Managing the Workload Protection agent in Red Hat OpenShift by using a HELM chart

Step 1. Set up the cluster context

Complete the following steps:

1. Log in to the account. If you have a federated account, include the --sso option.

   ibmcloud login [-g <resource_group>] [--sso]
   

2. Download and add the kubeconfig configuration file for your cluster to your existing kubeconfig in ~/.kube/config or the last file in the KUBECONFIG environment variable.

   ibmcloud oc cluster config --cluster <cluster_name_or_ID>
   

3. In your browser, navigate to the address of your Master URL and append /console. For example, https://c0.containers.cloud.ibm.com:23652/console.

4. From the Red Hat OpenShift web console menu bar, click your profile IAM#user.name@email.com > Copy Login Command. Display and copy the oc login token command into your command line to authenticate from the CLI.

5. Verify that the oc commands run properly with your cluster by checking the version.

   oc version
   

   Example output

   Client Version: v4.11.0
   Kubernetes Version: v1.25.8.2
   

   If you can't perform operations that require Administrator permissions, such as listing all the worker nodes or pods in a cluster, download the TLS certificates and permission files for the cluster administrator by running the ibmcloud oc cluster config --cluster <cluster_name_or_ID> --admin command.

Step 2. Setup the Sysdig Helm repository

Add the Workload Protection Helm repository to your Helm instance.

1. Add the Helm repository.

   helm repo add sysdig https://charts.sysdig.com
   

   If you get the following error:

   helm repo add sysdig https://charts.sysdig.com    --debug
   Error: context deadline exceeded
   helm.go:84: [debug] context deadline exceeded
   

   Run the following command and retry adding the Helm repository.

   rm $HOME/Library/Preferences/helm/repositories.lock
   

2. Update the repos to retrieve the latest versions of all Helm charts.

   helm repo update
   

3. List the Helm charts that are currently available for the Sysdig repo.

   helm search repo sysdig
   

4. Verify the Helm chart sysdig/sysdig-deploy is listed.

Step 3. Create the values yaml file

Define a yaml file and include the values to deploy the Workload Protection agent and the Secure components that you plan to deploy. For example, name the file agent-values-monitor-secure.yaml.

The following yaml is a template that you can use to configure the Workload Protection agent and the Secure components. You can customize the file by removing or commenting with # the sections that are not required for your agent deployment.

agent:
  collectorSettings:
    collectorHost: INGESTION_ENDPOINT
  sysdig:
    settings:
     host_scanner:
       enabled: true
     kspm_analyzer:
       enabled: true
     sysdig_api_endpoint: API_ENDPOINT
  extraVolumes:
    volumes:
    - name: root-vol
      hostPath:
        path: /
    - name: tmp-vol
      hostPath:
        path: /tmp
    mounts:
    - mountPath: /host
      name: root-vol
      readOnly: true
    - mountPath: /host/tmp
      name: tmp-vol
global:
  imageRegistry: icr.io/ext
  clusterConfig:
    name: CLUSTER_NAME
  sysdig:
    accessKey: SERVICE_ACCESS_KEY
    apiHost: API_ENDPOINT
nodeAnalyzer:
  enabled: false
clusterShield:
  enabled: true
  cluster_shield:
    sysdig_endpoint: 
      region: custom
    log_level: info
    features:
      admission_control:
        enabled: true
      container_vulnerability_management:
        enabled: true
      audit:
        enabled: true
      posture:
        enabled: true

Where

• CLUSTER_NAME is the name of the cluster where you are deploying the agent.
• SERVICE_ACCESS_KEY is the Workload Protection instance access key.
• INGESTION_ENDPOINT is the instance's ingestion endpoint. For example, ingest.us-east.security-compliance-secure.cloud.ibm.com
• API_ENDPOINT is the intance's API endpoint. For example, us-east.security-compliance-secure.cloud.ibm.com

Step 4. Install the helm chart

To deploy the agent, the Secure components, or both, you must install the sysdig/sysdig-deploy chart and use the variables yaml file that you configured in the previous step.

Run the following command to install the agent by using the helm chart:

helm install -n ibm-observe sysdig-agent sysdig/sysdig-deploy -f agent-values-monitor-secure.yaml

For example, for the us-east region, a sample Helm values file looks as follows:

agent:
  collectorSettings:
    collectorHost: ingest.private.us-east.security-compliance-secure.cloud.ibm.com
  sysdig:
    settings:
     host_scanner:
       enabled: true
     kspm_analyzer:
       enabled: true
     sysdig_api_endpoint: private.us-east.security-compliance-secure.cloud.ibm.com
  extraVolumes:
    volumes:
    - name: root-vol
      hostPath:
        path: /
    - name: tmp-vol
      hostPath:
        path: /tmp
    mounts:
    - mountPath: /host
      name: root-vol
      readOnly: true
    - mountPath: /host/tmp
      name: tmp-vol
global:
  imageRegistry: icr.io/ext
  clusterConfig:
    name: my-cluster
  sysdig:
    accessKey: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx
    apiHost: private.us-east.security-compliance-secure.cloud.ibm.com
nodeAnalyzer:
  enabled: false
clusterShield:
  enabled: true
  cluster_shield:
    sysdig_endpoint: 
      region: custom
    log_level: info
    features:
      admission_control:
        enabled: true
      container_vulnerability_management:
        enabled: true
      audit:
        enabled: true
      posture:
        enabled: true

Where

• CLUSTER_NAME is the name of the cluster where you are deploying the agent.
• SERVICE_ACCESS_KEY is the Workload Protection instance access key.
• INGESTION_ENDPOINT is the instance's ingestion endpoint.
• API_ENDPOINT is the intance's API endpoint.

If you encounter the following error: Error: INSTALLATION FAILED: OpenShift cluster unreachable: xxxxxx failed to refresh token: oauth2: cannot fetch token: 400 Bad Request, set your cluster context and try again.