pg-hba-conf.html[The pg_hba.conf File - PostgreSQL Docs]

installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc

@@ -9,6 +9,53 @@ toc::[]
 [role="_abstract"]
 When installing Secured Cluster services by using the Operator, you can configure optional settings.
 
+//Secured Cluster services configuration options
 include::modules/secured-cluster-configuration-options-operator.adoc[leveloffset=+1]
 
-include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1]
+//Required configuration settings
+include::modules/required-configuration-settings.adoc[leveloffset=+2]
+
+//Admission controller settings
+include::modules/admission-controller-settings.adoc[leveloffset=+2]
+
+//Scanner configuration settings for the Operator
+include::modules/scanner-configuration-settings-operator.adoc[leveloffset=+2]
+
+//Image configuration
+include::modules/image-configuration-settings.adoc[leveloffset=+2]
+
+//Per node settings
+include::modules/per-node-settings.adoc[leveloffset=+2]
+
+//Sensor configuration
+include::modules/sensor-configuration-settings.adoc[leveloffset=+2]
+
+//General and miscellaneous settings
+include::modules/general-and-miscellaneous-settings-secured-cluster.adoc[leveloffset=+2]
+
+//Customizing the installation using the Operator with overlays
+include::modules/customize-installation-operator-overlays.adoc[leveloffset=+1]
+
+//Overlays
+include::modules/overlays-overview.adoc[leveloffset=+2]
+
+//Adding an overlay
+include::modules/adding-an-overlay.adoc[leveloffset=+3]
+
+//Overlay examples
+include::modules/overlay-examples-overview.adoc[leveloffset=+2]
+
+//Specifying an EKS pod role ARN for the Central ServiceAccount
+include::modules/adding-eks-role-arn-annotation.adoc[leveloffset=+3]
+
+//Injecting an environment variable into the Central deployment
+include::modules/adding-an-environment-variable-to-a-deployment.adoc[leveloffset=+3]
+
+//Extending network policy with an ingress rule
+include::modules/adding-an-ingress-to-a-network-policy.adoc[leveloffset=+3]
+
+//Modifying ConfigMap data
+include::modules/changing-configmap-data.adoc[leveloffset=+3]
+
+//Adding a container to the Central deployment
+include::modules/adding-a-container-to-a-deployment.adoc[leveloffset=+3]

modules/adding-a-container-to-a-deployment.adoc

@@ -0,0 +1,34 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="adding-a-container-to-a-deployment_{context}"]
+= Adding a container to the `Central` deployment
+
+[role="_abstract"]
+Add a new container to the `central` deployment as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: platform.stackrox.io
+kind: Central
+metadata:
+  name: central
+spec:
+    # ...
+    overlays:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: central
+      patches:
+        - path: spec.template.spec.containers[-1]
+      value: |
+        name: nginx
+        image: nginx
+        ports:
+          - containerPort: 8000
+            name: http
+            protocol: TCP
+----

modules/adding-an-environment-variable-to-a-deployment.adoc

@@ -0,0 +1,30 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="adding-an-environment-variable-to-a-deployment_{context}"]
+= Injecting an environment variable into the Central deployment
+
+[role="_abstract"]
+Inject an environment variable into the `central` deployment as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: platform.stackrox.io
+kind: Central
+metadata:
+  name: central
+spec:
+  # ...
+  overlays:
+  - apiVersion: apps/v1
+    kind: Deployment
+    name: central
+    patches:
+    - path: spec.template.spec.containers[name:central].env[-1]
+      value: |
+        name: MY_ENV_VAR
+        value: value
+----

modules/adding-an-ingress-to-a-network-policy.adoc

@@ -0,0 +1,31 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="adding-an-ingress-to-a-network-policy_{context}"]
+= Extending network policy with an ingress rule
+
+[role="_abstract"]
+Add an ingress rule to the `allow-ext-to-central` network policy for port 999 traffic as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: platform.stackrox.io
+kind: Central
+metadata:
+  name: central
+spec:
+    # ...
+    overlays:
+    - apiVersion: networking.k8s.io/v1
+      kind: NetworkPolicy
+      name: allow-ext-to-central
+      patches:
+        - path: spec.ingress[-1]
+          value: |
+            ports:
+            - port: 999
+              protocol: TCP
+----

modules/adding-an-overlay.adoc

@@ -0,0 +1,15 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="adding-an-overlay_{context}"]
+= Adding an overlay
+
+[role="_abstract"]
+For customizations, you can add overlays to `Central` or `SecuredCluster` custom resources. Use the OpenShift CLI (`oc`)
+or the {ocp} web console for modifications.
+
+If overlays do not take effect as expected, check the {product-title-short} Operator logs for any syntax errors or
+issues logged.

modules/adding-eks-role-arn-annotation.adoc

@@ -0,0 +1,29 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="adding-eks-role-arn-annotation_{context}"]
+= Specifying an EKS pod role ARN for the Central ServiceAccount
+
+[role="_abstract"]
+Add an Amazon Elastic Kubernetes Service (EKS) pod role Amazon Resource Name (ARN) annotation to the `central`
+ServiceAccount as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: platform.stackrox.io
+kind: Central
+metadata:
+  name: central
+spec:
+  # ...
+  overlays:
+  - apiVersion: v1
+    kind: ServiceAccount
+    name: central
+    patches:
+      - path: metadata.annotations.eks\.amazonaws\.com/role-arn
+        value: "\"arn:aws:iam:1234:role\""
+----

modules/admission-controller-settings.adoc

@@ -0,0 +1,59 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="admission-controller-settings_{context}"]
+= Admission controller settings
+
+[role="_abstract"]
+Configure the admission controller component of the `SecuredCluster` custom resource to enforce security policies on workload create and update operations.
+
+[cols="1,3"]
+|===
+| Parameter | Description
+
+|`admissionControl.enforcement`
+| This parameter determines if you configured the admission controller to enforce policies that have enforcement enabled. For a new secured cluster deployed with {product-title-short} 4.9, the default value is `Enabled`. For secured clusters updating from {product-title-short} versions before 4.9, previous values for the admission controller configuration parameters determine the value of this parameter. Before the update, if either of the `admissionControl.listenOnCreates` or `admissionControl.listenOnUpdates` parameters was set to `true`, the value of this parameter defaults to `Enabled` after upgrade. If both of these parameters were set to `false`, the default value becomes `Disabled` on update.
+
+| `admissionControl.listenOnCreates`
+| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect.
+
+| `admissionControl.listenOnEvents`
+| This parameter is deprecated. {product-title-short} checks the value during updates to version 4.9 and is used to set a default value for the new `admissionControl.enforcement` parameter. On new installations, changing this parameter has no effect.
+
+| `admissionControl.listenOnUpdates`
+| This parameter is deprecated and {product-title-short} ignores its value.
+
+| `admissionControl.nodeSelector`
+| If you want this component to only run on specific nodes, you can configure a node selector using this parameter.
+
+| `admissionControl.tolerations`
+| If the node selector selects tainted nodes, use this parameter to specify a taint toleration key, value, and effect for Admission Control. This parameter is mainly used for infrastructure nodes.
+
+| `admissionControl.hostAliases`
+| Use this parameter to inject hosts and IP addresses into the pod's hosts file.
+
+| `admissionControl.resources.limits`
+| Use this parameter to override the default resource limits for the admission controller.
+
+| `admissionControl.resources.requests`
+| Use this parameter to override the default resource requests for the admission controller.
+
+| `admissionControl.bypass`
+a| Use one of the following values to configure whether {product-title-short} allows bypassing the admission controller enforcement:
+
+    * `BreakGlassAnnotation` to enable bypassing the admission controller by using the `admission.stackrox.io/break-glass` annotation.
+    * `Disabled` to disable the ability to bypass admission controller enforcement for the secured cluster.
+
+The default value is `BreakGlassAnnotation`.
+
+| `admissionControl.contactImageScanners`
+| This field is deprecated. Setting it has no effect.
+
+|`admissionControl.failurePolicy`
+| Determines whether the API server request is allowed (fail open) or blocked (fail closed) if an error or timeout happens in the {product-title-short} validating webhook's evaluation. Valid values are `Ignore` and `Fail`. The default value is `Ignore` to fail open.
+
+| `admissionControl.timeoutSeconds`
+| The ability to configure this parameter is deprecated. {product-title-short} uses a preset value for the timeout period and you cannot change it. This parameter is ignored.
+|===

modules/changing-configmap-data.adoc

@@ -0,0 +1,38 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_ocp/install-secured-cluster-config-options-ocp.adoc
+// * installing/installing_ocp/install-central-config-options-ocp.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="changing-configmap-data_{context}"]
+= Modifying ConfigMap data
+
+[role="_abstract"]
+Modify the `central-endpoints` ConfigMap data as shown in the following example:
+
+[source,yaml]
+----
+apiVersion: platform.stackrox.io
+kind: Central
+metadata:
+  name: central
+spec:
+    # ...
+    overlays:
+    - apiVersion: v1
+      kind: ConfigMap
+      name: central-endpoints
+      patches:
+      - path: data.endpoints\.yaml
+        verbatim: |
+          disableDefault: false
+          # another line
+----
+This example shows how to override only a single item (file) under `data`.
+
+Follow this example by taking these steps:
+
+* Use the `verbatim` key, rather than `value`.
+This helps pass through characters such as newlines or quotes so that they are unaffected.
+* You must escape the dot in the filename in the `path` key as shown, or
+ you can write the path as `data["endpoints.yaml"]`.