From a4ca58189150bec53dc81e1d178bf20373853a39 Mon Sep 17 00:00:00 2001 From: solalraveh Date: Fri, 19 Jun 2020 10:46:40 +0300 Subject: [PATCH 1/4] Update install_swarm.adoc modified to distinguish saas and self-hosted --- admin_guide/install/install_swarm.adoc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/admin_guide/install/install_swarm.adoc b/admin_guide/install/install_swarm.adoc index 085c84b3..563ccfaa 100644 --- a/admin_guide/install/install_swarm.adoc +++ b/admin_guide/install/install_swarm.adoc @@ -316,9 +316,9 @@ Console provides a GUI to configure all the options required to deploy Defender [.procedure] . Open Console. +ifdef::compute_edition[] . Go to *Manage > Defenders > Names*. -ifdef::compute_edition[] . Click *Add SAN*, and add the DNS name of your load balancer. . Go to *Manage > Defenders > Deploy > Swarm*. @@ -358,7 +358,12 @@ You need sudo privileges to run this command. . Validate that the Defender global service is running. + +ifdef::prisma_cloud[] +Open Console, then go to *Compute > Manage > Defenders > Manage*. +endif::prisma_cloud[] +ifdef::compute_edition[] Open Console, then go to *Manage > Defenders > Manage*. +endif::compute_edition[] The table lists all Defenders deployed to your environment (one per node). From 83e60f92eb9730ce8cada106bd672f47619f2102 Mon Sep 17 00:00:00 2001 From: solalraveh Date: Fri, 19 Jun 2020 11:07:15 +0300 Subject: [PATCH 2/4] updates to port 443 on saas updated openshift install and connectivity flow to call out 443. diagram png file needs to be modified --- admin_guide/install/install_openshift.adoc | 2 +- ref_arch/platform_components/connectivity_flows.adoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/admin_guide/install/install_openshift.adoc b/admin_guide/install/install_openshift.adoc index a69194af..dc698b13 100644 --- a/admin_guide/install/install_openshift.adoc +++ b/admin_guide/install/install_openshift.adoc @@ -76,7 +76,7 @@ ifdef::prisma_cloud[] [.section] ==== Network connectivity -Validate that outbound connections can be made on port 8084. +Validate that outbound connections to your Console can be made on port 443. endif::prisma_cloud[] diff --git a/ref_arch/platform_components/connectivity_flows.adoc b/ref_arch/platform_components/connectivity_flows.adoc index 8ed19c33..e1d2acab 100644 --- a/ref_arch/platform_components/connectivity_flows.adoc +++ b/ref_arch/platform_components/connectivity_flows.adoc @@ -18,7 +18,7 @@ interoperate with firewalls wherever necessary, provided the required TCP ports are open. When using Prisma Cloud Compute Saas Console customers will need to provide connectivity -from their deployed Defenders to the SaaS Console through the firewalls. +from their deployed Defenders to the SaaS Console through the firewalls on port 443. === Istio From 672b47c6cedcd82e0dda35ad416e108a5b35b64f Mon Sep 17 00:00:00 2001 From: solalraveh Date: Fri, 3 Jul 2020 10:01:48 +0300 Subject: [PATCH 3/4] Update install_kubernetes.adoc --- admin_guide/install/install_kubernetes.adoc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/admin_guide/install/install_kubernetes.adoc b/admin_guide/install/install_kubernetes.adoc index 6c2abb32..5a4bb45c 100644 --- a/admin_guide/install/install_kubernetes.adoc +++ b/admin_guide/install/install_kubernetes.adoc @@ -91,9 +91,15 @@ endif::compute_edition[] *Prisma Cloud Defenders*: +ifdef::compute_edition[] * Incoming: None * Outgoing: 8084 +endif::compute_edition[] +ifdef::prisma_cloud[] +* Incoming: None +* Outgoing: 443 +endif::prisma_cloud[] [#_install_twistlock] === Install Prisma Cloud @@ -112,7 +118,7 @@ Use xref:../tools/twistcli.adoc[_twistcli_] to install the Prisma Cloud Defender The _twistcli_ utility is included with every release. The main criteria for installing Defender is that it can connect to the Prisma Cloud Compute Console SaaS service. -Defender connects to Console via websocket over port 8084 to retrieve policies and send data +Defender connects to Console via websocket over port 443 to retrieve policies and send data endif::prisma_cloud[] From 88a6842a8a5a29de1fdb70ccf8d693982a0ae560 Mon Sep 17 00:00:00 2001 From: solalraveh Date: Wed, 23 Sep 2020 17:27:00 +0200 Subject: [PATCH 4/4] ocp 4 updates and cri - added a note to add --cri flag on OCP 4.x - removed a space in nodeselector where it has "Prisma Cloud" with a space - described how to use tolerations for OCP 4.x so it will deploy daemonset to master as well. --- .../install_defender_twistcli_export_oc.adoc | 3 ++ admin_guide/install/install_openshift.adoc | 51 ++++++++++++++++--- 2 files changed, 47 insertions(+), 7 deletions(-) diff --git a/admin_guide/install/fragments/install_defender_twistcli_export_oc.adoc b/admin_guide/install/fragments/install_defender_twistcli_export_oc.adoc index da740646..01ccb96d 100644 --- a/admin_guide/install/fragments/install_defender_twistcli_export_oc.adoc +++ b/admin_guide/install/fragments/install_defender_twistcli_export_oc.adoc @@ -15,6 +15,9 @@ Alternatively, you can generate Defender DaemonSet install commands in the Conso Install scripts work on Linux hosts only. For macOS and Windows hosts, use twistcli to generate Defender DaemonSet YAML configuration files, and then deploy it with oc, as described in the following procedure. +NOTE: Red Hat OpenShift Container Platform (OCP) 4 now defaults to CRI-O as underlying container engine. +Use the _--cri_ flag for any _twistcli defender export openshift_ command you run. + [.procedure] . Retrive Console's API address (PRISMA_CLOUD_COMPUTE_CONSOLE_API_ADDR). diff --git a/admin_guide/install/install_openshift.adoc b/admin_guide/install/install_openshift.adoc index ab282457..7cbe1fba 100644 --- a/admin_guide/install/install_openshift.adoc +++ b/admin_guide/install/install_openshift.adoc @@ -349,6 +349,8 @@ endif::compute_edition[] ifdef::compute_edition[] [.task] ==== Install Defender +NOTE: Red Hat OpenShift Container Platform (OCP) 4 now defaults to CRI-O as underlying container engine. +Use the _--cri_ flag for any _twistcli defender export openshift_ command you run. Prisma Cloud Defenders run as containers on the nodes in your OpenShift cluster. They are deployed as a DaemonSet. @@ -449,12 +451,14 @@ endif::prisma_cloud[] [.task] -=== Control Defender deployments with NodeSelector +=== Control Defender deployments with NodeSelector (OCP 3.x) and Tolerations (OCP 4.x) You can deploy Defenders to all nodes in an OpenShift cluster (master, infra, compute). -Depending upon the nodeSelector configuration, Prisma Cloud Defenders may not get deployed to all nodes. +Depending upon the nodeSelector (OCP 3.x) or tolerations (OCP 4.x) configuration, Prisma Cloud Defenders may not get deployed to all nodes. Adjust the guidance in the following procedure according to your organization's deployment strategy. +For OCP 3.x environments, where nodeSelector is used to determine where the DaemonSet can be deployed, follow: + [.procedure] . Review the following OpenShift configuration settings. @@ -488,16 +492,16 @@ In this example the Prisma Cloud project default nodeSelector instructs OpenShif $ oc annotate namespace twistlock openshift.io/node-selector="" -. Add a _Deploy_Prisma Cloud : true_ label to all nodes to which Defender should be deployed. +. Add a _Deploy_PrismaCloud : true_ label to all nodes to which Defender should be deployed. + [source] ---- - $ oc label node ip-172-31-0-55.ec2.internal Deploy_Prisma Cloud=true + $ oc label node ip-172-31-0-55.ec2.internal Deploy_PrismaCloud=true $ oc describe node ip-172-31-0-55.ec2.internal Name: ip-172-31-0-55.ec2.internal Roles: compute - Labels: Deploy_Prisma Cloud=true + Labels: Deploy_PrismaCloud=true beta.kubernetes.io/arch=amd64 beta.kubernetes.io/os=linux kubernetes.io/hostname=ip-172-31-0-55.ec2.internal @@ -525,7 +529,7 @@ spec: spec: serviceAccountName: twistlock-service nodeSelector: - Deploy_Prisma Cloud: "true" + Deploy_PrismaCloud: "true" restartPolicy: Always containers: - name: twistlock-defender-2-5-127 @@ -539,9 +543,42 @@ spec: $ oc get ds -n twistlock NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR -twistlock-defender-ds 4 4 4 4 4 Deploy_Prisma Cloud=true +twistlock-defender-ds 4 4 4 4 4 Deploy_PrismaCloud=true +---- + + +OpenShift 4.x+ uses Taints to prevent workload to be scheduled to masters. +i.e. : +[source,yaml] +---- +... +taints: +- effect: NoSchedule + key: node-role.kubernetes.io/master +... +---- + +For OCP 4.x environments, where Tolerations are used to determine where the DaemonSet can be deployed, follow either one of the following two: + +[.procedure] +. If the Defender yaml file is not deployed/applied yet, then add the following example under spec > template > spec: ++ +[source,yaml] +---- +... +tolerations: +- effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists +... ---- +. If the Defender DaemonSet is already deployed, patch it with this cli: ++ +[source] +---- + oc patch daemonset twistlock-defender-ds --type=merge -p '{"spec":{"template":{"spec":{"tolerations":[{"effect":"NoSchedule","key":"node-role.kubernetes.io/master","operator":"Exists"}]}}}}' +---- === Install Prisma Cloud with Helm charts