Getting PC Report for Red Hat OpenShift Container Platform (RHOCP) 4.x

You can get the Policy Compliance report for Red Hat OpenShift Container Platform (RHOCP) 4.x using any one of the following two methods:

• Scan one of the master/worker nodes in the RHOCP. You need to deploy Qualys Cloud Agent for Red Hat Enterprise Linux CoreOS. Qualys Cloud Agent will run as a container in the RHOCP.
  See Generating PC Report using Master/Worker Node.

OR

• Scan the bastion host that can connect to the RHOCP cluster API server. You can use Qualys Scanner or Qualys Linux Agent. 
  The PC scan relies on the oc commands and the /root/.kube/config file on the host.
  See Generating PC Report using Bastion Host.

Generating PC Report using Master/Worker Node 

This method works only with Qualys Cloud Agent.

1. Install the oc CLI client on the host.

2. Create a service account and assign a cluster-reader role to this account.
   The cluster-reader role grants users the ability to read all resources in the cluster. It is recommended that you use a Service account to launch the RHOCP scan. With the Service account, the session token associated with it will not expire. The regular account's Access Token default lifetime is 24 hours (86400 seconds).

3. Download the Qualys Cloud Agent for CoreOS in case you haven't downloaded it.

4. Untar the package file of the Qualys Cloud Agent container image and access Qualys Cloud Agent. 
   Ensure that the agent deployment file lxa-openshift-crio-ds.yml is present in the container package.

5. Add the environment variable name 'QTOKEN' under the 'env' section of the file. It represents the created service account 'token' value, which will be used by Qualys in the discovery code of RHOCP along with 'oc login' command to log into the OpenShift cluster.

   Example: Adding an environment variable - QTOKEN - in the Agent deployment file
   The Agent deployment file defines the token value of the service account.
   a. Open the Agent deployment file and search below mentioned # content.

       # uncomment (and indent properly) below section if proxy (with CA cert) required to connect Qualys Cloud
       #             env:
       #                - name: qualys_https_proxy
       #                  value: <proxy FQDN or Ip address>:<port#>
                
   b. Replace "qualys_https_proxy" name with "QTOKEN" and specify the service account token in the value field.
                  env:
                   - name: QTOKEN
                     value: <service account token>

6. Deploy the Qualys Cloud Agent deployment file "lxa-openshift-crio-ds.yml" with the newly added environment variable "QTOKEN" to run the Agent as a container on the host.

Generating PC Report using Bastion Host 

To generate a PC Report using Bastion Host, follow the steps mentioned below.

1.  Install the oc CLI client on the host.

2. Create a service account and assign a cluster-reader role to this account.
   The cluster-reader role grants users the ability to read all resources in the cluster. It is recommended that you use a Service account to launch the RHOCP scan. With the Service account, the session token associated with it will not expire. The regular account's Access Token default lifetime is 24 hours (86400 seconds).

3. Run the "oc login" command on the host using the created service account server IP and token with the "--server" and "--token" options.

   Example: Executing "oc login" command

   Provide the Server IP using "--server" option and the token with the "--token" option.

   oc login --server=<server IP/URL> --token=<token>

   Once the "oc login" command is successfully executed, it automatically makes an entry of your login details such as - server, user, and token details into its configuration file ".kube/config". The configuration file needs to be configured properly with server, user, and token details.

   Example: /root/.kube/config Content

   apiVersion: v1
   clusters:
     - cluster:
         certificate-authority-data: >-
           <data>
   server: '<server>:6443'
   name: '<name>:6443'
   contexts:
     - context:
         cluster: '<cluster>:6443'
   namespace: default
         user: ahutest
       name: ahutest
   current-context: ahutest
   kind: Config
   preferences: {}
   users:
     - name: ahutest
       user:
         token: >-
           <token>

4. Start the Qualys Scanner or Qualys Cloud Agent depending upon your requirement.

You can test the following commands on the host root account. Server Version 4.xxx is used as the flag of found RHOCP 4.x.

• which oc

• oc version

     Example: Running "which oc" and "oc version" commands

   [root@OSCP-Cent76 ~]# which oc
   /openshift/oc
   [root@OSCP-Cent76 ~]# oc version
   Client Version: 4.7.16
   Server Version: 4.7.16
   Kubernetes Version: v1.20.0+2817867