ralvares

apiVersion: platform.stackrox.io/v1alpha1
kind: SecuredCluster
metadata:
  name: stackrox-secured-cluster-services
  namespace: stackrox
spec:
  admissionControl:
    bypass: BreakGlassAnnotation
    contactImageScanners: DoNotScanInline
    listenOnCreates: true

ralvares

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: stackrox
  name: stackrox-image-puller
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stackrox-image-puller-clusterrolebinding

ralvares

#!/bin/bash

if [[ -z "${ROX_ENDPOINT}" ]]; then
  echo >&2 "ROX_ENDPOINT must be set"
  exit 1
fi

if [[ -z "${ROX_API_TOKEN}" ]]; then
  echo >&2 "ROX_API_TOKEN must be set"
  exit 1

ralvares

4 simple steps

- Create namespace
- Create secret ( it is required )
- Generate cluster-init-bundle.
- Install secured-cluster using helm.

# Create namespace and Pull-Secret from cloud.redhat.com

kubectl create namespace stackrox

ralvares

apiVersion: template.openshift.io/v1
kind: Template
labels:
  template: nfs-client-provisioner
message: 'NFS storage class ${STORAGE_CLASS} created.'
metadata:
  annotations:
    description: nfs-client-provisioner
    openshift.io/display-name: nfs-client-provisioner
    openshift.io/provider-display-name: Tiger Team

ralvares

### libvirt lab network ###

cat > /root/lab.xml << EOF
<network connections='8'>
  <name>lab</name>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>

ralvares

# Updated for OCP 4.11.5
# https://gist.github.com/ralvares/976dce493b43c498cf781f8b8dff28d3

## Download Artifacts

# housekeep old vm if necessary
virsh destroy master-sno
virsh undefine master-sno

## openshift-client

ralvares

kubectl create secret generic cloud-secret \
  --namespace='sock-shop' \
  --from-literal=apikey='xxxxx-xxxxx-xxxxx-xxxxx-xxxxx'
----
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: cloud-venafi-issuer
  namespace: sock-shop 
spec:

ralvares

kubectl create secret docker-registry regcred --docker-password=TOKEN --docker-username=USERNAME --docker-server=quay.io  -n workshop
kubectl patch serviceaccount pipeline -p '{"secrets": [{"name": "regcred"}]}'

ralvares

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-anyuid-enforce
  namespace: default
  annotations:
    policy.open-cluster-management.io/categories: AC Access Control
    policy.open-cluster-management.io/controls: AC-3 Access Enforcement
    policy.open-cluster-management.io/standards: NIST SP 800-53
spec: