Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ocp 4 updates and cri #160

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Ocp 4 updates and cri #160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a4ca581
Update install_swarm.adoc
solalraveh Jun 19, 2020
83e60f9
updates to port 443 on saas
solalraveh Jun 19, 2020
32abc7b
Merge pull request #1 from solalraveh/openshift-edits
solalraveh Jun 19, 2020
d6bfd9d
Merge pull request #2 from twistlock/master
solalraveh Jul 3, 2020
672b47c
Update install_kubernetes.adoc
solalraveh Jul 3, 2020
4e36afa
Merge pull request #3 from twistlock/master
solalraveh Sep 23, 2020
88a6842
ocp 4 updates and cri
solalraveh Sep 23, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions admin_guide/install/fragments/install_defender_twistcli_export_oc.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ Alternatively, you can generate Defender DaemonSet install commands in the Conso
Install scripts work on Linux hosts only.
For macOS and Windows hosts, use twistcli to generate Defender DaemonSet YAML configuration files, and then deploy it with oc, as described in the following procedure.

NOTE: Red Hat OpenShift Container Platform (OCP) 4 now defaults to CRI-O as underlying container engine.
Use the _--cri_ flag for any _twistcli defender export openshift_ command you run.

[.procedure]
. Retrive Console's API address (PRISMA_CLOUD_COMPUTE_CONSOLE_API_ADDR).

Expand Down
51 changes: 44 additions & 7 deletions admin_guide/install/install_openshift.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -349,6 +349,8 @@ endif::compute_edition[]
ifdef::compute_edition[]
[.task]
==== Install Defender
NOTE: Red Hat OpenShift Container Platform (OCP) 4 now defaults to CRI-O as underlying container engine.
Use the _--cri_ flag for any _twistcli defender export openshift_ command you run.

Prisma Cloud Defenders run as containers on the nodes in your OpenShift cluster.
They are deployed as a DaemonSet.
Expand Down Expand Up @@ -449,12 +451,14 @@ endif::prisma_cloud[]


[.task]
=== Control Defender deployments with NodeSelector
=== Control Defender deployments with NodeSelector (OCP 3.x) and Tolerations (OCP 4.x)

You can deploy Defenders to all nodes in an OpenShift cluster (master, infra, compute).
Depending upon the nodeSelector configuration, Prisma Cloud Defenders may not get deployed to all nodes.
Depending upon the nodeSelector (OCP 3.x) or tolerations (OCP 4.x) configuration, Prisma Cloud Defenders may not get deployed to all nodes.
Adjust the guidance in the following procedure according to your organization's deployment strategy.

For OCP 3.x environments, where nodeSelector is used to determine where the DaemonSet can be deployed, follow:

[.procedure]
. Review the following OpenShift configuration settings.

Expand Down Expand Up @@ -488,16 +492,16 @@ In this example the Prisma Cloud project default nodeSelector instructs OpenShif

$ oc annotate namespace twistlock openshift.io/node-selector=""

. Add a _Deploy_Prisma Cloud : true_ label to all nodes to which Defender should be deployed.
. Add a _Deploy_PrismaCloud : true_ label to all nodes to which Defender should be deployed.
+
[source]
----
$ oc label node ip-172-31-0-55.ec2.internal Deploy_Prisma Cloud=true
$ oc label node ip-172-31-0-55.ec2.internal Deploy_PrismaCloud=true

$ oc describe node ip-172-31-0-55.ec2.internal
Name: ip-172-31-0-55.ec2.internal
Roles: compute
Labels: Deploy_Prisma Cloud=true
Labels: Deploy_PrismaCloud=true
beta.kubernetes.io/arch=amd64
beta.kubernetes.io/os=linux
kubernetes.io/hostname=ip-172-31-0-55.ec2.internal
Expand Down Expand Up @@ -525,7 +529,7 @@ spec:
spec:
serviceAccountName: twistlock-service
nodeSelector:
Deploy_Prisma Cloud: "true"
Deploy_PrismaCloud: "true"
restartPolicy: Always
containers:
- name: twistlock-defender-2-5-127
Expand All @@ -539,9 +543,42 @@ spec:
$ oc get ds -n twistlock

NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR
twistlock-defender-ds 4 4 4 4 4 Deploy_Prisma Cloud=true
twistlock-defender-ds 4 4 4 4 4 Deploy_PrismaCloud=true
----


OpenShift 4.x+ uses Taints to prevent workload to be scheduled to masters.
i.e. :
[source,yaml]
----
...
taints:
- effect: NoSchedule
key: node-role.kubernetes.io/master
...
----

For OCP 4.x environments, where Tolerations are used to determine where the DaemonSet can be deployed, follow either one of the following two:

[.procedure]
. If the Defender yaml file is not deployed/applied yet, then add the following example under spec > template > spec:
+
[source,yaml]
----
...
tolerations:
- effect: NoSchedule
key: node-role.kubernetes.io/master
operator: Exists
...
----

. If the Defender DaemonSet is already deployed, patch it with this cli:
+
[source]
----
oc patch daemonset twistlock-defender-ds --type=merge -p '{"spec":{"template":{"spec":{"tolerations":[{"effect":"NoSchedule","key":"node-role.kubernetes.io/master","operator":"Exists"}]}}}}'
----

=== Install Prisma Cloud with Helm charts

Expand Down