diff --git a/stackrox_offline/README.md b/stackrox_offline/README.md index af9e4a4..9d3f4fa 100644 --- a/stackrox_offline/README.md +++ b/stackrox_offline/README.md @@ -2,19 +2,19 @@ ## Install from the super bundle -### Get the tarball +### Get all the bits -`curl -# https://andyc.info/rox/all_the_things_3.0.52.0.tar.gz -o all_the_things_3.0.52.0.tar.gz` +`wget $(curl -s https://andyc.info/rox/|grep href| grep -v Index|awk -F">" '{print "https://andyc.info/rox/"$2}'|sed 's#" '{print "https://andyc.info/rox/"$2}'|sed 's# + +# generate stackrox install +roxctl central generate k8s none --offline --enable-telemetry=false --lb-type np --password $password --main-image $registry/stackrox/main:3.0.52.1 --scanner-db-image $registry/stackrox/scanner-db:2.7.1 --scanner-image $registry/stackrox/scanner:2.7.1 + +# reduce StackRox requirements +sed -i -e 's/4Gi/2Gi/g' -e 's/8Gi/4Gi/g' ./central-bundle/central/01-central-12-deployment.yaml +sed -i -e 's/4Gi/2Gi/g' -e 's/8Gi/4Gi/g' -e 's/replicas: 3/replicas: 1/g' ./central-bundle/scanner/02-scanner-06-deployment.yaml +sed -i -e 's/minReplicas: 2/minReplicas: 1/g' central-bundle/scanner/02-scanner-08-hpa.yaml + +# how do the nodes authenticate to the registry? +############################################################################################### +# if you have your nodes authenticate for you start here +# if not skip the `sed` statements + +# remove the auth assumptions +sed -i -e '25,$d' central-bundle/central/scripts/setup.sh +sed -i -e '9,$d' central-bundle/scanner/scripts/setup.sh + +# proceed with the `imagePullSecrets` path + +############################################################################################### +# if you need imagePullSecrets then start here +# run the setup and enter the registry creds + +#deploy +./central-bundle/central/scripts/setup.sh + +# kube all the things +kubectl apply -R -f central-bundle/central + +# install scanner +./central-bundle/scanner/scripts/setup.sh +kubectl apply -R -f central-bundle/scanner + +############################################################################################### + +# get port +rox_port=$(kubectl -n stackrox get svc central-loadbalancer |grep Node|awk '{print $5}'|sed -e 's/443://g' -e 's#/TCP##g') +until [ $(curl -kIs https://$server:$rox_port|head -n1|wc -l) = 1 ]; do echo -n "." ; sleep 2; done + +# get sensor bundle +roxctl -e $server:$rox_port sensor generate k8s --name k3s --central central.stackrox:443 --insecure-skip-tls-verify -p $password --collection-method kernel --main-image $registry/stackrox/main:$version + +# how do the nodes authenticate to the registry? +############################################################################################### +# if you have your nodes authenticate for you start here +# if not skip the `sed` statement +sed -i -e '25,57d' sensor-k3s/sensor.sh + +# apply the sensor bundle +kubectl apply -R -f sensor-k3s/ + +# update vulns database +roxctl scanner upload-db -e $server:$rox_port --scanner-db-file=scanner-vuln-updates.zip --insecure-skip-tls-verify -p $password + +# update the the kernel modules +roxctl collector support-packages upload $server:$rox_port support-pkg-b6745d-latest.zip